hi, Al Viro,
we noticed parent has another KASAN issue at the similar position as 95688800ee.
(one dmesg is attached as dmesg-parent.xz FYI).
41a0ecc0997cd40d 95688800eefe28240204c2a0dd2
---------------- ---------------------------
fail:runs %reproduction fail:runs
| | |
6:6 -83% :6 dmesg.BUG:KASAN:slab-use-after-free_in_debugfs_locked_down
:6 100% 6:6 dmesg.BUG:KASAN:slab-use-after-free_in_full_proxy_read
we don't have enough knowledge if 95688800ee fixes the issue in parent commit,
or if it raises the new issue. so still make out below report FYI.
Hello,
kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_full_proxy_read" on:
commit: 95688800eefe28240204c2a0dd2bca5bf5f7f1d9 ("debugfs: don't mess with bits in ->d_fsdata")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
[test failed on linux-next/master 5ffa57f6eecefababb8cbe327222ef171943b183]
in testcase: hwsim
version: hwsim-x86_64-4ea2c336d-1_20241103
with following parameters:
test: group-19
config: x86_64-rhel-9.4-func
compiler: gcc-12
test machine: 4 threads Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz (Skylake) with 32G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-lkp/202501261538.5d0a7232-lkp@xxxxxxxxx
[ 231.391189][ T6580] BUG: KASAN: slab-use-after-free in full_proxy_read (fs/debugfs/file.c:383)
[ 231.399064][ T298]
[ 231.403194][ T6580] Read of size 8 at addr ffff8888683ed718 by task cat/6580
[ 231.403198][ T6580]
[ 231.403200][ T6580] CPU: 0 UID: 0 PID: 6580 Comm: cat Tainted: G I 6.13.0-rc7-00074-g95688800eefe #1
[ 231.410986][ T298] ssid_verified=1
[ 231.412859][ T6580] Tainted: [I]=FIRMWARE_WORKAROUND
[ 231.412861][ T6580] Hardware name: Dell Inc. OptiPlex 7040/0Y7WYT, BIOS 1.1.1 10/07/2015
[ 231.419849][ T298]
[ 231.422004][ T6580] Call Trace:
[ 231.422023][ T6580] <TASK>
[ 231.422024][ T6580] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1))
[ 231.432660][ T298] bigtk_set=1
[ 231.435900][ T6580] print_address_description+0x2c/0x3a0
[ 231.435906][ T6580] ? full_proxy_read (fs/debugfs/file.c:383)
[ 231.440830][ T298]
[ 231.448836][ T6580] print_report (mm/kasan/report.c:490)
[ 231.448840][ T6580] ? kasan_addr_to_slab (mm/kasan/common.c:37)
[ 231.451038][ T298]
[ 231.454136][ T6580] ? full_proxy_read (fs/debugfs/file.c:383)
[ 231.454139][ T6580] kasan_report (mm/kasan/report.c:604)
[ 231.456913][ T298]
[ 231.461221][ T6580] ? full_proxy_read (fs/debugfs/file.c:383)
[ 231.461225][ T6580] full_proxy_read (fs/debugfs/file.c:383)
[ 231.461229][ T6580] vfs_read (fs/read_write.c:563)
[ 231.461233][ T6580] ? __pfx___do_sys_newfstatat (fs/stat.c:526)
[ 231.461237][ T6580] ? __pfx_vfs_read (fs/read_write.c:546)
[ 231.461255][ T6580] ? __handle_mm_fault (mm/memory.c:5944)
[ 231.461260][ T6580] ? fdget_pos (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/file_ref.h:171 fs/file.c:1182 fs/file.c:1190)
[ 231.461278][ T6580] ? __pfx___handle_mm_fault (mm/memory.c:5853)
[ 231.461283][ T6580] ksys_read (fs/read_write.c:708)
[ 231.461299][ T6580] ? __pfx_ksys_read (fs/read_write.c:698)
[ 231.461303][ T6580] ? __count_memcg_events (mm/memcontrol.c:583 mm/memcontrol.c:857)
[ 231.461309][ T6580] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
[ 231.461313][ T6580] ? handle_mm_fault (mm/memory.c:5986 mm/memory.c:6138)
[ 231.560515][ T6580] ? do_user_addr_fault (include/linux/rcupdate.h:882 include/linux/mm.h:742 arch/x86/mm/fault.c:1340)
[ 231.565529][ T6580] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:92 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)
[ 231.570031][ T6580] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 231.575742][ T6580] RIP: 0033:0x7f13a99d019d
[ 231.579976][ T6580] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 54 0a 00 e8 49 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 24 0e 00 00 74 17 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec
All code
========
0: 31 c0 xor %eax,%eax
2: e9 c6 fe ff ff jmp 0xfffffffffffffecd
7: 50 push %rax
8: 48 8d 3d 66 54 0a 00 lea 0xa5466(%rip),%rdi # 0xa5475
f: e8 49 ff 01 00 call 0x1ff5d
14: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
1b: 00 00
1d: 80 3d 41 24 0e 00 00 cmpb $0x0,0xe2441(%rip) # 0xe2465
24: 74 17 je 0x3d
26: 31 c0 xor %eax,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 5b ja 0x8d
32: c3 ret
33: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
3a: 00 00 00
3d: 48 rex.W
3e: 83 .byte 0x83
3f: ec in (%dx),%al
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 5b ja 0x63
8: c3 ret
9: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
