io_uring: io_wqe_worker使用旧的req->work.identity->fs和chroot_fs_refs并发可能导致UAF问题

【标题描述】io_wqe_worker使用旧的req->work.identity->fs和chroot_fs_refs并发可能导致UAF问题
【环境信息】
NA
软件信息：
OLK-510
【问题复现步骤】
```
CONFIG_KASAN=y
1. 打入延时补丁diff
2. 安装liburing库，编译gcc -o aa a.c -luring
3. mount /dev/sda temp   # /dev/sda任意文件系统
   cd temp
   mkdir old-root
   unshare -m
   （另开一个窗口执行./aa）
   内核打印“__io_worker_unuse: wait exit”的5s内执行 pivot_root . old-root
```
出现概率(是否必现，概率性错误)必现
【预期结果】
内核KASAN检测到UAF
【实际结果】
```
[   96.955025] io_queue_sqe: op 21 fs ffff888111f93380
[   96.955407] __io_worker_unuse: wait exit (fs ffff888111f93380)
[   96.956011] exit_fs: 1695 put fs ffff88810eef2c80
[   96.971420] exit_fs: 1698 put fs ffff888111f93380
[   98.881457] chroot_fs_refs: iter io_wqe_worker (fs ffff888111f93380)
[   98.886352] ==================================================================
[   98.887731] BUG: KASAN: use-after-free in _raw_spin_lock+0x7b/0x110
[   98.888879] Write of size 4 at addr ffff888111f93384 by task pivot_root/1699
[   98.890158] 
[   98.890452] CPU: 2 PID: 1699 Comm: pivot_root Not tainted 5.10.0-03659-g9a343628e098-dirty #24
[   98.892023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc34
[   98.893803] Call Trace:
[   98.894162]  ? dump_stack+0xdd/0x126
[   98.894657]  ? print_address_description.constprop.0+0x2c/0x420
[   98.895461]  ? _raw_read_unlock_irqrestore+0x50/0x50
[   98.896134]  ? __irq_work_queue_local+0xc4/0xf0
[   98.896745]  ? _raw_spin_lock+0x7b/0x110
[   98.897281]  ? _raw_spin_lock+0x7b/0x110
[   98.897808]  ? kasan_report.cold+0x5d/0xdb
[   98.898357]  ? _raw_spin_lock+0x7b/0x110
[   98.898881]  ? check_memory_region+0x263/0x2b0
[   98.899473]  ? __kasan_check_write+0x20/0x30
[   98.900042]  ? _raw_spin_lock+0x7b/0x110
[   98.900575]  ? _raw_spin_lock_irq+0x120/0x120
[   98.901168]  ? lockref_get_not_zero+0x1d0/0x1d0
[   98.901775]  ? chroot_fs_refs+0x177/0x430
[   98.902321]  ? __se_sys_pivot_root+0x8a4/0x8f0
[   98.902914]  ? is_path_reachable+0xb0/0xb0
[   98.903465]  ? vmacache_find+0x11c/0x1a0
[   98.903990]  ? exit_to_user_mode_prepare+0x2a/0x210
[   98.904651]  ? irqentry_exit_to_user_mode+0xd/0xa0
[   98.905302]  ? irqentry_exit+0x50/0x80
[   98.905806]  ? __x64_sys_pivot_root+0x34/0x40
[   98.906393]  ? do_syscall_64+0x45/0x70
[   98.906896]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   98.907589] 
[   98.907806] Allocated by task 1695:
[   98.908290]  kasan_save_stack+0x23/0x60
[   98.908810]  __kasan_kmalloc.constprop.0+0x10b/0x120
[   98.909485]  kasan_slab_alloc+0x12/0x20
[   98.910005]  kmem_cache_alloc+0x1c0/0x9d0
[   98.910552]  copy_fs_struct+0x38/0x170
[   98.911053]  copy_process+0x1d94/0x3cb0
[   98.911577]  kernel_clone+0xb7/0x830
[   98.912064]  __se_sys_clone+0xbc/0x100
[   98.912575]  __x64_sys_clone+0x6a/0x80
[   98.913096]  do_syscall_64+0x45/0x70
[   98.913600]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   98.914283] 
[   98.914491] Freed by task 1698:
[   98.914915]  kasan_save_stack+0x23/0x60
[   98.915435]  kasan_set_track+0x24/0x40
[   98.915948]  kasan_set_free_info+0x2b/0x50
[   98.916507]  __kasan_slab_free+0x159/0x290
[   98.917064]  kasan_slab_free+0x12/0x20
[   98.917587]  kmem_cache_free+0x104/0x9b0
[   98.918131]  free_fs_struct+0x4e/0x60
[   98.918619]  exit_fs+0xf4/0x150
[   98.919045]  do_exit+0x899/0x1ca0
[   98.919504]  do_group_exit+0x6b/0x1a0
[   98.920001]  __wake_up_parent+0x0/0x50
[   98.920515]  do_syscall_64+0x45/0x70
[   98.921001]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   98.921675] 
[   98.921890] The buggy address belongs to the object at ffff888111f93380
[   98.921890]  which belongs to the cache fs_cache of size 56
[   98.923509] The buggy address is located 4 bytes inside of
[   98.923509]  56-byte region [ffff888111f93380, ffff888111f933b8)
[   98.925041] The buggy address belongs to the page:
[   98.925689] page:0000000027b6f68b refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888111f93f00 pfn:0x111f93
[   98.927118] flags: 0x2fffff80000200(slab|node=0|zone=2|lastcpupid=0x1fffff)
[   98.928051] raw: 002fffff80000200 0000000000000000 0000000100000001 ffff88810026cf00
