ubi: fix slab-out-of-bounds in ubi_eba_get_ldesc+0xfb/0x130

**【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）**

**一、缺陷信息**

**内核信息：**

OLK-6.6

**缺陷归属组件：**

UBI

**缺陷归属的版本：**

OLK-6.6

**缺陷简述：**

使用ioctl接口调整UBI卷大小时，`ubi_resize_volume`
首先调整EBA表的大小，但不更改中的`vol->reserved_pebs`
相同的原子上下文，可能导致对EBA表的并发访问。

例如，用户调用`ubi_resize_volume`收缩UBI卷A。
当另一个线程正在写入卷B并触发磨损均衡时，
可能会调用`ubi_write_fastmap`，在这种情况下，KASAN可能
在`ubi_eba_get_ldesc+0xfb/0x130`中报告slab-out-of-bounds错误。

**【环境信息】**

硬件信息

- 裸机场景请提供问题的硬件信息
全平台
- 虚拟机场景请提供虚拟机的XML文件或配置信息

软件信息
- OS版本及分支信息
OLK-6.6
- 内核信息
- 发现问题的组件版本信息
网络信息
- 如果有特殊组网，请提供网络拓扑信息

**【问题复现步骤】**，请描述具体的操作步骤
~~~
    Process 1: write and trigger ubi wear-leveling
        ubimkvol /dev/ubi0 -s 5000MiB -N v1
        ubimkvol /dev/ubi0 -s 2000MiB -N v2
        ubimkvol /dev/ubi0 -s 10MiB -N v3
        mount -t ubifs /dev/ubi0_0 /mnt/ubifs
        while true;
        do
            filename=/mnt/ubifs/$((RANDOM))
            dd if=/dev/random of=${filename} bs=1M count=$((RANDOM % 1000))
            rm -rf ${filename}
            sync /mnt/ubifs/
        done
    
    Process 2: do random resize
        struct ubi_rsvol_req req;
        req.vol_id = 1;
        req.bytes = (rand() % 50) * 512KB;
        ioctl(fd, UBI_IOCRSVOL, &req);
~~~
**【实际结果】**，请描述出问题的结果和影响

~~~
[  415.592955][   T11] ==================================================================
[  415.593720][   T11] BUG: KASAN: slab-out-of-bounds in ubi_eba_get_ldesc+0x62/0x90 [ubi]
[  415.595075][   T11] Read of size 4 at addr ffff8881b109fe80 by task kworker/u32:0/11
[  415.595821][   T11] 
[  415.596031][   T11] CPU: 13 PID: 11 Comm: kworker/u32:0 Not tainted 6.6.0+ #84
[  415.596710][   T11] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
[  415.597572][   T11] Workqueue: writeback wb_workfn (flush-ubifs_0_0)
[  415.598150][   T11] Call Trace:
[  415.598450][   T11]  <TASK>
[  415.598724][   T11]  dump_stack_lvl+0x76/0xb0
[  415.599132][   T11]  print_address_description.constprop.0+0x4c/0x5e0
[  415.599741][   T11]  ? ubi_eba_get_ldesc+0x62/0x90 [ubi]
[  415.600297][   T11]  print_report+0xe9/0x320
[  415.600716][   T11]  ? __virt_addr_valid+0x14d/0x260
[  415.601170][   T11]  ? kasan_addr_to_slab+0x14/0x110
[  415.601624][   T11]  ? ubi_eba_get_ldesc+0x62/0x90 [ubi]
[  415.602270][   T11]  kasan_report+0xdc/0x160
[  415.602694][   T11]  ? ubi_eba_get_ldesc+0x62/0x90 [ubi]
[  415.603250][   T11]  __asan_load4+0xa2/0x150
[  415.603688][   T11]  ubi_eba_get_ldesc+0x62/0x90 [ubi]
[  415.604251][   T11]  ubi_write_fastmap+0x10cd/0x1f10 [ubi]
[  415.604838][   T11]  ? __pfx_ubi_write_fastmap+0x10/0x10 [ubi]
[  415.605439][   T11]  ? ubi_wl_put_fm_peb+0x106/0x2d0 [ubi]
[  415.606013][   T11]  ubi_update_fastmap+0x504/0xc50 [ubi]
[  415.606594][   T11]  ? __kasan_check_write+0x22/0x30
[  415.607060][   T11]  ubi_wl_get_peb+0x194/0x3c0 [ubi]
[  415.607591][   T11]  ? __kmem_cache_alloc_node+0x1f7/0x890
[  415.608110][   T11]  try_write_vid_and_data+0x7e/0x490 [ubi]
[  415.608701][   T11]  ? _raw_spin_lock+0xa1/0x120
[  415.609146][   T11]  ? kmalloc_trace+0x8c/0x160
[  415.609572][   T11]  ubi_eba_write_leb+0x29b/0x900 [ubi]
[  415.610137][   T11]  ? __pfx_ubi_eba_write_leb+0x10/0x10 [ubi]
[  415.610726][   T11]  ? ubifs_categorize_lprops+0x3a/0x1c0 [ubifs]
[  415.611391][   T11]  ? kasan_poison+0x43/0x90
[  415.611804][   T11]  ? __kasan_slab_alloc+0x42/0xc0
[  415.612266][   T11]  ubi_leb_map+0xf1/0x1e0 [ubi]
[  415.612769][   T11]  ubifs_leb_map+0xd2/0x190 [ubifs]
[  415.613325][   T11]  ubifs_add_bud_to_log+0x6d2/0x870 [ubifs]
[  415.613974][   T11]  reserve_space+0x609/0x7d0 [ubifs]
[  415.614553][   T11]  ? __pfx_reserve_space+0x10/0x10 [ubifs]
[  415.615160][   T11]  ? __pfx_down_read+0x10/0x10
[  415.615594][   T11]  ? __pfx_mutex_unlock+0x10/0x10
[  415.616052][   T11]  make_reservation+0xbb/0x310 [ubifs]
[  415.616640][   T11]  ubifs_jnl_write_data+0x247/0x660 [ubifs]
[  415.617257][   T11]  ? __kasan_check_read+0x1f/0x30
[  415.617708][   T11]  ? __pfx_ubifs_jnl_write_data+0x10/0x10 [ubifs]
[  415.618602][   T11]  do_writepage+0x18d/0x690 [ubifs]
