打开KASAN选项对内核进行syzkaller模糊测试，出现KASAN: slab-out-of-bounds Read in efivarfs_d_compare

【严重程度】 一般
【特性】 
【重现类型】 有条件概率重现
【定位分析】 </p><p><br></p><p><span style="font-size: 16px; color: rgb(34, 34, 34);">efivarfs_d_compare中，入参len小于EFI_VARIABLE_GUID_LEN时guid被减为负数，该值作为地址偏移使用发生了oob。</span></p><p><span style="background-color: var(--md-bk-color); font-size: 16px; color: var(--md-theme-color);">根因：</span></p><p><span style="background-color: var(--md-bk-color); font-size: 16px; color: var(--md-theme-color);">两个进程并发打开一个不存在的文件（flag中不包含create）</span></p><div class="ql-code-block-container" spellcheck="false"><div class="ql-code-block" data-language="plain">      T1                    T2</div><div class="ql-code-block" data-language="plain">      lookup_open</div><div class="ql-code-block" data-language="plain">       -&gt;lookup</div><div class="ql-code-block" data-language="plain">        simple_lookup</div><div class="ql-code-block" data-language="plain">         d_add</div><div class="ql-code-block" data-language="plain">         // invalid dentry is added to hash list</div><div class="ql-code-block" data-language="plain"><br></div><div class="ql-code-block" data-language="plain">                            lookup_open</div><div class="ql-code-block" data-language="plain">                             d_alloc_parallel</div><div class="ql-code-block" data-language="plain">                              __d_lookup_rcu</div><div class="ql-code-block" data-language="plain">                               __d_lookup_rcu_op_compare</div><div class="ql-code-block" data-language="plain">                                hlist_bl_for_each_entry_rcu</div><div class="ql-code-block" data-language="plain">                                // invalid dentry can be retrieved</div><div class="ql-code-block" data-language="plain">                                 -&gt;d_compare</div><div class="ql-code-block" data-language="plain">                                  efivarfs_d_compare</div></div><p><span style="background-color: var(--md-bk-color); font-size: 16px; color: var(--md-theme-color);">第一个进程将dentry加入hash后（后续将释放，但此时还未释放），并发的进程找到了这个dentry并调用了efivarfs的接口使用，进而发生问题</span></p><p><br></p><p>

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (10)

GVPopenEuler/kernelClosed

Content Risk Flag