Date
Nov. 22, 2024, 6:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 36.408197] ================================================================== [ 36.410607] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 36.411662] Read of size 1 at addr fff00000c6ad9240 by task kunit_try_catch/220 [ 36.412832] [ 36.413276] CPU: 0 UID: 0 PID: 220 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241122 #1 [ 36.414714] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.415351] Hardware name: linux,dummy-virt (DT) [ 36.416123] Call trace: [ 36.416578] show_stack+0x20/0x38 (C) [ 36.417868] dump_stack_lvl+0x8c/0xd0 [ 36.418580] print_report+0x118/0x5e0 [ 36.419179] kasan_report+0xc8/0x118 [ 36.419856] __asan_report_load1_noabort+0x20/0x30 [ 36.420642] mempool_uaf_helper+0x314/0x340 [ 36.421502] mempool_slab_uaf+0xb8/0x110 [ 36.422048] kunit_try_run_case+0x14c/0x3d0 [ 36.422665] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.423531] kthread+0x24c/0x2d0 [ 36.424105] ret_from_fork+0x10/0x20 [ 36.425087] [ 36.425674] Allocated by task 220: [ 36.426283] kasan_save_stack+0x3c/0x68 [ 36.426908] kasan_save_track+0x20/0x40 [ 36.427625] kasan_save_alloc_info+0x40/0x58 [ 36.428285] __kasan_mempool_unpoison_object+0xbc/0x180 [ 36.429368] remove_element+0x16c/0x1f8 [ 36.430665] mempool_alloc_preallocated+0x58/0xc0 [ 36.431596] mempool_uaf_helper+0xa4/0x340 [ 36.432165] mempool_slab_uaf+0xb8/0x110 [ 36.433495] kunit_try_run_case+0x14c/0x3d0 [ 36.434136] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.434924] kthread+0x24c/0x2d0 [ 36.435753] ret_from_fork+0x10/0x20 [ 36.436574] [ 36.437346] Freed by task 220: [ 36.438097] kasan_save_stack+0x3c/0x68 [ 36.438754] kasan_save_track+0x20/0x40 [ 36.439619] kasan_save_free_info+0x4c/0x78 [ 36.440331] __kasan_mempool_poison_object+0xc0/0x150 [ 36.441383] mempool_free+0x28c/0x328 [ 36.441945] mempool_uaf_helper+0x104/0x340 [ 36.443013] mempool_slab_uaf+0xb8/0x110 [ 36.443627] kunit_try_run_case+0x14c/0x3d0 [ 36.444310] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.445421] kthread+0x24c/0x2d0 [ 36.445927] ret_from_fork+0x10/0x20 [ 36.446457] [ 36.446773] The buggy address belongs to the object at fff00000c6ad9240 [ 36.446773] which belongs to the cache test_cache of size 123 [ 36.448377] The buggy address is located 0 bytes inside of [ 36.448377] freed 123-byte region [fff00000c6ad9240, fff00000c6ad92bb) [ 36.450596] [ 36.450897] The buggy address belongs to the physical page: [ 36.451781] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106ad9 [ 36.453123] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 36.454374] page_type: f5(slab) [ 36.455073] raw: 0bfffe0000000000 fff00000c408cb40 dead000000000122 0000000000000000 [ 36.456566] raw: 0000000000000000 0000000080150015 00000001f5000000 0000000000000000 [ 36.458242] page dumped because: kasan: bad access detected [ 36.459006] [ 36.459677] Memory state around the buggy address: [ 36.460247] fff00000c6ad9100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 36.461709] fff00000c6ad9180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.463199] >fff00000c6ad9200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 36.464047] ^ [ 36.465398] fff00000c6ad9280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 36.466423] fff00000c6ad9300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.467544] ================================================================== [ 36.270239] ================================================================== [ 36.271752] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 36.273605] Read of size 1 at addr fff00000c6a52100 by task kunit_try_catch/216 [ 36.274932] [ 36.275313] CPU: 1 UID: 0 PID: 216 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241122 #1 [ 36.276815] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.277462] Hardware name: linux,dummy-virt (DT) [ 36.278165] Call trace: [ 36.278802] show_stack+0x20/0x38 (C) [ 36.279524] dump_stack_lvl+0x8c/0xd0 [ 36.280370] print_report+0x118/0x5e0 [ 36.281382] kasan_report+0xc8/0x118 [ 36.282282] __asan_report_load1_noabort+0x20/0x30 [ 36.282908] mempool_uaf_helper+0x314/0x340 [ 36.283630] mempool_kmalloc_uaf+0xbc/0x118 [ 36.284892] kunit_try_run_case+0x14c/0x3d0 [ 36.286501] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.287091] kthread+0x24c/0x2d0 [ 36.288278] ret_from_fork+0x10/0x20 [ 36.290117] [ 36.290867] Allocated by task 216: [ 36.292296] kasan_save_stack+0x3c/0x68 [ 36.293270] kasan_save_track+0x20/0x40 [ 36.296293] kasan_save_alloc_info+0x40/0x58 [ 36.297357] __kasan_mempool_unpoison_object+0x11c/0x180 [ 36.298188] remove_element+0x130/0x1f8 [ 36.299960] mempool_alloc_preallocated+0x58/0xc0 [ 36.301225] mempool_uaf_helper+0xa4/0x340 [ 36.302526] mempool_kmalloc_uaf+0xbc/0x118 [ 36.302982] kunit_try_run_case+0x14c/0x3d0 [ 36.304285] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.304979] kthread+0x24c/0x2d0 [ 36.306152] ret_from_fork+0x10/0x20 [ 36.307280] [ 36.308142] Freed by task 216: [ 36.309108] kasan_save_stack+0x3c/0x68 [ 36.310038] kasan_save_track+0x20/0x40 [ 36.311009] kasan_save_free_info+0x4c/0x78 [ 36.311933] __kasan_mempool_poison_object+0xc0/0x150 [ 36.312784] mempool_free+0x28c/0x328 [ 36.313870] mempool_uaf_helper+0x104/0x340 [ 36.314701] mempool_kmalloc_uaf+0xbc/0x118 [ 36.315403] kunit_try_run_case+0x14c/0x3d0 [ 36.316092] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.316977] kthread+0x24c/0x2d0 [ 36.317984] ret_from_fork+0x10/0x20 [ 36.319139] [ 36.319484] The buggy address belongs to the object at fff00000c6a52100 [ 36.319484] which belongs to the cache kmalloc-128 of size 128 [ 36.321074] The buggy address is located 0 bytes inside of [ 36.321074] freed 128-byte region [fff00000c6a52100, fff00000c6a52180) [ 36.322402] [ 36.323065] The buggy address belongs to the physical page: [ 36.324249] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106a52 [ 36.325429] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 36.326533] page_type: f5(slab) [ 36.327094] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 36.328132] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 36.329151] page dumped because: kasan: bad access detected [ 36.330324] [ 36.330613] Memory state around the buggy address: [ 36.331876] fff00000c6a52000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.333382] fff00000c6a52080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.334866] >fff00000c6a52100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.335892] ^ [ 36.336641] fff00000c6a52180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.337500] fff00000c6a52200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.338686] ==================================================================
[ 27.402761] ================================================================== [ 27.403608] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x394/0x400 [ 27.404236] Read of size 1 at addr ffff888102a1a240 by task kunit_try_catch/239 [ 27.404791] [ 27.405115] CPU: 1 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241122 #1 [ 27.405976] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.406496] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.407180] Call Trace: [ 27.408061] <TASK> [ 27.408344] dump_stack_lvl+0x73/0xb0 [ 27.408658] print_report+0xd1/0x640 [ 27.410576] ? __virt_addr_valid+0x1db/0x2d0 [ 27.411085] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.411491] kasan_report+0x102/0x140 [ 27.412110] ? mempool_uaf_helper+0x394/0x400 [ 27.413023] ? mempool_uaf_helper+0x394/0x400 [ 27.413559] __asan_report_load1_noabort+0x18/0x20 [ 27.414332] mempool_uaf_helper+0x394/0x400 [ 27.414848] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 27.415504] ? irqentry_exit+0x2a/0x60 [ 27.415873] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 27.416952] mempool_slab_uaf+0xae/0x100 [ 27.417310] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 