Hay
Sign in
Date
Nov. 26, 2024, 6:09 a.m.

Environment
qemu-arm64
qemu-x86_64 

[   31.667652] ==================================================================
[   31.669577] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310
[   31.670805] Write of size 33 at addr fff00000c6499600 by task kunit_try_catch/175
[   31.671498] 
[   31.672089] CPU: 1 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241126 #1
[   31.673694] Tainted: [B]=BAD_PAGE, [N]=TEST
[   31.674251] Hardware name: linux,dummy-virt (DT)
[   31.674828] Call trace:
[   31.675194]  show_stack+0x20/0x38 (C)
[   31.675879]  dump_stack_lvl+0x8c/0xd0
[   31.676930]  print_report+0x118/0x5e0
[   31.677506]  kasan_report+0xc8/0x118
[   31.678068]  kasan_check_range+0x100/0x1a8
[   31.678656]  __asan_memset+0x34/0x78
[   31.679227]  kmalloc_uaf_memset+0x170/0x310
[   31.679785]  kunit_try_run_case+0x14c/0x3d0
[   31.680570]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   31.681405]  kthread+0x24c/0x2d0
[   31.682147]  ret_from_fork+0x10/0x20
[   31.682657] 
[   31.683035] Allocated by task 175:
[   31.683552]  kasan_save_stack+0x3c/0x68
[   31.684193]  kasan_save_track+0x20/0x40
[   31.685175]  kasan_save_alloc_info+0x40/0x58
[   31.685769]  __kasan_kmalloc+0xd4/0xd8
[   31.686362]  __kmalloc_cache_noprof+0x15c/0x3c8
[   31.687051]  kmalloc_uaf_memset+0xb8/0x310
[   31.687606]  kunit_try_run_case+0x14c/0x3d0
[   31.688133]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   31.689005]  kthread+0x24c/0x2d0
[   31.689926]  ret_from_fork+0x10/0x20
[   31.690716] 
[   31.691090] Freed by task 175:
[   31.691569]  kasan_save_stack+0x3c/0x68
[   31.692120]  kasan_save_track+0x20/0x40
[   31.693098]  kasan_save_free_info+0x4c/0x78
[   31.694146]  __kasan_slab_free+0x6c/0x98
[   31.694983]  kfree+0x114/0x3d0
[   31.695507]  kmalloc_uaf_memset+0x11c/0x310
[   31.696123]  kunit_try_run_case+0x14c/0x3d0
[   31.697085]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   31.697813]  kthread+0x24c/0x2d0
[   31.698382]  ret_from_fork+0x10/0x20
[   31.699030] 
[   31.699352] The buggy address belongs to the object at fff00000c6499600
[   31.699352]  which belongs to the cache kmalloc-64 of size 64
[   31.700841] The buggy address is located 0 bytes inside of
[   31.700841]  freed 64-byte region [fff00000c6499600, fff00000c6499640)
[   31.702244] 
[   31.702619] The buggy address belongs to the physical page:
[   31.703173] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106499
[   31.704112] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   31.704972] page_type: f5(slab)
[   31.705572] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   31.706519] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[   31.707532] page dumped because: kasan: bad access detected
[   31.708499] 
[   31.708897] Memory state around the buggy address:
[   31.709671]  fff00000c6499500: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[   31.710697]  fff00000c6499580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   31.711301] >fff00000c6499600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   31.712298]                    ^
[   31.712951]  fff00000c6499680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   31.713634]  fff00000c6499700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   31.714681] ==================================================================
Metadata Full log Test run details 

[   31.645390] ==================================================================
[   31.646477] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310
[   31.647473] Write of size 33 at addr fff00000c5e77200 by task kunit_try_catch/175
[   31.648474] 
[   31.649009] CPU: 0 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241126 #1
[   31.650182] Tainted: [B]=BAD_PAGE, [N]=TEST
[   31.651321] Hardware name: linux,dummy-virt (DT)
