Date
July 11, 2025, 10:11 a.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 54.565178] ================================================================== [ 54.565370] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 54.571283] Read of size 1 at addr ffff000806dcc000 by task kunit_try_catch/317 [ 54.578573] [ 54.580061] CPU: 4 UID: 0 PID: 317 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250711 #1 PREEMPT [ 54.580117] Tainted: [B]=BAD_PAGE, [N]=TEST [ 54.580135] Hardware name: WinLink E850-96 board (DT) [ 54.580158] Call trace: [ 54.580173] show_stack+0x20/0x38 (C) [ 54.580211] dump_stack_lvl+0x8c/0xd0 [ 54.580245] print_report+0x118/0x5d0 [ 54.580276] kasan_report+0xdc/0x128 [ 54.580304] __asan_report_load1_noabort+0x20/0x30 [ 54.580337] mempool_uaf_helper+0x314/0x340 [ 54.580372] mempool_page_alloc_uaf+0xc0/0x118 [ 54.580408] kunit_try_run_case+0x170/0x3f0 [ 54.580449] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.580482] kthread+0x328/0x630 [ 54.580512] ret_from_fork+0x10/0x20 [ 54.580546] [ 54.648541] The buggy address belongs to the physical page: [ 54.654096] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x886dcc [ 54.662084] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 54.668605] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 54.676321] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 54.684041] page dumped because: kasan: bad access detected [ 54.689595] [ 54.691071] Memory state around the buggy address: [ 54.695851] ffff000806dcbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.703054] ffff000806dcbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.710260] >ffff000806dcc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.717459] ^ [ 54.720675] ffff000806dcc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.727880] ffff000806dcc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.735084] ================================================================== [ 53.998812] ================================================================== [ 54.008188] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 54.014870] Read of size 1 at addr ffff000805b50000 by task kunit_try_catch/313 [ 54.022158] [ 54.023645] CPU: 3 UID: 0 PID: 313 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250711 #1 PREEMPT [ 54.023704] Tainted: [B]=BAD_PAGE, [N]=TEST [ 54.023721] Hardware name: WinLink E850-96 board (DT) [ 54.023743] Call trace: [ 54.023759] show_stack+0x20/0x38 (C) [ 54.023797] dump_stack_lvl+0x8c/0xd0 [ 54.023830] print_report+0x118/0x5d0 [ 54.023861] kasan_report+0xdc/0x128 [ 54.023888] __asan_report_load1_noabort+0x20/0x30 [ 54.023923] mempool_uaf_helper+0x314/0x340 [ 54.023954] mempool_kmalloc_large_uaf+0xc4/0x120 [ 54.023986] kunit_try_run_case+0x170/0x3f0 [ 54.024028] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.024060] kthread+0x328/0x630 [ 54.024091] ret_from_fork+0x10/0x20 [ 54.024129] [ 54.092387] The buggy address belongs to the physical page: [ 54.097942] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x885b50 [ 54.105926] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 54.113566] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 54.120508] page_type: f8(unknown) [ 54.123906] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 54.131625] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 54.139351] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 54.147162] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 54.154975] head: 0bfffe0000000002 fffffdffe016d401 00000000ffffffff 00000000ffffffff [ 54.162787] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 54.170593] page dumped because: kasan: bad access detected [ 54.176148] [ 54.177624] Memory state around the buggy address: [ 54.182407] ffff000805b4ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.189607] ffff000805b4ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.196815] >ffff000805b50000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.204012] ^ [ 54.207228] ffff000805b50080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.214433] ffff000805b50100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.221634] ==================================================================
[ 32.441177] ================================================================== [ 32.441243] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 32.441314] Read of size 1 at addr fff00000c9b64000 by task kunit_try_catch/260 [ 32.441381] [ 32.441416] CPU: 0 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250711 #1 PREEMPT [ 32.441768] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.441803] Hardware name: linux,dummy-virt (DT) [ 32.441836] Call trace: [ 32.441861] show_stack+0x20/0x38 (C) [ 32.441964] dump_stack_lvl+0x8c/0xd0 [ 32.442128] print_report+0x118/0x5d0 [ 32.442216] kasan_report+0xdc/0x128 [ 32.442289] __asan_report_load1_noabort+0x20/0x30 [ 32.442387] mempool_uaf_helper+0x314/0x340 [ 32.442469] mempool_kmalloc_large_uaf+0xc4/0x120 [ 32.442576] kunit_try_run_case+0x170/0x3f0 [ 