Hay
Sign in
Date
July 14, 2025, 10:38 a.m.

Environment
e850-96
qemu-arm64
qemu-x86_64 

[   52.698289] ==================================================================
[   52.707837] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   52.714519] Read of size 1 at addr ffff000805f94000 by task kunit_try_catch/313
[   52.721809] 
[   52.723297] CPU: 5 UID: 0 PID: 313 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250714 #1 PREEMPT 
[   52.723351] Tainted: [B]=BAD_PAGE, [N]=TEST
[   52.723369] Hardware name: WinLink E850-96 board (DT)
[   52.723392] Call trace:
[   52.723406]  show_stack+0x20/0x38 (C)
[   52.723444]  dump_stack_lvl+0x8c/0xd0
[   52.723478]  print_report+0x118/0x5d0
[   52.723508]  kasan_report+0xdc/0x128
[   52.723535]  __asan_report_load1_noabort+0x20/0x30
[   52.723569]  mempool_uaf_helper+0x314/0x340
[   52.723600]  mempool_kmalloc_large_uaf+0xc4/0x120
[   52.723635]  kunit_try_run_case+0x170/0x3f0
[   52.723675]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   52.723708]  kthread+0x328/0x630
[   52.723739]  ret_from_fork+0x10/0x20
[   52.723778] 
[   52.792035] The buggy address belongs to the physical page:
[   52.797594] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x885f94
[   52.805577] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   52.813216] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   52.820159] page_type: f8(unknown)
[   52.823556] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   52.831276] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   52.839002] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   52.846813] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   52.854626] head: 0bfffe0000000002 fffffdffe017e501 00000000ffffffff 00000000ffffffff
[   52.862438] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   52.870246] page dumped because: kasan: bad access detected
[   52.875799] 
[   52.877276] Memory state around the buggy address:
[   52.882054]  ffff000805f93f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   52.889258]  ffff000805f93f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   52.896464] >ffff000805f94000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   52.903664]                    ^
[   52.906879]  ffff000805f94080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   52.914084]  ffff000805f94100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   52.921287] ==================================================================
[   53.268136] ==================================================================
[   53.268311] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   53.270933] Read of size 1 at addr ffff0008088e4000 by task kunit_try_catch/317
[   53.278226] 
[   53.279711] CPU: 7 UID: 0 PID: 317 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250714 #1 PREEMPT 
[   53.279768] Tainted: [B]=BAD_PAGE, [N]=TEST
[   53.279785] Hardware name: WinLink E850-96 board (DT)
[   53.279807] Call trace:
[   53.279820]  show_stack+0x20/0x38 (C)
[   53.279857]  dump_stack_lvl+0x8c/0xd0
[   53.279891]  print_report+0x118/0x5d0
[   53.279920]  kasan_report+0xdc/0x128
[   53.279949]  __asan_report_load1_noabort+0x20/0x30
[   53.279985]  mempool_uaf_helper+0x314/0x340
[   53.280020]  mempool_page_alloc_uaf+0xc0/0x118
[   53.280054]  kunit_try_run_case+0x170/0x3f0
[   53.280095]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.280128]  kthread+0x328/0x630
[   53.280158]  ret_from_fork+0x10/0x20
[   53.280193] 
[   53.348192] The buggy address belongs to the physical page:
[   53.353749] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8888e4
[   53.361733] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   53.368253] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   53.375972] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   53.383693] page dumped because: kasan: bad access detected
[   53.389247] 
[   53.390724] Memory state around the buggy address:
[   53.395503]  ffff0008088e3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   53.402705]  ffff0008088e3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   53.409911] >ffff0008088e4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   53.417111]                    ^
[   53.420326]  ffff0008088e4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   53.427531]  ffff0008088e4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   53.434734] ==================================================================
Metadata Full log Test run details 

