Date
June 17, 2025, 6:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.987451] ================================================================== [ 16.987522] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338 [ 16.987896] Read of size 1 at addr fff00000c11936e8 by task kunit_try_catch/193 [ 16.988008] [ 16.988126] CPU: 1 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT [ 16.988236] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.988265] Hardware name: linux,dummy-virt (DT) [ 16.988454] Call trace: [ 16.988603] show_stack+0x20/0x38 (C) [ 16.988672] dump_stack_lvl+0x8c/0xd0 [ 16.988972] print_report+0x118/0x608 [ 16.989096] kasan_report+0xdc/0x128 [ 16.989149] __asan_report_load1_noabort+0x20/0x30 [ 16.989217] kmalloc_uaf+0x300/0x338 [ 16.989323] kunit_try_run_case+0x170/0x3f0 [ 16.989381] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.989451] kthread+0x328/0x630 [ 16.989635] ret_from_fork+0x10/0x20 [ 16.989888] [ 16.989922] Allocated by task 193: [ 16.989967] kasan_save_stack+0x3c/0x68 [ 16.990100] kasan_save_track+0x20/0x40 [ 16.990212] kasan_save_alloc_info+0x40/0x58 [ 16.990368] __kasan_kmalloc+0xd4/0xd8 [ 16.990414] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.990464] kmalloc_uaf+0xb8/0x338 [ 16.990500] kunit_try_run_case+0x170/0x3f0 [ 16.990795] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.990978] kthread+0x328/0x630 [ 16.991066] ret_from_fork+0x10/0x20 [ 16.991192] [ 16.991214] Freed by task 193: [ 16.991265] kasan_save_stack+0x3c/0x68 [ 16.991532] kasan_save_track+0x20/0x40 [ 16.991797] kasan_save_free_info+0x4c/0x78 [ 16.991844] __kasan_slab_free+0x6c/0x98 [ 16.991901] kfree+0x214/0x3c8 [ 16.991989] kmalloc_uaf+0x11c/0x338 [ 16.992027] kunit_try_run_case+0x170/0x3f0 [ 16.992066] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.992122] kthread+0x328/0x630 [ 16.992155] ret_from_fork+0x10/0x20 [ 16.992193] [ 16.992214] The buggy address belongs to the object at fff00000c11936e0 [ 16.992214] which belongs to the cache kmalloc-16 of size 16 [ 16.992277] The buggy address is located 8 bytes inside of [ 16.992277] freed 16-byte region [fff00000c11936e0, fff00000c11936f0) [ 16.992363] [ 16.992395] The buggy address belongs to the physical page: [ 16.992443] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101193 [ 16.992509] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.992561] page_type: f5(slab) [ 16.992612] raw: 0bfffe0000000000 fff00000c0001640 dead000000000100 dead000000000122 [ 16.992665] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 16.992716] page dumped because: kasan: bad access detected [ 16.992748] [ 16.992766] Memory state around the buggy address: [ 16.992830] fff00000c1193580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 16.992875] fff00000c1193600: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 16.992918] >fff00000c1193680: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 16.993212] ^ [ 16.993373] fff00000c1193700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.993483] fff00000c1193780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.993820] ==================================================================
