nbd: fix uaf in nbd_genl_connect() error path

UAF问题分析：
在函数nbd_genl_connect中，如果nbd设备成功启动（nbd_start_device成功）
在函数剩余的处理中，如果因为出错，ret不为0，导致nbd_genl_connect进入错误处理分支out时不会增加nbd->configs引用计数。
导致在异步进程recv_work释放掉configs后还在使用。

修复方案：
在nbd_genl_connect错误路径中，释放掉configs最后一个引用计数前，将nbd_start_device中创建的资源都正确释放。
or
将nbd_start_device调用后置

栈信息：
[  744.928175] ==================================================================
[  744.929130] BUG: KASAN: slab-use-after-free in recv_work+0x3b0/0x7f0
[  744.930077] Write of size 4 at addr ffff0000ca8fe140 by task kworker/u9:0/96
[  744.931100] 
[  744.931381] CPU: 2 PID: 96 Comm: kworker/u9:0 Not tainted 6.6.0+ #25
[  744.932931] Hardware name: linux,dummy-virt (DT)
[  744.934881] Workqueue: nbd2-recv recv_work
[  744.936311] Call trace:
[  744.937339]  dump_backtrace+0x12c/0x220
[  744.938071]  show_stack+0x34/0x50
[  744.938702]  dump_stack_lvl+0x80/0x118
[  744.939339]  print_address_description.constprop.0+0x84/0x3c8
[  744.940296]  print_report+0xb0/0x280
[  744.940967]  kasan_report+0x84/0xd0
[  744.941633]  kasan_check_range+0xe8/0x190
[  744.942380]  __kasan_check_write+0x20/0x30
[  744.943079]  recv_work+0x3b0/0x7f0
[  744.943671]  process_one_work+0x600/0xfe0
[  744.944324]  worker_thread+0x6f0/0xc78
[  744.944969]  kthread+0x2b0/0x340
[  744.945547]  ret_from_fork+0x10/0x20
[  744.946238] 
[  744.946589] Allocated by task 13560:
[  744.947248]  kasan_save_stack+0x2c/0x58
[  744.947943]  kasan_set_track+0x2c/0x40
[  744.948638]  kasan_save_alloc_info+0x24/0x38
[  744.949416]  __kasan_kmalloc+0xb8/0xc0
[  744.950102]  kmalloc_trace+0x60/0x100
[  744.950772]  nbd_alloc_and_init_config+0x98/0x280
[  744.951590]  nbd_genl_connect+0x3b0/0x1718
[  744.952283]  genl_family_rcv_msg_doit+0x1e4/0x2c8
[  744.953079]  genl_family_rcv_msg+0x3e0/0x5f0
[  744.953809]  genl_rcv_msg+0xd8/0x1a8
[  744.954438]  netlink_rcv_skb+0x210/0x3e8
[  744.955097]  genl_rcv+0x44/0x68
[  744.955644]  netlink_unicast+0x4f4/0x720
[  744.956295]  netlink_sendmsg+0x844/0xcc8
[  744.956945]  __sock_sendmsg+0xc8/0x190
[  744.957573]  ____sys_sendmsg+0x6c4/0x8d8
[  744.958252]  ___sys_sendmsg+0x134/0x1e0
[  744.958907]  __sys_sendmsg+0x104/0x1d0
[  744.959473]  __arm64_sys_sendmsg+0x7c/0xb8
[  744.960160]  invoke_syscall+0x8c/0x2e0
[  744.960808]  el0_svc_common.constprop.0+0x200/0x2a8
[  744.961434]  do_el0_svc+0x4c/0x70
[  744.962047]  el0_svc+0x44/0x1d8
[  744.962626]  el0t_64_sync_handler+0x100/0x130
[  744.963365]  el0t_64_sync+0x188/0x190
[  744.963991] 
[  744.964336] Freed by task 96:
[  744.964884]  kasan_save_stack+0x2c/0x58
[  744.965577]  kasan_set_track+0x2c/0x40
[  744.966262]  kasan_save_free_info+0x38/0x60
[  744.966888]  __kasan_slab_free+0xec/0x188
[  744.967409]  __kmem_cache_free+0x154/0x3c0
[  744.967937]  kfree+0x78/0x138
[  744.968358]  nbd_config_put+0x358/0x740
[  744.968869]  recv_work+0x3a0/0x7f0
[  744.969471]  process_one_work+0x600/0xfe0
[  744.970207]  worker_thread+0x6f0/0xc78
[  744.970893]  kthread+0x2b0/0x340
[  744.971456]  ret_from_fork+0x10/0x20
[  744.972071] 
[  744.972401] The buggy address belongs to the object at ffff0000ca8fe100
                which belongs to the cache kmalloc-128 of size 128
[  744.974286] The buggy address is located 64 bytes inside of
                freed 128-byte region [ffff0000ca8fe100, ffff0000ca8fe180)
[  744.976202] 
[  744.976551] The buggy address belongs to the physical page:
[  744.977485] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a8fe
[  744.978774] flags: 0x5ffffe00000800(slab|node=0|zone=2|lastcpupid=0xfffff)
[  744.979890] raw: 005ffffe00000800 ffff0000c00028c0 fffffc0000d89500 dead000000000004
[  744.981118] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[  744.982358] page dumped because: kasan: bad access detected
[  744.983235] 
[  744.983556] Memory state around the buggy address:
[  744.984256]  ffff0000ca8fe000: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[  744.985328]  ffff0000ca8fe080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  744.986417] >ffff0000ca8fe100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  744.987474]                                            ^
[  744.988275]  ffff0000ca8fe180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  744.989291]  ffff0000ca8fe200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[  744.990351] ==================================================================
[  744.991617] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  744.992541] CPU: 2 PID: 96 Comm: kworker/u9:0 Not tainted 6.6.0+ #25
[  744.993437] Hardware name: linux,dummy-virt (DT)
[  744.994180] Workqueue: nbd2-recv recv_work
[  744.994878] Call trace:
[  744.995332]  dump_backtrace+0x12c/0x220
[  744.995880]  show_stack+0x34/0x50
[  744.996475]  dump_stack_lvl+0x80/0x118
[  744.997104]  dump_stack+0x20/0x30
[  744.997649]  panic+0x758/0x7b0
[  744.998190]  check_panic_on_warn+0xf4/0x120
[  744.998887]  end_report+0xb0/0x110
[  744.999479]  kasan_report+0x94/0xd0
[  745.000053]  kasan_check_range+0xe8/0x190
[  745.000695]  __kasan_check_write+0x20/0x30
[  745.001356]  recv_work+0x3b0/0x7f0
[  745.001958]  process_one_work+0x600/0xfe0
[  745.002625]  worker_thread+0x6f0/0xc78
[  745.003130]  kthread+0x2b0/0x340
[  745.003693]  ret_from_fork+0x10/0x20
[  745.004314] SMP: stopping secondary CPUs
[  745.004984] Kernel Offset: 0x54d254a00000 from 0xffff800080000000
[  745.005941] PHYS_OFFSET: 0x40000000
[  745.006548] CPU features: 0x00,00000000,00000008,80080142,10016203
[  745.007471] Memory Limit: none
[  745.008027] ---[ end Kernel panic - not syncing: KASAN: panic_on_warn set ... ]---
**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

GVP openEuler/kernel

内容风险标识

评论 (2)

GVPopenEuler/kernel

内容风险标识