Re: refcount_t: underflow; use-after-free with CIFS umount after scsi-misc commit ef2cc88e2a205b8a11a19e78db63a70d3728cdf5

[Arthur Marsh]

Arthur Marsh wrote on 12/5/19 2:14 PM:
> Hi, I came across a problem when un-mounting CIFS mounts that bisected 
> back to the commit "[ef2cc88e2a205b8a11a19e78db63a70d3728cdf5] Merge tag 
> 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi".


This still happens with 5.5.0-rc1:

[  301.679819] ------------[ cut here ]------------
[  301.680095] refcount_t: underflow; use-after-free.
[  301.680192] WARNING: CPU: 1 PID: 3569 at lib/refcount.c:28 
refcount_warn_saturate+0xb4/0xf3
[  301.680298] Modules linked in: md4 sha512_generic cmac hmac cifs 
libdes dns_resolver fscache libarc4 nfc rfkill cpufreq_conservative 
cpufreq_userspace cpufreq_powersave binfmt_misc nls_utf8 nls_cp437 vfat 
fat lm75 it87 hwmon_vid tun cuse fuse ib_iser rdma_cm iw_cm ib_cm 
ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi 
parport_pc ppdev lp parport radeon ttm snd_hda_codec_realtek 
snd_hda_codec_generic snd_hda_codec_hdmi ledtrig_audio snd_hda_intel 
snd_intel_dspcfg drm_kms_helper snd_hda_codec drm i2c_algo_bit 
snd_hda_core fb_sys_fops iTCO_wdt iTCO_vendor_support intel_powerclamp 
syscopyarea sysfillrect snd_hwdep sysimgblt snd_pcm evdev snd_timer 
pcspkr snd serio_raw rng_core soundcore button acpi_cpufreq ext4 crc16 
mbcache jbd2 sr_mod cdrom sg sd_mod ata_generic psmouse ata_piix tg3 
pata_it821x firewire_ohci uhci_hcd i2c_i801 lpc_ich firewire_core 
mfd_core crc_itu_t libata ehci_pci scsi_mod ehci_hcd usbcore usb_common 
ptp pps_core libphy
[  301.681361] CPU: 1 PID: 3569 Comm: umount Not tainted 5.5.0-rc1 #1692
[  301.681444] Hardware name:  /8I945P Pro, BIOS F10 04/06/2006
[  301.681521] EIP: refcount_warn_saturate+0xb4/0xf3
[  301.681586] Code: 24 f8 58 8b c1 e8 ab 91 d0 ff 0f 0b c9 c3 80 3d c3 
be 9d c1 00 75 91 c6 05 c3 be 9d c1 01 c7 04 24 4c 59 8b c1 e8 8b 91 d0 
ff <0f> 0b c9 c3 80 3d c1 be 9d c1 00 0f 85 6d ff ff ff c6 05 c1 be 9d
[  301.681807] EAX: 00000026 EBX: ed5ae6d8 ECX: 00000007 EDX: f62950cc
[  301.681889] ESI: ed5ae6e4 EDI: ed5d7000 EBP: ed503e2c ESP: ed503e28
[  301.681971] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010292
[  301.682057] CR0: 80050033 CR2: 0058f00c CR3: 2a20a000 CR4: 000006d0
[  301.682139] Call Trace:
[  301.682240]  close_shroot+0x97/0xda [cifs]
[  301.682351]  SMB2_tdis+0x7c/0x176 [cifs]
[  301.682456]  ? _get_xid+0x58/0x91 [cifs]
[  301.682563]  cifs_put_tcon.part.0+0x99/0x202 [cifs]
[  301.682637]  ? ida_free+0x99/0x10a
[  301.682727]  ? cifs_umount+0x3d/0x9d [cifs]
[  301.682829]  cifs_put_tlink+0x3a/0x50 [cifs]
[  301.682929]  cifs_umount+0x44/0x9d [cifs]
[  301.683023]  cifs_kill_sb+0x16/0x19 [cifs]
[  301.683084]  deactivate_locked_super+0x28/0x5c
[  301.683147]  deactivate_super+0x30/0x33
[  301.683204]  cleanup_mnt+0x8a/0x103
[  301.683256]  __cleanup_mnt+0xb/0xd
[  301.683308]  task_work_run+0x6c/0x8b
[  301.683364]  exit_to_usermode_loop+0xbe/0xc0
[  301.683427]  do_fast_syscall_32+0x291/0x364
[  301.683493]  entry_SYSENTER_32+0xaa/0x102
[  301.683549] EIP: 0xb7fa9af1
[  301.683592] Code: 00 89 d3 5b 5e 5f 5d c3 b8 00 09 3d 00 eb c4 8b 04 
24 c3 8b 14 24 c3 8b 1c 24 c3 8b 34 24 c3 90 90 51 52 55 89 e5 0f 34 cd 
80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76
[  301.683811] EAX: 00000000 EBX: 0058ccf0 ECX: 00000000 EDX: b7f12000
[  301.683892] ESI: bfe75280 EDI: b7f12000 EBP: bfe74168 ESP: bfe740fc
[  301.683973] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000286
[  301.687861] irq event stamp: 8202
[  301.691737] hardirqs last  enabled at (8201): [<c10c741c>] 
console_unlock+0x45a/0x598
[  301.695687] hardirqs last disabled at (8202): [<c100171f>] 
trace_hardirqs_off_thunk+0xc/0x1d
[  301.699620] softirqs last  enabled at (8132): [<c14f9770>] 
peernet2id+0x3c/0x56
[  301.703583] softirqs last disabled at (8130): [<c14f9756>] 
peernet2id+0x22/0x56
[  301.707502] ---[ end trace fbe0ba2a50b93358 ]---