Date
July 1, 2025, 11:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.834583] ================================================================== [ 18.834725] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8 [ 18.834842] Read of size 8 at addr fff00000c7747f00 by task kunit_try_catch/201 [ 18.834903] [ 18.835152] CPU: 1 UID: 0 PID: 201 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.835255] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.835285] Hardware name: linux,dummy-virt (DT) [ 18.835367] Call trace: [ 18.835421] show_stack+0x20/0x38 (C) [ 18.835481] dump_stack_lvl+0x8c/0xd0 [ 18.835576] print_report+0x118/0x608 [ 18.835627] kasan_report+0xdc/0x128 [ 18.835676] __asan_report_load8_noabort+0x20/0x30 [ 18.835728] workqueue_uaf+0x480/0x4a8 [ 18.835776] kunit_try_run_case+0x170/0x3f0 [ 18.835827] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.835949] kthread+0x328/0x630 [ 18.836139] ret_from_fork+0x10/0x20 [ 18.836206] [ 18.836226] Allocated by task 201: [ 18.836401] kasan_save_stack+0x3c/0x68 [ 18.836489] kasan_save_track+0x20/0x40 [ 18.836531] kasan_save_alloc_info+0x40/0x58 [ 18.836605] __kasan_kmalloc+0xd4/0xd8 [ 18.836647] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.836690] workqueue_uaf+0x13c/0x4a8 [ 18.836727] kunit_try_run_case+0x170/0x3f0 [ 18.836769] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.837092] kthread+0x328/0x630 [ 18.837215] ret_from_fork+0x10/0x20 [ 18.837383] [ 18.837460] Freed by task 47: [ 18.837618] kasan_save_stack+0x3c/0x68 [ 18.837658] kasan_save_track+0x20/0x40 [ 18.837739] kasan_save_free_info+0x4c/0x78 [ 18.837797] __kasan_slab_free+0x6c/0x98 [ 18.838275] kfree+0x214/0x3c8 [ 18.838324] workqueue_uaf_work+0x18/0x30 [ 18.838429] process_one_work+0x530/0xf98 [ 18.838532] worker_thread+0x618/0xf38 [ 18.838715] kthread+0x328/0x630 [ 18.838787] ret_from_fork+0x10/0x20 [ 18.838911] [ 18.838934] Last potentially related work creation: [ 18.838962] kasan_save_stack+0x3c/0x68 [ 18.839037] kasan_record_aux_stack+0xb4/0xc8 [ 18.839334] __queue_work+0x65c/0x1008 [ 18.839527] queue_work_on+0xbc/0xf8 [ 18.839752] workqueue_uaf+0x210/0x4a8 [ 18.839978] kunit_try_run_case+0x170/0x3f0 [ 18.840047] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.840109] kthread+0x328/0x630 [ 18.840264] ret_from_fork+0x10/0x20 [ 18.840307] [ 18.840328] The buggy address belongs to the object at fff00000c7747f00 [ 18.840328] which belongs to the cache kmalloc-32 of size 32 [ 18.840602] The buggy address is located 0 bytes inside of [ 18.840602] freed 32-byte region [fff00000c7747f00, fff00000c7747f20) [ 18.840689] [ 18.840713] The buggy address belongs to the physical page: [ 18.840751] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107747 [ 18.840813] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.840871] page_type: f5(slab) [ 18.840920] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 18.840976] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 18.841021] page dumped because: kasan: bad access detected [ 18.841055] [ 18.841075] Memory state around the buggy address: [ 18.841253] fff00000c7747e00: 00 00 00 fc fc fc fc fc 00 00 03 fc fc fc fc fc [ 18.841346] fff00000c7747e80: 00 00 07 fc fc fc fc fc 00 00 00 07 fc fc fc fc [ 18.841427] >fff00000c7747f00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 18.841696] ^ [ 18.841857] fff00000c7747f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.842025] fff00000c7748000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.842259] ==================================================================
