Oleksij Rempel
d7ca4e9bdf
can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership
...
commit e940e0895a upstream.
There are two ref count variables controlling the free()ing of a socket:
- struct sock::sk_refcnt - which is changed by sock_hold()/sock_put()
- struct sock::sk_wmem_alloc - which accounts the memory allocated by
the skbs in the send path.
In case there are still TX skbs on the fly and the socket() is closed,
the struct sock::sk_refcnt reaches 0. In the TX-path the CAN stack
clones an "echo" skb, calls sock_hold() on the original socket and
references it. This produces the following back trace:
| WARNING: CPU: 0 PID: 280 at lib/refcount.c:25 refcount_warn_saturate+0x114/0x134
| refcount_t: addition on 0; use-after-free.
| Modules linked in: coda_vpu(E) v4l2_jpeg(E) videobuf2_vmalloc(E) imx_vdoa(E)
| CPU: 0 PID: 280 Comm: test_can.sh Tainted: G E 5.11.0-04577-gf8ff6603c617 #203
| Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
| Backtrace:
| [<80bafea4>] (dump_backtrace) from [<80bb0280>] (show_stack+0x20/0x24) r7:00000000 r6:600f0113 r5:00000000 r4:81441220
| [<80bb0260>] (show_stack) from [<80bb593c>] (dump_stack+0xa0/0xc8)
| [<80bb589c>] (dump_stack) from [<8012b268>] (__warn+0xd4/0x114) r9:00000019 r8:80f4a8c2 r7:83e4150c r6:00000000 r5:00000009 r4:80528f90
| [<8012b194>] (__warn) from [<80bb09c4>] (warn_slowpath_fmt+0x88/0xc8) r9:83f26400 r8:80f4a8d1 r7:00000009 r6:80528f90 r5:00000019 r4:80f4a8c2
| [<80bb0940>] (warn_slowpath_fmt) from [<80528f90>] (refcount_warn_saturate+0x114/0x134) r8:00000000 r7:00000000 r6:82b44000 r5:834e5600 r4:83f4d540
| [<80528e7c>] (refcount_warn_saturate) from [<8079a4c8>] (__refcount_add.constprop.0+0x4c/0x50)
| [<8079a47c>] (__refcount_add.constprop.0) from [<8079a57c>] (can_put_echo_skb+0xb0/0x13c)
| [<8079a4cc>] (can_put_echo_skb) from [<8079ba98>] (flexcan_start_xmit+0x1c4/0x230) r9:00000010 r8:83f48610 r7:0fdc0000 r6:0c080000 r5:82b44000 r4:834e5600
| [<8079b8d4>] (flexcan_start_xmit) from [<80969078>] (netdev_start_xmit+0x44/0x70) r9:814c0ba0 r8:80c8790c r7:00000000 r6:834e5600 r5:82b44000 r4:82ab1f00
| [<80969034>] (netdev_start_xmit) from [<809725a4>] (dev_hard_start_xmit+0x19c/0x318) r9:814c0ba0 r8:00000000 r7:82ab1f00 r6:82b44000 r5:00000000 r4:834e5600
| [<80972408>] (dev_hard_start_xmit) from [<809c6584>] (sch_direct_xmit+0xcc/0x264) r10:834e5600 r9:00000000 r8:00000000 r7:82b44000 r6:82ab1f00 r5:834e5600 r4:83f27400
| [<809c64b8>] (sch_direct_xmit) from [<809c6c0c>] (__qdisc_run+0x4f0/0x534)
To fix this problem, only set skb ownership to sockets which have still
a ref count > 0.
Fixes: 0ae89beb28 ("can: add destructor for self generated skbs")
Cc: Oliver Hartkopp <socketcan@hartkopp.net >
Cc: Andre Naujoks <nautsch2@gmail.com >
Link: https://lore.kernel.org/r/20210226092456.27126-1-o.rempel@pengutronix.de
Suggested-by: Eric Dumazet <edumazet@google.com >
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de >
Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net >
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2021-03-17 16:43:42 +01:00
..
