Date
July 4, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.663192] ================================================================== [ 29.663261] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310 [ 29.663315] Write of size 33 at addr fff00000c9b70a00 by task kunit_try_catch/219 [ 29.663368] [ 29.663426] CPU: 0 UID: 0 PID: 219 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT [ 29.663549] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.663605] Hardware name: linux,dummy-virt (DT) [ 29.663639] Call trace: [ 29.663660] show_stack+0x20/0x38 (C) [ 29.663707] dump_stack_lvl+0x8c/0xd0 [ 29.663754] print_report+0x118/0x608 [ 29.663799] kasan_report+0xdc/0x128 [ 29.664049] kasan_check_range+0x100/0x1a8 [ 29.664148] __asan_memset+0x34/0x78 [ 29.664191] kmalloc_uaf_memset+0x170/0x310 [ 29.664336] kunit_try_run_case+0x170/0x3f0 [ 29.664424] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.664483] kthread+0x328/0x630 [ 29.664576] ret_from_fork+0x10/0x20 [ 29.664709] [ 29.664757] Allocated by task 219: [ 29.664818] kasan_save_stack+0x3c/0x68 [ 29.664859] kasan_save_track+0x20/0x40 [ 29.664909] kasan_save_alloc_info+0x40/0x58 [ 29.664946] __kasan_kmalloc+0xd4/0xd8 [ 29.665003] __kmalloc_cache_noprof+0x16c/0x3c0 [ 29.665067] kmalloc_uaf_memset+0xb8/0x310 [ 29.665180] kunit_try_run_case+0x170/0x3f0 [ 29.665220] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.665302] kthread+0x328/0x630 [ 29.665337] ret_from_fork+0x10/0x20 [ 29.665420] [ 29.665457] Freed by task 219: [ 29.665485] kasan_save_stack+0x3c/0x68 [ 29.665525] kasan_save_track+0x20/0x40 [ 29.665561] kasan_save_free_info+0x4c/0x78 [ 29.665598] __kasan_slab_free+0x6c/0x98 [ 29.665658] kfree+0x214/0x3c8 [ 29.665739] kmalloc_uaf_memset+0x11c/0x310 [ 29.665876] kunit_try_run_case+0x170/0x3f0 [ 29.666040] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.666231] kthread+0x328/0x630 [ 29.666376] ret_from_fork+0x10/0x20 [ 29.666515] [ 29.666564] The buggy address belongs to the object at fff00000c9b70a00 [ 29.666564] which belongs to the cache kmalloc-64 of size 64 [ 29.666624] The buggy address is located 0 bytes inside of [ 29.666624] freed 64-byte region [fff00000c9b70a00, fff00000c9b70a40) [ 29.666814] [ 29.666834] The buggy address belongs to the physical page: [ 29.666865] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b70 [ 29.666928] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 29.666975] page_type: f5(slab) [ 29.667012] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 29.667061] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 29.667174] page dumped because: kasan: bad access detected [ 29.667333] [ 29.667502] Memory state around the buggy address: [ 29.667630] fff00000c9b70900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.667792] fff00000c9b70980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.667842] >fff00000c9b70a00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.668040] ^ [ 29.668070] fff00000c9b70a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.668113] fff00000c9b70b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.668151] ==================================================================
[ 25.203776] ================================================================== [ 25.204298] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360 [ 25.204712] Write of size 33 at addr ffff888105aaa980 by task kunit_try_catch/235 [ 25.205431] [ 25.205573] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT(voluntary) [ 25.205630] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.205643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.205667] Call Trace: [ 25.205682] <TASK> [ 25.205702] dump_stack_lvl+0x73/0xb0 [ 25.205734] print_report+0xd1/0x650 [ 