Date
Nov. 28, 2024, 2:36 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 32.013788] ================================================================== [ 32.014685] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x17c/0x2f8 [ 32.015481] Read of size 1 at addr fff00000c5b7b500 by task kunit_try_catch/203 [ 32.016338] [ 32.016708] CPU: 1 UID: 0 PID: 203 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241128 #1 [ 32.018565] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.019093] Hardware name: linux,dummy-virt (DT) [ 32.019639] Call trace: [ 32.019989] show_stack+0x20/0x38 (C) [ 32.020563] dump_stack_lvl+0x8c/0xd0 [ 32.021535] print_report+0x118/0x5e0 [ 32.022405] kasan_report+0xc8/0x118 [ 32.022868] __kasan_check_byte+0x54/0x70 [ 32.023560] kmem_cache_destroy+0x34/0x218 [ 32.024161] kmem_cache_double_destroy+0x17c/0x2f8 [ 32.024834] kunit_try_run_case+0x14c/0x3d0 [ 32.025709] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.027092] kthread+0x24c/0x2d0 [ 32.027752] ret_from_fork+0x10/0x20 [ 32.028382] [ 32.028756] Allocated by task 203: [ 32.029293] kasan_save_stack+0x3c/0x68 [ 32.030224] kasan_save_track+0x20/0x40 [ 32.031197] kasan_save_alloc_info+0x40/0x58 [ 32.031910] __kasan_slab_alloc+0xa8/0xb0 [ 32.032655] kmem_cache_alloc_noprof+0x108/0x398 [ 32.034209] __kmem_cache_create_args+0x18c/0x2b0 [ 32.034809] kmem_cache_double_destroy+0xc8/0x2f8 [ 32.035416] kunit_try_run_case+0x14c/0x3d0 [ 32.035929] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.036645] kthread+0x24c/0x2d0 [ 32.037086] ret_from_fork+0x10/0x20 [ 32.038197] [ 32.038697] Freed by task 203: [ 32.039101] kasan_save_stack+0x3c/0x68 [ 32.039938] kasan_save_track+0x20/0x40 [ 32.040485] kasan_save_free_info+0x4c/0x78 [ 32.041660] __kasan_slab_free+0x6c/0x98 [ 32.042632] kmem_cache_free+0x118/0x470 [ 32.043238] slab_kmem_cache_release+0x38/0x50 [ 32.043760] kmem_cache_release+0x1c/0x30 [ 32.044427] kobject_put+0x17c/0x430 [ 32.045717] sysfs_slab_release+0x1c/0x30 [ 32.046319] kmem_cache_destroy+0x118/0x218 [ 32.046839] kmem_cache_double_destroy+0x130/0x2f8 [ 32.047431] kunit_try_run_case+0x14c/0x3d0 [ 32.048019] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.048674] kthread+0x24c/0x2d0 [ 32.049481] ret_from_fork+0x10/0x20 [ 32.050015] [ 32.050339] The buggy address belongs to the object at fff00000c5b7b500 [ 32.050339] which belongs to the cache kmem_cache of size 208 [ 32.051858] The buggy address is located 0 bytes inside of [ 32.051858] freed 208-byte region [fff00000c5b7b500, fff00000c5b7b5d0) [ 32.053977] [ 32.054278] The buggy address belongs to the physical page: [ 32.055042] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b7b [ 32.055987] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.056890] page_type: f5(slab) [ 32.058092] raw: 0bfffe0000000000 fff00000c0001000 dead000000000122 0000000000000000 [ 32.059043] raw: 0000000000000000 00000000800c000c 00000001f5000000 0000000000000000 [ 32.059922] page dumped because: kasan: bad access detected [ 32.060555] [ 32.060847] Memory state around the buggy address: [ 32.061495] fff00000c5b7b400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.062155] fff00000c5b7b480: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.063016] >fff00000c5b7b500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.064234] ^ [ 32.064706] fff00000c5b7b580: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 32.066326] fff00000c5b7b600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.067075] ==================================================================