27.418161] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 27.418854] ? __pfx_mempool_free_slab+0x10/0x10 [ 27.419608] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 27.420278] kunit_try_run_case+0x1b3/0x490 [ 27.421239] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.422027] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 27.422791] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.423256] ? __kthread_parkme+0x82/0x160 [ 27.424082] ? preempt_count_sub+0x50/0x80 [ 27.424746] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.425280] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.425966] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.427203] kthread+0x257/0x310 [ 27.427722] ? __pfx_kthread+0x10/0x10 [ 27.428707] ret_from_fork+0x41/0x80 [ 27.429570] ? __pfx_kthread+0x10/0x10 [ 27.429942] ret_from_fork_asm+0x1a/0x30 [ 27.430642] </TASK> [ 27.431271] [ 27.431667] Allocated by task 239: [ 27.431932] kasan_save_stack+0x3d/0x60 [ 27.432276] kasan_save_track+0x18/0x40 [ 27.432671] kasan_save_alloc_info+0x3b/0x50 [ 27.433423] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 27.434470] remove_element+0x11e/0x190 [ 27.434871] mempool_alloc_preallocated+0x4d/0x90 [ 27.435361] mempool_uaf_helper+0x97/0x400 [ 27.435747] mempool_slab_uaf+0xae/0x100 [ 27.436693] kunit_try_run_case+0x1b3/0x490 [ 27.437340] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.438182] kthread+0x257/0x310 [ 27.438508] ret_from_fork+0x41/0x80 [ 27.439428] ret_from_fork_asm+0x1a/0x30 [ 27.440110] [ 27.440265] Freed by task 239: [ 27.440523] kasan_save_stack+0x3d/0x60 [ 27.440999] kasan_save_track+0x18/0x40 [ 27.441388] kasan_save_free_info+0x3f/0x60 [ 27.441767] __kasan_mempool_poison_object+0x131/0x1d0 [ 27.442511] mempool_free+0x2ec/0x380 [ 27.443134] mempool_uaf_helper+0x11b/0x400 [ 27.444108] mempool_slab_uaf+0xae/0x100 [ 27.444995] kunit_try_run_case+0x1b3/0x490 [ 27.445511] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.446048] kthread+0x257/0x310 [ 27.446365] ret_from_fork+0x41/0x80 [ 27.446702] ret_from_fork_asm+0x1a/0x30 [ 27.448198] [ 27.448468] The buggy address belongs to the object at ffff888102a1a240 [ 27.448468] which belongs to the cache test_cache of size 123 [ 27.449790] The buggy address is located 0 bytes inside of [ 27.449790] freed 123-byte region [ffff888102a1a240, ffff888102a1a2bb) [ 27.451681] [ 27.452220] The buggy address belongs to the physical page: [ 27.452879] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a1a [ 27.454246] flags: 0x200000000000000(node=0|zone=2) [ 27.454738] page_type: f5(slab) [ 27.455067] raw: 0200000000000000 ffff888102a0e3c0 dead000000000122 0000000000000000 [ 27.456854] raw: 0000000000000000 0000000080150015 00000001f5000000 0000000000000000 [ 27.457703] page dumped because: kasan: bad access detected [ 27.459391] [ 27.459611] Memory state around the buggy address: [ 27.460099] ffff888102a1a100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 27.461022] ffff888102a1a180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.461687] >ffff888102a1a200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 27.462407] ^ [ 27.463660] ffff888102a1a280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 27.464284] ffff888102a1a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.464959] ================================================================== [ 27.292630] ================================================================== [ 27.293879] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x394/0x400 [ 27.294216] Read of size 1 at addr ffff888101ab3f00 by task kunit_try_catch/235 [ 27.295977] [ 27.296157] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241122 #1 [ 27.296920] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.297407] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.297957] Call Trace: [ 27.298250] <TASK> [ 27.299052] dump_stack_lvl+0x73/0xb0 [ 27.299373] print_report+0xd1/0x640 [ 27.299777] ? __virt_addr_valid+0x1db/0x2d0 [ 27.300263] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.301574] kasan_report+0x102/0x140 [ 27.301965] ? mempool_uaf_helper+0x394/0x400 [ 27.302802] ? mempool_uaf_helper+0x394/0x400 [ 27.303466] __asan_report_load1_noabort+0x18/0x20 [ 27.304145] mempool_uaf_helper+0x394/0x400 [ 27.304937] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 27.305439] ? update_load_avg+0x1c3/0x2110 [ 27.305771] ? update_curr+0x7d/0x5a0 [ 27.306202] ? update_curr+0x7d/0x5a0 [ 27.306637] ? finish_task_switch.isra.0+0x153/0x700 [ 27.307096] mempool_kmalloc_uaf+0xb3/0x100 [ 27.308114] ? __pfx_mempool_kmalloc_uaf+0x10/0x10 [ 27.308694] ? __switch_to+0x5d9/0xf60 [ 27.309195] ? __pfx_mempool_kmalloc+0x10/0x10 [ 27.309996] ? __pfx_mempool_kfree+0x10/0x10 [ 27.310294] ? __pfx_read_tsc+0x10/0x10 [ 27.310705] ? ktime_get_ts64+0x84/0x230 [ 27.311123] kunit_try_run_case+0x1b3/0x490 [ 27.311498] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.311992] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 27.312368] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.313331] ? __kthread_parkme+0x82/0x160 [ 27.313650] ? preempt_count_sub+0x50/0x80 [ 27.314120] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.315123] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.315680] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.316142] kthread+0x257/0x310 [ 27.317028] ? __pfx_kthread+0x10/0x10 [ 27.317421] ret_from_fork+0x41/0x80 [ 27.317778] ? __pfx_kthread+0x10/0x10 [ 27.318158] ret_from_fork_asm+0x1a/0x30 [ 27.319070] </TASK> [ 27.319664] [ 27.319899] Allocated by task 235: [ 27.320261] kasan_save_stack+0x3d/0x60 [ 27.320663] kasan_save_track+0x18/0x40 [ 27.321100] kasan_save_alloc_info+0x3b/0x50 [ 27.322178] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 27.322548] remove_element+0x11e/0x190 [ 27.322924] mempool_alloc_preallocated+0x4d/0x90 [ 27.323799] mempool_uaf_helper+0x97/0x400 [ 27.324603] mempool_kmalloc_uaf+0xb3/0x100 [ 27.325002] kunit_try_run_case+0x1b3/0x490 [ 27.325393] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.326021] kthread+0x257/0x310 [ 27.326275] ret_from_fork+0x41/0x80 [ 27.326671] ret_from_fork_asm+0x1a/0x30 [ 27.326979] [ 27.327197] Freed by task 235: [ 27.327685] kasan_save_stack+0x3d/0x60 [ 27.328090] kasan_save_track+0x18/0x40 [ 27.328508] kasan_save_free_info+0x3f/0x60 [ 27.329081] __kasan_mempool_poison_object+0x131/0x1d0 [ 27.329485] mempool_free+0x2ec/0x380 [ 27.331011] mempool_uaf_helper+0x11b/0x400 [ 27.331582] mempool_kmalloc_uaf+0xb3/0x100 [ 27.331916] kunit_try_run_case+0x1b3/0x490 [ 27.332370] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.332886] kthread+0x257/0x310 [ 27.333870] ret_from_fork+0x41/0x80 [ 27.334287] ret_from_fork_asm+0x1a/0x30 [ 27.335116] [ 27.335269] The buggy address belongs to the object at ffff888101ab3f00 [ 27.335269] which belongs to the cache kmalloc-128 of size 128 [ 27.336744] The buggy address is located 0 bytes inside of [ 27.336744] freed 128-byte region [ffff888101ab3f00, ffff888101ab3f80) [ 27.338129] [ 27.338317] The buggy address belongs to the physical page: [ 27.338781] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101ab3 [ 27.339208] flags: 0x200000000000000(node=0|zone=2) [ 27.339969] page_type: f5(slab) [ 27.340348] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 27.341047] raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 [ 27.341923] page dumped because: kasan: bad access detected [ 27.342693] [ 27.342902] Memory state around the buggy address: [ 27.343291] ffff888101ab3e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.344131] ffff888101ab3e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.344876] >ffff888101ab3f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.345912] ^ [ 27.346296] ffff888101ab3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.347495] ffff888101ab4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.348201] ==================================================================