kasan BUG log
[ 494.755726][ C0] BUG: KASAN: use-after-free in collect_expired_timers+0x174/0x1d8 [ 494.758452][ C0] Write of size 8 at addr ffff800068868538 by task swapper/0/0 [ 494.761000][ C0] [ 494.761914][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.0.0-rc8-next-20190301-00013-g4c430594824f #1 [ 494.765290][ C0] Hardware name: linux,dummy-virt (DT) [ 494.767168][ C0] Call trace: [ 494.768358][ C0] dump_backtrace+0x0/0x280 [ 494.769970][ C0] show_stack+0x28/0x38 [ 494.771446][ C0] dump_stack+0x110/0x190 [ 494.772992][ C0] print_address_description+0x2cc/0x308 [ 494.774994][ C0] kasan_report+0x164/0x1b0 [ 494.776596][ C0] __asan_store8+0x94/0xa0 [ 494.778179][ C0] collect_expired_timers+0x174/0x1d8 [ 494.780059][ C0] run_timer_softirq+0x184/0x3f8 [ 494.781820][ C0] __do_softirq+0x54c/0xa58 [ 494.783408][ C0] irq_exit+0x150/0x1d0 [ 494.784892][ C0] __handle_domain_irq+0x114/0x158 [ 494.786709][ C0] gic_handle_irq+0x90/0xf8 [ 494.788293][ C0] el1_irq+0x100/0x200 [ 494.789768][ C0] arch_cpu_idle+0x270/0x4f0 [ 494.791398][ C0] default_idle_call+0x48/0x58 [ 494.793105][ C0] do_idle+0x264/0x3e0 [ 494.794568][ C0] cpu_startup_entry+0x2c/0x30 [ 494.796253][ C0] rest_init+0x458/0x46c [ 494.797801][ C0] arch_call_rest_init+0x18/0x20 [ 494.799548][ C0] start_kernel+0x6f4/0x734 [ 494.801130][ C0] [ 494.801989][ C0] Allocated by task 1: [ 494.803453][ C0] __kasan_kmalloc.isra.0+0xbc/0x178 [ 494.805334][ C0] kasan_kmalloc+0xc/0x18 [ 494.806870][ C0] kmem_cache_alloc_trace+0x56c/0x5c8 [ 494.808752][ C0] i2cdev_attach_adapter+0xc0/0x2c8 [ 494.810612][ C0] i2cdev_notifier_call+0x5c/0x90 [ 494.812382][ C0] notifier_call_chain+0x108/0x1b0 [ 494.814214][ C0] __blocking_notifier_call_chain+0x7c/0xb0 [ 494.816271][ C0] blocking_notifier_call_chain+0x40/0x50 [ 494.818274][ C0] device_add+0x884/0xc00 [ 494.819820][ C0] device_register+0x2c/0x38 [ 494.821477][ C0] i2c_register_adapter+0x27c/0x6f0 [ 494.823295][ C0] i2c_add_adapter+0x110/0x130 [ 494.824980][ C0] i2c_add_numbered_adapter+0x48/0x78 [ 494.826899][ C0] unittest_i2c_bus_probe+0x1a8/0x1f4 [ 494.828778][ C0] platform_drv_probe+0xd8/0x1a8 [ 494.830741][ C0] really_probe+0x424/0x840 [ 494.832366][ C0] driver_probe_device+0x16c/0x238 [ 494.834216][ C0] device_driver_attach+0x90/0xc0 [ 494.835979][ C0] __driver_attach+0x1e8/0x200 [ 494.837697][ C0] bus_for_each_dev+0xf8/0x190 [ 494.839400][ C0] driver_attach+0x3c/0x48 [ 494.840986][ C0] bus_add_driver+0x20c/0x3d0 [ 494.842658][ C0] driver_register+0x168/0x200 [ 494.844369][ C0] __platform_driver_register+0x84/0x90 [ 494.846344][ C0] of_unittest_overlay+0x1444/0x14e8 [ 494.848200][ C0] of_unittest+0x2034/0x28a4 [ 494.849842][ C0] do_one_initcall+0x490/0x9bc [ 494.851546][ C0] kernel_init_freeable+0xb94/0xcc0 [ 494.853398][ C0] kernel_init+0x1c/0x204 [ 494.854945][ C0] ret_from_fork+0x10/0x18 [ 494.856487][ C0] [ 494.857356][ C0] Freed by task 1: [ 494.858762][ C0] __kasan_slab_free+0x140/0x200 [ 494.860495][ C0] kasan_slab_free+0x10/0x18 [ 494.862116][ C0] kfree+0x3f4/0x608 [ 494.863457][ C0] put_i2c_dev+0xc8/0xd8 [ 494.864915][ C0] i2cdev_detach_adapter+0x70/0xd8 [ 494.866775][ C0] i2cdev_notifier_call+0x74/0x90 [ 494.868527][ C0] notifier_call_chain+0x108/0x1b0 [ 494.870292][ C0] __blocking_notifier_call_chain+0x7c/0xb0 [ 494.872204][ C0] blocking_notifier_call_chain+0x40/0x50 [ 494.874059][ C0] device_del+0x108/0x5b0 [ 494.875578][ C0] device_unregister+0x78/0x98 [ 494.877268][ C0] i2c_del_adapter+0x36c/0x3c8 [ 494.878820][ C0] unittest_i2c_bus_remove+0x88/0xa0 [ 494.880531][ C0] platform_drv_remove+0x44/0x70 [ 494.882211][ C0] really_probe+0x488/0x840 [ 494.883710][ C0] driver_probe_device+0x16c/0x238 [ 494.885514][ C0] device_driver_attach+0x90/0xc0 [ 494.887283][ C0] __driver_attach+0x1e8/0x200 [ 494.888910][ C0] bus_for_each_dev+0xf8/0x190 [ 494.890617][ C0] driver_attach+0x3c/0x48 [ 494.892179][ C0] bus_add_driver+0x20c/0x3d0 [ 494.893847][ C0] driver_register+0x168/0x200 [ 494.895489][ C0] __platform_driver_register+0x84/0x90 [ 494.897367][ C0] of_unittest_overlay+0x1444/0x14e8 [ 494.899235][ C0] of_unittest+0x2034/0x28a4 [ 494.900861][ C0] do_one_initcall+0x490/0x9bc [ 494.902588][ C0] kernel_init_freeable+0xb94/0xcc0 [ 494.904429][ C0] kernel_init+0x1c/0x204 [ 494.905941][ C0] ret_from_fork+0x10/0x18 [ 494.907389][ C0] [ 494.908198][ C0] The buggy address belongs to the object at ffff800068868480 [ 494.908198][ C0] which belongs to the cache kmalloc-512 of size 512 [ 494.912942][ C0] The buggy address is located 184 bytes inside of [ 494.912942][ C0] 512-byte region [ffff800068868480, ffff800068868680) [ 494.917228][ C0] The buggy address belongs to the page: [ 494.919084][ C0] page:ffff7e0001a21a00 count:1 mapcount:0 mapping:ffff80003fc0c980 index:0x0 compound_mapcount: 0 [ 494.922710][ C0] flags: 0xffff00000010200(slab|head) [ 494.924623][ C0] raw: 0ffff00000010200 ffff7e0001a21608 ffff7e0001a22588 ffff80003fc0c980 [ 494.927501][ C0] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 494.930369][ C0] page dumped because: kasan: bad access detected [ 494.932528][ C0] [ 494.933358][ C0] Memory state around the buggy address: [ 494.935202][ C0] ffff800068868400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 494.937786][ C0] ffff800068868480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 494.940516][ C0] >ffff800068868500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
KASAN_SHADOW_OFFSET
#define KASAN_SHADOW_OFFSET KASAN_SHADOW_START - ((KASAN_SHADOW_START + KASAN_SHADOW_SIZE) - (1ULL << \ (64 - KASAN_SHADOW_SCALE_SHIFT))) /*64-3 = 61, 2^61, KASAN_SHADOW_OFFSET is FFFFFF9000000000 - 2000000000000000 = 0xDFFFFF9000000000*/
kasan compilor support
Generic KASAN is supported in both GCC and Clang. With GCC it requires version 4.9.2 or later for basic support and version 5.0 or later for detection of out-of-bounds accesses for stack and global variables and for inline instrumentation mode (see the Usage section). With Clang it requires version 7.0.0 or later and it doesn't support detection of out-of-bounds accesses for global variables yet.
from: https://01.org/linuxgraphics/gfx-docs/drm/dev-tools/kasan.html
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】凌霞软件回馈社区,博客园 & 1Panel & Halo 联合会员上线
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】博客园社区专享云产品让利特惠,阿里云新客6.5折上折
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步
· 浏览器原生「磁吸」效果!Anchor Positioning 锚点定位神器解析
· 没有源码,如何修改代码逻辑?
· 一个奇形怪状的面试题:Bean中的CHM要不要加volatile?
· [.NET]调用本地 Deepseek 模型
· 一个费力不讨好的项目,让我损失了近一半的绩效!
· 在鹅厂做java开发是什么体验
· 百万级群聊的设计实践
· WPF到Web的无缝过渡:英雄联盟客户端的OpenSilver迁移实战
· 永远不要相信用户的输入:从 SQL 注入攻防看输入验证的重要性
· 浏览器原生「磁吸」效果!Anchor Positioning 锚点定位神器解析