Date
June 17, 2025, 6:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.092483] ================================================================== [ 19.092562] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 19.092639] Read of size 1 at addr fff00000c5250000 by task kunit_try_catch/242 [ 19.092692] [ 19.092734] CPU: 1 UID: 0 PID: 242 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT [ 19.092826] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.092854] Hardware name: linux,dummy-virt (DT) [ 19.092889] Call trace: [ 19.092916] show_stack+0x20/0x38 (C) [ 19.092989] dump_stack_lvl+0x8c/0xd0 [ 19.093042] print_report+0x118/0x608 [ 19.093092] kasan_report+0xdc/0x128 [ 19.093139] __asan_report_load1_noabort+0x20/0x30 [ 19.093187] mempool_uaf_helper+0x314/0x340 [ 19.093235] mempool_page_alloc_uaf+0xc0/0x118 [ 19.093284] kunit_try_run_case+0x170/0x3f0 [ 19.093335] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.093388] kthread+0x328/0x630 [ 19.093433] ret_from_fork+0x10/0x20 [ 19.093484] [ 19.093507] The buggy address belongs to the physical page: [ 19.093541] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105250 [ 19.093603] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.093672] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 19.093723] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 19.093767] page dumped because: kasan: bad access detected [ 19.093799] [ 19.093817] Memory state around the buggy address: [ 19.093850] fff00000c524ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.093894] fff00000c524ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.093946] >fff00000c5250000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.093985] ^ [ 19.094013] fff00000c5250080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.094074] fff00000c5250100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.094115] ================================================================== [ 19.015149] ================================================================== [ 19.015224] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 19.015294] Read of size 1 at addr fff00000c5250000 by task kunit_try_catch/238 [ 19.016794] [ 19.017241] CPU: 1 UID: 0 PID: 238 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT [ 19.017458] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.017585] Hardware name: linux,dummy-virt (DT) [ 19.017886] Call trace: [ 19.017986] show_stack+0x20/0x38 (C) [ 19.018273] dump_stack_lvl+0x8c/0xd0 [ 19.018364] print_report+0x118/0x608 [ 19.018417] kasan_report+0xdc/0x128 [ 19.018587] __asan_report_load1_noabort+0x20/0x30 [ 19.018649] mempool_uaf_helper+0x314/0x340 [ 19.018698] mempool_kmalloc_large_uaf+0xc4/0x120 [ 19.019159] kunit_try_run_case+0x170/0x3f0 [ 19.019216] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.019268] kthread+0x328/0x630 [ 19.019310] ret_from_fork+0x10/0x20 [ 19.019692] [ 19.019720] The buggy address belongs to the physical page: [ 19.019755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105250 [ 19.020338] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.020540] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.020691] page_type: f8(unknown) [ 19.020737] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.020862] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.021130] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.021233] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.021282] head: 0bfffe0000000002 ffffc1ffc3149401 00000000ffffffff 00000000ffffffff [ 19.021807] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 19.022068] page dumped because: kasan: bad access detected [ 19.022107] [ 19.022259] Memory state around the buggy address: [ 19.022308] fff00000c524ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.022356] fff00000c524ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.022400] >fff00000c5250000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.022459] ^ [ 19.022490] fff00000c5250080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.022981] fff00000c5250100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.023157] ==================================================================
[ 20.270960] ================================================================== [ 20.271693] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 20.272407] Read of size 1 at addr ffff88810396c000 by task kunit_try_catch/260 [ 20.273169] [ 20.273568] CPU: 0 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT(voluntary) [ 20.273704] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.273745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 20.273803] Call Trace: [ 20.273861] <TASK> [ 20.273909] dump_stack_lvl+0x73/0xb0 [ 20.274015] print_report+0xd1/0x650 [ 20.274119] ? __virt_addr_valid+0x1db/0x2d0 [ 20.274198] ? mempool_uaf_helper+0x392/0x400 [ 20.274267] ? kasan_addr_to_slab+0x11/0xa0 [ 20.274737] ? mempool_uaf_helper+0x392/0x400 [ 20.274867] kasan_report+0x141/0x180 [ 20.274950] ? mempool_uaf_helper+0x392/0x400 [ 20.275030] __asan_report_load1_noabort+0x18/0x20 [ 20.275105] mempool_uaf_helper+0x392/0x400 [ 20.275159] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 20.275191] ? update_load_avg+0x1be/0x21b0 [ 20.275244] ? dequeue_entities+0x27e/0x1740 [ 20.275323] ? irqentry_exit+0x2a/0x60 [ 20.275392] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 20.275462] mempool_page_alloc_uaf+0xed/0x140 [ 20.275534] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 20.275620] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 