Date
July 20, 2025, 11:12 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.818155] ================================================================== [ 18.818220] BUG: KASAN: slab-use-after-free in strcmp+0xc0/0xc8 [ 18.818275] Read of size 1 at addr fff00000c79c3ad0 by task kunit_try_catch/259 [ 18.818656] [ 18.818844] CPU: 1 UID: 0 PID: 259 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT [ 18.818948] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.818978] Hardware name: linux,dummy-virt (DT) [ 18.819031] Call trace: [ 18.819057] show_stack+0x20/0x38 (C) [ 18.819115] dump_stack_lvl+0x8c/0xd0 [ 18.819163] print_report+0x118/0x5d0 [ 18.819213] kasan_report+0xdc/0x128 [ 18.819606] __asan_report_load1_noabort+0x20/0x30 [ 18.819811] strcmp+0xc0/0xc8 [ 18.819888] kasan_strings+0x340/0xb00 [ 18.819976] kunit_try_run_case+0x170/0x3f0 [ 18.820027] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.820103] kthread+0x328/0x630 [ 18.820169] ret_from_fork+0x10/0x20 [ 18.820392] [ 18.820499] Allocated by task 259: [ 18.820531] kasan_save_stack+0x3c/0x68 [ 18.820577] kasan_save_track+0x20/0x40 [ 18.820618] kasan_save_alloc_info+0x40/0x58 [ 18.820662] __kasan_kmalloc+0xd4/0xd8 [ 18.820703] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.820799] kasan_strings+0xc8/0xb00 [ 18.820842] kunit_try_run_case+0x170/0x3f0 [ 18.820888] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.820946] kthread+0x328/0x630 [ 18.820982] ret_from_fork+0x10/0x20 [ 18.821313] [ 18.821341] Freed by task 259: [ 18.821573] kasan_save_stack+0x3c/0x68 [ 18.821627] kasan_save_track+0x20/0x40 [ 18.821760] kasan_save_free_info+0x4c/0x78 [ 18.821870] __kasan_slab_free+0x6c/0x98 [ 18.821920] kfree+0x214/0x3c8 [ 18.821956] kasan_strings+0x24c/0xb00 [ 18.821995] kunit_try_run_case+0x170/0x3f0 [ 18.822059] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.822386] kthread+0x328/0x630 [ 18.822442] ret_from_fork+0x10/0x20 [ 18.822501] [ 18.822523] The buggy address belongs to the object at fff00000c79c3ac0 [ 18.822523] which belongs to the cache kmalloc-32 of size 32 [ 18.822585] The buggy address is located 16 bytes inside of [ 18.822585] freed 32-byte region [fff00000c79c3ac0, fff00000c79c3ae0) [ 18.822664] [ 18.822688] The buggy address belongs to the physical page: [ 18.822725] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079c3 [ 18.822780] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.822843] page_type: f5(slab) [ 18.822885] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 18.823259] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 18.823308] page dumped because: kasan: bad access detected [ 18.823340] [ 18.823523] Memory state around the buggy address: [ 18.823750] fff00000c79c3980: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 18.824035] fff00000c79c3a00: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 18.824293] >fff00000c79c3a80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 18.824389] ^ [ 18.824431] fff00000c79c3b00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 18.824620] fff00000c79c3b80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 18.824669] ==================================================================
[ 19.054086] ================================================================== [ 19.054145] BUG: KASAN: slab-use-after-free in strcmp+0xc0/0xc8 [ 19.054204] Read of size 1 at addr fff00000c5b41290 by task kunit_try_catch/259 [ 19.054259] [ 19.054299] CPU: 1 UID: 0 PID: 259 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT [ 19.054390] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.054985] Hardware name: linux,dummy-virt (DT) [ 19.055040] Call trace: [ 19.055069] show_stack+0x20/0x38 (C) [ 19.055181] dump_stack_lvl+0x8c/0xd0 [ 19.055803] print_report+0x118/0x5d0 [ 19.055863] kasan_report+0xdc/0x128 [ 19.056500] __asan_report_load1_noabort+0x20/0x30 [ 19.056564] strcmp+0xc0/0xc8 [ 19.057518] kasan_strings+0x340/0xb00 [ 19.057579] kunit_try_run_case+0x170/0x3f0 [ 19.058120] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.058187] kthread+0x328/0x630 [ 19.058242] ret_from_fork+0x10/0x20 [ 19.058393] [ 19.058495] Allocated by task 259: [ 19.058571] kasan_save_stack+0x3c/0x68 [ 19.058730] kasan_save_track+0x20/0x40 [ 19.058773] kasan_save_alloc_info+0x40/0x58 [ 19.059230] __kasan_kmalloc+0xd4/0xd8 [ 19.059283] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.059328] kasan_strings+0xc8/0xb00 [ 19.059682] kunit_try_run_case+0x170/0x3f0 [ 19.059737] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.059785] kthread+0x328/0x630 [ 19.060087] ret_from_fork+0x10/0x20 [ 19.060131] [ 19.060153] Freed by task 259: [ 19.060185] kasan_save_stack+0x3c/0x68 [ 19.060608] kasan_save_track+0x20/0x40 [ 19.060668] kasan_save_free_info+0x4c/0x78 [ 19.060852] __kasan_slab_free+0x6c/0x98 [ 19.060898] kfree+0x214/0x3c8 [ 19.061206] kasan_strings+0x24c/0xb00 [ 19.061251] kunit_try_run_case+0x170/0x3f0 [ 19.061374] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.061424] kthread+0x328/0x630 [ 19.061479] ret_from_fork+0x10/0x20 [ 19.062280] [ 19.062890] The buggy address belongs to the object at fff00000c5b41280 [ 19.062890] which belongs to the cache kmalloc-32 of size 32 [ 19.063123] The buggy address is located 16 bytes inside of [ 19.063123] freed 32-byte region [fff00000c5b41280, fff00000c5b412a0) [ 19.063338] [ 19.063544] The buggy address belongs to the physical page: [ 19.063687] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b41 [ 19.063753] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.063968] page_type: f5(slab) [ 19.064486] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 19.064542] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 19.064842] page dumped because: kasan: bad access detected [ 19.064883] [ 19.064903] Memory state around the buggy address: [ 19.065105] fff00000c5b41180: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 19.065157] fff00000c5b41200: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 19.065203] >fff00000c5b41280: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 19.065341] ^ [ 19.065376] fff00000c5b41300: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 19.065424] fff00000c5b41380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 19.065465] ==================================================================
[ 14.622716] ================================================================== [ 14.624218] BUG: KASAN: slab-use-after-free in strcmp+0xb0/0xc0 [ 14.624859] Read of size 1 at addr ffff8881039514d0 by task kunit_try_catch/277 [ 14.625534] [ 14.625736] CPU: 1 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT(voluntary) [ 14.625784] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.625797] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.625819] Call Trace: [ 14.625834] <TASK> [ 14.625866] dump_stack_lvl+0x73/0xb0 [ 14.625897] print_report+0xd1/0x610 [ 14.625924] ? __virt_addr_valid+0x1db/0x2d0 [ 14.625963] ? strcmp+0xb0/0xc0 [ 14.625981] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.626005] ? strcmp+0xb0/0xc0 [ 14.626024] kasan_report+0x141/0x180 [ 14.626047] ? strcmp+0xb0/0xc0 [ 14.626070] __asan_report_load1_noabort+0x18/0x20 [ 14.626096] strcmp+0xb0/0xc0 [ 14.626116] kasan_strings+0x431/0xe80 [ 14.626136] ? trace_hardirqs_on+0x37/0xe0 [ 14.626162] ? __pfx_kasan_strings+0x10/0x10 [ 14.626183] ? finish_task_switch.isra.0+0x153/0x700 [ 14.626207] ? __switch_to+0x47/0xf50 [ 14.626236] ? __schedule+0x10c6/0x2b60 [ 14.626260] ? __pfx_read_tsc+0x10/0x10 [ 14.626282] ? ktime_get_ts64+0x86/0x230 [ 14.626308] kunit_try_run_case+0x1a5/0x480 [ 14.626335] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.626358] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.626384] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.626417] ? __kthread_parkme+0x82/0x180 [ 14.626439] ? preempt_count_sub+0x50/0x80 [ 14.626464] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.626489] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.626513] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.626538] kthread+0x337/0x6f0 [ 14.626558] ? trace_preempt_on+0x20/0xc0 [ 14.626581] ? __pfx_kthread+0x10/0x10 [ 14.626613] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.626635] ? calculate_sigpending+0x7b/0xa0 [ 14.626661] ? __pfx_kthread+0x10/0x10 [ 14.626684] ret_from_fork+0x116/0x1d0 [ 14.626703] ? __pfx_kthread+0x10/0x10 [ 14.626724] ret_from_fork_asm+0x1a/0x30 [ 14.626757] </TASK> [ 14.626769] [ 14.638596] Allocated by task 277: [ 14.638855] kasan_save_stack+0x45/0x70 [ 14.639162] kasan_save_track+0x18/0x40 [ 14.639542] kasan_save_alloc_info+0x3b/0x50 [ 14.639740] __kasan_kmalloc+0xb7/0xc0 [ 14.640005] __kmalloc_cache_noprof+0x189/0x420 [ 14.640364] kasan_strings+0xc0/0xe80 [ 14.640683] kunit_try_run_case+0x1a5/0x480 [ 14.640997] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.641377] kthread+0x337/0x6f0 [ 14.641510] ret_from_fork+0x116/0x1d0 [ 14.641784] ret_from_fork_asm+0x1a/0x30 [ 14.642163] [ 14.642337] Freed by task 277: [ 14.642669] kasan_save_stack+0x45/0x70 [ 14.642958] kasan_save_track+0x18/0x40 [ 14.643241] kasan_save_free_info+0x3f/0x60 [ 14.643403] __kasan_slab_free+0x56/0x70 [ 14.643576] kfree+0x222/0x3f0 [ 14.643768] kasan_strings+0x2aa/0xe80 [ 14.643955] kunit_try_run_case+0x1a5/0x480 [ 14.644131] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.644371] kthread+0x337/0x6f0 [ 14.644555] ret_from_fork+0x116/0x1d0 [ 14.644730] ret_from_fork_asm+0x1a/0x30 [ 14.644932] [ 14.645041] The buggy address belongs to the object at ffff8881039514c0 [ 14.645041] which belongs to the cache kmalloc-32 of size 32 [ 14.645507] The buggy address is located 16 bytes inside of [ 14.645507] freed 32-byte region [ffff8881039514c0, ffff8881039514e0) [ 14.645970] [ 14.646055] The buggy address belongs to the physical page: [ 14.646333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103951 [ 14.646700] flags: 0x200000000000000(node=0|zone=2) [ 14.646913] page_type: f5(slab) [ 14.647086] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 14.647463] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 14.647818] page dumped because: kasan: bad access detected [ 14.648062] [ 14.648161] Memory state around the buggy address: [ 14.648384] ffff888103951380: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.648734] ffff888103951400: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.649032] >ffff888103951480: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.649341] ^ [ 14.649620] ffff888103951500: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.649925] ffff888103951580: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.650213] ==================================================================
[ 14.713220] ================================================================== [ 14.714608] BUG: KASAN: slab-use-after-free in strcmp+0xb0/0xc0 [ 14.714999] Read of size 1 at addr ffff8881027c0890 by task kunit_try_catch/277 [ 14.715292] [ 14.715421] CPU: 1 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT(voluntary) [ 14.715471] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.715483] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.715508] Call Trace: [ 14.715523] <TASK> [ 14.715542] dump_stack_lvl+0x73/0xb0 [ 14.715573] print_report+0xd1/0x610 [ 14.715600] ? __virt_addr_valid+0x1db/0x2d0 [ 