[openEuler-1.0-LTS] BUG: KASAN: use-after-free in squashfs_get_id

## 错误信息
```
[  324.389676] ==================================================================                        
[  324.391008] BUG: KASAN: use-after-free in squashfs_get_id+0xf5/0x1a0                                  
[  324.392918] Read of size 8 at addr ffff88800e461858 by task repro/606                                 
                                                                                                         
[  324.394418] CPU: 2 PID: 606 Comm: repro Not tainted 4.19.90 #5                                        
[  324.395460] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014      
[  324.397014] Call Trace:                                                                               
[  324.397541]  dump_stack+0x105/0x14f                                                                   
[  324.398225]  print_address_description+0x9e/0x36a                                                     
[  324.399130]  kasan_report.cold.4+0x22a/0x26a                                                          
[  324.399929]  ? squashfs_get_id+0xf5/0x1a0                                                             
[  324.400692]  __asan_load8+0x115/0x120                                                                 
[  324.401392]  squashfs_get_id+0xf5/0x1a0                                                               
[  324.402141]  ? squashfs_read_fragment_index_table+0xb0/0xb0                                           
[  324.403164]  ? squashfs_read_data.cold.5+0x7f/0x7f                                                    
[  324.404059]  ? memcpy+0x6a/0x80                                                                       
[  324.404689]  ? kasan_check_write+0x20/0x30                                                            
[  324.405469]  ? _raw_spin_lock+0x2b/0x80                                                               
[  324.406219]  ? squashfs_cache_put+0x5a/0x110                                                          
[  324.407019]  ? squashfs_read_metadata+0xeb/0x240                                                      
[  324.407884]  squashfs_read_inode+0x1f9/0x11d0                                                         
[  324.408692]  ? __kasan_slab_free+0x175/0x240                                                          
[  324.409528]  ? squashfs_get_id.cold.0+0x3a/0x3a                                                       
[  324.410423]  ? kasan_check_write+0x20/0x30                                                            
[  324.411192]  ? _raw_spin_lock+0x2b/0x80                                                               
[  324.411902]  ? squashfs_cache_get+0x426/0x850                                                         
[  324.412720]  ? map_id_range_down+0x1a3/0x1d0                                                          
[  324.413506]  ? from_kuid+0xb0/0xb0                                                                    
[  324.414173]  ? kasan_unpoison_shadow+0x38/0x60                                                        
[  324.414996]  ? kasan_kmalloc+0x115/0x130                                                              
[  324.415755]  ? __list_add_valid+0x3b/0x1c0                                                            
[  324.416538]  ? inode_sb_list_add+0xcb/0x120                                                           
[  324.417364]  ? squashfs_iget+0xb1/0xf6                                                                
[  324.418060]  squashfs_iget+0xb1/0xf6                                                                  
[  324.418743]  squashfs_lookup+0x6f9/0x8a0                                                              
[  324.419529]  ? squashfs_read_inode.cold.0+0x10a/0x10a                                                 
[  324.420483]  ? __d_lookup_rcu+0x3e0/0x3e0                           
[  324.419529]  ? squashfs_read_inode.cold.0+0x10a/0x10a                                                                                                                                              [3286/19675]
[  324.420483]  ? __d_lookup_rcu+0x3e0/0x3e0                                                                                                                                                                      
[  324.421244]  ? __save_stack_trace+0xba/0x180                                                          
[  324.422062]  ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1                                                                                                                                                        
[  324.423049]  ? __d_lookup+0x57/0x330                                                                  
[  324.423732]  ? kasan_check_write+0x20/0x30                                                                                                                                                                     
[  324.424507]  ? squashfs_read_inode.cold.0+0x10a/0x10a                                                 
[  324.425431]  lookup_open+0x33e/0xed0                                                                                                                                                                           
[  324.426147]  ? deref_stack_reg+0xf0/0xf0                                                              
[  324.426882]  ? path_mountpoint+0x6f0/0x6f0                                                                                                                                                                     
[  324.427643]  ? walk_component+0x92/0x790                                                              
[  324.428378]  ? __mnt_want_write+0xf9/0x120                                                                                                                                                                     
[  324.429160]  do_last+0xe5a/0x1540                                                                     
[  324.429808]  ? lookup_open+0xed0/0xed0                                                                                                                                                                         
[  324.430514]  ? generic_permission+0x56/0x410                                                          
[  324.431308]  ? security_inode_permission+0x18/0xc0                                                    
[  324.432187]  ? inode_permission+0xba/0x390                                                                                                                                                                     
[  324.432948]  ? link_path_walk+0x2df/0xb10                                                             
[  324.433714]  ? __alloc_file+0x2c/0x200                                                                
[  324.434435]  ? walk_component+0x790/0x790                                                             
[  324.435203]  ? path_init+0x478/0x750                                                                  
[  324.435912]  path_openat+0x10d/0x550                                                                  
[  324.436581]  ? _atomic_dec_and_lock+0xc4/0x1cd                                                        
[  324.437421]  ? do_last+0x1540/0x1540                                                                  
[  324.438097]  ? kasan_check_read+0x1d/0x30                                                             
[  324.438851]  ? mutex_lock+0xa6/0x110                                                                  
[  324.439515]  ? __mutex_lock_slowpath+0x30/0x30                                                        
[  324.440375]  do_filp_open+0x124/0x1f0                                                                 
[  324.441081]  ? may_open_dev+0x60/0x60                                                                 
[  324.441801]  ? files_cgroup_unalloc_fd+0x70/0x70                                                      
[  324.442656]  ? __check_object_size+0x1f1/0x2dc                                                        
[  324.443556]  do_sys_open+0x287/0x3a0                                                                  
[  324.444250]  ? filp_open+0x80/0x80                                                                    
[  324.444942]  __x64_sys_openat+0x5b/0x70                                                               
[  324.445678]  do_syscall_64+0xe3/0x560                                                                 
[  324.446388]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1                                                 
                                                                                                         
[  324.447652] Allocated by task 237:                                                                    
[  324.448304]  save_stack+0x4f/0x140                                                                    
[  324.448949]  kasan_kmalloc+0x115/0x130                                                                
[  324.449670]  __kmalloc+0x195/0x370                                                                    
[  324.450310]  kernfs_fop_write+0x263/0x300                                                             
[  324.451055]  __vfs_write+0xce/0x4a0                                                                   
[  324.451699]  vfs_write+0x105/0x2f0                                                                    
[  324.452336]  ksys_write+0xb9/0x1f0                                                                    
[  324.452975]  __x64_sys_write+0x46/0x60                                                                
[  324.453672]  do_syscall_64+0xe3/0x560                                                                 
[  324.454358]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1                                                 
                                                                                                         
[  324.455552] Freed by task 237:                                                                        
[  324.456145]  save_stack+0x4f/0x140                                                                    
[  324.456787]  __kasan_slab_free+0x158/0x240                                                            
[  324.457553]  kasan_slab_free+0x12/0x20                                                                
[  324.458262]  kfree+0xdf/0x3b0                                                                         
[  324.458835]  kernfs_fop_write+0xef/0x300                 
[  324.458262]  kfree+0xdf/0x3b0                                                                                                                                                                      [3233/19675]
[  324.458835]  kernfs_fop_write+0xef/0x300                                                                                                                                                                       
[  324.459573]  __vfs_write+0xce/0x4a0                                                                   
[  324.460221]  vfs_write+0x105/0x2f0                                                                                                                                                                             
[  324.460861]  ksys_write+0xb9/0x1f0                                                                    
[  324.461502]  __x64_sys_write+0x46/0x60                                                                                                                                                                         
[  324.462202]  do_syscall_64+0xe3/0x560                                                                 
[  324.462871]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1                                                                                                                                                          
                                                                                                         
[  324.464403] The buggy address belongs to the object at ffff88800e461858                                                                                                                                        
                which belongs to the cache kmalloc-8 of size 8                                           
[  324.466522] The buggy address is located 0 bytes inside of                                                                                                                                                     
                8-byte region [ffff88800e461858, ffff88800e461860)                                       
[  324.468510] The buggy address belongs to the page:                                                                                                                                                             
[  324.469387] page:ffffea0000391840 count:1 mapcount:0 mapping:ffff88800b003c00 index:0xffff88800e461f18
[  324.471057] flags: 0xfffffc0000100(slab)                                                              
[  324.471799] raw: 000fffffc0000100 ffffea00003931c0 0000000200000002 ffff88800b003c00                                                                                                                           
[  324.473181] raw: ffff88800e461f18 0000000080aa0070 00000001ffffffff 0000000000000000                  
[  324.474557] page dumped because: kasan: bad access detected                                           
                                                                                                         
[  324.475845] Memory state around the buggy address:                                                    
[  324.476710]  ffff88800e461700: fc 00 fc fc 00 fc fc fb fc fc fb fc fc fb fc fc                        
[  324.477990]  ffff88800e461780: fb fc fc fb fc fc fb fc fc fb fc fc 00 fc fc fb                        
[  324.479271] >ffff88800e461800: fc fc fb fc fc fb fc fc 00 fc fc fb fc fc fb fc                        
[  324.480541]                                                     ^                                     
[  324.481635]  ffff88800e461880: fc fb fc fc fb fc fc fb fc fc fb fc fc fb fc fc                        
[  324.482919]  ffff88800e461900: fb fc fc fb fc fc fb fc fc fb fc fc fb fc fc fb                        
[  324.484177] ==================================================================  
```

## 复现方法
cc poc.c -static -lpthread -o repro
运行./repro

GVP openEuler/kernel

内容风险标识

评论 (3)

GVPopenEuler/kernel

内容风险标识