Sign in
Sign up
Explore
Enterprise
Education
Search
Help
Terms of use
About Us
Explore
Enterprise
Education
Gitee Premium
Gitee AI
AI teammates
Sign in
Sign up
Fetch the repository succeeded.
description of repo status
Open Source
>
Other
>
Operation System
&&
Watch
Unwatch
Watching
Releases Only
Ignoring
456
Star
1.7K
Fork
1.9K
GVP
openEuler
/
kernel
Closed
Code
Issues
1271
Pull Requests
980
Wiki
Insights
Pipelines
Service
Quality Analysis
Jenkins for Gitee
Tencent CloudBase
Tencent Cloud Serverless
悬镜安全
Aliyun SAE
Codeblitz
SBOM
DevLens
Don’t show this again
Update failed. Please try again later!
Remove this flag
Content Risk Flag
This task is identified by
as the content contains sensitive information such as code security bugs, privacy leaks, etc., so it is only accessible to contributors of this repository.
【openEuler-1.0-LTS】BUG: KASAN: use-after-free in __fget_light
Done
#I5HEXY
Bug
Li Lingfeng
Opened this issue
2022-07-16 16:58
<!-- #请根据issue的类型在标题右侧下拉框中选择对应的选项（需求、缺陷或CVE等）--> <!-- #请根据issue相关的版本在里程碑中选择对应的节点，若是与版本无关，请选择“不关联里程碑”--> 【标题描述】BUG: KASAN: use-after-free in __fget_light 【环境信息】 硬件信息： 1） 裸机场景提供出问题的硬件信息； 2） 虚机场景提供虚机XML文件或者配置信息 软件信息： 1） OS版本及分支 2） 内核信息 3） 发现问题的组件版本信息 如果有特殊组网，请提供网络拓扑图 【问题复现步骤】 具体操作步骤 执行复现用例 出现概率：概率 【预期结果】 描述预期结果，可以通过对比新老版本获取 【实际结果】 [2022-07-15 10:56:55] [ 546.075801] BUG: KASAN: use-after-free in __fget_light+0x54/0x210 [2022-07-15 10:56:55] [ 546.076605] Read of size 4 at addr ffff88810188c840 by task io_wqe_worker-0/1036 [2022-07-15 10:56:55] [ 546.077568] [2022-07-15 10:56:55] [ 546.077788] CPU: 3 PID: 1036 Comm: io_wqe_worker-0 Not tainted 4.19.90+ #14 [2022-07-15 10:56:55] [ 546.078703] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [2022-07-15 10:56:55] [ 546.080431] Call Trace: [2022-07-15 10:56:55] [ 546.080778] dump_stack+0x95/0xce [2022-07-15 10:56:55] [ 546.081241] print_address_description.cold+0x54/0x246 [2022-07-15 10:56:55] [ 546.081926] kasan_report.cold+0x6b/0x9d [2022-07-15 10:56:55] [ 546.082467] __fget_light+0x54/0x210 [2022-07-15 10:56:55] [ 546.082956] path_init+0x51a/0x1010 [2022-07-15 10:56:55] [ 546.083431] ? ftrace_graph_stop+0x10/0x10 [2022-07-15 10:56:55] [ 546.083984] ? path_lookupat+0x8c/0x820 [2022-07-15 10:56:55] [ 546.084509] path_lookupat+0x96/0x820 [2022-07-15 10:56:55] [ 546.085008] ? prepare_ftrace_return+0xa1/0x100 [2022-07-15 10:56:55] [ 546.085619] ? link_path_walk.part.0+0x10b0/0x10b0 [2022-07-15 10:56:55] [ 546.086262] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.086834] ? function_graph_enter+0x422/0x610 [2022-07-15 10:56:55] [ 546.087444] ? ftrace_graph_stop+0x10/0x10 [2022-07-15 10:56:55] [ 546.087996] ? filename_lookup+0x150/0x3c0 [2022-07-15 10:56:55] [ 546.088566] filename_lookup+0x1a6/0x3c0 [2022-07-15 10:56:55] [ 546.089096] ? nd_jump_link+0x1d0/0x1d0 [2022-07-15 10:56:55] [ 546.089610] ? nd_jump_link+0x1d0/0x1d0 [2022-07-15 10:56:55] [ 546.090135] ? nd_jump_link+0x1d0/0x1d0 [2022-07-15 10:56:55] [ 546.090645] ? vfs_statx+0xec/0x190 [2022-07-15 10:56:55] [ 546.091117] ? prepare_ftrace_return+0xa1/0x100 [2022-07-15 10:56:55] [ 546.091734] ? getname_flags+0x233/0x550 [2022-07-15 10:56:55] [ 546.092285] vfs_statx+0xec/0x190 [2022-07-15 10:56:55] [ 546.092735] ? vfs_statx_fd+0x90/0x90 [2022-07-15 10:56:55] [ 546.093226] ? trace_graph_entry+0x2c5/0x740 [2022-07-15 10:56:55] [ 546.093809] do_statx+0xc7/0x140 [2022-07-15 10:56:55] [ 546.094250] ? __x64_sys_readlink+0xb0/0xb0 [2022-07-15 10:56:55] [ 546.094810] ? __x64_sys_readlink+0xb0/0xb0 [2022-07-15 10:56:55] [ 546.095372] ? io_issue_sqe+0x198c/0x5080 [2022-07-15 10:56:55] [ 546.095910] ? prepare_ftrace_return+0xa1/0x100 [2022-07-15 10:56:55] [ 546.096523] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.097096] ? __io_free_req_finish+0xb9/0x250 [2022-07-15 10:56:55] [ 546.097682] ? __io_free_req+0x29/0x120 [2022-07-15 10:56:55] [ 546.098205] ? io_put_req+0x36/0x40 [2022-07-15 10:56:55] [ 546.098669] ? io_worker_handle_work+0xb13/0x1580 [2022-07-15 10:56:55] [ 546.099290] ? kthread+0x2c6/0x3c0 [2022-07-15 10:56:55] [ 546.099742] ? ret_from_fork+0x35/0x40 [2022-07-15 10:56:55] [ 546.100261] io_issue_sqe+0x198c/0x5080 [2022-07-15 10:56:55] [ 546.100775] ? function_graph_enter+0x422/0x610 [2022-07-15 10:56:55] [ 546.101394] ? ftrace_graph_stop+0x10/0x10 [2022-07-15 10:56:55] [ 546.101938] ? io_write+0x980/0x980 [2022-07-15 10:56:55] [ 546.102406] ? rcu_note_context_switch+0x2a0/0x2a0 [2022-07-15 10:56:55] [ 546.103049] ? io_write+0x980/0x980 [2022-07-15 10:56:55] [ 546.103514] ? io_wq_submit_work+0x95/0x330 [2022-07-15 10:56:55] [ 546.104072] ? prepare_ftrace_return+0xa1/0x100 [2022-07-15 10:56:55] [ 546.104671] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.105248] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.105829] io_wq_submit_work+0x95/0x330 [2022-07-15 10:56:55] [ 546.106375] ? io_wq_submit_work+0x5/0x330 [2022-07-15 10:56:55] [ 546.106919] io_worker_handle_work+0xa9a/0x1580 [2022-07-15 10:56:55] [ 546.107549] ? io_wqe_enqueue+0x720/0x720 [2022-07-15 10:56:55] [ 546.108086] ? io_wqe_worker+0x997/0xea0 [2022-07-15 10:56:55] [ 546.108616] io_wqe_worker+0x9bb/0xea0 [2022-07-15 10:56:55] [ 546.109137] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.109704] ? io_worker_handle_work+0x1580/0x1580 [2022-07-15 10:56:55] [ 546.110346] ? __kthread_parkme+0x9c/0x100 [2022-07-15 10:56:55] [ 546.110885] ? io_worker_handle_work+0x1580/0x1580 [2022-07-15 10:56:55] [ 546.111519] kthread+0x2c6/0x3c0 [2022-07-15 10:56:55] [ 546.111949] ? kthread_park+0x150/0x150 [2022-07-15 10:56:55] [ 546.112462] ret_from_fork+0x35/0x40 [2022-07-15 10:56:55] [ 546.112958] [2022-07-15 10:56:55] [ 546.113171] Allocated by task 923: [2022-07-15 10:56:55] [ 546.113620] kmem_cache_alloc+0xcc/0x1f0 [2022-07-15 10:56:55] [ 546.114136] dup_fd+0x8a/0xbc0 [2022-07-15 10:56:55] [ 546.114542] copy_process.part.0+0x1829/0x6640 [2022-07-15 10:56:55] [ 546.115122] _do_fork+0x1a2/0x920 [2022-07-15 10:56:55] [ 546.115559] do_syscall_64+0x11b/0xcf0 [2022-07-15 10:56:55] [ 546.116055] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [2022-07-15 10:56:55] [ 546.116704] [2022-07-15 10:56:55] [ 546.116912] Freed by task 1034: [2022-07-15 10:56:55] [ 546.117337] kmem_cache_free+0x83/0x1f0 [2022-07-15 10:56:55] [ 546.117842] put_files_struct+0x25a/0x2c0 [2022-07-15 10:56:55] [ 546.118371] exit_files+0xa9/0xe0 [2022-07-15 10:56:55] [ 546.118813] do_exit+0xa7e/0x2ac0 [2022-07-15 10:56:55] [ 546.119259] do_group_exit+0xf3/0x2f0 [2022-07-15 10:56:55] [ 546.119740] __x64_sys_exit_group+0x3f/0x50 [2022-07-15 10:56:55] [ 546.120293] do_syscall_64+0x11b/0xcf0 [2022-07-15 10:56:55] [ 546.120783] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [2022-07-15 10:56:55] [ 546.121441] [2022-07-15 10:56:55] [ 546.121651] The buggy address belongs to the object at ffff88810188c840 [2022-07-15 10:56:55] [ 546.121651] which belongs to the cache files_cache of size 704 [2022-07-15 10:56:55] [ 546.123260] The buggy address is located 0 bytes inside of [2022-07-15 10:56:55] [ 546.123260] 704-byte region [ffff88810188c840, ffff88810188cb00) [2022-07-15 10:56:55] [ 546.124741] The buggy address belongs to the page: [2022-07-15 10:56:55] [ 546.125376] page:ffffea0004062200 count:1 mapcount:0 mapping:ffff8881008ccac0 