【openEuler-1.0-LTS】修复KASAN: slab-out-of-bounds in ses_enclosure_data_process问题

1. 日志
4195 [  494.901335] BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x234/0x6f0 [ses]
4196 [  494.901347] Write of size 1 at addr ffff8882f3181a70 by task systemd-udevd/1704
4197 [  494.931929] i801_smbus 0000:00:1f.4: SPD Write Disable is set
4198 
4200 [  494.944101] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 7.01 11/13/2019
4201 [  494.964003] i801_smbus 0000:00:1f.4: SMBus using PCI interrupt
4202 [  494.978532] Call Trace:
4203 [  494.978544]  dump_stack+0xbe/0xf9
4204 [  494.978558]  print_address_description.constprop.0+0x19/0x130
4205 [  495.092838]  ? ses_enclosure_data_process+0x234/0x6f0 [ses]
4206 [  495.092846]  __kasan_report.cold+0x68/0x80
4207 [  495.092855]  ? __kasan_kmalloc.constprop.0+0x71/0xd0
4208 [  495.092862]  ? ses_enclosure_data_process+0x234/0x6f0 [ses]
4209 [  495.092868]  kasan_report+0x3a/0x50
4210 [  495.092875]  ses_enclosure_data_process+0x234/0x6f0 [ses]
4211 [  495.092882]  ? mutex_unlock+0x1d/0x40
4212 [  495.092889]  ses_intf_add+0x57f/0x910 [ses]
4213 [  495.092900]  class_interface_register+0x26d/0x290
4214 [  495.092906]  ? class_destroy+0xd0/0xd0
4215 [  495.092912]  ? 0xffffffffc0bf8000
4216 [  495.092919]  ses_init+0x18/0x1000 [ses]
4217 [  495.092927]  do_one_initcall+0xcb/0x370
4218 [  495.092934]  ? initcall_blacklisted+0x1b0/0x1b0
4219 [  495.092942]  ? create_object.isra.0+0x330/0x3a0
4220 [  495.092950]  ? kasan_unpoison_shadow+0x33/0x40
4221 [  495.092957]  ? kasan_unpoison_shadow+0x33/0x40
4222 [  495.092966]  do_init_module+0xe4/0x3a0
4223 [  495.092972]  load_module+0xd0a/0xdd0
4224 [  495.092980]  ? layout_and_allocate+0x300/0x300
4225 [  495.092989]  ? seccomp_run_filters+0x1d6/0x2c0
4226 [  495.092999]  ? kernel_read_file_from_fd+0xb3/0xe0
4227 [  495.093006]  __se_sys_finit_module+0x11b/0x1b0
4228 [  495.093012]  ? __ia32_sys_init_module+0x40/0x40
4229 [  495.093023]  ? __audit_syscall_entry+0x226/0x290
4230 [  495.093032]  do_syscall_64+0x33/0x40
4231 [  495.093041]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
4234 [  495.093058] RSP: 002b:00007ffdc6009e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
4235 [  495.093068] RAX: ffffffffffffffda RBX: 000055d4192801c0 RCX: 00007f39c3376089
4236 [  495.093072] RDX: 0000000000000000 RSI: 00007f39c2fae99d RDI: 000000000000000f
4237 [  495.093076] RBP: 00007f39c2fae99d R08: 0000000000000000 R09: 0000000000000001
4238 [  495.093080] R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000000
4239 [  495.093084] R13: 000055d419282e00 R14: 0000000000020000 R15: 000055d41927f1f0
4240 
4241 [  495.093091] Allocated by task 1704:
4242 [  495.093098]  kasan_save_stack+0x1b/0x40
4243 [  495.093105]  __kasan_kmalloc.constprop.0+0xc2/0xd0
4244 [  495.093111]  ses_enclosure_data_process+0x65d/0x6f0 [ses]
4245 [  495.093117]  ses_intf_add+0x57f/0x910 [ses]
4246 [  495.093123]  class_interface_register+0x26d/0x290
4247 [  495.093129]  ses_init+0x18/0x1000 [ses]
4248 [  495.093134]  do_one_initcall+0xcb/0x370
4249 [  495.093139]  do_init_module+0xe4/0x3a0
4250 [  495.093144]  load_module+0xd0a/0xdd0
4251 [  495.093150]  __se_sys_finit_module+0x11b/0x1b0
4252 [  495.093155]  do_syscall_64+0x33/0x40
4253 [  495.093162]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
4254 
4255 [  495.093168] The buggy address belongs to the object at ffff8882f3181a40
4256                 which belongs to the cache kmalloc-64 of size 64
4257 [  495.093173] The buggy address is located 48 bytes inside of
4258                 64-byte region [ffff8882f3181a40, ffff8882f3181a80)
4259 [  495.093175] The buggy address belongs to the page:
4260 [  495.093181] page:ffffea000bcc6000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f3180
4261 [  495.093186] head:ffffea000bcc6000 order:2 compound_mapcount:0 compound_pincount:0
4262 [  495.093194] flags: 0x17ffe0000010200(slab|head|node=0|zone=2|lastcpupid=0x3fff)
4263 [  495.093204] raw: 017ffe0000010200 ffffea0016e5fb08 ffffea0016921508 ffff888100050e00
4264 [  495.093211] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
4265 [  495.093213] page dumped because: kasan: bad access detected
4266 
4267 [  495.093216] Memory state around the buggy address:
4268 [  495.093222]  ffff8882f3181900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
4269 [  495.093227]  ffff8882f3181980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
4270 [  495.093231] >ffff8882f3181a00: fc fc fc fc fc fc fc fc 00 00 00 00 01 fc fc fc
4271 [  495.093234]                                                              ^
4272 [  495.093239]  ffff8882f3181a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
4273 [  495.093244]  ffff8882f3181b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
4274 [  495.093246] ==================================================================
4275 [  495.093248] Disabling lock debugging due to kernel taint
2. 基本代码逻辑
do_init_module
    do_one_initcall
        ses_init
            class_interface_register
                ses_intf_add
                    ses_enclosure_data_process  0x234/0x6f0
                        
3. 具体越界位置定位
    [zhangwensheng@ceph-admin wanghai]$ addr2line -a 0000000000000710 -e ses.ko
    0x0000000000000710
    /home/changjuye/510euleros/hulk/drivers/scsi/ses.c:566

4. 对应代码位置
	if (ses_dev->page10)
		addl_desc_ptr = ses_dev->page10 + 8;
	type_ptr = ses_dev->page1_types;
	components = 0;
	for (i = 0; i < types; i++, type_ptr += 4) {
		for (j = 0; j < type_ptr[1]; j++) {
			char *name = NULL;
			struct enclosure_component *ecomp;

if (desc_ptr) {
				if (desc_ptr >= buf + page7_len) {
					desc_ptr = NULL;
				} else {
					len = (desc_ptr[2] << 8) + desc_ptr[3];
					desc_ptr += 4;
					/* Add trailing zero - pushes into
					 * reserved space */
					desc_ptr[len] = '\0';
					name = desc_ptr;
				}
			}

存在越界逻辑风险，修改方案为先进行校验再处理；

src-openEuler/kernel
Closed

Content Risk Flag

Comments (1)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag