反复重启sysmonitor，并且并发访问/proc/sysmonitor /proc/sig_catch 可能会触发panic

【严重程度】 一般
【特性】 
【重现类型】 有条件必然重现
【定位分析】 </p><p><br></p><p><span style="font-size: 16px;">漏洞发生在proc_get_inode()函数中:</span></p><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block">struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)</div><div class="ql-code-block">{</div><div class="ql-code-block">    struct inode *inode = new_inode(sb);</div><div class="ql-code-block">    if (inode) {</div><div class="ql-code-block">        ...</div><div class="ql-code-block">        if (de-&gt;mode &amp; S_IFDIR) {</div><div class="ql-code-block">            set_nlink(inode, 2);</div><div class="ql-code-block">        }</div><div class="ql-code-block">        if (de-&gt;mode &amp; S_IFREG) {</div><div class="ql-code-block">            inode-&gt;i_fop = &amp;proc_reg_file_ops;</div><div class="ql-code-block">            inode-&gt;i_data.a_ops = &amp;proc_reg_aops;</div><div class="ql-code-block">            if (de-&gt;proc_ops-&gt;proc_read_iter) // [1]</div><div class="ql-code-block">                inode-&gt;i_fop = &amp;proc_reg_read_iter_ops;</div><div class="ql-code-block">        } else {</div><div class="ql-code-block">            BUG();</div><div class="ql-code-block">        }</div><div class="ql-code-block">        ...</div><div class="ql-code-block">    }</div><div class="ql-code-block">    return inode;</div><div class="ql-code-block">}   </div></div><p><br></p><p><span style="font-size: 16px;">可以看到,该函数根据de-&gt;mode的类型,为inode设置不同的文件操作函数,其中就有de-&gt;proc_ops-&gt;proc_read_iter。</span></p><p><br></p><p><span style="font-size: 16px;">问题在于,该函数开始时通过pde_get(de)增加了de的引用计数,但之后一直持有de指针而没有释放引用。</span></p><p><br></p><p><span style="font-size: 16px;">如果在[1]处之前,de对应的模块被卸载,de就会被释放,那么之后再去访问de-&gt;proc_ops就是非法的,形成use-after-free。</span></p><p><br></p><p><span style="font-size: 16px;">修复方案是在函数开始处通过use_pde(de)再次增加引用计数,并在访问proc_ops前检查de的有效性。在函数返回前,再通过unuse_pde(de)释放引用:</span></p><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block">+	if (!pde_is_permanent(de) &amp;&amp; !use_pde(de)) {</div><div class="ql-code-block">+		pde_put(de);</div><div class="ql-code-block">+		return NULL;</div><div class="ql-code-block">+	}</div><div class="ql-code-block"> </div><div class="ql-code-block">	if (de-&gt;mode &amp; S_IFDIR) {</div><div class="ql-code-block"> 		set_nlink(inode, 2);</div><div class="ql-code-block">	}</div><div class="ql-code-block">	if (de-&gt;mode &amp; S_IFREG) {</div><div class="ql-code-block"> 		inode-&gt;i_fop = &amp;proc_reg_file_ops;</div><div class="ql-code-block"> 		inode-&gt;i_data.a_ops = &amp;proc_reg_aops;</div><div class="ql-code-block"> 		if (de-&gt;proc_ops-&gt;proc_read_iter)</div><div class="ql-code-block">			inode-&gt;i_fop = &amp;proc_reg_read_iter_ops; </div><div class="ql-code-block">	} else {</div><div class="ql-code-block">		BUG();</div><div class="ql-code-block">	}</div><div class="ql-code-block"><br></div><div class="ql-code-block">+	if (!pde_is_permanent(de))</div><div class="ql-code-block" data-language="plain">+		unuse_pde(de);</div></div><p><br></p><p>

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (6)

GVPopenEuler/kernelClosed

Content Risk Flag