402 Star 1.4K Fork 1.3K

GVPopenEuler / kernel

 / 详情

[OLK-5.10] machine check safe review issue modification

已完成
缺陷
创建于  
2023-01-16 15:53

【标题描述】代码检视发现的两个问题修改
【环境信息】

uname -a

Linux qemu 5.10.0+ #37 SMP Mon Jan 16 07:55:29 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
无特殊组网,代码检视发现的问题。
【问题复现步骤】

  1. 修改memcpy_mcs的返回值类型。
  2. 增加memcpy_mcs的kasan检测支持。
    出现概率(是否必现,概率性错误)
    【预期结果】
    加入修改前memcpy_mcs()不支持KASAN检测
    【实际结果】
    加入修改后memcpy_mcs()支持KASAN检测,日志如下:
    ==================================================================
    BUG: KASAN: slab-out-of-bounds in sample_init+0x1c4/0x1000 [sample]
    Read of size 4196 at addr ffff0c1680eca000 by task insmod/312

CPU: 1 PID: 312 Comm: insmod Tainted: G OE 5.10.0-03309-gf9a7511163e6 #26
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x0/0x300
show_stack+0x20/0x30
dump_stack+0x104/0x17c
print_address_description.constprop.0+0x48/0x548
kasan_report+0x114/0x210
check_memory_region+0x100/0x1b8
memcpy_mcs+0x54/0xf0
sample_init+0x1c4/0x1000 [sample]
do_one_initcall+0xa4/0x340
do_init_module+0xd0/0x338
load_module+0x1710/0x19a0
__se_sys_finit_module+0x10c/0x198
__arm64_sys_finit_module+0x4c/0x60
el0_svc_common.constprop.0+0xb4/0x2a8
do_el0_svc+0x40/0xa8
el0_svc+0x20/0x30
el0_sync_handler+0xb0/0xb8
el0_sync+0x160/0x180

Allocated by task 312:
kasan_save_stack+0x28/0x58
__kasan_kmalloc.isra.0+0xa4/0xd0
kasan_kmalloc+0x10/0x20
kmem_cache_alloc_trace+0xe0/0x578
sample_init+0x17c/0x1000 [sample]
do_one_initcall+0xa4/0x340
do_init_module+0xd0/0x338
load_module+0x1710/0x19a0
__se_sys_finit_module+0x10c/0x198
__arm64_sys_finit_module+0x4c/0x60
el0_svc_common.constprop.0+0xb4/0x2a8
do_el0_svc+0x40/0xa8
el0_svc+0x20/0x30
el0_sync_handler+0xb0/0xb8
el0_sync+0x160/0x180

The buggy address belongs to the object at ffff0c1680eca000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 0 bytes inside of
4096-byte region [ffff0c1680eca000, ffff0c1680ecb000)
The buggy address belongs to the page:
page:0000000028026f88 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100ec8
head:0000000028026f88 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x17ffff800010200(slab|head|node=0|zone=2|lastcpupid=0xfffff)
raw: 017ffff800010200 0000000000000000 dead000000000122 ffff0c1680002e00
raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff0c1680ecaf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0c1680ecaf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

ffff0c1680ecb000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff0c1680ecb080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0c1680ecb100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

【附件信息】

评论 (2)

Tong Tiangen 创建了缺陷

Hi Tong-Tiangen, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers: @YangYingliang , @成坚 (CHENG Jian) , @jiaoff , @zhengzengkai , @刘勇强 , @wangxiongfeng , @朱科潜 , @WangShaoBo , @lujialin , @wuxu_buque , @Xu Kuohai , @冷嘲啊 , @Lingmingqiang , @yuzenghui , @juntian , @OSSIM , @陈结松 , @whoisxxx , @koulihong , @刘恺 , @hanjun-guo , @woqidaideshi , @Chiqijun , @Kefeng , @ThunderTown , @AlexGuo , @kylin-mayukun , @Zheng Zucheng , @柳歆 , @Jackie Liu , @zhujianwei001 , @郑振鹏 , @SuperSix173 , @colyli , @Zhang Yi , @htforge , @Qiuuuuu , @Yuehaibing , @xiehaocheng , @guzitao , @CTC-Xibo.Wang , @zhanghongchen , @chen wei , @Jason Zeng , @苟浩 , @DuanqiangWen , @georgeguo , @毛泓博 , @AllenShi , @Xie XiuQi

openeuler-ci-bot 添加了
 
sig/Kernel
标签
Tong Tiangen 修改了描述
Tong Tiangen 任务状态待办的 修改为修复中
Tong Tiangen 修改了标题
Tong Tiangen 通过openeuler/kernel Pull Request !353任务状态修复中 修改为已完成

登录 后才可以发表评论

状态
负责人
项目
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
预计工期 (小时)
参与者(2)
5329419 openeuler ci bot 1632792936
C
1
https://gitee.com/openeuler/kernel.git
git@gitee.com:openeuler/kernel.git
openeuler
kernel
kernel

搜索帮助