[ 12.096000] ================================================================== [ 12.096537] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560 [ 12.096928] Read of size 8 at addr ffff888102f02cc0 by task kunit_try_catch/217 [ 12.097240] [ 12.097399] CPU: 1 UID: 0 PID: 217 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 12.097449] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.097461] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.097510] Call Trace: [ 12.097537] <TASK> [ 12.097571] dump_stack_lvl+0x73/0xb0 [ 12.097612] print_report+0xd1/0x650 [ 12.097635] ? __virt_addr_valid+0x1db/0x2d0 [ 12.097670] ? workqueue_uaf+0x4d6/0x560 [ 12.097690] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.097710] ? workqueue_uaf+0x4d6/0x560 [ 12.097730] kasan_report+0x141/0x180 [ 12.097750] ? workqueue_uaf+0x4d6/0x560 [ 12.097775] __asan_report_load8_noabort+0x18/0x20 [ 12.097798] workqueue_uaf+0x4d6/0x560 [ 12.097819] ? __pfx_workqueue_uaf+0x10/0x10 [ 12.097839] ? __schedule+0x10cc/0x2b60 [ 12.097861] ? __pfx_read_tsc+0x10/0x10 [ 12.097882] ? ktime_get_ts64+0x86/0x230 [ 12.097907] kunit_try_run_case+0x1a5/0x480 [ 12.097942] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.097962] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.097985] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.098006] ? __kthread_parkme+0x82/0x180 [ 12.098027] ? preempt_count_sub+0x50/0x80 [ 12.098050] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.098072] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.098093] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.098114] kthread+0x337/0x6f0 [ 12.098133] ? trace_preempt_on+0x20/0xc0 [ 12.098157] ? __pfx_kthread+0x10/0x10 [ 12.098176] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.098196] ? calculate_sigpending+0x7b/0xa0 [ 12.098219] ? __pfx_kthread+0x10/0x10 [ 12.098259] ret_from_fork+0x116/0x1d0 [ 12.098287] ? __pfx_kthread+0x10/0x10 [ 12.098306] ret_from_fork_asm+0x1a/0x30 [ 12.098358] </TASK> [ 12.098369] [ 12.107223] Allocated by task 217: [ 12.107429] kasan_save_stack+0x45/0x70 [ 12.107642] kasan_save_track+0x18/0x40 [ 12.108218] kasan_save_alloc_info+0x3b/0x50 [ 12.108395] __kasan_kmalloc+0xb7/0xc0 [ 12.108529] __kmalloc_cache_noprof+0x189/0x420 [ 12.108686] workqueue_uaf+0x152/0x560 [ 12.108851] kunit_try_run_case+0x1a5/0x480 [ 12.109087] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.109367] kthread+0x337/0x6f0 [ 12.109704] ret_from_fork+0x116/0x1d0 [ 12.109979] ret_from_fork_asm+0x1a/0x30 [ 12.110221] [ 12.110318] Freed by task 24: [ 12.110499] kasan_save_stack+0x45/0x70 [ 12.110797] kasan_save_track+0x18/0x40 [ 12.110996] kasan_save_free_info+0x3f/0x60 [ 12.111198] __kasan_slab_free+0x56/0x70 [ 12.111335] kfree+0x222/0x3f0 [ 12.111499] workqueue_uaf_work+0x12/0x20 [ 12.111699] process_one_work+0x5ee/0xf60 [ 12.112134] worker_thread+0x758/0x1220 [ 12.112369] kthread+0x337/0x6f0 [ 12.112551] ret_from_fork+0x116/0x1d0 [ 12.112742] ret_from_fork_asm+0x1a/0x30 [ 12.112993] [ 12.113114] Last potentially related work creation: [ 12.113354] kasan_save_stack+0x45/0x70 [ 12.113511] kasan_record_aux_stack+0xb2/0xc0 [ 12.113660] __queue_work+0x626/0xeb0 [ 12.113967] queue_work_on+0xb6/0xc0 [ 12.114183] workqueue_uaf+0x26d/0x560 [ 12.114382] kunit_try_run_case+0x1a5/0x480 [ 12.114611] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.114900] kthread+0x337/0x6f0 [ 12.115020] ret_from_fork+0x116/0x1d0 [ 12.115172] ret_from_fork_asm+0x1a/0x30 [ 12.115448] [ 12.115555] The buggy address belongs to the object at ffff888102f02cc0 [ 12.115555] which belongs to the cache kmalloc-32 of size 32 [ 12.115965] The buggy address is located 0 bytes inside of [ 12.115965] freed 32-byte region [ffff888102f02cc0, ffff888102f02ce0) [ 12.116728] [ 12.116835] The buggy address belongs to the physical page: [ 12.117179] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102f02 [ 12.117459] flags: 0x200000000000000(node=0|zone=2) [ 12.117821] page_type: f5(slab) [ 12.118075] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 12.118442] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 12.118774] page dumped because: kasan: bad access detected [ 12.118989] [ 12.119059] Memory state around the buggy address: [ 12.119213] ffff888102f02b80: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 12.119544] ffff888102f02c00: 00 00 03 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 12.119870] >ffff888102f02c80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 12.120184] ^ [ 12.120583] ffff888102f02d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.121311] ffff888102f02d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.121685] ==================================================================