Date
July 11, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.878701] ================================================================== [ 16.880125] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468 [ 16.880191] Read of size 1 at addr fff00000c58a8228 by task kunit_try_catch/189 [ 16.880240] [ 16.880280] CPU: 0 UID: 0 PID: 189 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.881581] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.881949] Hardware name: linux,dummy-virt (DT) [ 16.882439] Call trace: [ 16.882652] show_stack+0x20/0x38 (C) [ 16.883100] dump_stack_lvl+0x8c/0xd0 [ 16.883155] print_report+0x118/0x608 [ 16.883202] kasan_report+0xdc/0x128 [ 16.883368] __asan_report_load1_noabort+0x20/0x30 [ 16.884216] kmalloc_uaf2+0x3f4/0x468 [ 16.884307] kunit_try_run_case+0x170/0x3f0 [ 16.884358] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.884412] kthread+0x328/0x630 [ 16.884454] ret_from_fork+0x10/0x20 [ 16.884504] [ 16.884521] Allocated by task 189: [ 16.885619] kasan_save_stack+0x3c/0x68 [ 16.885812] kasan_save_track+0x20/0x40 [ 16.886097] kasan_save_alloc_info+0x40/0x58 [ 16.886196] __kasan_kmalloc+0xd4/0xd8 [ 16.887028] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.887172] kmalloc_uaf2+0xc4/0x468 [ 16.887418] kunit_try_run_case+0x170/0x3f0 [ 16.887671] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.887905] kthread+0x328/0x630 [ 16.888350] ret_from_fork+0x10/0x20 [ 16.888396] [ 16.888942] Freed by task 189: [ 16.889077] kasan_save_stack+0x3c/0x68 [ 16.889120] kasan_save_track+0x20/0x40 [ 16.889157] kasan_save_free_info+0x4c/0x78 [ 16.889772] __kasan_slab_free+0x6c/0x98 [ 16.889819] kfree+0x214/0x3c8 [ 16.890358] kmalloc_uaf2+0x134/0x468 [ 16.890508] kunit_try_run_case+0x170/0x3f0 [ 16.890796] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.891198] kthread+0x328/0x630 [ 16.891435] ret_from_fork+0x10/0x20 [ 16.891500] [ 16.891641] The buggy address belongs to the object at fff00000c58a8200 [ 16.891641] which belongs to the cache kmalloc-64 of size 64 [ 16.892060] The buggy address is located 40 bytes inside of [ 16.892060] freed 64-byte region [fff00000c58a8200, fff00000c58a8240) [ 16.892456] [ 16.892751] The buggy address belongs to the physical page: [ 16.892921] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1058a8 [ 16.893072] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.893272] page_type: f5(slab) [ 16.893782] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 16.893850] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 16.894396] page dumped because: kasan: bad access detected [ 16.894623] [ 16.894660] Memory state around the buggy address: [ 16.894865] fff00000c58a8100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.895201] fff00000c58a8180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.895530] >fff00000c58a8200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.895858] ^ [ 16.895927] fff00000c58a8280: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc [ 16.896325] fff00000c58a8300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.896395] ==================================================================
[ 12.638107] ================================================================== [ 12.638491] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x4a8/0x520 [ 12.638800] Read of size 1 at addr ffff888102c61ea8 by task kunit_try_catch/205 [ 12.639157] [ 12.639242] CPU: 0 UID: 0 PID: 205 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.639281] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.639292] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.639310] Call Trace: [ 12.639321] <TASK> [ 12.639334] dump_stack_lvl+0x73/0xb0 [ 12.639363] print_report+0xd1/0x650 [ 