index:0xffff88810188f540 compound_mapcount: 0 [2022-07-15 10:56:55] [ 546.126804] flags: 0xbfff00000008100(slab|head) [2022-07-15 10:56:55] [ 546.127393] raw: 0bfff00000008100 ffffea000405d808 ffff88810091da50 ffff8881008ccac0 [2022-07-15 10:56:55] [ 546.128364] raw: ffff88810188f540 00000000001c0003 00000001ffffffff 0000000000000000 [2022-07-15 10:56:55] [ 546.129339] page dumped because: kasan: bad access detected [2022-07-15 10:56:55] [ 546.130045] [2022-07-15 10:56:55] [ 546.130237] Memory state around the buggy address: [2022-07-15 10:56:55] [ 546.130851] ffff88810188c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [2022-07-15 10:56:55] [ 546.131760] ffff88810188c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [2022-07-15 10:56:55] [ 546.132677] >ffff88810188c800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [2022-07-15 10:56:55] [ 546.133584] ^ [2022-07-15 10:56:55] [ 546.134258] ffff88810188c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [2022-07-15 10:56:55] [ 546.135166] ffff88810188c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [2022-07-15 10:56:55] [ 546.136083] ================================================================== [2022-07-15 10:56:55] [ 546.137000] Disabling lock debugging due to kernel taint 【附件信息】 用例 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include <endian.h> #include <setjmp.h> #include <signal.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/mman.h> #include <sys/syscall.h> #include <sys/types.h> #include <unistd.h> #ifndef __NR_io_uring_enter #define __NR_io_uring_enter 426 #endif #ifndef __NR_io_uring_setup #define __NR_io_uring_setup 425 #endif static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) #define SIZEOF_IO_URING_SQE 64 #define SIZEOF_IO_URING_CQE 16 #define SQ_HEAD_OFFSET 0 #define SQ_TAIL_OFFSET 64 #define SQ_RING_MASK_OFFSET 256 #define SQ_RING_ENTRIES_OFFSET 264 #define SQ_FLAGS_OFFSET 276 #define SQ_DROPPED_OFFSET 272 #define CQ_HEAD_OFFSET 128 #define CQ_TAIL_OFFSET 192 #define CQ_RING_MASK_OFFSET 260 #define CQ_RING_ENTRIES_OFFSET 268 #define CQ_RING_OVERFLOW_OFFSET 284 #define CQ_FLAGS_OFFSET 280 #define CQ_CQES_OFFSET 320 struct io_sqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t flags; uint32_t dropped; uint32_t array; uint32_t resv1; uint64_t resv2; }; struct io_cqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t overflow; uint32_t cqes; uint64_t resv[2]; }; struct io_uring_params { uint32_t sq_entries; uint32_t cq_entries; uint32_t flags; uint32_t sq_thread_cpu; uint32_t sq_thread_idle; uint32_t features; uint32_t resv[4]; struct io_sqring_offsets sq_off; struct io_cqring_offsets cq_off; }; #define IORING_OFF_SQ_RING 0 #define IORING_OFF_SQES 0x10000000ULL static long syz_io_uring_setup(volatile long a0, volatile long a1, volatile long a2, volatile long a3, volatile long a4, volatile long a5) { uint32_t entries = (uint32_t)a0; struct io_uring_params* setup_params = (struct io_uring_params*)a1; void* vma1 = (void*)a2; void* vma2 = (void*)a3; void** ring_ptr_out = (void**)a4; void** sqes_ptr_out = (void**)a5; uint32_t fd_io_uring = syscall(__NR_io_uring_setup, entries, setup_params); uint32_t sq_ring_sz = setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t); uint32_t cq_ring_sz = setup_params->cq_off.cqes + setup_params->cq_entries * SIZEOF_IO_URING_CQE; uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz; *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQ_RING); uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE; *sqes_ptr_out = mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES); return fd_io_uring; } static long