Date
March 19, 2025, 10:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.984165] ================================================================== [ 34.985304] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 34.985478] Read of size 4 at addr fff00000c5d93200 by task swapper/1/0 [ 34.985628] [ 34.985731] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 34.986008] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.988113] Hardware name: linux,dummy-virt (DT) [ 34.988380] Call trace: [ 34.988997] show_stack+0x20/0x38 (C) [ 34.989562] dump_stack_lvl+0x8c/0xd0 [ 34.990035] print_report+0x118/0x5f0 [ 34.990289] kasan_report+0xc8/0x118 [ 34.990840] __asan_report_load4_noabort+0x20/0x30 [ 34.991363] rcu_uaf_reclaim+0x64/0x70 [ 34.991523] rcu_core+0x9f4/0x1e58 [ 34.991667] rcu_core_si+0x18/0x30 [ 34.991797] handle_softirqs+0x374/0xb20 [ 34.991954] __do_softirq+0x1c/0x28 [ 34.993357] ____do_softirq+0x18/0x30 [ 34.994482] call_on_irq_stack+0x24/0x58 [ 34.994961] do_softirq_own_stack+0x24/0x38 [ 34.995152] __irq_exit_rcu+0x1fc/0x318 [ 34.995303] irq_exit_rcu+0x1c/0x80 [ 34.995448] el1_interrupt+0x38/0x58 [ 34.996485] el1h_64_irq_handler+0x18/0x28 [ 34.996866] el1h_64_irq+0x6c/0x70 [ 34.999933] finish_task_switch.isra.0+0x120/0x5f8 (P) [ 35.000385] __schedule+0xa90/0x2628 [ 35.000546] schedule_idle+0x60/0xa8 [ 35.000692] do_idle+0x2c4/0x4e8 [ 35.000830] cpu_startup_entry+0x64/0x80 [ 35.000969] secondary_start_kernel+0x288/0x340 [ 35.003228] __secondary_switched+0xc0/0xc8 [ 35.003633] [ 35.003723] Allocated by task 200: [ 35.004022] kasan_save_stack+0x3c/0x68 [ 35.004517] kasan_save_track+0x20/0x40 [ 35.004648] kasan_save_alloc_info+0x40/0x58 [ 35.005151] __kasan_kmalloc+0xd4/0xd8 [ 35.005308] __kmalloc_cache_noprof+0x15c/0x3c0 [ 35.005442] rcu_uaf+0xb0/0x2d0 [ 35.005546] kunit_try_run_case+0x14c/0x3d0 [ 35.005666] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.006328] kthread+0x318/0x618 [ 35.006930] ret_from_fork+0x10/0x20 [ 35.007324] [ 35.007410] Freed by task 0: [ 35.007490] kasan_save_stack+0x3c/0x68 [ 35.007622] kasan_save_track+0x20/0x40 [ 35.008252] kasan_save_free_info+0x4c/0x78 [ 35.008559] __kasan_slab_free+0x6c/0x98 [ 35.008899] kfree+0x214/0x3c8 [ 35.009770] rcu_uaf_reclaim+0x28/0x70 [ 35.010244] rcu_core+0x9f4/0x1e58 [ 35.011100] rcu_core_si+0x18/0x30 [ 35.011247] handle_softirqs+0x374/0xb20 [ 35.011314] __do_softirq+0x1c/0x28 [ 35.011376] [ 35.011425] Last potentially related work creation: [ 35.011482] kasan_save_stack+0x3c/0x68 [ 35.011543] kasan_record_aux_stack+0xb4/0xc8 [ 35.011609] __call_rcu_common.constprop.0+0x70/0x8b0 [ 35.011676] call_rcu+0x18/0x30 [ 35.011730] rcu_uaf+0x14c/0x2d0 [ 35.011787] kunit_try_run_case+0x14c/0x3d0 [ 35.011852] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.011923] kthread+0x318/0x618 [ 35.011982] ret_from_fork+0x10/0x20 [ 35.012078] [ 35.012306] The buggy address belongs to the object at fff00000c5d93200 [ 35.012306] which belongs to the cache kmalloc-32 of size 32 [ 35.012872] The buggy address is located 0 bytes inside of [ 35.012872] freed 32-byte region [fff00000c5d93200, fff00000c5d93220) [ 35.013472] [ 35.013546] The buggy address belongs to the physical page: [ 35.014254] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105d93 [ 35.014524] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 35.015122] page_type: f5(slab) [ 35.015301] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 35.015475] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 35.015746] page dumped because: kasan: bad access detected [ 35.016013] [ 35.016242] Memory state around the buggy address: [ 35.016478] fff00000c5d93100: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 35.016922] fff00000c5d93180: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 35.017476] >fff00000c5d93200: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 35.017747] ^ [ 35.018036] fff00000c5d93280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.018346] fff00000c5d93300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.018495] ==================================================================
