【syzkaller】KASAN: slab-use-after-free Read in fbcon_prepare_logo

> _**请尽量提供详细的信息，如缺乏必要的定位信息，则缺陷不会被定位**_

## 环境信息

【OS版本】（如openEuler-22.03-LTS，参考命令"cat /etc/os-release"结果）

【内核版本】（如kernel-5.10.0-60.138.0.165，参考命令"uname -r"结果）

【硬件平台】（缺陷相关的硬件信息，如：处理器型号、内存、磁盘、网卡、BIOS 等信息）

【组网信息】（和网络、性能相关的问题，应该说明详细的组网和场景信息）

## 缺陷信息

【问题复现步骤】
1. 
2. 
3.

【实际结果】请描述出问题的结果和影响

【期望结果】请描述出期望的结果和影响

【其他相关附件信息】比如 syslog、dmesg、panic、lockup、kdump 信息、图片等

```
==================================================================
BUG: KASAN: slab-use-after-free in scr_memcpyw include/linux/vt_buffer.h:49 [inline]
BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90 drivers/video/fbdev/core/fbcon.c:600
Read of size 14 at addr ffff888104eb4838 by task syz.0.2606/13486

CPU: 1 PID: 13486 Comm: syz.0.2606 Not tainted 6.6.0+ #82
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
 print_address_description.constprop.0+0x6b/0x3c0 mm/kasan/report.c:364
 print_report+0xba/0x280 mm/kasan/report.c:468
 kasan_report+0xaf/0xe0 mm/kasan/report.c:581
 check_region_inline mm/kasan/generic.c:181 [inline]
 kasan_check_range+0x100/0x1c0 mm/kasan/generic.c:187
 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:117
 scr_memcpyw include/linux/vt_buffer.h:49 [inline]
 fbcon_prepare_logo+0x61e/0xc90 drivers/video/fbdev/core/fbcon.c:600
 fbcon_init+0xeb9/0x1db0 drivers/video/fbdev/core/fbcon.c:1134
 visual_init+0x30d/0x5c0 drivers/tty/vt/vt.c:1023
 do_bind_con_driver.isra.0+0x627/0xbd0 drivers/tty/vt/vt.c:3645
 vt_bind drivers/tty/vt/vt.c:3801 [inline]
 store_bind+0x60b/0x710 drivers/tty/vt/vt.c:3873
 dev_attr_store+0x5d/0x90 drivers/base/core.c:2396
 sysfs_kf_write+0x142/0x1b0 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x3c2/0x5f0 fs/kernfs/file.c:356
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write+0x1b1/0x2d0 fs/read_write.c:493
 vfs_write+0x71a/0x960 fs/read_write.c:586
 ksys_write+0x12e/0x260 fs/read_write.c:639
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x78/0xe2
RIP: 0033:0x54d2cd
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb9312c9048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000007f5fa0 RCX: 000000000054d2cd
RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000008
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000007f5fac
R13: 0000000000000000 R14: 00000000007f5fa0 R15: 00007fb9312a9000
 </TASK>

Allocated by task 13486:
 kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
 kmalloc include/linux/slab.h:600 [inline]
 kmalloc_array include/linux/slab.h:636 [inline]
 kcalloc include/linux/slab.h:668 [inline]
 con_insert_unipair+0x155/0x270 drivers/tty/vt/consolemap.c:517
 con_set_default_unimap+0x374/0x6e0 drivers/tty/vt/consolemap.c:738
 do_bind_con_driver.isra.0+0x5dc/0xbd0 drivers/tty/vt/vt.c:3643
 vt_bind drivers/tty/vt/vt.c:3801 [inline]
 store_bind+0x60b/0x710 drivers/tty/vt/vt.c:3873
 dev_attr_store+0x5d/0x90 drivers/base/core.c:2396
 sysfs_kf_write+0x142/0x1b0 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x3c2/0x5f0 fs/kernfs/file.c:356
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write+0x1b1/0x2d0 fs/read_write.c:493
 vfs_write+0x71a/0x960 fs/read_write.c:586
 ksys_write+0x12e/0x260 fs/read_write.c:639
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x78/0xe2

Freed by task 13486:
 kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522
 ____kasan_slab_free mm/kasan/common.c:236 [inline]
 __kasan_slab_free+0x10a/0x180 mm/kasan/common.c:244
 kasan_slab_free include/linux/kasan.h:167 [inline]
 slab_free_hook mm/slub.c:1827 [inline]
 slab_free_freelist_hook mm/slub.c:1853 [inline]
 slab_free mm/slub.c:3820 [inline]
 __kmem_cache_free+0x178/0x370 mm/slub.c:3833
 con_release_unimap+0xdf/0x230 drivers/tty/vt/consolemap.c:438
 con_free_unimap+0xbc/0xf0 drivers/tty/vt/consolemap.c:463
 visual_init+0x19d/0x5c0 drivers/tty/vt/vt.c:1016
 do_bind_con_driver.isra.0+0x627/0xbd0 drivers/tty/vt/vt.c:3645
 vt_bind drivers/tty/vt/vt.c:3801 [inline]
 store_bind+0x60b/0x710 drivers/tty/vt/vt.c:3873
 dev_attr_store+0x5d/0x90 drivers/base/core.c:2396