[  415.619160][   T11]  ? __pfx_do_writepage+0x10/0x10 [ubifs]
[  415.619734][   T11]  ? __kasan_check_write+0x22/0x30
[  415.620163][   T11]  ? _raw_spin_lock+0xa1/0x120
[  415.620576][   T11]  ? __pfx__raw_spin_lock+0x10/0x10
[  415.621013][   T11]  ? __mod_memcg_lruvec_state+0xd8/0x180
[  415.621485][   T11]  ubifs_writepage+0x3da/0x450 [ubifs]
[  415.622042][   T11]  writepage_cb+0x54/0x140
[  415.622423][   T11]  write_cache_pages+0x27e/0x830
[  415.622837][   T11]  ? __pfx_writepage_cb+0x10/0x10
[  415.623291][   T11]  ? __pfx_write_cache_pages+0x10/0x10
[  415.623768][   T11]  ? fprop_reflect_period_percpu.isra.0+0x33/0x1b0
[  415.624340][   T11]  ? __pfx__raw_spin_lock+0x10/0x10
[  415.624802][   T11]  do_writepages+0x1cd/0x3c0
[  415.625225][   T11]  ? __pfx_do_writepages+0x10/0x10
[  415.625732][   T11]  ? __kasan_check_write+0x22/0x30
[  415.626220][   T11]  ? _raw_spin_lock_irqsave+0xb5/0x140
[  415.626711][   T11]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  415.627239][   T11]  ? _find_next_or_bit+0x58/0x160
[  415.627707][   T11]  __writeback_single_inode+0x84/0x870
[  415.628202][   T11]  writeback_sb_inodes+0x3a6/0x970
[  415.628670][   T11]  ? __pfx__raw_spin_lock+0x10/0x10
[  415.629136][   T11]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  415.629645][   T11]  ? __list_add_valid_or_report+0x52/0x1a0
[  415.630184][   T11]  __writeback_inodes_wb+0xc6/0x160
[  415.630651][   T11]  wb_writeback+0x598/0x6c0
[  415.631054][   T11]  ? __pfx_wb_writeback+0x10/0x10
[  415.631512][   T11]  ? get_nr_dirty_inodes+0xb1/0xf0
[  415.631983][   T11]  wb_do_writeback+0x515/0x620
[  415.632410][   T11]  ? __pfx_wb_do_writeback+0x10/0x10
[  415.632881][   T11]  ? update_load_avg+0x13d/0xa00
[  415.633330][   T11]  wb_workfn+0xe9/0x580
[  415.633733][   T11]  ? __pfx_wb_workfn+0x10/0x10
[  415.634180][   T11]  ? finish_task_switch+0x133/0x5d0
[  415.634640][   T11]  ? __kasan_check_write+0x22/0x30
[  415.635111][   T11]  ? __switch_to+0x3a7/0xd70
[  415.635545][   T11]  ? __schedule+0x874/0x13d0
[  415.635964][   T11]  ? kick_pool+0x4f/0x240
[  415.636355][   T11]  process_one_work+0x3c5/0x870
[  415.636790][   T11]  process_scheduled_works+0x89/0xe0
[  415.637275][   T11]  worker_thread+0x2ea/0x6d0
[  415.637764][   T11]  ? __pfx_worker_thread+0x10/0x10
[  415.638273][   T11]  kthread+0x1e6/0x260
[  415.638651][   T11]  ? __pfx_kthread+0x10/0x10
[  415.639068][   T11]  ret_from_fork+0x71/0x90
[  415.639469][   T11]  ? __pfx_kthread+0x10/0x10
[  415.639891][   T11]  ret_from_fork_asm+0x1b/0x30
[  415.640319][   T11]  </TASK>
[  415.640604][   T11] 
[  415.640811][   T11] The buggy address belongs to the physical page:
[  415.641405][   T11] page:000000002c563ebf refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b109c
[  415.642347][   T11] head:000000002c563ebf order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  415.643167][   T11] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
[  415.643878][   T11] page_type: 0xffffffff()
[  415.644271][   T11] raw: 0017ffffc0000040 0000000000000000 dead000000000122 0000000000000000
[  415.645068][   T11] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[  415.645896][   T11] page dumped because: kasan: bad access detected
[  415.646508][   T11] 
[  415.646722][   T11] Memory state around the buggy address:
[  415.647251][   T11]  ffff8881b109fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  415.647983][   T11]  ffff8881b109fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  415.648719][   T11] >ffff8881b109fe80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[  415.649440][   T11]                    ^
[  415.649812][   T11]  ffff8881b109ff00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[  415.650549][   T11]  ffff8881b109ff80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[  415.651267][   T11] ==================================================================
~~~

合入修复补丁后，问题不再复现

**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等

**缺陷详情参考链接：**

**缺陷分析指导链接：**
https：xxx

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识