[ 22.881394] ================================================================== [ 22.882168] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x1bd/0x380 [ 22.883220] Read of size 1 at addr ffff888101af9a00 by task kunit_try_catch/223 [ 22.884387] [ 22.884841] CPU: 1 UID: 0 PID: 223 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241128 #1 [ 22.886707] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.887145] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.888161] Call Trace: [ 22.888473] <TASK> [ 22.888727] dump_stack_lvl+0x73/0xb0 [ 22.889227] print_report+0xd1/0x640 [ 22.889637] ? __virt_addr_valid+0x1db/0x2d0 [ 22.890502] ? kasan_complete_mode_report_info+0x64/0x200 [ 22.891109] kasan_report+0x102/0x140 [ 22.891515] ? kmem_cache_double_destroy+0x1bd/0x380 [ 22.891959] ? kmem_cache_double_destroy+0x1bd/0x380 [ 22.892895] ? kmem_cache_double_destroy+0x1bd/0x380 [ 22.893729] __kasan_check_byte+0x3d/0x50 [ 22.894181] kmem_cache_destroy+0x25/0x1d0 [ 22.894636] kmem_cache_double_destroy+0x1bd/0x380 [ 22.895303] ? __pfx_kmem_cache_double_destroy+0x10/0x10 [ 22.895846] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 22.896251] ? __pfx_empty_cache_ctor+0x10/0x10 [ 22.897072] ? __pfx_kmem_cache_double_destroy+0x10/0x10 [ 22.897705] kunit_try_run_case+0x1b3/0x490 [ 22.898258] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.898753] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 22.899984] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.900575] ? __kthread_parkme+0x82/0x160 [ 22.900917] ? preempt_count_sub+0x50/0x80 [ 22.901385] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.901953] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.902474] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.903237] kthread+0x257/0x310 [ 22.903531] ? __pfx_kthread+0x10/0x10 [ 22.903983] ret_from_fork+0x41/0x80 [ 22.904373] ? __pfx_kthread+0x10/0x10 [ 22.904716] ret_from_fork_asm+0x1a/0x30 [ 22.905883] </TASK> [ 22.906163] [ 22.906331] Allocated by task 223: [ 22.906791] kasan_save_stack+0x3d/0x60 [ 22.907425] kasan_save_track+0x18/0x40 [ 22.907829] kasan_save_alloc_info+0x3b/0x50 [ 22.908391] __kasan_slab_alloc+0x91/0xa0 [ 22.908854] kmem_cache_alloc_noprof+0x11e/0x3e0 [ 22.909219] __kmem_cache_create_args+0x177/0x250 [ 22.910597] kmem_cache_double_destroy+0xd3/0x380 [ 22.910895] kunit_try_run_case+0x1b3/0x490 [ 22.911577] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.912618] kthread+0x257/0x310 [ 22.913387] ret_from_fork+0x41/0x80 [ 22.913667] ret_from_fork_asm+0x1a/0x30 [ 22.914123] [ 22.914368] Freed by task 223: [ 22.915021] kasan_save_stack+0x3d/0x60 [ 22.915867] kasan_save_track+0x18/0x40 [ 22.916507] kasan_save_free_info+0x3f/0x60 [ 22.916815] __kasan_slab_free+0x56/0x70 [ 22.917065] kmem_cache_free+0x120/0x420 [ 22.917603] slab_kmem_cache_release+0x2e/0x40 [ 22.918093] kmem_cache_release+0x16/0x20 [ 22.918964] kobject_put+0x181/0x450 [ 22.919425] sysfs_slab_release+0x16/0x20 [ 22.919902] kmem_cache_destroy+0xf0/0x1d0 [ 22.921416] kmem_cache_double_destroy+0x14c/0x380 [ 22.921858] kunit_try_run_case+0x1b3/0x490 [ 22.922531] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.923006] kthread+0x257/0x310 [ 22.923977] ret_from_fork+0x41/0x80 [ 22.924538] ret_from_fork_asm+0x1a/0x30 [ 22.924896] [ 22.925126] The buggy address belongs to the object at ffff888101af9a00 [ 22.925126] which belongs to the cache kmem_cache of size 208 [ 22.926390] The buggy address is located 0 bytes inside of [ 22.926390] freed 208-byte region [ffff888101af9a00, ffff888101af9ad0) [ 22.927316] [ 22.928088] The buggy address belongs to the physical page: [ 22.928764] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101af9 [ 22.929468] flags: 0x200000000000000(node=0|zone=2) [ 22.929861] page_type: f5(slab) [ 22.930413] raw: 0200000000000000 ffff888100041000 dead000000000122 0000000000000000 [ 22.931186] raw: 0000000000000000 00000000800c000c 00000001f5000000 0000000000000000 [ 22.932473] page dumped because: kasan: bad access detected [ 22.933038] [ 22.933563] Memory state around the buggy address: [ 22.933886] ffff888101af9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.934680] ffff888101af9980: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.935634] >ffff888101af9a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.936162] ^ [ 22.936424] ffff888101af9a80: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 22.937320] ffff888101af9b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.938059] ==================================================================