 sysfs_kf_write+0x142/0x1b0 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x3c2/0x5f0 fs/kernfs/file.c:356
 call_write_iter include/linux/fs.h:2085 [inline]
 new_sync_write+0x1b1/0x2d0 fs/read_write.c:493
 vfs_write+0x71a/0x960 fs/read_write.c:586
 ksys_write+0x12e/0x260 fs/read_write.c:639
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x78/0xe2

Last potentially related work creation:
 kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
 __kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492
 kvfree_call_rcu+0x2e/0x8d0 kernel/rcu/tree.c:3452
 drop_sysctl_table+0x1cc/0x3a0 fs/proc/proc_sysctl.c:1515
 unregister_sysctl_table fs/proc/proc_sysctl.c:1536 [inline]
 unregister_sysctl_table+0x35/0x50 fs/proc/proc_sysctl.c:1528
 neigh_sysctl_unregister+0x64/0x90 net/core/neighbour.c:3885
 devinet_sysctl_unregister net/ipv4/devinet.c:2685 [inline]
 inetdev_event+0x73a/0x10e0 net/ipv4/devinet.c:1644
 notifier_call_chain+0x109/0x2f0 kernel/notifier.c:93
 call_netdevice_notifiers_info+0xbe/0x130 net/core/dev.c:2028
 call_netdevice_notifiers_extack net/core/dev.c:2066 [inline]
 call_netdevice_notifiers net/core/dev.c:2080 [inline]
 dev_change_name+0x379/0x650 net/core/dev.c:1301
 do_setlink+0x2135/0x2cb0 net/core/rtnetlink.c:2888
 __rtnl_newlink+0xe4a/0x10d0 net/core/rtnetlink.c:3706
 rtnl_newlink+0x6c/0xa0 net/core/rtnetlink.c:3753
 rtnetlink_rcv_msg+0x451/0xb60 net/core/rtnetlink.c:6478
 netlink_rcv_skb+0x16e/0x440 net/netlink/af_netlink.c:2545
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x6f7/0x9d0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x796/0xe10 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:734 [inline]
 __sock_sendmsg net/socket.c:749 [inline]
 __sock_sendmsg+0x200/0x250 net/socket.c:744
 __sys_sendto+0x1f9/0x2e0 net/socket.c:2204
 __do_sys_sendto net/socket.c:2216 [inline]
 __se_sys_sendto net/socket.c:2212 [inline]
 __x64_sys_sendto+0xe5/0x1c0 net/socket.c:2212
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x78/0xe2

Second to last potentially related work creation:
 kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
 __kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492
 kvfree_call_rcu+0x2e/0x8d0 kernel/rcu/tree.c:3452
 drop_sysctl_table+0x1cc/0x3a0 fs/proc/proc_sysctl.c:1515
 unregister_sysctl_table fs/proc/proc_sysctl.c:1536 [inline]
 unregister_sysctl_table+0x35/0x50 fs/proc/proc_sysctl.c:1528
 unix_sysctl_unregister+0x61/0x90 net/unix/sysctl_net_unix.c:58
 unix_net_exit+0x6e/0xc0 net/unix/af_unix.c:3695
 ops_exit_list+0xb5/0x160 net/core/net_namespace.c:173
 cleanup_net+0x4b6/0xb60 net/core/net_namespace.c:633
 process_one_work+0x663/0x1020 kernel/workqueue.c:2738
 process_scheduled_works kernel/workqueue.c:2815 [inline]
 worker_thread+0x849/0x1090 kernel/workqueue.c:2896
 kthread+0x2f4/0x3f0 kernel/kthread.c:388
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293

The buggy address belongs to the object at ffff888104eb4800
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 56 bytes inside of
 freed 256-byte region [ffff888104eb4800, ffff888104eb4900)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104eb4
head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5fffff00000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
raw: 005fffff00000840 ffff888100042b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
head: 005fffff00000840 ffff888100042b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
head: 005fffff00000001 ffffea000413ad01 ffffea000413ad48 00000000ffffffff
head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888104eb4700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888104eb4780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888104eb4800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff888104eb4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888104eb4900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
```

【已分析信息】如已经做过分析和定位，请尽量附上详细的分析结果
**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

GVP openEuler/kernel
关闭

内容风险标识

评论 (3)

GVPopenEuler/kernel关闭

内容风险标识