KASAN: slab-use-after-free Read in release_task

【严重程度】 一般
【特性】 
【重现类型】 有条件概率重现
【定位分析】 </p><p>问题现象：</p><p>1 vhost退出时，group_leader指向一个已经释放的任务，导致 group_leader 二次释放出现UAF问题</p><p>2 vhost tgid保存的是主线程pid（26040），应该和 group_leader 指向的主线程pid（26044）一致，但两者并不相同</p><p>所以应该是 group_leader 指向的任务被修改了</p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">crash&gt; task_struct.group_leader ffff88800a3f0000</div><div class="ql-code-block" data-language="plain">  group_leader = 0xffff888052f30000,</div><div class="ql-code-block" data-language="plain">crash&gt; task_struct.thread_group 0xffff888052f30000</div><div class="ql-code-block" data-language="plain">  thread_group = {</div><div class="ql-code-block" data-language="plain">    next = 0xffff88805c0fd1b0,</div><div class="ql-code-block" data-language="plain">    prev = 0xdead000000000122</div><div class="ql-code-block" data-language="plain">  },</div><div class="ql-code-block" data-language="plain">crash&gt; task_struct.pid 0xffff888052f30000</div><div class="ql-code-block" data-language="plain">  pid = 26044,</div><div class="ql-code-block" data-language="plain">crash&gt; bt 26044</div><div class="ql-code-block" data-language="plain">bt: invalid task or pid value: 26044</div><div class="ql-code-block" data-language="plain">crash&gt; task_struct.tgid 0xffff888052f30000</div><div class="ql-code-block" data-language="plain">  tgid = 26040,</div><div class="ql-code-block" data-language="plain">crash&gt; task_struct.comm 0xffff888052f30000</div><div class="ql-code-block" data-language="plain">  comm = "syz.3.5742\000\000\000\000\000",</div><div class="ql-code-block" data-language="plain">crash&gt; bt 26040</div><div class="ql-code-block" data-language="plain">PID: 26040  TASK: ffff88805c0fc680  CPU: 3   COMMAND: "file1"</div><div class="ql-code-block" data-language="plain">crash&gt; task_struct.thread_group ffff88805c0fc680</div><div class="ql-code-block" data-language="plain">  thread_group = {</div><div class="ql-code-block" data-language="plain">    next = 0xffff88805c0fd1b0,</div><div class="ql-code-block" data-language="plain">    prev = 0xffff88805c0fd1b0</div><div class="ql-code-block" data-language="plain">  },</div></div><p>走读代码，在 de_thread() 里会修改 group_leader，调用路径为：load_binary -&gt; begin_new_exec -&gt; de_thread</p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">static int de_thread(struct task_struct *tsk)</div><div class="ql-code-block" data-language="plain">{</div><div class="ql-code-block" data-language="plain">		exchange_tids(tsk, leader);</div><div class="ql-code-block" data-language="plain">		transfer_pid(leader, tsk, PIDTYPE_TGID);</div><div class="ql-code-block" data-language="plain">		transfer_pid(leader, tsk, PIDTYPE_PGID);</div><div class="ql-code-block" data-language="plain">		transfer_pid(leader, tsk, PIDTYPE_SID);</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">		list_replace_rcu(&amp;leader-&gt;tasks, &amp;tsk-&gt;tasks);</div><div class="ql-code-block" data-language="plain">		list_replace_init(&amp;leader-&gt;sibling, &amp;tsk-&gt;sibling);</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">		tsk-&gt;group_leader = tsk;</div><div class="ql-code-block" data-language="plain">		leader-&gt;group_leader = tsk;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">		tsk-&gt;exit_signal = SIGCHLD;</div><div class="ql-code-block" data-language="plain">		leader-&gt;exit_signal = -1;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">		BUG_ON(leader-&gt;exit_state != EXIT_ZOMBIE);</div><div class="ql-code-block" data-language="plain">		leader-&gt;exit_state = EXIT_DEAD;</div><div class="ql-code-block" data-language="plain">}</div></div><p>这是 exec 系统调用加载二进制文件时，如果原进程是一个线程组，则会通知其他线程退出，然后用的可执行文件替代原进程的地址空间，并继承原进程的pid，所以原线程组里的一个子线程file1（pid为26040），调用了 load_elf_binary 去退出线程组的主线程，所以主线的pid被继承，pid正确，但是原来的主线程（syz）被释放，vhost的group_leader依然指向了这个主线程，所以vhost退出时，group_leader已经被释放了。</p><p>所以问题模型如下：</p><p>1 在一个线程组内，存在vhost子线程，会调用exec系统调用的子线程file1，以及主线程syz</p><p>2 file1调用exec系统调用时，正常会通知vhost、syz子线程退出，先退出子线程vhost，再退出主线程syz，然后替换原进程的地址空间并继承pid 26040</p><p>3 vhost 线程没有退出，但主线程 syz 已经退出，vhost 继续执行到自己的退出逻辑时，group_leader 指向了已经释放的主线程 syz，结果出现 UAF 问题</p><p>问题出现在 vhost 没有在主线程之前退出，时序上有问题，需要保证子线程 vhost 退出后，再退出主线程，加维测分析</p><p></p><p>vhost还没退出，就执行到继承pid的逻辑，de_thread 调用 zap_other_threads 退出其他线程，zap_other_threads 会跳过 vhost_worker，所以 vhost_worker 不会收到 SIGKILL 信号退出，而是正常执行到自己程序的退出逻辑</p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">int zap_other_threads(struct task_struct *p)</div><div class="ql-code-block" data-language="plain">{</div><div class="ql-code-block" data-language="plain">	struct task_struct *t = p;</div><div class="ql-code-block" data-language="plain">	int count = 0;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">	p-&gt;signal-&gt;group_stop_count = 0;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">	while_each_thread(p, t) {</div><div class="ql-code-block" data-language="plain">		task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK);</div><div class="ql-code-block" data-language="plain">		/* Don't require de_thread to wait for the vhost_worker */</div><div class="ql-code-block" data-language="plain">		if ((t-&gt;flags &amp; (PF_IO_WORKER | PF_USER_WORKER)) != PF_USER_WORKER)</div><div class="ql-code-block" data-language="plain">			count++;</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">		/* Don't bother with already dead threads */</div><div class="ql-code-block" data-language="plain">		if (t-&gt;exit_state)</div><div class="ql-code-block" data-language="plain">			continue;</div><div class="ql-code-block" data-language="plain">		sigaddset(&amp;t-&gt;pending.signal, SIGKILL);</div><div class="ql-code-block" data-language="plain">		signal_wake_up(t, 1);</div><div class="ql-code-block" data-language="plain">	}</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">	return count;</div><div class="ql-code-block" data-language="plain">}</div></div><p>所以 vhost 在线程组里没有收到SIGKILL信号，导致主线程在 vhost 之前退出，当 vhost 退出时，指向的主线程已经释放了，所以出现UAF问题</p><p><br></p><p>

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

GVP openEuler/kernel

内容风险标识

评论 (7)

GVPopenEuler/kernel

内容风险标识