25.205758] ? __virt_addr_valid+0x1db/0x2d0 [ 25.205783] ? kmalloc_uaf_memset+0x1a3/0x360 [ 25.205805] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.205831] ? kmalloc_uaf_memset+0x1a3/0x360 [ 25.205854] kasan_report+0x141/0x180 [ 25.205876] ? kmalloc_uaf_memset+0x1a3/0x360 [ 25.205904] kasan_check_range+0x10c/0x1c0 [ 25.205929] __asan_memset+0x27/0x50 [ 25.205953] kmalloc_uaf_memset+0x1a3/0x360 [ 25.205975] ? __pfx_kmalloc_uaf_memset+0x10/0x10 [ 25.205999] ? __schedule+0x10cc/0x2b60 [ 25.206025] ? __pfx_read_tsc+0x10/0x10 [ 25.206050] ? ktime_get_ts64+0x86/0x230 [ 25.206077] kunit_try_run_case+0x1a5/0x480 [ 25.206104] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.206129] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.206154] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.206180] ? __kthread_parkme+0x82/0x180 [ 25.206202] ? preempt_count_sub+0x50/0x80 [ 25.206227] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.206253] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.206279] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.206485] kthread+0x337/0x6f0 [ 25.206519] ? trace_preempt_on+0x20/0xc0 [ 25.206545] ? __pfx_kthread+0x10/0x10 [ 25.206567] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.206592] ? calculate_sigpending+0x7b/0xa0 [ 25.206618] ? __pfx_kthread+0x10/0x10 [ 25.206641] ret_from_fork+0x116/0x1d0 [ 25.206663] ? __pfx_kthread+0x10/0x10 [ 25.206685] ret_from_fork_asm+0x1a/0x30 [ 25.206718] </TASK> [ 25.206732] [ 25.217730] Allocated by task 235: [ 25.217881] kasan_save_stack+0x45/0x70 [ 25.218465] kasan_save_track+0x18/0x40 [ 25.218680] kasan_save_alloc_info+0x3b/0x50 [ 25.218877] __kasan_kmalloc+0xb7/0xc0 [ 25.219302] __kmalloc_cache_noprof+0x189/0x420 [ 25.219674] kmalloc_uaf_memset+0xa9/0x360 [ 25.220023] kunit_try_run_case+0x1a5/0x480 [ 25.220435] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.220707] kthread+0x337/0x6f0 [ 25.220876] ret_from_fork+0x116/0x1d0 [ 25.221388] ret_from_fork_asm+0x1a/0x30 [ 25.221678] [ 25.221764] Freed by task 235: [ 25.221911] kasan_save_stack+0x45/0x70 [ 25.222523] kasan_save_track+0x18/0x40 [ 25.222722] kasan_save_free_info+0x3f/0x60 [ 25.223124] __kasan_slab_free+0x56/0x70 [ 25.223379] kfree+0x222/0x3f0 [ 25.223518] kmalloc_uaf_memset+0x12b/0x360 [ 25.223952] kunit_try_run_case+0x1a5/0x480 [ 25.224309] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.224642] kthread+0x337/0x6f0 [ 25.224807] ret_from_fork+0x116/0x1d0 [ 25.225324] ret_from_fork_asm+0x1a/0x30 [ 25.225496] [ 25.225758] The buggy address belongs to the object at ffff888105aaa980 [ 25.225758] which belongs to the cache kmalloc-64 of size 64 [ 25.226654] The buggy address is located 0 bytes inside of [ 25.226654] freed 64-byte region [ffff888105aaa980, ffff888105aaa9c0) [ 25.227477] [ 25.227589] The buggy address belongs to the physical page: [ 25.227851] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105aaa [ 25.228426] flags: 0x200000000000000(node=0|zone=2) [ 25.228750] page_type: f5(slab) [ 25.228927] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 25.229549] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 25.229929] page dumped because: kasan: bad access detected [ 25.230238] [ 25.230322] Memory state around the buggy address: [ 25.230554] ffff888105aaa880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.230865] ffff888105aaa900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.231161] >ffff888105aaa980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.231474] ^ [ 25.231629] ffff888105aaaa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.232577] ffff888105aaaa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.232886] ==================================================================