Hay
Date
March 19, 2025, 10:35 a.m.

Environment
qemu-x86_64

[   24.782410] ==================================================================
[   24.784890] BUG: KASAN: slab-use-after-free in strcmp+0xb0/0xc0
[   24.785248] Read of size 1 at addr ffff88810306e390 by task kunit_try_catch/280
[   24.786323] 
[   24.786596] CPU: 0 UID: 0 PID: 280 Comm: kunit_try_catch Tainted: G    B            N  6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) 
[   24.787046] Tainted: [B]=BAD_PAGE, [N]=TEST
[   24.787106] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   24.787191] Call Trace:
[   24.787225]  <TASK>
[   24.787263]  dump_stack_lvl+0x73/0xb0
[   24.787651]  print_report+0xd1/0x660
[   24.787740]  ? __virt_addr_valid+0x1db/0x2d0
[   24.787863]  ? kasan_complete_mode_report_info+0x64/0x200
[   24.787905]  kasan_report+0x104/0x140
[   24.787949]  ? strcmp+0xb0/0xc0
[   24.787983]  ? strcmp+0xb0/0xc0
[   24.788021]  __asan_report_load1_noabort+0x18/0x20
[   24.788052]  strcmp+0xb0/0xc0
[   24.788086]  kasan_strings+0x2d2/0xb50
[   24.788146]  ? __pfx_kasan_strings+0x10/0x10
[   24.788201]  ? __schedule+0xd46/0x29c0
[   24.788233]  ? __pfx_read_tsc+0x10/0x10
[   24.788264]  ? ktime_get_ts64+0x86/0x240
[   24.788301]  kunit_try_run_case+0x1b2/0x490
[   24.788339]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.788370]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   24.788402]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   24.788434]  ? __kthread_parkme+0x82/0x160
[   24.788466]  ? preempt_count_sub+0x50/0x80
[   24.788501]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.788535]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.788568]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   24.788603]  kthread+0x323/0x710
[   24.788632]  ? trace_preempt_on+0x20/0xc0
[   24.788665]  ? __pfx_kthread+0x10/0x10
[   24.788696]  ? _raw_spin_unlock_irq+0x47/0x80
[   24.788775]  ? calculate_sigpending+0x7b/0xa0
[   24.788854]  ? __pfx_kthread+0x10/0x10
[   24.788923]  ret_from_fork+0x41/0x80
[   24.788959]  ? __pfx_kthread+0x10/0x10
[   24.788992]  ret_from_fork_asm+0x1a/0x30
[   24.789039]  </TASK>
[   24.789055] 
[   24.802067] Allocated by task 280:
[   24.802329]  kasan_save_stack+0x3d/0x60
[   24.802605]  kasan_save_track+0x18/0x40
[   24.803047]  kasan_save_alloc_info+0x3b/0x50
[   24.803909]  __kasan_kmalloc+0xb7/0xc0
[   24.804403]  __kmalloc_cache_noprof+0x183/0x410
[   24.805071]  kasan_strings+0xb8/0xb50
[   24.805548]  kunit_try_run_case+0x1b2/0x490
[   24.806247]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.807083]  kthread+0x323/0x710
[   24.807370]  ret_from_fork+0x41/0x80
[   24.807662]  ret_from_fork_asm+0x1a/0x30
[   24.807951] 
[   24.808097] Freed by task 280:
[   24.808604]  kasan_save_stack+0x3d/0x60
[   24.809268]  kasan_save_track+0x18/0x40
[   24.809969]  kasan_save_free_info+0x3f/0x60
[   24.810477]  __kasan_slab_free+0x56/0x70
[   24.811210]  kfree+0x222/0x3f0
[   24.811571]  kasan_strings+0x13b/0xb50
[   24.812428]  kunit_try_run_case+0x1b2/0x490
[   24.813095]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.813802]  kthread+0x323/0x710
[   24.814175]  ret_from_fork+0x41/0x80
[   24.814446]  ret_from_fork_asm+0x1a/0x30
[   24.814713] 
[   24.814934] The buggy address belongs to the object at ffff88810306e380
[   24.814934]  which belongs to the cache kmalloc-32 of size 32
[   24.816295] The buggy address is located 16 bytes inside of
[   24.816295]  freed 32-byte region [ffff88810306e380, ffff88810306e3a0)
[   24.817885] 
[   24.818085] The buggy address belongs to the physical page:
[   24.822980] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10306e
[   24.824027] flags: 0x200000000000000(node=0|zone=2)
[   24.825053] page_type: f5(slab)
[   24.825442] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000
[   24.826099] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   24.826716] page dumped because: kasan: bad access detected
[   24.827597] 
[   24.827882] Memory state around the buggy address:
[   24.828420]  ffff88810306e280: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   24.829268]  ffff88810306e300: 00 00 00 04 fc fc fc fc 00 00 07 fc fc fc fc fc
[   24.829976] >ffff88810306e380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   24.830582]                          ^
[   24.831027]  ffff88810306e400: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   24.832074]  ffff88810306e480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   24.832626] ==================================================================