[ 22.762945] ================================================================== [ 22.763646] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60 [ 22.764708] Read of size 4 at addr ffff88810305fd00 by task swapper/0/0 [ 22.765381] [ 22.765586] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 22.765653] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.765671] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.766104] Call Trace: [ 22.766532] <IRQ> [ 22.766593] dump_stack_lvl+0x73/0xb0 [ 22.766679] print_report+0xd1/0x660 [ 22.766991] ? __virt_addr_valid+0x1db/0x2d0 [ 22.767184] ? kasan_complete_mode_report_info+0x64/0x200 [ 22.767254] kasan_report+0x104/0x140 [ 22.767287] ? rcu_uaf_reclaim+0x50/0x60 [ 22.767320] ? rcu_uaf_reclaim+0x50/0x60 [ 22.767360] __asan_report_load4_noabort+0x18/0x20 [ 22.767390] rcu_uaf_reclaim+0x50/0x60 [ 22.767421] rcu_core+0x66c/0x1cd0 [ 22.767468] ? __pfx_rcu_core+0x10/0x10 [ 22.767512] rcu_core_si+0x12/0x20 [ 22.767541] handle_softirqs+0x209/0x730 [ 22.767575] ? hrtimer_interrupt+0x2fe/0x780 [ 22.767693] ? __pfx_handle_softirqs+0x10/0x10 [ 22.767790] __irq_exit_rcu+0xc9/0x110 [ 22.767894] irq_exit_rcu+0x12/0x20 [ 22.767942] sysvec_apic_timer_interrupt+0x81/0x90 [ 22.767979] </IRQ> [ 22.767994] <TASK> [ 22.768010] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 22.768181] RIP: 0010:default_idle+0xf/0x20 [ 22.768498] Code: 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d f3 e6 16 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 [ 22.768617] RSP: 0000:ffffffffb5007de8 EFLAGS: 00010206 [ 22.768903] RAX: ffff8881a4b85000 RBX: ffffffffb501cbc0 RCX: ffffffffb3ef7555 [ 22.768988] RDX: ffffed102b606103 RSI: 0000000000000004 RDI: 000000000001ac94 [ 22.769054] RBP: ffffffffb5007df0 R08: 0000000000000001 R09: ffffed102b606102 [ 22.769140] R10: ffff88815b030813 R11: 00000000000b0000 R12: 0000000000000000 [ 22.769208] R13: fffffbfff6a03978 R14: ffffffffb5c7d610 R15: 0000000000000000 [ 22.769301] ? ct_kernel_exit.constprop.0+0xa5/0xe0 [ 22.769389] ? arch_cpu_idle+0xd/0x20 [ 22.769422] default_idle_call+0x48/0x80 [ 22.769454] do_idle+0x38b/0x500 [ 22.769490] ? __pfx_do_idle+0x10/0x10 [ 22.769522] ? rest_init+0x10b/0x140 [ 22.769558] cpu_startup_entry+0x5c/0x70 [ 22.769589] rest_init+0x11a/0x140 [ 22.769619] ? acpi_subsystem_init+0x5d/0x150 [ 22.769657] start_kernel+0x325/0x450 [ 22.769709] x86_64_start_reservations+0x1c/0x30 [ 22.769743] x86_64_start_kernel+0xcf/0xe0 [ 22.769776] common_startup_64+0x12c/0x138 [ 22.769826] </TASK> [ 22.769842] [ 22.794352] Allocated by task 219: [ 22.795041] kasan_save_stack+0x3d/0x60 [ 22.795543] kasan_save_track+0x18/0x40 [ 22.796416] kasan_save_alloc_info+0x3b/0x50 [ 22.797084] __kasan_kmalloc+0xb7/0xc0 [ 22.797604] __kmalloc_cache_noprof+0x183/0x410 [ 22.798328] rcu_uaf+0xb0/0x330 [ 22.799276] kunit_try_run_case+0x1b2/0x490 [ 22.799951] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.800570] kthread+0x323/0x710 [ 22.801236] ret_from_fork+0x41/0x80 [ 22.801652] ret_from_fork_asm+0x1a/0x30 [ 22.802393] [ 22.802649] Freed by task 0: [ 22.803446] kasan_save_stack+0x3d/0x60 [ 22.804175] kasan_save_track+0x18/0x40 [ 22.804856] kasan_save_free_info+0x3f/0x60 [ 22.805344] __kasan_slab_free+0x56/0x70 [ 22.806134] kfree+0x222/0x3f0 [ 22.806509] rcu_uaf_reclaim+0x1f/0x60 [ 22.806899] rcu_core+0x66c/0x1cd0 [ 22.807817] rcu_core_si+0x12/0x20 [ 22.808467] handle_softirqs+0x209/0x730 [ 22.808990] __irq_exit_rcu+0xc9/0x110 [ 22.809429] irq_exit_rcu+0x12/0x20 [ 22.809695] sysvec_apic_timer_interrupt+0x81/0x90 [ 22.810540] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 22.811503] [ 22.812130] Last potentially related work creation: [ 22.812502] kasan_save_stack+0x3d/0x60 [ 22.813133] kasan_record_aux_stack+0xb2/0xc0 [ 22.813604] __call_rcu_common.constprop.0+0x72/0xa00 [ 22.814468] call_rcu+0x12/0x20 [ 22.815417] rcu_uaf+0x168/0x330 [ 22.816068] kunit_try_run_case+0x1b2/0x490 [ 22.816510] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.817291] kthread+0x323/0x710 [ 22.817950] ret_from_fork+0x41/0x80 [ 22.818387] ret_from_fork_asm+0x1a/0x30 [ 22.819054] [ 22.819280] The buggy address belongs to the object at ffff88810305fd00 [ 22.819280] which belongs to the cache kmalloc-32 of size 32 [ 22.820601] The buggy address is located 0 bytes inside of [ 22.820601] freed 32-byte region [ffff88810305fd00, ffff88810305fd20) [ 22.821515] [ 22.821710] The buggy address belongs to the physical page: [ 22.822964] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10305f [ 22.824223] flags: 0x200000000000000(node=0|zone=2) [ 22.824698] page_type: f5(slab) [ 22.825674] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 22.826578] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 22.827866] page dumped because: kasan: bad access detected [ 22.828570] [ 22.828703] Memory state around the buggy address: [ 22.828867] ffff88810305fc00: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 22.829080] ffff88810305fc80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 22.829438] >ffff88810305fd00: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 22.829904] ^ [ 22.831010] ffff88810305fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.831897] ffff88810305fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.832612] ==================================================================