Date
Dec. 4, 2024, 3:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 33.046346] ================================================================== [ 33.047383] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 33.048316] Read of size 4 at addr fff00000c67471c0 by task swapper/1/0 [ 33.049563] [ 33.050250] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.13.0-rc1-next-20241204 #1 [ 33.052445] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.053100] Hardware name: linux,dummy-virt (DT) [ 33.053863] Call trace: [ 33.054443] show_stack+0x20/0x38 (C) [ 33.055335] dump_stack_lvl+0x8c/0xd0 [ 33.055917] print_report+0x118/0x5e0 [ 33.056501] kasan_report+0xc8/0x118 [ 33.057167] __asan_report_load4_noabort+0x20/0x30 [ 33.057763] rcu_uaf_reclaim+0x64/0x70 [ 33.058435] rcu_core+0x9f4/0x1e20 [ 33.058986] rcu_core_si+0x18/0x30 [ 33.059611] handle_softirqs+0x374/0xb20 [ 33.060533] __do_softirq+0x1c/0x28 [ 33.061101] ____do_softirq+0x18/0x30 [ 33.062028] call_on_irq_stack+0x24/0x58 [ 33.062674] do_softirq_own_stack+0x24/0x38 [ 33.063368] __irq_exit_rcu+0x1fc/0x318 [ 33.063925] irq_exit_rcu+0x1c/0x80 [ 33.064675] el1_interrupt+0x38/0x58 [ 33.065436] el1h_64_irq_handler+0x18/0x28 [ 33.066420] el1h_64_irq+0x6c/0x70 [ 33.067138] arch_local_irq_enable+0x4/0x8 (P) [ 33.067826] default_idle_call+0x6c/0x78 (L) [ 33.068482] do_idle+0x384/0x4e8 [ 33.069105] cpu_startup_entry+0x64/0x80 [ 33.069683] secondary_start_kernel+0x288/0x340 [ 33.070726] __secondary_switched+0xc0/0xc8 [ 33.071483] [ 33.071851] Allocated by task 186: [ 33.072409] kasan_save_stack+0x3c/0x68 [ 33.073129] kasan_save_track+0x20/0x40 [ 33.074030] kasan_save_alloc_info+0x40/0x58 [ 33.074764] __kasan_kmalloc+0xd4/0xd8 [ 33.075486] __kmalloc_cache_noprof+0x15c/0x3c0 [ 33.076171] rcu_uaf+0xb0/0x2d0 [ 33.076718] kunit_try_run_case+0x14c/0x3d0 [ 33.077387] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.078347] kthread+0x24c/0x2d0 [ 33.079222] ret_from_fork+0x10/0x20 [ 33.079911] [ 33.080369] Freed by task 0: [ 33.080886] kasan_save_stack+0x3c/0x68 [ 33.081400] kasan_save_track+0x20/0x40 [ 33.082480] kasan_save_free_info+0x4c/0x78 [ 33.083310] __kasan_slab_free+0x6c/0x98 [ 33.083990] kfree+0x114/0x3c8 [ 33.084455] rcu_uaf_reclaim+0x28/0x70 [ 33.085012] rcu_core+0x9f4/0x1e20 [ 33.085600] rcu_core_si+0x18/0x30 [ 33.086168] handle_softirqs+0x374/0xb20 [ 33.086879] __do_softirq+0x1c/0x28 [ 33.087482] [ 33.088236] Last potentially related work creation: [ 33.088939] kasan_save_stack+0x3c/0x68 [ 33.089592] kasan_record_aux_stack+0xb4/0xc8 [ 33.090718] __call_rcu_common.constprop.0+0x74/0xa10 [ 33.091420] call_rcu+0x18/0x30 [ 33.092004] rcu_uaf+0x14c/0x2d0 [ 33.092558] kunit_try_run_case+0x14c/0x3d0 [ 33.093205] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.094203] kthread+0x24c/0x2d0 [ 33.094781] ret_from_fork+0x10/0x20 [ 33.095359] [ 33.095770] The buggy address belongs to the object at fff00000c67471c0 [ 33.095770] which belongs to the cache kmalloc-32 of size 32 [ 33.097114] The buggy address is located 0 bytes inside of [ 33.097114] freed 32-byte region [fff00000c67471c0, fff00000c67471e0) [ 33.098925] [ 33.099241] The buggy address belongs to the physical page: [ 33.099877] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106747 [ 33.100956] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.102059] page_type: f5(slab) [ 33.102682] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 33.103471] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 33.104521] page dumped because: kasan: bad access detected [ 33.105141] [ 33.105496] Memory state around the buggy address: [ 33.106694] fff00000c6747080: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 33.107643] fff00000c6747100: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 33.108534] >fff00000c6747180: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 33.109496] ^ [ 33.110184] fff00000c6747200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.111584] fff00000c6747280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.112477] ==================================================================
