【openEuler-1.0-LTS】KASAN: use-after-free Write in get_files_struct

【标题描述】 KASAN: use-after-free Write in get_files_struct
【环境信息】
硬件信息：
1）	裸机场景提供出问题的硬件信息；
2）	虚机场景提供虚机XML文件或者配置信息
软件信息：
1）	OS版本及分支
2）	内核信息
3）	发现问题的组件版本信息
如果有特殊组网，请提供网络拓扑图
【问题复现步骤】
具体操作步骤
出现概率(是否必现，概率性错误)
【预期结果】
描述预期结果，可以通过对比新老版本获取
【实际结果】
```
==================================================================
BUG: KASAN: use-after-free in atomic_inc include/asm-generic/atomic-instrumented.h:109 [inline]
BUG: KASAN: use-after-free in get_files_struct+0x5c/0x80 fs/file.c:446
Write of size 4 at addr ffff88811af9ad80 by task mingetty/31696

CPU: 1 PID: 31696 Comm: mingetty Not tainted 4.19.90 #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xa7/0xe9 lib/dump_stack.c:118
 print_address_description.cold+0x54/0x246 mm/kasan/report.c:253
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report+0xe1/0x110 mm/kasan/report.c:393
 atomic_inc include/asm-generic/atomic-instrumented.h:109 [inline]
 get_files_struct+0x5c/0x80 fs/file.c:446
 proc_readfd_common+0x124/0x780 fs/proc/fd.c:240
 iterate_dir+0x3fe/0x540 fs/readdir.c:65
 ksys_getdents64+0x121/0x220 fs/readdir.c:375
 __do_sys_getdents64 fs/readdir.c:394 [inline]
 __se_sys_getdents64 fs/readdir.c:391 [inline]
 __x64_sys_getdents64+0x74/0xb0 fs/readdir.c:391
 do_syscall_64+0xc7/0x280 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fb78c440b7a
Code: 48 8b 36 48 8b 3f 48 83 c6 13 48 83 c7 13 e9 5d d0 fd ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 63 ff b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 f3 c3 48 8b 15 c5 f2 2c 00 64 48 8b 0c 25
RSP: 002b:00007ffce6963898 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00000000024babe0 RCX: 00007fb78c440b7a
RDX: 0000000000008000 RSI: 00000000024bac10 RDI: 0000000000000004
RBP: 00000000024bac10 R08: 0000000000000000 R09: 00007ffce6963a1d
R10: 000000000000f3f1 R11: 0000000000000246 R12: ffffffffffffffa8
R13: 00007fb78c92f700 R14: 0000000000000019 R15: 00000000024b2ba0

Allocated by task 2555:
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc2/0xe0 mm/kasan/kasan.c:553
 slab_post_alloc_hook mm/slab.h:441 [inline]
 slab_alloc_node mm/slub.c:2755 [inline]
 slab_alloc mm/slub.c:2763 [inline]
 kmem_cache_alloc+0xbc/0x1d0 mm/slub.c:2768
 dup_fd+0x89/0xc10 fs/file.c:281
 copy_files kernel/fork.c:1463 [inline]
 copy_process.part.0+0x1336/0x4830 kernel/fork.c:1976
 copy_process kernel/fork.c:1785 [inline]
 _do_fork+0x195/0x680 kernel/fork.c:2306
 do_syscall_64+0xc7/0x280 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 16481:
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x12d/0x170 mm/kasan/kasan.c:521
 slab_free_hook mm/slub.c:1397 [inline]
 slab_free_freelist_hook mm/slub.c:1425 [inline]
 slab_free mm/slub.c:3004 [inline]
 kmem_cache_free+0x79/0x1e0 mm/slub.c:3020
 put_files_struct fs/file.c:460 [inline]
 put_files_struct+0xd0/0x100 fs/file.c:452
 exit_files+0x85/0xb0 fs/file.c:484
 do_exit+0x641/0xf20 kernel/exit.c:794
 do_group_exit+0xf3/0x2d0 kernel/exit.c:896
 __do_sys_exit_group kernel/exit.c:907 [inline]
 __se_sys_exit_group kernel/exit.c:905 [inline]
 __x64_sys_exit_group+0x3f/0x50 kernel/exit.c:905
 do_syscall_64+0xc7/0x280 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff88811af9ad80
 which belongs to the cache files_cache of size 704
The buggy address is located 0 bytes inside of
 704-byte region [ffff88811af9ad80, ffff88811af9b040)
The buggy address belongs to the page:
page:ffffea00046be600 count:1 mapcount:0 mapping:ffff888100170e00 index:0x0 compound_mapcount: 0
flags: 0x17ffffc0008100(slab|head)
raw: 0017ffffc0008100 ffffea0004730f00 0000000600000006 ffff888100170e00
raw: 0000000000000000 0000000000130013 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88811af9ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811af9ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811af9ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

^
