Date
Nov. 26, 2024, 6:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.390176] ================================================================== [ 34.391939] BUG: KASAN: slab-use-after-free in strrchr+0x6c/0x78 [ 34.393866] Read of size 1 at addr fff00000c58bc8d0 by task kunit_try_catch/248 [ 34.394676] [ 34.395142] CPU: 1 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241126 #1 [ 34.396761] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.397859] Hardware name: linux,dummy-virt (DT) [ 34.398564] Call trace: [ 34.399111] show_stack+0x20/0x38 (C) [ 34.399755] dump_stack_lvl+0x8c/0xd0 [ 34.400320] print_report+0x118/0x5e0 [ 34.400615] kasan_report+0xc8/0x118 [ 34.400877] __asan_report_load1_noabort+0x20/0x30 [ 34.401575] strrchr+0x6c/0x78 [ 34.402128] kasan_strings+0x1e0/0x8f8 [ 34.402824] kunit_try_run_case+0x14c/0x3d0 [ 34.403462] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.404293] kthread+0x24c/0x2d0 [ 34.404828] ret_from_fork+0x10/0x20 [ 34.405365] [ 34.405669] Allocated by task 248: [ 34.406237] kasan_save_stack+0x3c/0x68 [ 34.406882] kasan_save_track+0x20/0x40 [ 34.407526] kasan_save_alloc_info+0x40/0x58 [ 34.408203] __kasan_kmalloc+0xd4/0xd8 [ 34.408677] __kmalloc_cache_noprof+0x15c/0x3c8 [ 34.409379] kasan_strings+0xb4/0x8f8 [ 34.410005] kunit_try_run_case+0x14c/0x3d0 [ 34.410544] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.411337] kthread+0x24c/0x2d0 [ 34.411933] ret_from_fork+0x10/0x20 [ 34.412475] [ 34.412871] Freed by task 248: [ 34.413282] kasan_save_stack+0x3c/0x68 [ 34.414283] kasan_save_track+0x20/0x40 [ 34.414964] kasan_save_free_info+0x4c/0x78 [ 34.415612] __kasan_slab_free+0x6c/0x98 [ 34.416271] kfree+0x114/0x3d0 [ 34.416895] kasan_strings+0x128/0x8f8 [ 34.417499] kunit_try_run_case+0x14c/0x3d0 [ 34.418224] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.419004] kthread+0x24c/0x2d0 [ 34.419527] ret_from_fork+0x10/0x20 [ 34.420101] [ 34.420412] The buggy address belongs to the object at fff00000c58bc8c0 [ 34.420412] which belongs to the cache kmalloc-32 of size 32 [ 34.421775] The buggy address is located 16 bytes inside of [ 34.421775] freed 32-byte region [fff00000c58bc8c0, fff00000c58bc8e0) [ 34.422982] [ 34.423355] The buggy address belongs to the physical page: [ 34.424118] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1058bc [ 34.424880] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.425733] page_type: f5(slab) [ 34.426259] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 34.427252] raw: 0000000000000000 0000000080400040 00000001f5000000 0000000000000000 [ 34.427929] page dumped because: kasan: bad access detected [ 34.428650] [ 34.429040] Memory state around the buggy address: [ 34.429663] fff00000c58bc780: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 34.430520] fff00000c58bc800: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 34.431338] >fff00000c58bc880: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 34.432083] ^ [ 34.432864] fff00000c58bc900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.433676] fff00000c58bc980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.434398] ==================================================================