32.442627] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.442812] kthread+0x328/0x630 [ 32.442890] ret_from_fork+0x10/0x20 [ 32.442988] [ 32.443069] The buggy address belongs to the physical page: [ 32.443139] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b64 [ 32.443238] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.443353] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.443419] page_type: f8(unknown) [ 32.443486] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.443549] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.443743] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.443866] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.443937] head: 0bfffe0000000002 ffffc1ffc326d901 00000000ffffffff 00000000ffffffff [ 32.443986] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 32.444026] page dumped because: kasan: bad access detected [ 32.444235] [ 32.444329] Memory state around the buggy address: [ 32.444406] fff00000c9b63f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.444536] fff00000c9b63f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.444580] >fff00000c9b64000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.444652] ^ [ 32.444800] fff00000c9b64080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.444961] fff00000c9b64100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.445074] ================================================================== [ 32.483685] ================================================================== [ 32.483769] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 32.483857] Read of size 1 at addr fff00000c9b68000 by task kunit_try_catch/264 [ 32.484036] [ 32.484132] CPU: 0 UID: 0 PID: 264 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250711 #1 PREEMPT [ 32.484250] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.484302] Hardware name: linux,dummy-virt (DT) [ 32.484428] Call trace: [ 32.484477] show_stack+0x20/0x38 (C) [ 32.484552] dump_stack_lvl+0x8c/0xd0 [ 32.484634] print_report+0x118/0x5d0 [ 32.484680] kasan_report+0xdc/0x128 [ 32.484721] __asan_report_load1_noabort+0x20/0x30 [ 32.484769] mempool_uaf_helper+0x314/0x340 [ 32.484815] mempool_page_alloc_uaf+0xc0/0x118 [ 32.484911] kunit_try_run_case+0x170/0x3f0 [ 32.484979] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.485030] kthread+0x328/0x630 [ 32.485073] ret_from_fork+0x10/0x20 [ 32.485285] [ 32.485320] The buggy address belongs to the physical page: [ 32.485555] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b68 [ 32.485683] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.485787] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 32.485896] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 32.485984] page dumped because: kasan: bad access detected [ 32.486076] [ 32.486140] Memory state around the buggy address: [ 32.486199] fff00000c9b67f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.486269] fff00000c9b67f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.486394] >fff00000c9b68000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.486482] ^ [ 32.486540] fff00000c9b68080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.486622] fff00000c9b68100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.486672] ==================================================================
[ 25.370368] ================================================================== [ 25.370969] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 25.371504] Read of size 1 at addr ffff888102ba8000 by task kunit_try_catch/279 [ 25.372045] [ 25.372165] CPU: 1 UID: 0 PID: 279 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250711 #1 PREEMPT(voluntary) [ 25.372223] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.372236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.372263] Call Trace: [ 25.372523] <TASK> [ 25.372547] dump_stack_lvl+0x73/0xb0 [ 25.372586] print_report+0xd1/0x610 [ 25.372609] ? __virt_addr_valid+0x1db/0x2d0 [ 25.372635] ? mempool_uaf_helper+0x392/0x400 [ 25.372657] ? kasan_addr_to_slab+0x11/0xa0 [ 25.372678] ? mempool_uaf_helper+0x392/0x400 [ 25.372700] kasan_report+0x141/0x180 [ 25.372722] ? mempool_uaf_helper+0x392/0x400 [ 25.372763] __asan_report_load1_noabort+0x18/0x20 [ 25.372787] mempool_uaf_helper+0x392/0x400 [ 25.372810] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 25.372833] ? __kasan_check_write+0x18/0x20 [ 25.372858] ? __pfx_sched_clock_cpu+0x10/0x10 [ 25.372882] ? finish_task_switch.isra.0+0x153/0x700 [ 25.372910] mempool_kmalloc_large_uaf+0xef/0x140 [ 25.372934] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 25.372959] ? __pfx_mempool_kmalloc+0x10/0x10 [ 25.372983] ? __pfx_mempool_kfree+0x10/0x10 [ 25.373008] ? __pfx_read_tsc+0x10/0x10 [ 25.373031] ? ktime_get_ts64+0x86/0x230 [ 25.373057] kunit_try_run_case+0x1a5/0x480 [ 25.373083] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.373103] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.373129] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.373152] ? __kthread_parkme+0x82/0x180 [ 25.373174] ? preempt_count_sub+0x50/0x80 [ 25.373198] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.373220] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.373246] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.373307] kthread+0x337/0x6f0 [ 25.373331] ? trace_preempt_on+0x20/0xc0 [ 25.373356] ? __pfx_kthread+0x10/0x10 [ 25.373378] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.373400] ? calculate_sigpending+0x7b/0xa0 [ 25.373439] ? __pfx_kthread+0x10/0x10 [ 25.373462] ret_from_fork+0x116/0x1d0 [ 25.373483] ? __pfx_kthread+0x10/0x10 [ 25.373504] ret_from_fork_asm+0x1a/0x30 [ 25.373535] </TASK> [ 25.373547] [ 25.385716] The buggy address belongs to the physical page: [ 25.386200] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ba8 [ 25.386873] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.387296] flags: 0x200000000000040(head|node=0|zone=2) [ 25.387750] page_type: f8(unknown) [ 25.388020] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.388536] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 25.388937] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.389270] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 25.389866] head: 0200000000000002 ffffea00040aea01 00000000ffffffff 00000000ffffffff [ 25.390352] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.390796] page dumped because: kasan: bad access detected [ 25.391029] [ 25.391104] Memory state around the buggy address: [ 25.391572] ffff888102ba7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.391982] ffff888102ba7f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.392478] >ffff888102ba8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.392771] ^ [ 25.392928] ffff888102ba8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.393218] ffff888102ba8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.393833] ================================================================== [ 25.450758] ================================================================== [ 25.451182] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 25.451420] Read of size 1 at addr ffff888102ba8000 by task kunit_try_catch/283 [ 25.451636] [ 25.451727] CPU: 1 UID: 0 PID: 283 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250711 #1 PREEMPT(voluntary) [ 25.451795] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.451808] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.451833] Call Trace: [ 25.451847] <TASK> [ 25.451867] dump_stack_lvl+0x73/0xb0 [ 25.451899] print_report+0xd1/0x610 [ 25.451922] ? __virt_addr_valid+0x1db/0x2d0 [ 25.451947] ? mempool_uaf_helper+0x392/0x400 [ 25.451968] ? kasan_addr_to_slab+0x11/0xa0 [ 25.451988] ? mempool_uaf_helper+0x392/0x400 [ 25.452010] kasan_report+0x141/0x180 [ 25.452031] ? mempool_uaf_helper+0x392/0x400 [ 25.452057] __asan_report_load1_noabort+0x18/0x20 [ 25.452086] mempool_uaf_helper+0x392/0x400 [ 25.452110] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 25.452132] ? __kasan_check_write+0x18/0x20 [ 25.452156] ? __pfx_sched_clock_cpu+0x10/0x10 [ 25.452178] ? finish_task_switch.isra.0+0x153/0x700 [ 25.452204] mempool_page_alloc_uaf+0xed/0x140 [ 25.452227] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 25.452252] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 25.452276] ? __pfx_mempool_free_pages+0x10/0x10 [ 25.452302] ? __pfx_read_tsc+0x10/0x10 [ 25.452329] ? ktime_get_ts64+0x86/0x230 [ 25.452355] kunit_try_run_case+0x1a5/0x480 [ 25.452378] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.452398] ? irqentry_exit+0x2a/0x60 [ 25.452424] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.452453] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.452475] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.452499] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.452523] kthread+0x337/0x6f0 [ 25.452544] ? trace_preempt_on+0x20/0xc0 [ 25.452567] ? __pfx_kthread+0x10/0x10 [ 25.452589] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.452610] ? calculate_sigpending+0x7b/0xa0 [ 25.452635] ? __pfx_kthread+0x10/0x10 [ 25.452657] ret_from_fork+0x116/0x1d0 [ 25.452675] ? __pfx_kthread+0x10/0x10 [ 25.452696] ret_from_fork_asm+0x1a/0x30 [ 25.452727] </TASK> [ 25.453116] [ 25.473325] The buggy address belongs to the physical page: [ 25.473944] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ba8 [ 25.474550] flags: 0x200000000000000(node=0|zone=2) [ 25.474799] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 25.475607] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 25.476338] page dumped because: kasan: bad access detected [ 25.476836] [ 25.477026] Memory state around the buggy address: [ 25.477554] ffff888102ba7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.477820] ffff888102ba7f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.478492] >ffff888102ba8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.479073] ^ [ 25.479414] ffff888102ba8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.480004] ffff888102ba8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.480441] ==================================================================