[   31.651957] Call trace:
[   31.652402]  show_stack+0x20/0x38 (C)
[   31.652995]  dump_stack_lvl+0x8c/0xd0
[   31.653613]  print_report+0x118/0x5e0
[   31.654628]  kasan_report+0xc8/0x118
[   31.655291]  kasan_check_range+0x100/0x1a8
[   31.656078]  __asan_memset+0x34/0x78
[   31.656812]  kmalloc_uaf_memset+0x170/0x310
[   31.657463]  kunit_try_run_case+0x14c/0x3d0
[   31.658416]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   31.659344]  kthread+0x24c/0x2d0
[   31.659911]  ret_from_fork+0x10/0x20
[   31.660554] 
[   31.660862] Allocated by task 175:
[   31.661463]  kasan_save_stack+0x3c/0x68
[   31.662521]  kasan_save_track+0x20/0x40
[   31.663413]  kasan_save_alloc_info+0x40/0x58
[   31.664149]  __kasan_kmalloc+0xd4/0xd8
[   31.664776]  __kmalloc_cache_noprof+0x15c/0x3c8
[   31.665458]  kmalloc_uaf_memset+0xb8/0x310
[   31.666338]  kunit_try_run_case+0x14c/0x3d0
[   31.667280]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   31.667938]  kthread+0x24c/0x2d0
[   31.668519]  ret_from_fork+0x10/0x20
[   31.669128] 
[   31.669452] Freed by task 175:
[   31.670429]  kasan_save_stack+0x3c/0x68
[   31.671071]  kasan_save_track+0x20/0x40
[   31.671600]  kasan_save_free_info+0x4c/0x78
[   31.672231]  __kasan_slab_free+0x6c/0x98
[   31.672866]  kfree+0x114/0x3d0
[   31.673416]  kmalloc_uaf_memset+0x11c/0x310
[   31.674246]  kunit_try_run_case+0x14c/0x3d0
[   31.674948]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   31.675934]  kthread+0x24c/0x2d0
[   31.676514]  ret_from_fork+0x10/0x20
[   31.677105] 
[   31.677456] The buggy address belongs to the object at fff00000c5e77200
[   31.677456]  which belongs to the cache kmalloc-64 of size 64
[   31.679268] The buggy address is located 0 bytes inside of
[   31.679268]  freed 64-byte region [fff00000c5e77200, fff00000c5e77240)
[   31.680424] 
[   31.680818] The buggy address belongs to the physical page:
[   31.681548] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105e77
[   31.682825] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   31.683704] page_type: f5(slab)
[   31.684223] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   31.685236] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[   31.686632] page dumped because: kasan: bad access detected
[   31.687276] 
[   31.687631] Memory state around the buggy address:
[   31.688197]  fff00000c5e77100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   31.689009]  fff00000c5e77180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   31.689936] >fff00000c5e77200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   31.690718]                    ^
[   31.691260]  fff00000c5e77280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   31.692557]  fff00000c5e77300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   31.693388] ==================================================================
Metadata Full log Test run details 

[   25.804383] ==================================================================
[   25.805030] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a4/0x360
[   25.805187] Write of size 33 at addr ffff88810293d000 by task kunit_try_catch/195
[   25.805187] 
[   25.805187] CPU: 1 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241126 #1
[   25.805187] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.805187] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   25.805187] Call Trace:
[   25.805187]  <TASK>
[   25.805187]  dump_stack_lvl+0x73/0xb0
[   25.805187]  print_report+0xd1/0x640
[   25.805187]  ? __virt_addr_valid+0x1db/0x2d0
[   25.805187]  ? kasan_complete_mode_report_info+0x64/0x200
[   25.805187]  kasan_report+0x102/0x140
[   25.805187]  ? kmalloc_uaf_memset+0x1a4/0x360
[   25.805187]  ? kmalloc_uaf_memset+0x1a4/0x360
[   25.805187]  kasan_check_range+0x10c/0x1c0
[   25.805187]  __asan_memset+0x27/0x50
