【OLK-5.10】sharepool中退组接口和sp_alloc接口存在并发问题，并发调用可能导致UAF

【标题描述】sharepool中退组接口和sp_alloc接口并发调用肯能导致UAF问题
【环境信息】
硬件信息：
qemu arm64
软件信息：
OLK-5.10
如果有特殊组网，请提供网络拓扑图
【问题复现步骤】
具体操作步骤
出现概率(是否必现，概率性错误)
【预期结果】
描述预期结果，可以通过对比新老版本获取
【实际结果】
描述出问题的结果 
【附件信息】
比如系统message日志/组件日志、dump信息、图片等
<1>[553267.555682][ T7596] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098
<1>[553267.556040][ T7596] Mem abort info:
<1>[553267.556157][ T7596]   ESR = 0x96000004
<1>[553267.556312][ T7596]   EC = 0x25: DABT (current EL), IL = 32 bits
<1>[553267.556473][ T7596]   SET = 0, FnV = 0
<1>[553267.556586][ T7596]   EA = 0, S1PTW = 0
<1>[553267.556705][ T7596] Data abort info:
<1>[553267.556818][ T7596]   ISV = 0, ISS = 0x00000004
<1>[553267.556952][ T7596]   CM = 0, WnR = 0
<1>[553267.557203][ T7596] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001040a3000
<1>[553267.557431][ T7596] [0000000000000098] pgd=0000000000000000, p4d=0000000000000000
<0>[553267.558841][ T7596] Internal error: Oops: 96000004 [#1] SMP
<4>[553267.559466][ T7596] Modules linked in: sharepool_dev(OE) [last unloaded: demo]
<4>[553267.560389][ T7596] CPU: 1 PID: 7596 Comm: test_sp_group_d Tainted: G           OE     5.10.0+ #8
<4>[553267.560626][ T7596] Hardware name: linux,dummy-virt (DT)
<4>[553267.561025][ T7596] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--)
<4>[553267.562179][ T7596] pc : sp_free_area+0x34/0x120
<4>[553267.562340][ T7596] lr : sp_free_area+0x30/0x120
<4>[553267.562487][ T7596] sp : ffff80001c6a3b20
<4>[553267.562620][ T7596] x29: ffff80001c6a3b20 x28: 0000000000000009-
<4>[553267.562843][ T7596] x27: 0000000000000000 x26: ffff800011c49d20-
<4>[553267.563011][ T7596] x25: ffff0000c227f6c0 x24: 0000000000000008-
<4>[553267.563509][ T7596] x23: ffff0000c0cf0ce8 x22: 0000000000000001-
<4>[553267.563674][ T7596] x21: ffff0000c4082b30 x20: 0000000000000000-
<4>[553267.563836][ T7596] x19: ffff0000c4082b00 x18: 0000000000000000-
<4>[553267.563999][ T7596] x17: 0000000000000000 x16: 0000000000000000-
<4>[553267.564161][ T7596] x15: 0000000000000000 x14: 0000000000000000-
<4>[553267.564322][ T7596] x13: 0000000000000000 x12: ffff0005fffe12c0-
<4>[553267.564485][ T7596] x11: 0000000000000008 x10: ffff0005fffe12c0-
<4>[553267.564647][ T7596] x9 : ffff8000103eb690 x8 : 0000000000000001-
<4>[553267.564809][ T7596] x7 : 0000000000210d00 x6 : 0000000000000000-
<4>[553267.564971][ T7596] x5 : ffff8000123edea0 x4 : 0000000000000030-
<4>[553267.565134][ T7596] x3 : ffffeff000000000 x2 : 0000eff000000000-
<4>[553267.565296][ T7596] x1 : 0000e80000000000 x0 : 0000000000000000-
<4>[553267.565656][ T7596] Call trace:
<4>[553267.566038][ T7596]  sp_free_area+0x34/0x120
<4>[553267.566185][ T7596]  __sp_area_drop_locked+0x3c/0x60
<4>[553267.566323][ T7596]  sp_area_drop+0x80/0xbc
<4>[553267.566453][ T7596]  remove_vma+0x54/0x70
<4>[553267.566569][ T7596]  exit_mmap+0x114/0x1d0
<4>[553267.566701][ T7596]  mmput+0x90/0x1ec
<4>[553267.566809][ T7596]  exit_mm+0x1d0/0x2f0
<4>[553267.566921][ T7596]  do_exit+0x180/0x400
<4>[553267.567074][ T7596]  do_group_exit+0x40/0x114
<4>[553267.567441][ T7596]  get_signal+0x1e8/0x720
<4>[553267.567578][ T7596]  do_signal+0x11c/0x1e4
<4>[553267.567692][ T7596]  do_notify_resume+0x15c/0x250
<4>[553267.567821][ T7596]  work_pending+0xc/0x6d8
<0>[553267.568340][ T7596] Code: f9400001 f9402c00 97fff0e5 aa0003f4 (f9404c00)-
<4>[553267.569907][ T7596] ---[ end trace 3c8368d77e758ebd ]---
<0>[553267.570358][ T7596] Kernel panic - not syncing: Oops: Fatal exception
<2>[553267.570720][ T7596] SMP: stopping secondary CPUs
<0>[553267.572286][ T7596] Kernel Offset: disabled
<0>[553267.572991][ T7596] CPU features: 0x0004,00200022,61006082
<0>[553267.573373][ T7596] Memory Limit: none
<0>[553267.573948][ T7596] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (1)

GVPopenEuler/kernelClosed

Content Risk Flag