Date
July 9, 2025, 1:08 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.428835] ================================================================== [ 31.428906] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 31.428960] Read of size 1 at addr fff00000c7d7a240 by task kunit_try_catch/263 [ 31.429009] [ 31.429039] CPU: 1 UID: 0 PID: 263 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250709 #1 PREEMPT [ 31.429442] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.429643] Hardware name: linux,dummy-virt (DT) [ 31.429796] Call trace: [ 31.429909] show_stack+0x20/0x38 (C) [ 31.429961] dump_stack_lvl+0x8c/0xd0 [ 31.430015] print_report+0x118/0x5d0 [ 31.430390] kasan_report+0xdc/0x128 [ 31.430559] __asan_report_load1_noabort+0x20/0x30 [ 31.430611] mempool_uaf_helper+0x314/0x340 [ 31.430659] mempool_slab_uaf+0xc0/0x118 [ 31.430992] kunit_try_run_case+0x170/0x3f0 [ 31.431089] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.431145] kthread+0x328/0x630 [ 31.431187] ret_from_fork+0x10/0x20 [ 31.431384] [ 31.431414] Allocated by task 263: [ 31.431665] kasan_save_stack+0x3c/0x68 [ 31.431781] kasan_save_track+0x20/0x40 [ 31.431822] kasan_save_alloc_info+0x40/0x58 [ 31.431860] __kasan_mempool_unpoison_object+0xbc/0x180 [ 31.431942] remove_element+0x16c/0x1f8 [ 31.431980] mempool_alloc_preallocated+0x58/0xc0 [ 31.432020] mempool_uaf_helper+0xa4/0x340 [ 31.432068] mempool_slab_uaf+0xc0/0x118 [ 31.432104] kunit_try_run_case+0x170/0x3f0 [ 31.432145] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.432189] kthread+0x328/0x630 [ 31.432223] ret_from_fork+0x10/0x20 [ 31.432714] [ 31.432774] Freed by task 263: [ 31.432845] kasan_save_stack+0x3c/0x68 [ 31.432896] kasan_save_track+0x20/0x40 [ 31.432994] kasan_save_free_info+0x4c/0x78 [ 31.433062] __kasan_mempool_poison_object+0xc0/0x150 [ 31.433160] mempool_free+0x28c/0x328 [ 31.433196] mempool_uaf_helper+0x104/0x340 [ 31.433255] mempool_slab_uaf+0xc0/0x118 [ 31.433487] kunit_try_run_case+0x170/0x3f0 [ 31.433529] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.433575] kthread+0x328/0x630 [ 31.433629] ret_from_fork+0x10/0x20 [ 31.433811] [ 31.433874] The buggy address belongs to the object at fff00000c7d7a240 [ 31.433874] which belongs to the cache test_cache of size 123 [ 31.433957] The buggy address is located 0 bytes inside of [ 31.433957] freed 123-byte region [fff00000c7d7a240, fff00000c7d7a2bb) [ 31.434331] [ 31.434657] The buggy address belongs to the physical page: [ 31.434713] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107d7a [ 31.434862] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.435100] page_type: f5(slab) [ 31.435182] raw: 0bfffe0000000000 fff00000c3f54500 dead000000000122 0000000000000000 [ 31.435234] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 31.435276] page dumped because: kasan: bad access detected [ 31.435308] [ 31.435326] Memory state around the buggy address: [ 31.435359] fff00000c7d7a100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 31.435401] fff00000c7d7a180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.435445] >fff00000c7d7a200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 31.435483] ^ [ 31.436232] fff00000c7d7a280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 31.436362] fff00000c7d7a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.436401] ================================================================== [ 31.388151] ================================================================== [ 31.388222] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 31.388781] Read of size 1 at addr fff00000c7d40600 by task kunit_try_catch/259 [ 31.388944] [ 31.389021] CPU: 1 UID: 0 PID: 259 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250709 #1 PREEMPT [ 31.389129] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.389157] Hardware name: linux,dummy-virt (DT) [ 31.389461] Call trace: [ 31.389754] show_stack+0x20/0x38 (C) [ 31.389835] dump_stack_lvl+0x8c/0xd0 [ 31.389887] print_report+0x118/0x5d0 [ 31.389931] kasan_report+0xdc/0x128 [ 31.390023] __asan_report_load1_noabort+0x20/0x30 [ 31.390147] mempool_uaf_helper+0x314/0x340 [ 31.390200] mempool_kmalloc_uaf+0xc4/0x120 [ 31.390549] kunit_try_run_case+0x170/0x3f0 [ 31.390712] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.390768] kthread+0x328/0x630 [ 31.390810] ret_from_fork+0x10/0x20 [ 31.390869] [ 31.390890] Allocated by task 259: [ 31.391046] kasan_save_stack+0x3c/0x68 [ 31.391480] kasan_save_track+0x20/0x40 [ 31.391554] kasan_save_alloc_info+0x40/0x58 [ 31.391791] __kasan_mempool_unpoison_object+0x11c/0x180 [ 31.391841] remove_element+0x130/0x1f8 [ 31.391882] mempool_alloc_preallocated+0x58/0xc0 [ 31.392227] mempool_uaf_helper+0xa4/0x340 [ 31.392343] mempool_kmalloc_uaf+0xc4/0x120 [ 31.392383] kunit_try_run_case+0x170/0x3f0 [ 31.392448] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.392493] kthread+0x328/0x630 [ 31.392527] ret_from_fork+0x10/0x20 [ 31.392720] [ 31.392741] Freed by task 259: [ 31.392771] kasan_save_stack+0x3c/0x68 [ 31.392812] kasan_save_track+0x20/0x40 [ 31.392850] kasan_save_free_info+0x4c/0x78 [ 31.392927] __kasan_mempool_poison_object+0xc0/0x150 [ 31.393427] mempool_free+0x28c/0x328 [ 31.393504] mempool_uaf_helper+0x104/0x340 [ 31.393544] mempool_kmalloc_uaf+0xc4/0x120 [ 31.393594] kunit_try_run_case+0x170/0x3f0 [ 31.393633] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.394072] kthread+0x328/0x630 [ 31.394153] ret_from_fork+0x10/0x20 [ 31.394251] [ 31.394317] The buggy address belongs to the object at fff00000c7d40600 [ 31.394317] which belongs to the cache kmalloc-128 of size 128 [ 31.394389] The buggy address is located 0 bytes inside of [ 31.394389] freed 128-byte region [fff00000c7d40600, fff00000c7d40680) [ 31.394451] [ 31.394473] The buggy address belongs to the physical page: [ 31.394516] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107d40 [ 31.394571] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.395095] page_type: f5(slab) [ 31.395167] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 31.395302] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.395453] page dumped because: kasan: bad access detected [ 31.395485] [ 31.395585] Memory state around the buggy address: [ 31.395724] fff00000c7d40500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.395769] fff00000c7d40580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.395831] >fff00000c7d40600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.396191] ^ [ 31.396241] fff00000c7d40680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.396378] fff00000c7d40700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.396418] ==================================================================
[ 25.607625] ================================================================== [ 25.608076] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 25.608333] Read of size 1 at addr ffff8881058c1b00 by task kunit_try_catch/277 [ 25.608550] [ 25.608640] CPU: 0 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc5-next-20250709 #1 PREEMPT(voluntary) [ 25.608714] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 25.608728] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.608753] Call Trace: [ 25.608767] <TASK> [ 25.608789] dump_stack_lvl+0x73/0xb0 [ 25.608823] print_report+0xd1/0x610 [ 25.608847] ? __virt_addr_valid+0x1db/0x2d0 [ 25.608873] ? mempool_uaf_helper+0x392/0x400 [ 25.608894] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.608920] ? mempool_uaf_helper+0x392/0x400 [ 25.608941] kasan_report+0x141/0x180 [ 25.608963] ? mempool_uaf_helper+0x392/0x400 [ 25.608989] __asan_report_load1_noabort+0x18/0x20 [ 25.609012] mempool_uaf_helper+0x392/0x400 [ 25.609034] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 25.609056] ? __kasan_check_write+0x18/0x20 [ 25.609079] ? __pfx_sched_clock_cpu+0x10/0x10 [ 25.609102] ? finish_task_switch.isra.0+0x153/0x700 [ 25.609129] mempool_kmalloc_uaf+0xef/0x140 [ 25.609151] ? __pfx_mempool_kmalloc_uaf+0x10/0x10 [ 25.609175] ? __pfx_mempool_kmalloc+0x10/0x10 [ 25.609200] ? __pfx_mempool_kfree+0x10/0x10 [ 25.609224] ? __pfx_read_tsc+0x10/0x10 [ 25.609246] ? ktime_get_ts64+0x86/0x230 [ 25.609272] kunit_try_run_case+0x1a5/0x480 [ 25.609295] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.609315] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.609340] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.609363] ? __kthread_parkme+0x82/0x180 [ 25.609383] ? preempt_count_sub+0x50/0x80 [ 25.609405] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.609426] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.609450] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.609475] kthread+0x337/0x6f0 [ 25.609493] ? trace_preempt_on+0x20/0xc0 [ 25.609517] ? __pfx_kthread+0x10/0x10 [ 25.609537] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.609558] ? calculate_sigpending+0x7b/0xa0 [ 25.609583] ? __pfx_kthread+0x10/0x10 [ 25.609604] ret_from_fork+0x116/0x1d0 [ 25.609623] ? __pfx_kthread+0x10/0x10 [ 25.609642] ret_from_fork_asm+0x1a/0x30 [ 25.609674] </TASK> [ 25.609686] [ 25.619948] Allocated by task 277: [ 25.620132] kasan_save_stack+0x45/0x70 [ 25.620286] kasan_save_track+0x18/0x40 [ 25.620413] kasan_save_alloc_info+0x3b/0x50 [ 25.620550] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 25.620843] remove_element+0x11e/0x190 [ 25.620995] mempool_alloc_preallocated+0x4d/0x90 [ 25.621144] mempool_uaf_helper+0x96/0x400 [ 25.621275] mempool_kmalloc_uaf+0xef/0x140 [ 25.621406] kunit_try_run_case+0x1a5/0x480 [ 25.621571] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.621892] kthread+0x337/0x6f0 [ 25.622065] ret_from_fork+0x116/0x1d0 [ 25.622533] ret_from_fork_asm+0x1a/0x30 [ 25.622758] [ 25.623039] Freed by task 277: [ 25.623201] kasan_save_stack+0x45/0x70 [ 25.623401] kasan_save_track+0x18/0x40 [ 25.623530] kasan_save_free_info+0x3f/0x60 [ 25.623668] __kasan_mempool_poison_object+0x131/0x1d0 [ 25.624348] mempool_free+0x2ec/0x380 [ 25.624573] mempool_uaf_helper+0x11a/0x400 [ 25.624777] mempool_kmalloc_uaf+0xef/0x140 [ 25.624971] kunit_try_run_case+0x1a5/0x480 [ 25.625271] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.625434] kthread+0x337/0x6f0 [ 25.625546] ret_from_fork+0x116/0x1d0 [ 25.625668] ret_from_fork_asm+0x1a/0x30 [ 25.625805] [ 25.625872] The buggy address belongs to the object at ffff8881058c1b00 [ 25.625872] which belongs to the cache kmalloc-128 of size 128 [ 25.626755] The buggy address is located 0 bytes inside of [ 25.626755] freed 128-byte region [ffff8881058c1b00, ffff8881058c1b80) [ 25.627649] [ 25.627806] The buggy address belongs to the physical page: [ 25.628198] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1058c1 [ 25.628615] flags: 0x200000000000000(node=0|zone=2) [ 25.628873] page_type: f5(slab) [ 25.629091] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 25.629310] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.629522] page dumped because: kasan: bad access detected [ 25.629735] [ 25.630023] Memory state around the buggy address: [ 25.630373] ffff8881058c1a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.630683] ffff8881058c1a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.631361] >ffff8881058c1b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.632241] ^ [ 25.632382] ffff8881058c1b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.632722] ffff8881058c1c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.633078] ================================================================== [ 25.670567] ================================================================== [ 25.671756] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x392/0x400 [ 25.672419] Read of size 1 at addr ffff8881058d6240 by task kunit_try_catch/281 [ 25.673049] [ 25.673241] CPU: 0 UID: 0 PID: 281 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc5-next-20250709 #1 PREEMPT(voluntary) [ 25.673312] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 25.673327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.673350] Call Trace: [ 25.673365] <TASK> [ 25.673388] dump_stack_lvl+0x73/0xb0 [ 25.673421] print_report+0xd1/0x610 [ 25.673446] ? __virt_addr_valid+0x1db/0x2d0 [ 25.673470] ? mempool_uaf_helper+0x392/0x400 [ 25.673491] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.673517] ? mempool_uaf_helper+0x392/0x400 [ 25.673539] kasan_report+0x141/0x180 [ 25.673561] ? mempool_uaf_helper+0x392/0x400 [ 25.673587] __asan_report_load1_noabort+0x18/0x20 [ 25.673610] mempool_uaf_helper+0x392/0x400 [ 25.673633] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 25.673657] ? __pfx_sched_clock_cpu+0x10/0x10 [ 25.673679] ? finish_task_switch.isra.0+0x153/0x700 [ 25.673715] mempool_slab_uaf+0xea/0x140 [ 25.673737] ? __pfx_mempool_slab_uaf+0x10/0x10 [ 25.673762] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 25.673797] ? __pfx_mempool_free_slab+0x10/0x10 [ 25.673821] ? __pfx_read_tsc+0x10/0x10 [ 25.673845] ? ktime_get_ts64+0x86/0x230 [ 25.673870] kunit_try_run_case+0x1a5/0x480 [ 25.673894] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.673914] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.673939] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.673963] ? __kthread_parkme+0x82/0x180 [ 25.673984] ? preempt_count_sub+0x50/0x80 [ 25.674006] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.674027] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.674053] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.674078] kthread+0x337/0x6f0 [ 25.674098] ? trace_preempt_on+0x20/0xc0 [ 25.674121] ? __pfx_kthread+0x10/0x10 [ 25.674142] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.674164] ? calculate_sigpending+0x7b/0xa0 [ 25.674189] ? __pfx_kthread+0x10/0x10 [ 25.674211] ret_from_fork+0x116/0x1d0 [ 25.674230] ? __pfx_kthread+0x10/0x10 [ 25.674251] ret_from_fork_asm+0x1a/0x30 [ 25.674284] </TASK> [ 25.674296] [ 25.686796] Allocated by task 281: [ 25.687139] kasan_save_stack+0x45/0x70 [ 25.687491] kasan_save_track+0x18/0x40 [ 25.687885] kasan_save_alloc_info+0x3b/0x50 [ 25.688252] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 25.688711] remove_element+0x11e/0x190 [ 25.689138] mempool_alloc_preallocated+0x4d/0x90 [ 25.689564] mempool_uaf_helper+0x96/0x400 [ 25.689961] mempool_slab_uaf+0xea/0x140 [ 25.690345] kunit_try_run_case+0x1a5/0x480 [ 25.690713] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.691111] kthread+0x337/0x6f0 [ 25.691229] ret_from_fork+0x116/0x1d0 [ 25.691357] ret_from_fork_asm+0x1a/0x30 [ 25.691490] [ 25.691555] Freed by task 281: [ 25.691662] kasan_save_stack+0x45/0x70 [ 25.691811] kasan_save_track+0x18/0x40 [ 25.692003] kasan_save_free_info+0x3f/0x60 [ 25.692152] __kasan_mempool_poison_object+0x131/0x1d0 [ 25.692377] mempool_free+0x2ec/0x380 [ 25.692560] mempool_uaf_helper+0x11a/0x400 [ 25.692724] mempool_slab_uaf+0xea/0x140 [ 25.692858] kunit_try_run_case+0x1a5/0x480 [ 25.693130] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.693495] kthread+0x337/0x6f0 [ 25.693632] ret_from_fork+0x116/0x1d0 [ 25.693837] ret_from_fork_asm+0x1a/0x30 [ 25.693972] [ 25.694039] The buggy address belongs to the object at ffff8881058d6240 [ 25.694039] which belongs to the cache test_cache of size 123 [ 25.694690] The buggy address is located 0 bytes inside of [ 25.694690] freed 123-byte region [ffff8881058d6240, ffff8881058d62bb) [ 25.695340] [ 25.695429] The buggy address belongs to the physical page: [ 25.695631] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1058d6 [ 25.695909] flags: 0x200000000000000(node=0|zone=2) [ 25.696144] page_type: f5(slab) [ 25.696312] raw: 0200000000000000 ffff888101d20640 dead000000000122 0000000000000000 [ 25.696720] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 25.696938] page dumped because: kasan: bad access detected [ 25.697332] [ 25.697402] Memory state around the buggy address: [ 25.697587] ffff8881058d6100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.697897] ffff8881058d6180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.698213] >ffff8881058d6200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 25.698489] ^ [ 25.698708] ffff8881058d6280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.698958] ffff8881058d6300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.699257] ==================================================================