Re: [PATCH v2] Bluetooth: fix use-after-free error in lock_sock_nested()

On Mon, 19 Jul 2021 17:03:53 +0800 Wang ShaoBo wrote:

quoted

I have tried this before, this will trigger error "underflow of refcount
of chan" as following:

[  118.708179][ T3086] ------------[ cut here ]------------
[  118.710172][ T3086] refcount_t: underflow; use-after-free.
[  118.713391][ T3086] WARNING: CPU: 4 PID: 3086 at lib/refcount.c:28
refcount_warn_saturate+0x30a/0x3c0
[  118.716774][ T3086] Modules linked in:
[  118.718279][ T3086] CPU: 4 PID: 3086 Comm: kworker/4:2 Not tainted
5.12.0-rc6+ #84
[  118.721005][ T3086] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[  118.722846][ T3086] Workqueue: events l2cap_chan_timeout
[  118.723786][ T3086] RIP: 0010:refcount_warn_saturate+0x30a/0x3c0
...
[  118.737912][ T3086] CR2: 0000000020000040 CR3: 0000000011029000 CR4:
00000000000006e0
[  118.739187][ T3086] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[  118.740451][ T3086] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[  118.741720][ T3086] Call Trace:
[  118.742262][ T3086]  l2cap_sock_close_cb+0x165/0x170
[  118.743124][ T3086]  ? l2cap_sock_teardown_cb+0x560/0x560

Actually, if adding sock_hold(sk) in l2cap_sock_init(),
l2cap_sock_kill() will continue to excute untill it found

now chan's refcount is 0, this is because sock was not freed in last
round execution of l2cap_sock_kill().

Well double kill cannot be walked around without adding more - add the
destroy callback to make the chan->data recorded sock survive kill. It
will be released when chan is destroyed to cut the race in reguards to
accessing sock by making chan->data stable throughout chan's lifespan.

+++ x/net/bluetooth/l2cap_core.c

@@ -485,7 +485,10 @@ static void l2cap_chan_destroy(struct kr
        list_del(&chan->global_l);
        write_unlock(&chan_list_lock);

-       kfree(chan);
+       if (chan->ops && chan->ops->destroy)
+               chan->ops->destroy(chan);
+       else
+               kfree(chan);

 }

 void l2cap_chan_hold(struct l2cap_chan *c)

+++ x/net/bluetooth/l2cap_sock.c

@@ -1220,11 +1220,13 @@ static void l2cap_sock_kill(struct sock

        BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));

+       /* double kill means noop */
+       if (sock_flag(sk, SOCK_DEAD))
+               return;
        /* Kill poor orphan */

        l2cap_chan_put(l2cap_pi(sk)->chan);
        sock_set_flag(sk, SOCK_DEAD);
-       sock_put(sk);
 }

 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)

@@ -1504,6 +1506,14 @@ done:
        return err;
 }

+static void l2cap_sock_destroy_cb(struct l2cap_chan *chan)
+{
+       struct sock *sk = chan->data;
+
+       sock_put(sk);
+       kfree(chan);
+}
+
 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
 {
        struct sock *sk = chan->data;

@@ -1690,6 +1700,7 @@ static const struct l2cap_ops l2cap_chan
        .new_connection         = l2cap_sock_new_connection_cb,
        .recv                   = l2cap_sock_recv_cb,
        .close                  = l2cap_sock_close_cb,
+       .destroy                = l2cap_sock_destroy_cb,