Date
Feb. 5, 2025, 2:09 p.m.
Environment | |
---|---|
qemu-arm64 |
[ 182.863852] ================================================================== [ 182.865547] BUG: KASAN: slab-use-after-free in strnlen+0x3c/0x68 [ 182.866997] Read of size 1 at addr ffff0000c5f6ec10 by task kunit_try_catch/204 [ 182.869038] [ 182.869748] CPU: 0 PID: 204 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 182.871476] Hardware name: linux,dummy-virt (DT) [ 182.872551] Call trace: [ 182.873271] dump_backtrace+0x9c/0x128 [ 182.874370] show_stack+0x20/0x38 [ 182.875367] dump_stack_lvl+0x60/0xb0 [ 182.876498] print_report+0xf8/0x5d8 [ 182.877632] kasan_report+0xc8/0x118 [ 182.878786] __asan_load1+0x60/0x70 [ 182.879873] strnlen+0x3c/0x68 [ 182.880859] kasan_strings+0x1a4/0x478 [ 182.881980] kunit_try_run_case+0xf8/0x260 [ 182.883163] kunit_generic_run_threadfn_adapter+0x38/0x60 [ 182.884639] kthread+0x18c/0x1a8 [ 182.885563] ret_from_fork+0x10/0x20 [ 182.886676] [ 182.887238] Allocated by task 204: [ 182.888141] kasan_save_stack+0x3c/0x68 [ 182.889268] kasan_set_track+0x2c/0x40 [ 182.890406] kasan_save_alloc_info+0x24/0x38 [ 182.891721] __kasan_kmalloc+0xd4/0xd8 [ 182.892862] kmalloc_trace+0x68/0x130 [ 182.893939] kasan_strings+0xa0/0x478 [ 182.895008] kunit_try_run_case+0xf8/0x260 [ 182.896192] kunit_generic_run_threadfn_adapter+0x38/0x60 [ 182.897644] kthread+0x18c/0x1a8 [ 182.898611] ret_from_fork+0x10/0x20 [ 182.899682] [ 182.900171] Freed by task 204: [ 182.901060] kasan_save_stack+0x3c/0x68 [ 182.902256] kasan_set_track+0x2c/0x40 [ 182.903371] kasan_save_free_info+0x38/0x60 [ 182.904628] __kasan_slab_free+0x100/0x170 [ 182.906660] __kmem_cache_free+0x170/0x2e0 [ 182.907870] kfree+0x74/0x138 [ 182.908823] kasan_strings+0xbc/0x478 [ 182.909872] kunit_try_run_case+0xf8/0x260 [ 182.911100] kunit_generic_run_threadfn_adapter+0x38/0x60 [ 182.912548] kthread+0x18c/0x1a8 [ 182.913507] ret_from_fork+0x10/0x20 [ 182.914601] [ 182.915117] The buggy address belongs to the object at ffff0000c5f6ec00 [ 182.915117] which belongs to the cache kmalloc-32 of size 32 [ 182.917485] The buggy address is located 16 bytes inside of [ 182.917485] freed 32-byte region [ffff0000c5f6ec00, ffff0000c5f6ec20) [ 182.919841] [ 182.920468] The buggy address belongs to the physical page: [ 182.921755] page:00000000e8269612 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f6e [ 182.923711] flags: 0xbfffc0000000800(slab|node=0|zone=2|lastcpupid=0xffff) [ 182.925242] page_type: 0xffffffff() [ 182.926289] raw: 0bfffc0000000800 ffff0000c0001500 dead000000000122 0000000000000000 [ 182.928032] raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000 [ 182.929627] page dumped because: kasan: bad access detected [ 182.930898] [ 182.931399] Memory state around the buggy address: [ 182.932626] ffff0000c5f6eb00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 182.934240] ffff0000c5f6eb80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 182.935816] >ffff0000c5f6ec00: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 182.937389] ^ [ 182.938347] ffff0000c5f6ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 182.939970] ffff0000c5f6ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 182.941481] ==================================================================