mount.cifs挂载命令会触发内核panic

【严重程度】 一般
【特性】 
【重现类型】 有条件必然重现
【定位分析】 </p><p><br></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block">      crypt_message()</div><div class="ql-code-block">        // 分配包含req的creq缓冲区 </div><div class="ql-code-block">        creq = smb2_get_aead_req(..., &amp;req);</div><div class="ql-code-block">    </div><div class="ql-code-block">        // 异步加密立即返回 -EINPROGRESS </div><div class="ql-code-block">        rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);</div><div class="ql-code-block">    </div><div class="ql-code-block">        // 异步操作仍在进行时，释放creq </div><div class="ql-code-block">        kvfree_sensitive(creq, ...);</div><div class="ql-code-block">        // 后续驱动中触发空指针解引用。</div></div><p>引入问题的主线补丁是b0abcd65ec54 ("smb: client: fix UAF in async decryption")，</p><p><br></p><p>问题触发的根因是补丁作者认为，如果没有在 crypto_alloc_aead() 指定 mask 参数为 CRYPTO_ALG_ASYNC，那么加密默认应该是同步的。但是根据crypto框架代码和文档， CRYPTO_ALG_ASYNC的功能只是限制去搜索异步，当mask为0时，依然可能选择异步加墨模块</p><p><br></p><p><br></p><p>

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

GVP openEuler / kernel
Closed

Content Risk Flag

Comments (8)

GVPopenEuler / kernelClosed

Content Risk Flag