From: gregkh@linuxfoundation.org
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Oliver Hartkopp <socketcan@hartkopp.net>,
Andre Naujoks <nautsch2@gmail.com>,
Eric Dumazet <edumazet@google.com>,
Oleksij Rempel <o.rempel@pengutronix.de>,
Marc Kleine-Budde <mkl@pengutronix.de>
Subject: [PATCH 4.19 006/120] can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership
Date: Mon, 15 Mar 2021 14:55:57 +0100 [thread overview]
Message-ID: <20210315135720.226530585@linuxfoundation.org> (raw)
In-Reply-To: <20210315135720.002213995@linuxfoundation.org>
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
From: Oleksij Rempel <o.rempel@pengutronix.de>
commit e940e0895a82c6fbaa259f2615eb52b57ee91a7e upstream.
There are two ref count variables controlling the free()ing of a socket:
- struct sock::sk_refcnt - which is changed by sock_hold()/sock_put()
- struct sock::sk_wmem_alloc - which accounts the memory allocated by
the skbs in the send path.
In case there are still TX skbs on the fly and the socket() is closed,
the struct sock::sk_refcnt reaches 0. In the TX-path the CAN stack
clones an "echo" skb, calls sock_hold() on the original socket and
references it. This produces the following back trace:
| WARNING: CPU: 0 PID: 280 at lib/refcount.c:25 refcount_warn_saturate+0x114/0x134
| refcount_t: addition on 0; use-after-free.
| Modules linked in: coda_vpu(E) v4l2_jpeg(E) videobuf2_vmalloc(E) imx_vdoa(E)
| CPU: 0 PID: 280 Comm: test_can.sh Tainted: G E 5.11.0-04577-gf8ff6603c617 #203
| Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
| Backtrace:
| [<80bafea4>] (dump_backtrace) from [<80bb0280>] (show_stack+0x20/0x24) r7:00000000 r6:600f0113 r5:00000000 r4:81441220
| [<80bb0260>] (show_stack) from [<80bb593c>] (dump_stack+0xa0/0xc8)
| [<80bb589c>] (dump_stack) from [<8012b268>] (__warn+0xd4/0x114) r9:00000019 r8:80f4a8c2 r7:83e4150c r6:00000000 r5:00000009 r4:80528f90
| [<8012b194>] (__warn) from [<80bb09c4>] (warn_slowpath_fmt+0x88/0xc8) r9:83f26400 r8:80f4a8d1 r7:00000009 r6:80528f90 r5:00000019 r4:80f4a8c2
| [<80bb0940>] (warn_slowpath_fmt) from [<80528f90>] (refcount_warn_saturate+0x114/0x134) r8:00000000 r7:00000000 r6:82b44000 r5:834e5600 r4:83f4d540
| [<80528e7c>] (refcount_warn_saturate) from [<8079a4c8>] (__refcount_add.constprop.0+0x4c/0x50)
| [<8079a47c>] (__refcount_add.constprop.0) from [<8079a57c>] (can_put_echo_skb+0xb0/0x13c)
| [<8079a4cc>] (can_put_echo_skb) from [<8079ba98>] (flexcan_start_xmit+0x1c4/0x230) r9:00000010 r8:83f48610 r7:0fdc0000 r6:0c080000 r5:82b44000 r4:834e5600
| [<8079b8d4>] (flexcan_start_xmit) from [<80969078>] (netdev_start_xmit+0x44/0x70) r9:814c0ba0 r8:80c8790c r7:00000000 r6:834e5600 r5:82b44000 r4:82ab1f00
| [<80969034>] (netdev_start_xmit) from [<809725a4>] (dev_hard_start_xmit+0x19c/0x318) r9:814c0ba0 r8:00000000 r7:82ab1f00 r6:82b44000 r5:00000000 r4:834e5600
| [<80972408>] (dev_hard_start_xmit) from [<809c6584>] (sch_direct_xmit+0xcc/0x264) r10:834e5600 r9:00000000 r8:00000000 r7:82b44000 r6:82ab1f00 r5:834e5600 r4:83f27400
| [<809c64b8>] (sch_direct_xmit) from [<809c6c0c>] (__qdisc_run+0x4f0/0x534)
To fix this problem, only set skb ownership to sockets which have still
a ref count > 0.
