Date
July 20, 2025, 11:12 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.840353] ================================================================== [ 18.840890] BUG: KASAN: slab-use-after-free in strnlen+0x80/0x88 [ 18.841095] Read of size 1 at addr fff00000c79c3ad0 by task kunit_try_catch/259 [ 18.841295] [ 18.841424] CPU: 1 UID: 0 PID: 259 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT [ 18.841737] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.841776] Hardware name: linux,dummy-virt (DT) [ 18.841865] Call trace: [ 18.841892] show_stack+0x20/0x38 (C) [ 18.841957] dump_stack_lvl+0x8c/0xd0 [ 18.842034] print_report+0x118/0x5d0 [ 18.842083] kasan_report+0xdc/0x128 [ 18.842156] __asan_report_load1_noabort+0x20/0x30 [ 18.842210] strnlen+0x80/0x88 [ 18.842494] kasan_strings+0x478/0xb00 [ 18.842942] kunit_try_run_case+0x170/0x3f0 [ 18.843215] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.843271] kthread+0x328/0x630 [ 18.843316] ret_from_fork+0x10/0x20 [ 18.843545] [ 18.843692] Allocated by task 259: [ 18.843758] kasan_save_stack+0x3c/0x68 [ 18.843832] kasan_save_track+0x20/0x40 [ 18.843874] kasan_save_alloc_info+0x40/0x58 [ 18.843927] __kasan_kmalloc+0xd4/0xd8 [ 18.844006] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.844125] kasan_strings+0xc8/0xb00 [ 18.844703] kunit_try_run_case+0x170/0x3f0 [ 18.844828] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.845020] kthread+0x328/0x630 [ 18.845215] ret_from_fork+0x10/0x20 [ 18.845261] [ 18.845389] Freed by task 259: [ 18.845519] kasan_save_stack+0x3c/0x68 [ 18.846124] kasan_save_track+0x20/0x40 [ 18.846177] kasan_save_free_info+0x4c/0x78 [ 18.846220] __kasan_slab_free+0x6c/0x98 [ 18.846264] kfree+0x214/0x3c8 [ 18.846301] kasan_strings+0x24c/0xb00 [ 18.846340] kunit_try_run_case+0x170/0x3f0 [ 18.846413] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.846542] kthread+0x328/0x630 [ 18.846578] ret_from_fork+0x10/0x20 [ 18.846616] [ 18.846654] The buggy address belongs to the object at fff00000c79c3ac0 [ 18.846654] which belongs to the cache kmalloc-32 of size 32 [ 18.846770] The buggy address is located 16 bytes inside of [ 18.846770] freed 32-byte region [fff00000c79c3ac0, fff00000c79c3ae0) [ 18.846836] [ 18.846922] The buggy address belongs to the physical page: [ 18.847099] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079c3 [ 18.847208] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.847755] page_type: f5(slab) [ 18.847811] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 18.847866] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 18.847919] page dumped because: kasan: bad access detected [ 18.848006] [ 18.848093] Memory state around the buggy address: [ 18.848133] fff00000c79c3980: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 18.848317] fff00000c79c3a00: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 18.848364] >fff00000c79c3a80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 18.848406] ^ [ 18.848506] fff00000c79c3b00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 18.848659] fff00000c79c3b80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 18.848732] ==================================================================
[ 19.095768] ================================================================== [ 19.096170] BUG: KASAN: slab-use-after-free in strnlen+0x80/0x88 [ 19.096434] Read of size 1 at addr fff00000c5b41290 by task kunit_try_catch/259 [ 19.096488] [ 19.096525] CPU: 1 UID: 0 PID: 259 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT [ 19.096611] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.097130] Hardware name: linux,dummy-virt (DT) [ 19.097207] Call trace: [ 19.097388] show_stack+0x20/0x38 (C) [ 19.097693] dump_stack_lvl+0x8c/0xd0 [ 19.097758] print_report+0x118/0x5d0 [ 19.098027] kasan_report+0xdc/0x128 [ 19.098211] __asan_report_load1_noabort+0x20/0x30 [ 19.098737] strnlen+0x80/0x88 [ 19.098787] kasan_strings+0x478/0xb00 [ 19.098834] kunit_try_run_case+0x170/0x3f0 [ 19.099462] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.099538] kthread+0x328/0x630 [ 19.099950] ret_from_fork+0x10/0x20 [ 19.100142] [ 19.100467] Allocated by task 259: [ 19.100638] kasan_save_stack+0x3c/0x68 [ 19.100700] kasan_save_track+0x20/0x40 [ 19.100767] kasan_save_alloc_info+0x40/0x58 [ 19.100810] __kasan_kmalloc+0xd4/0xd8 [ 19.100851] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.100893] kasan_strings+0xc8/0xb00 [ 19.101301] kunit_try_run_case+0x170/0x3f0 [ 19.101384] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.101432] kthread+0x328/0x630 [ 19.101751] ret_from_fork+0x10/0x20 [ 19.101823] [ 19.101978] Freed by task 259: [ 19.102170] kasan_save_stack+0x3c/0x68 [ 19.102320] kasan_save_track+0x20/0x40 [ 19.102365] kasan_save_free_info+0x4c/0x78 [ 19.102486] __kasan_slab_free+0x6c/0x98 [ 19.102554] kfree+0x214/0x3c8 [ 19.102590] kasan_strings+0x24c/0xb00 [ 19.102859] kunit_try_run_case+0x170/0x3f0 [ 19.103032] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.103389] kthread+0x328/0x630 [ 19.103502] ret_from_fork+0x10/0x20 [ 19.103815] [ 19.103863] The buggy address belongs to the object at fff00000c5b41280 [ 19.103863] which belongs to the cache kmalloc-32 of size 32 [ 19.104112] The buggy address is located 16 bytes inside of [ 19.104112] freed 32-byte region [fff00000c5b41280, fff00000c5b412a0) [ 19.104581] [ 19.104711] The buggy address belongs to the physical page: [ 19.104746] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b41 [ 19.104804] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.105287] page_type: f5(slab) [ 19.105349] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 19.105413] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 19.105476] page dumped because: kasan: bad access detected [ 19.105695] [ 19.105717] Memory state around the buggy address: [ 19.105755] fff00000c5b41180: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 19.106221] fff00000c5b41200: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 19.106608] >fff00000c5b41280: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 19.106877] ^ [ 19.107204] fff00000c5b41300: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 19.107469] fff00000c5b41380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 19.107660] ==================================================================
[ 14.698232] ================================================================== [ 14.698560] BUG: KASAN: slab-use-after-free in strnlen+0x73/0x80 [ 14.699139] Read of size 1 at addr ffff8881039514d0 by task kunit_try_catch/277 [ 14.699760] [ 14.699878] CPU: 1 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT(voluntary) [ 14.699924] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.699936] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.699958] Call Trace: [ 14.699973] <TASK> [ 14.699989] dump_stack_lvl+0x73/0xb0 [ 14.700019] print_report+0xd1/0x610 [ 14.700043] ? __virt_addr_valid+0x1db/0x2d0 [ 14.700067] ? strnlen+0x73/0x80 [ 14.700086] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.700109] ? strnlen+0x73/0x80 [ 14.700127] kasan_report+0x141/0x180 [ 14.700149] ? strnlen+0x73/0x80 [ 14.700174] __asan_report_load1_noabort+0x18/0x20 [ 14.700198] strnlen+0x73/0x80 [ 14.700218] kasan_strings+0x615/0xe80 [ 14.700239] ? trace_hardirqs_on+0x37/0xe0 [ 14.700263] ? __pfx_kasan_strings+0x10/0x10 [ 14.700284] ? finish_task_switch.isra.0+0x153/0x700 [ 14.700306] ? __switch_to+0x47/0xf50 [ 14.700332] ? __schedule+0x10c6/0x2b60 [ 14.700354] ? __pfx_read_tsc+0x10/0x10 [ 14.700375] ? ktime_get_ts64+0x86/0x230 [ 14.700414] kunit_try_run_case+0x1a5/0x480 [ 14.700440] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.700462] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.700485] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.700510] ? __kthread_parkme+0x82/0x180 [ 14.700531] ? preempt_count_sub+0x50/0x80 [ 14.700555] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.700580] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.700614] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.700638] kthread+0x337/0x6f0 [ 14.700659] ? trace_preempt_on+0x20/0xc0 [ 14.700689] ? __pfx_kthread+0x10/0x10 [ 14.700710] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.700732] ? calculate_sigpending+0x7b/0xa0 [ 14.700757] ? __pfx_kthread+0x10/0x10 [ 14.700779] ret_from_fork+0x116/0x1d0 [ 14.700798] ? __pfx_kthread+0x10/0x10 [ 14.700819] ret_from_fork_asm+0x1a/0x30 [ 14.700852] </TASK> [ 14.700863] [ 14.708270] Allocated by task 277: [ 14.708455] kasan_save_stack+0x45/0x70 [ 14.708720] kasan_save_track+0x18/0x40 [ 14.708928] kasan_save_alloc_info+0x3b/0x50 [ 14.709147] __kasan_kmalloc+0xb7/0xc0 [ 14.709320] __kmalloc_cache_noprof+0x189/0x420 [ 14.709549] kasan_strings+0xc0/0xe80 [ 14.709781] kunit_try_run_case+0x1a5/0x480 [ 14.709983] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.710199] kthread+0x337/0x6f0 [ 14.710371] ret_from_fork+0x116/0x1d0 [ 14.710550] ret_from_fork_asm+0x1a/0x30 [ 14.710749] [ 14.710846] Freed by task 277: [ 14.710996] kasan_save_stack+0x45/0x70 [ 14.711142] kasan_save_track+0x18/0x40 [ 14.711333] kasan_save_free_info+0x3f/0x60 [ 14.711499] __kasan_slab_free+0x56/0x70 [ 14.711755] kfree+0x222/0x3f0 [ 14.711925] kasan_strings+0x2aa/0xe80 [ 14.712078] kunit_try_run_case+0x1a5/0x480 [ 14.712284] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.712494] kthread+0x337/0x6f0 [ 14.712686] ret_from_fork+0x116/0x1d0 [ 14.712876] ret_from_fork_asm+0x1a/0x30 [ 14.713069] [ 14.713159] The buggy address belongs to the object at ffff8881039514c0 [ 14.713159] which belongs to the cache kmalloc-32 of size 32 [ 14.713588] The buggy address is located 16 bytes inside of [ 14.713588] freed 32-byte region [ffff8881039514c0, ffff8881039514e0) [ 14.714084] [ 14.714167] The buggy address belongs to the physical page: [ 14.714404] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103951 [ 14.714689] flags: 0x200000000000000(node=0|zone=2) [ 14.714936] page_type: f5(slab) [ 14.715139] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 14.715434] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 14.715782] page dumped because: kasan: bad access detected [ 14.716007] [ 14.716084] Memory state around the buggy address: [ 14.716299] ffff888103951380: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.716603] ffff888103951400: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.716891] >ffff888103951480: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.717161] ^ [ 14.717383] ffff888103951500: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.717730] ffff888103951580: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 14.717951] ==================================================================
[ 14.793417] ================================================================== [ 14.793763] BUG: KASAN: slab-use-after-free in strnlen+0x73/0x80 [ 14.794074] Read of size 1 at addr ffff8881027c0890 by task kunit_try_catch/277 [ 14.794399] [ 14.794514] CPU: 1 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT(voluntary) [ 14.794558] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.794571] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.794593] Call Trace: [ 14.794610] <TASK> [ 14.794627] dump_stack_lvl+0x73/0xb0 [ 14.794653] print_report+0xd1/0x610 [ 14.794675] ? __virt_addr_valid+0x1db/0x2d0 [ 14.794697] ? strnlen+0x73/0x80 [ 14.794714] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.794737] ? strnlen+0x73/0x80 [ 14.794754] kasan_report+0x141/0x180 [ 14.794776] ? strnlen+0x73/0x80 [ 14.794797] __asan_report_load1_noabort+0x18/0x20 [ 14.794821] strnlen+0x73/0x80 [ 14.794840] kasan_strings+0x615/0xe80 [ 14.795003] ? trace_hardirqs_on+0x37/0xe0 [ 14.795028] ? __pfx_kasan_strings+0x10/0x10 [ 14.795048] ? finish_task_switch.isra.0+0x153/0x700 [ 14.795069] ? __switch_to+0x47/0xf50 [ 14.795096] ? __schedule+0x10c6/0x2b60 [ 14.795118] ? __pfx_read_tsc+0x10/0x10 [ 14.795141] ? ktime_get_ts64+0x86/0x230 [ 14.795179] kunit_try_run_case+0x1a5/0x480 [ 14.795203] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.795225] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.795249] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.795272] ? __kthread_parkme+0x82/0x180 [ 14.795291] ? preempt_count_sub+0x50/0x80 [ 14.795314] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.795337] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.795360] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.795384] kthread+0x337/0x6f0 [ 14.795403] ? trace_preempt_on+0x20/0xc0 [ 14.795424] ? __pfx_kthread+0x10/0x10 [ 14.795445] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.795465] ? calculate_sigpending+0x7b/0xa0 [ 14.795489] ? __pfx_kthread+0x10/0x10 [ 14.795511] ret_from_fork+0x116/0x1d0 [ 14.795529] ? __pfx_kthread+0x10/0x10 [ 14.795550] ret_from_fork_asm+0x1a/0x30 [ 14.795579] </TASK> [ 14.795590] [ 14.804553] Allocated by task 277: [ 14.804697] kasan_save_stack+0x45/0x70 [ 14.804898] kasan_save_track+0x18/0x40 [ 14.805102] kasan_save_alloc_info+0x3b/0x50 [ 14.805352] __kasan_kmalloc+0xb7/0xc0 [ 14.805547] __kmalloc_cache_noprof+0x189/0x420 [ 14.805772] kasan_strings+0xc0/0xe80 [ 14.806037] kunit_try_run_case+0x1a5/0x480 [ 14.806230] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.806575] kthread+0x337/0x6f0 [ 14.806735] ret_from_fork+0x116/0x1d0 [ 14.807161] ret_from_fork_asm+0x1a/0x30 [ 14.807319] [ 14.807393] Freed by task 277: [ 14.807508] kasan_save_stack+0x45/0x70 [ 14.807647] kasan_save_track+0x18/0x40 [ 14.807785] kasan_save_free_info+0x3f/0x60 [ 14.807936] __kasan_slab_free+0x56/0x70 [ 14.808081] kfree+0x222/0x3f0 [ 14.808251] kasan_strings+0x2aa/0xe80 [ 14.808450] kunit_try_run_case+0x1a5/0x480 [ 14.808664] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.808915] kthread+0x337/0x6f0 [ 14.809340] ret_from_fork+0x116/0x1d0 [ 14.809548] ret_from_fork_asm+0x1a/0x30 [ 14.809744] [ 14.809840] The buggy address belongs to the object at ffff8881027c0880 [ 14.809840] which belongs to the cache kmalloc-32 of size 32 [ 14.810626] The buggy address is located 16 bytes inside of [ 14.810626] freed 32-byte region [ffff8881027c0880, ffff8881027c08a0) [ 14.811415] [ 14.811522] The buggy address belongs to the physical page: [ 14.811759] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1027c0 [ 14.812199] flags: 0x200000000000000(node=0|zone=2) [ 14.812429] page_type: f5(slab) [ 14.812556] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 14.812791] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 14.813280] page dumped because: kasan: bad access detected [ 14.813692] [ 14.813796] Memory state around the buggy address: [ 14.814167] ffff8881027c0780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.814484] ffff8881027c0800: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.814741] >ffff8881027c0880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.815423] ^ [ 14.815617] ffff8881027c0900: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 14.815980] ffff8881027c0980: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 14.816311] ==================================================================