Date
June 20, 2025, 12:38 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 35.142219] ================================================================== [ 35.142399] BUG: KASAN: slab-use-after-free in kasan_strings+0x95c/0xb00 [ 35.142550] Read of size 1 at addr fff00000c7699cd0 by task kunit_try_catch/270 [ 35.143012] [ 35.143209] CPU: 0 UID: 0 PID: 270 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250620 #1 PREEMPT [ 35.143796] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.143997] Hardware name: linux,dummy-virt (DT) [ 35.144159] Call trace: [ 35.144228] show_stack+0x20/0x38 (C) [ 35.144646] dump_stack_lvl+0x8c/0xd0 [ 35.144743] print_report+0x118/0x608 [ 35.144848] kasan_report+0xdc/0x128 [ 35.144953] __asan_report_load1_noabort+0x20/0x30 [ 35.145082] kasan_strings+0x95c/0xb00 [ 35.145675] kunit_try_run_case+0x170/0x3f0 [ 35.145938] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.146089] kthread+0x328/0x630 [ 35.146450] ret_from_fork+0x10/0x20 [ 35.146696] [ 35.146777] Allocated by task 270: [ 35.146914] kasan_save_stack+0x3c/0x68 [ 35.147039] kasan_save_track+0x20/0x40 [ 35.147141] kasan_save_alloc_info+0x40/0x58 [ 35.147252] __kasan_kmalloc+0xd4/0xd8 [ 35.147348] __kmalloc_cache_noprof+0x16c/0x3c0 [ 35.147474] kasan_strings+0xc8/0xb00 [ 35.147577] kunit_try_run_case+0x170/0x3f0 [ 35.147692] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.147815] kthread+0x328/0x630 [ 35.147913] ret_from_fork+0x10/0x20 [ 35.148010] [ 35.148069] Freed by task 270: [ 35.148424] kasan_save_stack+0x3c/0x68 [ 35.148773] kasan_save_track+0x20/0x40 [ 35.149039] kasan_save_free_info+0x4c/0x78 [ 35.149135] __kasan_slab_free+0x6c/0x98 [ 35.149239] kfree+0x214/0x3c8 [ 35.149329] kasan_strings+0x24c/0xb00 [ 35.149516] kunit_try_run_case+0x170/0x3f0 [ 35.149723] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.149921] kthread+0x328/0x630 [ 35.150082] ret_from_fork+0x10/0x20 [ 35.150261] [ 35.150355] The buggy address belongs to the object at fff00000c7699cc0 [ 35.150355] which belongs to the cache kmalloc-32 of size 32 [ 35.150902] The buggy address is located 16 bytes inside of [ 35.150902] freed 32-byte region [fff00000c7699cc0, fff00000c7699ce0) [ 35.151251] [ 35.151316] The buggy address belongs to the physical page: [ 35.151741] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107699 [ 35.151976] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 35.152209] page_type: f5(slab) [ 35.152465] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 35.152810] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 35.152986] page dumped because: kasan: bad access detected [ 35.153257] [ 35.153341] Memory state around the buggy address: [ 35.153454] fff00000c7699b80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 35.153577] fff00000c7699c00: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 35.153695] >fff00000c7699c80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 35.153805] ^ [ 35.154043] fff00000c7699d00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 35.154289] fff00000c7699d80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 35.154847] ==================================================================
[ 27.864082] ================================================================== [ 27.864938] BUG: KASAN: slab-use-after-free in kasan_strings+0xcbc/0xe80 [ 27.865804] Read of size 1 at addr ffff888102336390 by task kunit_try_catch/288 [ 27.866286] [ 27.866586] CPU: 0 UID: 0 PID: 288 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250620 #1 PREEMPT(voluntary) [ 27.866880] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.867162] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.867211] Call Trace: [ 27.867253] <TASK> [ 27.867281] dump_stack_lvl+0x73/0xb0 [ 27.867331] print_report+0xd1/0x650 [ 27.867358] ? __virt_addr_valid+0x1db/0x2d0 [ 27.867385] ? kasan_strings+0xcbc/0xe80 [ 27.867408] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.867437] ? kasan_strings+0xcbc/0xe80 [ 27.867489] kasan_report+0x141/0x180 [ 27.867514] ? kasan_strings+0xcbc/0xe80 [ 27.867541] __asan_report_load1_noabort+0x18/0x20 [ 27.867582] kasan_strings+0xcbc/0xe80 [ 27.867616] ? trace_hardirqs_on+0x37/0xe0 [ 27.867655] ? __pfx_kasan_strings+0x10/0x10 [ 27.867689] ? finish_task_switch.isra.0+0x153/0x700 [ 27.867718] ? __switch_to+0x47/0xf50 [ 27.867748] ? __schedule+0x10cc/0x2b60 [ 27.867774] ? __pfx_read_tsc+0x10/0x10 [ 27.867798] ? ktime_get_ts64+0x86/0x230 [ 27.867827] kunit_try_run_case+0x1a5/0x480 [ 27.867856] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.867882] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.867906] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.867932] ? __kthread_parkme+0x82/0x180 [ 27.867954] ? preempt_count_sub+0x50/0x80 [ 27.867978] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.868004] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.868029] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.868055] kthread+0x337/0x6f0 [ 27.868076] ? trace_preempt_on+0x20/0xc0 [ 27.868101] ? __pfx_kthread+0x10/0x10 [ 27.868124] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.868153] ? calculate_sigpending+0x7b/0xa0 [ 27.868188] ? __pfx_kthread+0x10/0x10 [ 27.868212] ret_from_fork+0x116/0x1d0 [ 27.868233] ? __pfx_kthread+0x10/0x10 [ 27.868255] ret_from_fork_asm+0x1a/0x30 [ 27.868290] </TASK> [ 27.868305] [ 27.879907] Allocated by task 288: [ 27.880138] kasan_save_stack+0x45/0x70 [ 27.880333] kasan_save_track+0x18/0x40 [ 27.881136] kasan_save_alloc_info+0x3b/0x50 [ 27.881969] __kasan_kmalloc+0xb7/0xc0 [ 27.882194] __kmalloc_cache_noprof+0x189/0x420 [ 27.882358] kasan_strings+0xc0/0xe80 [ 27.882641] kunit_try_run_case+0x1a5/0x480 [ 27.883955] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.884936] kthread+0x337/0x6f0 [ 27.885112] ret_from_fork+0x116/0x1d0 [ 27.885327] ret_from_fork_asm+0x1a/0x30 [ 27.885675] [ 27.885839] Freed by task 288: [ 27.886580] kasan_save_stack+0x45/0x70 [ 27.886978] kasan_save_track+0x18/0x40 [ 27.887411] kasan_save_free_info+0x3f/0x60 [ 27.887655] __kasan_slab_free+0x56/0x70 [ 27.887827] kfree+0x222/0x3f0 [ 27.888071] kasan_strings+0x2aa/0xe80 [ 27.888418] kunit_try_run_case+0x1a5/0x480 [ 27.888782] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.889112] kthread+0x337/0x6f0 [ 27.889379] ret_from_fork+0x116/0x1d0 [ 27.889629] ret_from_fork_asm+0x1a/0x30 [ 27.889923] [ 27.890108] The buggy address belongs to the object at ffff888102336380 [ 27.890108] which belongs to the cache kmalloc-32 of size 32 [ 27.891116] The buggy address is located 16 bytes inside of [ 27.891116] freed 32-byte region [ffff888102336380, ffff8881023363a0) [ 27.891593] [ 27.892313] The buggy address belongs to the physical page: [ 27.893230] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102336 [ 27.893522] flags: 0x200000000000000(node=0|zone=2) [ 27.893911] page_type: f5(slab) [ 27.894211] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 27.894674] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 27.895168] page dumped because: kasan: bad access detected [ 27.895921] [ 27.896077] Memory state around the buggy address: [ 27.896352] ffff888102336280: 00 00 00 04 fc fc fc fc fa fb fb fb fc fc fc fc [ 27.896679] ffff888102336300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 27.897013] >ffff888102336380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 27.898345] ^ [ 27.898718] ffff888102336400: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 27.899193] ffff888102336480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 27.899604] ==================================================================