Date
April 22, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 | |
| rk3399-rock-pi-4b |
[ 18.248480] ================================================================== [ 18.248745] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 18.249196] Read of size 4 at addr fff00000c62b9cc0 by task swapper/1/0 [ 18.249341] [ 18.249434] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 18.249633] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.249696] Hardware name: linux,dummy-virt (DT) [ 18.249768] Call trace: [ 18.249822] show_stack+0x20/0x38 (C) [ 18.249937] dump_stack_lvl+0x8c/0xd0 [ 18.250387] print_report+0x118/0x608 [ 18.250514] kasan_report+0xdc/0x128 [ 18.251219] __asan_report_load4_noabort+0x20/0x30 [ 18.251317] rcu_uaf_reclaim+0x64/0x70 [ 18.251393] rcu_core+0x9f4/0x1e20 [ 18.251444] rcu_core_si+0x18/0x30 [ 18.251498] handle_softirqs+0x374/0xb28 [ 18.251640] __do_softirq+0x1c/0x28 [ 18.251767] ____do_softirq+0x18/0x30 [ 18.251898] call_on_irq_stack+0x24/0x58 [ 18.251998] do_softirq_own_stack+0x24/0x38 [ 18.252080] __irq_exit_rcu+0x1fc/0x318 [ 18.252155] irq_exit_rcu+0x1c/0x80 [ 18.252233] el1_interrupt+0x38/0x58 [ 18.252328] el1h_64_irq_handler+0x18/0x28 [ 18.252433] el1h_64_irq+0x6c/0x70 [ 18.252742] arch_local_irq_enable+0x4/0x8 (P) [ 18.252894] do_idle+0x384/0x4e8 [ 18.253028] cpu_startup_entry+0x64/0x80 [ 18.253132] secondary_start_kernel+0x288/0x340 [ 18.253233] __secondary_switched+0xc0/0xc8 [ 18.253394] [ 18.253460] Allocated by task 200: [ 18.253574] kasan_save_stack+0x3c/0x68 [ 18.253657] kasan_save_track+0x20/0x40 [ 18.253730] kasan_save_alloc_info+0x40/0x58 [ 18.253811] __kasan_kmalloc+0xd4/0xd8 [ 18.253871] __kmalloc_cache_noprof+0x15c/0x3c0 [ 18.253953] rcu_uaf+0xb0/0x2d8 [ 18.254025] kunit_try_run_case+0x170/0x3f0 [ 18.254114] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.254204] kthread+0x328/0x630 [ 18.254276] ret_from_fork+0x10/0x20 [ 18.254366] [ 18.254414] Freed by task 0: [ 18.254475] kasan_save_stack+0x3c/0x68 [ 18.254644] kasan_save_track+0x20/0x40 [ 18.254739] kasan_save_free_info+0x4c/0x78 [ 18.254824] __kasan_slab_free+0x6c/0x98 [ 18.254902] kfree+0x214/0x3c8 [ 18.254984] rcu_uaf_reclaim+0x28/0x70 [ 18.255107] rcu_core+0x9f4/0x1e20 [ 18.255189] rcu_core_si+0x18/0x30 [ 18.255318] handle_softirqs+0x374/0xb28 [ 18.255401] __do_softirq+0x1c/0x28 [ 18.255470] [ 18.255528] Last potentially related work creation: [ 18.255610] kasan_save_stack+0x3c/0x68 [ 18.255679] kasan_record_aux_stack+0xb4/0xc8 [ 18.255756] __call_rcu_common.constprop.0+0x70/0x8b0 [ 18.255839] call_rcu+0x18/0x30 [ 18.255895] rcu_uaf+0x14c/0x2d8 [ 18.255954] kunit_try_run_case+0x170/0x3f0 [ 18.256044] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.256115] kthread+0x328/0x630 [ 18.256182] ret_from_fork+0x10/0x20 [ 18.256342] [ 18.256481] The buggy address belongs to the object at fff00000c62b9cc0 [ 18.256481] which belongs to the cache kmalloc-32 of size 32 [ 18.256720] The buggy address is located 0 bytes inside of [ 18.256720] freed 32-byte region [fff00000c62b9cc0, fff00000c62b9ce0) [ 18.256952] [ 18.257613] The buggy address belongs to the physical page: [ 18.258028] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062b9 [ 18.258221] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.258454] page_type: f5(slab) [ 18.258576] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 18.259039] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 18.259166] page dumped because: kasan: bad access detected [ 18.259244] [ 18.259288] Memory state around the buggy address: [ 18.259730] fff00000c62b9b80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 18.259853] fff00000c62b9c00: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 18.259941] >fff00000c62b9c80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 18.260009] ^ [ 18.260079] fff00000c62b9d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.260833] fff00000c62b9d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.260982] ==================================================================
[ 19.069758] ================================================================== [ 19.071384] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60 [ 19.072247] Read of size 4 at addr ffff888102974900 by task swapper/1/0 [ 19.072883] [ 19.073149] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.15.0-rc3 #1 PREEMPT(voluntary) [ 19.073270] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.073388] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 19.073452] Call Trace: [ 19.073538] <IRQ> [ 19.073609] dump_stack_lvl+0x73/0xb0 [ 19.073693] print_report+0xd1/0x650 [ 19.073770] ? __virt_addr_valid+0x1db/0x2d0 [ 19.073853] ? rcu_uaf_reclaim+0x50/0x60 [ 19.073924] ? kasan_complete_mode_report_info+0x64/0x200 [ 19.074258] ? rcu_uaf_reclaim+0x50/0x60 [ 19.074330] kasan_report+0x141/0x180 [ 19.074449] ? rcu_uaf_reclaim+0x50/0x60 [ 19.074560] __asan_report_load4_noabort+0x18/0x20 [ 19.074635] rcu_uaf_reclaim+0x50/0x60 [ 19.074705] rcu_core+0x66c/0x1c30 [ 19.074887] ? __pfx_rcu_core+0x10/0x10 [ 19.074925] ? ktime_get+0x6b/0x150 [ 19.074965] rcu_core_si+0x12/0x20 [ 19.074994] handle_softirqs+0x209/0x730 [ 19.075025] ? hrtimer_interrupt+0x2fe/0x780 [ 19.075056] ? __pfx_handle_softirqs+0x10/0x10 [ 19.075093] __irq_exit_rcu+0xc9/0x110 [ 19.075122] irq_exit_rcu+0x12/0x20 [ 19.075150] sysvec_apic_timer_interrupt+0x81/0x90 [ 19.075187] </IRQ> [ 19.075226] <TASK> [ 19.075241] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 19.075355] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 19.075722] Code: 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 43 c8 1b 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 19.075837] RSP: 0000:ffff88810086fdc8 EFLAGS: 00010212 [ 19.075953] RAX: ffff8881be53b000 RBX: ffff8881008353c0 RCX: ffffffff9a6cd0b5 [ 19.076015] RDX: ffffed102b626103 RSI: 0000000000000004 RDI: 0000000000020f2c [ 19.076071] RBP: ffff88810086fdd0 R08: 0000000000000001 R09: ffffed102b626102 [ 19.076129] R10: ffff88815b130813 R11: 0000000000044c00 R12: 0000000000000001 [ 19.076186] R13: ffffed1020106a78 R14: ffffffff9c3e7010 R15: 0000000000000000 [ 19.076261] ? ct_kernel_exit.constprop.0+0xa5/0xd0 [ 19.076307] ? default_idle+0xd/0x20 [ 19.076333] arch_cpu_idle+0xd/0x20 [ 19.076358] default_idle_call+0x48/0x80 [ 19.076383] do_idle+0x379/0x4f0 [ 19.076414] ? __pfx_do_idle+0x10/0x10 [ 19.076526] cpu_startup_entry+0x5c/0x70 [ 19.076598] start_secondary+0x211/0x290 [ 19.076629] ? __pfx_start_secondary+0x10/0x10 [ 19.076663] common_startup_64+0x13e/0x148 [ 19.076706] </TASK> [ 19.076720] [ 19.102057] Allocated by task 218: [ 19.102777] kasan_save_stack+0x45/0x70 [ 19.103520] kasan_save_track+0x18/0x40 [ 19.104263] kasan_save_alloc_info+0x3b/0x50 [ 19.105002] __kasan_kmalloc+0xb7/0xc0 [ 19.105622] __kmalloc_cache_noprof+0x189/0x420 [ 19.106141] rcu_uaf+0xb0/0x330 [ 19.106820] kunit_try_run_case+0x1a5/0x480 [ 19.107727] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 19.108252] kthread+0x337/0x6f0 [ 19.108810] ret_from_fork+0x41/0x80 [ 19.109537] ret_from_fork_asm+0x1a/0x30 [ 19.109756] [ 19.109854] Freed by task 0: [ 19.109983] kasan_save_stack+0x45/0x70 [ 19.110143] kasan_save_track+0x18/0x40 [ 19.110295] kasan_save_free_info+0x3f/0x60 [ 19.110453] __kasan_slab_free+0x56/0x70 [ 19.111737] kfree+0x222/0x3f0 [ 19.111986] rcu_uaf_reclaim+0x1f/0x60 [ 19.112220] rcu_core+0x66c/0x1c30 [ 19.112464] rcu_core_si+0x12/0x20 [ 19.113388] handle_softirqs+0x209/0x730 [ 19.114841] __irq_exit_rcu+0xc9/0x110 [ 19.115986] irq_exit_rcu+0x12/0x20 [ 19.116778] sysvec_apic_timer_interrupt+0x81/0x90 [ 19.117943] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 19.118841] [ 19.119270] Last potentially related work creation: [ 19.119783] kasan_save_stack+0x45/0x70 [ 19.120273] kasan_record_aux_stack+0xb2/0xc0 [ 19.120769] __call_rcu_common.constprop.0+0x72/0x9c0 [ 19.121383] call_rcu+0x12/0x20 [ 19.121729] rcu_uaf+0x168/0x330 [ 19.122165] kunit_try_run_case+0x1a5/0x480 [ 19.123587] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 19.124254] kthread+0x337/0x6f0 [ 19.124776] ret_from_fork+0x41/0x80 [ 19.125149] ret_from_fork_asm+0x1a/0x30 [ 19.126082] [ 19.126294] The buggy address belongs to the object at ffff888102974900 [ 19.126294] which belongs to the cache kmalloc-32 of size 32 [ 19.127779] The buggy address is located 0 bytes inside of [ 19.127779] freed 32-byte region [ffff888102974900, ffff888102974920) [ 19.128967] [ 19.129163] The buggy address belongs to the physical page: [ 19.130086] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102974 [ 19.131347] flags: 0x200000000000000(node=0|zone=2) [ 19.132337] page_type: f5(slab) [ 19.132657] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 19.133296] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 19.134281] page dumped because: kasan: bad access detected [ 19.135343] [ 19.135822] Memory state around the buggy address: [ 19.136202] ffff888102974800: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 19.136708] ffff888102974880: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 19.137276] >ffff888102974900: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 19.138242] ^ [ 19.138678] ffff888102974980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.139225] ffff888102974a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.139930] ==================================================================
[ 20.301985] ================================================================== [ 20.303028] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 20.303704] Read of size 4 at addr ffff00000a7c1fc0 by task swapper/3/0 [ 20.304351] [ 20.304536] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 20.304615] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.304640] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.304668] Call trace: [ 20.304688] show_stack+0x20/0x38 (C) [ 20.304741] dump_stack_lvl+0x8c/0xd0 [ 20.304792] print_report+0x118/0x608 [ 20.304841] kasan_report+0xdc/0x128 [ 20.304889] __asan_report_load4_noabort+0x20/0x30 [ 20.304946] rcu_uaf_reclaim+0x64/0x70 [ 