https://bugzilla.kernel.org/show_bug.cgi?id=219291
Bug ID: 219291 Summary: KASAN: slab-use-after-free in acpi_ps_parse_loop+0x1f40/0x26f0 Product: ACPI Version: 2.5 Hardware: All OS: Linux Status: NEW Severity: normal Priority: P3 Component: ACPICA-Core Assignee: acpi_acpica-c...@kernel-bugs.osdl.org Reporter: ace...@gmail.com Regression: No Created attachment 306900 --> https://bugzilla.kernel.org/attachment.cgi?id=306900&action=edit dmesg + kasan Mainline kernel: 6.11.0-2004cef11ea0+ Enable KASAN in the kernel config and found the KASAN error messages It looks like the issue happens while parsing the ACPI tables. [ 2.147393] BUG: KASAN: slab-use-after-free in acpi_ps_parse_loop+0x1f40/0x26f0 [ 2.147403] Read of size 2 at addr ffff888107eac012 by task swapper/0/1 [ 2.147410] CPU: 16 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-2004cef11ea0+ #39 [ 2.147415] Hardware name: Dell Inc. Dell Tower E0T2250/, BIOS 0.6.19 07/12/2024 [ 2.147420] Call Trace: [ 2.147422] <TASK> [ 2.147426] dump_stack_lvl+0x72/0xa0 [ 2.147432] print_report+0xd1/0x670 [ 2.147437] ? _raw_read_unlock_irqrestore+0x60/0x60 [ 2.147441] ? ret_from_fork_asm+0x11/0x20 [ 2.147445] ? kasan_complete_mode_report_info+0x66/0x1c0 [ 2.147449] kasan_report+0xd6/0x110 [ 2.147453] ? acpi_ps_parse_loop+0x1f40/0x26f0 [ 2.147456] ? acpi_ps_parse_loop+0x1f40/0x26f0 [ 2.147460] __asan_report_load2_noabort+0x14/0x20 [ 2.147464] acpi_ps_parse_loop+0x1f40/0x26f0 [ 2.147468] ? acpi_ps_get_next_arg+0x14e0/0x14e0 [ 2.147472] ? acpi_ds_delete_walk_state+0x22d/0x370 [ 2.147476] acpi_ps_parse_aml+0x616/0xf50 [ 2.147480] ? acpi_ut_create_internal_object_dbg+0x1a2/0x240 [ 2.147484] acpi_ps_execute_method+0x52e/0xde0 [ 2.147488] ? acpi_ut_acquire_mutex+0x1a7/0x490 [ 2.147492] acpi_ns_evaluate+0x530/0x14a0 [ 2.147496] acpi_evaluate_object+0x37d/0xca0 [ 2.147499] ? acpi_get_data_full+0xf0/0xf0 [ 2.147503] ? kobject_set_name_vargs+0xb3/0x120 [ 2.147507] acpi_get_physical_device_location+0x8b/0x250 [ 2.147512] ? acpi_handle_list_equal+0x120/0x120 [ 2.147516] acpi_device_add+0x389/0xa10 [ 2.147520] ? acpi_tie_acpi_dev+0x90/0x90 [ 2.147523] ? acpi_scan_check_and_detach+0x240/0x240 [ 2.147527] acpi_add_single_object+0x834/0x1ad0 [ 2.147531] ? acpi_ns_get_node+0x89/0xe0 [ 2.147535] ? acpi_get_handle+0xdf/0x220 [ 2.147538] ? acpi_get_data+0xb0/0xb0 [ 2.147541] ? acpi_init_device_object+0x1e40/0x1e40 [ 2.147545] ? acpi_mipi_check_crs_csi2+0xa6/0x310 [ 2.147549] ? up+0x75/0xc0 [ 2.147553] ? acpi_has_method+0x68/0xa0 [ 2.147557] ? acpi_get_physical_device_location+0x250/0x250 [ 2.147561] acpi_bus_check_add+0x206/0x6e0 [ 2.147565] ? arch_acpi_add_auto_dep+0x10/0x10 [ 2.147568] ? __kasan_check_write+0x14/0x20 [ 2.147572] ? _raw_spin_lock_irqsave+0x96/0x100 [ 2.147576] ? acpi_os_signal_semaphore+0xf4/0x150 [ 2.147580] acpi_bus_check_add_1+0x16/0x20 [ 2.147583] acpi_ns_walk_namespace+0x32a/0x560 [ 2.147587] ? acpi_bus_check_add+0x6e0/0x6e0 [ 2.147590] ? acpi_bus_check_add+0x6e0/0x6e0 [ 2.147594] acpi_walk_namespace+0x158/0x170 [ 2.147598] acpi_bus_scan+0x351/0x400 [ 2.147602] ? acpi_bus_check_add_1+0x20/0x20 [ 2.147605] ? __kasan_check_write+0x14/0x20 [ 2.147609] ? mutex_lock+0x8e/0xe0 [ 2.147612] ? __mutex_lock_slowpath+0x20/0x20 [ 2.147616] ? acpi_get_table+0x13b/0x1d0 [ 2.147619] acpi_scan_init+0x1e5/0x640 [ 2.147624] ? acpi_hest_init+0x9d/0x2d0 [ 2.147628] ? acpi_match_madt+0xa0/0xa0 [ 2.147631] ? acpi_viot_early_init+0x71/0xc0 [ 2.147634] ? viot_get_iommu+0x790/0x790 [ 2.147637] ? acpi_ffh_address_space_arch_handler+0x10/0x10 [ 2.147640] acpi_init+0x406/0xa20 [ 2.147644] ? acpi_sleep_proc_init+0x60/0x60 [ 2.147645] ? vprintk+0x7d/0x100 [ 2.147645] ? _printk+0xbc/0x100 [ 2.147645] ? rng_is_initialized+0x20/0x20 [ 2.147645] ? acpi_sleep_proc_init+0x60/0x60 [ 2.147645] ? acpi_sleep_proc_init+0x60/0x60 [ 2.147645] do_one_initcall+0xae/0x400 [ 2.147645] ? trace_event_raw_event_initcall_level+0x210/0x210 [ 2.147645] ? kernel_init_freeable+0x83c/0xe90 [ 2.147645] ? kasan_poison+0x3a/0x60 [ 2.147645] kernel_init_freeable+0x9aa/0xe90 [ 2.147645] ? rest_init+0x170/0x170 [ 2.147645] kernel_init+0x1f/0x210 [ 2.147645] ret_from_fork+0x40/0x90 [ 2.147645] ? rest_init+0x170/0x170 [ 2.147645] ret_from_fork_asm+0x11/0x20 [ 2.147645] </TASK> [ 2.147645] Allocated by task 1: [ 2.147645] kasan_save_stack+0x39/0x60 [ 2.147645] kasan_save_track+0x14/0x40 [ 2.147645] kasan_save_alloc_info+0x37/0x50 [ 2.147645] __kasan_slab_alloc+0x95/0xa0 [ 2.147645] kmem_cache_alloc_noprof+0x123/0x3d0 [ 2.147645] acpi_ps_alloc_op+0x220/0x2f0 [ 2.147645] acpi_ps_create_op+0x48f/0xcc0 [ 2.147645] acpi_ps_parse_loop+0x79e/0x26f0 [ 2.147645] acpi_ps_parse_aml+0x616/0xf50 [ 2.147645] acpi_ps_execute_method+0x52e/0xde0 [ 2.147645] acpi_ns_evaluate+0x530/0x14a0 [ 2.147645] acpi_evaluate_object+0x37d/0xca0 [ 2.147645] acpi_get_physical_device_location+0x8b/0x250 [ 2.147645] acpi_device_add+0x389/0xa10 [ 2.147645] acpi_add_single_object+0x834/0x1ad0 [ 2.147645] acpi_bus_check_add+0x206/0x6e0 [ 2.147645] acpi_bus_check_add_1+0x16/0x20 [ 2.147645] acpi_ns_walk_namespace+0x32a/0x560 [ 2.147645] acpi_walk_namespace+0x158/0x170 [ 2.147645] acpi_bus_scan+0x351/0x400 [ 2.147645] acpi_scan_init+0x1e5/0x640 [ 2.147645] acpi_init+0x406/0xa20 [ 2.147645] do_one_initcall+0xae/0x400 [ 2.147645] kernel_init_freeable+0x9aa/0xe90 [ 2.147645] kernel_init+0x1f/0x210 [ 2.147645] ret_from_fork+0x40/0x90 [ 2.147645] ret_from_fork_asm+0x11/0x20 [ 2.147645] Freed by task 1: [ 2.147645] kasan_save_stack+0x39/0x60 [ 2.147645] kasan_save_track+0x14/0x40 [ 2.147645] kasan_save_free_info+0x3b/0x60 [ 2.147645] __kasan_slab_free+0x52/0x70 [ 2.147645] kmem_cache_free+0x1a4/0x560 [ 2.147645] kmem_cache_free+0x1a4/0x560 [ 2.147645] acpi_os_release_object+0xe/0x20 [ 