402 Star 1.4K Fork 1.3K

GVPopenEuler / kernel

 / 详情

KASAN: use-after-free Write in io_req_drop_files

已完成
缺陷
创建于  
2022-08-05 10:08

【标题描述】运行测试用例,触发UAF
【环境信息】
软件信息:
kernel 5.10
【问题复现步骤】
具体操作步骤:运行测试用例
出现概率:必现
【预期结果】
用例正常执行完毕
【实际结果】
触发UAF
【附件信息】
测试用例:
03:51:00 executing program 3:
r0 = syz_io_uring_setup(0xcf, &(0x7f00000011c0), &(0x7f0000002000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000040), &(0x7f0000000100)=<r1=>0x0)
ioctl$BTRFS_IOC_SNAP_CREATE(0xffffffffffffffff, 0x50009401, &(0x7f0000001240)={{}, "15cabd8f82f1d5461c747d5abb149ff4000cbd8305939d977fec44510fbb077140e1f4f3b2d769a9f43f464ec5a12414e8702f437ffbfafe7da8ca81e760b105028c99b80932cf7522e8c4da507cdd70970b34d3ab6a7f8950a7ba208e169caa7f0d2aaa8da0a2a8b37b9c2b4e9cc57faa4c2d22c93ebcc1324e09284a6ab1bd5594205858e076b228feaf4bb34512500e8b6bc1b7e0a658fba52b0b7b924ee35332bba2080a5adeb0c6f05a58283da4806fbc98555901be29fb80ab0e4e21861feaeea7995073ffc24e4832fa36b78582528319789ab7782839442a71b553f96330e0faa486f76e1f1134ab77a40b6334a58fb9e679085e8c97650d38f3b26e5d30e76d97bf913662a461415848f557e787ed02cf50d06494ef0c7432c59da964ff06f43aa8678a92c245ab3b0041a6ec6210a69ef31b407d901689789b4b22c70f88a8420f60a1cc6d3b5c08ad23c68960e04ca5bc5c0d6d79e5b1596b22a4d58ad98f5bfa1e596a76a9187e1cb4309cf8409566323935f697667545b74c797d18c5c0de7670a5d4608a50086fabe69298c19827641c7f49a6263bd3f63e41c64a34cf7ce3f3dc410dbe778249dd4e36e96a539503bb82792ee36a005a968198873cae81a135eff8a5fb98ae4fc50c1020ca50f1236eebeaf4cd2e8dbceee319c5c0d377b35071366ebccb1d5d814b340d86b788bb314fbc3a2e81102f7e370a34e7b983b13fbfecdd91c38205bca1fcb799157ecd95902dea9d00a6db1b4b806f7181aa501e6c02903c41629a53b2417d4f1d7c43a839f2eaccdf84a4f4e34435527c14e624b6739da17daa261baa5c84aae944deda2ce5ad9129363381389146f0623e7a037981ead3a1c6f85f22b1930edf23f8919d45aec8b8d3858ef51291ecf36cd0dc2e743ce62b166acb34e9ac5c44bcd874ee4d9ee172b0ba75ad722b50cacaf6d93f680d8076b8b067d64cfb1ddf39fc6c4484fb2d4c8d1ff45c5b6093f8f437ab6efe15593207c5d940cdc5a906ed3e63683e01ce4603600d1aa13179233167d697e99a408073a00dfc6f848678b31e0c4c17627a385d6b40d57eefaf8fc1e399e115ad9587a94ed4ffa6c7cd3c12846f68ba6c88a012a38cdb8beb5f3265f2cd57de761c97365e619d9d0388ea1c62c946a546baaef7b593b7e22178f3a473b1c84b269644838f082889d4ef39f61c44b14dd9aada715c9579db44f141a8d5143cd046eeea722c8b68c07e48bfb30ede97688e5e066764a1c321b88748878b8324608b5903b9152c7a5723378ae687115abe8ac55ec7618d934372559e531c79405b89faea20d381fe0e5377f587260347b84dbfdae1da553d60268b79d95855d7bb2d14ab69425091559cf5fa2b2d6ca105648a9fe9543f57599