Hay
Sign in
Date
Dec. 3, 2024, 11:38 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   32.986809] ==================================================================
[   32.988402] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   32.989160] Read of size 1 at addr fff00000c6564000 by task kunit_try_catch/222
[   32.989936] 
[   32.990349] CPU: 1 UID: 0 PID: 222 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241203 #1
[   32.992613] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.993015] Hardware name: linux,dummy-virt (DT)
[   32.994069] Call trace:
[   32.994652]  show_stack+0x20/0x38 (C)
[   32.995605]  dump_stack_lvl+0x8c/0xd0
[   32.996086]  print_report+0x118/0x5e0
[   32.996539]  kasan_report+0xc8/0x118
[   32.996979]  __asan_report_load1_noabort+0x20/0x30
[   32.997401]  mempool_uaf_helper+0x314/0x340
[   32.998456]  mempool_page_alloc_uaf+0xb8/0x118
[   32.999457]  kunit_try_run_case+0x14c/0x3d0
[   33.000047]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   33.000748]  kthread+0x24c/0x2d0
[   33.001458]  ret_from_fork+0x10/0x20
[   33.002105] 
[   33.002467] The buggy address belongs to the physical page:
[   33.003349] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106564
[   33.004315] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   33.005192] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   33.006217] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   33.006750] page dumped because: kasan: bad access detected
[   33.007217] 
[   33.008132] Memory state around the buggy address:
[   33.008818]  fff00000c6563f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.009759]  fff00000c6563f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.010681] >fff00000c6564000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.011559]                    ^
[   33.012067]  fff00000c6564080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.012923]  fff00000c6564100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.014102] ==================================================================
[   32.857413] ==================================================================
[   32.858649] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   32.859552] Read of size 1 at addr fff00000c6564000 by task kunit_try_catch/218
[   32.860465] 
[   32.860956] CPU: 1 UID: 0 PID: 218 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241203 #1
[   32.862165] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.863575] Hardware name: linux,dummy-virt (DT)
[   32.864242] Call trace:
[   32.864762]  show_stack+0x20/0x38 (C)
[   32.865775]  dump_stack_lvl+0x8c/0xd0
[   32.866365]  print_report+0x118/0x5e0
[   32.866986]  kasan_report+0xc8/0x118
[   32.868158]  __asan_report_load1_noabort+0x20/0x30
[   32.868855]  mempool_uaf_helper+0x314/0x340
[   32.869452]  mempool_kmalloc_large_uaf+0xbc/0x118
[   32.870156]  kunit_try_run_case+0x14c/0x3d0
[   32.870885]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.872175]  kthread+0x24c/0x2d0
[   32.872770]  ret_from_fork+0x10/0x20
[   32.873506] 
[   32.873875] The buggy address belongs to the physical page:
[   32.874647] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106564
[   32.876050] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   32.877390] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   32.878411] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   32.879567] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   32.880799] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   32.881885] head: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   32.882940] head: 0bfffe0000000002 ffffc1ffc3195901 ffffffffffffffff 0000000000000000
[   32.883900] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   32.884763] page dumped because: kasan: bad access detected
[   32.885269] 
[   32.885537] Memory state around the buggy address:
[   32.886471]  fff00000c6563f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.887579]  fff00000c6563f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.888429] >fff00000c6564000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.889280]                    ^
[   32.889968]  fff00000c6564080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.890816]  fff00000c6564100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.892421] ==================================================================
Metadata Full log Test run details 

[   28.173980] ==================================================================
[   28.175565] BUG: KASAN: use-after-free in mempool_uaf_helper+0x394/0x400
[   28.176350] Read of size 1 at addr ffff888102760000 by task kunit_try_catch/238
[   28.177119] 
[   28.177387] CPU: 1 UID: 0 PID: 238 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241203 #1
[   28.178205] Tainted: [B]=BAD_PAGE, [N]=TEST
[   28.178487] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   28.179420] Call Trace:
[   28.179906]  <TASK>
[   28.180223]  dump_stack_lvl+0x73/0xb0
[   28.180947]  print_report+0xd1/0x640
[   28.181335]  ? __virt_addr_valid+0x1db/0x2d0
[   28.181991]  ? kasan_addr_to_slab+0x11/0xa0
[   28.182508]  kasan_report+0x102/0x140
[   28.183074]  ? mempool_uaf_helper+0x394/0x400
[   28.183583]  ? mempool_uaf_helper+0x394/0x400
[   28.184130]  __asan_report_load1_noabort+0x18/0x20
[   28.184559]  mempool_uaf_helper+0x394/0x400
[   28.185043]  ? __pfx_mempool_uaf_helper+0x10/0x10
[   28.185383]  ? finish_task_switch.isra.0+0x153/0x700
[   28.186527]  mempool_kmalloc_large_uaf+0xb3/0x100