Fixes: 0ae89beb283a ("can: add destructor for self generated skbs")
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: Andre Naujoks <nautsch2@gmail.com>
Link: https://lore.kernel.org/r/20210226092456.27126-1-o.rempel@pengutronix.de
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/can/skb.h | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -49,8 +49,12 @@ static inline void can_skb_reserve(struc
static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
{
- if (sk) {
- sock_hold(sk);
+ /* If the socket has already been closed by user space, the
+ * refcount may already be 0 (and the socket will be freed
+ * after the last TX skb has been freed). So only increase
+ * socket refcount if the refcount is > 0.
+ */
+ if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) {
skb->destructor = sock_efree;
skb->sk = sk;
}
next prev parent reply other threads:[~2021-03-15 14:08 UTC|newest]
Thread overview: 138+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-15 13:55 [PATCH 4.19 000/120] 4.19.181-rc1 review gregkh
2021-03-15 13:55 ` [PATCH 4.19 001/120] uapi: nfnetlink_cthelper.h: fix userspace compilation error gregkh
2021-03-15 13:55 ` [PATCH 4.19 002/120] ethernet: alx: fix order of calls on resume gregkh
2021-03-15 13:55 ` [PATCH 4.19 003/120] ath9k: fix transmitting to stations in dynamic SMPS mode gregkh
2021-03-15 13:55 ` [PATCH 4.19 004/120] net: Fix gro aggregation for udp encaps with zero csum gregkh
2021-03-15 13:55 ` [PATCH 4.19 005/120] net: Introduce parse_protocol header_ops callback gregkh
2021-03-15 13:55 ` gregkh [this message]
2021-03-15 13:55 ` [PATCH 4.19 007/120] can: flexcan: assert FRZ bit in flexcan_chip_freeze() gregkh
2021-03-15 13:55 ` [PATCH 4.19 008/120] can: flexcan: enable RX FIFO after FRZ/HALT valid gregkh
2021-03-15 13:56 ` [PATCH 4.19 009/120] netfilter: x_tables: gpf inside xt_find_revision() gregkh
2021-03-15 13:56 ` [PATCH 4.19 010/120] mt76: dma: do not report truncated frames to mac80211 gregkh
2021-03-15 13:56 ` [PATCH 4.19 011/120] tcp: annotate tp->copied_seq lockless reads gregkh
2021-03-16 9:41 ` Pavel Machek
2021-03-16 9:48 ` Greg KH
2021-03-16 9:49 ` Eric Dumazet
2021-03-15 13:56 ` [PATCH 4.19 012/120] tcp: annotate tp->write_seq " gregkh
2021-03-16 9:50 ` Pavel Machek
2021-03-16 9:52 ` Eric Dumazet
2021-03-16 9:53 ` Pavel Machek
2021-03-16 9:59 ` Eric Dumazet
2021-03-15 13:56 ` [PATCH 4.19 013/120] tcp: add sanity tests to TCP_QUEUE_SEQ gregkh
2021-03-15 13:56 ` [PATCH 4.19 014/120] cifs: return proper error code in statfs(2) gregkh
2021-03-15 13:56 ` [PATCH 4.19 015/120] scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section names gregkh
2021-03-15 13:56 ` [PATCH 4.19 016/120] Revert "mm, slub: consider rest of partial list if acquire_slab() fails" gregkh
2021-03-15 13:56 ` [PATCH 4.19 017/120] sh_eth: fix TRSCER mask for SH771x gregkh
2021-03-15 13:56 ` [PATCH 4.19 018/120] net: check if protocol extracted by virtio_net_hdr_set_proto is correct gregkh
2021-03-15 13:56 ` [PATCH 4.19 019/120] net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 gregkh
2021-03-15 13:56 ` [PATCH 4.19 020/120] net/mlx4_en: update moderation when config reset gregkh
2021-03-15 13:56 ` [PATCH 4.19 021/120] net: stmmac: fix incorrect DMA channel intr enable setting of EQoS v4.10 gregkh
2021-03-15 13:56 ` [PATCH 4.19 022/120] net: sched: avoid duplicates in classes dump gregkh
2021-03-15 13:56 ` [PATCH 4.19 023/120] net: usb: qmi_wwan: allow qmimux add/del with master up gregkh
