Hay
Sign in
Date
Dec. 4, 2024, 3:07 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   34.608812] ==================================================================
[   34.610767] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   34.611854] Read of size 1 at addr fff00000c6844000 by task kunit_try_catch/221
[   34.613384] 
[   34.614365] CPU: 0 UID: 0 PID: 221 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   34.615783] Tainted: [B]=BAD_PAGE, [N]=TEST
[   34.616563] Hardware name: linux,dummy-virt (DT)
[   34.617219] Call trace:
[   34.617570]  show_stack+0x20/0x38 (C)
[   34.618323]  dump_stack_lvl+0x8c/0xd0
[   34.619004]  print_report+0x118/0x5e0
[   34.619540]  kasan_report+0xc8/0x118
[   34.620564]  __asan_report_load1_noabort+0x20/0x30
[   34.621273]  mempool_uaf_helper+0x314/0x340
[   34.621855]  mempool_page_alloc_uaf+0xb8/0x118
[   34.622552]  kunit_try_run_case+0x14c/0x3d0
[   34.623655]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.624316]  kthread+0x24c/0x2d0
[   34.624946]  ret_from_fork+0x10/0x20
[   34.625529] 
[   34.626471] The buggy address belongs to the physical page:
[   34.627159] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106844
[   34.628241] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   34.629371] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   34.630966] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   34.631841] page dumped because: kasan: bad access detected
[   34.632492] 
[   34.632885] Memory state around the buggy address:
[   34.633484]  fff00000c6843f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.634718]  fff00000c6843f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.635582] >fff00000c6844000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.636495]                    ^
[   34.637487]  fff00000c6844080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.638820]  fff00000c6844100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.640137] ==================================================================
[   34.484870] ==================================================================
[   34.486104] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   34.487028] Read of size 1 at addr fff00000c6844000 by task kunit_try_catch/217
[   34.487908] 
[   34.488307] CPU: 0 UID: 0 PID: 217 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   34.489711] Tainted: [B]=BAD_PAGE, [N]=TEST
[   34.490601] Hardware name: linux,dummy-virt (DT)
[   34.491147] Call trace:
[   34.491754]  show_stack+0x20/0x38 (C)
[   34.492538]  dump_stack_lvl+0x8c/0xd0
[   34.493388]  print_report+0x118/0x5e0
[   34.494241]  kasan_report+0xc8/0x118
[   34.494793]  __asan_report_load1_noabort+0x20/0x30
[   34.495488]  mempool_uaf_helper+0x314/0x340
[   34.496454]  mempool_kmalloc_large_uaf+0xbc/0x118
[   34.497127]  kunit_try_run_case+0x14c/0x3d0
[   34.498694]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.499476]  kthread+0x24c/0x2d0
[   34.500000]  ret_from_fork+0x10/0x20
[   34.500690] 
[   34.501066] The buggy address belongs to the physical page:
[   34.501833] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106844
[   34.503205] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   34.504127] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   34.505294] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   34.506465] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   34.507880] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   34.508812] head: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   34.509821] head: 0bfffe0000000002 ffffc1ffc31a1101 ffffffffffffffff 0000000000000000
[   34.511406] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   34.512289] page dumped because: kasan: bad access detected
[   34.513025] 
[   34.513333] Memory state around the buggy address:
[   34.514209]  fff00000c6843f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.515512]  fff00000c6843f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.516480] >fff00000c6844000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.517395]                    ^
[   34.518520]  fff00000c6844080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.519471]  fff00000c6844100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   34.520414] ==================================================================
Metadata Full log Test run details 

[   25.365933] ==================================================================
[   25.366875] BUG: KASAN: use-after-free in mempool_uaf_helper+0x394/0x400
[   25.367308] Read of size 1 at addr ffff888102c54000 by task kunit_try_catch/241
[   25.368358] 
[   25.368781] CPU: 0 UID: 0 PID: 241 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   25.371192] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.371947] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   25.373775] Call Trace:
[   25.374243]  <TASK>
[   25.375131]  dump_stack_lvl+0x73/0xb0
[   25.376036]  print_report+0xd1/0x640
[   25.376335]  ? __virt_addr_valid+0x1db/0x2d0
[   25.376914]  ? kasan_addr_to_slab+0x11/0xa0
[   25.377918]  kasan_report+0x102/0x140
[   25.378319]  ? mempool_uaf_helper+0x394/0x400
[   25.378954]  ? mempool_uaf_helper+0x394/0x400
[   25.379512]  __asan_report_load1_noabort+0x18/0x20
[   25.380144]  mempool_uaf_helper+0x394/0x400
[   25.380794]  ? __pfx_mempool_uaf_helper+0x10/0x10
[   25.381279]  ? irqentry_exit+0x2a/0x60
[   25.381830]  ? sysvec_apic_timer_interrupt+0x50/0x90
[   25.382871]  mempool_page_alloc_uaf+0xb1/0x100
[   25.383382]  ? __pfx_mempool_page_alloc_uaf+0x10/0x10
[   25.383987]  ? __pfx_mempool_alloc_pages+0x10/0x10
[   25.384593]  ? __pfx_mempool_free_pages+0x10/0x10
[   25.385199]  ? __pfx_mempool_page_alloc_uaf+0x10/0x10
[   25.386002]  kunit_try_run_case+0x1b3/0x490
[   25.386435]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.387285]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   25.387848]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   25.388576]  ? __kthread_parkme+0x82/0x160
[   25.388940]  ? preempt_count_sub+0x50/0x80
[   25.389502]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.390057]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   25.390717]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.391905]  kthread+0x257/0x310
[   25.392531]  ? __pfx_kthread+0x10/0x10
[   25.393342]  ret_from_fork+0x41/0x80
[   25.393696]  ? __pfx_kthread+0x10/0x10
[   25.394198]  ret_from_fork_asm+0x1a/0x30
[   25.395173]  </TASK>
[   25.395621] 
[   25.395852] The buggy address belongs to the physical page:
[   25.396776] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c54
[   25.397710] flags: 0x200000000000000(node=0|zone=2)
[   25.398514] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
[   25.399340] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   25.400172] page dumped because: kasan: bad access detected
[   25.400832] 
[   25.401167] Memory state around the buggy address:
[   25.401684]  ffff888102c53f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.402751]  ffff888102c53f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.403458] >ffff888102c54000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.404426]                    ^
[   25.404886]  ffff888102c54080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.405646]  ffff888102c54100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.406304] ==================================================================
[   25.247310] ==================================================================
[   25.248405] BUG: KASAN: use-after-free in mempool_uaf_helper+0x394/0x400
[   25.248984] Read of size 1 at addr ffff888102b40000 by task kunit_try_catch/237
[   25.249647] 
[   25.249944] CPU: 1 UID: 0 PID: 237 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   25.251091] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.251672] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   25.252377] Call Trace:
[   25.253035]  <TASK>
[   25.253296]  dump_stack_lvl+0x73/0xb0
[   25.253976]  print_report+0xd1/0x640
[   25.254295]  ? __virt_addr_valid+0x1db/0x2d0
[   25.255406]  ? kasan_addr_to_slab+0x11/0xa0
[   25.255791]  kasan_report+0x102/0x140
[   25.256463]  ? mempool_uaf_helper+0x394/0x400
[   25.257676]  ? mempool_uaf_helper+0x394/0x400
[   25.258782]  __asan_report_load1_noabort+0x18/0x20
[   25.259390]  mempool_uaf_helper+0x394/0x400
[   25.260435]  ? __pfx_mempool_uaf_helper+0x10/0x10
[   25.261065]  ? finish_task_switch.isra.0+0x153/0x700
[   25.262189]  mempool_kmalloc_large_uaf+0xb3/0x100
[   25.262976]  ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10
[   25.263528]  ? __switch_to+0x5d9/0xf60
[   25.263916]  ? __pfx_mempool_kmalloc+0x10/0x10
[   25.264668]  ? __pfx_mempool_kfree+0x10/0x10
[   25.265213]  ? __pfx_read_tsc+0x10/0x10
[   25.266174]  ? ktime_get_ts64+0x86/0x230
[   25.266614]  kunit_try_run_case+0x1b3/0x490
[   25.267144]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.267738]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   25.268155]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   25.268748]  ? __kthread_parkme+0x82/0x160
[   25.269144]  ? preempt_count_sub+0x50/0x80
[   25.269947]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.270485]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   25.271446]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.271978]  kthread+0x257/0x310
[   25.272395]  ? __pfx_kthread+0x10/0x10
[   25.272859]  ret_from_fork+0x41/0x80
[   25.273686]  ? __pfx_kthread+0x10/0x10
[   25.274164]  ret_from_fork_asm+0x1a/0x30
[   25.274557]  </TASK>
[   25.275101] 
[   25.275431] The buggy address belongs to the physical page:
[   25.275891] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b40
[   25.276961] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   25.277526] flags: 0x200000000000040(head|node=0|zone=2)
[   25.278400] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   25.279069] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   25.279937] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   25.280761] head: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   25.281348] head: 0200000000000002 ffffea00040ad001 ffffffffffffffff 0000000000000000
[   25.282290] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   25.283293] page dumped because: kasan: bad access detected
[   25.283788] 
[   25.284215] Memory state around the buggy address:
[   25.284780]  ffff888102b3ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.285306]  ffff888102b3ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.286222] >ffff888102b40000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.287201]                    ^
[   25.287600]  ffff888102b40080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.288889]  ffff888102b40100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.289841] ==================================================================
Metadata Full log Test run details