Hay
Date
July 19, 2025, 11:11 a.m.

Environment
qemu-arm64
qemu-x86_64

[   17.537690] ==================================================================
[   17.538674] BUG: KASAN: slab-use-after-free in strcmp+0xc0/0xc8
[   17.538837] Read of size 1 at addr fff00000c77dfad0 by task kunit_try_catch/260
[   17.539257] 
[   17.539363] CPU: 1 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT 
[   17.539774] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.539857] Hardware name: linux,dummy-virt (DT)
[   17.539903] Call trace:
[   17.539942]  show_stack+0x20/0x38 (C)
[   17.540009]  dump_stack_lvl+0x8c/0xd0
[   17.540059]  print_report+0x118/0x5d0
[   17.540108]  kasan_report+0xdc/0x128
[   17.540166]  __asan_report_load1_noabort+0x20/0x30
[   17.540229]  strcmp+0xc0/0xc8
[   17.540273]  kasan_strings+0x340/0xb00
[   17.540329]  kunit_try_run_case+0x170/0x3f0
[   17.540379]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.540433]  kthread+0x328/0x630
[   17.540477]  ret_from_fork+0x10/0x20
[   17.540526] 
[   17.540572] Allocated by task 260:
[   17.540622]  kasan_save_stack+0x3c/0x68
[   17.540668]  kasan_save_track+0x20/0x40
[   17.540709]  kasan_save_alloc_info+0x40/0x58
[   17.540762]  __kasan_kmalloc+0xd4/0xd8
[   17.540802]  __kmalloc_cache_noprof+0x16c/0x3c0
[   17.540843]  kasan_strings+0xc8/0xb00
[   17.540881]  kunit_try_run_case+0x170/0x3f0
[   17.540937]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.540984]  kthread+0x328/0x630
[   17.541027]  ret_from_fork+0x10/0x20
[   17.541075] 
[   17.541104] Freed by task 260:
[   17.541148]  kasan_save_stack+0x3c/0x68
[   17.541189]  kasan_save_track+0x20/0x40
[   17.541230]  kasan_save_free_info+0x4c/0x78
[   17.541274]  __kasan_slab_free+0x6c/0x98
[   17.541319]  kfree+0x214/0x3c8
[   17.541353]  kasan_strings+0x24c/0xb00
[   17.541402]  kunit_try_run_case+0x170/0x3f0
[   17.541449]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.541493]  kthread+0x328/0x630
[   17.541879]  ret_from_fork+0x10/0x20
[   17.541944] 
[   17.542449] The buggy address belongs to the object at fff00000c77dfac0
[   17.542449]  which belongs to the cache kmalloc-32 of size 32
[   17.542803] The buggy address is located 16 bytes inside of
[   17.542803]  freed 32-byte region [fff00000c77dfac0, fff00000c77dfae0)
[   17.543321] 
[   17.543367] The buggy address belongs to the physical page:
[   17.543466] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077df
[   17.543610] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.543713] page_type: f5(slab)
[   17.544127] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000
[   17.544210] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   17.544311] page dumped because: kasan: bad access detected
[   17.544438] 
[   17.544497] Memory state around the buggy address:
[   17.544612]  fff00000c77df980: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[   17.545131]  fff00000c77dfa00: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc
[   17.545264] >fff00000c77dfa80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   17.545344]                                                  ^
[   17.545509]  fff00000c77dfb00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   17.545864]  fff00000c77dfb80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   17.546027] ==================================================================