syz_io_uring_submit(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { char* ring_ptr = (char*)a0; char* sqes_ptr = (char*)a1; char* sqe = (char*)a2; uint32_t sqes_index = (uint32_t)a3; uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET); uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET); uint32_t sq_array_off = (CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63; if (sq_ring_entries) sqes_index %= sq_ring_entries; char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE; memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE); uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET); uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET); uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask; uint32_t sq_tail_next = *sq_tail_ptr + 1; uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off); *(sq_array + sq_tail) = sqes_index; __atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE); return 0; } uint64_t r[3] = {0xffffffffffffffff, 0x0, 0x0}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); install_segv_handler(); intptr_t res = 0; NONFAILING(*(uint32_t*)0x20000104 = 0); NONFAILING(*(uint32_t*)0x20000108 = 0); NONFAILING(*(uint32_t*)0x2000010c = 0); NONFAILING(*(uint32_t*)0x20000110 = 0); NONFAILING(*(uint32_t*)0x20000118 = -1); NONFAILING(memset((void*)0x2000011c, 0, 12)); res = -1; NONFAILING(res = syz_io_uring_setup(0x3fd3, 0x20000100, 0x20000000, 0x200b0000, 0x20000180, 0x200001c0)); if (res != -1) { r[0] = res; NONFAILING(r[1] = *(uint64_t*)0x20000180); // ring_ptr_out NONFAILING(r[2] = *(uint64_t*)0x200001c0); // sqes_ptr_out } NONFAILING(*(uint8_t*)0x20000000 = 0x15); // opcode NONFAILING(*(uint8_t*)0x20000001 = 0); NONFAILING(*(uint16_t*)0x20000002 = 0); NONFAILING(*(uint32_t*)0x20000004 = -1); NONFAILING(*(uint64_t*)0x20000008 = 0); NONFAILING(*(uint64_t*)0x20000010 = 0x20000300); NONFAILING(memcpy((void*)0x20000300, "./file0\000", 8)); NONFAILING(*(uint32_t*)0x20000018 = 0xc24); NONFAILING(*(uint32_t*)0x2000001c = 0x1000); NONFAILING(*(uint64_t*)0x20000020 = 0); NONFAILING(*(uint16_t*)0x20000028 = 0); NONFAILING(*(uint16_t*)0x2000002a = 0); NONFAILING(memset((void*)0x2000002c, 0, 20)); NONFAILING(syz_io_uring_submit(r[1], r[2], 0x20000000, 0)); // IORING_OP_STATX 0x15 NONFAILING(*(uint64_t*)0x20000000 = 0); NONFAILING(*(uint32_t*)0x20000008 = 0); NONFAILING(*(uint64_t*)0x20000010 = 0x20000040); NONFAILING(*(uint64_t*)0x20000040 = 0x200002c0); NONFAILING(*(uint32_t*)0x200002c0 = -1); NONFAILING(*(uint64_t*)0x20000048 = 0x20); NONFAILING(*(uint64_t*)0x20000018 = 1); NONFAILING(*(uint64_t*)0x20000020 = 0); NONFAILING(*(uint64_t*)0x20000028 = 0); NONFAILING(*(uint32_t*)0x20000030 = 0); syscall(__NR_sendmsg, -1, 0x20000000ul, 0ul); NONFAILING(*(uint8_t*)0x20000340 = 0x14); // IORING_OP_FILES_UPDATE 0x14 NONFAILING(*(uint8_t*)0x20000341 = 2); NONFAILING(*(uint16_t*)0x20000342 = 0); NONFAILING(*(uint32_t*)0x20000344 = 0); NONFAILING(*(uint64_t*)0x20000348 = 0x5da9); NONFAILING(*(uint64_t*)0x20000350 = 0x20000080); NONFAILING(*(uint32_t*)0x20000080 = -1); NONFAILING(*(uint32_t*)0x20000084 = -1); NONFAILING(*(uint32_t*)0x20000088 = -1); NONFAILING(*(uint32_t*)0x2000008c = -1); NONFAILING(*(uint32_t*)0x20000358 = 4); NONFAILING(*(uint32_t*)0x2000035c = 0); NONFAILING(*(uint64_t*)0x20000360 = 0); NONFAILING(*(uint16_t*)0x20000368 = 0); NONFAILING(*(uint16_t*)0x2000036a = 0); NONFAILING(memset((void*)0x2000036c, 0, 20)); NONFAILING(syz_io_uring_submit(r[1], r[2], 0x20000340, 8)); // IORING_OP_FILES_UPDATE 0x14 syscall(__NR_io_uring_enter, r[0], 0xfffffffe, 0, 0ul, 0ul, 0ul); return 0; }
