Date
July 10, 2025, 9:07 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.626094] ================================================================== [ 29.626169] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468 [ 29.626221] Read of size 1 at addr fff00000c99b0ca8 by task kunit_try_catch/219 [ 29.626272] [ 29.626304] CPU: 0 UID: 0 PID: 219 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250710 #1 PREEMPT [ 29.626390] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.626419] Hardware name: linux,dummy-virt (DT) [ 29.626449] Call trace: [ 29.626473] show_stack+0x20/0x38 (C) [ 29.626520] dump_stack_lvl+0x8c/0xd0 [ 29.626676] print_report+0x118/0x5d0 [ 29.626916] kasan_report+0xdc/0x128 [ 29.627356] __asan_report_load1_noabort+0x20/0x30 [ 29.627418] kmalloc_uaf2+0x3f4/0x468 [ 29.627463] kunit_try_run_case+0x170/0x3f0 [ 29.627526] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.627581] kthread+0x328/0x630 [ 29.627623] ret_from_fork+0x10/0x20 [ 29.628437] [ 29.628457] Allocated by task 219: [ 29.628486] kasan_save_stack+0x3c/0x68 [ 29.628627] kasan_save_track+0x20/0x40 [ 29.628989] kasan_save_alloc_info+0x40/0x58 [ 29.629251] __kasan_kmalloc+0xd4/0xd8 [ 29.629631] __kmalloc_cache_noprof+0x16c/0x3c0 [ 29.629674] kmalloc_uaf2+0xc4/0x468 [ 29.629811] kunit_try_run_case+0x170/0x3f0 [ 29.629869] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.630503] kthread+0x328/0x630 [ 29.630991] ret_from_fork+0x10/0x20 [ 29.631064] [ 29.631083] Freed by task 219: [ 29.631111] kasan_save_stack+0x3c/0x68 [ 29.631165] kasan_save_track+0x20/0x40 [ 29.631202] kasan_save_free_info+0x4c/0x78 [ 29.631241] __kasan_slab_free+0x6c/0x98 [ 29.631280] kfree+0x214/0x3c8 [ 29.631313] kmalloc_uaf2+0x134/0x468 [ 29.631351] kunit_try_run_case+0x170/0x3f0 [ 29.632124] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.632626] kthread+0x328/0x630 [ 29.632661] ret_from_fork+0x10/0x20 [ 29.632697] [ 29.632716] The buggy address belongs to the object at fff00000c99b0c80 [ 29.632716] which belongs to the cache kmalloc-64 of size 64 [ 29.633296] The buggy address is located 40 bytes inside of [ 29.633296] freed 64-byte region [fff00000c99b0c80, fff00000c99b0cc0) [ 29.633481] [ 29.633502] The buggy address belongs to the physical page: [ 29.633904] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1099b0 [ 29.633977] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 29.634140] page_type: f5(slab) [ 29.634261] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 29.634524] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 29.634724] page dumped because: kasan: bad access detected [ 29.634758] [ 29.634777] Memory state around the buggy address: [ 29.634809] fff00000c99b0b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.635034] fff00000c99b0c00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.635082] >fff00000c99b0c80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.635388] ^ [ 29.635642] fff00000c99b0d00: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc [ 29.635689] fff00000c99b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.636212] ==================================================================
[ 25.350006] ================================================================== [ 25.350425] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x4a8/0x520 [ 25.350716] Read of size 1 at addr ffff888105847c28 by task kunit_try_catch/236 [ 25.351127] [ 25.351242] CPU: 0 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250710 #1 PREEMPT(voluntary) [ 25.351290] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.351302] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.351323] Call Trace: [ 25.351336] <TASK> [ 25.351354] dump_stack_lvl+0x73/0xb0 [ 25.351382] print_report+0xd1/0x610 [ 25.351405] ? __virt_addr_valid+0x1db/0x2d0 [ 25.351429] ? kmalloc_uaf2+0x4a8/0x520 [ 25.351448] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.351473] ? kmalloc_uaf2+0x4a8/0x520 [ 25.351502] kasan_report+0x141/0x180 [ 25.351523] ? kmalloc_uaf2+0x4a8/0x520 [ 25.351547] __asan_report_load1_noabort+0x18/0x20 [ 25.351571] kmalloc_uaf2+0x4a8/0x520 [ 25.351591] ? __pfx_kmalloc_uaf2+0x10/0x10 [ 25.351610] ? finish_task_switch.isra.0+0x153/0x700 [ 25.351632] ? __switch_to+0x47/0xf80 [ 25.351659] ? __schedule+0x10cc/0x2b60 [ 25.351682] ? __pfx_read_tsc+0x10/0x10 [ 25.351716] ? ktime_get_ts64+0x86/0x230 [ 25.351740] kunit_try_run_case+0x1a5/0x480 [ 25.351762] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.351829] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.351865] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.351888] ? __kthread_parkme+0x82/0x180 [ 25.351909] ? preempt_count_sub+0x50/0x80 [ 25.351931] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.351953] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.351977] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.352002] kthread+0x337/0x6f0 [ 25.352021] ? trace_preempt_on+0x20/0xc0 [ 25.352044] ? __pfx_kthread+0x10/0x10 [ 25.352065] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.352086] ? calculate_sigpending+0x7b/0xa0 [ 25.352110] ? __pfx_kthread+0x10/0x10 [ 25.352131] ret_from_fork+0x116/0x1d0 [ 25.352149] ? __pfx_kthread+0x10/0x10 [ 25.352170] ret_from_fork_asm+0x1a/0x30 [ 25.352200] </TASK> [ 25.352212] [ 25.359735] Allocated by task 236: [ 25.360044] kasan_save_stack+0x45/0x70 [ 25.360240] kasan_save_track+0x18/0x40 [ 25.360401] kasan_save_alloc_info+0x3b/0x50 [ 25.360622] __kasan_kmalloc+0xb7/0xc0 [ 25.360882] __kmalloc_cache_noprof+0x189/0x420 [ 25.361084] kmalloc_uaf2+0xc6/0x520 [ 25.361241] kunit_try_run_case+0x1a5/0x480 [ 25.361424] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.361693] kthread+0x337/0x6f0 [ 25.361822] ret_from_fork+0x116/0x1d0 [ 25.362000] ret_from_fork_asm+0x1a/0x30 [ 25.362201] [ 25.362292] Freed by task 236: [ 25.362449] kasan_save_stack+0x45/0x70 [ 25.362668] kasan_save_track+0x18/0x40 [ 25.362904] kasan_save_free_info+0x3f/0x60 [ 25.363097] __kasan_slab_free+0x56/0x70 [ 25.363228] kfree+0x222/0x3f0 [ 25.363358] kmalloc_uaf2+0x14c/0x520 [ 25.363580] kunit_try_run_case+0x1a5/0x480 [ 25.363834] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.364048] kthread+0x337/0x6f0 [ 25.364214] ret_from_fork+0x116/0x1d0 [ 25.364403] ret_from_fork_asm+0x1a/0x30 [ 25.364591] [ 25.364665] The buggy address belongs to the object at ffff888105847c00 [ 25.364665] which belongs to the cache kmalloc-64 of size 64 [ 25.365033] The buggy address is located 40 bytes inside of [ 25.365033] freed 64-byte region [ffff888105847c00, ffff888105847c40) [ 25.365380] [ 25.365447] The buggy address belongs to the physical page: [ 25.365684] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105847 [ 25.366363] flags: 0x200000000000000(node=0|zone=2) [ 25.366851] page_type: f5(slab) [ 25.367025] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 25.367361] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 25.367710] page dumped because: kasan: bad access detected [ 25.367986] [ 25.368083] Memory state around the buggy address: [ 25.368259] ffff888105847b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.368472] ffff888105847b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.368879] >ffff888105847c00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.369205] ^ [ 25.369391] ffff888105847c80: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc [ 25.369692] ffff888105847d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.370026] ==================================================================