io_uring关闭文件导致文件锁访问触发UAF

【标题描述】io_uring关闭文件导致文件锁访问触发UAF
```
==================================================================
BUG: KASAN: use-after-free in file_inode include/linux/fs.h:1306 [inline]
BUG: KASAN: use-after-free in lock_get_status+0x729/0x760 fs/locks.c:2634
Read of size 8 at addr ffff888107344020 by task syz-executor.0/5418

CPU: 3 PID: 5418 Comm: syz-executor.0 Not tainted 4.19.90 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xa7/0xe9 lib/dump_stack.c:118
 print_address_description.cold+0x54/0x246 mm/kasan/report.c:253
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report+0xe1/0x110 mm/kasan/report.c:393
 file_inode include/linux/fs.h:1306 [inline]
 lock_get_status+0x729/0x760 fs/locks.c:2634
 locks_show+0x139/0x230 fs/locks.c:2709
 seq_read+0x481/0x1000 fs/seq_file.c:232
 proc_reg_read+0x1b6/0x2a0 fs/proc/inode.c:231
 __vfs_read+0x81/0x100 fs/read_write.c:418
 vfs_read+0x125/0x310 fs/read_write.c:454
 ksys_read+0x100/0x240 fs/read_write.c:581
 do_syscall_64+0xc7/0x280 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x46bb29
Code: 5d db fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b db fa ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f9e945f8c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000000000077bf60 RCX: 000000000046bb29
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 000000000077bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe9d77b46f R14: 00007f9e945f99c0 R15: 00007ffe9d77b600

Allocated by task 2813:
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc2/0xe0 mm/kasan/kasan.c:553
 slab_post_alloc_hook mm/slab.h:441 [inline]
 slab_alloc_node mm/slub.c:2755 [inline]
 slab_alloc mm/slub.c:2763 [inline]
 kmem_cache_alloc+0xbc/0x1d0 mm/slub.c:2768
 kmem_cache_zalloc include/linux/slab.h:699 [inline]
 __alloc_file+0x2a/0x380 fs/file_table.c:100
 alloc_empty_file+0x54/0x120 fs/file_table.c:150
 alloc_file+0x5e/0x490 fs/file_table.c:192
 alloc_file_pseudo+0x16f/0x240 fs/file_table.c:231
 sock_alloc_file+0x4b/0x170 net/socket.c:406
 sock_map_fd net/socket.c:429 [inline]
 __sys_socket+0x119/0x1d0 net/socket.c:1473
 __do_sys_socket net/socket.c:1478 [inline]
 __se_sys_socket net/socket.c:1476 [inline]
 __x64_sys_socket+0x74/0xb0 net/socket.c:1476
 do_syscall_64+0xc7/0x280 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 21:
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x12d/0x170 mm/kasan/kasan.c:521
 slab_free_hook mm/slub.c:1397 [inline]
 slab_free_freelist_hook mm/slub.c:1425 [inline]
 slab_free mm/slub.c:3004 [inline]
 kmem_cache_free+0x79/0x1e0 mm/slub.c:3020
 __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
 rcu_do_batch+0x199/0x4b0 kernel/rcu/tree.c:2583
 invoke_rcu_callbacks kernel/rcu/tree.c:2896 [inline]
 __rcu_process_callbacks+0x29a/0x3c0 kernel/rcu/tree.c:2863
 rcu_process_callbacks+0x4f/0x270 kernel/rcu/tree.c:2880
 __do_softirq+0x1b9/0x6c1 kernel/softirq.c:292

The buggy address belongs to the object at ffff888107344000
 which belongs to the cache filp of size 256
The buggy address is located 32 bytes inside of
 256-byte region [ffff888107344000, ffff888107344100)
The buggy address belongs to the page:
page:ffffea00041cd100 count:1 mapcount:0 mapping:ffff888100172400 index:0x0 compound_mapcount: 0
flags: 0x17ffffc0008100(slab|head)
raw: 0017ffffc0008100 dead000000000100 dead000000000200 ffff888100172400
raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888107343f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888107343f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888107344000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

^
 ffff888107344080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888107344100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================
```
【环境信息】
硬件信息：
NA
软件信息：
openeuler-1.0-lts
【问题复现步骤】
依赖：
CONFIG_FILE_LOCKING
CONFIG_PROC_FS
CONFIG_KASAN

必现用例：
1. gcc -o bb b.c -luring
2. ./bb
```
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/xattr.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <errno.h>
#include <string.h>
#include <linux/reboot.h>
#include <arpa/inet.h>
#include <pthread.h>
#include <grp.h>
#include <sys/prctl.h>
#include <limits.h>
#include "liburing.h"

struct io_uring uring;

int main(void)
{
	int fd, rd, ret;
	struct io_uring_sqe *sqe;
	char buf[4096];
	struct io_uring_params params;
	struct flock my_lock = {F_RDLCK, SEEK_SET, 0, 0, 0 };

fd = open("/proc/sysvipc/msg", O_RDONLY);
	if (fd < 0) {
		perror("open fail");
		return 0;
	}

rd = open("/proc/locks", O_RDONLY);
	fcntl(fd, 0x7, &my_lock);

memset(&params, 0, sizeof(params));
	//params.flags = IORING_SETUP_SQPOLL;
	ret = io_uring_queue_init_params(40, &uring, &params);
	if (ret < 0) {
		printf("Set queue err %d\n", errno);
		return 0;
	}

sqe = io_uring_get_sqe(&uring);
	if (!sqe)
	      return 0;
	io_uring_prep_close(sqe, fd);
	ret = io_uring_submit_and_wait(&uring, 1);
	if (ret < 0)
	      printf("submit  err %d\n", errno);

system("echo 3 > /proc/sys/vm/drop_caches");

if (read(rd, buf, 4096) <= 0)
		perror("read fail");
	printf("%s\n", buf);

return 0;
}
```
出现概率：必现
【预期结果】
内核报UAF
【实际结果】
```
[  379.710894] Leaked POSIX lock on dev=0x0:0x4 ino=0xf00000f5  fl_owner=000000008127f56c fl_flags=0x81 fl_type=0x0 fl_pid=7
[  379.756720] Leaked locks on dev=0x0:0x4 ino=0xf00000f5:
[  379.757485] POSIX: fl_owner=000000008127f56c fl_flags=0x81 fl_type=0x0 fl_pid=2637
[  379.859495] ==================================================================
[  379.861845] BUG: KASAN: use-after-free in lock_get_status+0x781/0x810
[  379.863794] Read of size 8 at addr ffff888119258de0 by task bb/2637
[  379.865672] 
[  379.866152] CPU: 3 PID: 2637 Comm: bb Not tainted 4.19.90+ #85
[  379.867898] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc314
[  379.871065] Call Trace:
[  379.871402]  dump_stack+0x95/0xce
[  379.871849]  print_address_description.cold+0x54/0x246
[  379.872520]  kasan_report.cold+0x6b/0x9d
[  379.873040]  lock_get_status+0x781/0x810
[  379.873553]  locks_show+0x139/0x230
[  379.874017]  seq_read+0xa15/0x1010
[  379.874472]  ? seq_lseek+0x3c0/0x3c0
[  379.874947]  proc_reg_read+0x1a8/0x260
[  379.875459]  ? proc_reg_write+0x260/0x260
[  379.875993]  __vfs_read+0xfe/0x760
[  379.876443]  ? proc_reg_write+0x260/0x260
[  379.876970]  ? __x64_sys_copy_file_range+0x490/0x490
[  379.877622]  ? security_file_permission+0x170/0x1f0
[  379.878258]  ? security_file_permission+0x179/0x1f0
[  379.878896]  vfs_read+0x125/0x320
[  379.879335]  ksys_read+0x100/0x240
[  379.879788]  ? kernel_write+0x110/0x110
[  379.880292]  ? handle_mm_fault+0x2e5/0x5e0
[  379.880842]  do_syscall_64+0x11b/0xcf0
[  379.881334]  ? syscall_return_slowpath+0x210/0x210
[  379.881965]  ? do_page_fault+0x56/0x2c0
[  379.882468]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  379.883144] RIP: 0033:0x7fefe364f0d0
[  379.883622] Code: 86 fe ff ff 48 8d 3d 0f de 09 00 48 83 ec 08 e8 46 39 02 00 66 0f 1f 44 00 00 83 3d 19 46 2d 00 00 75 10 b8 00 00 00 004
[  379.886018] RSP: 002b:00007ffd429b5658 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  379.887030] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fefe364f0d0
[  379.887949] RDX: 0000000000001000 RSI: 00007ffd429b5700 RDI: 0000000000000004
[  379.888871] RBP: 00007ffd429b6720 R08: 0000000000000000 R09: 0000000000000008
[  379.889794] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000400790
[  379.890717] R13: 00007ffd429b6800 R14: 0000000000000000 R15: 0000000000000000
[  379.891636] 
[  379.891842] Allocated by task 2637:
[  379.892301]  kmem_cache_alloc+0xcc/0x1f0
[  379.892824]  __alloc_file+0x2a/0x380
[  379.893293]  alloc_empty_file+0x54/0x120
[  379.893811]  path_openat+0xcb/0x6a0
[  379.894271]  do_filp_open+0x1a6/0x280
[  379.894756]  do_sys_open+0x2d5/0x440
[  379.895226]  do_syscall_64+0x11b/0xcf0
[  379.895721]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  379.896373] 
[  379.896578] Freed by task 0:
[  379.896961]  kmem_cache_free+0x83/0x1f0
[  379.897477]  rcu_process_callbacks+0x5d6/0xc80
[  379.898059]  __do_softirq+0x1c4/0x676
[  379.898530] 
[  379.898739] The buggy address belongs to the object at ffff888119258dc0
[  379.898739]  which belongs to the cache filp of size 256
[  379.900246] The buggy address is located 32 bytes inside of
[  379.900246]  256-byte region [ffff888119258dc0, ffff888119258ec0)
[  379.901717] The buggy address belongs to the page:
[  379.902335] page:ffffea0004649600 count:1 mapcount:0 mapping:ffff8881001cb600 index:0x0 compound_mapcount: 0
[  379.903581] flags: 0xbfff00000008100(slab|head)
[  379.904168] raw: 0bfff00000008100 ffffea000461e200 0000000c0000000c ffff8881001cb600
[  379.905152] raw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000
[  379.906136] page dumped because: kasan: bad access detected
[  379.906853] 
[  379.907055] Memory state around the buggy address:
[  379.907674]  ffff888119258c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  379.908590]  ffff888119258d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  379.909509] >ffff888119258d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[  379.910431]                                                        ^
[  379.911246]  ffff888119258e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  379.912173]  ffff888119258e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  379.913103] ==================================================================
```
【附件信息】
比如系统message日志/组件日志、dump信息、图片等

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识