Re: [PATCH v2] Bluetooth: fix use-after-free error in lock_sock_nested()

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

Hi Hillf,

On Mon, Jul 19, 2021 at 7:16 PM Hillf Danton <hdanton@sina.com> wrote:
>
> On Mon, 19 Jul 2021 17:03:53 +0800 Wang ShaoBo wrote:
> >
> >I have tried this before, this will trigger error "underflow of refcount
> >of chan" as following:
> >
> >[  118.708179][ T3086] ------------[ cut here ]------------
> >[  118.710172][ T3086] refcount_t: underflow; use-after-free.
> >[  118.713391][ T3086] WARNING: CPU: 4 PID: 3086 at lib/refcount.c:28
> >refcount_warn_saturate+0x30a/0x3c0
> >[  118.716774][ T3086] Modules linked in:
> >[  118.718279][ T3086] CPU: 4 PID: 3086 Comm: kworker/4:2 Not tainted
> >5.12.0-rc6+ #84
> >[  118.721005][ T3086] Hardware name: QEMU Standard PC (i440FX + PIIX,
> >1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> >[  118.722846][ T3086] Workqueue: events l2cap_chan_timeout
> >[  118.723786][ T3086] RIP: 0010:refcount_warn_saturate+0x30a/0x3c0
> >...
> >[  118.737912][ T3086] CR2: 0000000020000040 CR3: 0000000011029000 CR4:
> >00000000000006e0
> >[  118.739187][ T3086] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> >0000000000000000
> >[  118.740451][ T3086] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> >0000000000000400
> >[  118.741720][ T3086] Call Trace:
> >[  118.742262][ T3086]  l2cap_sock_close_cb+0x165/0x170
> >[  118.743124][ T3086]  ? l2cap_sock_teardown_cb+0x560/0x560
> >
> >Actually, if adding sock_hold(sk) in l2cap_sock_init(),
> >l2cap_sock_kill() will continue to excute untill it found
> >
> >now chan's refcount is 0, this is because sock was not freed in last
> >round execution of l2cap_sock_kill().
>
> Well double kill cannot be walked around without adding more - add the
> destroy callback to make the chan->data recorded sock survive kill. It
> will be released when chan is destroyed to cut the race in reguards to
> accessing sock by making chan->data stable throughout chan's lifespan.
>
>
> +++ x/net/bluetooth/l2cap_core.c
> @@ -485,7 +485,10 @@ static void l2cap_chan_destroy(struct kr
>         list_del(&chan->global_l);
>         write_unlock(&chan_list_lock);
>
> -       kfree(chan);
> +       if (chan->ops && chan->ops->destroy)
> +               chan->ops->destroy(chan);
> +       else
> +               kfree(chan);

While Im fine adding a destroy callback the kfree shall be still in
l2cap_chan_destroy:

if (chan->ops && chan->ops->destroy)
  /* Destroy chan->data */
  chan->ops->destroy(chan->data);

kfree(chan);

>  }
>
>  void l2cap_chan_hold(struct l2cap_chan *c)
> +++ x/net/bluetooth/l2cap_sock.c
> @@ -1220,11 +1220,13 @@ static void l2cap_sock_kill(struct sock
>
>         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
>
> +       /* double kill means noop */
> +       if (sock_flag(sk, SOCK_DEAD))
> +               return;
>         /* Kill poor orphan */
>
>         l2cap_chan_put(l2cap_pi(sk)->chan);
>         sock_set_flag(sk, SOCK_DEAD);
> -       sock_put(sk);
>  }
>
>  static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
> @@ -1504,6 +1506,14 @@ done:
>         return err;
>  }
>
> +static void l2cap_sock_destroy_cb(struct l2cap_chan *chan)
> +{
> +       struct sock *sk = chan->data;
> +
> +       sock_put(sk);
> +       kfree(chan);
> +}
> +
>  static void l2cap_sock_close_cb(struct l2cap_chan *chan)
>  {
>         struct sock *sk = chan->data;
> @@ -1690,6 +1700,7 @@ static const struct l2cap_ops l2cap_chan
>         .new_connection         = l2cap_sock_new_connection_cb,
>         .recv                   = l2cap_sock_recv_cb,
>         .close                  = l2cap_sock_close_cb,
> +       .destroy                = l2cap_sock_destroy_cb,

If you do the changes above you can probably have sock_put directly
set as .destroy.

>         .teardown               = l2cap_sock_teardown_cb,
>         .state_change           = l2cap_sock_state_change_cb,
>         .ready                  = l2cap_sock_ready_cb,



-- 
Luiz Augusto von Dentz