 ffff88811af9ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88811af9ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 1 PID: 31696 Comm: mingetty Tainted: G    B             4.19.90 #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:proc_readfd_common+0x244/0x780 fs/proc/fd.c:256
Code: ea 03 42 80 3c 22 00 0f 85 4d 04 00 00 4d 8b 6d 00 4d 85 ed 0f 84 09 01 00 00 e8 27 a6 9f ff 49 8d 7d 44 48 89 f8 48 c1 e8 03 <42> 0f b6 0c 20 48 89 f8 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85
RSP: 0018:ffff8881bdcefcf0 EFLAGS: 00010a07
RAX: 1d4c001260000147 RBX: 0000000000000100 RCX: ffffffffa2c886c9
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ea60009300000a3f
RBP: ffff8881bdcefe68 R08: 000000000008ec01 R09: 000000000000000a
R10: ffff888100168303 R11: 0000000000000010 R12: dffffc0000000000
R13: ea600093000009fb R14: ffff88811af9ad80 R15: ffffed10235f35b4
FS:  00007fb78c92f700(0000) GS:ffff8883e2e80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb78c933000 CR3: 000000012942e002 CR4: 00000000003606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 iterate_dir+0x3fe/0x540 fs/readdir.c:65
 ksys_getdents64+0x121/0x220 fs/readdir.c:375
 __do_sys_getdents64 fs/readdir.c:394 [inline]
 __se_sys_getdents64 fs/readdir.c:391 [inline]
 __x64_sys_getdents64+0x74/0xb0 fs/readdir.c:391
 do_syscall_64+0xc7/0x280 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fb78c440b7a
Code: 48 8b 36 48 8b 3f 48 83 c6 13 48 83 c7 13 e9 5d d0 fd ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 63 ff b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 f3 c3 48 8b 15 c5 f2 2c 00 64 48 8b 0c 25
RSP: 002b:00007ffce6963898 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00000000024babe0 RCX: 00007fb78c440b7a
RDX: 0000000000008000 RSI: 00000000024bac10 RDI: 0000000000000004
RBP: 00000000024bac10 R08: 0000000000000000 R09: 00007ffce6963a1d
R10: 000000000000f3f1 R11: 0000000000000246 R12: ffffffffffffffa8
R13: 00007fb78c92f700 R14: 0000000000000019 R15: 00000000024b2ba0
Modules linked in:
---[ end trace f9181a51af4826e0 ]---
RIP: 0010:proc_readfd_common+0x244/0x780 fs/proc/fd.c:256
Code: ea 03 42 80 3c 22 00 0f 85 4d 04 00 00 4d 8b 6d 00 4d 85 ed 0f 84 09 01 00 00 e8 27 a6 9f ff 49 8d 7d 44 48 89 f8 48 c1 e8 03 <42> 0f b6 0c 20 48 89 f8 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85
RSP: 0018:ffff8881bdcefcf0 EFLAGS: 00010a07
RAX: 1d4c001260000147 RBX: 0000000000000100 RCX: ffffffffa2c886c9
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ea60009300000a3f
RBP: ffff8881bdcefe68 R08: 000000000008ec01 R09: 000000000000000a
R10: ffff888100168303 R11: 0000000000000010 R12: dffffc0000000000
R13: ea600093000009fb R14: ffff88811af9ad80 R15: ffffed10235f35b4
FS:  00007fb78c92f700(0000) GS:ffff8883e2e80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb78c933000 CR3: 000000012942e002 CR4: 00000000003606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	03 42 80             	add    -0x80(%rdx),%eax
   3:	3c 22                	cmp    $0x22,%al
   5:	00 0f                	add    %cl,(%rdi)
   7:	85 4d 04             	test   %ecx,0x4(%rbp)
   a:	00 00                	add    %al,(%rax)
   c:	4d 8b 6d 00          	mov    0x0(%r13),%r13
  10:	4d 85 ed             	test   %r13,%r13
  13:	0f 84 09 01 00 00    	je     0x122
  19:	e8 27 a6 9f ff       	callq  0xff9fa645
  1e:	49 8d 7d 44          	lea    0x44(%r13),%rdi
  22:	48 89 f8             	mov    %rdi,%rax
  25:	48 c1 e8 03          	shr    $0x3,%rax
* 29:	42 0f b6 0c 20       	movzbl (%rax,%r12,1),%ecx <-- trapping instruction
  2e:	48 89 f8             	mov    %rdi,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 03             	add    $0x3,%eax
  37:	38 c8                	cmp    %cl,%al
  39:	7c 08                	jl     0x43
  3b:	84 c9                	test   %cl,%cl
  3d:	0f                   	.byte 0xf
  3e:	85                   	.byte 0x85
```
【附件信息】
比如系统message日志/组件日志、dump信息、图片等

GVP openEuler/kernel
关闭

内容风险标识

评论 (1)

GVPopenEuler/kernel关闭

内容风险标识