2019-12-13 08:51:18 +01:00
2019-01-22 21:40:33 +01:00
2021-03-17 16:43:42 +01:00
2020-04-02 15:28:16 +02:00
2018-08-18 15:55:59 -07:00
2018-01-04 13:35:07 -05:00
2018-08-05 17:11:49 -07:00
2019-12-05 09:20:15 +01:00
2020-04-29 16:31:24 +02:00
2020-01-27 14:50:42 +01:00
2019-12-17 20:35:45 +01:00
2020-06-03 08:19:11 +02:00
2020-10-01 13:14:28 +02:00
2020-11-05 11:08:34 +01:00
2020-12-30 11:25:45 +01:00
2020-01-27 14:51:19 +01:00
2020-02-01 09:37:10 +00:00
2020-06-30 23:17:12 -04:00
2020-01-23 08:21:39 +01:00
2021-01-30 13:32:11 +01:00
2020-12-11 13:25:03 +01:00
2021-02-13 13:51:14 +01:00
2020-11-05 11:08:40 +01:00
2021-01-19 18:22:36 +01:00
2017-11-02 11:10:55 +01:00
2020-01-09 10:19:01 +01:00
2017-11-02 11:10:55 +01:00
2018-06-15 18:10:01 -03:00
2018-06-15 18:10:01 -03:00
2017-02-16 10:08:41 +05:30
2013-03-12 13:59:14 -07:00
2018-01-10 23:25:08 -05:00
2019-12-13 08:52:59 +01:00
2018-06-17 08:27:01 +09:00
2012-03-16 10:38:24 -04:00
2018-06-19 10:43:55 -04:00
2016-10-11 15:06:31 -07:00
2017-11-02 11:10:55 +01:00
2017-11-07 10:32:44 +01:00
2019-03-05 17:58:50 +01:00
2021-02-13 13:51:15 +01:00
2019-05-31 06:46:00 -07:00
2017-11-02 11:10:55 +01:00
2020-08-19 08:15:05 +02:00
2019-12-01 09:17:07 +01:00
2020-06-25 15:33:02 +02:00
2019-04-17 08:38:51 +02:00
2019-10-05 13:10:03 +02:00
2021-03-04 09:39:30 +01:00
2020-04-29 16:31:17 +02:00
2017-11-02 11:10:55 +01:00
2019-01-31 08:14:41 +01:00
2019-07-03 13:14:48 +02:00
2019-05-25 18:23:48 +02:00
2020-04-23 10:30:12 +02:00
2019-10-05 13:09:54 +02:00
2020-12-30 11:25:39 +01:00
2020-09-09 19:04:31 +02:00
2017-11-02 11:10:55 +01:00
2018-06-05 18:06:24 +01:00
2017-11-02 11:10:55 +01:00
2019-08-16 10:12:38 +02:00
2020-07-22 09:32:00 +02:00
2020-07-22 09:32:00 +02:00
2018-06-15 18:10:01 -03:00
2019-04-05 22:33:03 +02:00
2018-01-04 15:13:29 -08:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-08-06 19:06:52 +02:00
2019-08-06 19:06:52 +02:00
2017-11-02 11:10:55 +01:00
2021-01-30 13:32:11 +01:00
2019-06-09 09:17:23 +02:00
2020-12-30 11:25:40 +01:00
2021-01-23 15:49:55 +01:00
2019-02-27 10:08:53 +01:00
2020-12-30 11:25:40 +01:00
2017-11-02 11:10:55 +01:00
2008-04-30 08:29:54 -07:00
2018-07-21 09:21:10 +02:00
2018-07-31 13:06:57 +02:00
2017-11-02 11:10:55 +01:00
2013-12-29 15:25:48 +01:00
2017-11-02 11:10:55 +01:00
2018-05-14 08:57:47 +02:00
2011-09-23 12:05:29 +05:30
2019-11-12 19:21:38 +01:00
2019-11-20 18:47:11 +01:00
2019-12-31 16:36:22 +01:00
2019-07-26 09:14:12 +02:00
2019-11-24 08:20:07 +01:00