386887c5de337c9c851d6b5ae469fb262c9a0884ee71f3e0fd61477b2e1d446a353035ba7fa4d59d5d9fc813bb976bee94344927c661210f91896e23fcf6c86e3754fde4874670db60537efd7b09cfc563c5156d4ddb84caba4aa5424417b625ed6009d6dd3ffb56211d80b7901c8c469d901aed5c26e037aa7a67301c7125d718d72ea35dc318edf9c2ddf2dfd92307559700f3e6642276e4695c68e770bd83100f310d17ae028a5cfc1a1bb16e34170d6038b30c5750f2c6adea8adf871b0aa9f4b700b3e84f75f086f85e20cea17ee5b997d2e485feeedb2311da10c1245ffb6b56f8aa085318cef85d241fc07d06f05ae716bf69b8583e6e831f7376222418f62ca075be1ddeb8fa00ab4882904b6d84360f14b31d6aa3b02902b5cb9cb032c9496628e4f2cbf858ec5de882ecf64838dffc8ec7e498621671b769815d752e1377c3eeb6428692b205cbc809d3230ea638d41b1b269dbfc0898fdf151cd767a6db82c6cc6528d2c184b6121b0ffe9d68a1eaab9ea622f9a6e434c4f80b874f89ae448b7d71c990151f448006dda2aaea0f65a9e969e177faed16b09897d90a7bf62dd9544b843067df3272b150e601c1c55d9182027e353c7773572f905ba647a763df8109ca571ed6eb0d682459fe39568b5bc8c5da23979cb1a5ce82e0930046f916b19a6ddd7255da80acc918dbe6ac34e220813909256e974041ebf57b78c3af5905626df879ffd5d728f8559cc76eadb621a6ca34a57029748cc9b59552c5fda32a7bad1955cd6112a6b0c42f8b3bb9aa9469dec9967691b1be9545bdd5ce6559fa7ab5d328aa96c07edb2cc4d0c65e9dff1c8b30914749b13da31b9b866c070797a7bbbb2b2b7de9da4b4971602bba04caad629a1a3cb2d35675453ed323218f712bf3b2c1caafdc30e69fbb98b174b5bc7d0352fe391c4b5865050798ce86bc1ab4da34f6e85820706dfb9e1fe943f95e2ef5dee5aa234a28e73e561ba8929d8cd8238bb5f4079fd3662debb134f39acfc8a444ce5ef35c333f3d211ceca44e74b6bfad019a7c9ac8d5d87794042d5d49288ed729eb3d5b4e2fe9281ce3b3e2e4aaee35134110057468f965b42bcff6b9f8391bd304df6cf233a25a53d81286059797512d03a0f825fbaf7f3d25aa83a20956d02b2fee2246f6ac2f8683e5b20dbd38d726ba86622eb585a094fc8dcf0252b91456382e1ce2a2f422f1814c1cabddc585413c9fdc4179109fc19580ca24f25b7bd42de139868a7e02bad6449f079695cb86681535b05cbd7e1ecfa1e974199e1a2489242129a614b3335c902af8431fc558b9f1262e7b63ab307ce991e2b874aabe76c77d4d57c59269a2b0006e86f1b7539bcc3e5a27849707f6443143bfc1ca7feab90f9b5ab5b79a05c0610c8958c96412df0a29e5ea173082869db8562eaa8a184b0522a1d0547db1dd81a8dd68e6b65c5dfeac3431aaed7a8545e552d02aac86983f95d00f310d280b50f0845f47f2be1247914c21eba0ef23db4befcb3efdeea96f7b068ebfc6364c5c1e1fd6d93605b08afb5fd282dbcb66064336b66e35ce0ad84e24310e6434458321705b33143c1f4715484fbb819f476db376027af56ab11ca6071e6355bf38ab45c20ba139354087ea4aaa094e7470d908e6502c321829d3db060a934c7429ac6439ecb6c4cb49a2fc567ae58981ea9f477373a10ca26b3ec93a16fa17477471499e639fc63c6091b886c925be23b77aadd1111bf4066f12b3af5657ba2985c55d376