[OLK6.6][hfs] CVE-2018-12928

**【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）**

**一、缺陷信息**
```
[  464.683167] hfs: unable to locate alternate MDB
[  464.683547] hfs: continuing without an alternate MDB
[  464.684075] BUG: kernel NULL pointer dereference, address: 0000000000000040
[  464.684618] #PF: supervisor read access in kernel mode
[  464.685033] #PF: error_code(0x0000) - not-present page
[  464.685439] PGD 6e48067 P4D 6e48067 PUD 8832067 PMD 0 
[  464.685847] Oops: 0000 [#1] PREEMPT SMP
[  464.686154] CPU: 3 PID: 748 Comm: hfs_inject Not tainted 6.6.0-01904-g5f6959411f74 #59
[  464.686776] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
[  464.687795] RIP: 0010:hfs_find_init+0x1d/0xe0
[  464.688164] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 66 0f 1f 00 0f 1f 44 00 00 55 48 89 f5 53 48 89 fb 48 89 7e 10 48 c7 46 18 00 00 00 00 <8b> 47 40 be c0 0c 00 00 48 83 05 fb 10 98 0b 01 8d 7c 00 04 e
8 aa
[  464.689601] RSP: 0018:ffffc90000ceba40 EFLAGS: 00010246
[  464.690019] RAX: ffff88800298ee00 RBX: 0000000000000000 RCX: 0000000000000000
[  464.690574] RDX: 0000000000000000 RSI: ffffc90000ceba58 RDI: 0000000000000000
[  464.691133] RBP: ffffc90000ceba58 R08: ffff888016a34058 R09: 0000000000000000
[  464.691688] R10: 0000000000000800 R11: ffff888016a340b0 R12: 0000000000000000
[  464.692254] R13: 0000000000000000 R14: ffff888016834000 R15: 0000000000000000
[  464.692819] FS:  00007f462cb90440(0000) GS:ffff8880bcb80000(0000) knlGS:0000000000000000
[  464.693450] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  464.693906] CR2: 0000000000000040 CR3: 000000001566f000 CR4: 00000000000006e0
[  464.694460] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  464.695025] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  464.695577] Call Trace:
[  464.695798]  <TASK>
[  464.695983]  ? show_regs+0x88/0xa0
[  464.696259]  ? __die_body+0x27/0xa0
[  464.696539]  ? __die+0x3a/0x50
[  464.696793]  ? page_fault_oops+0x1d2/0x5e0
[  464.697116]  ? hfs_find_init+0x1d/0xe0
[  464.697413]  ? search_bpf_extables+0x7a/0xc0
[  464.697762]  ? search_exception_tables+0x80/0x90
[  464.698126]  ? kernelmode_fixup_or_oops+0x140/0x1a0
[  464.698508]  ? __bad_area_nosemaphore+0x209/0x350
[  464.698882]  ? find_vma+0x48/0x90
[  464.699148]  ? bad_area_nosemaphore+0x1a/0x30
[  464.699492]  ? do_user_addr_fault+0x94f/0x10e0
[  464.699849]  ? exc_page_fault+0x73/0x280
[  464.700160]  ? asm_exc_page_fault+0x26/0x30
[  464.700488]  ? hfs_find_init+0x1d/0xe0
[  464.700798]  hfs_ext_read_extent+0x57/0x280
[  464.701131]  ? alloc_buffer_head+0x69/0xc0
[  464.701454]  ? folio_alloc_buffers+0x129/0x310
[  464.701810]  hfs_get_block+0x1b3/0x2f0
[  464.702107]  block_read_full_folio+0x113/0x590
[  464.702460]  ? hfs_extend_file+0x3b0/0x3b0
[  464.702795]  ? memcg_list_lru_alloc+0x630/0x630
[  464.703151]  ? hfs_bmap+0x30/0x30
[  464.703416]  hfs_read_folio+0x20/0x30
[  464.703712]  filemap_read_folio+0x2f/0xf0
[  464.704031]  do_read_cache_folio+0xfa/0x3b0
[  464.704359]  ? hfs_free_extents+0x110/0x110
[  464.704691]  do_read_cache_page+0x16/0xa0
[  464.705014]  read_cache_page+0x1a/0x30
[  464.705312]  hfs_btree_open+0x1ce/0x690