2021-03-15 13:56 ` [PATCH 4.19 024/120] cipso,calipso: resolve a number of problems with the DOI refcounts gregkh
2021-03-15 13:56 ` [PATCH 4.19 025/120] net: lapbether: Remove netif_start_queue / netif_stop_queue gregkh
2021-03-15 13:56 ` [PATCH 4.19 026/120] net: davicom: Fix regulator not turned off on failed probe gregkh
2021-03-15 13:56 ` [PATCH 4.19 027/120] net: davicom: Fix regulator not turned off on driver removal gregkh
2021-03-15 13:56 ` [PATCH 4.19 028/120] net: qrtr: fix error return code of qrtr_sendmsg() gregkh
2021-03-15 13:56 ` [PATCH 4.19 029/120] net: stmmac: stop each tx channel independently gregkh
2021-03-15 13:56 ` [PATCH 4.19 030/120] net: stmmac: fix watchdog timeout during suspend/resume stress test gregkh
2021-03-15 13:56 ` [PATCH 4.19 031/120] selftests: forwarding: Fix race condition in mirror installation gregkh
2021-03-15 13:56 ` [PATCH 4.19 032/120] perf traceevent: Ensure read cmdlines are null terminated gregkh
2021-03-15 13:56 ` [PATCH 4.19 033/120] s390/cio: return -EFAULT if copy_to_user() fails again gregkh
2021-03-15 13:56 ` [PATCH 4.19 034/120] drm/compat: Clear bounce structures gregkh
2021-03-15 13:56 ` [PATCH 4.19 035/120] drm: meson_drv add shutdown function gregkh
2021-03-15 13:56 ` [PATCH 4.19 036/120] s390/cio: return -EFAULT if copy_to_user() fails gregkh
2021-03-15 13:56 ` [PATCH 4.19 037/120] sh_eth: fix TRSCER mask for R7S9210 gregkh
2021-03-15 13:56 ` [PATCH 4.19 038/120] media: usbtv: Fix deadlock on suspend gregkh
2021-03-15 13:56 ` [PATCH 4.19 039/120] media: v4l: vsp1: Fix uif null pointer access gregkh
2021-03-15 13:56 ` [PATCH 4.19 040/120] media: v4l: vsp1: Fix bru " gregkh
2021-03-15 13:56 ` [PATCH 4.19 041/120] net: phy: fix save wrong speed and duplex problem if autoneg is on gregkh
2021-03-15 13:56 ` [PATCH 4.19 042/120] i2c: rcar: optimize cacheline to minimize HW race condition gregkh
2021-03-15 13:56 ` [PATCH 4.19 043/120] udf: fix silent AED tagLocation corruption gregkh
2021-03-15 13:56 ` [PATCH 4.19 044/120] mmc: mxs-mmc: Fix a resource leak in an error handling path in mxs_mmc_probe() gregkh
2021-03-15 13:56 ` [PATCH 4.19 045/120] mmc: mediatek: fix race condition between msdc_request_timeout and irq gregkh
2021-03-15 13:56 ` [PATCH 4.19 046/120] powerpc/pci: Add ppc_md.discover_phbs() gregkh
2021-03-15 13:56 ` [PATCH 4.19 047/120] powerpc: improve handling of unrecoverable system reset gregkh
2021-03-15 13:56 ` [PATCH 4.19 048/120] powerpc/perf: Record counter overflow always if SAMPLE_IP is unset gregkh
2021-03-15 13:56 ` [PATCH 4.19 049/120] sparc32: Limit memblock allocation to low memory gregkh
2021-03-15 13:56 ` [PATCH 4.19 050/120] sparc64: Use arch_validate_flags() to validate ADI flag gregkh
2021-03-15 13:56 ` [PATCH 4.19 051/120] PCI: xgene-msi: Fix race in installing chained irq handler gregkh
2021-03-15 13:56 ` [PATCH 4.19 052/120] PCI: mediatek: Add missing of_node_put() to fix reference leak gregkh
2021-03-15 13:56 ` [PATCH 4.19 053/120] PCI: Fix pci_register_io_range() memory leak gregkh
2021-03-15 13:56 ` [PATCH 4.19 054/120] i40e: Fix memory leak in i40e_probe gregkh
2021-03-15 13:56 ` [PATCH 4.19 055/120] s390/smp: __smp_rescan_cpus() - move cpumask away from stack gregkh
2021-03-15 13:56 ` [PATCH 4.19 056/120] scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling gregkh
2021-03-15 13:56 ` [PATCH 4.19 057/120] scsi: target: core: Add cmd length set before cmd complete gregkh
