Date
June 20, 2025, 12:38 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 32.711354] ================================================================== [ 32.711579] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8 [ 32.712922] Read of size 8 at addr fff00000c59d4c40 by task kunit_try_catch/211 [ 32.713046] [ 32.713206] CPU: 1 UID: 0 PID: 211 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250620 #1 PREEMPT [ 32.713480] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.713596] Hardware name: linux,dummy-virt (DT) [ 32.713805] Call trace: [ 32.713946] show_stack+0x20/0x38 (C) [ 32.714238] dump_stack_lvl+0x8c/0xd0 [ 32.714475] print_report+0x118/0x608 [ 32.714837] kasan_report+0xdc/0x128 [ 32.715176] __asan_report_load8_noabort+0x20/0x30 [ 32.715580] workqueue_uaf+0x480/0x4a8 [ 32.715871] kunit_try_run_case+0x170/0x3f0 [ 32.716048] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.716262] kthread+0x328/0x630 [ 32.716463] ret_from_fork+0x10/0x20 [ 32.716704] [ 32.716841] Allocated by task 211: [ 32.716920] kasan_save_stack+0x3c/0x68 [ 32.717271] kasan_save_track+0x20/0x40 [ 32.717359] kasan_save_alloc_info+0x40/0x58 [ 32.717436] __kasan_kmalloc+0xd4/0xd8 [ 32.717539] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.717650] workqueue_uaf+0x13c/0x4a8 [ 32.717741] kunit_try_run_case+0x170/0x3f0 [ 32.717840] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.717969] kthread+0x328/0x630 [ 32.718128] ret_from_fork+0x10/0x20 [ 32.718281] [ 32.718336] Freed by task 42: [ 32.718405] kasan_save_stack+0x3c/0x68 [ 32.718744] kasan_save_track+0x20/0x40 [ 32.718855] kasan_save_free_info+0x4c/0x78 [ 32.718966] __kasan_slab_free+0x6c/0x98 [ 32.719062] kfree+0x214/0x3c8 [ 32.719203] workqueue_uaf_work+0x18/0x30 [ 32.719302] process_one_work+0x530/0xf98 [ 32.719397] worker_thread+0x618/0xf38 [ 32.719883] kthread+0x328/0x630 [ 32.719999] ret_from_fork+0x10/0x20 [ 32.720102] [ 32.721107] Last potentially related work creation: [ 32.721194] kasan_save_stack+0x3c/0x68 [ 32.721262] kasan_record_aux_stack+0xb4/0xc8 [ 32.721309] __queue_work+0x65c/0xfe0 [ 32.721382] queue_work_on+0xbc/0xf8 [ 32.721425] workqueue_uaf+0x210/0x4a8 [ 32.721468] kunit_try_run_case+0x170/0x3f0 [ 32.721513] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.721564] kthread+0x328/0x630 [ 32.721600] ret_from_fork+0x10/0x20 [ 32.721688] [ 32.721731] The buggy address belongs to the object at fff00000c59d4c40 [ 32.721731] which belongs to the cache kmalloc-32 of size 32 [ 32.721882] The buggy address is located 0 bytes inside of [ 32.721882] freed 32-byte region [fff00000c59d4c40, fff00000c59d4c60) [ 32.722040] [ 32.722099] The buggy address belongs to the physical page: [ 32.722382] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059d4 [ 32.722526] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.722680] page_type: f5(slab) [ 32.722951] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 32.723081] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 32.723190] page dumped because: kasan: bad access detected [ 32.723281] [ 32.723323] Memory state around the buggy address: [ 32.723405] fff00000c59d4b00: 00 00 00 fc fc fc fc fc 00 00 03 fc fc fc fc fc [ 32.723913] fff00000c59d4b80: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 32.724063] >fff00000c59d4c00: 00 00 00 07 fc fc fc fc fa fb fb fb fc fc fc fc [ 32.724261] ^ [ 32.724367] fff00000c59d4c80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.724450] fff00000c59d4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.724521] ==================================================================
