On Tue, 5 Sep 2023 20:54:40 +0800 Zheng Yejian zhengyejian1@huawei.com wrote:
Hi, Steve, Ajay,
After this patch and run this testcase, I got an use-after-free report by KASAN. Short log see [1], full logs see attach "panic.log".
And by simple bisect, I found it may be introduced by:
27152bceea1d ("eventfs: Move tracing/events to eventfs")
Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
[1] # ./ftracetest test.d/instances/instance-event.tc === Ftrace unit tests === [1] Test creation and deletion of trace instances while setting an event[ 89.472397] ================================================================== [ 89.475053] BUG: KASAN: slab-use-after-free in __ftrace_event_enable_disable+0x1b/0x3a0 [ 89.480039] Read of size 8 at addr ffff88814f5b2690 by task ftracetest/392 [ 89.483906] [ 89.484560] CPU: 10 PID: 392 Comm: ftracetest Tainted: G W 6.5.0+ #127 [ 89.487033] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 [ 89.489751] Call Trace: [ 89.490315] <TASK> [ 89.490817] dump_stack_lvl+0x4b/0x80 [ 89.491570] print_report+0xd0/0x620 [ 89.492296] ? __virt_addr_valid+0xf9/0x180 [ 89.493134] ? __ftrace_event_enable_disable+0x1b/0x3a0 [ 89.494151] kasan_report+0xb6/0xf0 [ 89.494881] ? __ftrace_event_enable_disable+0x1b/0x3a0 [ 89.495878] __ftrace_event_enable_disable+0x1b/0x3a0 [ 89.496805] event_enable_write+0x109/0x170 [ 89.497631] ? __pfx_event_enable_write+0x10/0x10 [ 89.498618] ? __pfx_bpf_lsm_file_permission+0x10/0x10 [ 89.499659] ? security_file_permission+0x51/0x2d0 [ 89.500604] vfs_write+0x175/0x670 [ 89.501385] ? __pfx_vfs_write+0x10/0x10 [ 89.502246] ? __pfx__raw_spin_lock+0x10/0x10 [ 89.503187] ? expand_files+0x9b/0x330 [ 89.504011] ? __pfx_expand_files+0x10/0x10 [ 89.504898] ? set_close_on_exec+0x7b/0xe0 [ 89.505782] ? __fget_light+0xae/0x1e0 [ 89.506615] ? _raw_spin_lock+0x85/0xe0 [ 89.507989] ksys_write+0xbd/0x160 [ 89.509302] ? __pfx_ksys_write+0x10/0x10 [ 89.510493] ? dnotify_flush+0x38/0x220 [ 89.511654] ? fpregs_assert_state_consistent+0x5a/0x70 [ 89.513297] ? exit_to_user_mode_prepare+0x32/0x110 [ 89.514692] do_syscall_64+0x3f/0x90 [ 89.515516] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
I wonder if this is related to:
https://lore.kernel.org/all/202309050916.58201dc6-oliver.sang@intel.com/
Which I'm currently debugging.
-- Steve