[   98.929123] raw: ffff888111f93f00 0000000080200011 00000001ffffffff 0000000000000000
[   98.930160] page dumped because: kasan: bad access detected
[   98.930903] 
[   98.931118] Memory state around the buggy address:
[   98.931745]  ffff888111f93280: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[   98.932708]  ffff888111f93300: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[   98.933668] >ffff888111f93380: fa fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[   98.934629]                    ^
[   98.935067]  ffff888111f93400: fa fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[   98.936034]  ffff888111f93480: fa fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[   98.936983] ==================================================================
```
【附件信息】
a.c
```
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/xattr.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <errno.h>
#include <string.h>
#include <linux/reboot.h>
#include <arpa/inet.h>
#include <linux/stat.h>
#include <pthread.h>
#include <grp.h>
#include <sys/prctl.h>
#include <limits.h>
#include "liburing.h"

struct io_uring uring;

int main(void)
{
	int ret;
	struct io_uring_params params;

memset(&params, 0, sizeof(params));
	ret = io_uring_queue_init_params(40, &uring, &params);
	if (ret < 0) {
		printf("Set queue err %d\n", errno);
		return 0;
	}

ret = fork();
	if (ret < 0) {
		perror("fork fail");
		return 0;
	} else if (ret == 0) {
		struct io_uring_sqe *sqe;
		struct statx st;

sqe = io_uring_get_sqe(&uring);
		if (!sqe)
		      return 0;
		io_uring_prep_statx(sqe, -1, "/root", 0, STATX_ALL, &st);
		sqe->flags |= IOSQE_ASYNC;

ret = io_uring_submit(&uring);
		if (ret < 0)
		      printf("submit  err %d\n", errno);

printf("submit\n");
		exit(0);
	}

return 0;
}
```
diff
```
diff --git a/fs/fs_struct.c b/fs/fs_struct.c
index 04b3f5b9c629..77bda80152b1 100644
--- a/fs/fs_struct.c
+++ b/fs/fs_struct.c
@@ -65,6 +65,8 @@ void chroot_fs_refs(const struct path *old_root, const struct path *new_root)
 	do_each_thread(g, p) {
 		task_lock(p);
 		fs = p->fs;
+		if (!strncmp(p->comm, "io_wqe_worker", strlen("io_wqe_worker")))
+			pr_err("%s: iter io_wqe_worker (fs %px)\n", __func__, fs);
 		if (fs) {
 			int hits = 0;
 			spin_lock(&fs->lock);
@@ -104,8 +106,11 @@ void exit_fs(struct task_struct *tsk)
 		kill = !--fs->users;
 		spin_unlock(&fs->lock);
 		task_unlock(tsk);
-		if (kill)
+		if (kill) {
 			free_fs_struct(fs);
+			if (!strcmp(tsk->comm, "aa"))
+				pr_err("%s: %d put fs %px\n", __func__, tsk->pid, fs);
+		}
 	}
 }
 
diff --git a/fs/io-wq.c b/fs/io-wq.c
index 3d5fc76b92d0..dcf19d701eb0 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -20,6 +20,7 @@
 #include <linux/blk-cgroup.h>
 #include <linux/audit.h>
 #include <linux/cpu.h>
+#include <linux/delay.h>
 
 #include "../kernel/sched/sched.h"
 #include "io-wq.h"
@@ -168,8 +169,12 @@ static bool __io_worker_unuse(struct io_wqe *wqe, struct io_worker *worker)
 		task_unlock(current);
 	}
 
-	if (current->fs != worker->restore_fs)
+	if (current->fs != worker->restore_fs) {
+		pr_err("%s: wait exit (fs %px)\n", __func__, current->fs);
+		mdelay(3000);
+		dump_stack();
 		current->fs = worker->restore_fs;
+	}
 
 	/*
 	 * If we have an active mm, we need to drop the wq lock before unusing
diff --git a/fs/io_uring.c b/fs/io_uring.c
index c1b2ee23fa68..e5b6b728b2d2 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1302,8 +1302,10 @@ static void io_req_clean_work(struct io_kiocb *req)
 		if (--fs->users)
 			fs = NULL;
 		spin_unlock(&req->work.identity->fs->lock);
-		if (fs)
+		if (fs) {
 			free_fs_struct(fs);
+			pr_err("%s(%s): release fs %px\n", current->comm, __func__, fs);
+		}
 		req->work.flags &= ~IO_WQ_WORK_FS;
 	}
 	if (req->flags & REQ_F_INFLIGHT)
@@ -6383,6 +6385,7 @@ static void io_queue_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe,
 				goto fail_req;
 		}
 		io_queue_async_work(req);
+		pr_err("%s: op %d fs %px\n", __func__, req->opcode, req->work.identity->fs);
 	} else {
 		if (sqe) {
 			ret = io_req_prep(req, sqe);
```

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (1)

GVPopenEuler/kernelClosed

Content Risk Flag