Hay
Date
July 18, 2025, 11:11 p.m.

Environment
qemu-arm64
qemu-x86_64

[   15.771587] ==================================================================
[   15.771666] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8
[   15.771812] Read of size 8 at addr fff00000c7713f80 by task kunit_try_catch/200
[   15.771867] 
[   15.772005] CPU: 1 UID: 0 PID: 200 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT 
[   15.772095] Tainted: [B]=BAD_PAGE, [N]=TEST
[   15.772159] Hardware name: linux,dummy-virt (DT)
[   15.772325] Call trace:
[   15.772372]  show_stack+0x20/0x38 (C)
[   15.772564]  dump_stack_lvl+0x8c/0xd0
[   15.772762]  print_report+0x118/0x5d0
[   15.772835]  kasan_report+0xdc/0x128
[   15.772938]  __asan_report_load8_noabort+0x20/0x30
[   15.773038]  workqueue_uaf+0x480/0x4a8
[   15.773125]  kunit_try_run_case+0x170/0x3f0
[   15.773177]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.773230]  kthread+0x328/0x630
[   15.773321]  ret_from_fork+0x10/0x20
[   15.773425] 
[   15.773453] Allocated by task 200:
[   15.773482]  kasan_save_stack+0x3c/0x68
[   15.773528]  kasan_save_track+0x20/0x40
[   15.773865]  kasan_save_alloc_info+0x40/0x58
[   15.774012]  __kasan_kmalloc+0xd4/0xd8
[   15.774088]  __kmalloc_cache_noprof+0x16c/0x3c0
[   15.774153]  workqueue_uaf+0x13c/0x4a8
[   15.774252]  kunit_try_run_case+0x170/0x3f0
[   15.774300]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.774354]  kthread+0x328/0x630
[   15.774387]  ret_from_fork+0x10/0x20
[   15.774423] 
[   15.774443] Freed by task 56:
[   15.774470]  kasan_save_stack+0x3c/0x68
[   15.774508]  kasan_save_track+0x20/0x40
[   15.774545]  kasan_save_free_info+0x4c/0x78
[   15.774586]  __kasan_slab_free+0x6c/0x98
[   15.774622]  kfree+0x214/0x3c8
[   15.774656]  workqueue_uaf_work+0x18/0x30
[   15.774690]  process_one_work+0x530/0xf98
[   15.774728]  worker_thread+0x618/0xf38
[   15.774772]  kthread+0x328/0x630
[   15.774806]  ret_from_fork+0x10/0x20
[   15.774840] 
[   15.774860] Last potentially related work creation:
[   15.774908]  kasan_save_stack+0x3c/0x68
[   15.774953]  kasan_record_aux_stack+0xb4/0xc8
[   15.774992]  __queue_work+0x65c/0x1008
[   15.775030]  queue_work_on+0xbc/0xf8
[   15.775068]  workqueue_uaf+0x210/0x4a8
[   15.775112]  kunit_try_run_case+0x170/0x3f0
[   15.775151]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.775196]  kthread+0x328/0x630
[   15.775229]  ret_from_fork+0x10/0x20
[   15.775265] 
[   15.775304] The buggy address belongs to the object at fff00000c7713f80
[   15.775304]  which belongs to the cache kmalloc-32 of size 32
[   15.775873] The buggy address is located 0 bytes inside of
[   15.775873]  freed 32-byte region [fff00000c7713f80, fff00000c7713fa0)
[   15.775961] 
[   15.776017] The buggy address belongs to the physical page:
[   15.776069] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107713
[   15.776165] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   15.776663] page_type: f5(slab)
[   15.776787] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000
[   15.776934] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   15.777060] page dumped because: kasan: bad access detected
[   15.777094] 
[   15.777113] Memory state around the buggy address:
[   15.777322]  fff00000c7713e80: 00 00 00 fc fc fc fc fc 00 00 03 fc fc fc fc fc
[   15.777432]  fff00000c7713f00: 00 00 07 fc fc fc fc fc 00 00 00 07 fc fc fc fc
[   15.777505] >fff00000c7713f80: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[   15.777670]                    ^
[   15.777750]  fff00000c7714000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   15.777872]  fff00000c7714080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   15.777968] ==================================================================

[   12.789220] ==================================================================
[   12.789914] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560
[   12.790411] Read of size 8 at addr ffff8881030e7800 by task kunit_try_catch/219
[   12.790743] 
[   12.791012] CPU: 1 UID: 0 PID: 219 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT(voluntary) 
[   12.791058] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.791069] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.791090] Call Trace:
[   12.791102]  <TASK>
[   12.791117]  dump_stack_lvl+0x73/0xb0
[   12.791148]  print_report+0xd1/0x610
[   12.791170]  ? __virt_addr_valid+0x1db/0x2d0
[   12.791193]  ? workqueue_uaf+0x4d6/0x560
[   12.791214]  ? kasan_complete_mode_report_info+0x64/0x200
[   12.791236]  ? workqueue_uaf+0x4d6/0x560
[   12.791257]  kasan_report+0x141/0x180
[   12.791367]  ? workqueue_uaf+0x4d6/0x560
[   12.791393]  __asan_report_load8_noabort+0x18/0x20
[   12.791417]  workqueue_uaf+0x4d6/0x560
[   12.791438]  ? __pfx_workqueue_uaf+0x10/0x10
[   12.791460]  ? __schedule+0x10cc/0x2b60
[   12.791482]  ? __pfx_read_tsc+0x10/0x10
[   12.791503]  ? ktime_get_ts64+0x86/0x230
[   12.791527]  kunit_try_run_case+0x1a5/0x480
[   12.791551]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.791573]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.791597]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.791620]  ? __kthread_parkme+0x82/0x180
[   12.791640]  ? preempt_count_sub+0x50/0x80
[   12.791664]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.791687]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.791709]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.791733]  kthread+0x337/0x6f0
[   12.791751]  ? trace_preempt_on+0x20/0xc0
[   12.791773]  ? __pfx_kthread+0x10/0x10
[   12.791793]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.791813]  ? calculate_sigpending+0x7b/0xa0
[   12.791837]  ? __pfx_kthread+0x10/0x10
[   12.791857]  ret_from_fork+0x116/0x1d0
[   12.791875]  ? __pfx_kthread+0x10/0x10
[   12.791895]  ret_from_fork_asm+0x1a/0x30
[   12.791925]  </TASK>
[   12.791934] 
[   12.799402] Allocated by task 219:
[   12.799571]  kasan_save_stack+0x45/0x70
[   12.799713]  kasan_save_track+0x18/0x40
[   12.799848]  kasan_save_alloc_info+0x3b/0x50
[   12.800241]  __kasan_kmalloc+0xb7/0xc0
[   12.800454]  __kmalloc_cache_noprof+0x189/0x420
[   12.800819]  workqueue_uaf+0x152/0x560
[   12.801070]  kunit_try_run_case+0x1a5/0x480
[   12.801272]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.801462]  kthread+0x337/0x6f0
[   12.801632]  ret_from_fork+0x116/0x1d0
[   12.801816]  ret_from_fork_asm+0x1a/0x30
[   12.802010] 
[   12.802159] Freed by task 41:
[   12.802321]  kasan_save_stack+0x45/0x70
[   12.802495]  kasan_save_track+0x18/0x40
[   12.802677]  kasan_save_free_info+0x3f/0x60
[   12.802874]  __kasan_slab_free+0x56/0x70
[   12.803121]  kfree+0x222/0x3f0
[   12.803311]  workqueue_uaf_work+0x12/0x20
[   12.803461]  process_one_work+0x5ee/0xf60
[   12.803659]  worker_thread+0x758/0x1220
[   12.803833]  kthread+0x337/0x6f0
[   12.803984]  ret_from_fork+0x116/0x1d0
[   12.804266]  ret_from_fork_asm+0x1a/0x30
[   12.804495] 
[   12.804568] Last potentially related work creation:
[   12.804776]  kasan_save_stack+0x45/0x70
[   12.804974]  kasan_record_aux_stack+0xb2/0xc0
[   12.805126]  __queue_work+0x626/0xeb0
[   12.805259]  queue_work_on+0xb6/0xc0
[   12.805582]  workqueue_uaf+0x26d/0x560
[   12.805771]  kunit_try_run_case+0x1a5/0x480
[   12.805923]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.806101]  kthread+0x337/0x6f0
[   12.806262]  ret_from_fork+0x116/0x1d0
[   12.806457]  ret_from_fork_asm+0x1a/0x30
[   12.806725] 
[   12.806819] The buggy address belongs to the object at ffff8881030e7800
[   12.806819]  which belongs to the cache kmalloc-32 of size 32
[   12.807352] The buggy address is located 0 bytes inside of
[   12.807352]  freed 32-byte region [ffff8881030e7800, ffff8881030e7820)
[   12.807966] 
[   12.808064] The buggy address belongs to the physical page:
[   12.808469] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1030e7
[   12.808785] flags: 0x200000000000000(node=0|zone=2)
[   12.809023] page_type: f5(slab)
[   12.809235] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000
[   12.809596] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   12.809893] page dumped because: kasan: bad access detected
[   12.810148] 
[   12.810220] Memory state around the buggy address:
[   12.810386]  ffff8881030e7700: 00 00 00 fc fc fc fc fc 00 00 03 fc fc fc fc fc
[   12.810678]  ffff8881030e7780: 00 00 07 fc fc fc fc fc 00 00 00 07 fc fc fc fc
[   12.811009] >ffff8881030e7800: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[   12.811443]                    ^
[   12.811595]  ffff8881030e7880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.811857]  ffff8881030e7900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.812275] ==================================================================