Date
March 19, 2025, 10:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 37.203804] ================================================================== [ 37.204087] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 37.204268] Read of size 1 at addr fff00000c5da6400 by task kunit_try_catch/229 [ 37.204547] [ 37.204665] CPU: 1 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 37.204951] Tainted: [B]=BAD_PAGE, [N]=TEST [ 37.205088] Hardware name: linux,dummy-virt (DT) [ 37.205242] Call trace: [ 37.205347] show_stack+0x20/0x38 (C) [ 37.205549] dump_stack_lvl+0x8c/0xd0 [ 37.205707] print_report+0x118/0x5f0 [ 37.205837] kasan_report+0xc8/0x118 [ 37.205974] __asan_report_load1_noabort+0x20/0x30 [ 37.206158] mempool_uaf_helper+0x314/0x340 [ 37.206310] mempool_kmalloc_uaf+0xbc/0x118 [ 37.206470] kunit_try_run_case+0x14c/0x3d0 [ 37.206639] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.206821] kthread+0x318/0x618 [ 37.207043] ret_from_fork+0x10/0x20 [ 37.207226] [ 37.207286] Allocated by task 229: [ 37.207515] kasan_save_stack+0x3c/0x68 [ 37.207648] kasan_save_track+0x20/0x40 [ 37.207846] kasan_save_alloc_info+0x40/0x58 [ 37.208070] __kasan_mempool_unpoison_object+0x11c/0x180 [ 37.208226] remove_element+0x130/0x1f8 [ 37.208418] mempool_alloc_preallocated+0x58/0xc0 [ 37.208554] mempool_uaf_helper+0xa4/0x340 [ 37.209112] mempool_kmalloc_uaf+0xbc/0x118 [ 37.209369] kunit_try_run_case+0x14c/0x3d0 [ 37.209715] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.209864] kthread+0x318/0x618 [ 37.210137] ret_from_fork+0x10/0x20 [ 37.210269] [ 37.210326] Freed by task 229: [ 37.210463] kasan_save_stack+0x3c/0x68 [ 37.210667] kasan_save_track+0x20/0x40 [ 37.210850] kasan_save_free_info+0x4c/0x78 [ 37.211021] __kasan_mempool_poison_object+0xc0/0x150 [ 37.211189] mempool_free+0x28c/0x328 [ 37.211385] mempool_uaf_helper+0x104/0x340 [ 37.211578] mempool_kmalloc_uaf+0xbc/0x118 [ 37.211787] kunit_try_run_case+0x14c/0x3d0 [ 37.211951] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.212114] kthread+0x318/0x618 [ 37.212224] ret_from_fork+0x10/0x20 [ 37.212406] [ 37.212571] The buggy address belongs to the object at fff00000c5da6400 [ 37.212571] which belongs to the cache kmalloc-128 of size 128 [ 37.212766] The buggy address is located 0 bytes inside of [ 37.212766] freed 128-byte region [fff00000c5da6400, fff00000c5da6480) [ 37.212967] [ 37.213036] The buggy address belongs to the physical page: [ 37.213180] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105da6 [ 37.213460] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.213715] page_type: f5(slab) [ 37.213878] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 37.214037] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 37.214179] page dumped because: kasan: bad access detected [ 37.214277] [ 37.214333] Memory state around the buggy address: [ 37.214439] fff00000c5da6300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.214624] fff00000c5da6380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.214852] >fff00000c5da6400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.215078] ^ [ 37.215165] fff00000c5da6480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.215358] fff00000c5da6500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.215494] ================================================================== [ 37.312457] ================================================================== [ 37.312805] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 37.312969] Read of size 1 at addr fff00000c5dab240 by task kunit_try_catch/233 [ 37.313152] [ 37.313408] CPU: 1 UID: 0 PID: 233 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 37.313850] Tainted: [B]=BAD_PAGE, [N]=TEST [ 37.313953] Hardware name: linux,dummy-virt (DT) [ 37.314080] Call trace: [ 37.314157] show_stack+0x20/0x38 (C) [ 37.314320] dump_stack_lvl+0x8c/0xd0 [ 37.314476] print_report+0x118/0x5f0 [ 37.314627] kasan_report+0xc8/0x118 [ 37.314772] __asan_report_load1_noabort+0x20/0x30 [ 37.314943] mempool_uaf_helper+0x314/0x340 [ 37.315611] mempool_slab_uaf+0xb8/0x110 [ 37.315805] kunit_try_run_case+0x14c/0x3d0 [ 37.315971] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.316532] kthread+0x318/0x618 [ 37.316794] ret_from_fork+0x10/0x20 [ 37.317044] [ 37.317169] Allocated by task 233: [ 37.317294] kasan_save_stack+0x3c/0x68 [ 37.317411] kasan_save_track+0x20/0x40 [ 37.317551] kasan_save_alloc_info+0x40/0x58 [ 37.317672] __kasan_mempool_unpoison_object+0xbc/0x180 [ 37.317803] remove_element+0x16c/0x1f8 [ 37.317935] mempool_alloc_preallocated+0x58/0xc0 [ 37.318134] mempool_uaf_helper+0xa4/0x340 [ 37.318270] mempool_slab_uaf+0xb8/0x110 [ 37.318418] kunit_try_run_case+0x14c/0x3d0 [ 37.318555] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.318713] kthread+0x318/0x618 [ 37.318891] ret_from_fork+0x10/0x20 [ 37.319035] [ 37.319143] Freed by task 233: [ 37.319227] kasan_save_stack+0x3c/0x68 [ 37.319384] kasan_save_track+0x20/0x40 [ 37.319491] kasan_save_free_info+0x4c/0x78 [ 37.319605] __kasan_mempool_poison_object+0xc0/0x150 [ 37.319740] mempool_free+0x28c/0x328 [ 37.319851] mempool_uaf_helper+0x104/0x340 [ 37.319979] mempool_slab_uaf+0xb8/0x110 [ 37.320186] kunit_try_run_case+0x14c/0x3d0 [ 37.320419] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.320618] kthread+0x318/0x618 [ 37.320774] ret_from_fork+0x10/0x20 [ 37.320893] [ 37.320962] The buggy address belongs to the object at fff00000c5dab240 [ 37.320962] which belongs to the cache test_cache of size 123 [ 37.321184] The buggy address is located 0 bytes inside of [ 37.321184] freed 123-byte region [fff00000c5dab240, fff00000c5dab2bb) [ 37.321391] [ 37.321466] The buggy address belongs to the physical page: [ 37.321615] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105dab [ 37.321777] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.321928] page_type: f5(slab) [ 37.322042] raw: 0bfffe0000000000 fff00000c5d9a780 dead000000000122 0000000000000000 [ 37.322218] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 37.322382] page dumped because: kasan: bad access detected [ 37.322484] [ 37.322546] Memory state around the buggy address: [ 37.322645] fff00000c5dab100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 37.322844] fff00000c5dab180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.323031] >fff00000c5dab200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 37.323253] ^ [ 37.323434] fff00000c5dab280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 37.323657] fff00000c5dab300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.323866] ==================================================================
[ 24.188192] ================================================================== [ 24.188820] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 24.190942] Read of size 1 at addr ffff888103230240 by task kunit_try_catch/252 [ 24.191509] [ 24.192256] CPU: 1 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 24.192391] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.192428] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.192493] Call Trace: [ 24.192526] <TASK> [ 24.192568] dump_stack_lvl+0x73/0xb0 [ 24.192649] print_report+0xd1/0x660 [ 24.192756] ? __virt_addr_valid+0x1db/0x2d0 [ 24.192877] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.192920] kasan_report+0x104/0x140 [ 24.192953] ? mempool_uaf_helper+0x392/0x400 [ 24.192989] ? mempool_uaf_helper+0x392/0x400 [ 24.193032] __asan_report_load1_noabort+0x18/0x20 [ 24.193063] mempool_uaf_helper+0x392/0x400 [ 24.193097] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 24.193202] ? finish_task_switch.isra.0+0x153/0x730 [ 24.193245] mempool_slab_uaf+0xad/0x100 [ 24.193280] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 24.193313] ? __switch_to+0x5d9/0xf70 [ 24.193351] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 24.193382] ? __pfx_mempool_free_slab+0x10/0x10 [ 24.193416] ? __pfx_read_tsc+0x10/0x10 [ 24.193446] ? ktime_get_ts64+0x86/0x240 [ 24.193484] kunit_try_run_case+0x1b2/0x490 [ 24.193521] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.193552] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.193585] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.193616] ? __kthread_parkme+0x82/0x160 [ 24.193647] ? preempt_count_sub+0x50/0x80 [ 24.193690] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.193793] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.193841] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.193876] kthread+0x323/0x710 [ 24.193907] ? trace_preempt_on+0x20/0xc0 [ 24.193943] ? __pfx_kthread+0x10/0x10 [ 24.193975] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.194005] ? calculate_sigpending+0x7b/0xa0 [ 24.194038] ? __pfx_kthread+0x10/0x10 [ 24.194072] ret_from_fork+0x41/0x80 [ 24.194103] ? __pfx_kthread+0x10/0x10 [ 24.194185] ret_from_fork_asm+0x1a/0x30 [ 24.194236] </TASK> [ 24.194252] [ 24.212215] Allocated by task 252: [ 24.212582] kasan_save_stack+0x3d/0x60 [ 24.213205] kasan_save_track+0x18/0x40 [ 24.213494] kasan_save_alloc_info+0x3b/0x50 [ 24.214148] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 24.214550] remove_element+0x11e/0x190 [ 24.215403] mempool_alloc_preallocated+0x4d/0x90 [ 24.216134] mempool_uaf_helper+0x96/0x400 [ 24.216582] mempool_slab_uaf+0xad/0x100 [ 24.217205] kunit_try_run_case+0x1b2/0x490 [ 24.217512] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.218175] kthread+0x323/0x710 [ 24.218542] ret_from_fork+0x41/0x80 [ 24.219134] ret_from_fork_asm+0x1a/0x30 [ 24.219562] [ 24.220300] Freed by task 252: [ 24.220614] kasan_save_stack+0x3d/0x60 [ 24.220966] kasan_save_track+0x18/0x40 [ 24.221524] kasan_save_free_info+0x3f/0x60 [ 24.222001] __kasan_mempool_poison_object+0x131/0x1d0 [ 24.222540] mempool_free+0x2ec/0x380 [ 24.223097] mempool_uaf_helper+0x11a/0x400 [ 24.223572] mempool_slab_uaf+0xad/0x100 [ 24.224053] kunit_try_run_case+0x1b2/0x490 [ 24.224472] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.224805] kthread+0x323/0x710 [ 24.225059] ret_from_fork+0x41/0x80 [ 24.226245] ret_from_fork_asm+0x1a/0x30 [ 24.226877] [ 24.227106] The buggy address belongs to the object at ffff888103230240 [ 24.227106] which belongs to the cache test_cache of size 123 [ 24.228353] The buggy address is located 0 bytes inside of [ 24.228353] freed 123-byte region [ffff888103230240, ffff8881032302bb) [ 24.229408] [ 24.229631] The buggy address belongs to the physical page: [ 24.230228] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103230 [ 24.231364] flags: 0x200000000000000(node=0|zone=2) [ 24.232054] page_type: f5(slab) [ 24.232442] raw: 0200000000000000 ffff88810322e000 dead000000000122 0000000000000000 [ 24.233255] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 24.233988] page dumped because: kasan: bad access detected [ 24.234327] [ 24.234487] Memory state around the buggy address: [ 24.235138] ffff888103230100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 24.236273] ffff888103230180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.237093] >ffff888103230200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 24.237914] ^ [ 24.238412] ffff888103230280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 24.238978] ffff888103230300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.239623] ================================================================== [ 24.068141] ================================================================== [ 24.069188] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 24.070001] Read of size 1 at addr ffff888103210a00 by task kunit_try_catch/248 [ 24.070832] [ 24.071098] CPU: 1 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 24.071251] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.071287] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.071332] Call Trace: [ 24.071352] <TASK> [ 24.071374] dump_stack_lvl+0x73/0xb0 [ 24.071422] print_report+0xd1/0x660 [ 24.071464] ? __virt_addr_valid+0x1db/0x2d0 [ 24.071553] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.071603] kasan_report+0x104/0x140 [ 24.071652] ? mempool_uaf_helper+0x392/0x400 [ 24.071688] ? mempool_uaf_helper+0x392/0x400 [ 24.071876] __asan_report_load1_noabort+0x18/0x20 [ 24.071977] mempool_uaf_helper+0x392/0x400 [ 24.072047] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 24.072150] ? finish_task_switch.isra.0+0x153/0x730 [ 24.072239] mempool_kmalloc_uaf+0xb2/0x100 [ 24.072306] ? __pfx_mempool_kmalloc_uaf+0x10/0x10 [ 24.072369] ? __switch_to+0x5d9/0xf70 [ 24.072441] ? __pfx_mempool_kmalloc+0x10/0x10 [ 24.072476] ? __pfx_mempool_kfree+0x10/0x10 [ 24.072512] ? __pfx_read_tsc+0x10/0x10 [ 24.072543] ? ktime_get_ts64+0x86/0x240 [ 24.072581] kunit_try_run_case+0x1b2/0x490 [ 24.072619] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.072651] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.072684] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.072751] ? __kthread_parkme+0x82/0x160 [ 24.072787] ? preempt_count_sub+0x50/0x80 [ 24.072823] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.072858] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.072892] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.072926] kthread+0x323/0x710 [ 24.072956] ? trace_preempt_on+0x20/0xc0 [ 24.072990] ? __pfx_kthread+0x10/0x10 [ 24.073021] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.073052] ? calculate_sigpending+0x7b/0xa0 [ 24.073084] ? __pfx_kthread+0x10/0x10 [ 24.073138] ret_from_fork+0x41/0x80 [ 24.073172] ? __pfx_kthread+0x10/0x10 [ 24.073205] ret_from_fork_asm+0x1a/0x30 [ 24.073252] </TASK> [ 24.073269] [ 24.088637] Allocated by task 248: [ 24.089253] kasan_save_stack+0x3d/0x60 [ 24.089782] kasan_save_track+0x18/0x40 [ 24.090226] kasan_save_alloc_info+0x3b/0x50 [ 24.090683] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 24.091357] remove_element+0x11e/0x190 [ 24.091960] mempool_alloc_preallocated+0x4d/0x90 [ 24.092485] mempool_uaf_helper+0x96/0x400 [ 24.093096] mempool_kmalloc_uaf+0xb2/0x100 [ 24.093572] kunit_try_run_case+0x1b2/0x490 [ 24.094145] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.094818] kthread+0x323/0x710 [ 24.095810] ret_from_fork+0x41/0x80 [ 24.096484] ret_from_fork_asm+0x1a/0x30 [ 24.096964] [ 24.097205] Freed by task 248: [ 24.097533] kasan_save_stack+0x3d/0x60 [ 24.097985] kasan_save_track+0x18/0x40 [ 24.098419] kasan_save_free_info+0x3f/0x60 [ 24.098915] __kasan_mempool_poison_object+0x131/0x1d0 [ 24.099478] mempool_free+0x2ec/0x380 [ 24.100039] mempool_uaf_helper+0x11a/0x400 [ 24.100510] mempool_kmalloc_uaf+0xb2/0x100 [ 24.101106] kunit_try_run_case+0x1b2/0x490 [ 24.101773] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.102562] kthread+0x323/0x710 [ 24.103002] ret_from_fork+0x41/0x80 [ 24.103509] ret_from_fork_asm+0x1a/0x30 [ 24.104300] [ 24.104527] The buggy address belongs to the object at ffff888103210a00 [ 24.104527] which belongs to the cache kmalloc-128 of size 128 [ 24.105601] The buggy address is located 0 bytes inside of [ 24.105601] freed 128-byte region [ffff888103210a00, ffff888103210a80) [ 24.106667] [ 24.106940] The buggy address belongs to the physical page: [ 24.107585] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103210 [ 24.108098] flags: 0x200000000000000(node=0|zone=2) [ 24.108427] page_type: f5(slab) [ 24.108663] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 24.109129] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.110105] page dumped because: kasan: bad access detected [ 24.110645] [ 24.111093] Memory state around the buggy address: [ 24.111622] ffff888103210900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.112564] ffff888103210980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.113460] >ffff888103210a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.114160] ^ [ 24.114599] ffff888103210a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.115474] ffff888103210b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.116300] ==================================================================