<!-- #请根据issue的类型在标题右侧下拉框中选择对应的选项（需求、缺陷或CVE等）--> <!-- #请根据issue相关的版本在里程碑中选择对应的节点，若是与版本无关，请选择“不关联里程碑”--> 【标题描述】BUG: KASAN: use-after-free in __fget_light 【环境信息】 硬件信息： 1） 裸机场景提供出问题的硬件信息； 2） 虚机场景提供虚机XML文件或者配置信息 软件信息： 1） OS版本及分支 2） 内核信息 3） 发现问题的组件版本信息 如果有特殊组网，请提供网络拓扑图 【问题复现步骤】 具体操作步骤 执行复现用例 出现概率：概率 【预期结果】 描述预期结果，可以通过对比新老版本获取 【实际结果】 [2022-07-15 10:56:55] [ 546.075801] BUG: KASAN: use-after-free in __fget_light+0x54/0x210 [2022-07-15 10:56:55] [ 546.076605] Read of size 4 at addr ffff88810188c840 by task io_wqe_worker-0/1036 [2022-07-15 10:56:55] [ 546.077568] [2022-07-15 10:56:55] [ 546.077788] CPU: 3 PID: 1036 Comm: io_wqe_worker-0 Not tainted 4.19.90+ #14 [2022-07-15 10:56:55] [ 546.078703] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [2022-07-15 10:56:55] [ 546.080431] Call Trace: [2022-07-15 10:56:55] [ 546.080778] dump_stack+0x95/0xce [2022-07-15 10:56:55] [ 546.081241] print_address_description.cold+0x54/0x246 [2022-07-15 10:56:55] [ 546.081926] kasan_report.cold+0x6b/0x9d [2022-07-15 10:56:55] [ 546.082467] __fget_light+0x54/0x210 [2022-07-15 10:56:55] [ 546.082956] path_init+0x51a/0x1010 [2022-07-15 10:56:55] [ 546.083431] ? ftrace_graph_stop+0x10/0x10 [2022-07-15 10:56:55] [ 546.083984] ? path_lookupat+0x8c/0x820 [2022-07-15 10:56:55] [ 546.084509] path_lookupat+0x96/0x820 [2022-07-15 10:56:55] [ 546.085008] ? prepare_ftrace_return+0xa1/0x100 [2022-07-15 10:56:55] [ 546.085619] ? link_path_walk.part.0+0x10b0/0x10b0 [2022-07-15 10:56:55] [ 546.086262] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.086834] ? function_graph_enter+0x422/0x610 [2022-07-15 10:56:55] [ 546.087444] ? ftrace_graph_stop+0x10/0x10 [2022-07-15 10:56:55] [ 546.087996] ? filename_lookup+0x150/0x3c0 [2022-07-15 10:56:55] [ 546.088566] filename_lookup+0x1a6/0x3c0 [2022-07-15 10:56:55] [ 546.089096] ? nd_jump_link+0x1d0/0x1d0 [2022-07-15 10:56:55] [ 546.089610] ? nd_jump_link+0x1d0/0x1d0 [2022-07-15 10:56:55] [ 546.090135] ? nd_jump_link+0x1d0/0x1d0 [2022-07-15 10:56:55] [ 546.090645] ? vfs_statx+0xec/0x190 [2022-07-15 10:56:55] [ 546.091117] ? prepare_ftrace_return+0xa1/0x100 [2022-07-15 10:56:55] [ 546.091734] ? getname_flags+0x233/0x550 [2022-07-15 10:56:55] [ 546.092285] vfs_statx+0xec/0x190 [2022-07-15 10:56:55] [ 546.092735] ? vfs_statx_fd+0x90/0x90 [2022-07-15 10:56:55] [ 546.093226] ? trace_graph_entry+0x2c5/0x740 [2022-07-15 10:56:55] [ 546.093809] do_statx+0xc7/0x140 [2022-07-15 10:56:55] [ 546.094250] ? __x64_sys_readlink+0xb0/0xb0 [2022-07-15 10:56:55] [ 546.094810] ? __x64_sys_readlink+0xb0/0xb0 [2022-07-15 10:56:55] [ 546.095372] ? io_issue_sqe+0x198c/0x5080 [2022-07-15 10:56:55] [ 546.095910] ? prepare_ftrace_return+0xa1/0x100 [2022-07-15 10:56:55] [ 546.096523] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.097096] ? __io_free_req_finish+0xb9/0x250 [2022-07-15 10:56:55] [ 546.097682] ? __io_free_req+0x29/0x120 [2022-07-15 10:56:55] [ 546.098205] ? io_put_req+0x36/0x40 [2022-07-15 10:56:55] [ 546.098669] ? io_worker_handle_work+0xb13/0x1580 [2022-07-15 10:56:55] [ 546.099290] ? kthread+0x2c6/0x3c0 [2022-07-15 10:56:55] [ 546.099742] ? ret_from_fork+0x35/0x40 [2022-07-15 10:56:55] [ 546.100261] io_issue_sqe+0x198c/0x5080 [2022-07-15 10:56:55] [ 546.100775] ? function_graph_enter+0x422/0x610 [2022-07-15 10:56:55] [ 546.101394] ? ftrace_graph_stop+0x10/0x10 [2022-07-15 10:56:55] [ 546.101938] ? io_write+0x980/0x980 [2022-07-15 10:56:55] [ 546.102406] ? rcu_note_context_switch+0x2a0/0x2a0 [2022-07-15 10:56:55] [ 546.103049] ? io_write+0x980/0x980 [2022-07-15 10:56:55] [ 546.103514] ? io_wq_submit_work+0x95/0x330 [2022-07-15 10:56:55] [ 546.104072] ? prepare_ftrace_return+0xa1/0x100 [2022-07-15 10:56:55] [ 546.104671] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.105248] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.105829] io_wq_submit_work+0x95/0x330 [2022-07-15 10:56:55] [ 546.106375] ? io_wq_submit_work+0x5/0x330 [2022-07-15 10:56:55] [ 546.106919] io_worker_handle_work+0xa9a/0x1580 [2022-07-15 10:56:55] [ 546.107549] ? io_wqe_enqueue+0x720/0x720 [2022-07-15 10:56:55] [ 546.108086] ? io_wqe_worker+0x997/0xea0 [2022-07-15 10:56:55] [ 546.108616] io_wqe_worker+0x9bb/0xea0 [2022-07-15 10:56:55] [ 546.109137] ? ftrace_graph_caller+0x62/0xa0 [2022-07-15 10:56:55] [ 546.109704] ? io_worker_handle_work+0x1580/0x1580 [2022-07-15 10:56:55] [ 546.110346] ? __kthread_parkme+0x9c/0x100 [2022-07-15 10:56:55] [ 546.110885] ? io_worker_handle_work+0x1580/0x1580 [2022-07-15 10:56:55] [ 546.111519] kthread+0x2c6/0x3c0 [2022-07-15 10:56:55] [ 546.111949] ? kthread_park+0x150/0x150 [2022-07-15 10:56:55] [ 546.112462] ret_from_fork+0x35/0x40 [2022-07-15 10:56:55] [ 546.112958] [2022-07-15 10:56:55] [ 546.113171] Allocated by task 923: [2022-07-15 10:56:55] [ 546.113620] kmem_cache_alloc+0xcc/0x1f0 [2022-07-15 10:56:55] [ 546.114136] dup_fd+0x8a/0xbc0 [2022-07-15 10:56:55] [ 546.114542] copy_process.part.0+0x1829/0x6640 [2022-07-15 10:56:55] [ 546.115122] _do_fork+0x1a2/0x920 [2022-07-15 10:56:55] [ 546.115559] do_syscall_64+0x11b/0xcf0 [2022-07-15 10:56:55] [ 546.116055] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [2022-07-15 10:56:55] [ 546.116704] [2022-07-15 10:56:55] [ 546.116912] Freed by task 1034: [2022-07-15 10:56:55] [ 546.117337] kmem_cache_free+0x83/0x1f0 [2022-07-15 10:56:55] [ 546.117842] put_files_struct+0x25a/0x2c0 [2022-07-15 10:56:55] [ 546.118371] exit_files+0xa9/0xe0 [2022-07-15 10:56:55] [ 546.118813] do_exit+0xa7e/0x2ac0 [2022-07-15 10:56:55] [ 546.119259] do_group_exit+0xf3/0x2f0 [2022-07-15 10:56:55] [ 546.119740] __x64_sys_exit_group+0x3f/0x50 [2022-07-15 10:56:55] [ 546.120293] do_syscall_64+0x11b/0xcf0 [2022-07-15 10:56:55] [ 546.120783] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [2022-07-15 10:56:55] [ 546.121441] [2022-07-15 10:56:55] [ 546.121651] The buggy address belongs to the object at ffff88810188c840 [2022-07-15 10:56:55] [ 546.121651] which belongs to the cache files_cache of size 704 [2022-07-15 10:56:55] [ 546.123260] The buggy address is located 0 bytes inside of [2022-07-15 10:56:55] [ 546.123260] 704-byte region [ffff88810188c840, ffff88810188cb00) [2022-07-15 10:56:55] [ 546.124741] The buggy address belongs to the page: [2022-07-15 10:56:55] [ 546.125376] page:ffffea0004062200 count:1 mapcount:0 mapping:ffff8881008ccac0 index:0xffff88810188f540 compound_mapcount: 0 [2022-07-15 10:56:55] [ 546.126804] flags: 0xbfff00000008100(slab|head) [2022-07-15 10:56:55] [ 546.127393] raw: 0bfff00000008100 ffffea000405d808 ffff88810091da50 ffff8881008ccac0 [2022-07-15 10:56:55] [ 546.128364] raw: ffff88810188f540 00000000001c0003 00000001ffffffff 0000000000000000 [2022-07-15 10:56:55] [ 546.129339] page dumped because: kasan: bad access detected [2022-07-15 10:56:55] [ 546.130045] [2022-07-15 10:56:55] [ 546.130237] Memory state around the buggy address: [2022-07-15 10:56:55] [ 546.130851] ffff88810188c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [2022-07-15 10:56:55] [ 546.131760] ffff88810188c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [2022-07-15 10:56:55] [ 546.132677] >ffff88810188c800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [2022-07-15 10:56:55] [ 546.133584] ^ [2022-07-15 10:56:55] [ 546.134258] ffff88810188c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [2022-07-15 10:56:55] [ 546.135166] ffff88810188c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [2022-07-15 10:56:55] [ 546.136083] ================================================================== [2022-07-15 10:56:55] [ 546.137000] Disabling lock debugging due to kernel taint 【附件信息】 用例 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include <endian.h> #include <setjmp.h> #include <signal.