[ 18.318708] ================================================================== [ 18.319696] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x320/0x380 [ 18.320779] Read of size 1 at addr ffff888102264568 by task kunit_try_catch/211 [ 18.321479] [ 18.321963] CPU: 1 UID: 0 PID: 211 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT(voluntary) [ 18.322158] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.322198] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.322414] Call Trace: [ 18.322454] <TASK> [ 18.322501] dump_stack_lvl+0x73/0xb0 [ 18.322589] print_report+0xd1/0x650 [ 18.322643] ? __virt_addr_valid+0x1db/0x2d0 [ 18.322680] ? kmalloc_uaf+0x320/0x380 [ 18.322709] ? kasan_complete_mode_report_info+0x64/0x200 [ 18.322740] ? kmalloc_uaf+0x320/0x380 [ 18.322770] kasan_report+0x141/0x180 [ 18.322800] ? kmalloc_uaf+0x320/0x380 [ 18.322858] __asan_report_load1_noabort+0x18/0x20 [ 18.322898] kmalloc_uaf+0x320/0x380 [ 18.322927] ? __pfx_kmalloc_uaf+0x10/0x10 [ 18.322956] ? __schedule+0x10cc/0x2b60 [ 18.322986] ? __pfx_read_tsc+0x10/0x10 [ 18.323017] ? ktime_get_ts64+0x86/0x230 [ 18.323052] kunit_try_run_case+0x1a5/0x480 [ 18.323090] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.323122] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.323151] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.323187] ? __kthread_parkme+0x82/0x180 [ 18.323238] ? preempt_count_sub+0x50/0x80 [ 18.323364] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.323441] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.323478] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.323511] kthread+0x337/0x6f0 [ 18.323549] ? trace_preempt_on+0x20/0xc0 [ 18.323587] ? __pfx_kthread+0x10/0x10 [ 18.323615] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.323648] ? calculate_sigpending+0x7b/0xa0 [ 18.323682] ? __pfx_kthread+0x10/0x10 [ 18.323711] ret_from_fork+0x116/0x1d0 [ 18.323737] ? __pfx_kthread+0x10/0x10 [ 18.323764] ret_from_fork_asm+0x1a/0x30 [ 18.323806] </TASK> [ 18.323821] [ 18.341054] Allocated by task 211: [ 18.341944] kasan_save_stack+0x45/0x70 [ 18.342661] kasan_save_track+0x18/0x40 [ 18.343092] kasan_save_alloc_info+0x3b/0x50 [ 18.343736] __kasan_kmalloc+0xb7/0xc0 [ 18.344128] __kmalloc_cache_noprof+0x189/0x420 [ 18.344875] kmalloc_uaf+0xaa/0x380 [ 18.345541] kunit_try_run_case+0x1a5/0x480 [ 18.345990] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.346550] kthread+0x337/0x6f0 [ 18.346819] ret_from_fork+0x116/0x1d0 [ 18.347204] ret_from_fork_asm+0x1a/0x30 [ 18.347627] [ 18.348069] Freed by task 211: [ 18.348582] kasan_save_stack+0x45/0x70 [ 18.348886] kasan_save_track+0x18/0x40 [ 18.349166] kasan_save_free_info+0x3f/0x60 [ 18.350130] __kasan_slab_free+0x56/0x70 [ 18.350652] kfree+0x222/0x3f0 [ 18.351063] kmalloc_uaf+0x12c/0x380 [ 18.351669] kunit_try_run_case+0x1a5/0x480 [ 18.352159] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.352859] kthread+0x337/0x6f0 [ 18.353686] ret_from_fork+0x116/0x1d0 [ 18.354101] ret_from_fork_asm+0x1a/0x30 [ 18.354768] [ 18.355381] The buggy address belongs to the object at ffff888102264560 [ 18.355381] which belongs to the cache kmalloc-16 of size 16 [ 18.356736] The buggy address is located 8 bytes inside of [ 18.356736] freed 16-byte region [ffff888102264560, ffff888102264570) [ 18.358137] [ 18.358348] The buggy address belongs to the physical page: [ 18.358766] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102264 [ 18.359795] flags: 0x200000000000000(node=0|zone=2) [ 18.360253] page_type: f5(slab) [ 18.360828] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122 [ 18.361980] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 18.362657] page dumped because: kasan: bad access detected [ 18.363360] [ 18.363865] Memory state around the buggy address: [ 18.364235] ffff888102264400: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 18.365018] ffff888102264480: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 18.365515] >ffff888102264500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 18.366286] ^ [ 18.367145] ffff888102264580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.367999] ffff888102264600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.368389] ==================================================================