2019-07-31 07:27:11 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2015-11-16 09:27:32 +05:30
2020-11-05 11:08:35 +01:00
2017-11-02 11:10:55 +01:00
2020-10-01 13:14:28 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2020-04-17 10:48:45 +02:00
2021-03-04 09:39:57 +01:00
2020-03-20 11:55:58 +01:00
2017-11-02 11:10:55 +01:00
2021-01-23 15:49:55 +01:00
2019-12-13 08:51:54 +01:00
2020-02-24 08:34:44 +01:00
2018-03-16 19:58:27 +01:00
2018-07-06 14:43:47 +02:00
2018-04-05 14:21:13 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-06-04 08:02:34 +02:00
2017-11-02 11:10:55 +01:00
2019-11-20 18:47:40 +01:00
2012-10-13 10:46:48 +01:00
2021-03-11 14:05:02 +01:00
2020-09-03 11:24:23 +02:00
2019-05-16 19:41:17 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2021-02-10 09:21:06 +01:00
2020-06-25 15:33:02 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-01-12 17:33:38 -08:00
2017-11-02 11:10:55 +01:00
2018-01-01 12:40:27 -07:00
2018-04-27 11:53:02 -04:00
2020-02-11 04:34:08 -08:00
2018-08-25 13:40:38 -07:00
2017-11-02 11:10:55 +01:00
2018-03-08 10:34:44 +09:00
2019-04-05 22:32:59 +02:00
2017-11-02 11:10:55 +01:00
2019-11-24 08:19:14 +01:00
2017-08-07 17:22:14 +02:00
2017-11-02 11:10:55 +01:00
2018-01-30 21:54:32 +01:00
2014-12-31 13:06:50 -05:00
2018-07-12 10:04:29 -04:00
2021-03-04 09:39:33 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-08-28 16:24:22 +02:00
2020-10-14 10:31:21 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2021-01-30 13:32:13 +01:00
2018-12-17 09:24:38 +01:00
2021-01-06 14:44:58 +01:00
2021-01-06 14:44:58 +01:00
2020-11-05 11:08:35 +01:00
2012-10-13 10:46:48 +01:00
2019-11-20 18:45:55 +01:00
2018-12-01 09:37:31 +01:00
2018-12-05 19:32:10 +01:00
2021-01-30 13:32:12 +01:00
2017-11-02 11:10:55 +01:00
2019-12-05 09:21:03 +01:00
2021-03-11 14:04:59 +01:00
2019-02-12 19:47:14 +01:00
2017-11-02 11:10:55 +01:00
2019-11-10 11:27:40 +01:00
2018-08-02 10:24:51 +02:00
2019-09-10 10:33:44 +01:00
2019-03-23 20:10:08 +01:00
2018-11-13 11:08:54 -08:00
2019-02-12 19:47:24 +01:00
2018-12-05 19:32:13 +01:00
2020-09-09 19:04:22 +02:00
2017-11-02 11:10:55 +01:00
2020-11-05 11:08:54 +01:00
2019-01-13 09:51:04 +01:00
2019-07-31 07:26:59 +02:00
2020-01-04 19:13:32 +01:00
2019-12-17 20:35:45 +01:00
2021-02-10 09:21:08 +01:00
2019-10-17 13:45:42 -07:00
2020-08-11 15:32:33 +02:00
2018-03-08 12:30:37 +01:00
2020-09-23 12:10:59 +02:00
2012-10-13 10:46:48 +01:00
2019-05-08 07:21:43 +02:00
2018-11-21 09:19:20 +01:00