2.147645] acpi_ps_free_op+0xa5/0x200 [ 2.147645] acpi_ps_delete_parse_tree+0x190/0x430 [ 2.147645] acpi_ps_complete_this_op+0x5f3/0xb00 [ 2.147645] acpi_ps_complete_final_op+0x3b8/0x540 [ 2.147645] acpi_ps_parse_loop+0xa68/0x26f0 [ 2.147645] acpi_ps_parse_aml+0x616/0xf50 [ 2.147645] acpi_ps_execute_method+0x52e/0xde0 [ 2.147645] acpi_ns_evaluate+0x530/0x14a0 [ 2.147645] acpi_evaluate_object+0x37d/0xca0 [ 2.147645] acpi_get_physical_device_location+0x8b/0x250 [ 2.147645] acpi_device_add+0x389/0xa10 [ 2.147645] acpi_add_single_object+0x834/0x1ad0 [ 2.147645] acpi_bus_check_add+0x206/0x6e0 [ 2.147645] acpi_bus_check_add_1+0x16/0x20 [ 2.147645] acpi_ns_walk_namespace+0x32a/0x560 [ 2.147645] acpi_walk_namespace+0x158/0x170 [ 2.147645] acpi_bus_scan+0x351/0x400 [ 2.147645] acpi_scan_init+0x1e5/0x640 [ 2.147645] acpi_init+0x406/0xa20 [ 2.147645] do_one_initcall+0xae/0x400 [ 2.147645] kernel_init_freeable+0x9aa/0xe90 [ 2.147645] kernel_init+0x1f/0x210 [ 2.147645] ret_from_fork+0x40/0x90 [ 2.147645] ret_from_fork_asm+0x11/0x20 [ 2.147645] The buggy address belongs to the object at ffff888107eac008 which belongs to the cache Acpi-Parse of size 80 [ 2.147645] The buggy address is located 10 bytes inside of freed 80-byte region [ffff888107eac008, ffff888107eac058) [ 2.147645] The buggy address belongs to the physical page: [ 2.147645] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107eac [ 2.147645] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2.147645] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ 2.147645] page_type: 0xfdffffff(slab) [ 2.147645] raw: 0017ffffc0000040 ffff888100053840 ffffea00041f9f10 ffffea00041fe310 [ 2.147645] raw: 0000000000000000 00000000002a002a 00000001fdffffff 0000000000000000 [ 2.147645] head: 0017ffffc0000040 ffff888100053840 ffffea00041f9f10 ffffea00041fe310 [ 2.147645] head: 0000000000000000 00000000002a002a 00000001fdffffff 0000000000000000 [ 2.147645] head: 0017ffffc0000001 ffffea00041fab01 ffffffffffffffff 0000000000000000 [ 2.147645] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 2.147645] page dumped because: kasan: bad access detected [ 2.147645] Memory state around the buggy address: [ 2.147645] ffff888107eabf00: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 2.147645] ffff888107eabf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2.147645] >ffff888107eac000: fc fa fb fb fb fb fb fb fb fb fb fc fc fc fc fc [ 2.147645] ^ [ 2.147645] ffff888107eac080: fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb [ 2.147645] ffff888107eac100: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc -- You may reply to this email to add a comment. You are receiving this mail because: You are watching the assignee of the bug. _______________________________________________ acpi-bugzilla mailing list acpi-bugzilla@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/acpi-bugzilla