Hay
Date
Feb. 5, 2025, 2:09 p.m.

Environment
qemu-arm64

[  182.863852] ==================================================================
[  182.865547] BUG: KASAN: slab-use-after-free in strnlen+0x3c/0x68
[  182.866997] Read of size 1 at addr ffff0000c5f6ec10 by task kunit_try_catch/204
[  182.869038] 
[  182.869748] CPU: 0 PID: 204 Comm: kunit_try_catch Tainted: G    B            N 6.6.76-rc1 #1
[  182.871476] Hardware name: linux,dummy-virt (DT)
[  182.872551] Call trace:
[  182.873271]  dump_backtrace+0x9c/0x128
[  182.874370]  show_stack+0x20/0x38
[  182.875367]  dump_stack_lvl+0x60/0xb0
[  182.876498]  print_report+0xf8/0x5d8
[  182.877632]  kasan_report+0xc8/0x118
[  182.878786]  __asan_load1+0x60/0x70
[  182.879873]  strnlen+0x3c/0x68
[  182.880859]  kasan_strings+0x1a4/0x478
[  182.881980]  kunit_try_run_case+0xf8/0x260
[  182.883163]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  182.884639]  kthread+0x18c/0x1a8
[  182.885563]  ret_from_fork+0x10/0x20
[  182.886676] 
[  182.887238] Allocated by task 204:
[  182.888141]  kasan_save_stack+0x3c/0x68
[  182.889268]  kasan_set_track+0x2c/0x40
[  182.890406]  kasan_save_alloc_info+0x24/0x38
[  182.891721]  __kasan_kmalloc+0xd4/0xd8
[  182.892862]  kmalloc_trace+0x68/0x130
[  182.893939]  kasan_strings+0xa0/0x478
[  182.895008]  kunit_try_run_case+0xf8/0x260
[  182.896192]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  182.897644]  kthread+0x18c/0x1a8
[  182.898611]  ret_from_fork+0x10/0x20
[  182.899682] 
[  182.900171] Freed by task 204:
[  182.901060]  kasan_save_stack+0x3c/0x68
[  182.902256]  kasan_set_track+0x2c/0x40
[  182.903371]  kasan_save_free_info+0x38/0x60
[  182.904628]  __kasan_slab_free+0x100/0x170
[  182.906660]  __kmem_cache_free+0x170/0x2e0
[  182.907870]  kfree+0x74/0x138
[  182.908823]  kasan_strings+0xbc/0x478
[  182.909872]  kunit_try_run_case+0xf8/0x260
[  182.911100]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  182.912548]  kthread+0x18c/0x1a8
[  182.913507]  ret_from_fork+0x10/0x20
[  182.914601] 
[  182.915117] The buggy address belongs to the object at ffff0000c5f6ec00
[  182.915117]  which belongs to the cache kmalloc-32 of size 32
[  182.917485] The buggy address is located 16 bytes inside of
[  182.917485]  freed 32-byte region [ffff0000c5f6ec00, ffff0000c5f6ec20)
[  182.919841] 
[  182.920468] The buggy address belongs to the physical page:
[  182.921755] page:00000000e8269612 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f6e
[  182.923711] flags: 0xbfffc0000000800(slab|node=0|zone=2|lastcpupid=0xffff)
[  182.925242] page_type: 0xffffffff()
[  182.926289] raw: 0bfffc0000000800 ffff0000c0001500 dead000000000122 0000000000000000
[  182.928032] raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000
[  182.929627] page dumped because: kasan: bad access detected
[  182.930898] 
[  182.931399] Memory state around the buggy address:
[  182.932626]  ffff0000c5f6eb00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  182.934240]  ffff0000c5f6eb80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  182.935816] >ffff0000c5f6ec00: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[  182.937389]                          ^
[  182.938347]  ffff0000c5f6ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  182.939970]  ffff0000c5f6ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  182.941481] ==================================================================