Messages in this thread | | | From | Mikhail Gavrilov <> | Date | Fri, 12 Feb 2021 18:28:12 +0500 | Subject | Re: BUG: KASAN: use-after-free in __list_add_valid+0x81/0xa0 (5.11-rc4) |
| |
On Tue, 26 Jan 2021 at 13:28, Hillf Danton <hdanton@sina.com> wrote: > > > BTW better run the reproducer again with KASAN enabled. >
It happened today again with kernel 5.11 rc7 (e0756cfc7d7c) Why not try your patch?
list_del corruption, ffffdef70143e848->next is LIST_POISON1 (dead000000000100) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:45! invalid opcode: 0000 [#1] SMP NOPTI CPU: 13 PID: 263 Comm: kswapd0 Tainted: G W --------- --- 5.11.0-0.rc7.20210210gite0756cfc7d7c.150.fc35.x86_64 #1 Hardware name: System manufacturer System Product Name/ROG STRIX X570-I GAMING, BIOS 3402 01/13/2021 RIP: 0010:__list_del_entry_valid.cold+0xf/0x47 Code: fe ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 e0 26 64 9e e8 1b 12 fe ff 0f 0b 48 89 fe 48 c7 c7 70 27 64 9e e8 0a 12 fe ff <0f> 0b 48 c7 c7 20 28 64 9e e8 fc 11 fe ff 0f 0b 48 89 f2 48 89 fe RSP: 0018:ffff9f2180863908 EFLAGS: 00010286 RAX: 000000000000004e RBX: ffff8f74d0fa1000 RCX: 0000000000000000 RDX: ffff8f7c885e9f60 RSI: ffff8f7c885db2a0 RDI: ffff8f7c885db2a0 RBP: ffff8f74d0fa1000 R08: 0000000000000000 R09: ffff9f2180863748 R10: ffff9f2180863740 R11: 0000000000000000 R12: ffff8f758edd8e00 R13: 0000000000012800 R14: ffffdef70143e840 R15: ffff8f758edd8e08 FS: 0000000000000000(0000) GS:ffff8f7c88400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000037203acb1000 CR3: 00000001d5c28000 CR4: 0000000000350ee0 Call Trace: z3fold_zpool_malloc+0x3e3/0x780 ? _raw_spin_unlock+0x1f/0x30 zswap_frontswap_store+0x43e/0x890 __frontswap_store+0xc8/0x170 swap_writepage+0x39/0x70 pageout+0x125/0x540 shrink_page_list+0x1329/0x1bc0 shrink_inactive_list+0x12a/0x440 shrink_lruvec+0x4a9/0x6d0 ? super_cache_count+0x79/0xf0 shrink_node+0x2d1/0x700 balance_pgdat+0x2f5/0x650 kswapd+0x21d/0x4d0 ? do_wait_intr_irq+0xd0/0xd0 ? balance_pgdat+0x650/0x650 kthread+0x13a/0x150 ? __kthread_bind_mask+0x60/0x60 ret_from_fork+0x22/0x30 Modules linked in: tun snd_seq_dummy snd_hrtimer uinput rfcomm nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nf_tables nfnetlink ip6table_filter ip6_tables iptable_filter cmac bnep zstd sunrpc vfat fat hid_logitech_hidpp hid_logitech_dj snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel mt76x2u snd_intel_dspcfg soundwire_intel mt76x2_common mt76x02_usb soundwire_generic_allocation mt76_usb intel_rapl_msr iwlmvm snd_soc_core snd_usb_audio intel_rapl_common mt76x02_lib mt76 snd_compress snd_pcm_dmaengine snd_usbmidi_lib soundwire_cadence snd_rawmidi mac80211 snd_hda_codec joydev snd_hda_core uvcvideo ac97_bus snd_hwdep btusb snd_seq videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 snd_seq_device btrtl edac_mce_amd btbcm iwlwifi snd_pcm videobuf2_common btintel kvm_amd eeepc_wmi snd_timer bluetooth kvm videodev asus_wmi snd ecdh_generic sparse_keymap irqbypass xpad mc libarc4 sp5100_tco rapl ff_memless cfg80211 wmi_bmof ecc video pcspkr soundcore k10temp i2c_piix4 rfkill acpi_cpufreq binfmt_misc ip_tables amdgpu drm_ttm_helper ttm iommu_v2 gpu_sched drm_kms_helper crct10dif_pclmul crc32_pclmul crc32c_intel cec drm ghash_clmulni_intel igb ccp nvme dca nvme_core i2c_algo_bit wmi pinctrl_amd fuse ---[ end trace a0c35e2a81af0791 ]--- RIP: 0010:__list_del_entry_valid.cold+0xf/0x47 Code: fe ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 e0 26 64 9e e8 1b 12 fe ff 0f 0b 48 89 fe 48 c7 c7 70 27 64 9e e8 0a 12 fe ff <0f> 0b 48 c7 c7 20 28 64 9e e8 fc 11 fe ff 0f 0b 48 89 f2 48 89 fe RSP: 0018:ffff9f2180863908 EFLAGS: 00010286 RAX: 000000000000004e RBX: ffff8f74d0fa1000 RCX: 0000000000000000 RDX: ffff8f7c885e9f60 RSI: ffff8f7c885db2a0 RDI: ffff8f7c885db2a0 RBP: ffff8f74d0fa1000 R08: 0000000000000000 R09: ffff9f2180863748 R10: ffff9f2180863740 R11: 0000000000000000 R12: ffff8f758edd8e00 R13: 0000000000012800 R14: ffffdef70143e840 R15: ffff8f758edd8e08 FS: 0000000000000000(0000) GS:ffff8f7c88400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000037203acb1000 CR3: 00000001d5c28000 CR4: 0000000000350ee0 note: kswapd0[263] exited with preempt_count 2
full kernel log: https://pastebin.com/FL1fZLJ0
-- Best Regards, Mike Gavrilov.
| |