2021-03-04 09:39:59 +01:00
2019-12-05 09:19:39 +01:00
2020-05-10 10:30:12 +02:00
2019-03-05 17:58:51 +01:00
2020-01-12 12:17:25 +01:00
2019-08-09 17:52:34 +02:00
2020-07-22 09:32:00 +02:00
2018-08-15 10:25:26 -07:00
2020-03-18 07:14:11 +01:00
2019-12-01 09:17:05 +01:00
2018-07-21 10:43:12 -05:00
2018-08-22 10:52:47 -07:00
2017-11-02 11:10:55 +01:00
2017-10-19 16:54:49 -07:00
2018-07-18 07:27:22 -04:00
2021-02-03 23:23:26 +01:00
2020-02-28 16:38:59 +01:00
2020-07-29 10:16:57 +02:00
2020-05-10 10:30:11 +02:00
2020-04-17 10:48:41 +02:00
2019-08-04 09:30:54 +02:00
2012-12-09 00:20:28 -05:00
2018-06-22 13:43:27 +09:00
2019-12-31 16:35:23 +01:00
2021-03-04 09:39:59 +01:00
2020-08-21 11:05:28 +02:00
2019-04-05 22:33:09 +02:00
2020-02-28 16:38:50 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-12-13 08:52:43 +01:00
2019-06-04 08:02:34 +02:00
2019-06-04 08:02:34 +02:00
2020-07-16 08:17:26 +02:00
2019-04-20 09:15:59 +02:00
2016-12-14 16:04:08 -08:00
2017-11-02 11:10:55 +01:00
2021-01-09 13:43:48 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-07-21 09:03:11 +02:00
2017-11-02 11:10:55 +01:00
2019-12-13 08:52:43 +01:00
2021-03-04 09:39:42 +01:00
2020-04-23 10:30:24 +02:00
2021-03-04 09:39:44 +01:00
2020-06-22 09:05:15 +02:00
2020-10-14 10:31:26 +02:00
2017-09-08 18:26:51 -07:00
2012-07-21 10:34:00 -07:00
2017-11-02 11:10:55 +01:00
2021-02-13 13:51:13 +01:00
2017-05-08 17:15:14 -07:00
2021-02-07 14:48:38 +01:00
2020-06-22 09:05:04 +02:00
2020-04-29 16:31:19 +02:00
2017-11-02 11:10:55 +01:00
2020-10-01 13:14:54 +02:00
2020-01-04 19:13:15 +01:00
2018-01-11 14:39:07 -06:00
2018-03-26 15:56:42 +02:00
2019-06-09 09:17:19 +02:00
2020-02-24 08:34:46 +01:00
2017-11-02 11:10:55 +01:00
2018-07-04 14:06:19 +09:00
2018-04-17 13:42:48 +02:00
2012-10-13 10:46:48 +01:00
2018-04-12 09:41:19 -07:00
2020-09-09 19:04:28 +02:00
2019-09-06 10:22:19 +02:00
2015-11-25 09:22:02 -07:00
2020-01-23 08:21:29 +01:00
2015-08-10 14:29:27 +05:30
2018-12-29 13:37:59 +01:00
2017-11-02 11:10:55 +01:00
2017-08-28 20:51:22 +02:00
2017-01-04 13:22:38 -07:00
2020-02-11 04:34:18 -08:00
2019-04-17 08:38:51 +02:00
2020-01-29 16:43:27 +01:00
2020-01-29 16:43:27 +01:00
2019-01-13 09:51:04 +01:00
2018-04-11 10:28:32 -07:00
2019-12-31 16:35:38 +01:00
2018-02-13 16:25:06 +01:00
2019-11-12 19:20:36 +01:00
2020-11-10 12:35:58 +01:00
2020-10-07 08:00:08 +02:00
2020-07-29 10:16:52 +02:00
2019-06-09 09:17:23 +02:00
2017-11-02 11:10:55 +01:00
2017-11-15 13:46:33 -08:00
2019-05-31 06:46:05 -07:00
2017-11-02 11:10:55 +01:00
2018-06-07 17:34:39 -07:00
2018-03-24 11:25:35 -05:00
2021-02-10 09:21:07 +01:00
2018-03-15 07:17:21 -07:00
2018-12-05 19:31:59 +01:00
2018-07-31 12:40:22 -07:00
2019-02-23 09:07:25 +01:00
2021-03-17 16:43:42 +01:00
2019-06-04 08:02:34 +02:00
2020-11-18 19:18:44 +01:00
2020-11-18 19:18:44 +01:00
2020-12-02 08:48:07 +01:00
2018-07-24 10:04:49 -07:00
2018-09-23 21:55:24 -07:00
2020-10-01 13:14:41 +02:00
2019-09-06 10:22:23 +02:00
2018-11-21 09:19:20 +01:00
2020-10-07 08:00:08 +02:00
2020-04-13 10:45:06 +02:00
2020-04-17 10:48:45 +02:00
2018-11-13 11:08:24 -08:00
2021-01-06 14:45:00 +01:00
2017-11-04 09:26:51 +09:00
2020-10-29 09:55:15 +01:00
2018-07-08 11:13:25 +09:00
2020-10-30 10:38:20 +01:00
2020-05-27 17:37:35 +02:00
2020-03-25 08:06:13 +01:00
2018-01-31 17:18:37 -08:00
2020-06-22 09:05:25 +02:00
2020-04-17 10:48:46 +02:00
2020-10-01 13:14:40 +02:00
2017-04-04 17:49:49 +01:00
2020-04-23 10:30:20 +02:00
2020-02-11 04:34:11 -08:00
2018-03-19 10:09:44 -07:00
2020-01-27 14:50:27 +01:00
2018-12-01 09:37:34 +01:00
2018-01-03 10:38:54 -05:00
2020-03-18 07:14:17 +01:00
2019-05-04 09:20:11 +02:00
2018-05-09 11:51:46 +10:00
2016-06-28 00:42:10 +02:00
2020-01-27 14:50:26 +01:00
2020-05-20 08:18:45 +02:00
2020-01-17 19:46:55 +01:00
2020-01-04 19:13:35 +01:00
2012-10-13 10:46:48 +01:00
2017-09-08 18:26:51 -07:00
2020-11-18 19:18:52 +01:00
2017-11-02 11:10:55 +01:00
2020-07-22 09:32:13 +02:00
2021-01-12 20:10:17 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-03-23 20:10:04 +01:00
2019-06-11 12:20:52 +02:00
2018-02-14 14:33:36 -05:00
2017-08-01 15:22:55 -07:00
2019-01-09 17:38:33 +01:00
2018-12-05 19:32:03 +01:00
2019-06-15 11:54:10 +02:00
2019-12-13 08:52:28 +01:00
2017-11-02 11:10:55 +01:00
2020-01-04 19:12:53 +01:00
2019-12-17 20:35:17 +01:00
2018-02-12 11:43:25 -05:00
2020-08-07 09:36:21 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2020-02-24 08:34:46 +01:00
2019-07-26 09:14:07 +02:00
2018-08-09 11:15:06 +01:00
2019-04-05 22:32:56 +02:00
2019-12-05 09:19:38 +01:00
2017-11-27 09:16:40 +01:00
2017-11-02 11:10:55 +01:00
2019-04-05 22:32:56 +02:00
2021-03-04 09:39:50 +01:00
2017-05-03 15:52:09 -07:00
2017-11-02 11:10:55 +01:00
2018-06-03 17:37:11 -07:00
2020-01-27 14:50:37 +01:00
2018-07-25 11:22:19 +02:00
2018-03-29 13:47:53 -04:00
2018-07-10 22:42:47 -04:00
2021-01-30 13:32:12 +01:00
2018-05-10 10:49:40 +01:00
2017-06-05 11:14:35 +01:00
2017-11-02 11:10:55 +01:00
2020-12-30 11:26:06 +01:00
2020-04-02 15:28:22 +02:00
2020-12-30 11:26:01 +01:00
2018-04-11 10:28:36 -07:00
2020-10-01 13:14:30 +02:00
2018-02-01 09:46:00 -08:00
2019-12-05 09:20:25 +01:00
2019-12-13 08:51:07 +01:00
2012-10-13 10:46:48 +01:00
2020-06-22 09:05:03 +02:00
2017-11-02 11:10:55 +01:00
2018-08-22 10:52:43 -07:00
2020-01-27 14:51:05 +01:00
2019-06-04 08:02:30 +02:00
2018-03-08 13:49:26 +00:00
2018-05-17 12:46:54 -04:00
2021-01-23 15:49:56 +01:00
2019-04-03 06:26:28 +02:00
2019-05-31 06:46:16 -07:00
2018-05-03 15:55:23 -07:00
2017-11-02 11:10:55 +01:00
2018-08-16 12:14:42 -07:00
2017-11-02 11:10:55 +01:00
2018-07-26 10:50:16 -04:00
2018-05-30 10:11:34 +02:00
2018-05-30 10:11:34 +02:00
2016-03-25 16:37:42 -07:00
2018-06-14 12:21:18 +09:00
2017-11-02 11:10:55 +01:00
2018-06-05 16:57:31 -07:00
2017-11-02 11:10:55 +01:00
2019-03-13 14:02:35 -07:00
2017-11-02 11:10:55 +01:00
2018-05-15 21:47:09 +03:00
2021-02-13 13:51:15 +01:00
2018-04-28 15:01:14 -07:00
2009-04-10 15:48:52 +02:00
2020-04-17 10:48:43 +02:00
2019-12-05 09:20:57 +01:00
2020-04-23 10:30:19 +02:00
2020-01-27 14:50:22 +01:00
2018-02-05 21:34:50 +01:00
2017-08-18 14:07:26 -03:00
2017-11-02 11:10:55 +01:00
2018-08-14 16:39:13 -07:00
2021-03-07 12:19:01 +01:00
2017-08-17 16:29:19 -07:00
2018-12-29 13:37:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2013-12-07 01:03:14 +01:00
2018-11-13 11:08:51 -08:00
2020-07-31 18:37:48 +02:00
2018-05-25 12:27:53 +01:00
2017-11-02 11:10:55 +01:00
2018-04-09 11:54:56 +02:00
2020-11-18 19:18:40 +01:00
2019-12-21 10:57:17 +01:00
2019-11-20 18:45:24 +01:00
2018-09-03 13:26:44 +02:00
2018-04-17 17:18:04 +02:00
2017-11-02 11:10:55 +01:00
2020-01-23 08:21:32 +01:00
2019-12-05 09:19:49 +01:00
2020-12-30 11:26:01 +01:00
2017-12-04 07:14:30 -05:00
2018-07-09 09:07:54 -06:00
2020-08-19 08:14:47 +02:00
2020-12-11 13:25:01 +01:00
2020-09-09 19:04:29 +02:00
2017-11-02 11:10:55 +01:00
2020-12-30 11:25:42 +01:00
2019-05-08 07:21:44 +02:00
2017-11-02 11:10:55 +01:00
2018-04-11 10:28:35 -07:00
2015-12-04 10:38:59 -02:00
2020-06-30 23:17:00 -04:00
2019-04-17 08:38:52 +02:00
2020-10-07 08:00:05 +02:00
2018-04-25 20:33:19 +03:00
2020-04-29 16:31:27 +02:00
2018-04-11 10:28:30 -07:00
2019-07-14 08:11:21 +02:00
2017-11-02 11:10:55 +01:00
2020-04-02 15:28:23 +02:00
2018-11-13 11:08:42 -08:00
2018-05-18 08:47:13 -07:00
2017-11-21 15:46:44 -08:00
2018-04-11 10:28:39 -07:00
2020-08-11 15:32:34 +02:00
2014-08-08 15:57:26 -07:00
2021-03-07 12:19:01 +01:00
2017-08-15 09:02:08 -07:00