Date
July 17, 2025, 11:10 a.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 |
[ 17.836044] ================================================================== [ 17.836097] BUG: KASAN: slab-use-after-free in strcmp+0xc0/0xc8 [ 17.836315] Read of size 1 at addr fff00000c7940d90 by task kunit_try_catch/260 [ 17.836507] [ 17.836563] CPU: 0 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 17.837047] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.837126] Hardware name: linux,dummy-virt (DT) [ 17.837160] Call trace: [ 17.837208] show_stack+0x20/0x38 (C) [ 17.837280] dump_stack_lvl+0x8c/0xd0 [ 17.837369] print_report+0x118/0x5d0 [ 17.837494] kasan_report+0xdc/0x128 [ 17.837665] __asan_report_load1_noabort+0x20/0x30 [ 17.837780] strcmp+0xc0/0xc8 [ 17.837824] kasan_strings+0x340/0xb00 [ 17.837869] kunit_try_run_case+0x170/0x3f0 [ 17.837919] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.837973] kthread+0x328/0x630 [ 17.838072] ret_from_fork+0x10/0x20 [ 17.838121] [ 17.838141] Allocated by task 260: [ 17.838172] kasan_save_stack+0x3c/0x68 [ 17.838218] kasan_save_track+0x20/0x40 [ 17.838383] kasan_save_alloc_info+0x40/0x58 [ 17.838479] __kasan_kmalloc+0xd4/0xd8 [ 17.838548] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.838678] kasan_strings+0xc8/0xb00 [ 17.838753] kunit_try_run_case+0x170/0x3f0 [ 17.838805] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.838911] kthread+0x328/0x630 [ 17.838993] ret_from_fork+0x10/0x20 [ 17.839061] [ 17.839083] Freed by task 260: [ 17.839121] kasan_save_stack+0x3c/0x68 [ 17.839210] kasan_save_track+0x20/0x40 [ 17.839250] kasan_save_free_info+0x4c/0x78 [ 17.839293] __kasan_slab_free+0x6c/0x98 [ 17.839357] kfree+0x214/0x3c8 [ 17.839516] kasan_strings+0x24c/0xb00 [ 17.839635] kunit_try_run_case+0x170/0x3f0 [ 17.839685] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.839788] kthread+0x328/0x630 [ 17.839825] ret_from_fork+0x10/0x20 [ 17.839861] [ 17.840038] The buggy address belongs to the object at fff00000c7940d80 [ 17.840038] which belongs to the cache kmalloc-32 of size 32 [ 17.840123] The buggy address is located 16 bytes inside of [ 17.840123] freed 32-byte region [fff00000c7940d80, fff00000c7940da0) [ 17.840235] [ 17.840293] The buggy address belongs to the physical page: [ 17.840373] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107940 [ 17.840462] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.840580] page_type: f5(slab) [ 17.840668] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 17.840809] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 17.840885] page dumped because: kasan: bad access detected [ 17.840953] [ 17.841049] Memory state around the buggy address: [ 17.841136] fff00000c7940c80: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 17.841182] fff00000c7940d00: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 17.841228] >fff00000c7940d80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 17.841269] ^ [ 17.841300] fff00000c7940e00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 17.841344] fff00000c7940e80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 17.841387] ==================================================================
[ 14.983771] ================================================================== [ 14.984707] BUG: KASAN: slab-use-after-free in strcmp+0xb0/0xc0 [ 14.984986] Read of size 1 at addr ffff888102a5ed10 by task kunit_try_catch/276 [ 14.985291] [ 14.985390] CPU: 1 UID: 0 PID: 276 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 14.985436] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.985448] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.985472] Call Trace: [ 14.985484] <TASK> [ 14.985499] dump_stack_lvl+0x73/0xb0 [ 14.985527] print_report+0xd1/0x610 [ 14.986043] ? __virt_addr_valid+0x1db/0x2d0 [ 14.986081] ? strcmp+0xb0/0xc0 [ 14.986098] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.986124] ? strcmp+0xb0/0xc0 [ 14.986142] kasan_report+0x141/0x180 [ 14.986164] ? strcmp+0xb0/0xc0 [ 14.986187] __asan_report_load1_noabort+0x18/0x20 [ 14.986212] strcmp+0xb0/0xc0 [ 14.986252] kasan_strings+0x431/0xe80 [ 14.986272] ? trace_hardirqs_on+0x37/0xe0 [ 14.986313] ? __pfx_kasan_strings+0x10/0x10 [ 14.986334] ? finish_task_switch.isra.0+0x153/0x700 [ 14.986358] ? __switch_to+0x47/0xf50 [ 14.986383] ? __schedule+0x10cc/0x2b60 [ 14.986421] ? __pfx_read_tsc+0x10/0x10 [ 14.986443] ? ktime_get_ts64+0x86/0x230 [ 14.986467] kunit_try_run_case+0x1a5/0x480 [ 14.986493] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.986517] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.986541] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.986576] ? __kthread_parkme+0x82/0x180 [ 14.986597] ? preempt_count_sub+0x50/0x80 [ 14.986621] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.986646] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.986671] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.986698] kthread+0x337/0x6f0 [ 14.986718] ? trace_preempt_on+0x20/0xc0 [ 14.986740] ? __pfx_kthread+0x10/0x10 [ 14.986761] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.986783] ? calculate_sigpending+0x7b/0xa0 [ 14.986808] ? __pfx_kthread+0x10/0x10 [ 14.986831] ret_from_fork+0x116/0x1d0 [ 14.986851] ? __pfx_kthread+0x10/0x10 [ 14.986872] ret_from_fork_asm+0x1a/0x30 [ 14.986903] </TASK> [ 14.986915] [ 14.996184] Allocated by task 276: [ 14.996490] kasan_save_stack+0x45/0x70 [ 14.996712] kasan_save_track+0x18/0x40 [ 14.996952] kasan_save_alloc_info+0x3b/0x50 [ 14.997262] __kasan_kmalloc+0xb7/0xc0 [ 14.997436] __kmalloc_cache_noprof+0x189/0x420 [ 14.997791] kasan_strings+0xc0/0xe80 [ 14.997998] kunit_try_run_case+0x1a5/0x480 [ 14.998220] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.998407] kthread+0x337/0x6f0 [ 14.998528] ret_from_fork+0x116/0x1d0 [ 14.998771] ret_from_fork_asm+0x1a/0x30 [ 14.999053] [ 14.999151] Freed by task 276: [ 14.999350] kasan_save_stack+0x45/0x70 [ 14.999599] kasan_save_track+0x18/0x40 [ 14.999862] kasan_save_free_info+0x3f/0x60 [ 15.000046] __kasan_slab_free+0x56/0x70 [ 15.000245] kfree+0x222/0x3f0 [ 15.000363] kasan_strings+0x2aa/0xe80 [ 15.000545] kunit_try_run_case+0x1a5/0x480 [ 15.000774] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.001167] kthread+0x337/0x6f0 [ 15.001401] ret_from_fork+0x116/0x1d0 [ 15.001541] ret_from_fork_asm+0x1a/0x30 [ 15.001691] [ 15.001762] The buggy address belongs to the object at ffff888102a5ed00 [ 15.001762] which belongs to the cache kmalloc-32 of size 32 [ 15.002295] The buggy address is located 16 bytes inside of [ 15.002295] freed 32-byte region [ffff888102a5ed00, ffff888102a5ed20) [ 15.002821] [ 15.002905] The buggy address belongs to the physical page: [ 15.003155] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a5e [ 15.003543] flags: 0x200000000000000(node=0|zone=2) [ 15.003835] page_type: f5(slab) [ 15.004026] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 15.004453] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 15.004792] page dumped because: kasan: bad access detected [ 15.005024] [ 15.005118] Memory state around the buggy address: [ 15.005327] ffff888102a5ec00: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 15.005721] ffff888102a5ec80: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 15.006002] >ffff888102a5ed00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 15.006213] ^ [ 15.006340] ffff888102a5ed80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 15.006850] ffff888102a5ee00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 15.007155] ==================================================================