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/mman.h> #include <sys/syscall.h> #include <sys/types.h> #include <unistd.h> #ifndef __NR_io_uring_enter #define __NR_io_uring_enter 426 #endif #ifndef __NR_io_uring_setup #define __NR_io_uring_setup 425 #endif static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) #define SIZEOF_IO_URING_SQE 64 #define SIZEOF_IO_URING_CQE 16 #define SQ_HEAD_OFFSET 0 #define SQ_TAIL_OFFSET 64 #define SQ_RING_MASK_OFFSET 256 #define SQ_RING_ENTRIES_OFFSET 264 #define SQ_FLAGS_OFFSET 276 #define SQ_DROPPED_OFFSET 272 #define CQ_HEAD_OFFSET 128 #define CQ_TAIL_OFFSET 192 #define CQ_RING_MASK_OFFSET 260 #define CQ_RING_ENTRIES_OFFSET 268 #define CQ_RING_OVERFLOW_OFFSET 284 #define CQ_FLAGS_OFFSET 280 #define CQ_CQES_OFFSET 320 struct io_sqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t flags; uint32_t dropped; uint32_t array; uint32_t resv1; uint64_t resv2; }; struct io_cqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t overflow; uint32_t cqes; uint64_t resv[2]; }; struct io_uring_params { uint32_t sq_entries; uint32_t cq_entries; uint32_t flags; uint32_t sq_thread_cpu; uint32_t sq_thread_idle; uint32_t features; uint32_t resv[4]; struct io_sqring_offsets sq_off; struct io_cqring_offsets cq_off; }; #define IORING_OFF_SQ_RING 0 #define IORING_OFF_SQES 0x10000000ULL static long syz_io_uring_setup(volatile long a0, volatile long a1, volatile long a2, volatile long a3, volatile long a4, volatile long a5) { uint32_t entries = (uint32_t)a0; struct io_uring_params* setup_params = (struct io_uring_params*)a1; void* vma1 = (void*)a2; void* vma2 = (void*)a3; void** ring_ptr_out = (void**)a4; void** sqes_ptr_out = (void**)a5; uint32_t fd_io_uring = syscall(__NR_io_uring_setup, entries, setup_params); uint32_t sq_ring_sz = setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t); uint32_t cq_ring_sz = setup_params->cq_off.cqes + setup_params->cq_entries * SIZEOF_IO_URING_CQE; uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz; *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQ_RING); uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE; *sqes_ptr_out = mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES); return fd_io_uring; } static long syz_io_uring_submit(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { char* ring_ptr = (char*)a0; char* sqes_ptr = (char*)a1; char* sqe = (char*)a2; uint32_t sqes_index = (uint32_t)a3; uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET); uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET); uint32_t sq_array_off = (CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63; if (sq_ring_entries) sqes_index %= sq_ring_entries; char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE; memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE); uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET); uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET); uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask; uint32_t sq_tail_next = *sq_tail_ptr + 1; uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off); *(sq_array + sq_tail) = sqes_index; __atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE); return 0; } uint64_t