Date
July 5, 2025, 11:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 20.207465] ================================================================== [ 20.207913] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 20.208162] Read of size 1 at addr fff00000c78d5240 by task kunit_try_catch/231 [ 20.208214] [ 20.208293] CPU: 0 UID: 0 PID: 231 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 20.208480] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.208509] Hardware name: linux,dummy-virt (DT) [ 20.208545] Call trace: [ 20.208622] show_stack+0x20/0x38 (C) [ 20.208749] dump_stack_lvl+0x8c/0xd0 [ 20.208796] print_report+0x118/0x608 [ 20.208840] kasan_report+0xdc/0x128 [ 20.208884] __asan_report_load1_noabort+0x20/0x30 [ 20.208942] mempool_uaf_helper+0x314/0x340 [ 20.208988] mempool_slab_uaf+0xc0/0x118 [ 20.209308] kunit_try_run_case+0x170/0x3f0 [ 20.209400] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.209772] kthread+0x328/0x630 [ 20.209900] ret_from_fork+0x10/0x20 [ 20.210095] [ 20.210257] Allocated by task 231: [ 20.210346] kasan_save_stack+0x3c/0x68 [ 20.210416] kasan_save_track+0x20/0x40 [ 20.210516] kasan_save_alloc_info+0x40/0x58 [ 20.210562] __kasan_mempool_unpoison_object+0xbc/0x180 [ 20.210756] remove_element+0x16c/0x1f8 [ 20.210792] mempool_alloc_preallocated+0x58/0xc0 [ 20.210830] mempool_uaf_helper+0xa4/0x340 [ 20.210867] mempool_slab_uaf+0xc0/0x118 [ 20.210903] kunit_try_run_case+0x170/0x3f0 [ 20.210940] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.210994] kthread+0x328/0x630 [ 20.211027] ret_from_fork+0x10/0x20 [ 20.211182] [ 20.211239] Freed by task 231: [ 20.211310] kasan_save_stack+0x3c/0x68 [ 20.211354] kasan_save_track+0x20/0x40 [ 20.211391] kasan_save_free_info+0x4c/0x78 [ 20.211438] __kasan_mempool_poison_object+0xc0/0x150 [ 20.211598] mempool_free+0x28c/0x328 [ 20.211652] mempool_uaf_helper+0x104/0x340 [ 20.211761] mempool_slab_uaf+0xc0/0x118 [ 20.211797] kunit_try_run_case+0x170/0x3f0 [ 20.211921] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.211967] kthread+0x328/0x630 [ 20.211999] ret_from_fork+0x10/0x20 [ 20.212033] [ 20.212056] The buggy address belongs to the object at fff00000c78d5240 [ 20.212056] which belongs to the cache test_cache of size 123 [ 20.212112] The buggy address is located 0 bytes inside of [ 20.212112] freed 123-byte region [fff00000c78d5240, fff00000c78d52bb) [ 20.212396] [ 20.212421] The buggy address belongs to the physical page: [ 20.212497] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078d5 [ 20.212553] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.213246] page_type: f5(slab) [ 20.213530] raw: 0bfffe0000000000 fff00000c78c0280 dead000000000122 0000000000000000 [ 20.213585] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 20.213658] page dumped because: kasan: bad access detected [ 20.213690] [ 20.213709] Memory state around the buggy address: [ 20.213740] fff00000c78d5100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 20.214167] fff00000c78d5180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.214333] >fff00000c78d5200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 20.214418] ^ [ 20.214489] fff00000c78d5280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 20.214531] fff00000c78d5300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.214567] ================================================================== [ 20.169216] ================================================================== [ 20.169282] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 20.169341] Read of size 1 at addr fff00000c3ec0e00 by task kunit_try_catch/227 [ 20.169399] [ 20.169575] CPU: 0 UID: 0 PID: 227 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 20.169819] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.169947] Hardware name: linux,dummy-virt (DT) [ 20.169986] Call trace: [ 20.170059] show_stack+0x20/0x38 (C) [ 20.170111] dump_stack_lvl+0x8c/0xd0 [ 20.170170] print_report+0x118/0x608 [ 20.170216] kasan_report+0xdc/0x128 [ 20.170260] __asan_report_load1_noabort+0x20/0x30 [ 20.170311] mempool_uaf_helper+0x314/0x340 [ 20.170357] mempool_kmalloc_uaf+0xc4/0x120 [ 20.170402] kunit_try_run_case+0x170/0x3f0 [ 20.170450] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.170503] kthread+0x328/0x630 [ 20.170544] ret_from_fork+0x10/0x20 [ 20.170592] [ 20.170620] Allocated by task 227: [ 20.170763] kasan_save_stack+0x3c/0x68 [ 20.170903] kasan_save_track+0x20/0x40 [ 20.170981] kasan_save_alloc_info+0x40/0x58 [ 20.171605] __kasan_mempool_unpoison_object+0x11c/0x180 [ 20.171738] remove_element+0x130/0x1f8 [ 20.171928] mempool_alloc_preallocated+0x58/0xc0 [ 20.172234] mempool_uaf_helper+0xa4/0x340 [ 20.172417] mempool_kmalloc_uaf+0xc4/0x120 [ 20.172480] kunit_try_run_case+0x170/0x3f0 [ 20.172520] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.172735] kthread+0x328/0x630 [ 20.172786] ret_from_fork+0x10/0x20 [ 20.173080] [ 20.173272] Freed by task 227: [ 20.173456] kasan_save_stack+0x3c/0x68 [ 20.173502] kasan_save_track+0x20/0x40 [ 20.173707] kasan_save_free_info+0x4c/0x78 [ 20.173945] __kasan_mempool_poison_object+0xc0/0x150 [ 20.173995] mempool_free+0x28c/0x328 [ 20.174031] mempool_uaf_helper+0x104/0x340 [ 20.174068] mempool_kmalloc_uaf+0xc4/0x120 [ 20.174115] kunit_try_run_case+0x170/0x3f0 [ 20.174162] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.174364] kthread+0x328/0x630 [ 20.174527] ret_from_fork+0x10/0x20 [ 20.174565] [ 20.174585] The buggy address belongs to the object at fff00000c3ec0e00 [ 20.174585] which belongs to the cache kmalloc-128 of size 128 [ 20.174647] The buggy address is located 0 bytes inside of [ 20.174647] freed 128-byte region [fff00000c3ec0e00, fff00000c3ec0e80) [ 20.175140] [ 20.175176] The buggy address belongs to the physical page: [ 20.175207] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103ec0 [ 20.175628] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.175931] page_type: f5(slab) [ 20.176012] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.176063] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.176104] page dumped because: kasan: bad access detected [ 20.176265] [ 20.176285] Memory state around the buggy address: [ 20.176447] fff00000c3ec0d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.176527] fff00000c3ec0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.176570] >fff00000c3ec0e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.176608] ^ [ 20.176651] fff00000c3ec0e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.176814] fff00000c3ec0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.176886] ==================================================================
[ 15.313443] ================================================================== [ 15.314016] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 15.314427] Read of size 1 at addr ffff88810392e240 by task kunit_try_catch/249 [ 15.314894] [ 15.315148] CPU: 0 UID: 0 PID: 249 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 15.315208] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.315223] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.315295] Call Trace: [ 15.315327] <TASK> [ 15.315348] dump_stack_lvl+0x73/0xb0 [ 15.315388] print_report+0xd1/0x650 [ 15.315414] ? __virt_addr_valid+0x1db/0x2d0 [ 15.315443] ? mempool_uaf_helper+0x392/0x400 [ 15.315468] ? kasan_complete_mode_report_info+0x64/0x200 [ 15.315496] ? mempool_uaf_helper+0x392/0x400 [ 15.315522] kasan_report+0x141/0x180 [ 15.315548] ? mempool_uaf_helper+0x392/0x400 [ 15.315579] __asan_report_load1_noabort+0x18/0x20 [ 15.315623] mempool_uaf_helper+0x392/0x400 [ 15.315649] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 15.315687] ? update_load_avg+0x1be/0x21b0 [ 15.315720] ? finish_task_switch.isra.0+0x153/0x700 [ 15.315750] mempool_slab_uaf+0xea/0x140 [ 15.315785] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 15.315827] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 15.315864] ? __pfx_mempool_free_slab+0x10/0x10 [ 15.315889] ? __pfx_read_tsc+0x10/0x10 [ 15.315914] ? ktime_get_ts64+0x86/0x230 [ 15.315943] kunit_try_run_case+0x1a5/0x480 [ 15.315974] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.316000] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 15.316029] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 15.316056] ? __kthread_parkme+0x82/0x180 [ 15.316082] ? preempt_count_sub+0x50/0x80 [ 15.316125] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.316198] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.316226] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 15.316252] kthread+0x337/0x6f0 [ 15.316276] ? trace_preempt_on+0x20/0xc0 [ 15.316303] ? __pfx_kthread+0x10/0x10 [ 15.316327] ? _raw_spin_unlock_irq+0x47/0x80 [ 15.316354] ? calculate_sigpending+0x7b/0xa0 [ 15.316384] ? __pfx_kthread+0x10/0x10 [ 15.316409] ret_from_fork+0x116/0x1d0 [ 15.316433] ? __pfx_kthread+0x10/0x10 [ 15.316457] ret_from_fork_asm+0x1a/0x30 [ 15.316493] </TASK> [ 15.316507] [ 15.327427] Allocated by task 249: [ 15.327607] kasan_save_stack+0x45/0x70 [ 15.327899] kasan_save_track+0x18/0x40 [ 15.328170] kasan_save_alloc_info+0x3b/0x50 [ 15.328358] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 15.328834] remove_element+0x11e/0x190 [ 15.329130] mempool_alloc_preallocated+0x4d/0x90 [ 15.329391] mempool_uaf_helper+0x96/0x400 [ 15.329561] mempool_slab_uaf+0xea/0x140 [ 15.329720] kunit_try_run_case+0x1a5/0x480 [ 15.330182] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.330476] kthread+0x337/0x6f0 [ 15.330655] ret_from_fork+0x116/0x1d0 [ 15.330821] ret_from_fork_asm+0x1a/0x30 [ 15.331397] [ 15.331555] Freed by task 249: [ 15.331769] kasan_save_stack+0x45/0x70 [ 15.332047] kasan_save_track+0x18/0x40 [ 15.332377] kasan_save_free_info+0x3f/0x60 [ 15.332625] __kasan_mempool_poison_object+0x131/0x1d0 [ 15.332970] mempool_free+0x2ec/0x380 [ 15.333276] mempool_uaf_helper+0x11a/0x400 [ 15.333579] mempool_slab_uaf+0xea/0x140 [ 15.333861] kunit_try_run_case+0x1a5/0x480 [ 15.334140] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.334438] kthread+0x337/0x6f0 [ 15.334617] ret_from_fork+0x116/0x1d0 [ 15.334958] ret_from_fork_asm+0x1a/0x30 [ 15.335277] [ 15.335377] The buggy address belongs to the object at ffff88810392e240 [ 15.335377] which belongs to the cache test_cache of size 123 [ 15.336002] The buggy address is located 0 bytes inside of [ 15.336002] freed 123-byte region [ffff88810392e240, ffff88810392e2bb) [ 15.336970] [ 15.337190] The buggy address belongs to the physical page: [ 15.337478] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10392e [ 15.337960] flags: 0x200000000000000(node=0|zone=2) [ 15.338383] page_type: f5(slab) [ 15.338566] raw: 0200000000000000 ffff88815a87cf00 dead000000000122 0000000000000000 [ 15.338997] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 15.339432] page dumped because: kasan: bad access detected [ 15.339670] [ 15.340578] Memory state around the buggy address: [ 15.340847] ffff88810392e100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 15.342061] ffff88810392e180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.342340] >ffff88810392e200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 15.342589] ^ [ 15.342798] ffff88810392e280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 15.345315] ffff88810392e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.346898] ================================================================== [ 15.239453] ================================================================== [ 15.240041] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 15.241379] Read of size 1 at addr ffff8881021dbf00 by task kunit_try_catch/245 [ 15.241698] [ 15.241822] CPU: 0 UID: 0 PID: 245 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 15.241881] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.241896] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.241925] Call Trace: [ 15.241941] <TASK> [ 15.241962] dump_stack_lvl+0x73/0xb0 [ 15.242005] print_report+0xd1/0x650 [ 15.242033] ? __virt_addr_valid+0x1db/0x2d0 [ 15.242065] ? mempool_uaf_helper+0x392/0x400 [ 15.242094] ? kasan_complete_mode_report_info+0x64/0x200 [ 15.242120] ? mempool_uaf_helper+0x392/0x400 [ 15.242145] kasan_report+0x141/0x180 [ 15.242171] ? mempool_uaf_helper+0x392/0x400 [ 15.242201] __asan_report_load1_noabort+0x18/0x20 [ 15.242228] mempool_uaf_helper+0x392/0x400 [ 15.242255] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 15.242282] ? __kasan_check_write+0x18/0x20 [ 15.242305] ? __pfx_sched_clock_cpu+0x10/0x10 [ 15.242330] ? finish_task_switch.isra.0+0x153/0x700 [ 15.242362] mempool_kmalloc_uaf+0xef/0x140 [ 15.242388] ? __pfx_mempool_kmalloc_uaf+0x10/0x10 [ 15.242417] ? __pfx_mempool_kmalloc+0x10/0x10 [ 15.242448] ? __pfx_mempool_kfree+0x10/0x10 [ 15.242477] ? __pfx_read_tsc+0x10/0x10 [ 15.242503] ? ktime_get_ts64+0x86/0x230 [ 15.242531] kunit_try_run_case+0x1a5/0x480 [ 15.242560] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.242586] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 15.242616] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 15.242642] ? __kthread_parkme+0x82/0x180 [ 15.242667] ? preempt_count_sub+0x50/0x80 [ 15.242693] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.242720] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.242747] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 15.242774] kthread+0x337/0x6f0 [ 15.242807] ? trace_preempt_on+0x20/0xc0 [ 15.242836] ? __pfx_kthread+0x10/0x10 [ 15.242860] ? _raw_spin_unlock_irq+0x47/0x80 [ 15.242885] ? calculate_sigpending+0x7b/0xa0 [ 15.242914] ? __pfx_kthread+0x10/0x10 [ 15.242938] ret_from_fork+0x116/0x1d0 [ 15.242960] ? __pfx_kthread+0x10/0x10 [ 15.242984] ret_from_fork_asm+0x1a/0x30 [ 15.243019] </TASK> [ 15.243034] [ 15.256893] Allocated by task 245: [ 15.257102] kasan_save_stack+0x45/0x70 [ 15.257328] kasan_save_track+0x18/0x40 [ 15.257560] kasan_save_alloc_info+0x3b/0x50 [ 15.257784] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 15.258095] remove_element+0x11e/0x190 [ 15.258306] mempool_alloc_preallocated+0x4d/0x90 [ 15.258534] mempool_uaf_helper+0x96/0x400 [ 15.258761] mempool_kmalloc_uaf+0xef/0x140 [ 15.259570] kunit_try_run_case+0x1a5/0x480 [ 15.259908] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.260393] kthread+0x337/0x6f0 [ 15.260551] ret_from_fork+0x116/0x1d0 [ 15.260970] ret_from_fork_asm+0x1a/0x30 [ 15.261188] [ 15.261307] Freed by task 245: [ 15.261498] kasan_save_stack+0x45/0x70 [ 15.261704] kasan_save_track+0x18/0x40 [ 15.261943] kasan_save_free_info+0x3f/0x60 [ 15.262144] __kasan_mempool_poison_object+0x131/0x1d0 [ 15.262884] mempool_free+0x2ec/0x380 [ 15.263135] mempool_uaf_helper+0x11a/0x400 [ 15.263610] mempool_kmalloc_uaf+0xef/0x140 [ 15.263872] kunit_try_run_case+0x1a5/0x480 [ 15.264460] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.264740] kthread+0x337/0x6f0 [ 15.265092] ret_from_fork+0x116/0x1d0 [ 15.265405] ret_from_fork_asm+0x1a/0x30 [ 15.265742] [ 15.265878] The buggy address belongs to the object at ffff8881021dbf00 [ 15.265878] which belongs to the cache kmalloc-128 of size 128 [ 15.266700] The buggy address is located 0 bytes inside of [ 15.266700] freed 128-byte region [ffff8881021dbf00, ffff8881021dbf80) [ 15.267636] [ 15.267759] The buggy address belongs to the physical page: [ 15.268113] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1021db [ 15.268773] flags: 0x200000000000000(node=0|zone=2) [ 15.269074] page_type: f5(slab) [ 15.269395] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 15.269743] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 15.270329] page dumped because: kasan: bad access detected [ 15.270672] [ 15.270882] Memory state around the buggy address: [ 15.271318] ffff8881021dbe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.271613] ffff8881021dbe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.272402] >ffff8881021dbf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.272771] ^ [ 15.272971] ffff8881021dbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.273466] ffff8881021dc000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 15.273938] ==================================================================