[   13.942094] ==================================================================
[   13.943167] BUG: KASAN: slab-use-after-free in strcmp+0xb0/0xc0
[   13.943563] Read of size 1 at addr ffff8881039fe2d0 by task kunit_try_catch/277
[   13.943913] 
[   13.944041] CPU: 1 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT(voluntary) 
[   13.944092] Tainted: [B]=BAD_PAGE, [N]=TEST
[   13.944104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   13.944126] Call Trace:
[   13.944139]  <TASK>
[   13.944157]  dump_stack_lvl+0x73/0xb0
[   13.944186]  print_report+0xd1/0x610
[   13.944211]  ? __virt_addr_valid+0x1db/0x2d0
[   13.944235]  ? strcmp+0xb0/0xc0
[   13.944251]  ? kasan_complete_mode_report_info+0x64/0x200
[   13.944274]  ? strcmp+0xb0/0xc0
[   13.944291]  kasan_report+0x141/0x180
[   13.944312]  ? strcmp+0xb0/0xc0
[   13.944334]  __asan_report_load1_noabort+0x18/0x20
[   13.944358]  strcmp+0xb0/0xc0
[   13.944377]  kasan_strings+0x431/0xe80
[   13.944396]  ? trace_hardirqs_on+0x37/0xe0
[   13.944420]  ? __pfx_kasan_strings+0x10/0x10
[   13.944441]  ? finish_task_switch.isra.0+0x153/0x700
[   13.944464]  ? __switch_to+0x47/0xf50
[   13.944490]  ? __schedule+0x10cc/0x2b60
[   13.944526]  ? __pfx_read_tsc+0x10/0x10
[   13.944548]  ? ktime_get_ts64+0x86/0x230
[   13.944572]  kunit_try_run_case+0x1a5/0x480
[   13.944598]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.944620]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   13.944645]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   13.944668]  ? __kthread_parkme+0x82/0x180
[   13.944689]  ? preempt_count_sub+0x50/0x80
[   13.944711]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.944735]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.944759]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   13.944783]  kthread+0x337/0x6f0
[   13.944801]  ? trace_preempt_on+0x20/0xc0
[   13.944822]  ? __pfx_kthread+0x10/0x10
[   13.944841]  ? _raw_spin_unlock_irq+0x47/0x80
[   13.944862]  ? calculate_sigpending+0x7b/0xa0
[   13.944886]  ? __pfx_kthread+0x10/0x10
[   13.944906]  ret_from_fork+0x116/0x1d0
[   13.944925]  ? __pfx_kthread+0x10/0x10
[   13.944944]  ret_from_fork_asm+0x1a/0x30
[   13.944975]  </TASK>
[   13.944985] 
[   13.958716] Allocated by task 277:
[   13.959276]  kasan_save_stack+0x45/0x70
[   13.959448]  kasan_save_track+0x18/0x40
[   13.959602]  kasan_save_alloc_info+0x3b/0x50
[   13.959754]  __kasan_kmalloc+0xb7/0xc0
[   13.959885]  __kmalloc_cache_noprof+0x189/0x420
[   13.960096]  kasan_strings+0xc0/0xe80
[   13.960457]  kunit_try_run_case+0x1a5/0x480
[   13.960838]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.961349]  kthread+0x337/0x6f0
[   13.961655]  ret_from_fork+0x116/0x1d0
[   13.961986]  ret_from_fork_asm+0x1a/0x30
[   13.962483] 
[   13.962655] Freed by task 277:
[   13.962928]  kasan_save_stack+0x45/0x70
[   13.963444]  kasan_save_track+0x18/0x40
[   13.963814]  kasan_save_free_info+0x3f/0x60
[   13.964313]  __kasan_slab_free+0x56/0x70
[   13.964572]  kfree+0x222/0x3f0
[   13.964691]  kasan_strings+0x2aa/0xe80
[   13.964831]  kunit_try_run_case+0x1a5/0x480
[   13.964978]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.965462]  kthread+0x337/0x6f0
[   13.965790]  ret_from_fork+0x116/0x1d0
[   13.966316]  ret_from_fork_asm+0x1a/0x30
[   13.966906] 
[   13.967430] The buggy address belongs to the object at ffff8881039fe2c0
[   13.967430]  which belongs to the cache kmalloc-32 of size 32
[   13.968479] The buggy address is located 16 bytes inside of
[   13.968479]  freed 32-byte region [ffff8881039fe2c0, ffff8881039fe2e0)
[   13.968852] 
[   13.968929] The buggy address belongs to the physical page:
[   13.969108] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039fe
[   13.970356] flags: 0x200000000000000(node=0|zone=2)
[   13.971089] page_type: f5(slab)
[   13.971556] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000
[   13.972585] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   13.973545] page dumped because: kasan: bad access detected
[   13.974221] 
[   13.974299] Memory state around the buggy address:
[   13.974461]  ffff8881039fe180: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[   13.975179]  ffff8881039fe200: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc
[   13.976170] >ffff8881039fe280: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   13.977001]                                                  ^
[   13.977828]  ffff8881039fe300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   13.978317]  ffff8881039fe380: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   13.979134] ==================================================================