Date
July 8, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 33.267172] ================================================================== [ 33.267251] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 33.267672] Read of size 1 at addr fff00000c9b90000 by task kunit_try_catch/260 [ 33.267760] [ 33.267797] CPU: 0 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 33.267987] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.268016] Hardware name: linux,dummy-virt (DT) [ 33.268057] Call trace: [ 33.268139] show_stack+0x20/0x38 (C) [ 33.268192] dump_stack_lvl+0x8c/0xd0 [ 33.268388] print_report+0x118/0x5d0 [ 33.268610] kasan_report+0xdc/0x128 [ 33.268777] __asan_report_load1_noabort+0x20/0x30 [ 33.268865] mempool_uaf_helper+0x314/0x340 [ 33.268973] mempool_kmalloc_large_uaf+0xc4/0x120 [ 33.269021] kunit_try_run_case+0x170/0x3f0 [ 33.269238] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.269417] kthread+0x328/0x630 [ 33.269509] ret_from_fork+0x10/0x20 [ 33.269585] [ 33.269607] The buggy address belongs to the physical page: [ 33.269641] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b90 [ 33.269711] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.269766] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 33.269828] page_type: f8(unknown) [ 33.269869] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 33.269918] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 33.269984] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 33.270032] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 33.270086] head: 0bfffe0000000002 ffffc1ffc326e401 00000000ffffffff 00000000ffffffff [ 33.270135] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 33.270174] page dumped because: kasan: bad access detected [ 33.270226] [ 33.270251] Memory state around the buggy address: [ 33.270300] fff00000c9b8ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.270352] fff00000c9b8ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.270405] >fff00000c9b90000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.270453] ^ [ 33.270499] fff00000c9b90080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.270550] fff00000c9b90100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.270587] ================================================================== [ 33.324105] ================================================================== [ 33.325238] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 33.325448] Read of size 1 at addr fff00000c9b90000 by task kunit_try_catch/264 [ 33.325510] [ 33.325547] CPU: 0 UID: 0 PID: 264 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 33.325664] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.325693] Hardware name: linux,dummy-virt (DT) [ 33.325725] Call trace: [ 33.325749] show_stack+0x20/0x38 (C) [ 33.325800] dump_stack_lvl+0x8c/0xd0 [ 33.325849] print_report+0x118/0x5d0 [ 33.325897] kasan_report+0xdc/0x128 [ 33.325943] __asan_report_load1_noabort+0x20/0x30 [ 33.325990] mempool_uaf_helper+0x314/0x340 [ 33.326037] mempool_page_alloc_uaf+0xc0/0x118 [ 33.326085] kunit_try_run_case+0x170/0x3f0 [ 33.326296] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.326436] kthread+0x328/0x630 [ 33.326603] ret_from_fork+0x10/0x20 [ 33.326657] [ 33.326762] The buggy address belongs to the physical page: [ 33.326850] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b90 [ 33.326903] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.326966] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 33.327016] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 33.327055] page dumped because: kasan: bad access detected [ 33.327085] [ 33.327105] Memory state around the buggy address: [ 33.327135] fff00000c9b8ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.327178] fff00000c9b8ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.327229] >fff00000c9b90000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.327318] ^ [ 33.327379] fff00000c9b90080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.327476] fff00000c9b90100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.327580] ==================================================================
[ 25.019044] ================================================================== [ 25.020103] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 25.020446] Read of size 1 at addr ffff888106330000 by task kunit_try_catch/281 [ 25.020749] [ 25.020960] CPU: 0 UID: 0 PID: 281 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 25.021020] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.021033] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.021057] Call Trace: [ 25.021071] <TASK> [ 25.021093] dump_stack_lvl+0x73/0xb0 [ 25.021141] print_report+0xd1/0x610 [ 25.021165] ? __virt_addr_valid+0x1db/0x2d0 [ 25.021210] ? mempool_uaf_helper+0x392/0x400 [ 25.021233] ? kasan_addr_to_slab+0x11/0xa0 [ 25.021265] ? mempool_uaf_helper+0x392/0x400 [ 25.021289] kasan_report+0x141/0x180 [ 25.021322] ? mempool_uaf_helper+0x392/0x400 [ 25.021350] __asan_report_load1_noabort+0x18/0x20 [ 25.021378] mempool_uaf_helper+0x392/0x400 [ 25.021412] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 25.021437] ? __kasan_check_write+0x18/0x20 [ 25.021464] ? __pfx_sched_clock_cpu+0x10/0x10 [ 25.021489] ? finish_task_switch.isra.0+0x153/0x700 [ 25.021517] mempool_page_alloc_uaf+0xed/0x140 [ 25.021543] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 25.021572] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 25.021601] ? __pfx_mempool_free_pages+0x10/0x10 [ 25.021631] ? __pfx_read_tsc+0x10/0x10 [ 25.021658] ? ktime_get_ts64+0x86/0x230 [ 25.021686] kunit_try_run_case+0x1a5/0x480 [ 25.021721] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.021743] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.021795] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.021868] ? __kthread_parkme+0x82/0x180 [ 25.021893] ? preempt_count_sub+0x50/0x80 [ 25.021917] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.021940] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.021968] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.021998] kthread+0x337/0x6f0 [ 25.022020] ? trace_preempt_on+0x20/0xc0 [ 25.022047] ? __pfx_kthread+0x10/0x10 [ 25.022070] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.022098] ? calculate_sigpending+0x7b/0xa0 [ 25.022127] ? __pfx_kthread+0x10/0x10 [ 25.022151] ret_from_fork+0x116/0x1d0 [ 25.022171] ? __pfx_kthread+0x10/0x10 [ 25.022195] ret_from_fork_asm+0x1a/0x30 [ 25.022232] </TASK> [ 25.022255] [ 25.030853] The buggy address belongs to the physical page: [ 25.031295] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106330 [ 25.031805] flags: 0x200000000000000(node=0|zone=2) [ 25.032041] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 25.032279] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 25.032613] page dumped because: kasan: bad access detected [ 25.033139] [ 25.033262] Memory state around the buggy address: [ 25.033435] ffff88810632ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.033726] ffff88810632ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.034193] >ffff888106330000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.034511] ^ [ 25.034688] ffff888106330080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.035088] ffff888106330100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.035402] ================================================================== [ 24.946659] ================================================================== [ 24.947655] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 24.948462] Read of size 1 at addr ffff888102668000 by task kunit_try_catch/277 [ 24.949200] [ 24.949320] CPU: 1 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 24.949380] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.949394] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.949419] Call Trace: [ 24.949437] <TASK> [ 24.949461] dump_stack_lvl+0x73/0xb0 [ 24.949498] print_report+0xd1/0x610 [ 24.949523] ? __virt_addr_valid+0x1db/0x2d0 [ 24.949550] ? mempool_uaf_helper+0x392/0x400 [ 24.949574] ? kasan_addr_to_slab+0x11/0xa0 [ 24.949595] ? mempool_uaf_helper+0x392/0x400 [ 24.949619] kasan_report+0x141/0x180 [ 24.949643] ? mempool_uaf_helper+0x392/0x400 [ 24.949671] __asan_report_load1_noabort+0x18/0x20 [ 24.949699] mempool_uaf_helper+0x392/0x400 [ 24.949724] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 24.949796] ? __kasan_check_write+0x18/0x20 [ 24.949827] ? __pfx_sched_clock_cpu+0x10/0x10 [ 24.949851] ? finish_task_switch.isra.0+0x153/0x700 [ 24.949881] mempool_kmalloc_large_uaf+0xef/0x140 [ 24.949907] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 24.949935] ? __pfx_mempool_kmalloc+0x10/0x10 [ 24.949962] ? __pfx_mempool_kfree+0x10/0x10 [ 24.949991] ? __pfx_read_tsc+0x10/0x10 [ 24.950017] ? ktime_get_ts64+0x86/0x230 [ 24.950045] kunit_try_run_case+0x1a5/0x480 [ 24.950071] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.950092] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.950115] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.950145] ? __kthread_parkme+0x82/0x180 [ 24.950167] ? preempt_count_sub+0x50/0x80 [ 24.950191] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.950213] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.950253] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.950280] kthread+0x337/0x6f0 [ 24.950303] ? trace_preempt_on+0x20/0xc0 [ 24.950330] ? __pfx_kthread+0x10/0x10 [ 24.950353] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.950381] ? calculate_sigpending+0x7b/0xa0 [ 24.950409] ? __pfx_kthread+0x10/0x10 [ 24.950433] ret_from_fork+0x116/0x1d0 [ 24.950454] ? __pfx_kthread+0x10/0x10 [ 24.950477] ret_from_fork_asm+0x1a/0x30 [ 24.950514] </TASK> [ 24.950527] [ 24.964933] The buggy address belongs to the physical page: [ 24.965493] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102668 [ 24.966108] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.966749] flags: 0x200000000000040(head|node=0|zone=2) [ 24.967280] page_type: f8(unknown) [ 24.967633] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.967943] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 24.968692] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.969297] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 24.969534] head: 0200000000000002 ffffea0004099a01 00000000ffffffff 00000000ffffffff [ 24.969805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.970666] page dumped because: kasan: bad access detected [ 24.971303] [ 24.971460] Memory state around the buggy address: [ 24.972121] ffff888102667f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.972847] ffff888102667f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.973448] >ffff888102668000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.973658] ^ [ 24.973848] ffff888102668080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.974592] ffff888102668100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.975277] ==================================================================