Date
Dec. 5, 2024, 2:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.489282] ================================================================== [ 30.490384] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310 [ 30.491215] Write of size 33 at addr fff00000c64e7d00 by task kunit_try_catch/175 [ 30.491921] [ 30.492217] CPU: 1 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 30.494151] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.494697] Hardware name: linux,dummy-virt (DT) [ 30.495312] Call trace: [ 30.495723] show_stack+0x20/0x38 (C) [ 30.496496] dump_stack_lvl+0x8c/0xd0 [ 30.497039] print_report+0x118/0x5e0 [ 30.497640] kasan_report+0xc8/0x118 [ 30.498612] kasan_check_range+0x100/0x1a8 [ 30.499388] __asan_memset+0x34/0x78 [ 30.499861] kmalloc_uaf_memset+0x170/0x310 [ 30.500771] kunit_try_run_case+0x14c/0x3d0 [ 30.501426] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.502245] kthread+0x24c/0x2d0 [ 30.502919] ret_from_fork+0x10/0x20 [ 30.503701] [ 30.504291] Allocated by task 175: [ 30.504796] kasan_save_stack+0x3c/0x68 [ 30.505435] kasan_save_track+0x20/0x40 [ 30.506019] kasan_save_alloc_info+0x40/0x58 [ 30.506638] __kasan_kmalloc+0xd4/0xd8 [ 30.507386] __kmalloc_cache_noprof+0x15c/0x3c0 [ 30.508040] kmalloc_uaf_memset+0xb8/0x310 [ 30.508636] kunit_try_run_case+0x14c/0x3d0 [ 30.509217] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.510108] kthread+0x24c/0x2d0 [ 30.510853] ret_from_fork+0x10/0x20 [ 30.511462] [ 30.511764] Freed by task 175: [ 30.512255] kasan_save_stack+0x3c/0x68 [ 30.512855] kasan_save_track+0x20/0x40 [ 30.513966] kasan_save_free_info+0x4c/0x78 [ 30.514588] __kasan_slab_free+0x6c/0x98 [ 30.515057] kfree+0x114/0x3c8 [ 30.515610] kmalloc_uaf_memset+0x11c/0x310 [ 30.516650] kunit_try_run_case+0x14c/0x3d0 [ 30.517470] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.518235] kthread+0x24c/0x2d0 [ 30.518732] ret_from_fork+0x10/0x20 [ 30.519495] [ 30.519797] The buggy address belongs to the object at fff00000c64e7d00 [ 30.519797] which belongs to the cache kmalloc-64 of size 64 [ 30.521216] The buggy address is located 0 bytes inside of [ 30.521216] freed 64-byte region [fff00000c64e7d00, fff00000c64e7d40) [ 30.522821] [ 30.523141] The buggy address belongs to the physical page: [ 30.524624] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064e7 [ 30.525583] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 30.526340] page_type: f5(slab) [ 30.526952] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 30.528231] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 30.529149] page dumped because: kasan: bad access detected [ 30.529795] [ 30.530111] Memory state around the buggy address: [ 30.530756] fff00000c64e7c00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 30.532394] fff00000c64e7c80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 30.533376] >fff00000c64e7d00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 30.534261] ^ [ 30.534720] fff00000c64e7d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.535811] fff00000c64e7e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.536647] ==================================================================
[ 28.295276] ================================================================== [ 28.296279] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a4/0x360 [ 28.296897] Write of size 33 at addr ffff8881029ff300 by task kunit_try_catch/193 [ 28.297306] [ 28.297503] CPU: 1 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 28.298598] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.299300] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 28.300715] Call Trace: [ 28.301143] <TASK> [ 28.301421] dump_stack_lvl+0x73/0xb0 [ 28.302175] print_report+0xd1/0x640 [ 28.302630] ? __virt_addr_valid+0x1db/0x2d0 [ 28.303144] ? kasan_complete_mode_report_info+0x64/0x200 [ 28.304163] kasan_report+0x102/0x140 [ 28.304550] ? kmalloc_uaf_memset+0x1a4/0x360 [ 28.305177] ? kmalloc_uaf_memset+0x1a4/0x360 [ 28.305570] kasan_check_range+0x10c/0x1c0 [ 28.306295] __asan_memset+0x27/0x50 [ 28.306824] kmalloc_uaf_memset+0x1a4/0x360 [ 28.307351] ? __pfx_kmalloc_uaf_memset+0x10/0x10 [ 28.308059] ? __schedule+0xc70/0x27e0 [ 28.308370] ? __pfx_read_tsc+0x10/0x10 [ 28.309254] ? ktime_get_ts64+0x86/0x230 [ 28.309623] kunit_try_run_case+0x1b3/0x490 [ 28.310357] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.310843] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 28.311496] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.312131] ? __kthread_parkme+0x82/0x160 [ 28.312528] ? preempt_count_sub+0x50/0x80 [ 28.313016] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.314101] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.314637] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.315131] kthread+0x257/0x310 [ 28.315458] ? __pfx_kthread+0x10/0x10 [ 28.315900] ret_from_fork+0x41/0x80 [ 28.316468] ? __pfx_kthread+0x10/0x10 [ 28.316960] ret_from_fork_asm+0x1a/0x30 [ 28.317482] </TASK> [ 28.317703] [ 28.318148] Allocated by task 193: [ 28.318437] kasan_save_stack+0x3d/0x60 [ 28.319080] kasan_save_track+0x18/0x40 [ 28.319401] kasan_save_alloc_info+0x3b/0x50 [ 28.319966] __kasan_kmalloc+0xb7/0xc0 [ 28.320372] __kmalloc_cache_noprof+0x184/0x410 [ 28.320886] kmalloc_uaf_memset+0xaa/0x360 [ 28.321497] kunit_try_run_case+0x1b3/0x490 [ 28.322095] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.322604] kthread+0x257/0x310 [ 28.323073] ret_from_fork+0x41/0x80 [ 28.323550] ret_from_fork_asm+0x1a/0x30 [ 28.324231] [ 28.324459] Freed by task 193: [ 28.324964] kasan_save_stack+0x3d/0x60 [ 28.326004] kasan_save_track+0x18/0x40 [ 28.326660] kasan_save_free_info+0x3f/0x60 [ 28.327277] __kasan_slab_free+0x56/0x70 [ 28.327790] kfree+0x123/0x3f0 [ 28.328475] kmalloc_uaf_memset+0x12c/0x360 [ 28.329083] kunit_try_run_case+0x1b3/0x490 [ 28.329431] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.329938] kthread+0x257/0x310 [ 28.330524] ret_from_fork+0x41/0x80 [ 28.330980] ret_from_fork_asm+0x1a/0x30 [ 28.331592] [ 28.331853] The buggy address belongs to the object at ffff8881029ff300 [ 28.331853] which belongs to the cache kmalloc-64 of size 64 [ 28.333290] The buggy address is located 0 bytes inside of [ 28.333290] freed 64-byte region [ffff8881029ff300, ffff8881029ff340) [ 28.334522] [ 28.334928] The buggy address belongs to the physical page: [ 28.335817] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029ff [ 28.336676] flags: 0x200000000000000(node=0|zone=2) [ 28.337100] page_type: f5(slab) [ 28.337489] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 28.338487] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 28.339330] page dumped because: kasan: bad access detected [ 28.339912] [ 28.340207] Memory state around the buggy address: [ 28.340761] ffff8881029ff200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.341503] ffff8881029ff280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.342368] >ffff8881029ff300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.343166] ^ [ 28.343506] ffff8881029ff380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.344358] ffff8881029ff400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.344915] ==================================================================