Date
Dec. 3, 2024, 11:38 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 32.908120] ================================================================== [ 32.909748] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 32.910767] Read of size 1 at addr fff00000c5945240 by task kunit_try_catch/220 [ 32.912358] [ 32.912801] CPU: 1 UID: 0 PID: 220 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 32.914043] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.914717] Hardware name: linux,dummy-virt (DT) [ 32.915601] Call trace: [ 32.916607] show_stack+0x20/0x38 (C) [ 32.917135] dump_stack_lvl+0x8c/0xd0 [ 32.917677] print_report+0x118/0x5e0 [ 32.918286] kasan_report+0xc8/0x118 [ 32.918804] __asan_report_load1_noabort+0x20/0x30 [ 32.919756] mempool_uaf_helper+0x314/0x340 [ 32.920782] mempool_slab_uaf+0xb8/0x110 [ 32.921493] kunit_try_run_case+0x14c/0x3d0 [ 32.922041] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.923074] kthread+0x24c/0x2d0 [ 32.924004] ret_from_fork+0x10/0x20 [ 32.924783] [ 32.925060] Allocated by task 220: [ 32.925751] kasan_save_stack+0x3c/0x68 [ 32.926208] kasan_save_track+0x20/0x40 [ 32.927076] kasan_save_alloc_info+0x40/0x58 [ 32.927999] __kasan_mempool_unpoison_object+0xbc/0x180 [ 32.928890] remove_element+0x16c/0x1f8 [ 32.929970] mempool_alloc_preallocated+0x58/0xc0 [ 32.930855] mempool_uaf_helper+0xa4/0x340 [ 32.931783] mempool_slab_uaf+0xb8/0x110 [ 32.932922] kunit_try_run_case+0x14c/0x3d0 [ 32.933864] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.934646] kthread+0x24c/0x2d0 [ 32.935691] ret_from_fork+0x10/0x20 [ 32.936225] [ 32.936586] Freed by task 220: [ 32.937107] kasan_save_stack+0x3c/0x68 [ 32.937996] kasan_save_track+0x20/0x40 [ 32.938642] kasan_save_free_info+0x4c/0x78 [ 32.939737] __kasan_mempool_poison_object+0xc0/0x150 [ 32.941050] mempool_free+0x28c/0x328 [ 32.941868] mempool_uaf_helper+0x104/0x340 [ 32.942674] mempool_slab_uaf+0xb8/0x110 [ 32.943713] kunit_try_run_case+0x14c/0x3d0 [ 32.944468] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.945271] kthread+0x24c/0x2d0 [ 32.945872] ret_from_fork+0x10/0x20 [ 32.946425] [ 32.946787] The buggy address belongs to the object at fff00000c5945240 [ 32.946787] which belongs to the cache test_cache of size 123 [ 32.949068] The buggy address is located 0 bytes inside of [ 32.949068] freed 123-byte region [fff00000c5945240, fff00000c59452bb) [ 32.951263] [ 32.951827] The buggy address belongs to the physical page: [ 32.952490] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105945 [ 32.953443] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.954271] page_type: f5(slab) [ 32.954854] raw: 0bfffe0000000000 fff00000c56f9a00 dead000000000122 0000000000000000 [ 32.956497] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 32.957402] page dumped because: kasan: bad access detected [ 32.958060] [ 32.958598] Memory state around the buggy address: [ 32.959486] fff00000c5945100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.960428] fff00000c5945180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.961257] >fff00000c5945200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 32.962138] ^ [ 32.962793] fff00000c5945280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.963898] fff00000c5945300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.964691] ================================================================== [ 32.794447] ================================================================== [ 32.795647] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 32.796575] Read of size 1 at addr fff00000c5912b00 by task kunit_try_catch/216 [ 32.797421] [ 32.797759] CPU: 1 UID: 0 PID: 216 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 32.799648] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.800621] Hardware name: linux,dummy-virt (DT) [ 32.801210] Call trace: [ 32.801652] show_stack+0x20/0x38 (C) [ 32.802938] dump_stack_lvl+0x8c/0xd0 [ 32.803482] print_report+0x118/0x5e0 [ 32.803929] kasan_report+0xc8/0x118 [ 32.804622] __asan_report_load1_noabort+0x20/0x30 [ 32.806225] mempool_uaf_helper+0x314/0x340 [ 32.807523] mempool_kmalloc_uaf+0xbc/0x118 [ 32.808108] kunit_try_run_case+0x14c/0x3d0 [ 32.808735] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.809592] kthread+0x24c/0x2d0 [ 32.810175] ret_from_fork+0x10/0x20 [ 32.810811] [ 32.811173] Allocated by task 216: [ 32.811645] kasan_save_stack+0x3c/0x68 [ 32.812394] kasan_save_track+0x20/0x40 [ 32.813083] kasan_save_alloc_info+0x40/0x58 [ 32.814252] __kasan_mempool_unpoison_object+0x11c/0x180 [ 32.815430] remove_element+0x130/0x1f8 [ 32.815991] mempool_alloc_preallocated+0x58/0xc0 [ 32.816646] mempool_uaf_helper+0xa4/0x340 [ 32.817224] mempool_kmalloc_uaf+0xbc/0x118 [ 32.817818] kunit_try_run_case+0x14c/0x3d0 [ 32.818474] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.819660] kthread+0x24c/0x2d0 [ 32.820136] ret_from_fork+0x10/0x20 [ 32.820777] [ 32.821064] Freed by task 216: [ 32.821554] kasan_save_stack+0x3c/0x68 [ 32.822157] kasan_save_track+0x20/0x40 [ 32.822799] kasan_save_free_info+0x4c/0x78 [ 32.823735] __kasan_mempool_poison_object+0xc0/0x150 [ 32.824407] mempool_free+0x28c/0x328 [ 32.825015] mempool_uaf_helper+0x104/0x340 [ 32.825860] mempool_kmalloc_uaf+0xbc/0x118 [ 32.826296] kunit_try_run_case+0x14c/0x3d0 [ 32.827228] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.828115] kthread+0x24c/0x2d0 [ 32.828799] ret_from_fork+0x10/0x20 [ 32.829525] [ 32.829841] The buggy address belongs to the object at fff00000c5912b00 [ 32.829841] which belongs to the cache kmalloc-128 of size 128 [ 32.831934] The buggy address is located 0 bytes inside of [ 32.831934] freed 128-byte region [fff00000c5912b00, fff00000c5912b80) [ 32.832764] [ 32.832943] The buggy address belongs to the physical page: [ 32.833281] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105912 [ 32.834066] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.834748] page_type: f5(slab) [ 32.835841] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.836932] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.838125] page dumped because: kasan: bad access detected [ 32.839264] [ 32.839710] Memory state around the buggy address: [ 32.840864] fff00000c5912a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.841694] fff00000c5912a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.842571] >fff00000c5912b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.843701] ^ [ 32.844381] fff00000c5912b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.845387] fff00000c5912c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.846252] ==================================================================
[ 28.221089] ================================================================== [ 28.221757] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x394/0x400 [ 28.222524] Read of size 1 at addr ffff888102a59240 by task kunit_try_catch/240 [ 28.223132] [ 28.223354] CPU: 1 UID: 0 PID: 240 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 28.224111] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.224828] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 28.225827] Call Trace: [ 28.226119] <TASK> [ 28.226314] dump_stack_lvl+0x73/0xb0 [ 28.226956] print_report+0xd1/0x640 [ 28.227311] ? __virt_addr_valid+0x1db/0x2d0 [ 28.228105] ? kasan_complete_mode_report_info+0x64/0x200 [ 28.228626] kasan_report+0x102/0x140 [ 28.228927] ? mempool_uaf_helper+0x394/0x400 [ 28.229418] ? mempool_uaf_helper+0x394/0x400 [ 28.229928] __asan_report_load1_noabort+0x18/0x20 [ 28.230340] mempool_uaf_helper+0x394/0x400 [ 28.230746] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 28.231149] ? finish_task_switch.isra.0+0x153/0x700 [ 28.232154] mempool_slab_uaf+0xae/0x100 [ 28.232698] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 28.233405] ? __switch_to+0x5d9/0xf60 [ 