20.275674] ? __pfx_mempool_free_pages+0x10/0x10 [ 20.275712] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 20.275750] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 20.275786] kunit_try_run_case+0x1a5/0x480 [ 20.275822] ? __pfx_kunit_try_run_case+0x10/0x10 [ 20.275884] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 20.275916] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 20.275956] ? __kthread_parkme+0x82/0x180 [ 20.275984] ? preempt_count_sub+0x50/0x80 [ 20.276016] ? __pfx_kunit_try_run_case+0x10/0x10 [ 20.276050] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 20.276082] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 20.276114] kthread+0x337/0x6f0 [ 20.276140] ? trace_preempt_on+0x20/0xc0 [ 20.276173] ? __pfx_kthread+0x10/0x10 [ 20.276201] ? _raw_spin_unlock_irq+0x47/0x80 [ 20.276262] ? calculate_sigpending+0x7b/0xa0 [ 20.276348] ? __pfx_kthread+0x10/0x10 [ 20.276401] ret_from_fork+0x116/0x1d0 [ 20.276430] ? __pfx_kthread+0x10/0x10 [ 20.276460] ret_from_fork_asm+0x1a/0x30 [ 20.276502] </TASK> [ 20.276518] [ 20.297136] The buggy address belongs to the physical page: [ 20.298066] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10396c [ 20.298765] flags: 0x200000000000000(node=0|zone=2) [ 20.299305] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 20.300430] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 20.301197] page dumped because: kasan: bad access detected [ 20.301756] [ 20.301942] Memory state around the buggy address: [ 20.302453] ffff88810396bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.303028] ffff88810396bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.303862] >ffff88810396c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.304819] ^ [ 20.305152] ffff88810396c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.305888] ffff88810396c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.306468] ================================================================== [ 20.159186] ================================================================== [ 20.160153] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 20.160796] Read of size 1 at addr ffff888103884000 by task kunit_try_catch/256 [ 20.161411] [ 20.161872] CPU: 1 UID: 0 PID: 256 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT(voluntary) [ 20.162005] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.162042] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 20.162096] Call Trace: [ 20.162126] <TASK> [ 20.162169] dump_stack_lvl+0x73/0xb0 [ 20.162248] print_report+0xd1/0x650 [ 20.162330] ? __virt_addr_valid+0x1db/0x2d0 [ 20.162409] ? mempool_uaf_helper+0x392/0x400 [ 20.162499] ? kasan_addr_to_slab+0x11/0xa0 [ 20.162602] ? mempool_uaf_helper+0x392/0x400 [ 20.162678] kasan_report+0x141/0x180 [ 20.162716] ? mempool_uaf_helper+0x392/0x400 [ 20.162755] __asan_report_load1_noabort+0x18/0x20 [ 20.162791] mempool_uaf_helper+0x392/0x400 [ 20.162860] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 20.162938] ? __kasan_check_write+0x18/0x20 [ 20.163026] ? __pfx_sched_clock_cpu+0x10/0x10 [ 20.163135] ? finish_task_switch.isra.0+0x153/0x700 [ 20.163221] mempool_kmalloc_large_uaf+0xef/0x140 [ 20.163299] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 20.163386] ? __pfx_mempool_kmalloc+0x10/0x10 [ 20.163485] ? __pfx_mempool_kfree+0x10/0x10 [ 20.163597] ? __pfx_read_tsc+0x10/0x10 [ 20.163672] ? ktime_get_ts64+0x86/0x230 [ 20.163730] kunit_try_run_case+0x1a5/0x480 [ 20.163770] ? __pfx_kunit_try_run_case+0x10/0x10 [ 20.163806] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 20.163862] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 20.163905] ? __kthread_parkme+0x82/0x180 [ 20.163935] ? preempt_count_sub+0x50/0x80 [ 20.163968] ? __pfx_kunit_try_run_case+0x10/0x10 [ 20.164001] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 20.164034] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 20.164067] kthread+0x337/0x6f0 [ 20.164095] ? trace_preempt_on+0x20/0xc0 [ 20.164130] ? __pfx_kthread+0x10/0x10 [ 20.164159] ? _raw_spin_unlock_irq+0x47/0x80 [ 20.164192] ? calculate_sigpending+0x7b/0xa0 [ 20.164242] ? __pfx_kthread+0x10/0x10 [ 20.164317] ret_from_fork+0x116/0x1d0 [ 20.164367] ? __pfx_kthread+0x10/0x10 [ 20.164398] ret_from_fork_asm+0x1a/0x30 [ 20.164442] </TASK> [ 20.164458] [ 20.183811] The buggy address belongs to the physical page: [ 20.184300] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103884 [ 20.185206] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.185929] flags: 0x200000000000040(head|node=0|zone=2) [ 20.186435] page_type: f8(unknown) [ 20.186873] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.187668] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.188626] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.189409] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.190106] head: 0200000000000002 ffffea00040e2101 00000000ffffffff 00000000ffffffff [ 20.190796] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.191246] page dumped because: kasan: bad access detected [ 20.191900] [ 20.192102] Memory state around the buggy address: [ 20.192569] ffff888103883f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.193595] ffff888103883f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.194378] >ffff888103884000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.194963] ^ [ 20.195293] ffff888103884080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.196030] ffff888103884100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.196728] ==================================================================