Skip to content

Instantly share code, notes, and snippets.

@doujiang24
Created January 14, 2021 11:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save doujiang24/c9537a7ff29096fab330dd9555296e21 to your computer and use it in GitHub Desktop.
Save doujiang24/c9537a7ff29096fab330dd9555296e21 to your computer and use it in GitHub Desktop.
[Thu Jan 14 04:23:30 2021] systemd-hostnam (1031) used greatest stack depth: 21088 bytes left
[Thu Jan 14 04:23:31 2021] Kprobes globally unoptimized
[Thu Jan 14 04:23:31 2021] orxray_ngx_rps_XX_6539: loading out-of-tree module taints kernel.
[Thu Jan 14 04:23:31 2021] orxray_ngx_rps_XX_6539: module verification failed: signature and/or required key missing - tainting kernel
[Thu Jan 14 04:23:32 2021] ==================================================================
[Thu Jan 14 04:23:32 2021] BUG: KASAN: use-after-free in proc_remove+0x7b/0x80
[Thu Jan 14 04:23:32 2021] Read of size 8 at addr ffff8882dc3b00b8 by task staprun-d/6732
[Thu Jan 14 04:23:32 2021] CPU: 7 PID: 6732 Comm: staprun-d Tainted: G OE --------- - - 4.18.0-259.el8.x86_64+debug #1
[Thu Jan 14 04:23:32 2021] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
[Thu Jan 14 04:23:32 2021] Call Trace:
[Thu Jan 14 04:23:32 2021] dump_stack+0x8e/0xd0
[Thu Jan 14 04:23:32 2021] print_address_description.constprop.3+0x1f/0x300
[Thu Jan 14 04:23:32 2021] __kasan_report.cold.7+0x76/0xbf
[Thu Jan 14 04:23:32 2021] ? proc_remove+0x7b/0x80
[Thu Jan 14 04:23:32 2021] kasan_report+0xe/0x20
[Thu Jan 14 04:23:32 2021] proc_remove+0x7b/0x80
[Thu Jan 14 04:23:32 2021] __stp_procfs_relay_remove_buf_file_callback+0x254/0x346 [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] ? __stp_procfs_relay_remove_buf_file_callback+0x346/0x346 [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] ? __stp_relay_remove_buf_file_callback+0x28/0x29 [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] ? relay_close_buf+0xe0/0x130
[Thu Jan 14 04:23:32 2021] ? relay_close+0x14f/0x470
[Thu Jan 14 04:23:32 2021] ? _stp_transport_data_fs_close+0x1b/0x27 [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] ? _stp_procfs_transport_fs_close+0xa/0xb [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] ? _stp_transport_fs_close+0x24/0x26 [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] ? _stp_transport_close+0x1e/0x24 [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] ? cleanup_module+0xa/0xb [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] ? __x64_sys_delete_module+0x2cc/0x4a0
[Thu Jan 14 04:23:32 2021] ? __ia32_sys_delete_module+0x4a0/0x4a0
[Thu Jan 14 04:23:32 2021] ? lockdep_hardirqs_on_prepare+0x343/0x4f0
[Thu Jan 14 04:23:32 2021] ? do_syscall_64+0x22/0x420
[Thu Jan 14 04:23:32 2021] ? do_syscall_64+0xa5/0x420
[Thu Jan 14 04:23:32 2021] ? entry_SYSCALL_64_after_hwframe+0x6a/0xdf
[Thu Jan 14 04:23:32 2021] Allocated by task 6587:
[Thu Jan 14 04:23:32 2021] save_stack+0x19/0x80
[Thu Jan 14 04:23:32 2021] __kasan_kmalloc.constprop.10+0xc1/0xd0
[Thu Jan 14 04:23:32 2021] kmem_cache_alloc+0xfe/0x350
[Thu Jan 14 04:23:32 2021] __proc_create+0x1f6/0x740
[Thu Jan 14 04:23:32 2021] proc_create_reg+0x61/0x100
[Thu Jan 14 04:23:32 2021] proc_create_data+0x79/0xf0
[Thu Jan 14 04:23:32 2021] __stp_procfs_relay_create_buf_file_callback+0xcb/0x43e [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] Freed by task 6732:
[Thu Jan 14 04:23:32 2021] save_stack+0x19/0x80
[Thu Jan 14 04:23:32 2021] __kasan_slab_free+0x125/0x170
[Thu Jan 14 04:23:32 2021] kmem_cache_free+0xcd/0x360
[Thu Jan 14 04:23:32 2021] proc_evict_inode+0x73/0x100
[Thu Jan 14 04:23:32 2021] evict+0x29e/0x590
[Thu Jan 14 04:23:32 2021] __dentry_kill+0x326/0x5a0
[Thu Jan 14 04:23:32 2021] dentry_kill+0x94/0x410
[Thu Jan 14 04:23:32 2021] dput+0x3b0/0x4a0
[Thu Jan 14 04:23:32 2021] path_put+0x2d/0x60
[Thu Jan 14 04:23:32 2021] __stp_procfs_relay_remove_buf_file_callback+0x24c/0x346 [orxray_libc_usleep_XX_6587]
[Thu Jan 14 04:23:32 2021] The buggy address belongs to the object at ffff8882dc3b0000
which belongs to the cache proc_dir_entry of size 512
[Thu Jan 14 04:23:32 2021] The buggy address is located 184 bytes inside of
512-byte region [ffff8882dc3b0000, ffff8882dc3b0200)
[Thu Jan 14 04:23:32 2021] The buggy address belongs to the page:
[Thu Jan 14 04:23:32 2021] page:ffffea000b70ec00 refcount:1 mapcount:0 mapping:ffff8881061d4f00 index:0x0 compound_mapcount: 0
[Thu Jan 14 04:23:32 2021] flags: 0x17ffffc0008100(slab|head)
[Thu Jan 14 04:23:32 2021] raw: 0017ffffc0008100 dead000000000100 dead000000000200 ffff8881061d4f00
[Thu Jan 14 04:23:32 2021] raw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000
[Thu Jan 14 04:23:32 2021] page dumped because: kasan: bad access detected
[Thu Jan 14 04:23:32 2021] Memory state around the buggy address:
[Thu Jan 14 04:23:32 2021] ffff8882dc3aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[Thu Jan 14 04:23:32 2021] ffff8882dc3b0000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[Thu Jan 14 04:23:32 2021] >ffff8882dc3b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[Thu Jan 14 04:23:32 2021] ^
[Thu Jan 14 04:23:32 2021] ffff8882dc3b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[Thu Jan 14 04:23:32 2021] ffff8882dc3b0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[Thu Jan 14 04:23:32 2021] ==================================================================
[Thu Jan 14 04:23:32 2021] Disabling lock debugging due to kernel taint
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment