Date
July 15, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.481997] ================================================================== [ 15.482419] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x3bc/0x438 [ 15.482651] Read of size 16 at addr fff00000c591d5c0 by task kunit_try_catch/169 [ 15.482711] [ 15.482788] CPU: 1 UID: 0 PID: 169 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.482867] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.482892] Hardware name: linux,dummy-virt (DT) [ 15.482921] Call trace: [ 15.483051] show_stack+0x20/0x38 (C) [ 15.483167] dump_stack_lvl+0x8c/0xd0 [ 15.483226] print_report+0x118/0x5d0 [ 15.483277] kasan_report+0xdc/0x128 [ 15.483338] __asan_report_load16_noabort+0x20/0x30 [ 15.483550] kmalloc_uaf_16+0x3bc/0x438 [ 15.483600] kunit_try_run_case+0x170/0x3f0 [ 15.483738] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.483812] kthread+0x328/0x630 [ 15.483852] ret_from_fork+0x10/0x20 [ 15.483899] [ 15.483921] Allocated by task 169: [ 15.484057] kasan_save_stack+0x3c/0x68 [ 15.484262] kasan_save_track+0x20/0x40 [ 15.484348] kasan_save_alloc_info+0x40/0x58 [ 15.484414] __kasan_kmalloc+0xd4/0xd8 [ 15.484449] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.484494] kmalloc_uaf_16+0x140/0x438 [ 15.484527] kunit_try_run_case+0x170/0x3f0 [ 15.484562] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.484604] kthread+0x328/0x630 [ 15.484640] ret_from_fork+0x10/0x20 [ 15.484810] [ 15.484834] Freed by task 169: [ 15.484858] kasan_save_stack+0x3c/0x68 [ 15.485013] kasan_save_track+0x20/0x40 [ 15.485051] kasan_save_free_info+0x4c/0x78 [ 15.485089] __kasan_slab_free+0x6c/0x98 [ 15.485124] kfree+0x214/0x3c8 [ 15.485157] kmalloc_uaf_16+0x190/0x438 [ 15.485200] kunit_try_run_case+0x170/0x3f0 [ 15.485432] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.485730] kthread+0x328/0x630 [ 15.485764] ret_from_fork+0x10/0x20 [ 15.485912] [ 15.485931] The buggy address belongs to the object at fff00000c591d5c0 [ 15.485931] which belongs to the cache kmalloc-16 of size 16 [ 15.485987] The buggy address is located 0 bytes inside of [ 15.485987] freed 16-byte region [fff00000c591d5c0, fff00000c591d5d0) [ 15.486047] [ 15.486065] The buggy address belongs to the physical page: [ 15.486207] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10591d [ 15.486262] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.486310] page_type: f5(slab) [ 15.486347] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 15.486396] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 15.486450] page dumped because: kasan: bad access detected [ 15.486486] [ 15.486509] Memory state around the buggy address: [ 15.486673] fff00000c591d480: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 15.486715] fff00000c591d500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 15.486757] >fff00000c591d580: fa fb fc fc 00 00 fc fc fa fb fc fc fc fc fc fc [ 15.486793] ^ [ 15.486825] fff00000c591d600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.486877] fff00000c591d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.487010] ==================================================================
[ 12.521407] ================================================================== [ 12.522650] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x47b/0x4c0 [ 12.523537] Read of size 16 at addr ffff8881027816e0 by task kunit_try_catch/185 [ 12.523972] [ 12.524090] CPU: 0 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.524135] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.524147] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.524167] Call Trace: [ 12.524178] <TASK> [ 12.524191] dump_stack_lvl+0x73/0xb0 [ 12.524221] print_report+0xd1/0x610 [ 12.524244] ? __virt_addr_valid+0x1db/0x2d0 [ 12.524267] ? kmalloc_uaf_16+0x47b/0x4c0 [ 12.524287] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.524311] ? kmalloc_uaf_16+0x47b/0x4c0 [ 12.524332] kasan_report+0x141/0x180 [ 12.524354] ? kmalloc_uaf_16+0x47b/0x4c0 [ 12.524379] __asan_report_load16_noabort+0x18/0x20 [ 12.524462] kmalloc_uaf_16+0x47b/0x4c0 [ 12.524484] ? __pfx_kmalloc_uaf_16+0x10/0x10 [ 12.524506] ? __schedule+0x10cc/0x2b60 [ 12.524529] ? __pfx_read_tsc+0x10/0x10 [ 12.524550] ? ktime_get_ts64+0x86/0x230 [ 12.524575] kunit_try_run_case+0x1a5/0x480 [ 12.524601] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.524624] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.524648] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.524672] ? __kthread_parkme+0x82/0x180 [ 12.524693] ? preempt_count_sub+0x50/0x80 [ 12.524718] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.524742] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.524789] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.524815] kthread+0x337/0x6f0 [ 12.524835] ? trace_preempt_on+0x20/0xc0 [ 12.524858] ? __pfx_kthread+0x10/0x10 [ 12.524879] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.524900] ? calculate_sigpending+0x7b/0xa0 [ 12.524925] ? __pfx_kthread+0x10/0x10 [ 12.524946] ret_from_fork+0x116/0x1d0 [ 12.524965] ? __pfx_kthread+0x10/0x10 [ 12.524991] ret_from_fork_asm+0x1a/0x30 [ 12.525022] </TASK> [ 12.525032] [ 12.532118] Allocated by task 185: [ 12.532305] kasan_save_stack+0x45/0x70 [ 12.532676] kasan_save_track+0x18/0x40 [ 12.532856] kasan_save_alloc_info+0x3b/0x50 [ 12.533009] __kasan_kmalloc+0xb7/0xc0 [ 12.533142] __kmalloc_cache_noprof+0x189/0x420 [ 12.533368] kmalloc_uaf_16+0x15b/0x4c0 [ 12.533558] kunit_try_run_case+0x1a5/0x480 [ 12.533813] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.534041] kthread+0x337/0x6f0 [ 12.534162] ret_from_fork+0x116/0x1d0 [ 12.534294] ret_from_fork_asm+0x1a/0x30 [ 12.534438] [ 12.534605] Freed by task 185: [ 12.534780] kasan_save_stack+0x45/0x70 [ 12.534982] kasan_save_track+0x18/0x40 [ 12.535172] kasan_save_free_info+0x3f/0x60 [ 12.535533] __kasan_slab_free+0x56/0x70 [ 12.535749] kfree+0x222/0x3f0 [ 12.535928] kmalloc_uaf_16+0x1d6/0x4c0 [ 12.536113] kunit_try_run_case+0x1a5/0x480 [ 12.536284] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.536702] kthread+0x337/0x6f0 [ 12.536875] ret_from_fork+0x116/0x1d0 [ 12.537056] ret_from_fork_asm+0x1a/0x30 [ 12.537222] [ 12.537294] The buggy address belongs to the object at ffff8881027816e0 [ 12.537294] which belongs to the cache kmalloc-16 of size 16 [ 12.538065] The buggy address is located 0 bytes inside of [ 12.538065] freed 16-byte region [ffff8881027816e0, ffff8881027816f0) [ 12.538474] [ 12.538544] The buggy address belongs to the physical page: [ 12.538715] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102781 [ 12.538962] flags: 0x200000000000000(node=0|zone=2) [ 12.539504] page_type: f5(slab) [ 12.539677] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 12.539982] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 12.540211] page dumped because: kasan: bad access detected [ 12.540691] [ 12.540812] Memory state around the buggy address: [ 12.541038] ffff888102781580: 00 00 fc fc 00 02 fc fc 00 02 fc fc 00 06 fc fc [ 12.541424] ffff888102781600: 00 06 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 12.541731] >ffff888102781680: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 12.541996] ^ [ 12.542190] ffff888102781700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.542460] ffff888102781780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.542854] ==================================================================