[ 34.411563] ================================================================== [ 34.412320] BUG: KASAN: slab-use-after-free in strrchr+0x6c/0x78 [ 34.412997] Read of size 1 at addr fff00000c5ec1d10 by task kunit_try_catch/248 [ 34.413829] [ 34.414236] CPU: 0 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241126 #1 [ 34.415646] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.416148] Hardware name: linux,dummy-virt (DT) [ 34.416855] Call trace: [ 34.417284] show_stack+0x20/0x38 (C) [ 34.418227] dump_stack_lvl+0x8c/0xd0 [ 34.418894] print_report+0x118/0x5e0 [ 34.419428] kasan_report+0xc8/0x118 [ 34.420081] __asan_report_load1_noabort+0x20/0x30 [ 34.420789] strrchr+0x6c/0x78 [ 34.421365] kasan_strings+0x1e0/0x8f8 [ 34.422281] kunit_try_run_case+0x14c/0x3d0 [ 34.422917] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.423556] kthread+0x24c/0x2d0 [ 34.424150] ret_from_fork+0x10/0x20 [ 34.424809] [ 34.425165] Allocated by task 248: [ 34.426045] kasan_save_stack+0x3c/0x68 [ 34.426627] kasan_save_track+0x20/0x40 [ 34.427268] kasan_save_alloc_info+0x40/0x58 [ 34.427976] __kasan_kmalloc+0xd4/0xd8 [ 34.428601] __kmalloc_cache_noprof+0x15c/0x3c8 [ 34.429246] kasan_strings+0xb4/0x8f8 [ 34.430102] kunit_try_run_case+0x14c/0x3d0 [ 34.430752] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.432455] kthread+0x24c/0x2d0 [ 34.433028] ret_from_fork+0x10/0x20 [ 34.433625] [ 34.434201] Freed by task 248: [ 34.434745] kasan_save_stack+0x3c/0x68 [ 34.435269] kasan_save_track+0x20/0x40 [ 34.436026] kasan_save_free_info+0x4c/0x78 [ 34.436658] __kasan_slab_free+0x6c/0x98 [ 34.437300] kfree+0x114/0x3d0 [ 34.438269] kasan_strings+0x128/0x8f8 [ 34.438778] kunit_try_run_case+0x14c/0x3d0 [ 34.439480] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.440151] kthread+0x24c/0x2d0 [ 34.440725] ret_from_fork+0x10/0x20 [ 34.441253] [ 34.441645] The buggy address belongs to the object at fff00000c5ec1d00 [ 34.441645] which belongs to the cache kmalloc-32 of size 32 [ 34.443137] The buggy address is located 16 bytes inside of [ 34.443137] freed 32-byte region [fff00000c5ec1d00, fff00000c5ec1d20) [ 34.444401] [ 34.444799] The buggy address belongs to the physical page: [ 34.445508] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105ec1 [ 34.446907] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.447727] page_type: f5(slab) [ 34.448310] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 34.449180] raw: 0000000000000000 0000000080400040 00000001f5000000 0000000000000000 [ 34.450383] page dumped because: kasan: bad access detected [ 34.451000] [ 34.451374] Memory state around the buggy address: [ 34.452083] fff00000c5ec1c00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 34.453395] fff00000c5ec1c80: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 34.454348] >fff00000c5ec1d00: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 34.455234] ^ [ 34.456038] fff00000c5ec1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.456923] fff00000c5ec1e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.458052] ==================================================================
[ 28.578564] ================================================================== [ 28.579149] BUG: KASAN: slab-use-after-free in strrchr+0x64/0x70 [ 28.579149] Read of size 1 at addr ffff88810294c410 by task kunit_try_catch/268 [ 28.579149] [ 28.579149] CPU: 1 UID: 0 PID: 268 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241126 #1 [ 28.579149] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.579149] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 28.579149] Call Trace: [ 28.579149] <TASK> [ 28.579149] dump_stack_lvl+0x73/0xb0 [ 28.579149] print_report+0xd1/0x640 [ 28.579149] ? __virt_addr_valid+0x1db/0x2d0 [ 28.579149] ? kasan_complete_mode_report_info+0x64/0x200 [ 28.579149] kasan_report+0x102/0x140 [ 28.579149] ? strrchr+0x64/0x70 [ 28.579149] ? strrchr+0x64/0x70 [ 28.579149] __asan_report_load1_noabort+0x18/0x20 [ 28.579149] strrchr+0x64/0x70 [ 28.579149] kasan_strings+0x24c/0xb60 [ 28.579149] ? __pfx_kasan_strings+0x10/0x10 [ 28.579149] ? __schedule+0xc3e/0x2790 [ 28.579149] ? ktime_get_ts64+0x84/0x230 [ 28.579149] kunit_try_run_case+0x1b3/0x490 [ 28.579149] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.579149] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 28.579149] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.579149] ? __kthread_parkme+0x82/0x160 [ 28.579149] ? preempt_count_sub+0x50/0x80 [ 28.579149] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.579149] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.579149] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.579149] kthread+0x257/0x310 [ 28.579149] ? __pfx_kthread+0x10/0x10 [ 28.579149] ret_from_fork+0x41/0x80 [ 28.579149] ? __pfx_kthread+0x10/0x10 [ 28.579149] ret_from_fork_asm+0x1a/0x30 [ 28.579149] </TASK> [ 28.579149] [ 28.579149] Allocated by task 268: [ 28.579149] kasan_save_stack+0x3d/0x60 [ 28.579149] kasan_save_track+0x18/0x40 [ 28.579149] kasan_save_alloc_info+0x3b/0x50 [ 28.579149] __kasan_kmalloc+0xb7/0xc0 [ 28.579149] __kmalloc_cache_noprof+0x184/0x410 [ 28.579149] kasan_strings+0xb3/0xb60 [ 28.579149] kunit_try_run_case+0x1b3/0x490 [ 28.579149] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.579149] kthread+0x257/0x310 [ 28.579149] ret_from_fork+0x41/0x80 [ 28.579149] ret_from_fork_asm+0x1a/0x30 [ 28.579149] [ 28.579149] Freed by task 268: [ 28.579149] kasan_save_stack+0x3d/0x60 [ 28.579149] kasan_save_track+0x18/0x40 [ 28.579149] kasan_save_free_info+0x3f/0x60 [ 28.579149] __kasan_slab_free+0x56/0x70 [ 28.579149] kfree+0x123/0x3f0 [ 28.579149] kasan_strings+0x13a/0xb60 [ 28.579149] kunit_try_run_case+0x1b3/0x490 [ 28.579149] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.579149] kthread+0x257/0x310 [ 28.579149] ret_from_fork+0x41/0x80 [ 28.579149] ret_from_fork_asm+0x1a/0x30 [ 28.579149] [ 28.579149] The buggy address belongs to the object at ffff88810294c400 [ 28.579149] which belongs to the cache kmalloc-32 of size 32 [ 28.579149] The buggy address is located 16 bytes inside of [ 28.579149] freed 32-byte region [ffff88810294c400, ffff88810294c420) [ 28.579149] [ 28.579149] The buggy address belongs to the physical page: [ 28.579149] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10294c [ 28.579149] flags: 0x200000000000000(node=0|zone=2) [ 28.579149] page_type: f5(slab) [ 28.579149] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 28.579149] raw: 0000000000000000 0000000080400040 00000001f5000000 0000000000000000 [ 28.579149] page dumped because: kasan: bad access detected [ 28.579149] [ 28.579149] Memory state around the buggy address: [ 28.579149] ffff88810294c300: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 28.579149] ffff88810294c380: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 28.579149] >ffff88810294c400: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 28.579149] ^ [ 28.579149] ffff88810294c480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.579149] ffff88810294c500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.579149] ==================================================================
