Date
Feb. 5, 2025, 2:09 p.m.
Environment | |
---|---|
qemu-arm64 |
[ 182.700220] ================================================================== [ 182.702221] BUG: KASAN: slab-use-after-free in kasan_strings+0x150/0x478 [ 182.704516] Read of size 1 at addr ffff0000c5f6ec10 by task kunit_try_catch/204 [ 182.706614] [ 182.707343] CPU: 1 PID: 204 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 182.709201] Hardware name: linux,dummy-virt (DT) [ 182.710354] Call trace: [ 182.711116] dump_backtrace+0x9c/0x128 [ 182.712228] show_stack+0x20/0x38 [ 182.713243] dump_stack_lvl+0x60/0xb0 [ 182.714425] print_report+0xf8/0x5d8 [ 182.715538] kasan_report+0xc8/0x118 [ 182.716697] __asan_load1+0x60/0x70 [ 182.717833] kasan_strings+0x150/0x478 [ 182.718955] kunit_try_run_case+0xf8/0x260 [ 182.720177] kunit_generic_run_threadfn_adapter+0x38/0x60 [ 182.721661] kthread+0x18c/0x1a8 [ 182.722659] ret_from_fork+0x10/0x20 [ 182.723762] [ 182.724345] Allocated by task 204: [ 182.725236] kasan_save_stack+0x3c/0x68 [ 182.726402] kasan_set_track+0x2c/0x40 [ 182.727541] kasan_save_alloc_info+0x24/0x38 [ 182.728812] __kasan_kmalloc+0xd4/0xd8 [ 182.729989] kmalloc_trace+0x68/0x130 [ 182.731064] kasan_strings+0xa0/0x478 [ 182.732100] kunit_try_run_case+0xf8/0x260 [ 182.733277] kunit_generic_run_threadfn_adapter+0x38/0x60 [ 182.734723] kthread+0x18c/0x1a8 [ 182.735669] ret_from_fork+0x10/0x20 [ 182.736727] [ 182.737258] Freed by task 204: [ 182.738101] kasan_save_stack+0x3c/0x68 [ 182.739228] kasan_set_track+0x2c/0x40 [ 182.740345] kasan_save_free_info+0x38/0x60 [ 182.741587] __kasan_slab_free+0x100/0x170 [ 182.742793] __kmem_cache_free+0x170/0x2e0 [ 182.743993] kfree+0x74/0x138 [ 182.744920] kasan_strings+0xbc/0x478 [ 182.745979] kunit_try_run_case+0xf8/0x260 [ 182.747168] kunit_generic_run_threadfn_adapter+0x38/0x60 [ 182.748615] kthread+0x18c/0x1a8 [ 182.749538] ret_from_fork+0x10/0x20 [ 182.750641] [ 182.751123] The buggy address belongs to the object at ffff0000c5f6ec00 [ 182.751123] which belongs to the cache kmalloc-32 of size 32 [ 182.753456] The buggy address is located 16 bytes inside of [ 182.753456] freed 32-byte region [ffff0000c5f6ec00, ffff0000c5f6ec20) [ 182.755740] [ 182.756329] The buggy address belongs to the physical page: [ 182.757619] page:00000000e8269612 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f6e [ 182.759466] flags: 0xbfffc0000000800(slab|node=0|zone=2|lastcpupid=0xffff) [ 182.761042] page_type: 0xffffffff() [ 182.762059] raw: 0bfffc0000000800 ffff0000c0001500 dead000000000122 0000000000000000 [ 182.763720] raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000 [ 182.765288] page dumped because: kasan: bad access detected [ 182.766526] [ 182.767066] Memory state around the buggy address: [ 182.768290] ffff0000c5f6eb00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 182.769901] ffff0000c5f6eb80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 182.771467] >ffff0000c5f6ec00: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 182.772982] ^ [ 182.773987] ffff0000c5f6ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 182.775534] ffff0000c5f6ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 182.777093] ==================================================================