2021-03-15 13:56 ` [PATCH 4.19 058/120] scsi: target: core: Prevent underflow for service actions gregkh
2021-03-15 13:56 ` [PATCH 4.19 059/120] ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk gregkh
2021-03-15 13:56 ` [PATCH 4.19 060/120] ALSA: hda/hdmi: Cancel pending works before suspend gregkh
2021-03-15 13:56 ` [PATCH 4.19 061/120] ALSA: hda: Drop the BATCH workaround for AMD controllers gregkh
2021-03-15 13:56 ` [PATCH 4.19 062/120] ALSA: hda: Avoid spurious unsol event handling during S3/S4 gregkh
2021-03-15 13:56 ` [PATCH 4.19 063/120] ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar gregkh
2021-03-15 13:56 ` [PATCH 4.19 064/120] ALSA: usb-audio: Apply the control quirk to Plantronics headsets gregkh
2021-03-15 13:56 ` [PATCH 4.19 065/120] Revert 95ebabde382c ("capabilities: Dont allow writing ambiguous v3 file capabilities") gregkh
2021-03-15 13:56 ` [PATCH 4.19 066/120] s390/dasd: fix hanging DASD driver unbind gregkh
2021-03-15 13:56 ` [PATCH 4.19 067/120] s390/dasd: fix hanging IO request during " gregkh
2021-03-15 13:56 ` [PATCH 4.19 068/120] mmc: core: Fix partition switch time for eMMC gregkh
2021-03-15 13:57 ` [PATCH 4.19 069/120] mmc: cqhci: Fix random crash when remove mmc module/card gregkh
2021-03-15 13:57 ` [PATCH 4.19 070/120] Goodix Fingerprint device is not a modem gregkh
2021-03-15 13:57 ` [PATCH 4.19 071/120] USB: gadget: u_ether: Fix a configfs return code gregkh
2021-03-15 13:57 ` [PATCH 4.19 072/120] usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot gregkh
2021-03-15 13:57 ` [PATCH 4.19 073/120] usb: gadget: f_uac1: stop playback on function disable gregkh
2021-03-15 13:57 ` [PATCH 4.19 074/120] usb: dwc3: qcom: Honor wakeup enabled/disabled state gregkh
2021-03-15 13:57 ` [PATCH 4.19 075/120] USB: usblp: fix a hang in poll() if disconnected gregkh
2021-03-15 13:57 ` [PATCH 4.19 076/120] usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM gregkh
2021-03-15 13:57 ` [PATCH 4.19 077/120] xhci: Improve detection of device initiated wake signal gregkh
2021-03-15 13:57 ` [PATCH 4.19 078/120] usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing gregkh
2021-03-15 13:57 ` [PATCH 4.19 079/120] USB: serial: io_edgeport: fix memory leak in edge_startup gregkh
2021-03-15 13:57 ` [PATCH 4.19 080/120] USB: serial: ch341: add new Product ID gregkh
2021-03-15 13:57 ` [PATCH 4.19 081/120] USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter gregkh
2021-03-15 13:57 ` [PATCH 4.19 082/120] USB: serial: cp210x: add some more GE USB IDs gregkh
2021-03-15 13:57 ` [PATCH 4.19 083/120] usbip: fix stub_dev to check for stream socket gregkh
2021-03-15 13:57 ` [PATCH 4.19 084/120] usbip: fix vhci_hcd " gregkh
2021-03-15 13:57 ` [PATCH 4.19 085/120] usbip: fix vudc " gregkh
2021-03-15 13:57 ` [PATCH 4.19 086/120] usbip: fix stub_dev usbip_sockfd_store() races leading to gpf gregkh
2021-03-15 13:57 ` [PATCH 4.19 087/120] usbip: fix vhci_hcd attach_store() " gregkh
2021-03-15 13:57 ` [PATCH 4.19 088/120] usbip: fix vudc usbip_sockfd_store " gregkh
2021-03-15 13:57 ` [PATCH 4.19 089/120] staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan() gregkh
2021-03-15 13:57 ` [PATCH 4.19 090/120] staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan() gregkh
2021-03-15 13:57 ` [PATCH 4.19 091/120] staging: rtl8712: unterminated string leads to read overflow gregkh
2021-03-15 13:57 ` [PATCH 4.19 092/120] staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data() gregkh
