From: Chuck Lever III <chuck.lever@oracle.com>
To: Eric Van Hensbergen <ericvh@kernel.org>,
Latchesar Ionkov <lucho@ionkov.net>,
Dominique Martinet <asmadeus@codewreck.org>
Cc: linux-fsdevel <linux-fsdevel@vger.kernel.org>,
"kdevops@lists.linux.dev" <kdevops@lists.linux.dev>
Subject: 9p KASAN splat
Date: Mon, 4 Mar 2024 17:29:24 +0000 [thread overview]
Message-ID: <D56DE98B-F6F1-4B38-A736-20B7E8B247FE@oracle.com> (raw)
While testing linux-next (20240304) under kdevops, I see
this KASAN splat, seems 100% reproducible:
==================================================================
BUG: KASAN: slab-use-after-free in v9fs_stat2inode_dotl+0x1f/0x3b0 [9p]
Read of size 8 at addr ffff888119369600 by task mount/666
CPU: 0 PID: 666 Comm: mount Not tainted 6.8.0-rc7-next-20240304 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x73/0xb0
print_report+0xc4/0x620
? preempt_count_sub+0x14/0xc0
? __virt_addr_valid+0x144/0x2f0
kasan_report+0xbd/0xf0
? v9fs_stat2inode_dotl+0x1f/0x3b0 [9p]
? v9fs_stat2inode_dotl+0x1f/0x3b0 [9p]
v9fs_stat2inode_dotl+0x1f/0x3b0 [9p]
v9fs_fid_iget_dotl+0x112/0x160 [9p]
v9fs_mount+0x27c/0x4c0 [9p]
? __pfx_v9fs_mount+0x10/0x10 [9p]
? vfs_parse_fs_string+0xd4/0x120
? __pfx_vfs_parse_fs_string+0x10/0x10
? __pfx_v9fs_mount+0x10/0x10 [9p]
legacy_get_tree+0x83/0xd0
vfs_get_tree+0x49/0x180
path_mount+0x61c/0xf90
? __pfx_path_mount+0x10/0x10
? user_path_at_empty+0x40/0x50
? kmem_cache_free+0x189/0x470
__x64_sys_mount+0x194/0x1d0
? __pfx___x64_sys_mount+0x10/0x10
? ktime_get_coarse_real_ts64+0x5c/0x80
do_syscall_64+0x6f/0x150
entry_SYSCALL_64_after_hwframe+0x6c/0x74
RIP: 0033:0x7fd2124e1b9e
Code: 48 8b 0d 6d 02 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3a 02 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd198cf698 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000055a9ad2149c0 RCX: 00007fd2124e1b9e
RDX: 000055a9ad214d00 RSI: 000055a9ad214d40 RDI: 000055a9ad214d20
RBP: 00007ffd198cf7c0 R08: 000055a9ad214c80 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 000055a9ad214d20 R14: 000055a9ad214d00 R15: 00007fd212611076
</TASK>
Allocated by task 666:
kasan_save_stack+0x1c/0x40
kasan_save_track+0x10/0x30
__kasan_kmalloc+0x8b/0x90
p9_client_getattr_dotl+0x3b/0x1d0
v9fs_fid_iget_dotl+0x7d/0x160 [9p]
v9fs_mount+0x27c/0x4c0 [9p]
legacy_get_tree+0x83/0xd0
vfs_get_tree+0x49/0x180
path_mount+0x61c/0xf90
__x64_sys_mount+0x194/0x1d0
do_syscall_64+0x6f/0x150
entry_SYSCALL_64_after_hwframe+0x6c/0x74
Freed by task 666:
kasan_save_stack+0x1c/0x40
kasan_save_track+0x10/0x30
kasan_save_free_info+0x37/0x60
poison_slab_object+0x103/0x180
__kasan_slab_free+0x10/0x30
kfree+0x107/0x390
v9fs_fid_iget_dotl+0xe5/0x160 [9p]
v9fs_mount+0x27c/0x4c0 [9p]
legacy_get_tree+0x83/0xd0
vfs_get_tree+0x49/0x180
path_mount+0x61c/0xf90
__x64_sys_mount+0x194/0x1d0
do_syscall_64+0x6f/0x150
entry_SYSCALL_64_after_hwframe+0x6c/0x74
The buggy address belongs to the object at ffff888119369600
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
freed 192-byte region [ffff888119369600, ffff8881193696c0)
The buggy address belongs to the physical page:
page does not match folio
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119369
ksm flags: 0x17fffe000000800(slab|node=0|zone=2|lastcpupid=0x3ffff)
page_type: 0xffffffff()
raw: 017fffe000000800 ffff888100042a00 ffffea0004735d80 dead000000000003
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888119369500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888119369580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888119369600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888119369680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888119369700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
fs/9p/vfs_inode_dotl.c:569
--
Chuck Lever
next reply other threads:[~2024-03-04 17:29 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-04 17:29 Chuck Lever III [this message]
2024-03-05 0:11 ` 9p KASAN splat Dominique Martinet
2024-03-05 18:08 ` Chuck Lever III
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=D56DE98B-F6F1-4B38-A736-20B7E8B247FE@oracle.com \
--to=chuck.lever@oracle.com \
--cc=asmadeus@codewreck.org \
--cc=ericvh@kernel.org \
--cc=kdevops@lists.linux.dev \
--cc=linux-fsdevel@vger.kernel.org \
--cc=lucho@ionkov.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).