4.19版本需要回退commit 0380474221530以同步解决perf_event_detach_bpf_prog uaf问题

【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）
4.18内核OS版本长稳测试，perf_event_detach_bpf_prog出现uaf问题，4.19经排查需要同步修复该问题
【环境信息】
硬件信息：
1）	裸机场景提供出问题的硬件信息；
2）	虚机场景提供虚机XML文件或者配置信息
虚拟机和裸机场景均有问题
软件信息：
1）	OS版本及分支
2）	内核信息
3）	发现问题的组件版本信息
openEuler-1.0-LTS
如果有特殊组网，请提供网络拓扑图
【问题复现步骤】
具体操作步骤
长稳测试
出现概率(是否必现，概率性错误)
概率性错误
【预期结果】
描述预期结果，可以通过对比新老版本获取
系统正常
【实际结果】
描述出问题的结果 
4.18内核perf_event_detach_bpf_prog出现uaf

【附件信息】
比如系统message日志/组件日志、dump信息、图片等
4.18内核问题日志：
Apr 14 12:22:27 euleros-pxe kernel: [ 8071.732140] Using feature eBPF/event.
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.044984] ==================================================================
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.052325] BUG: KASAN: use-after-free in perf_event_detach_bpf_prog+0xb6/0x1c0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.059735] Read of size 8 at addr ffff88b1cefdddd8 by task bpftrace/1416068
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.066847]
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068421] CPU: 56 PID: 1416068 Comm: bpftrace Kdump: loaded Not tainted 4.18.0-147.5.2.8.h878.kasan.eulerosv2r10.x86_64 #1
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068425] Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 1.57 08/11/2015
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068427] Call Trace:
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068442] dump_stack+0xc2/0x12e
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068452] print_address_description+0x70/0x360
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068461] ? vprintk_func+0x5e/0x100
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068467] kasan_report+0x1b2/0x330
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068475] ? perf_event_detach_bpf_prog+0xb6/0x1c0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068480] ? perf_event_detach_bpf_prog+0xb6/0x1c0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068486] perf_event_detach_bpf_prog+0xb6/0x1c0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068492] ? perf_event_attach_bpf_prog+0x210/0x210
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068500] ? __queue_delayed_work+0xf0/0x170
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068507] _free_event+0x18f/0x8d0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068512] put_event+0x31/0x40
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068518] perf_event_release_kernel+0x3a9/0x620
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068525] ? __perf_event_exit_context+0xb0/0xb0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068534] ? propagate_protected_usage+0x26/0x1e0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068539] ? perf_event_release_kernel+0x620/0x620
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068544] perf_release+0x21/0x30
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068551] __fput+0x180/0x430
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068558] task_work_run+0x101/0x140
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068568] exit_to_usermode_loop+0x157/0x160
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068574] do_syscall_64+0x28e/0x2d0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068583] entry_SYSCALL_64_after_hwframe+0x65/0xca
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068588] RIP: 0033:0x7f1cfac7d9ab
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068597] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 c3 ae f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 11 af f8 ff 8b 44
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068601] RSP: 002b:00007ffc4ebf1180 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068607] RAX: 0000000000000000 RBX: 000000000000005f RCX: 00007f1cfac7d9ab
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068610] RDX: 0000000000000000 RSI: 0000000000002401 RDI: 000000000000005f
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068614] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000564874c4e314
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068617] R10: 00000000ffffffff R11: 0000000000000293 R12: 0000564874c50ec0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068621] R13: 0000564874c4e314 R14: 00007ffc4ebf12c0 R15: 0000564874dde300
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.068624]
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.070197] Allocated by task 1416068:
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074037] kasan_kmalloc+0xa0/0xd0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074049] __kmalloc+0x11f/0x290
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074061] alloc_trace_uprobe+0x171/0x310
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074071] create_local_trace_uprobe+0x121/0x2a0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074080] perf_uprobe_init+0xfa/0x180
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074091] perf_uprobe_event_init+0x78/0xc0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074100] perf_try_init_event+0x80/0x270
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074111] perf_event_alloc.part.19+0xc9f/0x1550
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074121] perf_event_alloc+0x67/0x90
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074130] __do_sys_perf_event_open+0x216/0x16f0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074139] do_syscall_64+0x98/0x2d0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074149] entry_SYSCALL_64_after_hwframe+0x65/0xca
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.074151]
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.075730] Freed by task 1416068:
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079214] __kasan_slab_free+0x130/0x180
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079220] kfree+0xa5/0x1e0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079225] perf_remove_from_context+0xa3/0x1d0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079229] perf_event_release_kernel+0xfe/0x620
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079234] perf_release+0x21/0x30
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079239] __fput+0x180/0x430
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079245] task_work_run+0x101/0x140
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079250] exit_to_usermode_loop+0x157/0x160
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079256] do_syscall_64+0x28e/0x2d0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079262] entry_SYSCALL_64_after_hwframe+0x65/0xca
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.079263]
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.080835] The buggy address belongs to the object at ffff88b1cefddc80#012 which belongs to the cache kmalloc-512 of size 512
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.093423] The buggy address is located 344 bytes inside of#012 512-byte region [ffff88b1cefddc80, ffff88b1cefdde80)
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.105231] The buggy address belongs to the page:
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.110100] page:ffffea00c73bf600 count:1 mapcount:0 mapping:ffff888100010c80 index:0x0 compound_mapcount: 0
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.120008] flags: 0x57ffffc0008100(slab|head)
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.124531] raw: 0057ffffc0008100 ffffea00caec7408 ffffea00ca4f7608 ffff888100010c80
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.132367] raw: 0000000000000000 0000000000330033 00000001ffffffff 0000000000000000
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.140201] page dumped because: kasan: bad access detected
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.145848]
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.147425] Memory state around the buggy address:
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.152305] ffff88b1cefddc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.159621] ffff88b1cefddd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.166927] >ffff88b1cefddd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.174230] ^
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.180393] ffff88b1cefdde00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.187700] ffff88b1cefdde80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Apr 14 12:22:27 euleros-pxe kernel: [ 8072.195003] ==================================================================

GVP openEuler/kernel

内容风险标识

评论 (2)

GVPopenEuler/kernel

内容风险标识