Date
Dec. 6, 2024, 3:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.910624] ================================================================== [ 31.911938] BUG: KASAN: slab-use-after-free in ksize_uaf+0x168/0x600 [ 31.912728] Read of size 1 at addr fff00000c6779700 by task kunit_try_catch/185 [ 31.913536] [ 31.913976] CPU: 1 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 31.915783] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.916343] Hardware name: linux,dummy-virt (DT) [ 31.916983] Call trace: [ 31.917370] show_stack+0x20/0x38 (C) [ 31.917919] dump_stack_lvl+0x8c/0xd0 [ 31.918725] print_report+0x118/0x5e0 [ 31.919346] kasan_report+0xc8/0x118 [ 31.919795] __kasan_check_byte+0x54/0x70 [ 31.920504] ksize+0x30/0x88 [ 31.921061] ksize_uaf+0x168/0x600 [ 31.921688] kunit_try_run_case+0x14c/0x3d0 [ 31.922271] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.923576] kthread+0x24c/0x2d0 [ 31.924155] ret_from_fork+0x10/0x20 [ 31.924759] [ 31.925082] Allocated by task 185: [ 31.925594] kasan_save_stack+0x3c/0x68 [ 31.926215] kasan_save_track+0x20/0x40 [ 31.927108] kasan_save_alloc_info+0x40/0x58 [ 31.927699] __kasan_kmalloc+0xd4/0xd8 [ 31.928310] __kmalloc_cache_noprof+0x15c/0x3c0 [ 31.928937] ksize_uaf+0xb8/0x600 [ 31.929533] kunit_try_run_case+0x14c/0x3d0 [ 31.930139] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.931289] kthread+0x24c/0x2d0 [ 31.932003] ret_from_fork+0x10/0x20 [ 31.932379] [ 31.932768] Freed by task 185: [ 31.933295] kasan_save_stack+0x3c/0x68 [ 31.933857] kasan_save_track+0x20/0x40 [ 31.935054] kasan_save_free_info+0x4c/0x78 [ 31.935660] __kasan_slab_free+0x6c/0x98 [ 31.936328] kfree+0x114/0x3c8 [ 31.936826] ksize_uaf+0x11c/0x600 [ 31.937419] kunit_try_run_case+0x14c/0x3d0 [ 31.938105] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.938776] kthread+0x24c/0x2d0 [ 31.939359] ret_from_fork+0x10/0x20 [ 31.940314] [ 31.940671] The buggy address belongs to the object at fff00000c6779700 [ 31.940671] which belongs to the cache kmalloc-128 of size 128 [ 31.941911] The buggy address is located 0 bytes inside of [ 31.941911] freed 128-byte region [fff00000c6779700, fff00000c6779780) [ 31.943602] [ 31.943979] The buggy address belongs to the physical page: [ 31.944755] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106779 [ 31.945679] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.946573] page_type: f5(slab) [ 31.947118] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 31.948452] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.949298] page dumped because: kasan: bad access detected [ 31.949929] [ 31.950343] Memory state around the buggy address: [ 31.950894] fff00000c6779600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 31.952108] fff00000c6779680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.953039] >fff00000c6779700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.953826] ^ [ 31.954322] fff00000c6779780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.955211] fff00000c6779800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.956077] ================================================================== [ 31.960054] ================================================================== [ 31.961013] BUG: KASAN: slab-use-after-free in ksize_uaf+0x59c/0x600 [ 31.961733] Read of size 1 at addr fff00000c6779700 by task kunit_try_catch/185 [ 31.963294] [ 31.963712] CPU: 1 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 31.965294] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.966052] Hardware name: linux,dummy-virt (DT) [ 31.967272] Call trace: [ 31.967642] show_stack+0x20/0x38 (C) [ 31.968119] dump_stack_lvl+0x8c/0xd0 [ 31.968625] print_report+0x118/0x5e0 [ 31.969270] kasan_report+0xc8/0x118 [ 31.969873] __asan_report_load1_noabort+0x20/0x30 [ 31.970625] ksize_uaf+0x59c/0x600 [ 31.971230] kunit_try_run_case+0x14c/0x3d0 [ 31.971861] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.972652] kthread+0x24c/0x2d0 [ 31.973493] ret_from_fork+0x10/0x20 [ 31.974155] [ 31.975038] Allocated by task 185: [ 31.975467] kasan_save_stack+0x3c/0x68 [ 31.976154] kasan_save_track+0x20/0x40 [ 31.977030] kasan_save_alloc_info+0x40/0x58 [ 31.977542] __kasan_kmalloc+0xd4/0xd8 [ 31.978156] __kmalloc_cache_noprof+0x15c/0x3c0 [ 31.979274] ksize_uaf+0xb8/0x600 [ 31.979825] kunit_try_run_case+0x14c/0x3d0 [ 31.980478] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.981256] kthread+0x24c/0x2d0 [ 31.981834] ret_from_fork+0x10/0x20 [ 31.982721] [ 31.983095] Freed by task 185: [ 31.983538] kasan_save_stack+0x3c/0x68 [ 31.984289] kasan_save_track+0x20/0x40 [ 31.984982] kasan_save_free_info+0x4c/0x78 [ 31.985632] __kasan_slab_free+0x6c/0x98 [ 31.986452] kfree+0x114/0x3c8 [ 31.987560] ksize_uaf+0x11c/0x600 [ 31.988139] kunit_try_run_case+0x14c/0x3d0 [ 31.988881] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.989762] kthread+0x24c/0x2d0 [ 31.990549] ret_from_fork+0x10/0x20 [ 31.991045] [ 31.991411] The buggy address belongs to the object at fff00000c6779700 [ 31.991411] which belongs to the cache kmalloc-128 of size 128 [ 31.992587] The buggy address is located 0 bytes inside of [ 31.992587] freed 128-byte region [fff00000c6779700, fff00000c6779780) [ 31.994052] [ 31.994543] The buggy address belongs to the physical page: [ 31.995711] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106779 [ 31.996456] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.997304] page_type: f5(slab) [ 31.997863] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 31.999300] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.000213] page dumped because: kasan: bad access detected [ 32.000731] [ 32.001124] Memory state around the buggy address: [ 32.001827] fff00000c6779600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.003397] fff00000c6779680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.004391] >fff00000c6779700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.005290] ^ [ 32.005877] fff00000c6779780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.007628] fff00000c6779800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.008468] ================================================================== [ 32.011061] ================================================================== [ 32.012478] BUG: KASAN: slab-use-after-free in ksize_uaf+0x548/0x600 [ 32.013227] Read of size 1 at addr fff00000c6779778 by task kunit_try_catch/185 [ 32.014148] [ 32.014607] CPU: 1 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 32.016580] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.017076] Hardware name: linux,dummy-virt (DT) [ 32.017383] Call trace: [ 32.017605] show_stack+0x20/0x38 (C) [ 32.017890] dump_stack_lvl+0x8c/0xd0 [ 32.018160] print_report+0x118/0x5e0 [ 32.018428] kasan_report+0xc8/0x118 [ 32.019042] __asan_report_load1_noabort+0x20/0x30 [ 32.019855] ksize_uaf+0x548/0x600 [ 32.020533] kunit_try_run_case+0x14c/0x3d0 [ 32.021282] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.022157] kthread+0x24c/0x2d0 [ 32.022890] ret_from_fork+0x10/0x20 [ 32.023642] [ 32.023982] Allocated by task 185: [ 32.024479] kasan_save_stack+0x3c/0x68 [ 32.025049] kasan_save_track+0x20/0x40 [ 32.025665] kasan_save_alloc_info+0x40/0x58 [ 32.026288] __kasan_kmalloc+0xd4/0xd8 [ 32.026864] __kmalloc_cache_noprof+0x15c/0x3c0 [ 32.027554] ksize_uaf+0xb8/0x600 [ 32.028028] kunit_try_run_case+0x14c/0x3d0 [ 32.028694] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.029333] kthread+0x24c/0x2d0 [ 32.029941] ret_from_fork+0x10/0x20 [ 32.030548] [ 32.030921] Freed by task 185: [ 32.031439] kasan_save_stack+0x3c/0x68 [ 32.032050] kasan_save_track+0x20/0x40 [ 32.032690] kasan_save_free_info+0x4c/0x78 [ 32.033302] __kasan_slab_free+0x6c/0x98 [ 32.033802] kfree+0x114/0x3c8 [ 32.034353] ksize_uaf+0x11c/0x600 [ 32.034927] kunit_try_run_case+0x14c/0x3d0 [ 32.035617] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.036421] kthread+0x24c/0x2d0 [ 32.036903] ret_from_fork+0x10/0x20 [ 32.037495] [ 32.037878] The buggy address belongs to the object at fff00000c6779700 [ 32.037878] which belongs to the cache kmalloc-128 of size 128 [ 32.038943] The buggy address is located 120 bytes inside of [ 32.038943] freed 128-byte region [fff00000c6779700, fff00000c6779780) [ 32.040367] [ 32.040764] The buggy address belongs to the physical page: [ 32.041431] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106779 [ 32.042197] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.043095] page_type: f5(slab) [ 32.043666] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.044653] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.045501] page dumped because: kasan: bad access detected [ 32.046147] [ 32.046532] Memory state around the buggy address: [ 32.047208] fff00000c6779600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.048048] fff00000c6779680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.048751] >fff00000c6779700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.049653] ^ [ 32.050405] fff00000c6779780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.051248] fff00000c6779800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.052111] ==================================================================
[ 24.766119] ================================================================== [ 24.768085] BUG: KASAN: slab-use-after-free in ksize_uaf+0x5e6/0x6c0 [ 24.769618] Read of size 1 at addr ffff88810291df78 by task kunit_try_catch/204 [ 24.770394] [ 24.771628] CPU: 0 UID: 0 PID: 204 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 24.772858] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.774105] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.774488] Call Trace: [ 24.774625] <TASK> [ 24.774752] dump_stack_lvl+0x73/0xb0 [ 24.774991] print_report+0xd1/0x640 [ 24.775258] ? __virt_addr_valid+0x1db/0x2d0 [ 24.775566] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.776068] kasan_report+0x102/0x140 [ 24.776367] ? ksize_uaf+0x5e6/0x6c0 [ 24.776871] ? ksize_uaf+0x5e6/0x6c0 [ 24.777717] __asan_report_load1_noabort+0x18/0x20 [ 24.778959] ksize_uaf+0x5e6/0x6c0 [ 24.779578] ? __pfx_ksize_uaf+0x10/0x10 [ 24.780279] ? __schedule+0xc70/0x27e0 [ 24.780979] ? __pfx_read_tsc+0x10/0x10 [ 24.781809] ? ktime_get_ts64+0x86/0x230 [ 24.782680] kunit_try_run_case+0x1b3/0x490 [ 24.783001] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.783835] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 24.785718] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.786176] ? __kthread_parkme+0x82/0x160 [ 24.787110] ? preempt_count_sub+0x50/0x80 [ 24.787572] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.788696] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.790690] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.791306] kthread+0x257/0x310 [ 24.791632] ? __pfx_kthread+0x10/0x10 [ 24.792054] ret_from_fork+0x41/0x80 [ 24.792998] ? __pfx_kthread+0x10/0x10 [ 24.794004] ret_from_fork_asm+0x1a/0x30 [ 24.794572] </TASK> [ 24.795331] [ 24.795533] Allocated by task 204: [ 24.795965] kasan_save_stack+0x3d/0x60 [ 24.796434] kasan_save_track+0x18/0x40 [ 24.796892] kasan_save_alloc_info+0x3b/0x50 [ 24.798160] __kasan_kmalloc+0xb7/0xc0 [ 24.799624] __kmalloc_cache_noprof+0x184/0x410 [ 24.800052] ksize_uaf+0xab/0x6c0 [ 24.800501] kunit_try_run_case+0x1b3/0x490 [ 24.801325] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.802338] kthread+0x257/0x310 [ 24.802655] ret_from_fork+0x41/0x80 [ 24.803823] ret_from_fork_asm+0x1a/0x30 [ 24.805022] [ 24.805356] Freed by task 204: [ 24.805706] kasan_save_stack+0x3d/0x60 [ 24.807180] kasan_save_track+0x18/0x40 [ 24.807586] kasan_save_free_info+0x3f/0x60 [ 24.808131] __kasan_slab_free+0x56/0x70 [ 24.808580] kfree+0x123/0x3f0 [ 24.809851] ksize_uaf+0x12d/0x6c0 [ 24.810249] kunit_try_run_case+0x1b3/0x490 [ 24.810472] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.811861] kthread+0x257/0x310 [ 24.812218] ret_from_fork+0x41/0x80 [ 24.812759] ret_from_fork_asm+0x1a/0x30 [ 24.814114] [ 24.814425] The buggy address belongs to the object at ffff88810291df00 [ 24.814425] which belongs to the cache kmalloc-128 of size 128 [ 24.815636] The buggy address is located 120 bytes inside of [ 24.815636] freed 128-byte region [ffff88810291df00, ffff88810291df80) [ 24.817336] [ 24.818046] The buggy address belongs to the physical page: [ 24.819727] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10291d [ 24.820795] flags: 0x200000000000000(node=0|zone=2) [ 24.821621] page_type: f5(slab) [ 24.822074] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 24.823386] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.825025] page dumped because: kasan: bad access detected [ 24.826377] [ 24.827447] Memory state around the buggy address: [ 24.828410] ffff88810291de00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.829422] ffff88810291de80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.831174] >ffff88810291df00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.832781] ^ [ 24.834044] ffff88810291df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.835052] ffff88810291e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.836426] ================================================================== [ 24.633193] ================================================================== [ 24.634340] BUG: KASAN: slab-use-after-free in ksize_uaf+0x19e/0x6c0 [ 24.635153] Read of size 1 at addr ffff88810291df00 by task kunit_try_catch/204 [ 24.636881] [ 24.637517] CPU: 0 UID: 0 PID: 204 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 24.638946] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.639642] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.640467] Call Trace: [ 24.640691] <TASK> [ 24.640868] dump_stack_lvl+0x73/0xb0 [ 24.642699] print_report+0xd1/0x640 [ 24.643246] ? __virt_addr_valid+0x1db/0x2d0 [ 24.643554] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.644776] kasan_report+0x102/0x140 [ 24.645884] ? ksize_uaf+0x19e/0x6c0 [ 24.646997] ? ksize_uaf+0x19e/0x6c0 [ 24.647862] ? ksize_uaf+0x19e/0x6c0 [ 24.648864] __kasan_check_byte+0x3d/0x50 [ 24.649750] ksize+0x20/0x60 [ 24.650423] ksize_uaf+0x19e/0x6c0 [ 24.650859] ? __pfx_ksize_uaf+0x10/0x10 [ 24.652453] ? __schedule+0xc70/0x27e0 [ 24.653550] ? __pfx_read_tsc+0x10/0x10 [ 24.654009] ? ktime_get_ts64+0x86/0x230 [ 24.655681] kunit_try_run_case+0x1b3/0x490 [ 24.656144] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.657309] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 24.657813] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.659701] ? __kthread_parkme+0x82/0x160 [ 24.660100] ? preempt_count_sub+0x50/0x80 [ 24.660656] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.661256] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.661728] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.663859] kthread+0x257/0x310 [ 24.664344] ? __pfx_kthread+0x10/0x10 [ 24.664924] ret_from_fork+0x41/0x80 [ 24.665300] ? __pfx_kthread+0x10/0x10 [ 24.666046] ret_from_fork_asm+0x1a/0x30 [ 24.666579] </TASK> [ 24.666789] [ 24.667012] Allocated by task 204: [ 24.667435] kasan_save_stack+0x3d/0x60 [ 24.667802] kasan_save_track+0x18/0x40 [ 24.669307] kasan_save_alloc_info+0x3b/0x50 [ 24.669955] __kasan_kmalloc+0xb7/0xc0 [ 24.670638] __kmalloc_cache_noprof+0x184/0x410 [ 24.671020] ksize_uaf+0xab/0x6c0 [ 24.671648] kunit_try_run_case+0x1b3/0x490 [ 24.672230] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.673432] kthread+0x257/0x310 [ 24.674135] ret_from_fork+0x41/0x80 [ 24.674760] ret_from_fork_asm+0x1a/0x30 [ 24.675188] [ 24.675467] Freed by task 204: [ 24.675994] kasan_save_stack+0x3d/0x60 [ 24.676425] kasan_save_track+0x18/0x40 [ 24.676903] kasan_save_free_info+0x3f/0x60 [ 24.678289] __kasan_slab_free+0x56/0x70 [ 24.678784] kfree+0x123/0x3f0 [ 24.679415] ksize_uaf+0x12d/0x6c0 [ 24.679843] kunit_try_run_case+0x1b3/0x490 [ 24.680311] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.680970] kthread+0x257/0x310 [ 24.681282] ret_from_fork+0x41/0x80 [ 24.681727] ret_from_fork_asm+0x1a/0x30 [ 24.682674] [ 24.682920] The buggy address belongs to the object at ffff88810291df00 [ 24.682920] which belongs to the cache kmalloc-128 of size 128 [ 24.685141] The buggy address is located 0 bytes inside of [ 24.685141] freed 128-byte region [ffff88810291df00, ffff88810291df80) [ 24.686263] [ 24.686737] The buggy address belongs to the physical page: [ 24.687372] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10291d [ 24.687876] flags: 0x200000000000000(node=0|zone=2) [ 24.688462] page_type: f5(slab) [ 24.688799] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 24.690677] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.691329] page dumped because: kasan: bad access detected [ 24.692159] [ 24.692328] Memory state around the buggy address: [ 24.693039] ffff88810291de00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.693954] ffff88810291de80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.695855] >ffff88810291df00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.696336] ^ [ 24.696765] ffff88810291df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.697620] ffff88810291e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.698240] ================================================================== [ 24.701442] ================================================================== [ 24.702284] BUG: KASAN: slab-use-after-free in ksize_uaf+0x600/0x6c0 [ 24.702925] Read of size 1 at addr ffff88810291df00 by task kunit_try_catch/204 [ 24.703373] [ 24.703635] CPU: 0 UID: 0 PID: 204 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 24.704712] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.706220] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.707408] Call Trace: [ 24.708590] <TASK> [ 24.708979] dump_stack_lvl+0x73/0xb0 [ 24.710217] print_report+0xd1/0x640 [ 24.710708] ? __virt_addr_valid+0x1db/0x2d0 [ 24.711128] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.711667] kasan_report+0x102/0x140 [ 24.712641] ? ksize_uaf+0x600/0x6c0 [ 24.713151] ? ksize_uaf+0x600/0x6c0 [ 24.713529] __asan_report_load1_noabort+0x18/0x20 [ 24.714496] ksize_uaf+0x600/0x6c0 [ 24.715793] ? __pfx_ksize_uaf+0x10/0x10 [ 24.716839] ? __schedule+0xc70/0x27e0 [ 24.717582] ? __pfx_read_tsc+0x10/0x10 [ 24.718227] ? ktime_get_ts64+0x86/0x230 [ 24.719328] kunit_try_run_case+0x1b3/0x490 [ 24.720480] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.721891] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 24.722636] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.723561] ? __kthread_parkme+0x82/0x160 [ 24.724437] ? preempt_count_sub+0x50/0x80 [ 24.724980] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.725501] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.726862] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.727656] kthread+0x257/0x310 [ 24.728810] ? __pfx_kthread+0x10/0x10 [ 24.729208] ret_from_fork+0x41/0x80 [ 24.730228] ? __pfx_kthread+0x10/0x10 [ 24.731170] ret_from_fork_asm+0x1a/0x30 [ 24.731419] </TASK> [ 24.731541] [ 24.731635] Allocated by task 204: [ 24.731796] kasan_save_stack+0x3d/0x60 [ 24.733513] kasan_save_track+0x18/0x40 [ 24.734341] kasan_save_alloc_info+0x3b/0x50 [ 24.735179] __kasan_kmalloc+0xb7/0xc0 [ 24.736147] __kmalloc_cache_noprof+0x184/0x410 [ 24.736579] ksize_uaf+0xab/0x6c0 [ 24.737022] kunit_try_run_case+0x1b3/0x490 [ 24.738260] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.738805] kthread+0x257/0x310 [ 24.739863] ret_from_fork+0x41/0x80 [ 24.740161] ret_from_fork_asm+0x1a/0x30 [ 24.740754] [ 24.741041] Freed by task 204: [ 24.741272] kasan_save_stack+0x3d/0x60 [ 24.742147] kasan_save_track+0x18/0x40 [ 24.742712] kasan_save_free_info+0x3f/0x60 [ 24.743134] __kasan_slab_free+0x56/0x70 [ 24.743786] kfree+0x123/0x3f0 [ 24.744225] ksize_uaf+0x12d/0x6c0 [ 24.744645] kunit_try_run_case+0x1b3/0x490 [ 24.746190] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.747035] kthread+0x257/0x310 [ 24.747367] ret_from_fork+0x41/0x80 [ 24.747835] ret_from_fork_asm+0x1a/0x30 [ 24.748899] [ 24.749194] The buggy address belongs to the object at ffff88810291df00 [ 24.749194] which belongs to the cache kmalloc-128 of size 128 [ 24.750915] The buggy address is located 0 bytes inside of [ 24.750915] freed 128-byte region [ffff88810291df00, ffff88810291df80) [ 24.752476] [ 24.752917] The buggy address belongs to the physical page: [ 24.753847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10291d [ 24.755212] flags: 0x200000000000000(node=0|zone=2) [ 24.755882] page_type: f5(slab) [ 24.756302] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 24.756980] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.758350] page dumped because: kasan: bad access detected [ 24.759118] [ 24.759510] Memory state around the buggy address: [ 24.759960] ffff88810291de00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.760915] ffff88810291de80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.762376] >ffff88810291df00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.763093] ^ [ 24.763555] ffff88810291df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.764147] ffff88810291e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.764720] ==================================================================