10: 00 00 00
13: 48 rex.W
14: 83 .byte 0x83
15: ec in (%dx),%al
[ 231.599275][ T6580] RSP: 002b:00007fff93594a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 231.607481][ T6580] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f13a99d019d
[ 231.615257][ T6580] RDX: 0000000000020000 RSI: 00007f13a9859000 RDI: 0000000000000003
[ 231.623032][ T6580] RBP: 0000000000020000 R08: 00000000ffffffff R09: 0000000000000000
[ 231.630824][ T6580] R10: 00007f13a98e7b60 R11: 0000000000000246 R12: 00007f13a9859000
[ 231.638589][ T6580] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000000000
[ 231.646356][ T6580] </TASK>
[ 231.649214][ T6580]
[ 231.651382][ T6580] Allocated by task 5375:
[ 231.655531][ T6580] kasan_save_stack (mm/kasan/common.c:48)
[ 231.660030][ T6580] kasan_save_track (arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69)
[ 231.664538][ T6580] __kasan_kmalloc (mm/kasan/common.c:377 mm/kasan/common.c:394)
[ 231.668946][ T6580] __kmalloc_node_noprof (include/linux/kasan.h:260 mm/slub.c:4298 mm/slub.c:4304)
[ 231.674057][ T6580] alloc_slab_obj_exts (mm/slub.c:1966)
[ 231.678811][ T6580] allocate_slab (mm/slub.c:2552 mm/slub.c:2607)
[ 231.683219][ T6580] ___slab_alloc (mm/slub.c:3830 (discriminator 3))
[ 231.687626][ T6580] kmem_cache_alloc_noprof (mm/slub.c:3920 mm/slub.c:3995 mm/slub.c:4156 mm/slub.c:4175)
[ 231.692894][ T6580] alloc_empty_file (fs/file_table.c:228)
[ 231.697474][ T6580] path_openat (fs/namei.c:3973)
[ 231.701624][ T6580] do_filp_open (fs/namei.c:4014)
[ 231.705944][ T6580] do_sys_openat2 (fs/open.c:1402)
[ 231.710437][ T6580] __x64_sys_openat (fs/open.c:1428)
[ 231.715104][ T6580] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
[ 231.719426][ T6580] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 231.725125][ T6580]
[ 231.727292][ T6580] Freed by task 0:
[ 231.730836][ T6580] kasan_save_stack (mm/kasan/common.c:48)
[ 231.735331][ T6580] kasan_save_track (arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69)
[ 231.739823][ T6580] kasan_save_free_info (mm/kasan/generic.c:585)
[ 231.744663][ T6580] __kasan_slab_free (mm/kasan/common.c:271)
[ 231.749243][ T6580] kfree (mm/slub.c:4613 mm/slub.c:4761)
[ 231.752878][ T6580] __free_slab (mm/slub.c:2020 mm/slub.c:2562 mm/slub.c:2658)
[ 231.757029][ T6580] rcu_do_batch (kernel/rcu/tree.c:2567)
[ 231.761364][ T6580] rcu_core (kernel/rcu/tree.c:2825)
[ 231.765344][ T6580] handle_softirqs (kernel/softirq.c:561)
[ 231.769925][ T6580] __irq_exit_rcu (kernel/softirq.c:596 kernel/softirq.c:435 kernel/softirq.c:662)
[ 231.774419][ T6580] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1049 arch/x86/kernel/apic/apic.c:1049)
[ 231.779861][ T6580] asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:702)
[ 231.785646][ T6580]
[ 231.787814][ T6580] The buggy address belongs to the object at ffff8888683ed700
[ 231.787814][ T6580] which belongs to the cache kmalloc-128 of size 128
[ 231.801602][ T6580] The buggy address is located 24 bytes inside of
[ 231.801602][ T6580] freed 128-byte region [ffff8888683ed700, ffff8888683ed780)
[ 231.815061][ T6580]
[ 231.817228][ T6580] The buggy address belongs to the physical page:
[ 231.823442][ T6580] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8683ed
[ 231.832081][ T6580] ksm flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
[ 231.839589][ T6580] page_type: f5(slab)
[ 231.843399][ T6580] raw: 0017ffffc0000000 ffff88810c842a00 ffffea002157bcc0 dead000000000003
[ 231.851776][ T6580] raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
[ 231.860157][ T6580] page dumped because: kasan: bad access detected
[ 231.866382][ T6580]
[ 231.868554][ T6580] Memory state around the buggy address:
[ 231.873998][ T6580] ffff8888683ed600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 231.881868][ T6580] ffff8888683ed680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 231.889718][ T6580] >ffff8888683ed700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 231.897568][ T6580] ^
[ 231.902234][ T6580] ffff8888683ed780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 231.910081][ T6580] ffff8888683ed800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 231.917932][ T6580] ==================================================================
[ 231.925861][ T6580] Disabling lock debugging due to kernel taint
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250126/202501261538.5d0a7232-lkp@xxxxxxxxx
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Attachment:
dmesg-parent.xz
Description: application/xz
