Date
May 26, 2025, 9:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.909963] ================================================================== [ 19.910117] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 19.910246] Read of size 1 at addr fff00000c789d240 by task kunit_try_catch/231 [ 19.910371] [ 19.910783] CPU: 0 UID: 0 PID: 231 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7-next-20250526 #1 PREEMPT [ 19.911722] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.911780] Hardware name: linux,dummy-virt (DT) [ 19.911855] Call trace: [ 19.911904] show_stack+0x20/0x38 (C) [ 19.912033] dump_stack_lvl+0x8c/0xd0 [ 19.912140] print_report+0x118/0x608 [ 19.912249] kasan_report+0xdc/0x128 [ 19.912360] __asan_report_load1_noabort+0x20/0x30 [ 19.912482] mempool_uaf_helper+0x314/0x340 [ 19.912583] mempool_slab_uaf+0xc0/0x118 [ 19.912686] kunit_try_run_case+0x170/0x3f0 [ 19.912795] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.913086] kthread+0x328/0x630 [ 19.913212] ret_from_fork+0x10/0x20 [ 19.913838] [ 19.913890] Allocated by task 231: [ 19.913960] kasan_save_stack+0x3c/0x68 [ 19.914065] kasan_save_track+0x20/0x40 [ 19.914164] kasan_save_alloc_info+0x40/0x58 [ 19.914264] __kasan_mempool_unpoison_object+0xbc/0x180 [ 19.914384] remove_element+0x16c/0x1f8 [ 19.914702] mempool_alloc_preallocated+0x58/0xc0 [ 19.914864] mempool_uaf_helper+0xa4/0x340 [ 19.914959] mempool_slab_uaf+0xc0/0x118 [ 19.915052] kunit_try_run_case+0x170/0x3f0 [ 19.915143] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.915250] kthread+0x328/0x630 [ 19.918084] ret_from_fork+0x10/0x20 [ 19.918231] [ 19.918298] Freed by task 231: [ 19.918380] kasan_save_stack+0x3c/0x68 [ 19.918455] kasan_save_track+0x20/0x40 [ 19.918668] kasan_save_free_info+0x4c/0x78 [ 19.919160] __kasan_mempool_poison_object+0xc0/0x150 [ 19.919272] mempool_free+0x28c/0x328 [ 19.919533] mempool_uaf_helper+0x104/0x340 [ 19.919629] mempool_slab_uaf+0xc0/0x118 [ 19.919751] kunit_try_run_case+0x170/0x3f0 [ 19.919893] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.920068] kthread+0x328/0x630 [ 19.920167] ret_from_fork+0x10/0x20 [ 19.920289] [ 19.920802] The buggy address belongs to the object at fff00000c789d240 [ 19.920802] which belongs to the cache test_cache of size 123 [ 19.921183] The buggy address is located 0 bytes inside of [ 19.921183] freed 123-byte region [fff00000c789d240, fff00000c789d2bb) [ 19.921374] [ 19.921426] The buggy address belongs to the physical page: [ 19.922114] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10789d [ 19.922806] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.923013] page_type: f5(slab) [ 19.923174] raw: 0bfffe0000000000 fff00000c794a640 dead000000000122 0000000000000000 [ 19.923467] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 19.923549] page dumped because: kasan: bad access detected [ 19.923617] [ 19.923655] Memory state around the buggy address: [ 19.923982] fff00000c789d100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 19.924134] fff00000c789d180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.924278] >fff00000c789d200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 19.924378] ^ [ 19.924467] fff00000c789d280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 19.924626] fff00000c789d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.924762] ================================================================== [ 19.851572] ================================================================== [ 19.851811] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 19.852009] Read of size 1 at addr fff00000c78c2600 by task kunit_try_catch/227 [ 19.852145] [ 19.852283] CPU: 0 UID: 0 PID: 227 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7-next-20250526 #1 PREEMPT [ 19.852509] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.852576] Hardware name: linux,dummy-virt (DT) [ 19.852660] Call trace: [ 19.852837] show_stack+0x20/0x38 (C) [ 19.853005] dump_stack_lvl+0x8c/0xd0 [ 19.853241] print_report+0x118/0x608 [ 19.853367] kasan_report+0xdc/0x128 [ 19.853464] __asan_report_load1_noabort+0x20/0x30 [ 19.853576] mempool_uaf_helper+0x314/0x340 [ 19.853959] mempool_kmalloc_uaf+0xc4/0x120 [ 19.854081] kunit_try_run_case+0x170/0x3f0 [ 19.854264] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.854405] kthread+0x328/0x630 [ 19.854685] ret_from_fork+0x10/0x20 [ 19.855362] [ 19.855448] Allocated by task 227: [ 19.855690] kasan_save_stack+0x3c/0x68 [ 19.855799] kasan_save_track+0x20/0x40 [ 19.855899] kasan_save_alloc_info+0x40/0x58 [ 19.855988] __kasan_mempool_unpoison_object+0x11c/0x180 [ 19.856723] remove_element+0x130/0x1f8 [ 19.857628] mempool_alloc_preallocated+0x58/0xc0 [ 19.857863] mempool_uaf_helper+0xa4/0x340 [ 19.858479] mempool_kmalloc_uaf+0xc4/0x120 [ 19.858947] kunit_try_run_case+0x170/0x3f0 [ 19.859347] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.860019] kthread+0x328/0x630 [ 19.860096] ret_from_fork+0x10/0x20 [ 19.860716] [ 19.860976] Freed by task 227: [ 19.861126] kasan_save_stack+0x3c/0x68 [ 19.861739] kasan_save_track+0x20/0x40 [ 19.862211] kasan_save_free_info+0x4c/0x78 [ 19.862827] __kasan_mempool_poison_object+0xc0/0x150 [ 19.862937] mempool_free+0x28c/0x328 [ 19.863155] mempool_uaf_helper+0x104/0x340 [ 19.863534] mempool_kmalloc_uaf+0xc4/0x120 [ 19.863816] kunit_try_run_case+0x170/0x3f0 [ 19.864342] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.864467] kthread+0x328/0x630 [ 19.864583] ret_from_fork+0x10/0x20 [ 19.864717] [ 19.864790] The buggy address belongs to the object at fff00000c78c2600 [ 19.864790] which belongs to the cache kmalloc-128 of size 128 [ 19.864944] The buggy address is located 0 bytes inside of [ 19.864944] freed 128-byte region [fff00000c78c2600, fff00000c78c2680) [ 19.865137] [ 19.865209] The buggy address belongs to the physical page: [ 19.865329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078c2 [ 19.865486] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.865638] page_type: f5(slab) [ 19.865735] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.865870] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.865978] page dumped because: kasan: bad access detected [ 19.866071] [ 19.866134] Memory state around the buggy address: [ 19.866226] fff00000c78c2500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.867174] fff00000c78c2580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.867290] >fff00000c78c2600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.867376] ^ [ 19.867494] fff00000c78c2680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.867611] fff00000c78c2700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.867835] ==================================================================
[ 12.488499] ================================================================== [ 12.490160] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 12.491125] Read of size 1 at addr ffff8881039b7100 by task kunit_try_catch/245 [ 12.491658] [ 12.491960] CPU: 1 UID: 0 PID: 245 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7-next-20250526 #1 PREEMPT(voluntary) [ 12.492140] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.492156] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.492180] Call Trace: [ 12.492193] <TASK> [ 12.492211] dump_stack_lvl+0x73/0xb0 [ 12.492241] print_report+0xd1/0x650 [ 12.492265] ? __virt_addr_valid+0x1db/0x2d0 [ 12.492290] ? mempool_uaf_helper+0x392/0x400 [ 12.492314] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.492337] ? mempool_uaf_helper+0x392/0x400 [ 12.492361] kasan_report+0x141/0x180 [ 12.492415] ? mempool_uaf_helper+0x392/0x400 [ 12.492443] __asan_report_load1_noabort+0x18/0x20 [ 12.492464] mempool_uaf_helper+0x392/0x400 [ 12.492487] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 12.492509] ? update_load_avg+0x1be/0x21b0 [ 12.492533] ? dequeue_entities+0x27e/0x1740 [ 12.492592] ? finish_task_switch.isra.0+0x153/0x700 [ 12.492620] mempool_kmalloc_uaf+0xef/0x140 [ 12.492643] ? __pfx_mempool_kmalloc_uaf+0x10/0x10 [ 12.492668] ? __pfx_mempool_kmalloc+0x10/0x10 [ 12.492688] ? __pfx_mempool_kfree+0x10/0x10 [ 12.492730] ? __pfx_read_tsc+0x10/0x10 [ 12.492752] ? ktime_get_ts64+0x86/0x230 [ 12.492777] kunit_try_run_case+0x1a5/0x480 [ 12.492799] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.492818] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.492844] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.492869] ? __kthread_parkme+0x82/0x180 [ 12.492889] ? preempt_count_sub+0x50/0x80 [ 12.492912] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.492933] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.492957] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.492981] kthread+0x337/0x6f0 [ 12.493028] ? trace_preempt_on+0x20/0xc0 [ 12.493055] ? __pfx_kthread+0x10/0x10 [ 12.493077] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.493100] ? calculate_sigpending+0x7b/0xa0 [ 12.493124] ? __pfx_kthread+0x10/0x10 [ 12.493146] ret_from_fork+0x116/0x1d0 [ 12.493164] ? __pfx_kthread+0x10/0x10 [ 12.493185] ret_from_fork_asm+0x1a/0x30 [ 12.493215] </TASK> [ 12.493226] [ 12.508551] Allocated by task 245: [ 12.508929] kasan_save_stack+0x45/0x70 [ 12.509465] kasan_save_track+0x18/0x40 [ 12.509658] kasan_save_alloc_info+0x3b/0x50 [ 12.510128] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 12.510692] remove_element+0x11e/0x190 [ 12.510884] mempool_alloc_preallocated+0x4d/0x90 [ 12.511364] mempool_uaf_helper+0x96/0x400 [ 12.511534] mempool_kmalloc_uaf+0xef/0x140 [ 12.511683] kunit_try_run_case+0x1a5/0x480 [ 12.512150] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.512932] kthread+0x337/0x6f0 [ 12.513374] ret_from_fork+0x116/0x1d0 [ 12.513753] ret_from_fork_asm+0x1a/0x30 [ 12.514233] [ 12.514368] Freed by task 245: [ 12.514681] kasan_save_stack+0x45/0x70 [ 12.514927] kasan_save_track+0x18/0x40 [ 12.515345] kasan_save_free_info+0x3f/0x60 [ 12.515759] __kasan_mempool_poison_object+0x131/0x1d0 [ 12.515939] mempool_free+0x2ec/0x380 [ 12.516093] mempool_uaf_helper+0x11a/0x400 [ 12.516240] mempool_kmalloc_uaf+0xef/0x140 [ 12.516398] kunit_try_run_case+0x1a5/0x480 [ 12.516543] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.516767] kthread+0x337/0x6f0 [ 12.517168] ret_from_fork+0x116/0x1d0 [ 12.517705] ret_from_fork_asm+0x1a/0x30 [ 12.518109] [ 12.518345] The buggy address belongs to the object at ffff8881039b7100 [ 12.518345] which belongs to the cache kmalloc-128 of size 128 [ 12.519631] The buggy address is located 0 bytes inside of [ 12.519631] freed 128-byte region [ffff8881039b7100, ffff8881039b7180) [ 12.520924] [ 12.521167] The buggy address belongs to the physical page: [ 12.521690] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039b7 [ 12.522352] flags: 0x200000000000000(node=0|zone=2) [ 12.522893] page_type: f5(slab) [ 12.523020] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.523558] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.524320] page dumped because: kasan: bad access detected [ 12.524919] [ 12.525158] Memory state around the buggy address: [ 12.525668] ffff8881039b7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.526193] ffff8881039b7080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.526909] >ffff8881039b7100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.527604] ^ [ 12.527762] ffff8881039b7180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.528513] ffff8881039b7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.529057] ================================================================== [ 12.555870] ================================================================== [ 12.557016] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 12.557503] Read of size 1 at addr ffff888103981240 by task kunit_try_catch/249 [ 12.558490] [ 12.558805] CPU: 0 UID: 0 PID: 249 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7-next-20250526 #1 PREEMPT(voluntary) [ 12.558857] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.558870] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.558893] Call Trace: [ 12.558906] <TASK> [ 12.558923] dump_stack_lvl+0x73/0xb0 [ 12.558950] print_report+0xd1/0x650 [ 12.558973] ? __virt_addr_valid+0x1db/0x2d0 [ 12.558995] ? mempool_uaf_helper+0x392/0x400 [ 12.559129] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.559153] ? mempool_uaf_helper+0x392/0x400 [ 12.559176] kasan_report+0x141/0x180 [ 12.559199] ? mempool_uaf_helper+0x392/0x400 [ 12.559225] __asan_report_load1_noabort+0x18/0x20 [ 12.559278] mempool_uaf_helper+0x392/0x400 [ 12.559305] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 12.559331] ? __pfx_sched_clock_cpu+0x10/0x10 [ 12.559353] ? finish_task_switch.isra.0+0x153/0x700 [ 12.559390] mempool_slab_uaf+0xea/0x140 [ 12.559410] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 12.559432] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 12.559452] ? __pfx_mempool_free_slab+0x10/0x10 [ 12.559474] ? __pfx_read_tsc+0x10/0x10 [ 12.559495] ? ktime_get_ts64+0x86/0x230 [ 12.559518] kunit_try_run_case+0x1a5/0x480 [ 12.559541] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.559561] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.559586] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.559611] ? __kthread_parkme+0x82/0x180 [ 12.559632] ? preempt_count_sub+0x50/0x80 [ 12.559654] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.559675] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.559699] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.559744] kthread+0x337/0x6f0 [ 12.559763] ? trace_preempt_on+0x20/0xc0 [ 12.559786] ? __pfx_kthread+0x10/0x10 [ 12.559807] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.559829] ? calculate_sigpending+0x7b/0xa0 [ 12.559853] ? __pfx_kthread+0x10/0x10 [ 12.559874] ret_from_fork+0x116/0x1d0 [ 12.559891] ? __pfx_kthread+0x10/0x10 [ 12.559912] ret_from_fork_asm+0x1a/0x30 [ 12.559941] </TASK> [ 12.559952] [ 12.578800] Allocated by task 249: [ 12.579363] kasan_save_stack+0x45/0x70 [ 12.579872] kasan_save_track+0x18/0x40 [ 12.580336] kasan_save_alloc_info+0x3b/0x50 [ 12.580507] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 12.580684] remove_element+0x11e/0x190 [ 12.581356] mempool_alloc_preallocated+0x4d/0x90 [ 12.582115] mempool_uaf_helper+0x96/0x400 [ 12.582687] mempool_slab_uaf+0xea/0x140 [ 12.583216] kunit_try_run_case+0x1a5/0x480 [ 12.583864] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.584286] kthread+0x337/0x6f0 [ 12.584825] ret_from_fork+0x116/0x1d0 [ 12.585281] ret_from_fork_asm+0x1a/0x30 [ 12.585487] [ 12.585566] Freed by task 249: [ 12.585680] kasan_save_stack+0x45/0x70 [ 12.585821] kasan_save_track+0x18/0x40 [ 12.585956] kasan_save_free_info+0x3f/0x60 [ 12.586131] __kasan_mempool_poison_object+0x131/0x1d0 [ 12.586314] mempool_free+0x2ec/0x380 [ 12.586520] mempool_uaf_helper+0x11a/0x400 [ 12.586878] mempool_slab_uaf+0xea/0x140 [ 12.587243] kunit_try_run_case+0x1a5/0x480 [ 12.587461] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.587644] kthread+0x337/0x6f0 [ 12.587891] ret_from_fork+0x116/0x1d0 [ 12.588228] ret_from_fork_asm+0x1a/0x30 [ 12.588648] [ 12.588817] The buggy address belongs to the object at ffff888103981240 [ 12.588817] which belongs to the cache test_cache of size 123 [ 12.590050] The buggy address is located 0 bytes inside of [ 12.590050] freed 123-byte region [ffff888103981240, ffff8881039812bb) [ 12.591178] [ 12.591254] The buggy address belongs to the physical page: [ 12.591442] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103981 [ 12.591685] flags: 0x200000000000000(node=0|zone=2) [ 12.591869] page_type: f5(slab) [ 12.592027] raw: 0200000000000000 ffff88810189cc80 dead000000000122 0000000000000000 [ 12.592290] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 12.592626] page dumped because: kasan: bad access detected [ 12.592864] [ 12.592969] Memory state around the buggy address: [ 12.593137] ffff888103981100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.593517] ffff888103981180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.593797] >ffff888103981200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 12.594269] ^ [ 12.594499] ffff888103981280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.594737] ffff888103981300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.595139] ==================================================================