293851fb6e9e62b064e690ebb7cee1fdc56f2706e276f3eed72e5b73ea142928b1592e248cb631e3ff04db1bb3ba09eac4e80d9a686e5da8a4d538008021e08ee861eb4266ba5c3cbb065f0b2cb29a4c92d96e60a5576ce7d4ec8553d9881fb8cccc96a797235538e22b3e38385849ce6f0b463510ebae477ff768fae5ab1217bd9af55c38f414789f52a343b0f8b5a8c2e47e3a9017ab792938394154d055ac73f7ea662d70855864b990042eaa4ac9236d11767878e967a308d24368e8631bd76e6c87a489960a6af8fca332c0f2d4e42fee2d83c45f0796c66c5ae966d0d08c4ed9c7ebca7d9d9d88fa8019973951a47cdb765e72c369983fc02c2bf01439c9784094c2f7f711d75276c12f9deeb51971cb940e08ffade39ab0939a3cffdd53510f3968ca2d2ea1defcf591159c73d499c5a6f862328b0a992fdb229c2a2560fea5d1800ae6a71924397b14bb1efd35e70d7b3b1b65b7b55c62661cf44826e2d3065e0343b60d5add15ee2e5feb0a616e5147f9c2415a7fbd491752c52ed83ad5d12620d32ec9f6569fbd593bd914c28603795595f4078971d35952b83da927eec6a2b3a5daca34382b77f613cd099b51e2805dded97054c71d56c50fa8b75c83c81a262e7512945fbf33a79c54caff344e1a0c87cda6f1ae3c55d549c5a60528f1e39fd7495abfafbbe33520c7f87fe3faea924b3b64d3f97c843576b7f36438d1e3f5031c63fd8087cebcb95616fdebfaded27258a0469e941188723bba21662665c3d370ad057cb9598712743aee1d78c325fc6b9dcf155644092bfcd670375fcfc280cfc5e7edd4a686ffae3be5a16497fdba004c23bcbc95d1e832473587e37b1a9eccca9e46471a35fdf20d960ad9e8d5f6318d3cb651ff0358889d639092defd2ba5405e5ad9fcd25cb0f2c0486f39957e7cd39e2f5720de3ac9c176aec86933b2d1b00ee97cff0ced05cf83964e6bfa1f8daeb6ba8b05ff16cb99d631f87aa4b216bb9b920056ae0fde17c3a3b9d805d476f40afd5aa4debab31164f490870e20006cf995f1ec4d8bf2888a846282fb4b517393f9f10fb48bcc3af06949285b17a4a01d63fdab2f7f40da6076ae495cdf6bc06cd0c3efb620d52d856a739f67697dc2984341c7d27a4720e91094a92a22db067472d6a2bf58e20088c7e5638da3990925ca9670db437ca0524baebd4185e96704a71900979a3878b42535268ef5ccd79f9a7dec32c09e4cb9011bf184194cb0654ed9e25634db455ea64342b20324d36c38ace315a0cb5c3629368a4030b7b0da8e36fb99fc8210f1651af0447c2595f7d7ab6bdcfc37ffa9832a03859969870c714f98f35413e8a38af451afb02de78bcca9ba64eb202d072778f23ce60d9579e4aa531cdce718ec94cad9ac349d6d4ba9bbb3dfb7ce7698686de61d032889deccef44a48b35197650271527d51586abbf70e7228194678bd2eaa7063487f8673bb9c3bad7379d5d2990d578d1f1001f2c046b8b0bead461d4857f2734106e70d598171097214d48dbf33381737d9bb62f560cc3875162e383b177afc9086c02a24ecbe69236e1d9242fa4c15ee9e7e88c75d5baedb13663ae040899e696127633ac055f6e7abfb3e066dfc5f5c7512c1ea761f5cb6ec962d769693e1ea0f4e8c37cb60e12763c9496f9f80b0ff69e9daf34bcfa473867b255fd17aa45c84951b46d7c540f446d878cfe44a1516407cd548b8596e562a9f27d73ca48e03e699edccbad12ec8984bd9a06761ee