Date
July 10, 2025, 11:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.020123] ================================================================== [ 16.020183] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338 [ 16.020243] Read of size 1 at addr fff00000c5ff7a28 by task kunit_try_catch/184 [ 16.020292] [ 16.020329] CPU: 1 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.020412] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.020438] Hardware name: linux,dummy-virt (DT) [ 16.020469] Call trace: [ 16.020492] show_stack+0x20/0x38 (C) [ 16.020560] dump_stack_lvl+0x8c/0xd0 [ 16.020612] print_report+0x118/0x608 [ 16.020668] kasan_report+0xdc/0x128 [ 16.020719] __asan_report_load1_noabort+0x20/0x30 [ 16.020774] kmalloc_uaf+0x300/0x338 [ 16.020818] kunit_try_run_case+0x170/0x3f0 [ 16.020868] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.020932] kthread+0x328/0x630 [ 16.020985] ret_from_fork+0x10/0x20 [ 16.021036] [ 16.021055] Allocated by task 184: [ 16.021096] kasan_save_stack+0x3c/0x68 [ 16.021137] kasan_save_track+0x20/0x40 [ 16.021176] kasan_save_alloc_info+0x40/0x58 [ 16.021215] __kasan_kmalloc+0xd4/0xd8 [ 16.021251] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.021292] kmalloc_uaf+0xb8/0x338 [ 16.021575] kunit_try_run_case+0x170/0x3f0 [ 16.021770] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.021940] kthread+0x328/0x630 [ 16.021990] ret_from_fork+0x10/0x20 [ 16.022129] [ 16.022161] Freed by task 184: [ 16.022188] kasan_save_stack+0x3c/0x68 [ 16.022226] kasan_save_track+0x20/0x40 [ 16.022285] kasan_save_free_info+0x4c/0x78 [ 16.022326] __kasan_slab_free+0x6c/0x98 [ 16.022402] kfree+0x214/0x3c8 [ 16.022437] kmalloc_uaf+0x11c/0x338 [ 16.022607] kunit_try_run_case+0x170/0x3f0 [ 16.022689] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.022747] kthread+0x328/0x630 [ 16.022856] ret_from_fork+0x10/0x20 [ 16.022947] [ 16.022993] The buggy address belongs to the object at fff00000c5ff7a20 [ 16.022993] which belongs to the cache kmalloc-16 of size 16 [ 16.023069] The buggy address is located 8 bytes inside of [ 16.023069] freed 16-byte region [fff00000c5ff7a20, fff00000c5ff7a30) [ 16.023159] [ 16.023181] The buggy address belongs to the physical page: [ 16.023334] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105ff7 [ 16.023527] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.023634] page_type: f5(slab) [ 16.023692] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 16.023787] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 16.023863] page dumped because: kasan: bad access detected [ 16.023895] [ 16.023912] Memory state around the buggy address: [ 16.023970] fff00000c5ff7900: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc [ 16.025808] fff00000c5ff7980: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 16.025861] >fff00000c5ff7a00: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc [ 16.025901] ^ [ 16.025935] fff00000c5ff7a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.025977] fff00000c5ff7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.026016] ==================================================================
[ 12.940873] ================================================================== [ 12.941966] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x320/0x380 [ 12.942599] Read of size 1 at addr ffff888102749da8 by task kunit_try_catch/201 [ 12.943219] [ 12.943375] CPU: 0 UID: 0 PID: 201 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.943416] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.943444] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.943463] Call Trace: [ 12.943475] <TASK> [ 12.943490] dump_stack_lvl+0x73/0xb0 [ 12.943518] print_report+0xd1/0x650 [ 12.943540] ? __virt_addr_valid+0x1db/0x2d0 [ 12.943561] ? kmalloc_uaf+0x320/0x380 [ 12.943580] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.943602] ? kmalloc_uaf+0x320/0x380 [ 12.943622] kasan_report+0x141/0x180 [ 12.943643] ? kmalloc_uaf+0x320/0x380 [ 12.943667] __asan_report_load1_noabort+0x18/0x20 [ 12.943691] kmalloc_uaf+0x320/0x380 [ 12.943710] ? __pfx_kmalloc_uaf+0x10/0x10 [ 12.943730] ? __schedule+0x10cc/0x2b60 [ 12.943752] ? __pfx_read_tsc+0x10/0x10 [ 12.943772] ? ktime_get_ts64+0x86/0x230 [ 12.943796] kunit_try_run_case+0x1a5/0x480 [ 12.943821] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.943843] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.943867] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.943890] ? __kthread_parkme+0x82/0x180 [ 12.943910] ? preempt_count_sub+0x50/0x80 [ 12.943933] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.943957] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.943981] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.944005] kthread+0x337/0x6f0 [ 12.944024] ? trace_preempt_on+0x20/0xc0 [ 12.944046] ? __pfx_kthread+0x10/0x10 [ 12.944066] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.944087] ? calculate_sigpending+0x7b/0xa0 [ 12.944111] ? __pfx_kthread+0x10/0x10 [ 12.944131] ret_from_fork+0x116/0x1d0 [ 12.944149] ? __pfx_kthread+0x10/0x10 [ 12.944169] ret_from_fork_asm+0x1a/0x30 [ 12.944203] </TASK> [ 12.944212] [ 12.953748] Allocated by task 201: [ 12.953870] kasan_save_stack+0x45/0x70 [ 12.954082] kasan_save_track+0x18/0x40 [ 12.954275] kasan_save_alloc_info+0x3b/0x50 [ 12.954530] __kasan_kmalloc+0xb7/0xc0 [ 12.954667] __kmalloc_cache_noprof+0x189/0x420 [ 12.954822] kmalloc_uaf+0xaa/0x380 [ 12.955002] kunit_try_run_case+0x1a5/0x480 [ 12.955207] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.955516] kthread+0x337/0x6f0 [ 12.955672] ret_from_fork+0x116/0x1d0 [ 12.955835] ret_from_fork_asm+0x1a/0x30 [ 12.956031] [ 12.956104] Freed by task 201: [ 12.956251] kasan_save_stack+0x45/0x70 [ 12.956464] kasan_save_track+0x18/0x40 [ 12.956598] kasan_save_free_info+0x3f/0x60 [ 12.956742] __kasan_slab_free+0x56/0x70 [ 12.956877] kfree+0x222/0x3f0 [ 12.957017] kmalloc_uaf+0x12c/0x380 [ 12.957195] kunit_try_run_case+0x1a5/0x480 [ 12.957407] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.957656] kthread+0x337/0x6f0 [ 12.957820] ret_from_fork+0x116/0x1d0 [ 12.958016] ret_from_fork_asm+0x1a/0x30 [ 12.958153] [ 12.958221] The buggy address belongs to the object at ffff888102749da0 [ 12.958221] which belongs to the cache kmalloc-16 of size 16 [ 12.959021] The buggy address is located 8 bytes inside of [ 12.959021] freed 16-byte region [ffff888102749da0, ffff888102749db0) [ 12.959545] [ 12.959634] The buggy address belongs to the physical page: [ 12.959847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102749 [ 12.960117] flags: 0x200000000000000(node=0|zone=2) [ 12.960309] page_type: f5(slab) [ 12.960502] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 12.960810] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 12.961112] page dumped because: kasan: bad access detected [ 12.961333] [ 12.961434] Memory state around the buggy address: [ 12.961631] ffff888102749c80: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 12.961885] ffff888102749d00: 00 05 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 12.962206] >ffff888102749d80: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc [ 12.962506] ^ [ 12.962654] ffff888102749e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.962872] ffff888102749e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.963082] ==================================================================