[ 16.530760][ T269] ================================================================== [ 16.531112][ T269] BUG: KASAN: slab-use-after-free in emit_its_trampoline+0xa5/0x300 [ 16.531369][ T269] Read of size 1 at addr ffff888001926720 by task modprobe/269 [ 16.531615][ T269] [ 16.531703][ T269] CPU: 2 UID: 0 PID: 269 Comm: modprobe Not tainted 6.16.0-rc2-virtme #1 PREEMPT(full) [ 16.531708][ T269] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 16.531709][ T269] Call Trace: [ 16.531711][ T269] [ 16.531713][ T269] dump_stack_lvl+0x82/0xd0 [ 16.531721][ T269] print_address_description.constprop.0+0x2c/0x400 [ 16.531726][ T269] ? emit_its_trampoline+0xa5/0x300 [ 16.531730][ T269] print_report+0xb4/0x270 [ 16.531733][ T269] ? emit_its_trampoline+0xa5/0x300 [ 16.531736][ T269] ? kasan_addr_to_slab+0x25/0x80 [ 16.531740][ T269] ? emit_its_trampoline+0xa5/0x300 [ 16.531743][ T269] kasan_report+0xca/0x100 [ 16.531747][ T269] ? emit_its_trampoline+0xa5/0x300 [ 16.531752][ T269] ? emit_its_trampoline+0xa5/0x300 [ 16.531755][ T269] __kasan_check_byte+0x3a/0x50 [ 16.531758][ T269] krealloc_noprof+0x3d/0x320 [ 16.531762][ T269] ? execmem_alloc+0xc0/0x240 [ 16.531767][ T269] emit_its_trampoline+0xa5/0x300 [ 16.531771][ T269] ? __x86_indirect_paranoid_thunk_rcx+0x2/0x2 [ 16.531777][ T269] ? __pi___x86_indirect_thunk_rax+0x20/0x20 [ 16.531781][ T269] apply_retpolines+0xcf/0x550 [ 16.531786][ T269] ? __pfx_apply_retpolines+0x10/0x10 [ 16.531789][ T269] ? __pfx___mutex_lock+0x10/0x10 [ 16.531800][ T269] module_finalize+0x3d5/0x9d0 [ 16.531805][ T269] ? add_kallsyms+0x7bf/0xf40 [ 16.531811][ T269] ? __pfx_module_finalize+0x10/0x10 [ 16.531815][ T269] ? __pfx_cmp_ex_sort+0x10/0x10 [ 16.531818][ T269] ? __pfx_swap_ex+0x10/0x10 [ 16.531823][ T269] load_module+0x139a/0x2660 [ 16.531830][ T269] ? __pfx_load_module+0x10/0x10 [ 16.531833][ T269] ? kernel_read_file+0x3f5/0x550 [ 16.531839][ T269] ? kernel_read_file+0x3d0/0x550 [ 16.531843][ T269] ? __pfx_kernel_read_file+0x10/0x10 [ 16.531847][ T269] ? add_chain_cache+0x110/0x370 [ 16.531852][ T269] ? init_module_from_file+0xe9/0x150 [ 16.531855][ T269] init_module_from_file+0xe9/0x150 [ 16.531858][ T269] ? __pfx_init_module_from_file+0x10/0x10 [ 16.531866][ T269] ? idempotent_init_module+0x31a/0x620 [ 16.531869][ T269] ? __lock_release+0x5d/0x170 [ 16.531873][ T269] ? do_raw_spin_unlock+0x58/0x220 [ 16.531878][ T269] idempotent_init_module+0x335/0x620 [ 16.531882][ T269] ? __pfx_idempotent_init_module+0x10/0x10 [ 16.531889][ T269] ? cap_capable+0x94/0x230 [ 16.531897][ T269] __x64_sys_finit_module+0xca/0x150 [ 16.531900][ T269] ? do_syscall_64+0x85/0x380 [ 16.531904][ T269] do_syscall_64+0xc1/0x380 [ 16.531907][ T269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 16.531911][ T269] RIP: 0033:0x7f40021cde5d [ 16.531916][ T269] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 [ 16.531918][ T269] RSP: 002b:00007ffd42fff4f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 16.531922][ T269] RAX: ffffffffffffffda RBX: 000056170d464960 RCX: 00007f40021cde5d [ 16.531925][ T269] RDX: 0000000000000000 RSI: 00005617086b3a2a RDI: 0000000000000005 [ 16.531926][ T269] RBP: 0000000000040000 R08: 0000000000000000 R09: 00007ffd42fff630 [ 16.531928][ T269] R10: 0000000000000005 