内存问题:Kasan:use-after-free案例

内存问题:Kasan:use-after-free 案例

KASAN内存检测之UAF案例分析

现场日志

//第一份日志现场
 kernel: [ 2720.278427][ 0] ==================================================================
 kernel: [ 2720.286000][ 0] BUG: KASAN: use-after-free in i2c_dw_isr+0x8ac/0xa48 at addr ffffffe1f383e602
 kernel: [ 2720.294516][ 0] Read of size 2 by task swapper/0/0
 kernel: [ 2720.299296][ 0] =============================================================================
 kernel: [ 2720.307812][ 0] BUG kmalloc-64 (Tainted: G    B          ): kasan: bad access detected
 kernel: [ 2720.315717][ 0] -----------------------------------------------------------------------------
 kernel: [ 2720.315717][ 0] 
 kernel: [ 2720.326060][ 0] INFO: Allocated in i2cdev_ioctl_rdwr.isra.4+0xbc/0x3f8 age=37 cpu=1 pid=2035
 kernel: [ 2720.334491][ 0] 	alloc_debug_processing+0x184/0x190
 kernel: [ 2720.339360][ 0] 	___slab_alloc.constprop.26+0x2c8/0x2d0
 kernel: [ 2720.344575][ 0] 	__kmalloc_track_caller+0x268/0x298
 kernel: [ 2720.349444][ 0] 	memdup_user+0x2c/0xb8
 kernel: [ 2720.353185][ 0] 	fsnotify+0x438/0x5e8
 kernel: [ 2720.356838][ 0] 	__fsnotify_parent+0x16c/0x1c0
 kernel: [ 2720.361272][ 0] 	vfs_write+0x1ac/0x238
 kernel: [ 2720.365012][ 0] 	SyS_write+0xa0/0x110
 kernel: [ 2720.368665][ 0] 	__sys_trace_return+0x0/0x4
 kernel: [ 2720.372840][ 0] INFO: Freed in inotify_free_event+0xc/0x18 age=6 cpu=2 pid=1615
 kernel: [ 2720.380139][ 0] 	free_debug_processing+0x16c/0x308
 kernel: [ 2720.384920][ 0] 	__slab_free+0x20c/0x358
 kernel: [ 2720.388831][ 0] 	kfree+0x1a8/0x1b8
 kernel: [ 2720.392224][ 0] 	inotify_free_event+0xc/0x18
 kernel: [ 2720.396484][ 0] 	fsnotify_destroy_event+0x60/0x80
 kernel: [ 2720.401178][ 0] 	inotify_read+0x340/0x4b8
 kernel: [ 2720.405178][ 0] 	__vfs_read+0x54/0xa8
 kernel: [ 2720.408830][ 0] 	vfs_read+0x8c/0x1a8
 kernel: [ 2720.412395][ 0] 	SyS_read+0xa0/0x110
 kernel: [ 2720.415960][ 0] 	__sys_trace_return+0x0/0x4
 kernel: [ 2720.420134][ 0] INFO: Slab 0xffffffbe47ce0f80 objects=21 used=18 fp=0xffffffe1f383e480 flags=0x4000000000004080
 kernel: [ 2720.430212][ 0] INFO: Object 0xffffffe1f383e600 @offset=1536 fp=0xffffffe1f383f680
 kernel: [ 2720.430212][ 0] 
 kernel: [ 2720.439597][ 0] Bytes b4 ffffffe1f383e5f0: 00 00 00 00 3f 49 00 00 2f f4 07 00 01 00 00 00  ....?I../.......
 kernel: [ 2720.449414][ 0] Object ffffffe1f383e600: 80 f6 83 f3 e1 ff ff ff f0 73 6a 6c e2 ff ff ff  .........sjl....
 kernel: [ 2720.459057][ 0] Object ffffffe1f383e610: 58 72 64 77 c0 ff ff ff 02 00 00 08 c0 ff ff ff  Xrdw............
 kernel: [ 2720.468700][ 0] Object ffffffe1f383e620: 01 00 00 00 00 00 00 00 07 00 00 00 61 64 6a 74  ............adjt
 kernel: [ 2720.478343][ 0] Object ffffffe1f383e630: 69 6d 65 00 00 00 00 00 00 00 00 00 00 00 00 00  ime.............
 kernel: [ 2720.487986][ 0] Padding ffffffe1f383e770: 00 00 00 00 3f 49 00 00 2f f4 07 00 01 00 00 00  ....?I../.......
 kernel: [ 2720.497719][ 0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B           4.4.131-20200529-51s-7xx-03-ks01.kylin.desktop-generic #kylin
 kernel: [ 2720.497724][ 0] Hardware name: Changfeng Technology Co., Ltd TSZD Desktop/DFMBFTATX21056Y, BIOS KL4.23.LV.D.010.230926.R 09/26/23 15:33:11
 kernel: [ 2720.497727][ 0] Call trace:
 kernel: [ 2720.500513][ 0] [<ffffffc00008b7c8>] dump_backtrace+0x0/0x1c0
 kernel: [ 2720.500518][ 0] [<ffffffc00008b99c>] show_stack+0x14/0x20
 kernel: [ 2720.500524][ 0] [<ffffffc0007a4b00>] dump_stack+0xa4/0xcc
 kernel: [ 2720.500529][ 0] [<ffffffc0002649f4>] print_trailer+0x104/0x170
 kernel: [ 2720.500533][ 0] [<ffffffc0002696c4>] object_err+0x3c/0x50
 kernel: [ 2720.500538][ 0] [<ffffffc00026b648>] kasan_report.part.1+0x200/0x528
 kernel: [ 2720.500542][ 0] [<ffffffc00026bc30>] kasan_report+0x28/0x30
 kernel: [ 2720.500546][ 0] [<ffffffc00026a498>] __asan_load2+0x60/0x78
 kernel: [ 2720.500551][ 0] [<ffffffc000e9440c>] i2c_dw_isr+0x8ac/0xa48
 kernel: [ 2720.500558][ 0] [<ffffffc00011dc80>] handle_irq_event_percpu+0xb0/0x348
 kernel: [ 2720.500563][ 0] [<ffffffc00011df84>] handle_irq_event+0x6c/0xb0
 kernel: [ 2720.500567][ 0] [<ffffffc000123320>] handle_fasteoi_irq+0x128/0x290
 kernel: [ 2720.500572][ 0] [<ffffffc00011ced0>] generic_handle_irq+0x38/0x50
 kernel: [ 2720.500577][ 0] [<ffffffc00011d308>] __handle_domain_irq+0x78/0xe8
 kernel: [ 2720.500581][ 0] [<ffffffc0000820c8>] gic_handle_irq+0xf0/0x1a0
 kernel: [ 2720.500586][ 0] Exception stack(0xffffffc002ddbcf0 to 0xffffffc002ddbe10)
 kernel: [ 2720.500590][ 0] bce0:                                   ffffffc0014a5d80 ffffffc0033e2000
 kernel: [ 2720.500595][ 0] bd00: ffffffc002ddbe50 ffffffc0000860cc 0000000060000145 ffffffc002dd8000
 kernel: [ 2720.500600][ 0] bd20: 0000000000000000 ffffffc002dc4c40 0000000000000000 dfffff9000000000
 kernel: [ 2720.500605][ 0] bd40: 1ffffff80067c575 0000000000000000 0000000000000000 ffffffc002b8e328
 kernel: [ 2720.500609][ 0] bd60: ffffff88005bb7a8 dfffff9000000000 00000000f1f1f1f1 1ffffff8005bb7a8
 kernel: [ 2720.500614][ 0] bd80: 0000000000000790 00000000003d0f00 0000007ef62fe1e0 000000000000016d
 kernel: [ 2720.500619][ 0] bda0: 2ce33e6c02ce33e7 00000000000001db ffffffc00013e630 0000007f95679e80
 kernel: [ 2720.500623][ 0] bdc0: 0000000000000014 ffffffc0014a5d80 ffffffc0033e2000 ffffffc002dd801c
 kernel: [ 2720.500628][ 0] bde0: ffffffc0033e2000 ffffffc0033e2ba0 ffffffc002dd8000 0000000000000000
 kernel: [ 2720.500632][ 0] be00: ffffffc002dc4c40 ffffffc002dc8000
 kernel: [ 2720.500636][ 0] [<ffffffc000084da8>] el1_irq+0x68/0xc0
 kernel: [ 2720.500642][ 0] [<ffffffc0001058e0>] cpu_startup_entry+0x148/0x268
 kernel: [ 2720.500649][ 0] [<ffffffc00147deac>] rest_init+0x8c/0xa0
 kernel: [ 2720.500654][ 0] [<ffffffc002cf5b8c>] start_kernel+0x434/0x464
 kernel: [ 2720.500658][ 0] [<ffffffc0000811e4>] 0xffffffc0000811e4
 kernel: [ 2720.500661][ 0] Memory state around the buggy address:
 kernel: [ 2720.505789][ 0]  ffffffe1f383e500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 kernel: [ 2720.513349][ 0]  ffffffe1f383e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 kernel: [ 2720.520908][ 0] >ffffffe1f383e600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 kernel: [ 2720.528466][ 0]                    ^
 kernel: [ 2720.532031][ 0]  ffffffe1f383e680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 kernel: [ 2720.539590][ 0]  ffffffe1f383e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 kernel: [ 2720.547148][ 0] ==================================================================
 //第二份日志
 kernel: [ 2718.820752][ 1] BUG: KASAN: use-after-free in i2c_dw_isr+0x8ac/0xa48 at addr ffffffe1ebce6902
 kernel: [ 2718.829267][ 1] Read of size 2 by task swapper/0/0
 kernel: [ 2718.834048][ 1] =============================================================================
 kernel: [ 2718.842563][ 1] BUG kmalloc-64 (Tainted: G    B          ): kasan: bad access detected
 kernel: [ 2718.850469][ 1] -----------------------------------------------------------------------------
 kernel: [ 2718.850469][ 1] 
 kernel: [ 2718.860813][ 1] INFO: Allocated in kernfs_fop_write+0x150/0x248 age=77 cpu=1 pid=2034
 kernel: [ 2718.868636][ 1] 	alloc_debug_processing+0x184/0x190
 kernel: [ 2718.873504][ 1] 	___slab_alloc.constprop.26+0x2c8/0x2d0
 kernel: [ 2718.878719][ 1] 	__kmalloc+0x260/0x290
 kernel: [ 2718.882458][ 1] 	kernfs_fop_write+0x150/0x248
 kernel: [ 2718.886806][ 1] 	__vfs_write+0x54/0xa8
 kernel: [ 2718.890545][ 1] 	vfs_write+0xbc/0x238
 kernel: [ 2718.894197][ 1] 	SyS_write+0xa0/0x110
 kernel: [ 2718.897851][ 1] 	__sys_trace_return+0x0/0x4
 kernel: [ 2718.902025][ 1] INFO: Freed in kernfs_fop_write+0x100/0x248 age=87 cpu=1 pid=2034
 kernel: [ 2718.909498][ 1] 	free_debug_processing+0x16c/0x308
 kernel: [ 2718.914279][ 1] 	__slab_free+0x20c/0x358
 kernel: [ 2718.918191][ 1] 	kfree+0x1a8/0x1b8
 kernel: [ 2718.921582][ 1] 	kernfs_fop_write+0x100/0x248
 kernel: [ 2718.925929][ 1] 	__vfs_write+0x54/0xa8
 kernel: [ 2718.929668][ 1] 	vfs_write+0xbc/0x238
 kernel: [ 2718.933321][ 1] 	SyS_write+0xa0/0x110
 kernel: [ 2718.936973][ 1] 	__sys_trace_return+0x0/0x4
 kernel: [ 2718.941147][ 1] INFO: Slab 0xffffffbe47af3980 objects=21 used=15 fp=0xffffffe1ebce7800 flags=0x4000000000004080
 kernel: [ 2718.951224][ 1] INFO: Object 0xffffffe1ebce6900 @offset=2304 fp=0x          (null)
 kernel: [ 2718.951224][ 1] 
 kernel: [ 2718.960610][ 1] Bytes b4 ffffffe1ebce68f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 kernel: [ 2718.970427][ 1] Object ffffffe1ebce6900: 00 00 00 00 00 00 00 00 00 78 ce eb e1 ff ff ff  .........x......
 kernel: [ 2718.980070][ 1] Object ffffffe1ebce6910: 08 69 ce eb e1 ff ff ff 01 00 00 00 00 00 00 00  .i..............
 kernel: [ 2718.989713][ 1] Object ffffffe1ebce6920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 kernel: [ 2718.999356][ 1] Object ffffffe1ebce6930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 kernel: [ 2719.009000][ 1] Padding ffffffe1ebce6a70: 58 7d 0a 00 c0 ff ff ff d0 54 08 00 c0 ff ff ff  X}.......T......
 kernel: [ 2719.018732][ 1] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B           4.4.131-20200529-51s-7xx-03-ks01.kylin.desktop-generic #kylin
 kernel: [ 2719.018737][ 1] Hardware name: Changfeng Technology Co., Ltd TSZD Desktop/DFMBFTATX21056Y, BIOS KL4.23.LV.D.010.230926.R 09/26/23 15:33:11
 kernel: [ 2719.018740][ 1] Call trace:
 kernel: [ 2719.021526][ 1] [<ffffffc00008b7c8>] dump_backtrace+0x0/0x1c0
 kernel: [ 2719.021531][ 1] [<ffffffc00008b99c>] show_stack+0x14/0x20
 kernel: [ 2719.021537][ 1] [<ffffffc0007a4b00>] dump_stack+0xa4/0xcc
 kernel: [ 2719.021542][ 1] [<ffffffc0002649f4>] print_trailer+0x104/0x170
 kernel: [ 2719.021547][ 1] [<ffffffc0002696c4>] object_err+0x3c/0x50
 kernel: [ 2719.021551][ 1] [<ffffffc00026b648>] kasan_report.part.1+0x200/0x528
 kernel: [ 2719.021556][ 1] [<ffffffc00026bc30>] kasan_report+0x28/0x30
 kernel: [ 2719.021560][ 1] [<ffffffc00026a498>] __asan_load2+0x60/0x78
 kernel: [ 2719.021565][ 1] [<ffffffc000e9440c>] i2c_dw_isr+0x8ac/0xa48
 kernel: [ 2719.021571][ 1] [<ffffffc00011dc80>] handle_irq_event_percpu+0xb0/0x348
 kernel: [ 2719.021575][ 1] [<ffffffc00011df84>] handle_irq_event+0x6c/0xb0
 kernel: [ 2719.021580][ 1] [<ffffffc000123320>] handle_fasteoi_irq+0x128/0x290
 kernel: [ 2719.021585][ 1] [<ffffffc00011ced0>] generic_handle_irq+0x38/0x50
 kernel: [ 2719.021589][ 1] [<ffffffc00011d308>] __handle_domain_irq+0x78/0xe8
 kernel: [ 2719.021593][ 1] [<ffffffc0000820c8>] gic_handle_irq+0xf0/0x1a0
 kernel: [ 2719.021598][ 1] Exception stack(0xffffffc002ddbcf0 to 0xffffffc002ddbe10)
 kernel: [ 2719.021602][ 1] bce0:                                   ffffffc0014a5d80 ffffffc0033e2000
 kernel: [ 2719.021608][ 1] bd00: ffffffc002ddbe50 ffffffc0000860cc 0000000060000145 ffffffc002dd8000
 kernel: [ 2719.021612][ 1] bd20: 0000000000000000 ffffffc002dc4c40 0000000000000000 dfffff9000000000
 kernel: [ 2719.021617][ 1] bd40: 1ffffff80067c575 0000000000000000 0000000000000000 0000000000000018
 kernel: [ 2719.021622][ 1] bd60: 00022550fff73600 ffffffe2fff970a8 ffffffc002deb070 ffffffc002dd8000
 kernel: [ 2719.021626][ 1] bd80: 0000000000000790 000000000000001b 0000007f94bad1e0 00000003e8000000
 kernel: [ 2719.021631][ 1] bda0: 0000000000000000 0000007f95ae9000 ffffffc000158118 0000007f95a5c528
 kernel: [ 2719.021636][ 1] bdc0: 0000000000000014 ffffffc0014a5d80 ffffffc0033e2000 ffffffc002dd801c
 kernel: [ 2719.021640][ 1] bde0: ffffffc0033e2000 ffffffc0033e2ba0 ffffffc002dd8000 0000000000000000
 kernel: [ 2719.021644][ 1] be00: ffffffc002dc4c40 ffffffc002dc8000
 kernel: [ 2719.021649][ 1] [<ffffffc000084da8>] el1_irq+0x68/0xc0
 kernel: [ 2719.021654][ 1] [<ffffffc0001058e0>] cpu_startup_entry+0x148/0x268
 kernel: [ 2719.021661][ 1] [<ffffffc00147deac>] rest_init+0x8c/0xa0
 kernel: [ 2719.021666][ 1] [<ffffffc002cf5b8c>] start_kernel+0x434/0x464
 kernel: [ 2719.021670][ 1] [<ffffffc0000811e4>] 0xffffffc0000811e4
 kernel: [ 2719.021673][ 1] Memory state around the buggy address:
 kernel: [ 2719.026802][ 1]  ffffffe1ebce6800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 kernel: [ 2719.034361][ 1]  ffffffe1ebce6880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 kernel: [ 2719.041920][ 1] >ffffffe1ebce6900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 kernel: [ 2719.049478][ 1]                    ^
 kernel: [ 2719.053044][ 1]  ffffffe1ebce6980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 kernel: [ 2719.060603][ 1]  ffffffe1ebce6a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 kernel: [ 2719.068161][ 1] ==================================================================

