Skip to content

Conversation

@GUIDINGLI
Copy link
Contributor

Summary

epoll: fix epoll close error, report by kasan

-#9 0xf7abf899 in __asan::__asan_report_load2 (addr=4072681776) at ../../../../../src/libsanitizer/asan/asan_rtl.cc:117
-#10 0x5693f718 in inode_release (node=0xf2c03124) at inode/fs_inoderelease.c:69
-#11 0x568ea61b in file_close (filep=0xf55fedd0) at vfs/fs_close.c:79
-#12 0x568e7e56 in nx_close (fd=3) at inode/fs_files.c:528
-#13 0x568e7f0e in close (fd=3) at inode/fs_files.c:562
-#14 0x56e76c39 in epoll_close (epfd=3) at vfs/fs_epoll.c:252
-#15 0x56c33829 in sensor_service_delete (ctrl=0x578b8540 ) at src/common.c:439
-#16 0x56a0561e in sensor_middle_service_main (argc=1, argv=0xf55de820) at sensor_main.c:118
-#17 0x56878675 in nxtask_startup (entrypt=0x56a054cc <sensor_middle_service_main>, argc=1, argv=0xf55de820) at sched/task_startup.c:70
-#18 0x5684427a in nxtask_start () at task/task_start.c:133
-#19 0xdeadbeef in ?? ()

reason:
epoll_close -> close -> epoll_do_close (free inode)
-> inode_release (reuse inode, crash)

fix:
use the global inode to match the fd which will return to user.
like the g_sock_inode in fs/socket/socket.c

Change-Id: I0096ac691ce9cf4169d1fb8bfa6d27a8c1ee7d52
Signed-off-by: ligd liguiding1@xiaomi.com

Impact

epoll

Testing

VELA

-apache#9  0xf7abf899 in __asan::__asan_report_load2 (addr=4072681776) at ../../../../../src/libsanitizer/asan/asan_rtl.cc:117
-apache#10 0x5693f718 in inode_release (node=0xf2c03124) at inode/fs_inoderelease.c:69
-apache#11 0x568ea61b in file_close (filep=0xf55fedd0) at vfs/fs_close.c:79
-apache#12 0x568e7e56 in nx_close (fd=3) at inode/fs_files.c:528
-apache#13 0x568e7f0e in close (fd=3) at inode/fs_files.c:562
-apache#14 0x56e76c39 in epoll_close (epfd=3) at vfs/fs_epoll.c:252
-apache#15 0x56c33829 in sensor_service_delete (ctrl=0x578b8540 <control>) at src/common.c:439
-apache#16 0x56a0561e in sensor_middle_service_main (argc=1, argv=0xf55de820) at sensor_main.c:118
-apache#17 0x56878675 in nxtask_startup (entrypt=0x56a054cc <sensor_middle_service_main>, argc=1, argv=0xf55de820) at sched/task_startup.c:70
-apache#18 0x5684427a in nxtask_start () at task/task_start.c:133
-apache#19 0xdeadbeef in ?? ()

reason:
epoll_close -> close -> epoll_do_close (free inode)
                     -> inode_release  (reuse inode, crash)

fix:
use the global inode to match the fd which will return to user.
like the g_sock_inode in fs/socket/socket.c

Signed-off-by: ligd <liguiding1@xiaomi.com>
@pkarashchenko pkarashchenko merged commit 0d365f6 into apache:master Mar 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants