Date
July 13, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.901371] ================================================================== [ 18.901521] BUG: KASAN: slab-use-after-free in kasan_strings+0x95c/0xb00 [ 18.901689] Read of size 1 at addr fff00000c5ae3c90 by task kunit_try_catch/260 [ 18.901927] [ 18.903564] CPU: 1 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 18.904194] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.904504] Hardware name: linux,dummy-virt (DT) [ 18.904887] Call trace: [ 18.904922] show_stack+0x20/0x38 (C) [ 18.904977] dump_stack_lvl+0x8c/0xd0 [ 18.905112] print_report+0x118/0x5d0 [ 18.905434] kasan_report+0xdc/0x128 [ 18.905491] __asan_report_load1_noabort+0x20/0x30 [ 18.905544] kasan_strings+0x95c/0xb00 [ 18.906036] kunit_try_run_case+0x170/0x3f0 [ 18.906099] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.906156] kthread+0x328/0x630 [ 18.907514] ret_from_fork+0x10/0x20 [ 18.907733] [ 18.907756] Allocated by task 260: [ 18.907787] kasan_save_stack+0x3c/0x68 [ 18.907833] kasan_save_track+0x20/0x40 [ 18.908380] kasan_save_alloc_info+0x40/0x58 [ 18.908512] __kasan_kmalloc+0xd4/0xd8 [ 18.908834] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.909001] kasan_strings+0xc8/0xb00 [ 18.909073] kunit_try_run_case+0x170/0x3f0 [ 18.909114] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.909477] kthread+0x328/0x630 [ 18.909615] ret_from_fork+0x10/0x20 [ 18.909717] [ 18.909740] Freed by task 260: [ 18.909768] kasan_save_stack+0x3c/0x68 [ 18.909815] kasan_save_track+0x20/0x40 [ 18.909862] kasan_save_free_info+0x4c/0x78 [ 18.909904] __kasan_slab_free+0x6c/0x98 [ 18.910213] kfree+0x214/0x3c8 [ 18.910309] kasan_strings+0x24c/0xb00 [ 18.910353] kunit_try_run_case+0x170/0x3f0 [ 18.910682] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.910731] kthread+0x328/0x630 [ 18.910775] ret_from_fork+0x10/0x20 [ 18.910859] [ 18.910882] The buggy address belongs to the object at fff00000c5ae3c80 [ 18.910882] which belongs to the cache kmalloc-32 of size 32 [ 18.910965] The buggy address is located 16 bytes inside of [ 18.910965] freed 32-byte region [fff00000c5ae3c80, fff00000c5ae3ca0) [ 18.911354] [ 18.911554] The buggy address belongs to the physical page: [ 18.911649] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105ae3 [ 18.912003] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.912060] page_type: f5(slab) [ 18.912106] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 18.912251] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 18.912397] page dumped because: kasan: bad access detected [ 18.912465] [ 18.912505] Memory state around the buggy address: [ 18.912568] fff00000c5ae3b80: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 18.912614] fff00000c5ae3c00: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 18.912660] >fff00000c5ae3c80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 18.912708] ^ [ 18.912809] fff00000c5ae3d00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 18.912891] fff00000c5ae3d80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 18.913067] ==================================================================
[ 14.578240] ================================================================== [ 14.578579] BUG: KASAN: slab-use-after-free in kasan_strings+0xcbc/0xe80 [ 14.578948] Read of size 1 at addr ffff888103445d50 by task kunit_try_catch/277 [ 14.579166] [ 14.579252] CPU: 1 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 14.579309] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.579321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.579342] Call Trace: [ 14.579357] <TASK> [ 14.579372] dump_stack_lvl+0x73/0xb0 [ 14.579401] print_report+0xd1/0x610 [ 14.579493] ? __virt_addr_valid+0x1db/0x2d0 [ 14.579519] ? kasan_strings+0xcbc/0xe80 [ 14.579539] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.579682] ? kasan_strings+0xcbc/0xe80 [ 14.579711] kasan_report+0x141/0x180 [ 14.579735] ? kasan_strings+0xcbc/0xe80 [ 14.579761] __asan_report_load1_noabort+0x18/0x20 [ 14.579787] kasan_strings+0xcbc/0xe80 [ 14.579808] ? trace_hardirqs_on+0x37/0xe0 [ 14.579831] ? __pfx_kasan_strings+0x10/0x10 [ 14.579852] ? finish_task_switch.isra.0+0x153/0x700 [ 14.579876] ? __switch_to+0x47/0xf50 [ 14.579901] ? __schedule+0x10cc/0x2b60 [ 14.579925] ? __pfx_read_tsc+0x10/0x10 [ 14.579946] ? ktime_get_ts64+0x86/0x230 [ 14.579971] kunit_try_run_case+0x1a5/0x480 [ 14.579996] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.580021] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.580047] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.580072] ? __kthread_parkme+0x82/0x180 [ 14.580093] ? preempt_count_sub+0x50/0x80 [ 14.580117] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.580143] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.580168] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.580194] kthread+0x337/0x6f0 [ 14.580214] ? trace_preempt_on+0x20/0xc0 [ 14.580237] ? __pfx_kthread+0x10/0x10 [ 14.580258] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.580286] ? calculate_sigpending+0x7b/0xa0 [ 14.580311] ? __pfx_kthread+0x10/0x10 [ 14.580333] ret_from_fork+0x116/0x1d0 [ 14.580353] ? __pfx_kthread+0x10/0x10 [ 14.580374] ret_from_fork_asm+0x1a/0x30 [ 14.580405] </TASK> [ 14.580423] [ 14.588101] Allocated by task 277: [ 14.588620] kasan_save_stack+0x45/0x70 [ 14.588847] kasan_save_track+0x18/0x40 [ 14.589042] kasan_save_alloc_info+0x3b/0x50 [ 14.589263] __kasan_kmalloc+0xb7/0xc0 [ 14.589493] __kmalloc_cache_noprof+0x189/0x420 [ 14.589840] kasan_strings+0xc0/0xe80 [ 14.590002] kunit_try_run_case+0x1a5/0x480 [ 14.590214] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.590394] kthread+0x337/0x6f0 [ 14.590593] ret_from_fork+0x116/0x1d0 [ 14.590785] ret_from_fork_asm+0x1a/0x30 [ 14.590964] [ 14.591053] Freed by task 277: [ 14.591184] kasan_save_stack+0x45/0x70 [ 14.591368] kasan_save_track+0x18/0x40 [ 14.591600] kasan_save_free_info+0x3f/0x60 [ 14.591750] __kasan_slab_free+0x56/0x70 [ 14.591888] kfree+0x222/0x3f0 [ 14.592006] kasan_strings+0x2aa/0xe80 [ 14.592139] kunit_try_run_case+0x1a5/0x480 [ 14.592351] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.592620] kthread+0x337/0x6f0 [ 14.592788] ret_from_fork+0x116/0x1d0 [ 14.592975] ret_from_fork_asm+0x1a/0x30 [ 14.593175] [ 14.593272] The buggy address belongs to the object at ffff888103445d40 [ 14.593272] which belongs to the cache kmalloc-32 of size 32 [ 14.594034] The buggy address is located 16 bytes inside of [ 14.594034] freed 32-byte region [ffff888103445d40, ffff888103445d60) [ 14.594440] [ 14.594523] The buggy address belongs to the physical page: [ 14.594762] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103445 [ 14.595007] flags: 0x200000000000000(node=0|zone=2) [ 14.595206] page_type: f5(slab) [ 14.595374] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 14.595891] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 14.596269] page dumped because: kasan: bad access detected [ 14.596554] [ 14.596650] Memory state around the buggy address: [ 14.597086] ffff888103445c00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.597435] ffff888103445c80: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 14.597855] >ffff888103445d00: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.598200] ^ [ 14.598438] ffff888103445d80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.598749] ffff888103445e00: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.599124] ==================================================================
