netdev - Re: [PATCH bpf-next 1/6] bpf: btf: Avoid WARN_ON when CONFIG_REFCOUNT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <66DB0A5D-04A4-4F6A-AF44-166D2FE9ACF6@fb.com>
Date:   Tue, 8 May 2018 21:09:05 +0000
From:   Song Liu <songliubraving@...com>
To:     Martin Lau <kafai@...com>
CC:     Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <Kernel-team@...com>
Subject: Re: [PATCH bpf-next 1/6] bpf: btf: Avoid WARN_ON when
 CONFIG_REFCOUNT_FULL=y



> On May 4, 2018, at 2:49 PM, Martin KaFai Lau <kafai@...com> wrote:
> 
> If CONFIG_REFCOUNT_FULL=y, refcount_inc() WARN when refcount is 0.
> When creating a new btf, the initial btf->refcnt is 0 and
> triggered the following:
> 
> [   34.855452] refcount_t: increment on 0; use-after-free.
> [   34.856252] WARNING: CPU: 6 PID: 1857 at lib/refcount.c:153 refcount_inc+0x26/0x30
> ....
> [   34.868809] Call Trace:
> [   34.869168]  btf_new_fd+0x1af6/0x24d0
> [   34.869645]  ? btf_type_seq_show+0x200/0x200
> [   34.870212]  ? lock_acquire+0x3b0/0x3b0
> [   34.870726]  ? security_capable+0x54/0x90
> [   34.871247]  __x64_sys_bpf+0x1b2/0x310
> [   34.871761]  ? __ia32_sys_bpf+0x310/0x310
> [   34.872285]  ? bad_area_access_error+0x310/0x310
> [   34.872894]  do_syscall_64+0x95/0x3f0
> 
> This patch uses refcount_set() instead.
> 
> Reported-by: Yonghong Song <yhs@...com>
> Tested-by: Yonghong Song <yhs@...com>
> Signed-off-by: Martin KaFai Lau <kafai@...com>
> ---
> kernel/bpf/btf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 22e1046a1a86..fa0dce0452e7 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -1977,7 +1977,7 @@ static struct btf *btf_parse(void __user *btf_data, u32 btf_data_size,
> 
> 	if (!err) {
> 		btf_verifier_env_free(env);
> -		btf_get(btf);
> +		refcount_set(&btf->refcnt, 1);
> 		return btf;
> 	}
> 
> -- 
> 2.9.5
> 

Acked-by: Song Liu <songliubraving@...com>