问题分析

UAF日志简析

• 总体一句话，就是中断处理中进入读操作，读完将数据存放到指定buf，但此时BUF被提前释放。

# 经过KASAN抓取到的UAF现场
BUG: KASAN: use-after-free in i2c_dw_isr+0x8ac/0xa48 at addr ffffffe1f383e602
BUG kmalloc-64 (Tainted: G    B          ): kasan: bad access detected

# buf申请现场
INFO: Allocated in i2cdev_ioctl_rdwr.isra.4+0xbc/0x3f8 age=37 cpu=1 pid=2035


# buf释放现场
INFO: Freed in inotify_free_event+0xc/0x18 age=6 cpu=2 pid=1615

# 检测现场
 kernel: [ 2720.500533][ 0] [<ffffffc0002696c4>] object_err+0x3c/0x50
 kernel: [ 2720.500538][ 0] [<ffffffc00026b648>] kasan_report.part.1+0x200/0x528
 kernel: [ 2720.500542][ 0] [<ffffffc00026bc30>] kasan_report+0x28/0x30
 kernel: [ 2720.500546][ 0] [<ffffffc00026a498>] __asan_load2+0x60/0x78
 kernel: [ 2720.500551][ 0] [<ffffffc000e9440c>] i2c_dw_isr+0x8ac/0xa48
 kernel: [ 2720.500558][ 0] [<ffffffc00011dc80>] handle_irq_event_percpu+0xb0/0x348
 kernel: [ 2720.500563][ 0] [<ffffffc00011df84>] handle_irq_event+0x6c/0xb0
 kernel: [ 2720.500567][ 0] [<ffffffc000123320>] handle_fasteoi_irq+0x128/0x290
 kernel: [ 2720.500572][ 0] [<ffffffc00011ced0>] generic_handle_irq+0x38/0x50
 kernel: [ 2720.500577][ 0] [<ffffffc00011d308>] __handle_domain_irq+0x78/0xe8
 kernel: [ 2720.500581][ 0] [<ffffffc0000820c8>] gic_handle_irq+0xf0/0x1a0

I2C-dev读写过程

1、首先用户层通过IOCTL

   if(ioctl(file, I2C_RDWR, &packets) < 0)
   应用还使用inotify监控操作。

2、调用i2c-dev.c中的ioctl

//sys_wrire 读/写数据
390  static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
391  {
432  	case I2C_RDWR: {
451  		return i2cdev_ioctl_rdwr(client, rdwr_arg.nmsgs, rdwr_pa);
452  	}
453  
 static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
234  		unsigned nmsgs, struct i2c_msg *msgs)
235  {
254  		msgs[i].buf = memdup_user(data_ptrs[i], msgs[i].len);					//UAF对象
			res = i2c_transfer(client->adapter, msgs, nmsgs);
	 }

 -> vfs_read
 --> __vfs_read(file, buf, count, pos)
 ---> inotify_read
 ---- > fsnotify_destroy_event(group, kevent);销毁
 -----> group->ops->free_event(event);(inotify_free_event)
 ------> kfree

3、I2C子系统读写流程

i2c_transfer
-> ret = adap->algo->master_xfer(adap, msgs, num);
--> i2c_dw_xfer
439  	dev->msgs = msgs;															//UAF对象
---> i2c_dw_xfer_init(dev);															//使能中断

中断使用已释放的buf，触发UAF现场

i2c_dw_isr
-> i2c_dw_irq_handler_master(dev);
--> i2c_dw_read(dev);
struct i2c_msg *msgs = dev->msgs;
 																					//UAF现场
380  	for (; dev->msg_read_idx < dev->msgs_num; dev->msg_read_idx++) {
381  		u32 len;
382  		u8 *buf;
383  
384  		if (!(msgs[dev->msg_read_idx].flags & I2C_M_RD))
385  			continue;
386  
387  		if (!(dev->status & STATUS_READ_IN_PROGRESS)) {
388  			len = msgs[dev->msg_read_idx].len;
389  			buf = msgs[dev->msg_read_idx].buf;
390  		} else {
391  			len = dev->rx_buf_len;
392  			buf = dev->rx_buf;
393  		}

测试应用：

https://blog.csdn.net/zgp2917/article/details/99692635

其他同事关于KASNA优秀博文

1. https://blog.csdn.net/paul1994/article/details/133772914
2. https://blog.csdn.net/u012673734/article/details/121456204
3. https://blog.csdn.net/weixin_34100227/article/details/94634922
4. https://geesun.github.io/posts/2024/07/02_kasan.html
5. https://www.cnblogs.com/pwl999/p/15534973.html
6. https://blog.csdn.net/luoye_369/article/details/142813919
7. https://zhuanlan.zhihu.com/p/671689075