Date
Dec. 6, 2024, 3:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.141970] ================================================================== [ 30.143643] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8 [ 30.144572] Read of size 1 at addr fff00000c6220000 by task kunit_try_catch/137 [ 30.145391] [ 30.145847] CPU: 0 UID: 0 PID: 137 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 30.147181] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.148118] Hardware name: linux,dummy-virt (DT) [ 30.148790] Call trace: [ 30.149232] show_stack+0x20/0x38 (C) [ 30.149859] dump_stack_lvl+0x8c/0xd0 [ 30.150702] print_report+0x118/0x5e0 [ 30.151322] kasan_report+0xc8/0x118 [ 30.151836] __asan_report_load1_noabort+0x20/0x30 [ 30.152928] kmalloc_large_uaf+0x2cc/0x2f8 [ 30.153708] kunit_try_run_case+0x14c/0x3d0 [ 30.154600] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.155338] kthread+0x24c/0x2d0 [ 30.155948] ret_from_fork+0x10/0x20 [ 30.156641] [ 30.157040] The buggy address belongs to the physical page: [ 30.157876] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106220 [ 30.158675] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 30.159610] raw: 0bfffe0000000000 ffffc1ffc3188908 fff00000da4dc040 0000000000000000 [ 30.160781] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 30.161604] page dumped because: kasan: bad access detected [ 30.162615] [ 30.162986] Memory state around the buggy address: [ 30.163613] fff00000c621ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.164404] fff00000c621ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.165903] >fff00000c6220000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 30.166716] ^ [ 30.167239] fff00000c6220080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 30.168947] fff00000c6220100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 30.169703] ==================================================================
[ 22.301245] ================================================================== [ 22.302780] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f3/0x340 [ 22.303507] Read of size 1 at addr ffff888102ab4000 by task kunit_try_catch/156 [ 22.303975] [ 22.304316] CPU: 1 UID: 0 PID: 156 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 22.305329] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.305705] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.306530] Call Trace: [ 22.306914] <TASK> [ 22.307190] dump_stack_lvl+0x73/0xb0 [ 22.307548] print_report+0xd1/0x640 [ 22.308152] ? __virt_addr_valid+0x1db/0x2d0 [ 22.308700] ? kasan_addr_to_slab+0x11/0xa0 [ 22.309305] kasan_report+0x102/0x140 [ 22.309666] ? kmalloc_large_uaf+0x2f3/0x340 [ 22.310204] ? kmalloc_large_uaf+0x2f3/0x340 [ 22.310703] __asan_report_load1_noabort+0x18/0x20 [ 22.311253] kmalloc_large_uaf+0x2f3/0x340 [ 22.311764] ? __pfx_kmalloc_large_uaf+0x10/0x10 [ 22.312185] ? __pfx_kmalloc_large_uaf+0x10/0x10 [ 22.312736] kunit_try_run_case+0x1b3/0x490 [ 22.313349] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.313755] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 22.314364] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.314997] ? __kthread_parkme+0x82/0x160 [ 22.315424] ? preempt_count_sub+0x50/0x80 [ 22.315922] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.316349] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.316822] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.317560] kthread+0x257/0x310 [ 22.318069] ? __pfx_kthread+0x10/0x10 [ 22.318585] ret_from_fork+0x41/0x80 [ 22.319046] ? __pfx_kthread+0x10/0x10 [ 22.319578] ret_from_fork_asm+0x1a/0x30 [ 22.320041] </TASK> [ 22.320399] [ 22.320623] The buggy address belongs to the physical page: [ 22.321017] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ab4 [ 22.321712] flags: 0x200000000000000(node=0|zone=2) [ 22.322155] raw: 0200000000000000 ffffea00040aae08 ffff88815b13f0c0 0000000000000000 [ 22.323016] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 22.323843] page dumped because: kasan: bad access detected [ 22.324439] [ 22.324669] Memory state around the buggy address: [ 22.325048] ffff888102ab3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.325710] ffff888102ab3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.326490] >ffff888102ab4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 22.326993] ^ [ 22.327304] ffff888102ab4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 22.328174] ffff888102ab4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 22.328691] ==================================================================