kasan BUG log

[  494.755726][    C0] BUG: KASAN: use-after-free in
collect_expired_timers+0x174/0x1d8
[  494.758452][    C0] Write of size 8 at addr ffff800068868538 by
task swapper/0/0
[  494.761000][    C0]
[  494.761914][    C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
5.0.0-rc8-next-20190301-00013-g4c430594824f #1
[  494.765290][    C0] Hardware name: linux,dummy-virt (DT)
[  494.767168][    C0] Call trace:
[  494.768358][    C0]  dump_backtrace+0x0/0x280
[  494.769970][    C0]  show_stack+0x28/0x38
[  494.771446][    C0]  dump_stack+0x110/0x190
[  494.772992][    C0]  print_address_description+0x2cc/0x308
[  494.774994][    C0]  kasan_report+0x164/0x1b0
[  494.776596][    C0]  __asan_store8+0x94/0xa0
[  494.778179][    C0]  collect_expired_timers+0x174/0x1d8
[  494.780059][    C0]  run_timer_softirq+0x184/0x3f8
[  494.781820][    C0]  __do_softirq+0x54c/0xa58
[  494.783408][    C0]  irq_exit+0x150/0x1d0
[  494.784892][    C0]  __handle_domain_irq+0x114/0x158
[  494.786709][    C0]  gic_handle_irq+0x90/0xf8
[  494.788293][    C0]  el1_irq+0x100/0x200
[  494.789768][    C0]  arch_cpu_idle+0x270/0x4f0
[  494.791398][    C0]  default_idle_call+0x48/0x58
[  494.793105][    C0]  do_idle+0x264/0x3e0
[  494.794568][    C0]  cpu_startup_entry+0x2c/0x30
[  494.796253][    C0]  rest_init+0x458/0x46c
[  494.797801][    C0]  arch_call_rest_init+0x18/0x20
[  494.799548][    C0]  start_kernel+0x6f4/0x734
[  494.801130][    C0]
[  494.801989][    C0] Allocated by task 1:
[  494.803453][    C0]  __kasan_kmalloc.isra.0+0xbc/0x178
[  494.805334][    C0]  kasan_kmalloc+0xc/0x18
[  494.806870][    C0]  kmem_cache_alloc_trace+0x56c/0x5c8
[  494.808752][    C0]  i2cdev_attach_adapter+0xc0/0x2c8
[  494.810612][    C0]  i2cdev_notifier_call+0x5c/0x90
[  494.812382][    C0]  notifier_call_chain+0x108/0x1b0
[  494.814214][    C0]  __blocking_notifier_call_chain+0x7c/0xb0
[  494.816271][    C0]  blocking_notifier_call_chain+0x40/0x50
[  494.818274][    C0]  device_add+0x884/0xc00
[  494.819820][    C0]  device_register+0x2c/0x38
[  494.821477][    C0]  i2c_register_adapter+0x27c/0x6f0
[  494.823295][    C0]  i2c_add_adapter+0x110/0x130
[  494.824980][    C0]  i2c_add_numbered_adapter+0x48/0x78
[  494.826899][    C0]  unittest_i2c_bus_probe+0x1a8/0x1f4
[  494.828778][    C0]  platform_drv_probe+0xd8/0x1a8
[  494.830741][    C0]  really_probe+0x424/0x840
[  494.832366][    C0]  driver_probe_device+0x16c/0x238
[  494.834216][    C0]  device_driver_attach+0x90/0xc0
[  494.835979][    C0]  __driver_attach+0x1e8/0x200
[  494.837697][    C0]  bus_for_each_dev+0xf8/0x190
[  494.839400][    C0]  driver_attach+0x3c/0x48
[  494.840986][    C0]  bus_add_driver+0x20c/0x3d0
[  494.842658][    C0]  driver_register+0x168/0x200
[  494.844369][    C0]  __platform_driver_register+0x84/0x90
[  494.846344][    C0]  of_unittest_overlay+0x1444/0x14e8
[  494.848200][    C0]  of_unittest+0x2034/0x28a4
[  494.849842][    C0]  do_one_initcall+0x490/0x9bc
[  494.851546][    C0]  kernel_init_freeable+0xb94/0xcc0
[  494.853398][    C0]  kernel_init+0x1c/0x204
[  494.854945][    C0]  ret_from_fork+0x10/0x18
[  494.856487][    C0]
[  494.857356][    C0] Freed by task 1:
[  494.858762][    C0]  __kasan_slab_free+0x140/0x200
[  494.860495][    C0]  kasan_slab_free+0x10/0x18
[  494.862116][    C0]  kfree+0x3f4/0x608
[  494.863457][    C0]  put_i2c_dev+0xc8/0xd8
[  494.864915][    C0]  i2cdev_detach_adapter+0x70/0xd8
[  494.866775][    C0]  i2cdev_notifier_call+0x74/0x90
[  494.868527][    C0]  notifier_call_chain+0x108/0x1b0
[  494.870292][    C0]  __blocking_notifier_call_chain+0x7c/0xb0
[  494.872204][    C0]  blocking_notifier_call_chain+0x40/0x50
[  494.874059][    C0]  device_del+0x108/0x5b0
[  494.875578][    C0]  device_unregister+0x78/0x98
[  494.877268][    C0]  i2c_del_adapter+0x36c/0x3c8
[  494.878820][    C0]  unittest_i2c_bus_remove+0x88/0xa0
[  494.880531][    C0]  platform_drv_remove+0x44/0x70
[  494.882211][    C0]  really_probe+0x488/0x840
[  494.883710][    C0]  driver_probe_device+0x16c/0x238
[  494.885514][    C0]  device_driver_attach+0x90/0xc0
[  494.887283][    C0]  __driver_attach+0x1e8/0x200
[  494.888910][    C0]  bus_for_each_dev+0xf8/0x190
[  494.890617][    C0]  driver_attach+0x3c/0x48
[  494.892179][    C0]  bus_add_driver+0x20c/0x3d0
[  494.893847][    C0]  driver_register+0x168/0x200
[  494.895489][    C0]  __platform_driver_register+0x84/0x90
[  494.897367][    C0]  of_unittest_overlay+0x1444/0x14e8
[  494.899235][    C0]  of_unittest+0x2034/0x28a4
[  494.900861][    C0]  do_one_initcall+0x490/0x9bc
[  494.902588][    C0]  kernel_init_freeable+0xb94/0xcc0
[  494.904429][    C0]  kernel_init+0x1c/0x204
[  494.905941][    C0]  ret_from_fork+0x10/0x18
[  494.907389][    C0]
[  494.908198][    C0] The buggy address belongs to the object at
ffff800068868480
[  494.908198][    C0]  which belongs to the cache kmalloc-512 of size 512
[  494.912942][    C0] The buggy address is located 184 bytes inside of
[  494.912942][    C0]  512-byte region [ffff800068868480, ffff800068868680)
[  494.917228][    C0] The buggy address belongs to the page:
[  494.919084][    C0] page:ffff7e0001a21a00 count:1 mapcount:0
mapping:ffff80003fc0c980 index:0x0 compound_mapcount: 0
[  494.922710][    C0] flags: 0xffff00000010200(slab|head)
[  494.924623][    C0] raw: 0ffff00000010200 ffff7e0001a21608
ffff7e0001a22588 ffff80003fc0c980
[  494.927501][    C0] raw: 0000000000000000 0000000000080008
00000001ffffffff 0000000000000000
[  494.930369][    C0] page dumped because: kasan: bad access detected
[  494.932528][    C0]
[  494.933358][    C0] Memory state around the buggy address:
[  494.935202][    C0]  ffff800068868400: fc fc fc fc fc fc fc fc fc
fc fc fc fc fc fc fc
[  494.937786][    C0]  ffff800068868480: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[  494.940516][    C0] >ffff800068868500: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb


KASAN_SHADOW_OFFSET

#define KASAN_SHADOW_OFFSET     KASAN_SHADOW_START - ((KASAN_SHADOW_START + KASAN_SHADOW_SIZE) - (1ULL << \
                    (64 - KASAN_SHADOW_SCALE_SHIFT))) /*64-3 = 61, 2^61, KASAN_SHADOW_OFFSET is FFFFFF9000000000 - 2000000000000000 = 0xDFFFFF9000000000*/ 

kasan compilor support

Generic KASAN is supported in both GCC and Clang. With GCC it requires version 4.9.2 or later for basic support and version 5.0 or later for detection of out-of-bounds accesses for stack and global variables and for inline instrumentation mode (see the Usage section). With Clang it requires version 7.0.0 or later and it doesn't support detection of out-of-bounds accesses for global variables yet.

 from: https://01.org/linuxgraphics/gfx-docs/drm/dev-tools/kasan.html

 







posted @   aspirs  阅读(518)  评论(0编辑  收藏  举报
编辑推荐:
· 浏览器原生「磁吸」效果!Anchor Positioning 锚点定位神器解析
· 没有源码,如何修改代码逻辑?
· 一个奇形怪状的面试题:Bean中的CHM要不要加volatile?
· [.NET]调用本地 Deepseek 模型
· 一个费力不讨好的项目,让我损失了近一半的绩效!
阅读排行:
· 在鹅厂做java开发是什么体验
· 百万级群聊的设计实践
· WPF到Web的无缝过渡:英雄联盟客户端的OpenSilver迁移实战
· 永远不要相信用户的输入:从 SQL 注入攻防看输入验证的重要性
· 浏览器原生「磁吸」效果!Anchor Positioning 锚点定位神器解析
点击右上角即可分享
微信分享提示