[   28.186916]  ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10
[   28.187421]  ? __switch_to+0x5d9/0xf60
[   28.187776]  ? __pfx_mempool_kmalloc+0x10/0x10
[   28.188350]  ? __pfx_mempool_kfree+0x10/0x10
[   28.188922]  ? __pfx_read_tsc+0x10/0x10
[   28.189337]  ? ktime_get_ts64+0x86/0x230
[   28.189918]  kunit_try_run_case+0x1b3/0x490
[   28.190254]  ? __pfx_kunit_try_run_case+0x10/0x10
[   28.190865]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   28.191332]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   28.192497]  ? __kthread_parkme+0x82/0x160
[   28.192913]  ? preempt_count_sub+0x50/0x80
[   28.193534]  ? __pfx_kunit_try_run_case+0x10/0x10
[   28.193979]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   28.194574]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   28.195120]  kthread+0x257/0x310
[   28.195369]  ? __pfx_kthread+0x10/0x10
[   28.195916]  ret_from_fork+0x41/0x80
[   28.196315]  ? __pfx_kthread+0x10/0x10
[   28.196721]  ret_from_fork_asm+0x1a/0x30
[   28.197684]  </TASK>
[   28.197962] 
[   28.198182] The buggy address belongs to the physical page:
[   28.198669] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102760
[   28.199199] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   28.199737] flags: 0x200000000000040(head|node=0|zone=2)
[   28.200804] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   28.201382] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   28.201931] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   28.202737] head: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   28.203382] head: 0200000000000002 ffffea000409d801 ffffffffffffffff 0000000000000000
[   28.204714] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   28.205460] page dumped because: kasan: bad access detected
[   28.205827] 
[   28.205971] Memory state around the buggy address:
[   28.206419]  ffff88810275ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.206930]  ffff88810275ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.207807] >ffff888102760000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.208368]                    ^
[   28.208701]  ffff888102760080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.209433]  ffff888102760100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.210645] ==================================================================
[   28.282534] ==================================================================
[   28.283454] BUG: KASAN: use-after-free in mempool_uaf_helper+0x394/0x400
[   28.283874] Read of size 1 at addr ffff888102ba0000 by task kunit_try_catch/242
[   28.284673] 
[   28.284915] CPU: 0 UID: 0 PID: 242 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241203 #1
[   28.285455] Tainted: [B]=BAD_PAGE, [N]=TEST
[   28.286594] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   28.288081] Call Trace:
[   28.288391]  <TASK>
[   28.288879]  dump_stack_lvl+0x73/0xb0
[   28.289432]  print_report+0xd1/0x640
[   28.289947]  ? __virt_addr_valid+0x1db/0x2d0
[   28.290553]  ? kasan_addr_to_slab+0x11/0xa0
[   28.290988]  kasan_report+0x102/0x140
[   28.291820]  ? mempool_uaf_helper+0x394/0x400
[   28.292835]  ? mempool_uaf_helper+0x394/0x400
[   28.293210]  __asan_report_load1_noabort+0x18/0x20
[   28.293779]  mempool_uaf_helper+0x394/0x400
[   28.294316]  ? __pfx_mempool_uaf_helper+0x10/0x10
[   28.294729]  ? finish_task_switch.isra.0+0x153/0x700
[   28.295466]  mempool_page_alloc_uaf+0xb1/0x100
[   28.295999]  ? __pfx_mempool_page_alloc_uaf+0x10/0x10
[   28.296340]  ? __switch_to+0x5d9/0xf60
[   28.296788]  ? __pfx_mempool_alloc_pages+0x10/0x10
[   28.297194]  ? __pfx_mempool_free_pages+0x10/0x10
[   28.297791]  ? __pfx_read_tsc+0x10/0x10
[   28.298127]  ? ktime_get_ts64+0x86/0x230
[   28.299246]  kunit_try_run_case+0x1b3/0x490
[   28.299573]  ? __pfx_kunit_try_run_case+0x10/0x10
[   28.300076]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   28.300517]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   28.301028]  ? __kthread_parkme+0x82/0x160
[   28.301454]  ? preempt_count_sub+0x50/0x80
[   28.302432]  ? __pfx_kunit_try_run_case+0x10/0x10
[   28.302999]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   28.303463]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   28.303896]  kthread+0x257/0x310
[   28.304234]  ? __pfx_kthread+0x10/0x10
[   28.304642]  ret_from_fork+0x41/0x80
[   28.304981]  ? __pfx_kthread+0x10/0x10
[   28.306150]  ret_from_fork_asm+0x1a/0x30
[   28.306450]  </TASK>
[   28.306703] 
[   28.307175] The buggy address belongs to the physical page:
[   28.307635] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ba0
[   28.307967] flags: 0x200000000000000(node=0|zone=2)
[   28.308802] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
[   28.309205] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   28.310185] page dumped because: kasan: bad access detected
[   28.310498] 
[   28.311027] Memory state around the buggy address:
[   28.311462]  ffff888102b9ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.312971]  ffff888102b9ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.313326] >ffff888102ba0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.314311]                    ^
[   28.314860]  ffff888102ba0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.315709]  ffff888102ba0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   28.316630] ==================================================================
Metadata Full log Test run details