Date
July 8, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 33.286850] ================================================================== [ 33.286915] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 33.287004] Read of size 1 at addr fff00000c9bcb240 by task kunit_try_catch/262 [ 33.287056] [ 33.287089] CPU: 0 UID: 0 PID: 262 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 33.287174] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.287200] Hardware name: linux,dummy-virt (DT) [ 33.287245] Call trace: [ 33.287270] show_stack+0x20/0x38 (C) [ 33.287328] dump_stack_lvl+0x8c/0xd0 [ 33.287376] print_report+0x118/0x5d0 [ 33.287424] kasan_report+0xdc/0x128 [ 33.287470] __asan_report_load1_noabort+0x20/0x30 [ 33.287518] mempool_uaf_helper+0x314/0x340 [ 33.287565] mempool_slab_uaf+0xc0/0x118 [ 33.287612] kunit_try_run_case+0x170/0x3f0 [ 33.287661] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.287726] kthread+0x328/0x630 [ 33.287770] ret_from_fork+0x10/0x20 [ 33.287818] [ 33.287839] Allocated by task 262: [ 33.287867] kasan_save_stack+0x3c/0x68 [ 33.287909] kasan_save_track+0x20/0x40 [ 33.287948] kasan_save_alloc_info+0x40/0x58 [ 33.287997] __kasan_mempool_unpoison_object+0xbc/0x180 [ 33.288044] remove_element+0x16c/0x1f8 [ 33.288083] mempool_alloc_preallocated+0x58/0xc0 [ 33.288123] mempool_uaf_helper+0xa4/0x340 [ 33.288161] mempool_slab_uaf+0xc0/0x118 [ 33.288215] kunit_try_run_case+0x170/0x3f0 [ 33.288442] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.288782] kthread+0x328/0x630 [ 33.289060] ret_from_fork+0x10/0x20 [ 33.289383] [ 33.289429] Freed by task 262: [ 33.289976] kasan_save_stack+0x3c/0x68 [ 33.290070] kasan_save_track+0x20/0x40 [ 33.290472] kasan_save_free_info+0x4c/0x78 [ 33.290559] __kasan_mempool_poison_object+0xc0/0x150 [ 33.290751] mempool_free+0x28c/0x328 [ 33.290803] mempool_uaf_helper+0x104/0x340 [ 33.291035] mempool_slab_uaf+0xc0/0x118 [ 33.291195] kunit_try_run_case+0x170/0x3f0 [ 33.291258] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.291446] kthread+0x328/0x630 [ 33.291637] ret_from_fork+0x10/0x20 [ 33.291799] [ 33.291944] The buggy address belongs to the object at fff00000c9bcb240 [ 33.291944] which belongs to the cache test_cache of size 123 [ 33.292175] The buggy address is located 0 bytes inside of [ 33.292175] freed 123-byte region [fff00000c9bcb240, fff00000c9bcb2bb) [ 33.292321] [ 33.292346] The buggy address belongs to the physical page: [ 33.292518] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109bcb [ 33.292778] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.292896] page_type: f5(slab) [ 33.292952] raw: 0bfffe0000000000 fff00000c9ad5500 dead000000000122 0000000000000000 [ 33.293002] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 33.293349] page dumped because: kasan: bad access detected [ 33.293403] [ 33.293438] Memory state around the buggy address: [ 33.293550] fff00000c9bcb100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 33.293630] fff00000c9bcb180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.293691] >fff00000c9bcb200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 33.293895] ^ [ 33.294047] fff00000c9bcb280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 33.294260] fff00000c9bcb300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.294348] ================================================================== [ 33.246704] ================================================================== [ 33.246778] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 33.246847] Read of size 1 at addr fff00000c9a9cf00 by task kunit_try_catch/258 [ 33.246926] [ 33.246974] CPU: 0 UID: 0 PID: 258 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 33.247238] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.247288] Hardware name: linux,dummy-virt (DT) [ 33.247499] Call trace: [ 33.247538] show_stack+0x20/0x38 (C) [ 33.247596] dump_stack_lvl+0x8c/0xd0 [ 33.247794] print_report+0x118/0x5d0 [ 33.247934] kasan_report+0xdc/0x128 [ 33.248101] __asan_report_load1_noabort+0x20/0x30 [ 33.248224] mempool_uaf_helper+0x314/0x340 [ 33.248296] mempool_kmalloc_uaf+0xc4/0x120 [ 33.248514] kunit_try_run_case+0x170/0x3f0 [ 33.248763] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.248972] kthread+0x328/0x630 [ 33.249204] ret_from_fork+0x10/0x20 [ 33.249309] [ 33.249328] Allocated by task 258: [ 33.249392] kasan_save_stack+0x3c/0x68 [ 33.249480] kasan_save_track+0x20/0x40 [ 33.249554] kasan_save_alloc_info+0x40/0x58 [ 33.249798] __kasan_mempool_unpoison_object+0x11c/0x180 [ 33.249854] remove_element+0x130/0x1f8 [ 33.250086] mempool_alloc_preallocated+0x58/0xc0 [ 33.250315] mempool_uaf_helper+0xa4/0x340 [ 33.250648] mempool_kmalloc_uaf+0xc4/0x120 [ 33.250815] kunit_try_run_case+0x170/0x3f0 [ 33.250865] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.250941] kthread+0x328/0x630 [ 33.251260] ret_from_fork+0x10/0x20 [ 33.251395] [ 33.251444] Freed by task 258: [ 33.251632] kasan_save_stack+0x3c/0x68 [ 33.251713] kasan_save_track+0x20/0x40 [ 33.251984] kasan_save_free_info+0x4c/0x78 [ 33.252108] __kasan_mempool_poison_object+0xc0/0x150 [ 33.252184] mempool_free+0x28c/0x328 [ 33.252257] mempool_uaf_helper+0x104/0x340 [ 33.252469] mempool_kmalloc_uaf+0xc4/0x120 [ 33.252611] kunit_try_run_case+0x170/0x3f0 [ 33.252900] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.253249] kthread+0x328/0x630 [ 33.253359] ret_from_fork+0x10/0x20 [ 33.253440] [ 33.253487] The buggy address belongs to the object at fff00000c9a9cf00 [ 33.253487] which belongs to the cache kmalloc-128 of size 128 [ 33.253560] The buggy address is located 0 bytes inside of [ 33.253560] freed 128-byte region [fff00000c9a9cf00, fff00000c9a9cf80) [ 33.253825] [ 33.253939] The buggy address belongs to the physical page: [ 33.254001] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109a9c [ 33.254130] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.254272] page_type: f5(slab) [ 33.254318] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 33.254736] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 33.254794] page dumped because: kasan: bad access detected [ 33.254995] [ 33.255362] Memory state around the buggy address: [ 33.255716] fff00000c9a9ce00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.255919] fff00000c9a9ce80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.255988] >fff00000c9a9cf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.256029] ^ [ 33.256077] fff00000c9a9cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.256282] fff00000c9a9d000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.256362] ==================================================================
[ 24.981706] ================================================================== [ 24.982410] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 24.982723] Read of size 1 at addr ffff888106279240 by task kunit_try_catch/279 [ 24.983228] [ 24.983383] CPU: 1 UID: 0 PID: 279 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 24.983449] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.983463] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.983498] Call Trace: [ 24.983513] <TASK> [ 24.983533] dump_stack_lvl+0x73/0xb0 [ 24.983566] print_report+0xd1/0x610 [ 24.983590] ? __virt_addr_valid+0x1db/0x2d0 [ 24.983617] ? mempool_uaf_helper+0x392/0x400 [ 24.983640] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.983670] ? mempool_uaf_helper+0x392/0x400 [ 24.983704] kasan_report+0x141/0x180 [ 24.983728] ? mempool_uaf_helper+0x392/0x400 [ 24.983756] __asan_report_load1_noabort+0x18/0x20 [ 24.983794] mempool_uaf_helper+0x392/0x400 [ 24.983827] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 24.983867] ? update_load_avg+0x1be/0x21b0 [ 24.983949] ? irqentry_exit+0x2a/0x60 [ 24.983977] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 24.984004] mempool_slab_uaf+0xea/0x140 [ 24.984030] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 24.984059] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 24.984097] ? __pfx_mempool_free_slab+0x10/0x10 [ 24.984137] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 24.984164] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 24.984202] kunit_try_run_case+0x1a5/0x480 [ 24.984228] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.984260] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.984283] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.984314] ? __kthread_parkme+0x82/0x180 [ 24.984336] ? preempt_count_sub+0x50/0x80 [ 24.984361] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.984384] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.984412] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.984440] kthread+0x337/0x6f0 [ 24.984463] ? trace_preempt_on+0x20/0xc0 [ 24.984489] ? __pfx_kthread+0x10/0x10 [ 24.984512] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.984540] ? calculate_sigpending+0x7b/0xa0 [ 24.984568] ? __pfx_kthread+0x10/0x10 [ 24.984593] ret_from_fork+0x116/0x1d0 [ 24.984615] ? __pfx_kthread+0x10/0x10 [ 24.984639] ret_from_fork_asm+0x1a/0x30 [ 24.984675] </TASK> [ 24.984687] [ 24.994052] Allocated by task 279: [ 24.994232] kasan_save_stack+0x45/0x70 [ 24.994442] kasan_save_track+0x18/0x40 [ 24.994640] kasan_save_alloc_info+0x3b/0x50 [ 24.994880] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 24.995158] remove_element+0x11e/0x190 [ 24.995348] mempool_alloc_preallocated+0x4d/0x90 [ 24.995568] mempool_uaf_helper+0x96/0x400 [ 24.995706] mempool_slab_uaf+0xea/0x140 [ 24.995885] kunit_try_run_case+0x1a5/0x480 [ 24.996105] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.996400] kthread+0x337/0x6f0 [ 24.996521] ret_from_fork+0x116/0x1d0 [ 24.996815] ret_from_fork_asm+0x1a/0x30 [ 24.996991] [ 24.997086] Freed by task 279: [ 24.997573] kasan_save_stack+0x45/0x70 [ 24.997716] kasan_save_track+0x18/0x40 [ 24.997846] kasan_save_free_info+0x3f/0x60 [ 24.998202] __kasan_mempool_poison_object+0x131/0x1d0 [ 24.998485] mempool_free+0x2ec/0x380 [ 24.998674] mempool_uaf_helper+0x11a/0x400 [ 24.998950] mempool_slab_uaf+0xea/0x140 [ 24.999094] kunit_try_run_case+0x1a5/0x480 [ 24.999306] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.999581] kthread+0x337/0x6f0 [ 24.999772] ret_from_fork+0x116/0x1d0 [ 24.999993] ret_from_fork_asm+0x1a/0x30 [ 25.000194] [ 25.000301] The buggy address belongs to the object at ffff888106279240 [ 25.000301] which belongs to the cache test_cache of size 123 [ 25.000866] The buggy address is located 0 bytes inside of [ 25.000866] freed 123-byte region [ffff888106279240, ffff8881062792bb) [ 25.001294] [ 25.001367] The buggy address belongs to the physical page: [ 25.001535] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106279 [ 25.001876] flags: 0x200000000000000(node=0|zone=2) [ 25.002106] page_type: f5(slab) [ 25.002463] raw: 0200000000000000 ffff888106209280 dead000000000122 0000000000000000 [ 25.002941] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 25.003213] page dumped because: kasan: bad access detected [ 25.003393] [ 25.003458] Memory state around the buggy address: [ 25.003617] ffff888106279100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.004210] ffff888106279180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.004675] >ffff888106279200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 25.005334] ^ [ 25.005585] ffff888106279280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.006049] ffff888106279300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.006359] ================================================================== [ 24.902593] ================================================================== [ 24.903008] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 24.903261] Read of size 1 at addr ffff8881059acd00 by task kunit_try_catch/275 [ 24.903481] [ 24.903572] CPU: 0 UID: 0 PID: 275 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 24.903627] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.903639] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.903663] Call Trace: [ 24.903677] <TASK> [ 24.903698] dump_stack_lvl+0x73/0xb0 [ 24.903727] print_report+0xd1/0x610 [ 24.903751] ? __virt_addr_valid+0x1db/0x2d0 [ 24.903776] ? mempool_uaf_helper+0x392/0x400 [ 24.903798] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.903827] ? mempool_uaf_helper+0x392/0x400 [ 24.903850] kasan_report+0x141/0x180 [ 24.903872] ? mempool_uaf_helper+0x392/0x400 [ 24.903899] __asan_report_load1_noabort+0x18/0x20 [ 24.903925] mempool_uaf_helper+0x392/0x400 [ 24.903948] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 24.903972] ? __kasan_check_write+0x18/0x20 [ 24.903999] ? __pfx_sched_clock_cpu+0x10/0x10 [ 24.904021] ? finish_task_switch.isra.0+0x153/0x700 [ 24.904047] mempool_kmalloc_uaf+0xef/0x140 [ 24.904069] ? __pfx_mempool_kmalloc_uaf+0x10/0x10 [ 24.904095] ? __pfx_mempool_kmalloc+0x10/0x10 [ 24.904121] ? __pfx_mempool_kfree+0x10/0x10 [ 24.904147] ? __pfx_read_tsc+0x10/0x10 [ 24.904172] ? ktime_get_ts64+0x86/0x230 [ 24.904198] kunit_try_run_case+0x1a5/0x480 [ 24.904221] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.904723] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.904791] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.905085] ? __kthread_parkme+0x82/0x180 [ 24.905111] ? preempt_count_sub+0x50/0x80 [ 24.905136] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.905160] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.905189] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.905221] kthread+0x337/0x6f0 [ 24.905253] ? trace_preempt_on+0x20/0xc0 [ 24.905279] ? __pfx_kthread+0x10/0x10 [ 24.905302] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.905330] ? calculate_sigpending+0x7b/0xa0 [ 24.905358] ? __pfx_kthread+0x10/0x10 [ 24.905381] ret_from_fork+0x116/0x1d0 [ 24.905402] ? __pfx_kthread+0x10/0x10 [ 24.905424] ret_from_fork_asm+0x1a/0x30 [ 24.905458] </TASK> [ 24.905471] [ 24.922911] Allocated by task 275: [ 24.923313] kasan_save_stack+0x45/0x70 [ 24.923943] kasan_save_track+0x18/0x40 [ 24.924566] kasan_save_alloc_info+0x3b/0x50 [ 24.925100] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 24.925300] remove_element+0x11e/0x190 [ 24.925439] mempool_alloc_preallocated+0x4d/0x90 [ 24.925595] mempool_uaf_helper+0x96/0x400 [ 24.925731] mempool_kmalloc_uaf+0xef/0x140 [ 24.925934] kunit_try_run_case+0x1a5/0x480 [ 24.926865] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.927469] kthread+0x337/0x6f0 [ 24.927900] ret_from_fork+0x116/0x1d0 [ 24.928438] ret_from_fork_asm+0x1a/0x30 [ 24.928966] [ 24.929123] Freed by task 275: [ 24.929554] kasan_save_stack+0x45/0x70 [ 24.930019] kasan_save_track+0x18/0x40 [ 24.930529] kasan_save_free_info+0x3f/0x60 [ 24.931045] __kasan_mempool_poison_object+0x131/0x1d0 [ 24.931633] mempool_free+0x2ec/0x380 [ 24.931870] mempool_uaf_helper+0x11a/0x400 [ 24.932020] mempool_kmalloc_uaf+0xef/0x140 [ 24.932165] kunit_try_run_case+0x1a5/0x480 [ 24.932318] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.932492] kthread+0x337/0x6f0 [ 24.932607] ret_from_fork+0x116/0x1d0 [ 24.932733] ret_from_fork_asm+0x1a/0x30 [ 24.933577] [ 24.933836] The buggy address belongs to the object at ffff8881059acd00 [ 24.933836] which belongs to the cache kmalloc-128 of size 128 [ 24.935103] The buggy address is located 0 bytes inside of [ 24.935103] freed 128-byte region [ffff8881059acd00, ffff8881059acd80) [ 24.936253] [ 24.936454] The buggy address belongs to the physical page: [ 24.937101] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059ac [ 24.937884] flags: 0x200000000000000(node=0|zone=2) [ 24.938457] page_type: f5(slab) [ 24.938588] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 24.939218] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.939707] page dumped because: kasan: bad access detected [ 24.939992] [ 24.940172] Memory state around the buggy address: [ 24.940625] ffff8881059acc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.941346] ffff8881059acc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.941877] >ffff8881059acd00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.942234] ^ [ 24.942362] ffff8881059acd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.942568] ffff8881059ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.942790] ==================================================================