[   25.805187]  kmalloc_uaf_memset+0x1a4/0x360
[   25.805187]  ? __pfx_kmalloc_uaf_memset+0x10/0x10
[   25.805187]  ? __schedule+0xc3e/0x2790
[   25.805187]  ? ktime_get_ts64+0x84/0x230
[   25.805187]  kunit_try_run_case+0x1b3/0x490
[   25.805187]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.805187]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   25.805187]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   25.805187]  ? __kthread_parkme+0x82/0x160
[   25.805187]  ? preempt_count_sub+0x50/0x80
[   25.805187]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.805187]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   25.805187]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.805187]  kthread+0x257/0x310
[   25.805187]  ? __pfx_kthread+0x10/0x10
[   25.805187]  ret_from_fork+0x41/0x80
[   25.805187]  ? __pfx_kthread+0x10/0x10
[   25.805187]  ret_from_fork_asm+0x1a/0x30
[   25.805187]  </TASK>
[   25.805187] 
[   25.805187] Allocated by task 195:
[   25.805187]  kasan_save_stack+0x3d/0x60
[   25.805187]  kasan_save_track+0x18/0x40
[   25.805187]  kasan_save_alloc_info+0x3b/0x50
[   25.805187]  __kasan_kmalloc+0xb7/0xc0
[   25.805187]  __kmalloc_cache_noprof+0x184/0x410
[   25.805187]  kmalloc_uaf_memset+0xaa/0x360
[   25.805187]  kunit_try_run_case+0x1b3/0x490
[   25.805187]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.805187]  kthread+0x257/0x310
[   25.805187]  ret_from_fork+0x41/0x80
[   25.805187]  ret_from_fork_asm+0x1a/0x30
[   25.805187] 
[   25.805187] Freed by task 195:
[   25.805187]  kasan_save_stack+0x3d/0x60
[   25.805187]  kasan_save_track+0x18/0x40
[   25.805187]  kasan_save_free_info+0x3f/0x60
[   25.805187]  __kasan_slab_free+0x56/0x70
[   25.805187]  kfree+0x123/0x3f0
[   25.805187]  kmalloc_uaf_memset+0x12c/0x360
[   25.805187]  kunit_try_run_case+0x1b3/0x490
[   25.805187]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.805187]  kthread+0x257/0x310
[   25.805187]  ret_from_fork+0x41/0x80
[   25.805187]  ret_from_fork_asm+0x1a/0x30
[   25.805187] 
[   25.805187] The buggy address belongs to the object at ffff88810293d000
[   25.805187]  which belongs to the cache kmalloc-64 of size 64
[   25.805187] The buggy address is located 0 bytes inside of
[   25.805187]  freed 64-byte region [ffff88810293d000, ffff88810293d040)
[   25.805187] 
[   25.805187] The buggy address belongs to the physical page:
[   25.805187] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10293d
[   25.805187] flags: 0x200000000000000(node=0|zone=2)
[   25.805187] page_type: f5(slab)
[   25.805187] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   25.805187] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[   25.805187] page dumped because: kasan: bad access detected
[   25.805187] 
[   25.805187] Memory state around the buggy address:
[   25.805187]  ffff88810293cf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.805187]  ffff88810293cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.805187] >ffff88810293d000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.805187]                    ^
[   25.805187]  ffff88810293d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.805187]  ffff88810293d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.805187] ==================================================================
Metadata Full log Test run details 

[   20.830722] ==================================================================
[   20.831586] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a4/0x360
[   20.832183] Write of size 33 at addr ffff88810295cf00 by task kunit_try_catch/193
[   20.832856] 
[   20.833153] CPU: 1 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241126 #1
[   20.833799] Tainted: [B]=BAD_PAGE, [N]=TEST
[   20.834294] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   20.835082] Call Trace:
[   20.835293]  <TASK>
[   20.835769]  dump_stack_lvl+0x73/0xb0
[   20.836205]  print_report+0xd1/0x640
[   20.836595]  ? __virt_addr_valid+0x1db/0x2d0
[   20.837276]  ? kasan_complete_mode_report_info+0x64/0x200
[   20.837806]  kasan_report+0x102/0x140
[   20.838102]  ? kmalloc_uaf_memset+0x1a4/0x360
[   20.838459]  ? kmalloc_uaf_memset+0x1a4/0x360
[   20.839031]  kasan_check_range+0x10c/0x1c0
[   20.839676]  __asan_memset+0x27/0x50
[   20.840096]  kmalloc_uaf_memset+0x1a4/0x360
[   20.840656]  ? __pfx_kmalloc_uaf_memset+0x10/0x10
[   20.841071]  ? __schedule+0x1ba9/0x2790
[   20.841362]  ? __pfx_read_tsc+0x10/0x10
[   20.841697]  ? ktime_get_ts64+0x84/0x230
[   20.842198]  kunit_try_run_case+0x1b3/0x490
[   20.842752]  ? __pfx_kunit_try_run_case+0x10/0x10
[   20.843247]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   20.843818]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   20.844323]  ? __kthread_parkme+0x82/0x160
[   20.844846]  ? preempt_count_sub+0x50/0x80
[   20.845169]  ? __pfx_kunit_try_run_case+0x10/0x10
[   20.845504]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   20.846168]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   20.846797]  kthread+0x257/0x310
[   20.847062]  ? __pfx_kthread+0x10/0x10
[   20.847370]  ret_from_fork+0x41/0x80
[   20.847966]  ? __pfx_kthread+0x10/0x10
[   20.848913]  ret_from_fork_asm+0x1a/0x30
[   20.849380]  </TASK>
[   20.850254] 
[   20.850482] Allocated by task 193:
[   20.850878]  kasan_save_stack+0x3d/0x60
[   20.851301]  kasan_save_track+0x18/0x40
[   20.851806]  kasan_save_alloc_info+0x3b/0x50
[   20.852155]  __kasan_kmalloc+0xb7/0xc0
[   20.852657]  __kmalloc_cache_noprof+0x184/0x410
[   20.853001]  kmalloc_uaf_memset+0xaa/0x360
[   20.853500]  kunit_try_run_case+0x1b3/0x490
[   20.853887]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   20.854225]  kthread+0x257/0x310
[   20.854656]  ret_from_fork+0x41/0x80
[   20.855099]  ret_from_fork_asm+0x1a/0x30
[   20.855552] 
[   20.855861] Freed by task 193:
[   20.856199]  kasan_save_stack+0x3d/0x60
[   20.856646]  kasan_save_track+0x18/0x40
[   20.856922]  kasan_save_free_info+0x3f/0x60
[   20.857239]  __kasan_slab_free+0x56/0x70
[   20.857744]  kfree+0x123/0x3f0
[   20.858150]  kmalloc_uaf_memset+0x12c/0x360
[   20.858648]  kunit_try_run_case+0x1b3/0x490
[   20.859134]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   20.859725]  kthread+0x257/0x310
[   20.859990]  ret_from_fork+0x41/0x80
[   20.860257]  ret_from_fork_asm+0x1a/0x30
[   20.860542] 
[   20.860827] The buggy address belongs to the object at ffff88810295cf00
[   20.860827]  which belongs to the cache kmalloc-64 of size 64
[   20.861951] The buggy address is located 0 bytes inside of
[   20.861951]  freed 64-byte region [ffff88810295cf00, ffff88810295cf40)
[   20.862908] 
[   20.863147] The buggy address belongs to the physical page:
[   20.863546] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10295c
[   20.864001] flags: 0x200000000000000(node=0|zone=2)
[   20.864298] page_type: f5(slab)
[   20.864724] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   20.865424] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[   20.866205] page dumped because: kasan: bad access detected
[   20.866808] 
[   20.867034] Memory state around the buggy address:
[   20.867427]  ffff88810295ce00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   20.868000]  ffff88810295ce80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   20.868469] >ffff88810295cf00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   20.869078]                    ^
[   20.869501]  ffff88810295cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.870064]  ffff88810295d000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.870428] ==================================================================
Metadata Full log Test run details