20.305000] rcu_core+0x9f4/0x1e20 [ 20.305048] rcu_core_si+0x18/0x30 [ 20.305093] handle_softirqs+0x374/0xb28 [ 20.305145] __do_softirq+0x1c/0x28 [ 20.305189] ____do_softirq+0x18/0x30 [ 20.305239] call_on_irq_stack+0x24/0x58 [ 20.305289] do_softirq_own_stack+0x24/0x38 [ 20.305342] __irq_exit_rcu+0x1fc/0x318 [ 20.305392] irq_exit_rcu+0x1c/0x80 [ 20.305438] el1_interrupt+0x38/0x58 [ 20.305489] el1h_64_irq_handler+0x18/0x28 [ 20.305543] el1h_64_irq+0x6c/0x70 [ 20.305587] arch_local_irq_enable+0x4/0x8 (P) [ 20.305653] cpuidle_enter+0x60/0xb8 [ 20.305699] do_idle+0x36c/0x4e8 [ 20.305748] cpu_startup_entry+0x64/0x80 [ 20.305797] secondary_start_kernel+0x288/0x340 [ 20.305860] __secondary_switched+0xc0/0xc8 [ 20.305921] [ 20.316222] Allocated by task 256: [ 20.316571] kasan_save_stack+0x3c/0x68 [ 20.316973] kasan_save_track+0x20/0x40 [ 20.317371] kasan_save_alloc_info+0x40/0x58 [ 20.317813] __kasan_kmalloc+0xd4/0xd8 [ 20.318204] __kmalloc_cache_noprof+0x15c/0x3c0 [ 20.318677] rcu_uaf+0xb0/0x2d8 [ 20.319023] kunit_try_run_case+0x170/0x3f0 [ 20.319462] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.320024] kthread+0x328/0x630 [ 20.320377] ret_from_fork+0x10/0x20 [ 20.320756] [ 20.320925] Freed by task 0: [ 20.321225] kasan_save_stack+0x3c/0x68 [ 20.321622] kasan_save_track+0x20/0x40 [ 20.322023] kasan_save_free_info+0x4c/0x78 [ 20.322455] __kasan_slab_free+0x6c/0x98 [ 20.322861] kfree+0x214/0x3c8 [ 20.323197] rcu_uaf_reclaim+0x28/0x70 [ 20.323595] rcu_core+0x9f4/0x1e20 [ 20.323957] rcu_core_si+0x18/0x30 [ 20.324316] handle_softirqs+0x374/0xb28 [ 20.324723] __do_softirq+0x1c/0x28 [ 20.325088] [ 20.325257] Last potentially related work creation: [ 20.325728] kasan_save_stack+0x3c/0x68 [ 20.326127] kasan_record_aux_stack+0xb4/0xc8 [ 20.326577] __call_rcu_common.constprop.0+0x70/0x8b0 [ 20.327086] call_rcu+0x18/0x30 [ 20.327419] rcu_uaf+0x14c/0x2d8 [ 20.327771] kunit_try_run_case+0x170/0x3f0 [ 20.328208] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.328765] kthread+0x328/0x630 [ 20.329117] ret_from_fork+0x10/0x20 [ 20.329496] [ 20.329664] The buggy address belongs to the object at ffff00000a7c1fc0 [ 20.329664] which belongs to the cache kmalloc-32 of size 32 [ 20.330816] The buggy address is located 0 bytes inside of [ 20.330816] freed 32-byte region [ffff00000a7c1fc0, ffff00000a7c1fe0) [ 20.331942] [ 20.332112] The buggy address belongs to the physical page: [ 20.332649] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa7c1 [ 20.333405] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff) [ 20.334047] page_type: f5(slab) [ 20.334388] raw: 03fffe0000000000 ffff000000402780 dead000000000122 0000000000000000 [ 20.335135] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 20.335871] page dumped because: kasan: bad access detected [ 20.336409] [ 20.336576] Memory state around the buggy address: [ 20.337047] ffff00000a7c1e80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 20.337743] ffff00000a7c1f00: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 20.338437] >ffff00000a7c1f80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 20.339125] ^ [ 20.339645] ffff00000a7c2000: fa fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 20.340340] ffff00000a7c2080: fa fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 20.341026] ==================================================================