WARNING in ovl_real_fdget

【标题描述】overlayfs打开文件做SET_LEASE操作后，读文件触发WARNON
【环境信息】
硬件信息：
NA
软件信息：
OLK-5.10
【问题复现步骤】
gcc -obb b.c
./bb
出现概率(是否必现，概率性错误)必现
【预期结果】
内核打印WARNON
【实际结果】
```
[ 1268.014456] ------------[ cut here ]------------
[ 1268.015140] WARNING: CPU: 1 PID: 1854 at fs/overlayfs/file.c:82 ovl_real_fdget_meta+0x42f/0x4c0
[ 1268.016242] Modules linked in: iptable_nat
[ 1268.016786] CPU: 1 PID: 1854 Comm: re Not tainted 5.10.0+ #299
[ 1268.017541] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc314
[ 1268.019224] RIP: 0010:ovl_real_fdget_meta+0x42f/0x4c0
[ 1268.019867] Code: ff 4c 89 f7 e8 c2 fe a6 ff e9 5e fd ff ff e8 b8 fe a6 ff e9 2a fd ff ff 4c 89 f7 e8 1b ff a6 ff e9 b1 fd ff ff e8 c1 0bf
[ 1268.022227] RSP: 0018:ffff88811b95fbf0 EFLAGS: 00010293
[ 1268.022890] RAX: ffff8881215e91c0 RBX: 0000000004048000 RCX: ffffffffa648c7bf
[ 1268.023828] RDX: 0000000000000000 RSI: ffff88811b95fca8 RDI: ffff8881221a69c0
[ 1268.024737] RBP: ffff8881221a6980 R08: 0000000000001000 R09: ffffed1024434d38
[ 1268.025650] R10: ffff88811b95fdf0 R11: ffffed1024434d37 R12: ffff88812228c880
[ 1268.026563] R13: 000000000000a000 R14: ffff88812228c8c0 R15: ffff88812caf7a68
[ 1268.027487] FS:  00007f0a94b7e480(0000) GS:ffff8883aee80000(0000) knlGS:0000000000000000
[ 1268.028513] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1268.029246] CR2: 0000557846a9af80 CR3: 00000001142be000 CR4: 00000000000006e0
[ 1268.030174] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1268.031081] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1268.031994] Call Trace:
[ 1268.032334]  ovl_real_fdget+0x93/0x240
[ 1268.032816]  ovl_read_iter+0x111/0xa60
[ 1268.033317]  ? ovl_mmap+0x2e0/0x2e0
[ 1268.033769]  ? time_out_leases+0x390/0x390
[ 1268.034309]  ? __fsnotify_parent+0x444/0x980
[ 1268.034857]  new_sync_read+0x3cb/0x660
[ 1268.035363]  ? __x64_sys_lseek+0x1f0/0x1f0
[ 1268.035893]  vfs_read+0x365/0x480
[ 1268.036336]  ksys_read+0x105/0x210
[ 1268.036777]  ? vfs_write+0x7c0/0x7c0
[ 1268.037254]  ? fpregs_assert_state_consistent+0x81/0xc0
[ 1268.037918]  do_syscall_64+0x33/0x40
[ 1268.038386]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[ 1268.039027] RIP: 0033:0x7f0a946a44e9
[ 1268.039508] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088
[ 1268.041850] RSP: 002b:00007ffc03e77818 EFLAGS: 00000217 ORIG_RAX: 0000000000000000
[ 1268.042822] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0a946a44e9
[ 1268.043739] RDX: 0000000000001000 RSI: 0000000020000300 RDI: 0000000000000003
[ 1268.044656] RBP: 00007ffc03e77830 R08: 00007ffc03e77910 R09: 00007ffc03e77910
[ 1268.045572] R10: 00007ffc03e77910 R11: 0000000000000217 R12: 0000000000400470
[ 1268.046483] R13: 00007ffc03e77910 R14: 0000000000000000 R15: 0000000000000000
[ 1268.047408] ---[ end trace cd7fbc61ffa1feac ]---
```
【附件信息】
b.c
```
#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0);
  intptr_t res = 0;
  memcpy((void*)0x20000240, "./file1\000", 8);
  syscall(__NR_mkdir, 0x20000240ul, 0ul);
  memcpy((void*)0x20000180, "./bus\000", 6);
  syscall(__NR_mkdir, 0x20000180ul, 0ul);
  memcpy((void*)0x20000280, "./file0\000", 8);
  syscall(__NR_mkdir, 0x20000280ul, 0ul);
  memcpy((void*)0x20000000, "./bus\000", 6);
  memcpy((void*)0x20000080, "overlay\000", 8);
  memcpy((void*)0x20000100, "lowerdir=./bus,workdir=./file1,upperdir=./file0",
         47);
  syscall(__NR_mount, 0x400000ul, 0x20000000ul, 0x20000080ul, 0ul,
          0x20000100ul);
  memcpy((void*)0x200002c0, "./bus\000", 6);
  syscall(__NR_chdir, 0x200002c0ul);
  memcpy((void*)0x200001c0, "./file0\000", 8);
  res = syscall(__NR_open, 0x200001c0ul, 0x80040ul, 0ul);
  if (res != -1)
    r[0] = res;
  syscall(__NR_fcntl, r[0], 0x400ul, 0ul);
  syscall(__NR_read, r[0], 0x20000300ul, 0x1000ul);
  return 0;
}
```

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识