Hay
Sign in
Date
Nov. 26, 2024, 6:09 a.m.

Environment
qemu-arm64
qemu-x86_64 

[   30.287036] ==================================================================
[   30.288144] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   30.289023] Read of size 1 at addr fff00000c6464000 by task kunit_try_catch/137
[   30.290165] 
[   30.290963] CPU: 1 UID: 0 PID: 137 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241126 #1
[   30.292742] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.293412] Hardware name: linux,dummy-virt (DT)
[   30.294014] Call trace:
[   30.294510]  show_stack+0x20/0x38 (C)
[   30.295201]  dump_stack_lvl+0x8c/0xd0
[   30.295879]  print_report+0x118/0x5e0
[   30.296833]  kasan_report+0xc8/0x118
[   30.297482]  __asan_report_load1_noabort+0x20/0x30
[   30.298093]  kmalloc_large_uaf+0x2cc/0x2f8
[   30.298645]  kunit_try_run_case+0x14c/0x3d0
[   30.299820]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.300790]  kthread+0x24c/0x2d0
[   30.301558]  ret_from_fork+0x10/0x20
[   30.302255] 
[   30.302682] The buggy address belongs to the physical page:
[   30.303609] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106464
[   30.305169] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.306117] raw: 0bfffe0000000000 ffffc1ffc3191a08 fff00000da506f80 0000000000000000
[   30.307042] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   30.307921] page dumped because: kasan: bad access detected
[   30.308687] 
[   30.309042] Memory state around the buggy address:
[   30.309809]  fff00000c6463f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.310777]  fff00000c6463f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.311690] >fff00000c6464000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.312875]                    ^
[   30.314166]  fff00000c6464080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.314926]  fff00000c6464100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.315713] ==================================================================
Metadata Full log Test run details 

[   30.234891] ==================================================================
[   30.236195] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   30.237086] Read of size 1 at addr fff00000c64b4000 by task kunit_try_catch/137
[   30.238583] 
[   30.239013] CPU: 0 UID: 0 PID: 137 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241126 #1
[   30.240111] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.240732] Hardware name: linux,dummy-virt (DT)
[   30.242180] Call trace:
[   30.242885]  show_stack+0x20/0x38 (C)
[   30.243632]  dump_stack_lvl+0x8c/0xd0
[   30.244329]  print_report+0x118/0x5e0
[   30.245040]  kasan_report+0xc8/0x118
[   30.245715]  __asan_report_load1_noabort+0x20/0x30
[   30.246484]  kmalloc_large_uaf+0x2cc/0x2f8
[   30.247903]  kunit_try_run_case+0x14c/0x3d0
[   30.248506]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.249339]  kthread+0x24c/0x2d0
[   30.250103]  ret_from_fork+0x10/0x20
[   30.251134] 
[   30.251549] The buggy address belongs to the physical page:
[   30.252165] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064b4
[   30.253227] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.254806] raw: 0bfffe0000000000 ffffc1ffc3192e08 fff00000da4e4f80 0000000000000000
[   30.255784] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   30.256955] page dumped because: kasan: bad access detected
[   30.257876] 
[   30.258287] Memory state around the buggy address:
[   30.259339]  fff00000c64b3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.260328]  fff00000c64b3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.261367] >fff00000c64b4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.262409]                    ^
[   30.263725]  fff00000c64b4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.264602]  fff00000c64b4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.265481] ==================================================================
Metadata Full log Test run details 

