Date
July 19, 2025, 11:12 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.725166] ================================================================== [ 15.725360] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8 [ 15.725429] Read of size 8 at addr fff00000c779ef80 by task kunit_try_catch/200 [ 15.725485] [ 15.725709] CPU: 1 UID: 0 PID: 200 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.725797] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.725829] Hardware name: linux,dummy-virt (DT) [ 15.725955] Call trace: [ 15.725977] show_stack+0x20/0x38 (C) [ 15.726173] dump_stack_lvl+0x8c/0xd0 [ 15.726299] print_report+0x118/0x5d0 [ 15.726346] kasan_report+0xdc/0x128 [ 15.726391] __asan_report_load8_noabort+0x20/0x30 [ 15.726447] workqueue_uaf+0x480/0x4a8 [ 15.726579] kunit_try_run_case+0x170/0x3f0 [ 15.726761] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.727062] kthread+0x328/0x630 [ 15.727382] ret_from_fork+0x10/0x20 [ 15.727440] [ 15.727459] Allocated by task 200: [ 15.727491] kasan_save_stack+0x3c/0x68 [ 15.728008] kasan_save_track+0x20/0x40 [ 15.728221] kasan_save_alloc_info+0x40/0x58 [ 15.728328] __kasan_kmalloc+0xd4/0xd8 [ 15.728366] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.728406] workqueue_uaf+0x13c/0x4a8 [ 15.728442] kunit_try_run_case+0x170/0x3f0 [ 15.728480] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.728522] kthread+0x328/0x630 [ 15.728566] ret_from_fork+0x10/0x20 [ 15.728604] [ 15.728623] Freed by task 24: [ 15.728652] kasan_save_stack+0x3c/0x68 [ 15.728952] kasan_save_track+0x20/0x40 [ 15.728992] kasan_save_free_info+0x4c/0x78 [ 15.729268] __kasan_slab_free+0x6c/0x98 [ 15.729448] kfree+0x214/0x3c8 [ 15.729498] workqueue_uaf_work+0x18/0x30 [ 15.729550] process_one_work+0x530/0xf98 [ 15.729588] worker_thread+0x618/0xf38 [ 15.729642] kthread+0x328/0x630 [ 15.729674] ret_from_fork+0x10/0x20 [ 15.729721] [ 15.729958] Last potentially related work creation: [ 15.730011] kasan_save_stack+0x3c/0x68 [ 15.730164] kasan_record_aux_stack+0xb4/0xc8 [ 15.730212] __queue_work+0x65c/0x1008 [ 15.730250] queue_work_on+0xbc/0xf8 [ 15.730335] workqueue_uaf+0x210/0x4a8 [ 15.730379] kunit_try_run_case+0x170/0x3f0 [ 15.730418] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.730659] kthread+0x328/0x630 [ 15.730854] ret_from_fork+0x10/0x20 [ 15.730964] [ 15.731011] The buggy address belongs to the object at fff00000c779ef80 [ 15.731011] which belongs to the cache kmalloc-32 of size 32 [ 15.731080] The buggy address is located 0 bytes inside of [ 15.731080] freed 32-byte region [fff00000c779ef80, fff00000c779efa0) [ 15.731231] [ 15.731259] The buggy address belongs to the physical page: [ 15.731292] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10779e [ 15.731348] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.731398] page_type: f5(slab) [ 15.731655] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 15.731807] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 15.731939] page dumped because: kasan: bad access detected [ 15.732012] [ 15.732030] Memory state around the buggy address: [ 15.732084] fff00000c779ee80: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 15.732220] fff00000c779ef00: 00 00 00 fc fc fc fc fc 00 00 00 07 fc fc fc fc [ 15.732270] >fff00000c779ef80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 15.732333] ^ [ 15.732418] fff00000c779f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.732522] fff00000c779f080: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 15.732562] ==================================================================