R11: 0000000000000246 R12: 00005617086b3a2a [ 16.531930][ T269] R13: 000056170d464b10 R14: 000056170d464db0 R15: 0000000000000000 [ 16.531936][ T269] [ 16.531937][ T269] [ 16.542327][ T269] Allocated by task 266: [ 16.542455][ T269] kasan_save_stack+0x24/0x50 [ 16.542633][ T269] kasan_save_track+0x14/0x30 [ 16.542806][ T269] __kasan_kmalloc+0x7f/0x90 [ 16.542976][ T269] __kmalloc_noprof+0x1d4/0x470 [ 16.543151][ T269] virtqueue_add_split+0x6a7/0x1900 [ 16.543327][ T269] virtqueue_add_sgs+0x143/0x270 [ 16.543498][ T269] virtio_fs_enqueue_req+0x58c/0xfe0 [ 16.543671][ T269] virtio_fs_send_req+0x13a/0x710 [ 16.543843][ T269] __fuse_simple_request+0x22a/0xb50 [ 16.544019][ T269] fuse_file_put+0x170/0x1f0 [ 16.544212][ T269] fuse_release+0x134/0x1c0 [ 16.544389][ T269] __fput+0x35c/0xa80 [ 16.544525][ T269] task_work_run+0x134/0x220 [ 16.544703][ T269] exit_to_user_mode_loop+0xd1/0xe0 [ 16.544881][ T269] do_syscall_64+0x2fe/0x380 [ 16.545058][ T269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 16.545275][ T269] [ 16.545375][ T269] Freed by task 51: [ 16.545503][ T269] kasan_save_stack+0x24/0x50 [ 16.545677][ T269] kasan_save_track+0x14/0x30 [ 16.545859][ T269] kasan_save_free_info+0x3b/0x60 [ 16.546031][ T269] __kasan_slab_free+0x38/0x50 [ 16.546205][ T269] kfree+0x144/0x320 [ 16.546334][ T269] detach_buf_split+0x48d/0x6f0 [ 16.546509][ T269] virtqueue_get_buf_ctx_split+0x294/0x7f0 [ 16.546724][ T269] virtio_fs_requests_done_work+0x231/0x890 [ 16.546937][ T269] process_one_work+0xe43/0x1660 [ 16.547108][ T269] worker_thread+0x591/0xcf0 [ 16.547277][ T269] kthread+0x37b/0x600 [ 16.547407][ T269] ret_from_fork+0x243/0x320 [ 16.547579][ T269] ret_from_fork_asm+0x1a/0x30 [ 16.547752][ T269] [ 16.547841][ T269] The buggy address belongs to the object at ffff888001926720 [ 16.547841][ T269] which belongs to the cache kmalloc-96 of size 96 [ 16.548251][ T269] The buggy address is located 0 bytes inside of [ 16.548251][ T269] freed 96-byte region [ffff888001926720, ffff888001926780) [ 16.548661][ T269] [ 16.548748][ T269] The buggy address belongs to the physical page: [ 16.548959][ T269] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1926 [ 16.549261][ T269] flags: 0x80000000000000(node=0|zone=1) [ 16.549437][ T269] page_type: f5(slab) [ 16.549572][ T269] raw: 0080000000000000 ffff888001042340 ffffea0000141190 ffffea00000a9d90 [ 16.549878][ T269] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 16.550184][ T269] page dumped because: kasan: bad access detected [ 16.550393][ T269] [ 16.550476][ T269] Memory state around the buggy address: [ 16.550641][ T269] ffff888001926600: fc fc fc fc 00 00 00 00 00 00 00 00 00 fc fc fc [ 16.550891][ T269] ffff888001926680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.551137][ T269] >ffff888001926700: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb [ 16.551388][ T269] ^ [ 16.551554][ T269] ffff888001926780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.551802][ T269] ffff888001926800: fc fc fc fc 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.552047][ T269] ================================================================== [ 16.552346][ T269] Disabling lock debugging due to kernel taint WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr