On Wed, Apr 24, 2019 at 05:40:40PM +0530, Mukesh Ojha wrote:
Al,in a loop, and multithreaded, presumably?
i tried to put traceprintk inside ioctl after fdget and fdput on a simple
call of open => ioctl => close
on /dev/uinput.Look at ksys_ioctl():
ÂÂÂÂÂÂÂÂÂ uinput-532ÂÂ [002] ....ÂÂÂ 45.312044: SYSC_ioctl: 2 Â Â <= f_count
ÂÂÂ <After fdget()ÂÂÂÂÂÂÂÂÂ uinput-532ÂÂ [002] ....ÂÂÂ 45.312055: SYSC_ioctl: 2
<After fdput()
ÂÂÂÂÂÂÂÂÂ uinput-532ÂÂ [004] ....ÂÂÂ 45.313766: uinput_open: uinput: 1
ÂÂÂÂÂÂÂÂÂ uinput-532ÂÂ [004] ....ÂÂÂ 45.313783: SYSC_ioctl: 1
ÂÂÂÂÂÂÂÂÂ uinput-532ÂÂ [004] ....ÂÂÂ 45.313788: uinput_ioctl_handler:
uinput: uinput_ioctl_handler, 1
ÂÂÂÂÂÂÂÂÂ uinput-532ÂÂ [004] ....ÂÂÂ 45.313835: SYSC_ioctl: 1
ÂÂÂÂÂÂÂÂÂ uinput-532ÂÂ [004] ....ÂÂÂ 45.313843: uinput_release: uinput:Â 0
So while a ioctl is running the f_count is 1, so a fput could be run and do
atomic_long_dec_and_test
this could call release right ?
int ksys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
{
int error;
struct fd f = fdget(fd);
an error or refcount bumped
if (!f.file)
return -EBADF;
not an error, then. We know that ->release() won't be called
until we drop the reference we've just acquired.
error = security_file_ioctl(f.file, cmd, arg);
if (!error)
error = do_vfs_ioctl(f.file, fd, cmd, arg);
... and we are done with calling ->ioctl(), so
fdput(f);
... we drop the reference we'd acquired.
Seeing refcount 1 inside ->ioctl() is possible, all right:
CPU1: ioctl(2) resolves fd to struct file *, refcount 2
CPU2: close(2) rips struct file * from descriptor table and does fput() to drop it;
refcount reaches 1 and fput() is done; no call of ->release() yet.
CPU1: we get arouund to ->ioctl(), where your trace sees refcount 1
CPU1: done with ->ioctl(), drop our reference. *NOW* refcount gets to 0, and
->release() is called.
IOW, in your trace fput() has already been run by close(2); having somebody else
do that again while we are in ->ioctl() would be a bug (to start with, where
did they get that struct file * and why wasn't that reference contributing to
struct file refcount?)
In all cases we only call ->release() once all references gone - both
the one(s) in descriptor tables and any transient ones acquired by
fdget(), etc.
I would really like to see a reproducer for the original use-after-free report...