12.639385] ? __virt_addr_valid+0x1db/0x2d0 [ 12.639408] ? kmalloc_uaf2+0x4a8/0x520 [ 12.639427] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.639451] ? kmalloc_uaf2+0x4a8/0x520 [ 12.639481] kasan_report+0x141/0x180 [ 12.639503] ? kmalloc_uaf2+0x4a8/0x520 [ 12.639528] __asan_report_load1_noabort+0x18/0x20 [ 12.639554] kmalloc_uaf2+0x4a8/0x520 [ 12.639573] ? __pfx_kmalloc_uaf2+0x10/0x10 [ 12.639593] ? finish_task_switch.isra.0+0x153/0x700 [ 12.639615] ? __switch_to+0x47/0xf50 [ 12.639642] ? __schedule+0x10cc/0x2b60 [ 12.639663] ? __pfx_read_tsc+0x10/0x10 [ 12.639684] ? ktime_get_ts64+0x86/0x230 [ 12.639709] kunit_try_run_case+0x1a5/0x480 [ 12.639734] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.639771] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.639798] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.639823] ? __kthread_parkme+0x82/0x180 [ 12.639842] ? preempt_count_sub+0x50/0x80 [ 12.639865] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.639889] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.639913] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.639949] kthread+0x337/0x6f0 [ 12.639967] ? trace_preempt_on+0x20/0xc0 [ 12.639991] ? __pfx_kthread+0x10/0x10 [ 12.640012] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.640041] ? calculate_sigpending+0x7b/0xa0 [ 12.640066] ? __pfx_kthread+0x10/0x10 [ 12.640096] ret_from_fork+0x116/0x1d0 [ 12.640114] ? __pfx_kthread+0x10/0x10 [ 12.640135] ret_from_fork_asm+0x1a/0x30 [ 12.640167] </TASK> [ 12.640176] [ 12.648146] Allocated by task 205: [ 12.648319] kasan_save_stack+0x45/0x70 [ 12.648496] kasan_save_track+0x18/0x40 [ 12.648683] kasan_save_alloc_info+0x3b/0x50 [ 12.648943] __kasan_kmalloc+0xb7/0xc0 [ 12.649169] __kmalloc_cache_noprof+0x189/0x420 [ 12.649334] kmalloc_uaf2+0xc6/0x520 [ 12.649464] kunit_try_run_case+0x1a5/0x480 [ 12.649629] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.650007] kthread+0x337/0x6f0 [ 12.650179] ret_from_fork+0x116/0x1d0 [ 12.650499] ret_from_fork_asm+0x1a/0x30 [ 12.650955] [ 12.651031] Freed by task 205: [ 12.651143] kasan_save_stack+0x45/0x70 [ 12.651281] kasan_save_track+0x18/0x40 [ 12.651417] kasan_save_free_info+0x3f/0x60 [ 12.651894] __kasan_slab_free+0x56/0x70 [ 12.652352] kfree+0x222/0x3f0 [ 12.652518] kmalloc_uaf2+0x14c/0x520 [ 12.652697] kunit_try_run_case+0x1a5/0x480 [ 12.652952] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.653319] kthread+0x337/0x6f0 [ 12.653443] ret_from_fork+0x116/0x1d0 [ 12.653575] ret_from_fork_asm+0x1a/0x30 [ 12.653713] [ 12.653860] The buggy address belongs to the object at ffff888102c61e80 [ 12.653860] which belongs to the cache kmalloc-64 of size 64 [ 12.654884] The buggy address is located 40 bytes inside of [ 12.654884] freed 64-byte region [ffff888102c61e80, ffff888102c61ec0) [ 12.655328] [ 12.655400] The buggy address belongs to the physical page: [ 12.655569] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c61 [ 12.655912] flags: 0x200000000000000(node=0|zone=2) [ 12.656165] page_type: f5(slab) [ 12.656340] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 12.656681] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 12.658643] page dumped because: kasan: bad access detected [ 12.659028] [ 12.659120] Memory state around the buggy address: [ 12.660084] ffff888102c61d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.661214] ffff888102c61e00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.662179] >ffff888102c61e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.662464] ^ [ 12.662653] ffff888102c61f00: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc [ 12.664206] ffff888102c61f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.665215] ==================================================================