Date
July 12, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.812229] ================================================================== [ 16.812309] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310 [ 16.812368] Write of size 33 at addr fff00000c592f900 by task kunit_try_catch/186 [ 16.812421] [ 16.812459] CPU: 1 UID: 0 PID: 186 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.812543] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.812570] Hardware name: linux,dummy-virt (DT) [ 16.812609] Call trace: [ 16.812633] show_stack+0x20/0x38 (C) [ 16.812680] dump_stack_lvl+0x8c/0xd0 [ 16.812733] print_report+0x118/0x5d0 [ 16.812789] kasan_report+0xdc/0x128 [ 16.812834] kasan_check_range+0x100/0x1a8 [ 16.812892] __asan_memset+0x34/0x78 [ 16.812935] kmalloc_uaf_memset+0x170/0x310 [ 16.812981] kunit_try_run_case+0x170/0x3f0 [ 16.813038] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.813093] kthread+0x328/0x630 [ 16.813143] ret_from_fork+0x10/0x20 [ 16.813204] [ 16.813223] Allocated by task 186: [ 16.813250] kasan_save_stack+0x3c/0x68 [ 16.813291] kasan_save_track+0x20/0x40 [ 16.813327] kasan_save_alloc_info+0x40/0x58 [ 16.813367] __kasan_kmalloc+0xd4/0xd8 [ 16.813406] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.813444] kmalloc_uaf_memset+0xb8/0x310 [ 16.813481] kunit_try_run_case+0x170/0x3f0 [ 16.813517] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.813570] kthread+0x328/0x630 [ 16.813604] ret_from_fork+0x10/0x20 [ 16.813646] [ 16.813665] Freed by task 186: [ 16.813700] kasan_save_stack+0x3c/0x68 [ 16.813745] kasan_save_track+0x20/0x40 [ 16.813783] kasan_save_free_info+0x4c/0x78 [ 16.813822] __kasan_slab_free+0x6c/0x98 [ 16.813863] kfree+0x214/0x3c8 [ 16.813895] kmalloc_uaf_memset+0x11c/0x310 [ 16.813940] kunit_try_run_case+0x170/0x3f0 [ 16.813987] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.814030] kthread+0x328/0x630 [ 16.814061] ret_from_fork+0x10/0x20 [ 16.814106] [ 16.814125] The buggy address belongs to the object at fff00000c592f900 [ 16.814125] which belongs to the cache kmalloc-64 of size 64 [ 16.814570] The buggy address is located 0 bytes inside of [ 16.814570] freed 64-byte region [fff00000c592f900, fff00000c592f940) [ 16.814651] [ 16.814670] The buggy address belongs to the physical page: [ 16.814821] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10592f [ 16.814909] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.814961] page_type: f5(slab) [ 16.815142] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 16.815230] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 16.815311] page dumped because: kasan: bad access detected [ 16.815399] [ 16.815491] Memory state around the buggy address: [ 16.815600] fff00000c592f800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.815722] fff00000c592f880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.815809] >fff00000c592f900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.815924] ^ [ 16.816028] fff00000c592f980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.816159] fff00000c592fa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.816211] ==================================================================
[ 13.244950] ================================================================== [ 13.245994] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360 [ 13.246781] Write of size 33 at addr ffff8881029fc200 by task kunit_try_catch/203 [ 13.247010] [ 13.247101] CPU: 1 UID: 0 PID: 203 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 13.247146] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.247157] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.247178] Call Trace: [ 13.247191] <TASK> [ 13.247206] dump_stack_lvl+0x73/0xb0 [ 13.247236] print_report+0xd1/0x610 [ 13.247259] ? __virt_addr_valid+0x1db/0x2d0 [ 13.247296] ? kmalloc_uaf_memset+0x1a3/0x360 [ 13.247317] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.247340] ? kmalloc_uaf_memset+0x1a3/0x360 [ 13.247361] kasan_report+0x141/0x180 [ 13.247382] ? kmalloc_uaf_memset+0x1a3/0x360 [ 13.247409] kasan_check_range+0x10c/0x1c0 [ 13.247432] __asan_memset+0x27/0x50 [ 13.247457] kmalloc_uaf_memset+0x1a3/0x360 [ 13.247478] ? __pfx_kmalloc_uaf_memset+0x10/0x10 [ 13.247501] ? __schedule+0x10cc/0x2b60 [ 13.247523] ? __pfx_read_tsc+0x10/0x10 [ 13.247544] ? ktime_get_ts64+0x86/0x230 [ 13.247568] kunit_try_run_case+0x1a5/0x480 [ 13.247592] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.247615] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.247639] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.247663] ? __kthread_parkme+0x82/0x180 [ 13.247682] ? preempt_count_sub+0x50/0x80 [ 13.247706] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.247730] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.247754] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.247779] kthread+0x337/0x6f0 [ 13.247798] ? trace_preempt_on+0x20/0xc0 [ 13.247822] ? __pfx_kthread+0x10/0x10 [ 13.247842] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.247863] ? calculate_sigpending+0x7b/0xa0 [ 13.247888] ? __pfx_kthread+0x10/0x10 [ 13.247909] ret_from_fork+0x116/0x1d0 [ 13.247927] ? __pfx_kthread+0x10/0x10 [ 13.247947] ret_from_fork_asm+0x1a/0x30 [ 13.247977] </TASK> [ 13.247987] [ 13.259115] Allocated by task 203: [ 13.259294] kasan_save_stack+0x45/0x70 [ 13.259471] kasan_save_track+0x18/0x40 [ 13.259631] kasan_save_alloc_info+0x3b/0x50 [ 13.259833] __kasan_kmalloc+0xb7/0xc0 [ 13.260295] __kmalloc_cache_noprof+0x189/0x420 [ 13.260515] kmalloc_uaf_memset+0xa9/0x360 [ 13.260697] kunit_try_run_case+0x1a5/0x480 [ 13.260884] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.261304] kthread+0x337/0x6f0 [ 13.261475] ret_from_fork+0x116/0x1d0 [ 13.261650] ret_from_fork_asm+0x1a/0x30 [ 13.261832] [ 13.261921] Freed by task 203: [ 13.262130] kasan_save_stack+0x45/0x70 [ 13.262320] kasan_save_track+0x18/0x40 [ 13.262499] kasan_save_free_info+0x3f/0x60 [ 13.262695] __kasan_slab_free+0x56/0x70 [ 13.262887] kfree+0x222/0x3f0 [ 13.263087] kmalloc_uaf_memset+0x12b/0x360 [ 13.263287] kunit_try_run_case+0x1a5/0x480 [ 13.263475] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.263706] kthread+0x337/0x6f0 [ 13.263861] ret_from_fork+0x116/0x1d0 [ 13.264085] ret_from_fork_asm+0x1a/0x30 [ 13.264277] [ 13.264370] The buggy address belongs to the object at ffff8881029fc200 [ 13.264370] which belongs to the cache kmalloc-64 of size 64 [ 13.264848] The buggy address is located 0 bytes inside of [ 13.264848] freed 64-byte region [ffff8881029fc200, ffff8881029fc240) [ 13.265530] [ 13.265627] The buggy address belongs to the physical page: [ 13.265860] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029fc [ 13.266419] flags: 0x200000000000000(node=0|zone=2) [ 13.266642] page_type: f5(slab) [ 13.266802] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 13.267171] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 13.267481] page dumped because: kasan: bad access detected [ 13.267716] [ 13.267802] Memory state around the buggy address: [ 13.268048] ffff8881029fc100: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 13.268342] ffff8881029fc180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.268628] >ffff8881029fc200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.268911] ^ [ 13.269323] ffff8881029fc280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.269620] ffff8881029fc300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.269907] ==================================================================