From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753662AbcG2USM (ORCPT ); Fri, 29 Jul 2016 16:18:12 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:35961 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752036AbcG2UR7 (ORCPT ); Fri, 29 Jul 2016 16:17:59 -0400 To: kasan-dev Cc: LKML From: Vegard Nossum Subject: KASAN use-after-free not showing freed stacktrace? Message-ID: <579BB9F0.8080700@oracle.com> Date: Fri, 29 Jul 2016 22:17:52 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: userv0021.oracle.com [156.151.31.71] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi again, I am seeing some KASAN use-after-free bugs now but there is no stacktrace for where they were freed anymore: BUG: KASAN: use-after-free in acct_collect+0x7d5/0x830 at addr ffff88010e129b08 Read of size 8 by task trinity-c0/13609 CPU: 0 PID: 13609 Comm: trinity-c0 Not tainted 4.7.0+ #65 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 ffff88010e129b00 ffff88011482f8f0 ffffffff81d701c1 ffff88011482f980 ffff88010d4d5c00 ffff88011482f970 ffffffff81477d5e 0000000000000001 0000000000000000 0000000000000296 0000000000000246 ffffffff8126347d Call Trace: [] dump_stack+0x65/0x84 [] kasan_report_error+0x22e/0x5e0 [] ? acct_collect+0x12d/0x830 [] __asan_report_load8_noabort+0x3e/0x40 [] ? acct_collect+0x7d5/0x830 [] acct_collect+0x7d5/0x830 [] ? acct_exit_ns+0x70/0x70 [] ? xacct_add_tsk+0x670/0x670 [] ? hrtimer_active+0x340/0x340 [] ? get_signal+0x1120/0x1120 [] ? creds_are_invalid.part.1+0x11/0xb0 [] ? __validate_process_creds+0x242/0x3e0 [] do_exit+0xca1/0x2c90 [] ? ___perf_sw_event+0x284/0x330 [] ? ___perf_sw_event+0xf4/0x330 [] ? perf_swevent_put_recursion_context+0x90/0x90 [] ? mm_update_next_owner+0x720/0x720 [] ? print_context_stack+0x76/0xe0 [] ? get_signal+0x1a2/0x1120 [] do_group_exit+0xf4/0x2f0 [] get_signal+0x53d/0x1120 [] ? __lock_acquire.isra.32+0xc2/0x1a30 [] do_signal+0x83/0x1f10 [] ? debug_smp_processor_id+0x17/0x20 [] ? setup_sigcontext+0x7d0/0x7d0 [] ? __do_page_fault+0x53b/0x8f0 [] ? perf_iterate_sb+0x97/0x6d0 [] ? trace_do_page_fault+0x18d/0x310 [] ? ftrace_syscall_exit+0x550/0x550 [] ? async_page_fault+0x28/0x30 [] exit_to_usermode_loop+0xa2/0x120 [] syscall_return_slowpath+0x144/0x170 [] ret_from_fork+0x2f/0x40 Object at ffff88010e129b00, in cache vm_area_struct Object allocated with size 192 bytes. Allocation: PID = 1334 [] save_stack_trace+0x26/0x50 [] save_stack+0x46/0xd0 [] kasan_kmalloc+0xda/0x100 [] kasan_slab_alloc+0x12/0x20 [] kmem_cache_alloc+0xe9/0x290 [] copy_process.part.39+0x1e07/0x5390 [] _do_fork+0x17a/0xa70 [] SyS_clone+0x14/0x20 [] do_syscall_64+0x1a1/0x460 [] return_from_SYSCALL_64+0x0/0x6a Memory state around the buggy address: ffff88010e129a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88010e129a80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc >ffff88010e129b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88010e129b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88010e129c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Disabling lock debugging due to kernel taint ================================================================== That seems like a regression, maybe related to memory quarantine for SLUB? Or is there something else going on? Vegard