On Tue, 5 Sep 2023 20:54:40 +0800
Zheng Yejian <zhengyejian1@xxxxxxxxxx> wrote:
> Hi, Steve, Ajay,
>
> After this patch and run this testcase, I got an use-after-free report
> by KASAN. Short log see [1], full logs see attach "panic.log".
>
> And by simple bisect, I found it may be introduced by:
>
> 27152bceea1d ("eventfs: Move tracing/events to eventfs")
>
> Link:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=27152bceea1df27ffebb12ac9cd9adbf2c4c3f35
>
> [1]
> # ./ftracetest test.d/instances/instance-event.tc
> === Ftrace unit tests ===
> [1] Test creation and deletion of trace instances while setting an
> event[ 89.472397]
> ==================================================================
> [ 89.475053] BUG: KASAN: slab-use-after-free in
> __ftrace_event_enable_disable+0x1b/0x3a0
> [ 89.480039] Read of size 8 at addr ffff88814f5b2690 by task
> ftracetest/392
> [ 89.483906]
> [ 89.484560] CPU: 10 PID: 392 Comm: ftracetest Tainted: G W
> 6.5.0+ #127
> [ 89.487033] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
> [ 89.489751] Call Trace:
> [ 89.490315] <TASK>
> [ 89.490817] dump_stack_lvl+0x4b/0x80
> [ 89.491570] print_report+0xd0/0x620
> [ 89.492296] ? __virt_addr_valid+0xf9/0x180
> [ 89.493134] ? __ftrace_event_enable_disable+0x1b/0x3a0
> [ 89.494151] kasan_report+0xb6/0xf0
> [ 89.494881] ? __ftrace_event_enable_disable+0x1b/0x3a0
> [ 89.495878] __ftrace_event_enable_disable+0x1b/0x3a0
> [ 89.496805] event_enable_write+0x109/0x170
> [ 89.497631] ? __pfx_event_enable_write+0x10/0x10
> [ 89.498618] ? __pfx_bpf_lsm_file_permission+0x10/0x10
> [ 89.499659] ? security_file_permission+0x51/0x2d0
> [ 89.500604] vfs_write+0x175/0x670
> [ 89.501385] ? __pfx_vfs_write+0x10/0x10
> [ 89.502246] ? __pfx__raw_spin_lock+0x10/0x10
> [ 89.503187] ? expand_files+0x9b/0x330
> [ 89.504011] ? __pfx_expand_files+0x10/0x10
> [ 89.504898] ? set_close_on_exec+0x7b/0xe0
> [ 89.505782] ? __fget_light+0xae/0x1e0
> [ 89.506615] ? _raw_spin_lock+0x85/0xe0
> [ 89.507989] ksys_write+0xbd/0x160
> [ 89.509302] ? __pfx_ksys_write+0x10/0x10
> [ 89.510493] ? dnotify_flush+0x38/0x220
> [ 89.511654] ? fpregs_assert_state_consistent+0x5a/0x70
> [ 89.513297] ? exit_to_user_mode_prepare+0x32/0x110
> [ 89.514692] do_syscall_64+0x3f/0x90
> [ 89.515516] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
I wonder if this is related to:
https://lore.kernel.org/all/202309050916.58201dc6-oliver.sang@xxxxxxxxx/
Which I'm currently debugging.
-- Steve