[ 12.617853] ================================================================== [ 12.618410] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560 [ 12.619178] Read of size 8 at addr ffff888102fd53c0 by task kunit_try_catch/217 [ 12.619931] [ 12.620172] CPU: 0 UID: 0 PID: 217 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.620237] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.620248] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.620268] Call Trace: [ 12.620281] <TASK> [ 12.620296] dump_stack_lvl+0x73/0xb0 [ 12.620326] print_report+0xd1/0x610 [ 12.620435] ? __virt_addr_valid+0x1db/0x2d0 [ 12.620462] ? workqueue_uaf+0x4d6/0x560 [ 12.620483] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.620516] ? workqueue_uaf+0x4d6/0x560 [ 12.620536] kasan_report+0x141/0x180 [ 12.620559] ? workqueue_uaf+0x4d6/0x560 [ 12.620585] __asan_report_load8_noabort+0x18/0x20 [ 12.620609] workqueue_uaf+0x4d6/0x560 [ 12.620630] ? __pfx_workqueue_uaf+0x10/0x10 [ 12.620651] ? __schedule+0x10cc/0x2b60 [ 12.620674] ? __pfx_read_tsc+0x10/0x10 [ 12.620694] ? ktime_get_ts64+0x86/0x230 [ 12.620718] kunit_try_run_case+0x1a5/0x480 [ 12.620743] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.620764] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.620787] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.620809] ? __kthread_parkme+0x82/0x180 [ 12.620829] ? preempt_count_sub+0x50/0x80 [ 12.620852] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.620874] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.620896] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.620918] kthread+0x337/0x6f0 [ 12.620937] ? trace_preempt_on+0x20/0xc0 [ 12.620959] ? __pfx_kthread+0x10/0x10 [ 12.620984] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.621013] ? calculate_sigpending+0x7b/0xa0 [ 12.621036] ? __pfx_kthread+0x10/0x10 [ 12.621057] ret_from_fork+0x116/0x1d0 [ 12.621074] ? __pfx_kthread+0x10/0x10 [ 12.621094] ret_from_fork_asm+0x1a/0x30 [ 12.621124] </TASK> [ 12.621134] [ 12.632312] Allocated by task 217: [ 12.632744] kasan_save_stack+0x45/0x70 [ 12.632939] kasan_save_track+0x18/0x40 [ 12.633087] kasan_save_alloc_info+0x3b/0x50 [ 12.633231] __kasan_kmalloc+0xb7/0xc0 [ 12.633365] __kmalloc_cache_noprof+0x189/0x420 [ 12.633515] workqueue_uaf+0x152/0x560 [ 12.633643] kunit_try_run_case+0x1a5/0x480 [ 12.633783] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.633950] kthread+0x337/0x6f0 [ 12.634075] ret_from_fork+0x116/0x1d0 [ 12.634201] ret_from_fork_asm+0x1a/0x30 [ 12.634335] [ 12.634402] Freed by task 9: [ 12.634504] kasan_save_stack+0x45/0x70 [ 12.634633] kasan_save_track+0x18/0x40 [ 12.634761] kasan_save_free_info+0x3f/0x60 [ 12.634899] __kasan_slab_free+0x56/0x70 [ 12.635200] kfree+0x222/0x3f0 [ 12.635928] workqueue_uaf_work+0x12/0x20 [ 12.636290] process_one_work+0x5ee/0xf60 [ 12.636698] worker_thread+0x758/0x1220 [ 12.637056] kthread+0x337/0x6f0 [ 12.637365] ret_from_fork+0x116/0x1d0 [ 12.637873] ret_from_fork_asm+0x1a/0x30 [ 12.638287] [ 12.638577] Last potentially related work creation: [ 12.639128] kasan_save_stack+0x45/0x70 [ 12.639618] kasan_record_aux_stack+0xb2/0xc0 [ 12.640080] __queue_work+0x626/0xeb0 [ 12.640488] queue_work_on+0xb6/0xc0 [ 12.640912] workqueue_uaf+0x26d/0x560 [ 12.641365] kunit_try_run_case+0x1a5/0x480 [ 12.641831] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.642418] kthread+0x337/0x6f0 [ 12.642787] ret_from_fork+0x116/0x1d0 [ 12.643177] ret_from_fork_asm+0x1a/0x30 [ 12.643628] [ 12.643841] The buggy address belongs to the object at ffff888102fd53c0 [ 12.643841] which belongs to the cache kmalloc-32 of size 32 [ 12.645220] The buggy address is located 0 bytes inside of [ 12.645220] freed 32-byte region [ffff888102fd53c0, ffff888102fd53e0) [ 12.646530] [ 12.646747] The buggy address belongs to the physical page: [ 12.647292] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102fd5 [ 12.648187] flags: 0x200000000000000(node=0|zone=2) [ 12.648724] page_type: f5(slab) [ 12.648855] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 12.649097] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 12.649313] page dumped because: kasan: bad access detected [ 12.649886] [ 12.650095] Memory state around the buggy address: [ 12.650969] ffff888102fd5280: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 12.651959] ffff888102fd5300: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 12.652575] >ffff888102fd5380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 12.653401] ^ [ 12.653646] ffff888102fd5400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.653866] ffff888102fd5480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.654094] ==================================================================