Date
July 4, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.812413] ================================================================== [ 31.812881] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 31.812963] Read of size 1 at addr fff00000c9c10000 by task kunit_try_catch/266 [ 31.813025] [ 31.813163] CPU: 1 UID: 0 PID: 266 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT [ 31.813253] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.813282] Hardware name: linux,dummy-virt (DT) [ 31.813315] Call trace: [ 31.813340] show_stack+0x20/0x38 (C) [ 31.813392] dump_stack_lvl+0x8c/0xd0 [ 31.813450] print_report+0x118/0x608 [ 31.813499] kasan_report+0xdc/0x128 [ 31.814008] __asan_report_load1_noabort+0x20/0x30 [ 31.814116] mempool_uaf_helper+0x314/0x340 [ 31.814164] mempool_page_alloc_uaf+0xc0/0x118 [ 31.814222] kunit_try_run_case+0x170/0x3f0 [ 31.814277] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.814332] kthread+0x328/0x630 [ 31.814514] ret_from_fork+0x10/0x20 [ 31.814865] [ 31.814969] The buggy address belongs to the physical page: [ 31.815076] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109c10 [ 31.815198] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.815263] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 31.815576] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 31.815624] page dumped because: kasan: bad access detected [ 31.815657] [ 31.815675] Memory state around the buggy address: [ 31.815736] fff00000c9c0ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.815913] fff00000c9c0ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.815957] >fff00000c9c10000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.816012] ^ [ 31.816040] fff00000c9c10080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.816089] fff00000c9c10100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.816163] ================================================================== [ 31.747408] ================================================================== [ 31.747780] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 31.747837] Read of size 1 at addr fff00000c9bdc000 by task kunit_try_catch/262 [ 31.747971] [ 31.748155] CPU: 1 UID: 0 PID: 262 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT [ 31.748454] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.748487] Hardware name: linux,dummy-virt (DT) [ 31.748726] Call trace: [ 31.748763] show_stack+0x20/0x38 (C) [ 31.748827] dump_stack_lvl+0x8c/0xd0 [ 31.749004] print_report+0x118/0x608 [ 31.749091] kasan_report+0xdc/0x128 [ 31.749225] __asan_report_load1_noabort+0x20/0x30 [ 31.749274] mempool_uaf_helper+0x314/0x340 [ 31.749324] mempool_kmalloc_large_uaf+0xc4/0x120 [ 31.749377] kunit_try_run_case+0x170/0x3f0 [ 31.749596] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.749884] kthread+0x328/0x630 [ 31.750160] ret_from_fork+0x10/0x20 [ 31.750209] [ 31.750233] The buggy address belongs to the physical page: [ 31.750266] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109bdc [ 31.750559] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.750837] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.750949] page_type: f8(unknown) [ 31.750992] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 31.751160] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 31.751240] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 31.751296] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 31.751345] head: 0bfffe0000000002 ffffc1ffc326f701 00000000ffffffff 00000000ffffffff [ 31.751647] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 31.751789] page dumped because: kasan: bad access detected [ 31.751853] [ 31.751871] Memory state around the buggy address: [ 31.752179] fff00000c9bdbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.752310] fff00000c9bdbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.752355] >fff00000c9bdc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.752393] ^ [ 31.752619] fff00000c9bdc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.752717] fff00000c9bdc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.752755] ==================================================================
[ 26.585767] ================================================================== [ 26.586499] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 26.586840] Read of size 1 at addr ffff888106268000 by task kunit_try_catch/278 [ 26.587421] [ 26.587638] CPU: 1 UID: 0 PID: 278 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT(voluntary) [ 26.587703] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.587718] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.587746] Call Trace: [ 26.587765] <TASK> [ 26.587788] dump_stack_lvl+0x73/0xb0 [ 26.587824] print_report+0xd1/0x650 [ 26.588060] ? __virt_addr_valid+0x1db/0x2d0 [ 26.588101] ? mempool_uaf_helper+0x392/0x400 [ 26.588128] ? kasan_addr_to_slab+0x11/0xa0 [ 26.588160] ? mempool_uaf_helper+0x392/0x400 [ 26.588198] kasan_report+0x141/0x180 [ 26.588233] ? mempool_uaf_helper+0x392/0x400 [ 26.588266] __asan_report_load1_noabort+0x18/0x20 [ 26.588294] mempool_uaf_helper+0x392/0x400 [ 26.588320] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 26.588350] ? finish_task_switch.isra.0+0x153/0x700 [ 26.588382] mempool_kmalloc_large_uaf+0xef/0x140 [ 26.588422] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 26.588452] ? __pfx_mempool_kmalloc+0x10/0x10 [ 26.588479] ? __pfx_mempool_kfree+0x10/0x10 [ 26.588508] ? __pfx_read_tsc+0x10/0x10 [ 26.588533] ? ktime_get_ts64+0x86/0x230 [ 26.588565] kunit_try_run_case+0x1a5/0x480 [ 26.588596] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.588623] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.588653] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.588682] ? __kthread_parkme+0x82/0x180 [ 26.588707] ? preempt_count_sub+0x50/0x80 [ 26.588734] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.588764] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.588793] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.588822] kthread+0x337/0x6f0 [ 26.588845] ? trace_preempt_on+0x20/0xc0 [ 26.588874] ? __pfx_kthread+0x10/0x10 [ 26.588898] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.588924] ? calculate_sigpending+0x7b/0xa0 [ 26.588953] ? __pfx_kthread+0x10/0x10 [ 26.588978] ret_from_fork+0x116/0x1d0 [ 26.589000] ? __pfx_kthread+0x10/0x10 [ 26.589026] ret_from_fork_asm+0x1a/0x30 [ 26.589062] </TASK> [ 26.589078] [ 26.602747] The buggy address belongs to the physical page: [ 26.603007] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106268 [ 26.603379] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.604465] flags: 0x200000000000040(head|node=0|zone=2) [ 26.604730] page_type: f8(unknown) [ 26.604951] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.605588] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.606010] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.606403] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.607323] head: 0200000000000002 ffffea0004189a01 00000000ffffffff 00000000ffffffff [ 26.607666] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 26.608073] page dumped because: kasan: bad access detected [ 26.608587] [ 26.608703] Memory state around the buggy address: [ 26.608897] ffff888106267f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.609232] ffff888106267f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.609686] >ffff888106268000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.610102] ^ [ 26.610289] ffff888106268080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.610698] ffff888106268100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.611173] ================================================================== [ 26.670666] ================================================================== [ 26.671657] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 26.672670] Read of size 1 at addr ffff888106268000 by task kunit_try_catch/282 [ 26.673283] [ 26.673546] CPU: 1 UID: 0 PID: 282 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT(voluntary) [ 26.673611] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.673627] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.673654] Call Trace: [ 26.673671] <TASK> [ 26.673695] dump_stack_lvl+0x73/0xb0 [ 26.673729] print_report+0xd1/0x650 [ 26.673755] ? __virt_addr_valid+0x1db/0x2d0 [ 26.673783] ? mempool_uaf_helper+0x392/0x400 [ 26.673808] ? kasan_addr_to_slab+0x11/0xa0 [ 26.673836] ? mempool_uaf_helper+0x392/0x400 [ 26.673861] kasan_report+0x141/0x180 [ 26.673885] ? mempool_uaf_helper+0x392/0x400 [ 26.673914] __asan_report_load1_noabort+0x18/0x20 [ 26.673956] mempool_uaf_helper+0x392/0x400 [ 26.673980] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 26.674013] ? __kasan_check_write+0x18/0x20 [ 26.674040] ? __pfx_sched_clock_cpu+0x10/0x10 [ 26.674064] ? irqentry_exit+0x2a/0x60 [ 26.674090] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 26.674121] mempool_page_alloc_uaf+0xed/0x140 [ 26.674147] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 26.674175] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 26.674202] ? __pfx_mempool_free_pages+0x10/0x10 [ 26.674229] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 26.674256] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 26.674285] kunit_try_run_case+0x1a5/0x480 [ 26.674314] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.674341] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.674368] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.674404] ? __kthread_parkme+0x82/0x180 [ 26.674428] ? preempt_count_sub+0x50/0x80 [ 26.674454] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.674482] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.674509] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.674536] kthread+0x337/0x6f0 [ 26.674559] ? trace_preempt_on+0x20/0xc0 [ 26.674584] ? __pfx_kthread+0x10/0x10 [ 26.674608] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.674632] ? calculate_sigpending+0x7b/0xa0 [ 26.674660] ? __pfx_kthread+0x10/0x10 [ 26.674683] ret_from_fork+0x116/0x1d0 [ 26.674706] ? __pfx_kthread+0x10/0x10 [ 26.674729] ret_from_fork_asm+0x1a/0x30 [ 26.674765] </TASK> [ 26.674778] [ 26.690528] The buggy address belongs to the physical page: [ 26.691406] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106268 [ 26.692040] flags: 0x200000000000000(node=0|zone=2) [ 26.692589] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 26.693642] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 26.694472] page dumped because: kasan: bad access detected [ 26.694977] [ 26.695237] Memory state around the buggy address: [ 26.695753] ffff888106267f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.696456] ffff888106267f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.697126] >ffff888106268000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.697738] ^ [ 26.698129] ffff888106268080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.698674] ffff888106268100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.699371] ==================================================================