14.715624] ? strcmp+0xb0/0xc0 [ 14.715641] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.715665] ? strcmp+0xb0/0xc0 [ 14.715682] kasan_report+0x141/0x180 [ 14.715705] ? strcmp+0xb0/0xc0 [ 14.715726] __asan_report_load1_noabort+0x18/0x20 [ 14.715751] strcmp+0xb0/0xc0 [ 14.715770] kasan_strings+0x431/0xe80 [ 14.715791] ? trace_hardirqs_on+0x37/0xe0 [ 14.715815] ? __pfx_kasan_strings+0x10/0x10 [ 14.715835] ? finish_task_switch.isra.0+0x153/0x700 [ 14.715858] ? __switch_to+0x47/0xf50 [ 14.715883] ? __schedule+0x10c6/0x2b60 [ 14.715906] ? __pfx_read_tsc+0x10/0x10 [ 14.715927] ? ktime_get_ts64+0x86/0x230 [ 14.715952] kunit_try_run_case+0x1a5/0x480 [ 14.715976] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.715999] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.716023] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.716058] ? __kthread_parkme+0x82/0x180 [ 14.716079] ? preempt_count_sub+0x50/0x80 [ 14.716102] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.716125] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.716159] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.716182] kthread+0x337/0x6f0 [ 14.716201] ? trace_preempt_on+0x20/0xc0 [ 14.716223] ? __pfx_kthread+0x10/0x10 [ 14.716244] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.716267] ? calculate_sigpending+0x7b/0xa0 [ 14.716292] ? __pfx_kthread+0x10/0x10 [ 14.716315] ret_from_fork+0x116/0x1d0 [ 14.716337] ? __pfx_kthread+0x10/0x10 [ 14.716358] ret_from_fork_asm+0x1a/0x30 [ 14.716389] </TASK> [ 14.716399] [ 14.729670] Allocated by task 277: [ 14.729998] kasan_save_stack+0x45/0x70 [ 14.730540] kasan_save_track+0x18/0x40 [ 14.730879] kasan_save_alloc_info+0x3b/0x50 [ 14.731436] __kasan_kmalloc+0xb7/0xc0 [ 14.731798] __kmalloc_cache_noprof+0x189/0x420 [ 14.732062] kasan_strings+0xc0/0xe80 [ 14.732450] kunit_try_run_case+0x1a5/0x480 [ 14.732799] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.733388] kthread+0x337/0x6f0 [ 14.733612] ret_from_fork+0x116/0x1d0 [ 14.733750] ret_from_fork_asm+0x1a/0x30 [ 14.734032] [ 14.734219] Freed by task 277: [ 14.734498] kasan_save_stack+0x45/0x70 [ 14.734845] kasan_save_track+0x18/0x40 [ 14.735295] kasan_save_free_info+0x3f/0x60 [ 14.735679] __kasan_slab_free+0x56/0x70 [ 14.736133] kfree+0x222/0x3f0 [ 14.736292] kasan_strings+0x2aa/0xe80 [ 14.736457] kunit_try_run_case+0x1a5/0x480 [ 14.736608] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.736784] kthread+0x337/0x6f0 [ 14.737260] ret_from_fork+0x116/0x1d0 [ 14.737636] ret_from_fork_asm+0x1a/0x30 [ 14.737998] [ 14.738316] The buggy address belongs to the object at ffff8881027c0880 [ 14.738316] which belongs to the cache kmalloc-32 of size 32 [ 14.739587] The buggy address is located 16 bytes inside of [ 14.739587] freed 32-byte region [ffff8881027c0880, ffff8881027c08a0) [ 14.740332] [ 14.740500] The buggy address belongs to the physical page: [ 14.741041] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1027c0 [ 14.741588] flags: 0x200000000000000(node=0|zone=2) [ 14.741761] page_type: f5(slab) [ 14.742056] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 14.742737] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 14.743625] page dumped because: kasan: bad access detected [ 14.744167] [ 14.744350] Memory state around the buggy address: [ 14.744532] ffff8881027c0780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.744756] ffff8881027c0800: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 14.745311] >ffff8881027c0880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.746122] ^ [ 14.746638] ffff8881027c0900: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 14.747342] ffff8881027c0980: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.747958] ==================================================================