[   24.256441] ==================================================================
[   24.257211] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f3/0x340
[   24.258035] Read of size 1 at addr ffff888102b80000 by task kunit_try_catch/155
[   24.258731] 
[   24.259026] CPU: 0 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241126 #1
[   24.259908] Tainted: [B]=BAD_PAGE, [N]=TEST
[   24.261194] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   24.262628] Call Trace:
[   24.263057]  <TASK>
[   24.263471]  dump_stack_lvl+0x73/0xb0
[   24.264378]  print_report+0xd1/0x640
[   24.265032]  ? __virt_addr_valid+0x1db/0x2d0
[   24.265555]  ? kasan_addr_to_slab+0x11/0xa0
[   24.266719]  kasan_report+0x102/0x140
[   24.267094]  ? kmalloc_large_uaf+0x2f3/0x340
[   24.267486]  ? kmalloc_large_uaf+0x2f3/0x340
[   24.268162]  __asan_report_load1_noabort+0x18/0x20
[   24.268670]  kmalloc_large_uaf+0x2f3/0x340
[   24.269666]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   24.269978]  ? __schedule+0xc3e/0x2790
[   24.270637]  ? __pfx_read_tsc+0x10/0x10
[   24.271154]  ? ktime_get_ts64+0x84/0x230
[   24.271587]  kunit_try_run_case+0x1b3/0x490
[   24.272639]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.273791]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   24.274171]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   24.274946]  ? __kthread_parkme+0x82/0x160
[   24.275579]  ? preempt_count_sub+0x50/0x80
[   24.276186]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.276627]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   24.277517]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.278303]  kthread+0x257/0x310
[   24.278810]  ? __pfx_kthread+0x10/0x10
[   24.279411]  ret_from_fork+0x41/0x80
[   24.279916]  ? __pfx_kthread+0x10/0x10
[   24.280487]  ret_from_fork_asm+0x1a/0x30
[   24.281006]  </TASK>
[   24.281417] 
[   24.281682] The buggy address belongs to the physical page:
[   24.282324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b80
[   24.283159] flags: 0x200000000000000(node=0|zone=2)
[   24.283634] raw: 0200000000000000 ffffea00040ae108 ffff88815b03f000 0000000000000000
[   24.284512] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   24.285187] page dumped because: kasan: bad access detected
[   24.285409] 
[   24.285493] Memory state around the buggy address:
[   24.285653]  ffff888102b7ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.286000]  ffff888102b7ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.286574] >ffff888102b80000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.287892]                    ^
[   24.288545]  ffff888102b80080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.289454]  ffff888102b80100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.290287] ==================================================================
Metadata Full log Test run details 

[   19.456819] ==================================================================
[   19.457928] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f3/0x340
[   19.458527] Read of size 1 at addr ffff888102abc000 by task kunit_try_catch/155
[   19.459094] 
[   19.459315] CPU: 0 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241126 #1
[   19.460224] Tainted: [B]=BAD_PAGE, [N]=TEST
[   19.460731] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   19.461744] Call Trace:
[   19.462518]  <TASK>
[   19.462841]  dump_stack_lvl+0x73/0xb0
[   19.463449]  print_report+0xd1/0x640
[   19.464086]  ? __virt_addr_valid+0x1db/0x2d0
[   19.464671]  ? kasan_addr_to_slab+0x11/0xa0
[   19.465334]  kasan_report+0x102/0x140
[   19.465710]  ? kmalloc_large_uaf+0x2f3/0x340
[   19.466369]  ? kmalloc_large_uaf+0x2f3/0x340
[   19.466968]  __asan_report_load1_noabort+0x18/0x20
[   19.467913]  kmalloc_large_uaf+0x2f3/0x340
[   19.468398]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   19.468715]  ? __schedule+0xc3e/0x2790
[   19.468996]  ? __pfx_read_tsc+0x10/0x10
[   19.469547]  ? ktime_get_ts64+0x84/0x230
[   19.470456]  kunit_try_run_case+0x1b3/0x490
[   19.471008]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.471769]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   19.472357]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   19.472927]  ? __kthread_parkme+0x82/0x160
[   19.473278]  ? preempt_count_sub+0x50/0x80
[   19.474219]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.475327]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   19.475727]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.476460]  kthread+0x257/0x310
[   19.477101]  ? __pfx_kthread+0x10/0x10
[   19.477425]  ret_from_fork+0x41/0x80
[   19.477913]  ? __pfx_kthread+0x10/0x10
[   19.478675]  ret_from_fork_asm+0x1a/0x30
[   19.479063]  </TASK>
[   19.479480] 
[   19.479791] The buggy address belongs to the physical page:
[   19.480512] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102abc
[   19.481441] flags: 0x200000000000000(node=0|zone=2)
[   19.481920] raw: 0200000000000000 ffffea00040ab008 ffff888154a3f000 0000000000000000
[   19.482676] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   19.483130] page dumped because: kasan: bad access detected
[   19.484215] 
[   19.484436] Memory state around the buggy address:
[   19.484885]  ffff888102abbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.485535]  ffff888102abbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.486290] >ffff888102abc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   19.486931]                    ^
[   19.487445]  ffff888102abc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   19.488417]  ffff888102abc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   19.489073] ==================================================================
Metadata Full log Test run details