[openEuler 1.0 LTS] KASAN: use-after-free Read in lock_get_status

**【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）**

**一、缺陷信息**
==================================================================
BUG: KASAN: use-after-free in file_inode include/linux/fs.h:1317 [inline]
BUG: KASAN: use-after-free in lock_get_status+0x668/0x758 fs/locks.c:2632
Read of size 8 at addr ffff8000db5b7ba0 by task syz-executor.1/27824

CPU: 3 PID: 27824 Comm: syz-executor.1 Not tainted 4.19.90+ #1
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78
 show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x170/0x1dc lib/dump_stack.c:118
 print_address_description+0x68/0x2c8 mm/kasan/report.c:253
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x130/0x2d8 mm/kasan/report.c:409
 __asan_report_load8_noabort+0x30/0x40 mm/kasan/report.c:430
 file_inode include/linux/fs.h:1317 [inline]
 lock_get_status+0x668/0x758 fs/locks.c:2632
 locks_show+0x124/0x228 fs/locks.c:2707
 seq_read+0x288/0xea8 fs/seq_file.c:232
 proc_reg_read+0x138/0x1f0 fs/proc/inode.c:231
 do_loop_readv_writev fs/read_write.c:703 [inline]
 do_iter_read+0x348/0x540 fs/read_write.c:924
 vfs_readv+0xec/0x150 fs/read_write.c:986
 do_readv+0x100/0x2c8 fs/read_write.c:1019
 __do_sys_readv fs/read_write.c:1106 [inline]
 __se_sys_readv fs/read_write.c:1103 [inline]
 __arm64_sys_readv+0x78/0xa8 fs/read_write.c:1103
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common+0x134/0x570 arch/arm64/kernel/syscall.c:121
 el0_svc_handler+0x190/0x260 arch/arm64/kernel/syscall.c:190
 el0_svc+0x10/0x640 arch/arm64/kernel/entry.S:1028

Allocated by task 26977:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xdc/0x190 mm/kasan/kasan.c:553
 kasan_slab_alloc+0x14/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:441 [inline]
 slab_alloc_node mm/slub.c:2755 [inline]
 slab_alloc mm/slub.c:2763 [inline]
 kmem_cache_alloc+0xec/0x278 mm/slub.c:2768
 kmem_cache_zalloc include/linux/slab.h:699 [inline]
 __alloc_file+0x38/0x318 fs/file_table.c:100
 alloc_empty_file+0x74/0x170 fs/file_table.c:150
 path_openat+0xd4/0x610 fs/namei.c:3535
 do_filp_open+0x154/0x220 fs/namei.c:3576
 do_sys_open+0x28c/0x3a8 fs/open.c:1085
 __do_sys_openat fs/open.c:1112 [inline]
 __se_sys_openat fs/open.c:1106 [inline]
 __arm64_sys_openat+0x94/0xd8 fs/open.c:1106
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common+0x134/0x570 arch/arm64/kernel/syscall.c:121
 el0_svc_handler+0x190/0x260 arch/arm64/kernel/syscall.c:190
 el0_svc+0x10/0x640 arch/arm64/kernel/entry.S:1028

Freed by task 19:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x120/0x228 mm/kasan/kasan.c:521
 kasan_slab_free+0x10/0x18 mm/kasan/kasan.c:528
 slab_free_hook mm/slub.c:1397 [inline]
 slab_free_freelist_hook mm/slub.c:1425 [inline]
 slab_free mm/slub.c:3004 [inline]
 kmem_cache_free+0x1b8/0x270 mm/slub.c:3020
 file_free_rcu+0x6c/0xb0 fs/file_table.c:49
 __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
 rcu_nocb_kthread+0x2b0/0x508 kernel/rcu/tree_plugin.h:2336
 kthread+0x2c8/0x348 kernel/kthread.c:275
 ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1291

The buggy address belongs to the object at ffff8000db5b7b80
 which belongs to the cache filp of size 256
The buggy address is located 32 bytes inside of
 256-byte region [ffff8000db5b7b80, ffff8000db5b7c80)
The buggy address belongs to the page:
page:ffff7e00036d6d80 count:1 mapcount:0 mapping:ffff8000c0242e00 index:0x0 compound_mapcount: 0
flags: 0x7ffff0000008100(slab|head)
raw: 07ffff0000008100 0000000000000000 0000001500000001 ffff8000c0242e00
raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8000db5b7a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8000db5b7b00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8000db5b7b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                               ^
 ffff8000db5b7c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8000db5b7c80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
==================================================================
**内核信息：**

**缺陷归属组件：**

**缺陷归属的版本：**

**缺陷简述：**

**【环境信息】**
硬件信息
- 裸机场景请提供问题的硬件信息
- 虚拟机场景请提供虚拟机的XML文件或配置信息
软件信息
- OS版本及分支信息
- 内核信息
- 发现问题的组件版本信息
网络信息
- 如果有特殊组网，请提供网络拓扑信息

**【问题复现步骤】**，请描述具体的操作步骤
**【实际结果】**，请描述出问题的结果和影响
**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等

**缺陷详情参考链接：**

**缺陷分析指导链接：**
https：xxx

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识