Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 145.661830] ================================================================== [ 145.662827] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0xd8/0x1d4 [ 145.663661] Write of size 33 at addr c4fcfb80 by task kunit_try_catch/159 [ 145.664270] [ 145.664575] CPU: 0 PID: 159 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 145.665456] Hardware name: Generic DT based system [ 145.666091] unwind_backtrace from show_stack+0x18/0x1c [ 145.667345] show_stack from dump_stack_lvl+0x58/0x70 [ 145.668161] dump_stack_lvl from print_report+0x164/0x51c [ 145.668863] print_report from kasan_report+0xc8/0x104 [ 145.669565] kasan_report from kasan_check_range+0x14c/0x198 [ 145.670264] kasan_check_range from __asan_memset+0x20/0x3c [ 145.671024] __asan_memset from kmalloc_uaf_memset+0xd8/0x1d4 [ 145.671872] kmalloc_uaf_memset from kunit_try_run_case+0x11c/0x2e4 [ 145.672792] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.673730] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 145.674571] kthread from ret_from_fork+0x14/0x30 [ 145.675178] Exception stack(0xf9ff3fb0 to 0xf9ff3ff8) [ 145.676111] 3fa0: 00000000 00000000 00000000 00000000 [ 145.676976] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 145.677863] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 145.678590] [ 145.678835] Allocated by task 159: [ 145.679279] kasan_set_track+0x3c/0x5c [ 145.679844] __kasan_kmalloc+0x8c/0x94 [ 145.680365] kmalloc_uaf_memset+0xa0/0x1d4 [ 145.680971] kunit_try_run_case+0x11c/0x2e4 [ 145.681573] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.682219] kthread+0x184/0x1a8 [ 145.682661] ret_from_fork+0x14/0x30 [ 145.683112] [ 145.683448] Freed by task 159: [ 145.683979] kasan_set_track+0x3c/0x5c [ 145.684490] kasan_save_free_info+0x30/0x3c [ 145.685229] __kasan_slab_free+0xdc/0x124 [ 145.685941] __kmem_cache_free+0x140/0x2a8 [ 145.686891] kmalloc_uaf_memset+0xbc/0x1d4 [ 145.687681] kunit_try_run_case+0x11c/0x2e4 [ 145.688478] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.689095] kthread+0x184/0x1a8 [ 145.689500] ret_from_fork+0x14/0x30 [ 145.690088] [ 145.690322] The buggy address belongs to the object at c4fcfb80 [ 145.690322] which belongs to the cache kmalloc-64 of size 64 [ 145.691561] The buggy address is located 0 bytes inside of [ 145.691561] freed 64-byte region [c4fcfb80, c4fcfbc0) [ 145.692665] [ 145.692982] The buggy address belongs to the physical page: [ 145.693549] page:8516b471 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x44fcf [ 145.694496] flags: 0x800(slab|zone=0) [ 145.695019] page_type: 0xffffffff() [ 145.695522] raw: 00000800 c4801200 00000122 00000000 00000000 80200020 ffffffff 00000001 [ 145.697248] raw: 00000000 [ 145.697558] page dumped because: kasan: bad access detected [ 145.698282] [ 145.698525] Memory state around the buggy address: [ 145.699184] c4fcfa80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 145.699920] c4fcfb00: 00 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.700631] >c4fcfb80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 145.701327] ^ [ 145.701745] c4fcfc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.702516] c4fcfc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.703246] ==================================================================
