ovl: get_acl:在rcu路径存在空指针解引用问题

【标题描述】ovl: get_acl:在rcu路径存在空指针解引用问题
【环境信息】
硬件信息：
NA
软件信息：
OLK-5.10
【问题复现步骤】
具体操作步骤
1. Apply diff and compile kernel
2. useradd freg
3. ./test.sh
出现概率(是否必现，概率性错误)必现
【预期结果】
内核PANIC，空指针访问
【实际结果】
```
[   45.869492] overlayfs: get inode, wait drop cache, dir
[   46.008972] destroy inode
[   46.870505] overlayfs: wait done
[   46.870987] BUG: kernel NULL pointer dereference, address: 0000000000000028
[   46.871873] #PF: supervisor read access in kernel mode
[   46.872520] #PF: error_code(0x0000) - not-present page
[   46.873182] PGD 0 P4D 0 
[   46.873520] Oops: 0000 [#1] PREEMPT SMP
[   46.874014] CPU: 0 PID: 2594 Comm: ls Not tainted 5.10.0-02010-gce930557895a-dirty #875
[   46.875039] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproje4
[   46.876720] RIP: 0010:ovl_get_acl.cold+0x27/0x3a
[   46.877305] Code: 75 56 ff 48 c7 c7 44 a9 e7 82 48 83 05 d7 09 1f 0c 01 e8 6e 02 fe ff 4c 89 ef 48 83 05 cf 09 1f 0c 01 e8 f3
[   46.879661] RSP: 0018:ffffc90000c7bb98 EFLAGS: 00010202
[   46.880319] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   46.881207] RDX: 0000000000000000 RSI: ffffffff82ebcde0 RDI: ffff88811e09c020
[   46.882082] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffc90000c7b998
[   46.882971] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000008000
[   46.883895] R13: ffff88811e09c020 R14: ffff88811e03d870 R15: d0d0d0d0d0d0d0d0
[   46.884823] FS:  00007f51b8042540(0000) GS:ffff88842fc00000(0000) knlGS:0000000000000000
[   46.885856] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   46.886592] CR2: 0000000000000028 CR3: 000000011c525000 CR4: 00000000000006f0
[   46.887508] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   46.888428] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   46.889347] Call Trace:
[   46.889723]  get_cached_acl_rcu+0x6c/0xc0
[   46.890266]  generic_permission+0x20e/0x440
[   46.890800]  ovl_permission+0x46/0x190
[   46.891288]  inode_permission+0x109/0x220
[   46.891809]  link_path_walk+0xf3/0x4f0
[   46.892303]  ? path_init+0x3ad/0x560
[   46.892778]  path_lookupat.isra.0+0xa2/0x1f0
[   46.893337]  filename_lookup+0xce/0x240
[   46.893842]  ? getname_flags+0x57/0x300
[   46.894361]  ? kmemleak_alloc+0x66/0xd0
[   46.894870]  ? kmem_cache_alloc+0x638/0xa60
[   46.895431]  user_path_at_empty+0x43/0x60
[   46.895956]  vfs_statx+0x8f/0x1a0
[   46.896407]  vfs_fstatat+0x23/0x30
[   46.896860]  __se_sys_newlstat+0x40/0x90
[   46.897385]  ? debug_smp_processor_id+0x1b/0x30
[   46.897976]  ? switch_fpu_return+0x1f/0x1c0
[   46.898534]  ? exit_to_user_mode_prepare+0x23e/0x280
[   46.899186]  __x64_sys_newlstat+0x1a/0x30
[   46.899715]  do_syscall_64+0x45/0x70
[   46.900197]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[   46.900855] RIP: 0033:0x7f51b7731a75
[   46.901330] Code: 19 f4 2c 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b9
[   46.903681] RSP: 002b:00007ffd298bd298 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
[   46.904639] RAX: ffffffffffffffda RBX: 00007ffd298be4d0 RCX: 00007f51b7731a75
[   46.905539] RDX: 0000555a76013150 RSI: 0000555a76013150 RDI: 00007ffd298be4d0
[   46.906441] RBP: 00007ffd298bd640 R08: 0000000000000004 R09: 00007ffd298be4e7
[   46.907346] R10: 00000000298be400 R11: 0000000000000246 R12: 00007ffd298be4d0