[ 23.472356] ================================================================== [ 23.473832] BUG: KASAN: slab-use-after-free in strrchr+0x64/0x70 [ 23.474369] Read of size 1 at addr ffff8881028c9250 by task kunit_try_catch/266 [ 23.475039] [ 23.475338] CPU: 0 UID: 0 PID: 266 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241126 #1 [ 23.476331] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.476872] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.477426] Call Trace: [ 23.477763] <TASK> [ 23.478442] dump_stack_lvl+0x73/0xb0 [ 23.479256] print_report+0xd1/0x640 [ 23.479596] ? __virt_addr_valid+0x1db/0x2d0 [ 23.479910] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.480317] kasan_report+0x102/0x140 [ 23.480864] ? strrchr+0x64/0x70 [ 23.481162] ? strrchr+0x64/0x70 [ 23.481499] __asan_report_load1_noabort+0x18/0x20 [ 23.482096] strrchr+0x64/0x70 [ 23.482547] kasan_strings+0x24c/0xb60 [ 23.483029] ? __pfx_kasan_strings+0x10/0x10 [ 23.483338] ? __schedule+0xc3e/0x2790 [ 23.483863] ? __pfx_read_tsc+0x10/0x10 [ 23.484285] ? ktime_get_ts64+0x84/0x230 [ 23.484819] kunit_try_run_case+0x1b3/0x490 [ 23.485243] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.485633] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 23.486164] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.486825] ? __kthread_parkme+0x82/0x160 [ 23.487347] ? preempt_count_sub+0x50/0x80 [ 23.487872] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.488404] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.488865] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.489472] kthread+0x257/0x310 [ 23.489934] ? __pfx_kthread+0x10/0x10 [ 23.490278] ret_from_fork+0x41/0x80 [ 23.490625] ? __pfx_kthread+0x10/0x10 [ 23.490977] ret_from_fork_asm+0x1a/0x30 [ 23.491512] </TASK> [ 23.491841] [ 23.492064] Allocated by task 266: [ 23.492427] kasan_save_stack+0x3d/0x60 [ 23.492947] kasan_save_track+0x18/0x40 [ 23.493312] kasan_save_alloc_info+0x3b/0x50 [ 23.493875] __kasan_kmalloc+0xb7/0xc0 [ 23.494219] __kmalloc_cache_noprof+0x184/0x410 [ 23.494556] kasan_strings+0xb3/0xb60 [ 23.495030] kunit_try_run_case+0x1b3/0x490 [ 23.495720] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.496335] kthread+0x257/0x310 [ 23.496830] ret_from_fork+0x41/0x80 [ 23.497304] ret_from_fork_asm+0x1a/0x30 [ 23.497850] [ 23.498144] Freed by task 266: [ 23.498569] kasan_save_stack+0x3d/0x60 [ 23.499046] kasan_save_track+0x18/0x40 [ 23.499320] kasan_save_free_info+0x3f/0x60 [ 23.499736] __kasan_slab_free+0x56/0x70 [ 23.500093] kfree+0x123/0x3f0 [ 23.500412] kasan_strings+0x13a/0xb60 [ 23.500794] kunit_try_run_case+0x1b3/0x490 [ 23.501090] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.501665] kthread+0x257/0x310 [ 23.502050] ret_from_fork+0x41/0x80 [ 23.502454] ret_from_fork_asm+0x1a/0x30 [ 23.502929] [ 23.503122] The buggy address belongs to the object at ffff8881028c9240 [ 23.503122] which belongs to the cache kmalloc-32 of size 32 [ 23.503931] The buggy address is located 16 bytes inside of [ 23.503931] freed 32-byte region [ffff8881028c9240, ffff8881028c9260) [ 23.504894] [ 23.505076] The buggy address belongs to the physical page: [ 23.505427] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1028c9 [ 23.506159] flags: 0x200000000000000(node=0|zone=2) [ 23.506684] page_type: f5(slab) [ 23.506930] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 23.507322] raw: 0000000000000000 0000000080400040 00000001f5000000 0000000000000000 [ 23.507952] page dumped because: kasan: bad access detected [ 23.508471] [ 23.508760] Memory state around the buggy address: [ 23.510434] ffff8881028c9100: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 23.511108] ffff8881028c9180: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 23.511644] >ffff8881028c9200: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 23.512124] ^ [ 23.512753] ffff8881028c9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.513132] ffff8881028c9300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.513806] ==================================================================