【OLK 5.10】并发访问md_thread导致UAF

```
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0xe9a/0x1070 kernel/locking/lockdep.c:4824
Read of size 8 at addr ffff88805a9e7528 by task kworker/3:3/388

CPU: 3 PID: 388 Comm: kworker/3:3 Not tainted 5.10.0-02758-g8e5f91fd772f #26
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: md_misc md_start_sync

Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x167 lib/dump_stack.c:118
 print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:390
 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:550
 kasan_report+0x3a/0x50 mm/kasan/report.c:567
 __lock_acquire+0xe9a/0x1070 kernel/locking/lockdep.c:4824
 lock_acquire+0x197/0x4a0 kernel/locking/lockdep.c:5565
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3b/0x60 kernel/locking/spinlock.c:159
 __wake_up_common_lock+0xb9/0x140 kernel/sched/wait.c:122
 md_wakeup_thread+0x4f/0xa0 drivers/md/md.c:7942
 md_start_sync+0x71/0xf0 drivers/md/md.c:9201
 process_one_work+0x83e/0x13f0 kernel/workqueue.c:2280
 worker_thread+0xe1/0xd80 kernel/workqueue.c:2426
 kthread+0x353/0x470 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299

Allocated by task 388:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 set_alloc_info mm/kasan/common.c:486 [inline]
 __kasan_kmalloc mm/kasan/common.c:518 [inline]
 __kasan_kmalloc.constprop.0+0xf0/0x130 mm/kasan/common.c:489
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:675 [inline]
 md_register_thread+0x4e/0x230 drivers/md/md.c:7952
 md_start_sync+0x2b/0xf0 drivers/md/md.c:9183
 process_one_work+0x83e/0x13f0 kernel/workqueue.c:2280
 worker_thread+0xe1/0xd80 kernel/workqueue.c:2426
 kthread+0x353/0x470 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299

Freed by task 910:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:361
 __kasan_slab_free.part.0+0x13f/0x1b0 mm/kasan/common.c:470
 slab_free_hook mm/slub.c:1569 [inline]
 slab_free_freelist_hook mm/slub.c:1608 [inline]
 slab_free mm/slub.c:3179 [inline]
 kfree+0x117/0xd50 mm/slub.c:4176
 md_unregister_thread+0x9d/0x160 drivers/md/md.c:7992
 md_reap_sync_thread+0x5c/0x950 drivers/md/md.c:9413
 md_check_recovery+0x64f/0x1660 drivers/md/md.c:9333
 raid1d+0x542/0xcc0 drivers/md/raid1.c:2613
 md_thread+0x43c/0x4b0 drivers/md/md.c:7931
 kthread+0x353/0x470 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299

The buggy address belongs to the object at ffff88805a9e7500
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 40 bytes inside of
 128-byte region [ffff88805a9e7500, ffff88805a9e7580)
The buggy address belongs to the page:
page:ffffea00016a7900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5a9e4
head:ffffea00016a7900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0010200 ffffea00016a7508 ffff888100041068 ffff88810004dd00
raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88805a9e7400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88805a9e7480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805a9e7500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff88805a9e7580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88805a9e7600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
```

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识