[   46.908260] R13: 0000000000000000 R14: 0000555a76013140 R15: 0000000000000000
[   46.909184] Modules linked in:
[   46.909580] CR2: 0000000000000028
[   46.910050] ---[ end trace b2049c22c08e0947 ]---
[   46.910660] RIP: 0010:ovl_get_acl.cold+0x27/0x3a
[   46.911278] Code: 75 56 ff 48 c7 c7 44 a9 e7 82 48 83 05 d7 09 1f 0c 01 e8 6e 02 fe ff 4c 89 ef 48 83 05 cf 09 1f 0c 01 e8 f3
[   46.913652] RSP: 0018:ffffc90000c7bb98 EFLAGS: 00010202
[   46.914350] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   46.915314] RDX: 0000000000000000 RSI: ffffffff82ebcde0 RDI: ffff88811e09c020
[   46.916262] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffc90000c7b998
[   46.917199] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000008000
[   46.918140] R13: ffff88811e09c020 R14: ffff88811e03d870 R15: d0d0d0d0d0d0d0d0
[   46.919051] FS:  00007f51b8042540(0000) GS:ffff88842fc00000(0000) knlGS:0000000000000000
[   46.920102] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   46.920830] CR2: 0000000000000028 CR3: 000000011c525000 CR4: 00000000000006f0
[   46.921749] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   46.922731] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   46.923650] Kernel panic - not syncing: Fatal exception
[   46.924386] Kernel Offset: disabled
[   46.924849] ---[ end Kernel panic - not syncing: Fatal exception ]---
```
【附件信息】
diff
```
diff --git a/fs/inode.c b/fs/inode.c
index 7436a17a20c1..c61f307d17de 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -560,6 +560,7 @@ EXPORT_SYMBOL(clear_inode);
  * the cache. This should occur atomically with setting the I_FREEING state
  * flag, so no inodes here should ever be on the LRU when being evicted.
  */
+struct inode *g_inode;
 static void evict(struct inode *inode)
 {
 	const struct super_operations *op = inode->i_sb->s_op;
@@ -598,6 +599,12 @@ static void evict(struct inode *inode)
 	BUG_ON(inode->i_state != (I_FREEING | I_CLEAR));
 	spin_unlock(&inode->i_lock);
 
+	smp_rmb();
+	if (g_inode == inode) {
+		pr_err("destroy inode\n");
+		g_inode = NULL;
+		smp_wmb();
+	}
 	destroy_inode(inode);
 }
 
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index f319505bc9f0..1dc120d47cbf 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -442,8 +442,20 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 	return res;
 }
 
+#include <linux/delay.h>
+extern struct inode *g_inode;
 struct posix_acl *ovl_get_acl(struct inode *inode, int type, bool rcu)
 {
+	if (!g_inode && rcu) {
+		g_inode = inode;
+		smp_wmb();
+		pr_err("get inode, wait drop cache, %pd\n", ovl_upperdentry_dereference(OVL_I(inode)));
+		while (g_inode) {
+			smp_rmb();
+			mdelay(1000);
+		}
+		pr_err("wait done\n");
+	}
 	struct inode *realinode = ovl_inode_real(inode);
 	const struct cred *old_cred;
 	struct posix_acl *acl;
```
test.sh
```
#!/bin/bash

mkdir -p /root/tmp/merge /root/tmp/upper/dir /root/tmp/lower /root/tmp/work
touch /root/tmp/upper/dir/file
chown freg:freg -R /root/tmp/upper/dir
mount -t overlay none -oupperdir=/root/tmp/upper,lowerdir=/root/tmp/lower,workdir=/root/tmp/work /root/tmp/merge
ls /root/tmp/merge/dir/file &
echo 3 > /proc/sys/vm/drop_caches
```

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识