[ 23.849548] ================================================================== [ 23.850379] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60 [ 23.851358] Read of size 4 at addr ffff8881029907c0 by task swapper/1/0 [ 23.853002] [ 23.853209] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.13.0-rc1-next-20241204 #1 [ 23.855332] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.855611] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.856197] Call Trace: [ 23.856536] <IRQ> [ 23.857332] dump_stack_lvl+0x73/0xb0 [ 23.857813] print_report+0xd1/0x640 [ 23.858476] ? __virt_addr_valid+0x1db/0x2d0 [ 23.859109] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.859665] kasan_report+0x102/0x140 [ 23.860178] ? rcu_uaf_reclaim+0x50/0x60 [ 23.860588] ? rcu_uaf_reclaim+0x50/0x60 [ 23.861054] __asan_report_load4_noabort+0x18/0x20 [ 23.861539] rcu_uaf_reclaim+0x50/0x60 [ 23.862097] rcu_core+0x680/0x1d70 [ 23.862382] ? __pfx_rcu_core+0x10/0x10 [ 23.863232] ? ktime_get+0x6b/0x150 [ 23.863691] ? handle_softirqs+0x18e/0x720 [ 23.864288] rcu_core_si+0x12/0x20 [ 23.865186] handle_softirqs+0x209/0x720 [ 23.865930] ? hrtimer_interrupt+0x2fe/0x780 [ 23.866421] ? __pfx_handle_softirqs+0x10/0x10 [ 23.867318] __irq_exit_rcu+0xc9/0x110 [ 23.868183] irq_exit_rcu+0x12/0x20 [ 23.868544] sysvec_apic_timer_interrupt+0x81/0x90 [ 23.869101] </IRQ> [ 23.869731] <TASK> [ 23.870153] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 23.871123] RIP: 0010:default_idle+0xf/0x20 [ 23.872300] Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d d3 99 35 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 [ 23.873806] RSP: 0000:ffff888100877de0 EFLAGS: 00010206 [ 23.874788] RAX: ffff888154b00000 RBX: ffff88810084c000 RCX: ffffffffb8f01165 [ 23.876440] RDX: ffffed102a966b23 RSI: 0000000000000004 RDI: 000000000000e6c4 [ 23.877183] RBP: ffff888100877de8 R08: 0000000000000001 R09: ffffed102a966b22 [ 23.877886] R10: ffff888154b35913 R11: 0000000000000000 R12: 0000000000000001 [ 23.878866] R13: ffffed1020109800 R14: ffffffffbad74190 R15: 0000000000000000 [ 23.879963] ? ct_kernel_exit.constprop.0+0xa5/0xd0 [ 23.880672] ? arch_cpu_idle+0xd/0x20 [ 23.881172] default_idle_call+0x48/0x80 [ 23.882024] do_idle+0x310/0x3c0 [ 23.882531] ? __pfx_do_idle+0x10/0x10 [ 23.883233] ? _raw_spin_unlock_irqrestore+0x49/0x90 [ 23.884007] ? complete+0x15b/0x1d0 [ 23.884606] cpu_startup_entry+0x5c/0x70 [ 23.885025] start_secondary+0x216/0x290 [ 23.885399] ? __pfx_start_secondary+0x10/0x10 [ 23.886037] common_startup_64+0x12c/0x138 [ 23.886466] </TASK> [ 23.886853] [ 23.887396] Allocated by task 206: [ 23.887705] kasan_save_stack+0x3d/0x60 [ 23.888425] kasan_save_track+0x18/0x40 [ 23.888729] kasan_save_alloc_info+0x3b/0x50 [ 23.889250] __kasan_kmalloc+0xb7/0xc0 [ 23.889909] __kmalloc_cache_noprof+0x184/0x410 [ 23.890807] rcu_uaf+0xb1/0x330 [ 23.891107] kunit_try_run_case+0x1b3/0x490 [ 23.891492] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.892279] kthread+0x257/0x310 [ 23.892824] ret_from_fork+0x41/0x80 [ 23.893142] ret_from_fork_asm+0x1a/0x30 [ 23.894115] [ 23.894363] Freed by task 0: [ 23.894926] kasan_save_stack+0x3d/0x60 [ 23.895330] kasan_save_track+0x18/0x40 [ 23.895968] kasan_save_free_info+0x3f/0x60 [ 23.896308] __kasan_slab_free+0x56/0x70 [ 23.896592] kfree+0x123/0x3f0 [ 23.897055] rcu_uaf_reclaim+0x1f/0x60 [ 23.897697] rcu_core+0x680/0x1d70 [ 23.898147] rcu_core_si+0x12/0x20 [ 23.898908] handle_softirqs+0x209/0x720 [ 23.899234] __irq_exit_rcu+0xc9/0x110 [ 23.900087] irq_exit_rcu+0x12/0x20 [ 23.901122] sysvec_apic_timer_interrupt+0x81/0x90 [ 23.901883] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 23.902366] [ 23.902676] Last potentially related work creation: [ 23.903057] kasan_save_stack+0x3d/0x60 [ 23.903402] kasan_record_aux_stack+0xb2/0xc0 [ 23.903933] __call_rcu_common.constprop.0+0x72/0xaa0 [ 23.905175] call_rcu+0x12/0x20 [ 23.905894] rcu_uaf+0x169/0x330 [ 23.906576] kunit_try_run_case+0x1b3/0x490 [ 23.907600] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.908280] kthread+0x257/0x310 [ 23.909036] ret_from_fork+0x41/0x80 [ 23.909590] ret_from_fork_asm+0x1a/0x30 [ 23.909873] [ 23.910165] The buggy address belongs to the object at ffff8881029907c0 [ 23.910165] which belongs to the cache kmalloc-32 of size 32 [ 23.911739] The buggy address is located 0 bytes inside of [ 23.911739] freed 32-byte region [ffff8881029907c0, ffff8881029907e0) [ 23.912892] [ 23.913239] The buggy address belongs to the physical page: [ 23.914111] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102990 [ 23.915052] flags: 0x200000000000000(node=0|zone=2) [ 23.915717] page_type: f5(slab) [ 23.916218] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 23.917157] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 23.917998] page dumped because: kasan: bad access detected [ 23.918226] [ 23.918621] Memory state around the buggy address: [ 23.919791] ffff888102990680: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 23.920750] ffff888102990700: 00 00 00 fc fc fc fc fc 00 00 05 fc fc fc fc fc [ 23.922179] >ffff888102990780: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 23.923053] ^ [ 23.924024] ffff888102990800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.925767] ffff888102990880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.926253] ==================================================================