【OLK-5.10】打开KASAN选项对内核进行syzkaller模糊测试，BUG: unable to handle kernel NULL pointer dereference in nbd_open

【严重程度】 一般
【特性】 block驱动/nbd
【重现类型】 有条件必然重现
【定位分析】 </p><p>bugzilla:  http://openeuler.huawei.com/bugzilla/show_bug.cgi?id=188902</p><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block">   T1                      T2</div><div class="ql-code-block">vfs_open</div><div class="ql-code-block">  do_dentry_open</div><div class="ql-code-block">    blkdev_open</div><div class="ql-code-block">      blkdev_get</div><div class="ql-code-block">        __blkdev_get</div><div class="ql-code-block">          nbd_open</div><div class="ql-code-block">                        genl_rcv_msg</div><div class="ql-code-block">                          genl_family_rcv_msg</div><div class="ql-code-block">                            genl_family_rcv_msg_doit</div><div class="ql-code-block">                              nbd_genl_connect</div><div class="ql-code-block">                                nbd-&gt;config = config; // 2</div><div class="ql-code-block">                                // out of order execution</div><div class="ql-code-block">                                refcount_set(&amp;nbd-&gt;config_refs, 1); // 1</div><div class="ql-code-block">            nbd_disconnected(nbd-&gt;config) // null point</div><div class="ql-code-block">            </div></div><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">nbd_genl_connect 中的 nbd-&gt;config = config 和 refcount_set(&amp;nbd-&gt;config_refs, 1); 可能乱序，导致config_refs先被置成1， 然后nbd_open 访问nbd-&gt;config报空指针引用。</div></div><p><br></p><p>

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识