[ 14.799808] ================================================================== [ 14.800124] BUG: KASAN: slab-use-after-free in kasan_strings+0xcbc/0xe80 [ 14.800349] Read of size 1 at addr ffff8881025b0450 by task kunit_try_catch/277 [ 14.800571] [ 14.800655] CPU: 0 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 14.800696] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.800708] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.800782] Call Trace: [ 14.800795] <TASK> [ 14.800809] dump_stack_lvl+0x73/0xb0 [ 14.800839] print_report+0xd1/0x610 [ 14.800861] ? __virt_addr_valid+0x1db/0x2d0 [ 14.800885] ? kasan_strings+0xcbc/0xe80 [ 14.800906] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.800931] ? kasan_strings+0xcbc/0xe80 [ 14.800952] kasan_report+0x141/0x180 [ 14.800975] ? kasan_strings+0xcbc/0xe80 [ 14.801001] __asan_report_load1_noabort+0x18/0x20 [ 14.801027] kasan_strings+0xcbc/0xe80 [ 14.801047] ? trace_hardirqs_on+0x37/0xe0 [ 14.801084] ? __pfx_kasan_strings+0x10/0x10 [ 14.801106] ? finish_task_switch.isra.0+0x153/0x700 [ 14.801129] ? __switch_to+0x47/0xf50 [ 14.801155] ? __schedule+0x10cc/0x2b60 [ 14.801178] ? __pfx_read_tsc+0x10/0x10 [ 14.801200] ? ktime_get_ts64+0x86/0x230 [ 14.801225] kunit_try_run_case+0x1a5/0x480 [ 14.801249] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.801283] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.801309] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.801334] ? __kthread_parkme+0x82/0x180 [ 14.801356] ? preempt_count_sub+0x50/0x80 [ 14.801380] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.801405] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.801431] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.801458] kthread+0x337/0x6f0 [ 14.801478] ? trace_preempt_on+0x20/0xc0 [ 14.801500] ? __pfx_kthread+0x10/0x10 [ 14.801521] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.801544] ? calculate_sigpending+0x7b/0xa0 [ 14.801570] ? __pfx_kthread+0x10/0x10 [ 14.801591] ret_from_fork+0x116/0x1d0 [ 14.801610] ? __pfx_kthread+0x10/0x10 [ 14.801631] ret_from_fork_asm+0x1a/0x30 [ 14.801814] </TASK> [ 14.801826] [ 14.812869] Allocated by task 277: [ 14.813192] kasan_save_stack+0x45/0x70 [ 14.813405] kasan_save_track+0x18/0x40 [ 14.813590] kasan_save_alloc_info+0x3b/0x50 [ 14.814117] __kasan_kmalloc+0xb7/0xc0 [ 14.814273] __kmalloc_cache_noprof+0x189/0x420 [ 14.814584] kasan_strings+0xc0/0xe80 [ 14.815003] kunit_try_run_case+0x1a5/0x480 [ 14.815295] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.815631] kthread+0x337/0x6f0 [ 14.815860] ret_from_fork+0x116/0x1d0 [ 14.816039] ret_from_fork_asm+0x1a/0x30 [ 14.816394] [ 14.816498] Freed by task 277: [ 14.816827] kasan_save_stack+0x45/0x70 [ 14.816981] kasan_save_track+0x18/0x40 [ 14.817271] kasan_save_free_info+0x3f/0x60 [ 14.817811] __kasan_slab_free+0x56/0x70 [ 14.817997] kfree+0x222/0x3f0 [ 14.818390] kasan_strings+0x2aa/0xe80 [ 14.818581] kunit_try_run_case+0x1a5/0x480 [ 14.818863] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.819126] kthread+0x337/0x6f0 [ 14.819519] ret_from_fork+0x116/0x1d0 [ 14.819791] ret_from_fork_asm+0x1a/0x30 [ 14.820132] [ 14.820220] The buggy address belongs to the object at ffff8881025b0440 [ 14.820220] which belongs to the cache kmalloc-32 of size 32 [ 14.820907] The buggy address is located 16 bytes inside of [ 14.820907] freed 32-byte region [ffff8881025b0440, ffff8881025b0460) [ 14.821690] [ 14.821916] The buggy address belongs to the physical page: [ 14.822383] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1025b0 [ 14.822769] flags: 0x200000000000000(node=0|zone=2) [ 14.822981] page_type: f5(slab) [ 14.823288] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 14.823725] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 14.824145] page dumped because: kasan: bad access detected [ 14.824440] [ 14.824540] Memory state around the buggy address: [ 14.824841] ffff8881025b0300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.825335] ffff8881025b0380: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 14.825866] >ffff8881025b0400: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.826200] ^ [ 14.826466] ffff8881025b0480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.826964] ffff8881025b0500: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.827439] ==================================================================