[ 26.314311] ================================================================== [ 26.314941] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560 [ 26.315403] Read of size 8 at addr ffff888102bc8a40 by task kunit_try_catch/229 [ 26.316043] [ 26.316284] CPU: 1 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250620 #1 PREEMPT(voluntary) [ 26.316348] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.316363] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.316387] Call Trace: [ 26.316404] <TASK> [ 26.316429] dump_stack_lvl+0x73/0xb0 [ 26.316478] print_report+0xd1/0x650 [ 26.316502] ? __virt_addr_valid+0x1db/0x2d0 [ 26.316530] ? workqueue_uaf+0x4d6/0x560 [ 26.316760] ? kasan_complete_mode_report_info+0x64/0x200 [ 26.316794] ? workqueue_uaf+0x4d6/0x560 [ 26.316818] kasan_report+0x141/0x180 [ 26.316844] ? workqueue_uaf+0x4d6/0x560 [ 26.316870] __asan_report_load8_noabort+0x18/0x20 [ 26.316896] workqueue_uaf+0x4d6/0x560 [ 26.316918] ? __pfx_workqueue_uaf+0x10/0x10 [ 26.316943] ? __pfx_workqueue_uaf+0x10/0x10 [ 26.316970] kunit_try_run_case+0x1a5/0x480 [ 26.317000] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.317023] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.317050] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.317073] ? __kthread_parkme+0x82/0x180 [ 26.317099] ? preempt_count_sub+0x50/0x80 [ 26.317125] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.317150] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.317174] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.317197] kthread+0x337/0x6f0 [ 26.317218] ? trace_preempt_on+0x20/0xc0 [ 26.317244] ? __pfx_kthread+0x10/0x10 [ 26.317267] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.317289] ? calculate_sigpending+0x7b/0xa0 [ 26.317322] ? __pfx_kthread+0x10/0x10 [ 26.317349] ret_from_fork+0x116/0x1d0 [ 26.317370] ? __pfx_kthread+0x10/0x10 [ 26.317391] ret_from_fork_asm+0x1a/0x30 [ 26.317424] </TASK> [ 26.317438] [ 26.323695] Allocated by task 229: [ 26.324297] kasan_save_stack+0x45/0x70 [ 26.324868] kasan_save_track+0x18/0x40 [ 26.325538] kasan_save_alloc_info+0x3b/0x50 [ 26.325806] __kasan_kmalloc+0xb7/0xc0 [ 26.326467] __kmalloc_cache_noprof+0x189/0x420 [ 26.326617] workqueue_uaf+0x152/0x560 [ 26.326720] kunit_try_run_case+0x1a5/0x480 [ 26.326828] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.326954] kthread+0x337/0x6f0 [ 26.327046] ret_from_fork+0x116/0x1d0 [ 26.327141] ret_from_fork_asm+0x1a/0x30 [ 26.327239] [ 26.327294] Freed by task 41: [ 26.327378] kasan_save_stack+0x45/0x70 [ 26.327851] kasan_save_track+0x18/0x40 [ 26.328219] kasan_save_free_info+0x3f/0x60 [ 26.328467] __kasan_slab_free+0x56/0x70 [ 26.328759] kfree+0x222/0x3f0 [ 26.328947] workqueue_uaf_work+0x12/0x20 [ 26.329289] process_one_work+0x5ee/0xf60 [ 26.329852] worker_thread+0x758/0x1220 [ 26.330135] kthread+0x337/0x6f0 [ 26.330386] ret_from_fork+0x116/0x1d0 [ 26.330691] ret_from_fork_asm+0x1a/0x30 [ 26.330829] [ 26.330894] Last potentially related work creation: [ 26.331188] kasan_save_stack+0x45/0x70 [ 26.331335] kasan_record_aux_stack+0xb2/0xc0 [ 26.331724] __queue_work+0x61a/0xe70 [ 26.332017] queue_work_on+0xb6/0xc0 [ 26.332165] workqueue_uaf+0x26d/0x560 [ 26.332476] kunit_try_run_case+0x1a5/0x480 [ 26.332737] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.332970] kthread+0x337/0x6f0 [ 26.333243] ret_from_fork+0x116/0x1d0 [ 26.333406] ret_from_fork_asm+0x1a/0x30 [ 26.333522] [ 26.333701] The buggy address belongs to the object at ffff888102bc8a40 [ 26.333701] which belongs to the cache kmalloc-32 of size 32 [ 26.334295] The buggy address is located 0 bytes inside of [ 26.334295] freed 32-byte region [ffff888102bc8a40, ffff888102bc8a60) [ 26.334753] [ 26.334904] The buggy address belongs to the physical page: [ 26.335171] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bc8 [ 26.335493] flags: 0x200000000000000(node=0|zone=2) [ 26.335854] page_type: f5(slab) [ 26.336024] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 26.336407] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 26.336946] page dumped because: kasan: bad access detected [ 26.337078] [ 26.337132] Memory state around the buggy address: [ 26.337269] ffff888102bc8900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 26.337865] ffff888102bc8980: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 26.338215] >ffff888102bc8a00: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 26.338394] ^ [ 26.338840] ffff888102bc8a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.339260] ffff888102bc8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.340039] ==================================================================