> On May 4, 2018, at 2:49 PM, Martin KaFai Lau <ka...@fb.com> wrote:
>
> If CONFIG_REFCOUNT_FULL=y, refcount_inc() WARN when refcount is 0.
> When creating a new btf, the initial btf->refcnt is 0 and
> triggered the following:
>
> [ 34.855452] refcount_t: increment on 0; use-after-free.
> [ 34.856252] WARNING: CPU: 6 PID: 1857 at lib/refcount.c:153
> refcount_inc+0x26/0x30
> ....
> [ 34.868809] Call Trace:
> [ 34.869168] btf_new_fd+0x1af6/0x24d0
> [ 34.869645] ? btf_type_seq_show+0x200/0x200
> [ 34.870212] ? lock_acquire+0x3b0/0x3b0
> [ 34.870726] ? security_capable+0x54/0x90
> [ 34.871247] __x64_sys_bpf+0x1b2/0x310
> [ 34.871761] ? __ia32_sys_bpf+0x310/0x310
> [ 34.872285] ? bad_area_access_error+0x310/0x310
> [ 34.872894] do_syscall_64+0x95/0x3f0
>
> This patch uses refcount_set() instead.
>
> Reported-by: Yonghong Song <y...@fb.com>
> Tested-by: Yonghong Song <y...@fb.com>
> Signed-off-by: Martin KaFai Lau <ka...@fb.com>
> ---
> kernel/bpf/btf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 22e1046a1a86..fa0dce0452e7 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -1977,7 +1977,7 @@ static struct btf *btf_parse(void __user *btf_data, u32
> btf_data_size,
>
> if (!err) {
> btf_verifier_env_free(env);
> - btf_get(btf);
> + refcount_set(&btf->refcnt, 1);
> return btf;
> }
>
> --
> 2.9.5
>
Acked-by: Song Liu <songliubrav...@fb.com>
