Hay
Date
May 15, 2025, 10:38 a.m.

Environment
e850-96

[   40.232043] ==================================================================
[   40.255770] BUG: KASAN: slab-use-after-free in strcmp+0xc0/0xc8
[   40.261668] Read of size 1 at addr ffff0008065c9310 by task kunit_try_catch/304
[   40.268959] 
[   40.270446] CPU: 6 UID: 0 PID: 304 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc6-next-20250515 #1 PREEMPT 
[   40.270504] Tainted: [B]=BAD_PAGE, [N]=TEST
[   40.270521] Hardware name: WinLink E850-96 board (DT)
[   40.270545] Call trace:
[   40.270559]  show_stack+0x20/0x38 (C)
[   40.270598]  dump_stack_lvl+0x8c/0xd0
[   40.270631]  print_report+0x118/0x608
[   40.270667]  kasan_report+0xdc/0x128
[   40.270698]  __asan_report_load1_noabort+0x20/0x30
[   40.270739]  strcmp+0xc0/0xc8
[   40.270776]  kasan_strings+0x340/0xb00
[   40.270807]  kunit_try_run_case+0x170/0x3f0
[   40.270841]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.270877]  kthread+0x328/0x630
[   40.270916]  ret_from_fork+0x10/0x20
[   40.270953] 
[   40.337014] Allocated by task 304:
[   40.340402]  kasan_save_stack+0x3c/0x68
[   40.344218]  kasan_save_track+0x20/0x40
[   40.348037]  kasan_save_alloc_info+0x40/0x58
[   40.352290]  __kasan_kmalloc+0xd4/0xd8
[   40.356024]  __kmalloc_cache_noprof+0x15c/0x3c0
[   40.360537]  kasan_strings+0xc8/0xb00
[   40.364182]  kunit_try_run_case+0x170/0x3f0
[   40.368349]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.373817]  kthread+0x328/0x630
[   40.377030]  ret_from_fork+0x10/0x20
[   40.380588] 
[   40.382065] Freed by task 304:
[   40.385105]  kasan_save_stack+0x3c/0x68
[   40.388921]  kasan_save_track+0x20/0x40
[   40.392742]  kasan_save_free_info+0x4c/0x78
[   40.396907]  __kasan_slab_free+0x6c/0x98
[   40.400814]  kfree+0x214/0x3c8
[   40.403852]  kasan_strings+0x24c/0xb00
[   40.407585]  kunit_try_run_case+0x170/0x3f0
[   40.411751]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.417220]  kthread+0x328/0x630
[   40.420432]  ret_from_fork+0x10/0x20
[   40.423990] 
[   40.425468] The buggy address belongs to the object at ffff0008065c9300
[   40.425468]  which belongs to the cache kmalloc-32 of size 32
[   40.437794] The buggy address is located 16 bytes inside of
[   40.437794]  freed 32-byte region [ffff0008065c9300, ffff0008065c9320)
[   40.449858] 
[   40.451337] The buggy address belongs to the physical page:
[   40.456893] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8865c9
[   40.464879] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   40.471387] page_type: f5(slab)
[   40.474525] raw: 0bfffe0000000000 ffff000800002780 dead000000000122 0000000000000000
[   40.482243] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   40.489961] page dumped because: kasan: bad access detected
[   40.495517] 
[   40.496993] Memory state around the buggy address:
[   40.501776]  ffff0008065c9200: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   40.508976]  ffff0008065c9280: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   40.516180] >ffff0008065c9300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   40.523381]                          ^
[   40.527118]  ffff0008065c9380: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   40.534323]  ffff0008065c9400: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   40.541525] ==================================================================