Date
July 15, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.663729] ================================================================== [ 15.663802] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338 [ 15.663858] Read of size 1 at addr fff00000c591d5e8 by task kunit_try_catch/185 [ 15.663907] [ 15.664605] CPU: 1 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.664823] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.665001] Hardware name: linux,dummy-virt (DT) [ 15.665102] Call trace: [ 15.665127] show_stack+0x20/0x38 (C) [ 15.665199] dump_stack_lvl+0x8c/0xd0 [ 15.665248] print_report+0x118/0x5d0 [ 15.665293] kasan_report+0xdc/0x128 [ 15.665882] __asan_report_load1_noabort+0x20/0x30 [ 15.665991] kmalloc_uaf+0x300/0x338 [ 15.666655] kunit_try_run_case+0x170/0x3f0 [ 15.666760] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.666812] kthread+0x328/0x630 [ 15.667298] ret_from_fork+0x10/0x20 [ 15.667649] [ 15.667673] Allocated by task 185: [ 15.667705] kasan_save_stack+0x3c/0x68 [ 15.667939] kasan_save_track+0x20/0x40 [ 15.668103] kasan_save_alloc_info+0x40/0x58 [ 15.668430] __kasan_kmalloc+0xd4/0xd8 [ 15.668676] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.668765] kmalloc_uaf+0xb8/0x338 [ 15.669061] kunit_try_run_case+0x170/0x3f0 [ 15.669123] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.669334] kthread+0x328/0x630 [ 15.669385] ret_from_fork+0x10/0x20 [ 15.669422] [ 15.669443] Freed by task 185: [ 15.669470] kasan_save_stack+0x3c/0x68 [ 15.670044] kasan_save_track+0x20/0x40 [ 15.670101] kasan_save_free_info+0x4c/0x78 [ 15.670345] __kasan_slab_free+0x6c/0x98 [ 15.670408] kfree+0x214/0x3c8 [ 15.670772] kmalloc_uaf+0x11c/0x338 [ 15.670937] kunit_try_run_case+0x170/0x3f0 [ 15.670989] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.671162] kthread+0x328/0x630 [ 15.671314] ret_from_fork+0x10/0x20 [ 15.671623] [ 15.671677] The buggy address belongs to the object at fff00000c591d5e0 [ 15.671677] which belongs to the cache kmalloc-16 of size 16 [ 15.671826] The buggy address is located 8 bytes inside of [ 15.671826] freed 16-byte region [fff00000c591d5e0, fff00000c591d5f0) [ 15.672217] [ 15.672242] The buggy address belongs to the physical page: [ 15.672275] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10591d [ 15.672665] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.672866] page_type: f5(slab) [ 15.673095] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 15.673287] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 15.673457] page dumped because: kasan: bad access detected [ 15.673546] [ 15.673619] Memory state around the buggy address: [ 15.673654] fff00000c591d480: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 15.673699] fff00000c591d500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 15.673744] >fff00000c591d580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 15.673792] ^ [ 15.673833] fff00000c591d600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.673876] fff00000c591d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.674363] ==================================================================
[ 12.770803] ================================================================== [ 12.771208] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x320/0x380 [ 12.771812] Read of size 1 at addr ffff8881025148e8 by task kunit_try_catch/201 [ 12.772438] [ 12.772705] CPU: 1 UID: 0 PID: 201 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.772751] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.772775] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.772795] Call Trace: [ 12.772806] <TASK> [ 12.772821] dump_stack_lvl+0x73/0xb0 [ 12.772852] print_report+0xd1/0x610 [ 12.772874] ? __virt_addr_valid+0x1db/0x2d0 [ 12.772898] ? kmalloc_uaf+0x320/0x380 [ 12.772918] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.772941] ? kmalloc_uaf+0x320/0x380 [ 12.772961] kasan_report+0x141/0x180 [ 12.772982] ? kmalloc_uaf+0x320/0x380 [ 12.773007] __asan_report_load1_noabort+0x18/0x20 [ 12.773031] kmalloc_uaf+0x320/0x380 [ 12.773051] ? __pfx_kmalloc_uaf+0x10/0x10 [ 12.773072] ? __schedule+0x10cc/0x2b60 [ 12.773093] ? __pfx_read_tsc+0x10/0x10 [ 12.773113] ? ktime_get_ts64+0x86/0x230 [ 12.773137] kunit_try_run_case+0x1a5/0x480 [ 12.773162] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.773185] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.773209] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.773232] ? __kthread_parkme+0x82/0x180 [ 12.773253] ? preempt_count_sub+0x50/0x80 [ 12.773277] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.773301] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.773379] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.773408] kthread+0x337/0x6f0 [ 12.773427] ? trace_preempt_on+0x20/0xc0 [ 12.773463] ? __pfx_kthread+0x10/0x10 [ 12.773483] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.773505] ? calculate_sigpending+0x7b/0xa0 [ 12.773529] ? __pfx_kthread+0x10/0x10 [ 12.773550] ret_from_fork+0x116/0x1d0 [ 12.773568] ? __pfx_kthread+0x10/0x10 [ 12.773588] ret_from_fork_asm+0x1a/0x30 [ 12.773618] </TASK> [ 12.773628] [ 12.786151] Allocated by task 201: [ 12.786285] kasan_save_stack+0x45/0x70 [ 12.787113] kasan_save_track+0x18/0x40 [ 12.787617] kasan_save_alloc_info+0x3b/0x50 [ 12.787859] __kasan_kmalloc+0xb7/0xc0 [ 12.787996] __kmalloc_cache_noprof+0x189/0x420 [ 12.788155] kmalloc_uaf+0xaa/0x380 [ 12.788282] kunit_try_run_case+0x1a5/0x480 [ 12.788609] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.789413] kthread+0x337/0x6f0 [ 12.789902] ret_from_fork+0x116/0x1d0 [ 12.790472] ret_from_fork_asm+0x1a/0x30 [ 12.791010] [ 12.791171] Freed by task 201: [ 12.791667] kasan_save_stack+0x45/0x70 [ 12.792136] kasan_save_track+0x18/0x40 [ 12.792666] kasan_save_free_info+0x3f/0x60 [ 12.793053] __kasan_slab_free+0x56/0x70 [ 12.793198] kfree+0x222/0x3f0 [ 12.793318] kmalloc_uaf+0x12c/0x380 [ 12.793949] kunit_try_run_case+0x1a5/0x480 [ 12.794335] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.795116] kthread+0x337/0x6f0 [ 12.795555] ret_from_fork+0x116/0x1d0 [ 12.795963] ret_from_fork_asm+0x1a/0x30 [ 12.796150] [ 12.796223] The buggy address belongs to the object at ffff8881025148e0 [ 12.796223] which belongs to the cache kmalloc-16 of size 16 [ 12.797546] The buggy address is located 8 bytes inside of [ 12.797546] freed 16-byte region [ffff8881025148e0, ffff8881025148f0) [ 12.798234] [ 12.798314] The buggy address belongs to the physical page: [ 12.799110] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102514 [ 12.799950] flags: 0x200000000000000(node=0|zone=2) [ 12.800343] page_type: f5(slab) [ 12.800852] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 12.801144] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 12.801615] page dumped because: kasan: bad access detected [ 12.802183] [ 12.802452] Memory state around the buggy address: [ 12.803032] ffff888102514780: fa fb fc fc 00 02 fc fc 00 05 fc fc 00 02 fc fc [ 12.803598] ffff888102514800: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 05 fc fc [ 12.803957] >ffff888102514880: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 12.804719] ^ [ 12.805355] ffff888102514900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.805861] ffff888102514980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.806079] ==================================================================