[ 48.535642] ================================================================== [ 48.536501] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0xdb/0x1d0 [ 48.537599] Write of size 33 at addr ffff888102849080 by task kunit_try_catch/182 [ 48.538335] [ 48.538598] CPU: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 48.539639] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 48.540416] Call Trace: [ 48.540844] <TASK> [ 48.541200] dump_stack_lvl+0x4e/0x90 [ 48.542223] print_report+0xd2/0x660 [ 48.542816] ? __virt_addr_valid+0x156/0x1e0 [ 48.543625] ? kasan_complete_mode_report_info+0x64/0x200 [ 48.544513] kasan_report+0xff/0x140 [ 48.545155] ? kmalloc_uaf_memset+0xdb/0x1d0 [ 48.545838] ? kmalloc_uaf_memset+0xdb/0x1d0 [ 48.546582] kasan_check_range+0x10c/0x1c0 [ 48.547227] __asan_memset+0x27/0x50 [ 48.547919] kmalloc_uaf_memset+0xdb/0x1d0 [ 48.548468] ? __pfx_kmalloc_uaf_memset+0x10/0x10 [ 48.549249] ? __schedule+0x70b/0x1190 [ 48.550154] ? ktime_get_ts64+0x118/0x140 [ 48.550944] kunit_try_run_case+0x126/0x290 [ 48.551766] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.552568] ? __kasan_check_write+0x18/0x20 [ 48.553301] ? trace_preempt_on+0x20/0xa0 [ 48.553917] ? __kthread_parkme+0x4f/0xd0 [ 48.554566] ? preempt_count_sub+0x50/0x80 [ 48.555254] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.555828] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 48.556667] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.557579] kthread+0x19e/0x1e0 [ 48.558140] ? __pfx_kthread+0x10/0x10 [ 48.558588] ret_from_fork+0x41/0x70 [ 48.559032] ? __pfx_kthread+0x10/0x10 [ 48.559532] ret_from_fork_asm+0x1b/0x30 [ 48.560637] </TASK> [ 48.561184] [ 48.561821] Allocated by task 182: [ 48.562294] kasan_save_stack+0x3c/0x60 [ 48.563010] kasan_set_track+0x29/0x40 [ 48.563721] kasan_save_alloc_info+0x22/0x30 [ 48.564223] __kasan_kmalloc+0xb7/0xc0 [ 48.564634] kmalloc_trace+0x4c/0xb0 [ 48.565065] kmalloc_uaf_memset+0x9d/0x1d0 [ 48.565501] kunit_try_run_case+0x126/0x290 [ 48.566807] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.567728] kthread+0x19e/0x1e0 [ 48.568380] ret_from_fork+0x41/0x70 [ 48.569092] ret_from_fork_asm+0x1b/0x30 [ 48.569718] [ 48.570292] Freed by task 182: [ 48.570637] kasan_save_stack+0x3c/0x60 [ 48.571295] kasan_set_track+0x29/0x40 [ 48.572199] kasan_save_free_info+0x2f/0x50 [ 48.572913] ____kasan_slab_free+0x172/0x1d0 [ 48.573356] __kasan_slab_free+0x16/0x20 [ 48.574119] __kmem_cache_free+0x190/0x310 [ 48.574714] kfree+0x7c/0x120 [ 48.575446] kmalloc_uaf_memset+0xbd/0x1d0 [ 48.576034] kunit_try_run_case+0x126/0x290 [ 48.576977] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.577705] kthread+0x19e/0x1e0 [ 48.578192] ret_from_fork+0x41/0x70 [ 48.578641] ret_from_fork_asm+0x1b/0x30 [ 48.579611] [ 48.580193] The buggy address belongs to the object at ffff888102849080 [ 48.580193] which belongs to the cache kmalloc-64 of size 64 [ 48.581899] The buggy address is located 0 bytes inside of [ 48.581899] freed 64-byte region [ffff888102849080, ffff8881028490c0) [ 48.583217] [ 48.583515] The buggy address belongs to the physical page: [ 48.584579] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102849 [ 48.585331] flags: 0x200000000000800(slab|node=0|zone=2) [ 48.586284] page_type: 0xffffffff() [ 48.587141] raw: 0200000000000800 ffff888100041640 dead000000000122 0000000000000000 [ 48.588115] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 48.589177] page dumped because: kasan: bad access detected [ 48.589722] [ 48.589999] Memory state around the buggy address: [ 48.590435] ffff888102848f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.591574] ffff888102849000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 48.592530] >ffff888102849080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 48.593395] ^ [ 48.594043] ffff888102849100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.595043] ffff888102849180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.595937] ==================================================================