【OLK-5.10】sharepool的sp_group_exit存在非法地址访问

【标题描述】
Fuzz测试发现sp_group_exit中触发非法地址访问

【环境信息】
【问题复现步骤】
添加sharepool group后，使用clone（.., CLONE_VM, ..)创建子进程，父子进程退出触发问题
【预期结果】
系统正常
【实际结果】
[   43.321360] Unable to handle kernel paging request at virtual address dead000000000108              
[   43.324098] Mem abort info:
[   43.324562]   ESR = 0x96000044
[   43.325073]   EC = 0x25: DABT (current EL), IL = 32 bits
[   43.326331]   SET = 0, FnV = 0
[   43.327017]   EA = 0, S1PTW = 0
[   43.327623] Data abort info:
[   43.328025]   ISV = 0, ISS = 0x00000044
[   43.328699]   CM = 0, WnR = 1
[   43.330419] [dead000000000108] address between user and kernel address ranges
[   43.332534] Internal error: Oops: 96000044 [#1] PREEMPT SMP
[   43.333257] Modules linked in: sharepool_dev(O)
[   43.335162] CPU: 0 PID: 221 Comm: test_06_clone Tainted: G           O      5.10.0-02414-g50aecb3792bf #59
[   43.336546] Hardware name: linux,dummy-virt (DT)
[   43.337468] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
[   43.339982] pc : sp_group_exit+0x104/0x238
[   43.340469] lr : sp_group_exit+0xd8/0x238
[   43.340858] sp : ffff800014863d40
[   43.341203] x29: ffff800014863d40 x28: ffff0000c0ce5880
[   43.342224] x27: ffff0000c0ce5a00 x26: ffff0000c4c34880
[   43.343012] x25: dead000000000100 x24: dead000000000122
[   43.343535] x23: 0000000000000001 x22: ffff0000c3fc3c00
[   43.344038] x21: ffff0000c0ce5888 x20: ffff0000c0ce5a80
[   43.344561] x19: ffff0000c4c34800 x18: 0000000000000000
[   43.344896] x17: 0000000000000000 x16: 0000000000000000
[   43.345184] x15: 0000000000000000 x14: 0000000000000000
[   43.345674] x13: 0000000000000000 x12: 0000000000000000
[   43.346166] x11: 0000000000000000 x10: 0000000000000000
[   43.346555] x9 : 0000000000000000 x8 : ffff800012355000
[   43.346876] x7 : 0000000000000000 x6 : 000000009257d16a
[   43.347191] x5 : 01ffffffffffffff x4 : 0000000000000000
[   43.347499] x3 : dead000000000100 x2 : dead000000000122
[   43.347845] x1 : 7211d5d076b1eb00 x0 : ffff0000c4c34880
[   43.348454] Call trace:
[   43.348705]  sp_group_exit+0x104/0x238
[   43.348978]  do_exit+0x188/0xb88
[   43.349192]  __arm64_sys_exit+0x24/0x28
[   43.349431]  do_el0_svc+0x88/0x1c0
[   43.349948]  el0_svc+0x1c/0x28
[   43.350287]  el0_sync_handler+0x88/0xc0
[   43.350626]  el0_sync+0x138/0x140
[   43.351081] Code: a9428e64 eb03009f 540007e0 a9400b63 (f9000462)
[   43.352893] ---[ end trace b0975fbbdaabf9bd ]---
[   43.353801] Kernel panic - not syncing: Oops: Fatal exception
[   43.354392] SMP: stopping secondary CPUs
[   43.355927] Kernel Offset: disabled
[   43.356457] CPU features: 0x0004,00240022,61002082
[   43.356753] Memory Limit: none
[   43.357287] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
QEMU 6.2.0 monitor - type 'help' for more information
【附件信息】

Hi ***chen-jun-hw***, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at **[Here](https://gitee.com/openeuler/community/blob/master/en/sig-infrastructure/command.md)**.
If you have any questions, please contact the SIG: [Kernel](https://gitee.com/openeuler/community/tree/master/sig/Kernel), and any of the maintainers: @yangyingliang , @gatieme , @jiaoff , @zhengzengkai , @LiuYongQiang0816 , @wangxiongfeng , @kevinzhu1 , @jentlestea , @lujialin2 , @wuxu_buque , @xukuohai , @lengchao , @alvin-ling , @yuzenghui , @juntianlinux , @chenguangli , @gasonchen , @whoisxxx , @koulihong , @kailiu42 , @hanjun-guo , @woqidaideshi , @chiqijun , @wkfxxx , @thundertown , @guohaocs2c , @kylin-mayukun , @oskernel0719 , @liuxinux , @newbeats , @zhujianwei001 , @zhenpengzheng , @SuperSix173 , @colyli , @zhangyi089 , @htforge , @qiuuuuu , @yuehaibing_planb , @haochengxie , @guzitao , @CTC-XiboWang , @Hongchen_Zhang , @chenwei_kernel , @x56Jason , @gouhao2022 , @duanqiangwen , @georgeguo , @mao-hongbo , @allen-shi , @xiexiuqi

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识