r[3] = {0xffffffffffffffff, 0x0, 0x0}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); install_segv_handler(); intptr_t res = 0; NONFAILING(*(uint32_t*)0x20000104 = 0); NONFAILING(*(uint32_t*)0x20000108 = 0); NONFAILING(*(uint32_t*)0x2000010c = 0); NONFAILING(*(uint32_t*)0x20000110 = 0); NONFAILING(*(uint32_t*)0x20000118 = -1); NONFAILING(memset((void*)0x2000011c, 0, 12)); res = -1; NONFAILING(res = syz_io_uring_setup(0x3fd3, 0x20000100, 0x20000000, 0x200b0000, 0x20000180, 0x200001c0)); if (res != -1) { r[0] = res; NONFAILING(r[1] = *(uint64_t*)0x20000180); // ring_ptr_out NONFAILING(r[2] = *(uint64_t*)0x200001c0); // sqes_ptr_out } NONFAILING(*(uint8_t*)0x20000000 = 0x15); // opcode NONFAILING(*(uint8_t*)0x20000001 = 0); NONFAILING(*(uint16_t*)0x20000002 = 0); NONFAILING(*(uint32_t*)0x20000004 = -1); NONFAILING(*(uint64_t*)0x20000008 = 0); NONFAILING(*(uint64_t*)0x20000010 = 0x20000300); NONFAILING(memcpy((void*)0x20000300, "./file0\000", 8)); NONFAILING(*(uint32_t*)0x20000018 = 0xc24); NONFAILING(*(uint32_t*)0x2000001c = 0x1000); NONFAILING(*(uint64_t*)0x20000020 = 0); NONFAILING(*(uint16_t*)0x20000028 = 0); NONFAILING(*(uint16_t*)0x2000002a = 0); NONFAILING(memset((void*)0x2000002c, 0, 20)); NONFAILING(syz_io_uring_submit(r[1], r[2], 0x20000000, 0)); // IORING_OP_STATX 0x15 NONFAILING(*(uint64_t*)0x20000000 = 0); NONFAILING(*(uint32_t*)0x20000008 = 0); NONFAILING(*(uint64_t*)0x20000010 = 0x20000040); NONFAILING(*(uint64_t*)0x20000040 = 0x200002c0); NONFAILING(*(uint32_t*)0x200002c0 = -1); NONFAILING(*(uint64_t*)0x20000048 = 0x20); NONFAILING(*(uint64_t*)0x20000018 = 1); NONFAILING(*(uint64_t*)0x20000020 = 0); NONFAILING(*(uint64_t*)0x20000028 = 0); NONFAILING(*(uint32_t*)0x20000030 = 0); syscall(__NR_sendmsg, -1, 0x20000000ul, 0ul); NONFAILING(*(uint8_t*)0x20000340 = 0x14); // IORING_OP_FILES_UPDATE 0x14 NONFAILING(*(uint8_t*)0x20000341 = 2); NONFAILING(*(uint16_t*)0x20000342 = 0); NONFAILING(*(uint32_t*)0x20000344 = 0); NONFAILING(*(uint64_t*)0x20000348 = 0x5da9); NONFAILING(*(uint64_t*)0x20000350 = 0x20000080); NONFAILING(*(uint32_t*)0x20000080 = -1); NONFAILING(*(uint32_t*)0x20000084 = -1); NONFAILING(*(uint32_t*)0x20000088 = -1); NONFAILING(*(uint32_t*)0x2000008c = -1); NONFAILING(*(uint32_t*)0x20000358 = 4); NONFAILING(*(uint32_t*)0x2000035c = 0); NONFAILING(*(uint64_t*)0x20000360 = 0); NONFAILING(*(uint16_t*)0x20000368 = 0); NONFAILING(*(uint16_t*)0x2000036a = 0); NONFAILING(memset((void*)0x2000036c, 0, 20)); NONFAILING(syz_io_uring_submit(r[1], r[2], 0x20000340, 8)); // IORING_OP_FILES_UPDATE 0x14 syscall(__NR_io_uring_enter, r[0], 0xfffffffe, 0, 0ul, 0ul, 0ul); return 0; }
Comments (
1
)
Sign in
to comment
Status
Done
Backlog
已挂起
Fixing
Confirmed
Done
Accepted
Canceled
Assignees
Not set
Labels
sig/Kernel
Not set
Projects
Unprojected
Unprojected
Pull Requests
None yet
None yet
Successfully merging a pull request will close this issue.
Branches
No related branch
Branches (
-
)
Tags (
-
)
Planed to start - Planed to end
-
Top level
Not Top
Top Level: High
Top Level: Medium
Top Level: Low
Priority
Not specified
Serious
Main
Secondary
Unimportant
Duration
（hours）
参与者（2）
C
1
https://gitee.com/openeuler/kernel.git
git@gitee.com:openeuler/kernel.git
openeuler
kernel
kernel
Going to Help Center
Search
Git 命令在线学习
如何在 Gitee 导入 GitHub 仓库
Git 仓库基础操作
企业版和社区版功能对比
SSH 公钥设置
如何处理代码冲突
仓库体积过大，如何减小？
如何找回被删除的仓库数据
Gitee 产品配额说明
GitHub仓库快速导入Gitee及同步更新
什么是 Release（发行版）
将 PHP 项目自动发布到 packagist.org
Repository Report
Back to the top
Login prompt
This operation requires login to the code cloud account. Please log in before operating.
Go to login
No account. Register