28.233766] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 28.234330] ? __pfx_mempool_free_slab+0x10/0x10 [ 28.234964] ? __pfx_read_tsc+0x10/0x10 [ 28.235517] ? ktime_get_ts64+0x86/0x230 [ 28.236151] kunit_try_run_case+0x1b3/0x490 [ 28.236577] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.236955] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 28.237404] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.237942] ? __kthread_parkme+0x82/0x160 [ 28.238954] ? preempt_count_sub+0x50/0x80 [ 28.239537] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.240166] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.240760] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.241415] kthread+0x257/0x310 [ 28.242066] ? __pfx_kthread+0x10/0x10 [ 28.242733] ret_from_fork+0x41/0x80 [ 28.243231] ? __pfx_kthread+0x10/0x10 [ 28.243796] ret_from_fork_asm+0x1a/0x30 [ 28.244096] </TASK> [ 28.244359] [ 28.245025] Allocated by task 240: [ 28.245246] kasan_save_stack+0x3d/0x60 [ 28.246011] kasan_save_track+0x18/0x40 [ 28.246435] kasan_save_alloc_info+0x3b/0x50 [ 28.247371] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 28.248140] remove_element+0x11e/0x190 [ 28.248480] mempool_alloc_preallocated+0x4d/0x90 [ 28.249025] mempool_uaf_helper+0x97/0x400 [ 28.249930] mempool_slab_uaf+0xae/0x100 [ 28.250305] kunit_try_run_case+0x1b3/0x490 [ 28.250742] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.251288] kthread+0x257/0x310 [ 28.251993] ret_from_fork+0x41/0x80 [ 28.252694] ret_from_fork_asm+0x1a/0x30 [ 28.252952] [ 28.253181] Freed by task 240: [ 28.253480] kasan_save_stack+0x3d/0x60 [ 28.254347] kasan_save_track+0x18/0x40 [ 28.254670] kasan_save_free_info+0x3f/0x60 [ 28.255306] __kasan_mempool_poison_object+0x131/0x1d0 [ 28.256043] mempool_free+0x2ec/0x380 [ 28.256447] mempool_uaf_helper+0x11b/0x400 [ 28.256836] mempool_slab_uaf+0xae/0x100 [ 28.257170] kunit_try_run_case+0x1b3/0x490 [ 28.257577] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.258431] kthread+0x257/0x310 [ 28.258759] ret_from_fork+0x41/0x80 [ 28.259027] ret_from_fork_asm+0x1a/0x30 [ 28.259215] [ 28.259296] The buggy address belongs to the object at ffff888102a59240 [ 28.259296] which belongs to the cache test_cache of size 123 [ 28.260936] The buggy address is located 0 bytes inside of [ 28.260936] freed 123-byte region [ffff888102a59240, ffff888102a592bb) [ 28.262011] [ 28.262175] The buggy address belongs to the physical page: [ 28.262594] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a59 [ 28.263282] flags: 0x200000000000000(node=0|zone=2) [ 28.263766] page_type: f5(slab) [ 28.264184] raw: 0200000000000000 ffff888101e708c0 dead000000000122 0000000000000000 [ 28.265045] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 28.265416] page dumped because: kasan: bad access detected [ 28.265907] [ 28.266129] Memory state around the buggy address: [ 28.266578] ffff888102a59100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.267261] ffff888102a59180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.268118] >ffff888102a59200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 28.268847] ^ [ 28.269395] ffff888102a59280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.269942] ffff888102a59300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.270245] ================================================================== [ 28.116375] ================================================================== [ 28.117350] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x394/0x400 [ 28.118124] Read of size 1 at addr ffff888102994800 by task kunit_try_catch/236 [ 28.118661] [ 28.118847] CPU: 0 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 28.120933] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.121632] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 28.122252] Call Trace: [ 28.122530] <TASK> [ 28.122764] dump_stack_lvl+0x73/0xb0 [ 28.123094] print_report+0xd1/0x640 [ 28.123480] ? __virt_addr_valid+0x1db/0x2d0 [ 28.123937] ? kasan_complete_mode_report_info+0x64/0x200 [ 28.124575] kasan_report+0x102/0x140 [ 28.125222] ? mempool_uaf_helper+0x394/0x400 [ 28.125837] ? mempool_uaf_helper+0x394/0x400 [ 28.126296] __asan_report_load1_noabort+0x18/0x20 [ 28.126934] mempool_uaf_helper+0x394/0x400 [ 28.127281] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 28.127896] ? finish_task_switch.isra.0+0x153/0x700 [ 28.128417] mempool_kmalloc_uaf+0xb3/0x100 [ 28.129111] ? __pfx_mempool_kmalloc_uaf+0x10/0x10 [ 28.129508] ? __switch_to+0x5d9/0xf60 [ 28.130519] ? __pfx_mempool_kmalloc+0x10/0x10 [ 28.131045] ? __pfx_mempool_kfree+0x10/0x10 [ 28.131500] ? __pfx_read_tsc+0x10/0x10 [ 28.131876] ? ktime_get_ts64+0x86/0x230 [ 28.132309] kunit_try_run_case+0x1b3/0x490 [ 28.132736] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.133221] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 28.133615] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.134404] ? __kthread_parkme+0x82/0x160 [ 28.134910] ? preempt_count_sub+0x50/0x80 [ 28.135356] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.135984] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.136547] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.137224] kthread+0x257/0x310 [ 28.137856] ? __pfx_kthread+0x10/0x10 [ 28.138232] ret_from_fork+0x41/0x80 [ 28.138498] ? __pfx_kthread+0x10/0x10 [ 28.138999] ret_from_fork_asm+0x1a/0x30 [ 28.139435] </TASK> [ 28.139872] [ 28.140099] Allocated by task 236: [ 28.140455] kasan_save_stack+0x3d/0x60 [ 28.141021] kasan_save_track+0x18/0x40 [ 28.141440] kasan_save_alloc_info+0x3b/0x50 [ 28.142099] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 28.142441] remove_element+0x11e/0x190 [ 28.142942] mempool_alloc_preallocated+0x4d/0x90 [ 28.143405] mempool_uaf_helper+0x97/0x400 [ 28.143943] mempool_kmalloc_uaf+0xb3/0x100 [ 28.144239] kunit_try_run_case+0x1b3/0x490 [ 28.144519] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.145200] kthread+0x257/0x310 [ 28.145583] ret_from_fork+0x41/0x80 [ 28.146277] ret_from_fork_asm+0x1a/0x30 [ 28.146835] [ 28.147050] Freed by task 236: [ 28.147381] kasan_save_stack+0x3d/0x60 [ 28.148001] kasan_save_track+0x18/0x40 [ 28.148334] kasan_save_free_info+0x3f/0x60 [ 28.148631] __kasan_mempool_poison_object+0x131/0x1d0 [ 28.149301] mempool_free+0x2ec/0x380 [ 28.149984] mempool_uaf_helper+0x11b/0x400 [ 28.150493] mempool_kmalloc_uaf+0xb3/0x100 [ 28.151091] kunit_try_run_case+0x1b3/0x490 [ 28.151499] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.152143] kthread+0x257/0x310 [ 28.152524] ret_from_fork+0x41/0x80 [ 28.152829] ret_from_fork_asm+0x1a/0x30 [ 28.153355] [ 28.153869] The buggy address belongs to the object at ffff888102994800 [ 28.153869] which belongs to the cache kmalloc-128 of size 128 [ 28.154852] The buggy address is located 0 bytes inside of [ 28.154852] freed 128-byte region [ffff888102994800, ffff888102994880) [ 28.155408] [ 28.155601] The buggy address belongs to the physical page: [ 28.156298] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102994 [ 28.157227] flags: 0x200000000000000(node=0|zone=2) [ 28.157947] page_type: f5(slab) [ 28.158308] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 28.159169] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 28.159854] page dumped because: kasan: bad access detected [ 28.160166] [ 28.160310] Memory state around the buggy address: [ 28.160602] ffff888102994700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.161225] ffff888102994780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.161833] >ffff888102994800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.163665] ^ [ 28.164200] ffff888102994880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.164991] ffff888102994900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.165473] ==================================================================