KASAN: invalid-free in sched_prefer_cpus_free

【标题描述】syzkaller报告出现了invalid-free

【环境信息】

硬件信息：
NA
软件信息：
openEuler-1.0-LTS

【问题复现步骤】

出现概率(是否必现，概率性错误)syzkaller环境低概率
【预期结果】

KASAN 不会触发错误

【实际结果】
出现invalid-free 告警

【附件信息】

KASAN检测报错信息：

==================================================================
BUG: KASAN: double-free or invalid-free in sched_prefer_cpus_free+0x58/0x78 kernel/sched/core.c:7219

CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.19.90+ #1
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78
 show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x170/0x1dc lib/dump_stack.c:118
 print_address_description+0x68/0x2c8 mm/kasan/report.c:253
 kasan_report_invalid_free+0x64/0xa0 mm/kasan/report.c:333
 __kasan_slab_free+0x1d8/0x228 mm/kasan/kasan.c:501
 kasan_slab_free+0x10/0x18 mm/kasan/kasan.c:528
 slab_free_hook mm/slub.c:1397 [inline]
 slab_free_freelist_hook mm/slub.c:1425 [inline]
 slab_free mm/slub.c:3004 [inline]
 kfree+0x84/0x250 mm/slub.c:3965
 sched_prefer_cpus_free+0x58/0x78 kernel/sched/core.c:7219
 free_task+0xb0/0xe8 kernel/fork.c:463
 __put_task_struct+0x248/0x318 kernel/fork.c:740
 put_task_struct include/linux/sched/task.h:98 [inline]
 delayed_put_task_struct+0x58/0x210 kernel/exit.c:172
 __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
 rcu_do_batch+0x200/0x5e0 kernel/rcu/tree.c:2584
 invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
 rcu_process_callbacks+0x470/0xb60 kernel/rcu/tree.c:2881
 __do_softirq+0x2d0/0xba0 kernel/softirq.c:292
 do_softirq_own_stack include/linux/interrupt.h:524 [inline]
 invoke_softirq kernel/softirq.c:379 [inline]
 irq_exit+0x2ec/0x3e8 kernel/softirq.c:412
 __handle_domain_irq+0xc8/0x180 kernel/irq/irqdesc.c:685
 handle_domain_irq include/linux/irqdesc.h:173 [inline]
 gic_handle_irq+0xc8/0x720 drivers/irqchip/irq-gic-v3.c:544
 el1_irq+0xcc/0x180 arch/arm64/kernel/entry.S:692
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:50 [inline]
 arch_cpu_idle+0x5c/0x580 arch/arm64/kernel/process.c:132
 default_idle_call+0x4c/0xe8 kernel/sched/idle.c:93
 cpuidle_idle_call+0x1bc/0x3d0 kernel/sched/idle.c:153
 do_idle+0x148/0x218 kernel/sched/idle.c:263
 cpu_startup_entry+0x28/0x88 kernel/sched/idle.c:369
 secondary_start_kernel+0x3b4/0x608 arch/arm64/kernel/smp.c:447

Allocated by task 28589:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xdc/0x190 mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x110/0x280 mm/slub.c:2782
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 sched_prefer_cpus_fork+0xe0/0x1b8 kernel/sched/core.c:7206
 copy_process.isra.7.part.8+0xa70/0x5810 kernel/fork.c:1873
 copy_process kernel/fork.c:1801 [inline]
 _do_fork+0x188/0x8f0 kernel/fork.c:2318
 __do_sys_clone kernel/fork.c:2425 [inline]
 __se_sys_clone kernel/fork.c:2403 [inline]
 __arm64_sys_clone+0xb0/0x108 kernel/fork.c:2403
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common+0x134/0x570 arch/arm64/kernel/syscall.c:121
 el0_svc_handler+0x190/0x260 arch/arm64/kernel/syscall.c:190
 el0_svc+0x10/0x640 arch/arm64/kernel/entry.S:1028

Freed by task 0:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x120/0x228 mm/kasan/kasan.c:521
 kasan_slab_free+0x10/0x18 mm/kasan/kasan.c:528
 slab_free_hook mm/slub.c:1397 [inline]
 slab_free_freelist_hook mm/slub.c:1425 [inline]
 slab_free mm/slub.c:3004 [inline]
 kfree+0x84/0x250 mm/slub.c:3965
 sched_prefer_cpus_free+0x58/0x78 kernel/sched/core.c:7219
 free_task+0xb0/0xe8 kernel/fork.c:463
 __delayed_free_task+0x24/0x30 kernel/fork.c:1716
 __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
 rcu_do_batch+0x200/0x5e0 kernel/rcu/tree.c:2584
 invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
 rcu_process_callbacks+0x470/0xb60 kernel/rcu/tree.c:2881
 __do_softirq+0x2d0/0xba0 kernel/softirq.c:292

The buggy address belongs to the object at ffff8000db3eed00
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
 128-byte region [ffff8000db3eed00, ffff8000db3eed80)
The buggy address belongs to the page:
page:ffff7e00036cfb80 count:1 mapcount:0 mapping:ffff8000c0003c00 index:0x0
flags: 0x7ffff0000000100(slab)
raw: 07ffff0000000100 0000000000000000 0000000700000001 ffff8000c0003c00
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8000db3eec00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8000db3eec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8000db3eed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8000db3eed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8000db3eee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

GVP openEuler/kernel

内容风险标识

评论 (2)

GVPopenEuler/kernel

内容风险标识