【openEuler-1.0-LTS】dm_multipath压力测试中出现UAF

【标题描述】欧拉OS dm_multipath测试用例出现UAF
【环境信息】
【问题复现步骤】
1、在内核中加时延：
```c
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index b00f767af0e3..b25c7d026180 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -536,6 +536,7 @@ void dm_put_device(struct dm_target *ti, struct dm_dev *d)
        }
        if (refcount_dec_and_test(&dd->count)) {
                dm_put_table_device(ti->table->md, d);
+               msleep(10*1000);
                list_del(&dd->list);
                kfree(dd);
        }
```
在dm_put_device中增加10s的时延。

2、使用以下脚本加载iscsi和mpath服务

```sh
#!/bin/sh

ifconfig lo:0 127.0.0.2 up
ifconfig lo:1 127.0.0.3 up
ifconfig lo:2 127.0.0.4 up

# iscsi
cat << EOF > /etc/tgt/targets.conf
    <target iqn.2019-04.jenkins.disk>
            backing-store /dev/sda #使用sda作为后端设备
    </target>
EOF

service tgtd restart

# dm multipath
cat << EOF > /etc/multipath.conf
blacklist {
	devnode "^(ram|raw|loop|fd|md|dm-|sr|scd|st|pmem)[0-9]*"
	devnode "^hd[a-z][[0-9]*]"
	devnode "^vd[a-z][[0-9]*]"
	devnode "^cciss!c[0-9]d[0-9]*[p[0-9]*]"
}
defaults {
	path_checker            tur
	no_path_retry           18
	path_grouping_policy    group_by_prio
	prio                    const
	deferred_remove         yes
	uid_attribute           "ID_SERIAL"
	reassign_maps           no
	failback                immediate
	log_checker_err         once
}
multipaths {
	multipath {
		wwid                    360000000000000000e00000000010001
		alias                   mpath_disk          #磁盘别名
		path_selector           "service-time 0"    #负载均衡模式
	}
}
EOF

service multipathd restart
service iscsid restart
iscsiadm -m discovery -p 127.0.0.2 -t st
iscsiadm -m discovery -p 127.0.0.3 -t st
iscsiadm -m discovery -p 127.0.0.4 -t st
iscsiadm -m node -u  ##登出iscsi设备
iscsiadm -m node -u
iscsiadm -m node -l  ##登录iscsi设备，使用完毕后通过-u登出
```

3、完成dm设备的挂载和路径删除

```
mkfs.ext4 /dev/mapper/0QEMU_QEMU_HARDDISK_b_1
mount /dev/mapper/0QEMU_QEMU_HARDDISK_b_1 /mnt
multipathd del path /dev/sda
```

4、串口一 发送message信息：

```
dmsetup message /dev/mapper/0QEMU_QEMU_HARDDISK_b_1 0 "reinstate_path /dev/sda"
```

5、串口二 发送deps信息：

```
dmsetup deps /dev/mapper/0QEMU_QEMU_HARDDISK_b_1

```

问题必现：

```
[  773.599225] dm_put_table_device free td ffff888104a725d8
[  777.835868] retrieve_deps dd->dm_dev name 8:16, add ffff888104a725d8
[  777.842281] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[  777.843633] PGD 0 P4D 0 
[  777.844101] Oops: 0000 [#1] SMP
[  777.844643] CPU: 0 PID: 1157 Comm: dmsetup Not tainted 4.18.0 #2
[  777.845668] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
[  777.848542] RIP: 0010:table_deps.cold.13+0x35/0x69
[  777.849389] Code: 48 c7 c7 90 24 cc 8b 48 83 05 af 5b 54 04 01 48 8d 51 14 e8 ac 7e 32 ff 49 8b 47 18 8b 34 24 48 83 05 8f 5b 54 04 01 48 8b 00 <8b> 10 89 d0 89 d1 0f b6 d2 c1 e8 14 c1 e1 0c c1 e0 08 81 e1 0
[  777.852714] RSP: 0018:ffffc90002db3c90 EFLAGS: 00010202
[  777.853684] RAX: 0000000000000000 RBX: ffff88810e560000 RCX: 0000000000000000
[  777.854939] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8883f0a15c18
[  777.856249] RBP: ffff88810d370000 R08: 0000000000000246 R09: 0000000000000030
[  777.857508] R10: 0000000000000245 R11: ffffffff8cde3887 R12: ffff88810e560138
[  777.858781] R13: ffff888106883200 R14: 0000000000000010 R15: ffff88810d22c760
[  777.860060] FS:  00007f7403ebbdc0(0000) GS:ffff8883f0a00000(0000) knlGS:0000000000000000
[  777.861578] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  777.862575] CR2: 0000000000000000 CR3: 000000010e5ae000 CR4: 00000000000006f0
[  777.863836] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  777.865096] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  777.866407] Call Trace:
[  777.866912]  ? table_status+0xf0/0xf0
[  777.867578]  ctl_ioctl+0x22e/0x5e0
[  777.868202]  dm_ctl_ioctl+0x12/0x20
[  777.868847]  do_vfs_ioctl+0xa9/0xa80
[  777.869489]  ? __do_page_fault+0x390/0x980
[  777.870198]  ksys_ioctl+0x4a/0xa0
[  777.870782]  __x64_sys_ioctl+0x1e/0x30
[  777.871439]  do_syscall_64+0xc1/0x3e0
[  777.872079]  entry_SYSCALL_64_after_hwframe+0x65/0xca
[  777.872996] RIP: 0033:0x7f7403636577
[  777.873628] Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 88 2c 00 f7 d8 64 89 8
[  777.876901] RSP: 002b:00007ffd6bc52658 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  777.878223] RAX: ffffffffffffffda RBX: 00007f7403b19930 RCX: 00007f7403636577
[  777.879447] RDX: 0000564dfb136110 RSI: 00000000c138fd0b RDI: 0000000000000003
[  777.880674] RBP: 0000000000000000 R08: 00007f7403b52138 R09: 00007ffd6bc524c0
[  777.881913] R10: 00007f7403b515f3 R11: 0000000000000246 R12: 0000000000000000
[  777.883168] R13: 0000564dfb136140 R14: 0000564dfb136110 R15: 0000564dfb136030
[  777.884472] Modules linked in: dm_service_time dm_multipath
[  777.885461] CR2: 0000000000000000
[  777.886080] ---[ end trace 6e5ae08be3c43dcf ]---
[  777.886969] RIP: 0010:table_deps.cold.13+0x35/0x69
[  777.887862] Code: 48 c7 c7 90 24 cc 8b 48 83 05 af 5b 54 04 01 48 8d 51 14 e8 ac 7e 32 ff 49 8b 47 18 8b 34 24 48 83 05 8f 5b 54 04 01 48 8b 00 <8b> 10 89 d0 89 d1 0f b6 d2 c1 e8 14 c1 e1 0c c1 e0 08 81 e1 0
[  777.891205] RSP: 0018:ffffc90002db3c90 EFLAGS: 00010202
[  777.892118] RAX: 0000000000000000 RBX: ffff88810e560000 RCX: 0000000000000000
[  777.893391] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8883f0a15c18
[  777.894694] RBP: ffff88810d370000 R08: 0000000000000246 R09: 0000000000000030
[  777.896001] R10: 0000000000000245 R11: ffffffff8cde3887 R12: ffff88810e560138
[  777.897371] R13: ffff888106883200 R14: 0000000000000010 R15: ffff88810d22c760
[  777.898612] FS:  00007f7403ebbdc0(0000) GS:ffff8883f0a00000(0000) knlGS:0000000000000000
[  777.900096] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  777.901140] CR2: 0000000000000000 CR3: 000000010e5ae000 CR4: 00000000000006f0
[  777.902409] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  777.903722] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  783.839110] dm_put_device dm_dev name 8:16
```

问题分析：
该问题能出现以下并发场景：

```

设备路径删除之后，发送message会调用dm_get_device()，且去创建一个新的dd，完成对应message的操作之后会调用dm_put_device(),由于在dm_get_device()中新建的达到引用计数为1，因此dm_put_device()会destroy dd，若在此时调用table_deps()，则会触发UAF。

GVP openEuler/kernel
关闭

内容风险标识

评论 (2)

GVPopenEuler/kernel关闭

内容风险标识