2276cf052e17cb0cccfa8605cce5f5728073c9da2ca99eda979452460d1a198efb336725acbfb31aa5bb8afc4bc2235b484cc4136c570feee1b6b99844d8e5a1df0238b689168d399effa40160296aaefc6fbfe79d0e3253f1d4fc9f25b93a027a1090462c2e6a2031facd2aa5dee7ed3e71194a83f0a978fc241cc2dab0d8e536925d0004d7e4b276d9758886d8b832c1e55b7ab7c2cf5901b37a0d64e6b7116a82f55b8fa7e80a78f64d047899102a1fb3cc403c167bad8cbf790473af60dd727c6be7f3458f98bb2c98843543a7df577fb45b6b0cc5733bfed8de77c8b0d771d67e4cfa0a03df25cfe6ea27e835dee02c955a737e2b9712bc14f35bf26cd6cb4aba24bbfe14dde49bfaef32546a7d59301fa264e7b7832ddc00e7b4c12db7dbefe13480da79625a823c84e64573b0276c0a7c2f3bf504492fe42a4166bd2639c1098eaf12a5b1f1c23931277897567b2690835bbae45bbb2db8e0bf0aeca475d11a5b92db09bf4b5b5b737d87897c8b07fd6f4a66772d71d96fdf9c084c4935a92d10490628c2cf74d13b7d4b241164bd1618ac4075582c4cbc1e85de65d742d3d81bc160737e0657d0b255675a081851904eecf0b16a2f4d73fc37a0b04803cb26c1b0f84ee0b3aaf7a42bfeac015442a680d4a1bea306d8cedb8e7159866dc5f87bb8c6ab90869229b91f01671a389939b90d5000eb7b20fded5824378253f2fe8fd082cad273b8d98b99ffd446e619c6f1f01cef3c41ade55a7eb30569d7430b12fe349c2b19a8f160b92f758a3c60fb381c562b6db932fafc79206a89f09431533478aa5b3ee"})
r2 = syz_io_uring_setup(0x1, &(0x7f0000000080), &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140))
syz_io_uring_submit(r3, r1, &(0x7f0000000280)=@IORING_OP_OPENAT2={0x1c, 0x2, 0x0, 0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x18}, 0x0)
io_uring_enter(r0, 0x4572, 0x0, 0x0, 0x0, 0x0)
r5 = syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x200004)
close_range(r2, r5, 0x2)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='loginuid\x00')
writev(r6, &(0x7f0000000140)=[{&(0x7f0000000040)='2', 0x1}], 0x1)

评论 (1)

Li Lingfeng 创建了缺陷

Hi li-lingfeng3, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers: @YangYingliang , @成坚 (CHENG Jian) , @jiaoff , @zhengzengkai , @刘勇强 , @wangxiongfeng , @朱科潜 , @WangShaoBo , @lujialin , @wuxu_buque , @Xu Kuohai , @冷嘲啊 , @Lingmingqiang , @yuzenghui , @岳海兵 , @juntian , @OSSIM , @陈结松 , @whoisxxx , @koulihong , @刘恺 , @hanjun-guo , @woqidaideshi , @Chiqijun , @Kefeng , @ThunderTown , @AlexGuo , @kylin-mayukun , @Zheng Zucheng , @柳歆 , @Jackie Liu , @zhujianwei001 , @郑振鹏 , @SuperSix173 , @colyli , @Zhang Yi , @htforge , @Xie XiuQi

登录 后才可以发表评论

状态
负责人
项目
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
预计工期 (小时)
参与者(2)
5329419 openeuler ci bot 1632792936
C
1
https://gitee.com/openeuler/kernel.git
git@gitee.com:openeuler/kernel.git
openeuler
kernel
kernel

搜索帮助