[  464.705617]  hfs_mdb_get+0x61e/0x990
[  464.705914]  hfs_fill_super+0x66c/0xa50
[  464.706220]  ? vsnprintf+0x23c/0x850
[  464.706509]  ? snprintf+0x55/0x70
[  464.706787]  ? sb_set_blocksize+0x24/0x80
[  464.707107]  ? hfs_init_once+0x30/0x30
[  464.707406]  mount_bdev+0x14c/0x1e0
[  464.707691]  hfs_mount+0x1d/0x30
[  464.707964]  legacy_get_tree+0x30/0x70
[  464.708264]  vfs_get_tree+0x2b/0x120
[  464.708552]  path_mount+0x821/0xfc0
[  464.708843]  do_mount+0x91/0xc0
[  464.709100]  __x64_sys_mount+0xc4/0x160
[  464.709407]  do_syscall_64+0x39/0x80
[  464.709705]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  464.710108] RIP: 0033:0x7f462c51123a
[  464.710398] Code: 48 8b 0d 51 dc 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1e dc 2b 00 f7 d8 64 89 01 48
[  464.711838] RSP: 002b:00007ffd9dc31fc8 EFLAGS: 00000217 ORIG_RAX: 00000000000000a5
[  464.712424] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f462c51123a
[  464.712986] RDX: 000000000040204a RSI: 000000000040204e RDI: 00007ffd9dc31ff0
[  464.713539] RBP: 00007ffd9dc330a0 R08: 0000000000000000 R09: 0000000000000000
[  464.714096] R10: 0000000000000001 R11: 0000000000000217 R12: 0000000000401150
[  464.714649] R13: 00007ffd9dc33180 R14: 0000000000000000 R15: 0000000000000000
[  464.715215]  </TASK>
[  464.715398] Modules linked in:
[  464.715655] CR2: 0000000000000040
[  464.715966] ---[ end trace 0000000000000000 ]---
[  464.716334] RIP: 0010:hfs_find_init+0x1d/0xe0
[  464.716707] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 66 0f 1f 00 0f 1f 44 00 00 55 48 89 f5 53 48 89 fb 48 89 7e 10 48 c7 46 18 00 00 00 00 <8b> 47 40 be c0 0c 00 00 48 83 05 fb 10 98 0b 01 8d 7c 00 04 e8 aa
[  464.718155] RSP: 0018:ffffc90000ceba40 EFLAGS: 00010246
[  464.718568] RAX: ffff88800298ee00 RBX: 0000000000000000 RCX: 0000000000000000
[  464.719161] RDX: 0000000000000000 RSI: ffffc90000ceba58 RDI: 0000000000000000
[  464.719748] RBP: ffffc90000ceba58 R08: ffff888016a34058 R09: 0000000000000000
[  464.720306] R10: 0000000000000800 R11: ffff888016a340b0 R12: 0000000000000000
[  464.720881] R13: 0000000000000000 R14: ffff888016834000 R15: 0000000000000000
[  464.721442] FS:  00007f462cb90440(0000) GS:ffff8880bcb80000(0000) knlGS:0000000000000000
[  464.722088] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  464.722542] CR2: 0000000000000040 CR3: 000000001566f000 CR4: 00000000000006e0
[  464.723123] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  464.723708] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  464.724271] Kernel panic - not syncing: Fatal exception
[  464.724851] Kernel Offset: disabled
[  464.725131] ---[ end Kernel panic - not syncing: Fatal exception ]---
```
**内核信息：**

**缺陷归属组件：**

**缺陷归属的版本：**

**缺陷简述：**

**【环境信息】**
硬件信息
- 裸机场景请提供问题的硬件信息
- 虚拟机场景请提供虚拟机的XML文件或配置信息
软件信息
- OS版本及分支信息
- 内核信息
- 发现问题的组件版本信息
网络信息
- 如果有特殊组网，请提供网络拓扑信息

**【问题复现步骤】**，请描述具体的操作步骤
复现程序见附件hfs.zip, 复现方法:
./hfs_inject nullptr

**【实际结果】**，请描述出问题的结果和影响
**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等

**缺陷详情参考链接：**
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763384

**缺陷分析指导链接：**
https：xxx

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识