Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

epoll: fix epoll close error, report by kasan #5846

Merged
merged 1 commit into from
Mar 27, 2022

Conversation

GUIDINGLI
Copy link
Contributor

Summary

epoll: fix epoll close error, report by kasan

-#9 0xf7abf899 in __asan::__asan_report_load2 (addr=4072681776) at ../../../../../src/libsanitizer/asan/asan_rtl.cc:117
-#10 0x5693f718 in inode_release (node=0xf2c03124) at inode/fs_inoderelease.c:69
-#11 0x568ea61b in file_close (filep=0xf55fedd0) at vfs/fs_close.c:79
-#12 0x568e7e56 in nx_close (fd=3) at inode/fs_files.c:528
-#13 0x568e7f0e in close (fd=3) at inode/fs_files.c:562
-#14 0x56e76c39 in epoll_close (epfd=3) at vfs/fs_epoll.c:252
-#15 0x56c33829 in sensor_service_delete (ctrl=0x578b8540 ) at src/common.c:439
-#16 0x56a0561e in sensor_middle_service_main (argc=1, argv=0xf55de820) at sensor_main.c:118
-#17 0x56878675 in nxtask_startup (entrypt=0x56a054cc <sensor_middle_service_main>, argc=1, argv=0xf55de820) at sched/task_startup.c:70
-#18 0x5684427a in nxtask_start () at task/task_start.c:133
-#19 0xdeadbeef in ?? ()

reason:
epoll_close -> close -> epoll_do_close (free inode)
-> inode_release (reuse inode, crash)

fix:
use the global inode to match the fd which will return to user.
like the g_sock_inode in fs/socket/socket.c

Change-Id: I0096ac691ce9cf4169d1fb8bfa6d27a8c1ee7d52
Signed-off-by: ligd liguiding1@xiaomi.com

Impact

epoll

Testing

VELA

-apache#9  0xf7abf899 in __asan::__asan_report_load2 (addr=4072681776) at ../../../../../src/libsanitizer/asan/asan_rtl.cc:117
-apache#10 0x5693f718 in inode_release (node=0xf2c03124) at inode/fs_inoderelease.c:69
-apache#11 0x568ea61b in file_close (filep=0xf55fedd0) at vfs/fs_close.c:79
-apache#12 0x568e7e56 in nx_close (fd=3) at inode/fs_files.c:528
-apache#13 0x568e7f0e in close (fd=3) at inode/fs_files.c:562
-apache#14 0x56e76c39 in epoll_close (epfd=3) at vfs/fs_epoll.c:252
-apache#15 0x56c33829 in sensor_service_delete (ctrl=0x578b8540 <control>) at src/common.c:439
-apache#16 0x56a0561e in sensor_middle_service_main (argc=1, argv=0xf55de820) at sensor_main.c:118
-apache#17 0x56878675 in nxtask_startup (entrypt=0x56a054cc <sensor_middle_service_main>, argc=1, argv=0xf55de820) at sched/task_startup.c:70
-apache#18 0x5684427a in nxtask_start () at task/task_start.c:133
-apache#19 0xdeadbeef in ?? ()

reason:
epoll_close -> close -> epoll_do_close (free inode)
                     -> inode_release  (reuse inode, crash)

fix:
use the global inode to match the fd which will return to user.
like the g_sock_inode in fs/socket/socket.c

Signed-off-by: ligd <liguiding1@xiaomi.com>
@pkarashchenko pkarashchenko merged commit 0d365f6 into apache:master Mar 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants