Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 144.447344] ================================================================== [ 144.449094] BUG: KASAN: use-after-free in kmalloc_pagealloc_uaf+0xb4/0x1ac [ 144.449885] Read of size 1 at addr c8e28000 by task kunit_try_catch/119 [ 144.450566] [ 144.450833] CPU: 1 PID: 119 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 144.451563] Hardware name: Generic DT based system [ 144.452243] unwind_backtrace from show_stack+0x18/0x1c [ 144.452902] show_stack from dump_stack_lvl+0x58/0x70 [ 144.453672] dump_stack_lvl from print_report+0x164/0x51c [ 144.454413] print_report from kasan_report+0xc8/0x104 [ 144.455134] kasan_report from kmalloc_pagealloc_uaf+0xb4/0x1ac [ 144.455852] kmalloc_pagealloc_uaf from kunit_try_run_case+0x11c/0x2e4 [ 144.456753] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 144.458357] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 144.459164] kthread from ret_from_fork+0x14/0x30 [ 144.459942] Exception stack(0xf9ed3fb0 to 0xf9ed3ff8) [ 144.460551] 3fa0: 00000000 00000000 00000000 00000000 [ 144.461464] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 144.462310] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 144.463020] [ 144.463280] The buggy address belongs to the physical page: [ 144.463903] page:e8588773 refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x48e28 [ 144.464764] flags: 0x0(zone=0) [ 144.465178] page_type: 0xffffffff() [ 144.465664] raw: 00000000 edd38e34 e7b79e84 00000000 00000000 00000000 ffffffff 00000000 [ 144.466652] raw: 00000000 [ 144.466981] page dumped because: kasan: bad access detected [ 144.467698] [ 144.467916] Memory state around the buggy address: [ 144.468483] c8e27f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 144.469497] c8e27f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 144.470679] >c8e28000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 144.471495] ^ [ 144.471763] c8e28080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 144.472888] c8e28100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 144.473725] ==================================================================
[ 46.881685] ================================================================== [ 46.882713] BUG: KASAN: use-after-free in kmalloc_pagealloc_uaf+0xaf/0x1b0 [ 46.883415] Read of size 1 at addr ffff888102078000 by task kunit_try_catch/142 [ 46.884478] [ 46.884784] CPU: 0 PID: 142 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 46.886463] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 46.887824] Call Trace: [ 46.888227] <TASK> [ 46.888627] dump_stack_lvl+0x4e/0x90 [ 46.889253] print_report+0xd2/0x660 [ 46.889773] ? __virt_addr_valid+0x156/0x1e0 [ 46.890451] ? kasan_addr_to_slab+0x11/0xb0 [ 46.890947] kasan_report+0xff/0x140 [ 46.891366] ? kmalloc_pagealloc_uaf+0xaf/0x1b0 [ 46.891995] ? kmalloc_pagealloc_uaf+0xaf/0x1b0 [ 46.892620] __asan_load1+0x66/0x70 [ 46.893100] kmalloc_pagealloc_uaf+0xaf/0x1b0 [ 46.893627] ? __pfx_kmalloc_pagealloc_uaf+0x10/0x10 [ 46.894203] ? __schedule+0x70b/0x1190 [ 46.894726] ? ktime_get_ts64+0x118/0x140 [ 46.895261] kunit_try_run_case+0x126/0x290 [ 46.895884] ? __pfx_kunit_try_run_case+0x10/0x10 [ 46.896433] ? __kasan_check_write+0x18/0x20 [ 46.896993] ? trace_preempt_on+0x20/0xa0 [ 46.897578] ? __kthread_parkme+0x4f/0xd0 [ 46.898173] ? preempt_count_sub+0x50/0x80 [ 46.898758] ? __pfx_kunit_try_run_case+0x10/0x10 [ 46.899382] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 46.900216] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 46.900865] kthread+0x19e/0x1e0 [ 46.901427] ? __pfx_kthread+0x10/0x10 [ 46.902007] ret_from_fork+0x41/0x70 [ 46.902501] ? __pfx_kthread+0x10/0x10 [ 46.903075] ret_from_fork_asm+0x1b/0x30 [ 46.903695] </TASK> [ 46.904025] [ 46.904288] The buggy address belongs to the physical page: [ 46.904926] page:(____ptrval____) refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102078 [ 46.905873] flags: 0x200000000000000(node=0|zone=2) [ 46.906512] page_type: 0xffffffff() [ 46.907017] raw: 0200000000000000 ffffea0004081f08 ffff88815b43c8b8 0000000000000000 [ 46.907782] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 46.908380] page dumped because: kasan: bad access detected [ 46.908976] [ 46.909230] Memory state around the buggy address: [ 46.909801] ffff888102077f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.910438] ffff888102077f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.911232] >ffff888102078000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.911955] ^ [ 46.912292] ffff888102078080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.912839] ffff888102078100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 46.913644] ==================================================================