2021-03-15 13:57 ` [PATCH 4.19 093/120] staging: ks7010: prevent buffer overflow in ks_wlan_set_scan() gregkh
2021-03-15 13:57 ` [PATCH 4.19 094/120] staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd gregkh
2021-03-15 13:57 ` [PATCH 4.19 095/120] staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan gregkh
2021-03-15 13:57 ` [PATCH 4.19 096/120] staging: comedi: addi_apci_1032: Fix endian problem for COS sample gregkh
2021-03-15 13:57 ` [PATCH 4.19 097/120] staging: comedi: addi_apci_1500: Fix endian problem for command sample gregkh
2021-03-15 13:57 ` [PATCH 4.19 098/120] staging: comedi: adv_pci1710: Fix endian problem for AI command data gregkh
2021-03-15 13:57 ` [PATCH 4.19 099/120] staging: comedi: das6402: " gregkh
2021-03-15 13:57 ` [PATCH 4.19 100/120] staging: comedi: das800: " gregkh
2021-03-15 13:57 ` [PATCH 4.19 101/120] staging: comedi: dmm32at: " gregkh
2021-03-15 13:57 ` [PATCH 4.19 102/120] staging: comedi: me4000: " gregkh
2021-03-15 13:57 ` [PATCH 4.19 103/120] staging: comedi: pcl711: " gregkh
2021-03-15 13:57 ` [PATCH 4.19 104/120] staging: comedi: pcl818: " gregkh
2021-03-15 13:57 ` [PATCH 4.19 105/120] sh_eth: fix TRSCER mask for R7S72100 gregkh
2021-03-15 13:57 ` [PATCH 4.19 106/120] NFSv4.2: fix return value of _nfs4_get_security_label() gregkh
2021-03-15 13:57 ` [PATCH 4.19 107/120] block: rsxx: fix error return code of rsxx_pci_probe() gregkh
2021-03-15 13:57 ` [PATCH 4.19 108/120] configfs: fix a use-after-free in __configfs_open_file gregkh
2021-03-15 13:57 ` [PATCH 4.19 109/120] hrtimer: Update softirq_expires_next correctly after __hrtimer_get_next_event() gregkh
2021-03-15 13:57 ` [PATCH 4.19 110/120] stop_machine: mark helpers __always_inline gregkh
2021-03-15 13:57 ` [PATCH 4.19 111/120] include/linux/sched/mm.h: use rcu_dereference in in_vfork() gregkh
2021-03-15 13:57 ` [PATCH 4.19 112/120] prctl: fix PR_SET_MM_AUXV kernel stack leak gregkh
2021-03-15 13:57 ` [PATCH 4.19 113/120] powerpc/64s: Fix instruction encoding for lis in ppc_function_entry() gregkh
2021-03-15 13:57 ` [PATCH 4.19 114/120] binfmt_misc: fix possible deadlock in bm_register_write gregkh
2021-03-15 13:57 ` [PATCH 4.19 115/120] x86/unwind/orc: Disable KASAN checking in the ORC unwinder, part 2 gregkh
2021-03-15 13:57 ` [PATCH 4.19 116/120] hwmon: (lm90) Fix max6658 sporadic wrong temperature reading gregkh
2021-03-15 13:57 ` [PATCH 4.19 117/120] KVM: arm64: Fix exclusive limit for IPA size gregkh
2021-03-15 13:57 ` [PATCH 4.19 118/120] xen/events: reset affinity of 2-level event when tearing it down gregkh
2021-03-15 13:57 ` [PATCH 4.19 119/120] xen/events: dont unmask an event channel when an eoi is pending gregkh
2021-03-15 13:57 ` [PATCH 4.19 120/120] xen/events: avoid handling the same event on two cpus at the same time gregkh
2021-03-15 17:07 ` [PATCH 4.19 000/120] 4.19.181-rc1 review Jon Hunter
2021-03-15 21:38 ` Pavel Machek
2021-03-15 22:57 ` Jason Self
2021-03-16 9:33 ` Naresh Kamboju
2021-03-16 21:13 ` Guenter Roeck
2021-03-17 1:11 ` Samuel Zou
2021-03-17 2:57 ` Ross Schmidt
2021-03-18 11:59 ` Samuel Zou
2021-03-19 9:41 ` Greg KH
2021-03-19 1:50 ` Samuel Zou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210315135720.226530585@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mkl@pengutronix.de \
--cc=nautsch2@gmail.com \
--cc=o.rempel@pengutronix.de \
--cc=socketcan@hartkopp.net \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.