[   31.762498] ==================================================================
[   31.762569] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   31.762948] Read of size 1 at addr fff00000c9c04000 by task kunit_try_catch/264
[   31.763074] 
[   31.763128] CPU: 0 UID: 0 PID: 264 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250714 #1 PREEMPT 
[   31.763583] Tainted: [B]=BAD_PAGE, [N]=TEST
[   31.763648] Hardware name: linux,dummy-virt (DT)
[   31.763728] Call trace:
[   31.763759]  show_stack+0x20/0x38 (C)
[   31.763831]  dump_stack_lvl+0x8c/0xd0
[   31.763899]  print_report+0x118/0x5d0
[   31.763944]  kasan_report+0xdc/0x128
[   31.763987]  __asan_report_load1_noabort+0x20/0x30
[   31.764390]  mempool_uaf_helper+0x314/0x340
[   31.764471]  mempool_page_alloc_uaf+0xc0/0x118
[   31.764588]  kunit_try_run_case+0x170/0x3f0
[   31.764657]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   31.764716]  kthread+0x328/0x630
[   31.765124]  ret_from_fork+0x10/0x20
[   31.765255] 
[   31.765281] The buggy address belongs to the physical page:
[   31.765346] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109c04
[   31.765420] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   31.765800] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   31.766193] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   31.766257] page dumped because: kasan: bad access detected
[   31.766294] 
[   31.766313] Memory state around the buggy address:
[   31.766480]  fff00000c9c03f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.766684]  fff00000c9c03f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.766760] >fff00000c9c04000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.766821]                    ^
[   31.766926]  fff00000c9c04080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.767079]  fff00000c9c04100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.767272] ==================================================================
[   31.695443] ==================================================================
[   31.695626] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   31.695712] Read of size 1 at addr fff00000c9c00000 by task kunit_try_catch/260
[   31.695764] 
[   31.695958] CPU: 0 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250714 #1 PREEMPT 
[   31.696095] Tainted: [B]=BAD_PAGE, [N]=TEST
[   31.696199] Hardware name: linux,dummy-virt (DT)
[   31.696252] Call trace:
[   31.696355]  show_stack+0x20/0x38 (C)
[   31.696413]  dump_stack_lvl+0x8c/0xd0
[   31.696476]  print_report+0x118/0x5d0
[   31.696525]  kasan_report+0xdc/0x128
[   31.696603]  __asan_report_load1_noabort+0x20/0x30
[   31.697007]  mempool_uaf_helper+0x314/0x340
[   31.697086]  mempool_kmalloc_large_uaf+0xc4/0x120
[   31.697142]  kunit_try_run_case+0x170/0x3f0
[   31.697190]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   31.697277]  kthread+0x328/0x630
[   31.697322]  ret_from_fork+0x10/0x20
[   31.697377] 
[   31.697410] The buggy address belongs to the physical page:
[   31.697445] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109c00
[   31.697512] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   31.697577] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   31.697646] page_type: f8(unknown)
[   31.697690] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   31.697742] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   31.697792] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   31.697840] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   31.697889] head: 0bfffe0000000002 ffffc1ffc3270001 00000000ffffffff 00000000ffffffff
[   31.697951] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   31.697993] page dumped because: kasan: bad access detected
[   31.698025] 
[   31.698044] Memory state around the buggy address:
[   31.698103]  fff00000c9bfff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.698145]  fff00000c9bfff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.698186] >fff00000c9c00000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.698224]                    ^
[   31.698258]  fff00000c9c00080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.698300]  fff00000c9c00100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.698357] ==================================================================
Metadata Full log Test run details 

[   25.948067] ==================================================================
[   25.948532] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400
[   25.948829] Read of size 1 at addr ffff8881061b4000 by task kunit_try_catch/282
[   25.949176] 
[   25.949276] CPU: 0 UID: 0 PID: 282 Comm: kunit_try_catch Tainted: G    B   W        N  6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary) 
[   25.949333] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   25.949363] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   25.949388] Call Trace:
[   25.949403]  <TASK>
[   25.949425]  dump_stack_lvl+0x73/0xb0
[   25.949461]  print_report+0xd1/0x610
[   25.949487]  ? __virt_addr_valid+0x1db/0x2d0
[   25.949514]  ? mempool_uaf_helper+0x392/0x400
[   25.949536]  ? kasan_addr_to_slab+0x11/0xa0
[   25.949557]  ? mempool_uaf_helper+0x392/0x400
[   25.949578]  kasan_report+0x141/0x180
[   25.949600]  ? mempool_uaf_helper+0x392/0x400
[   25.949626]  __asan_report_load1_noabort+0x18/0x20
[   25.949650]  mempool_uaf_helper+0x392/0x400
[   25.949682]  ? __pfx_mempool_uaf_helper+0x10/0x10
[   25.949704]  ? dequeue_entities+0x23f/0x1630
[   25.949732]  ? __pfx_sched_clock_cpu+0x10/0x10
[   25.949771]  ? finish_task_switch.isra.0+0x153/0x700
[   25.949797]  mempool_page_alloc_uaf+0xed/0x140
[   25.949821]  ? __pfx_mempool_page_alloc_uaf+0x10/0x10
[   25.949847]  ? __pfx_mempool_alloc_pages+0x10/0x10
[   25.949872]  ? __pfx_mempool_free_pages+0x10/0x10
[   25.949897]  ? __pfx_read_tsc+0x10/0x10
[   25.949921]  ? ktime_get_ts64+0x86/0x230
[   25.949947]  kunit_try_run_case+0x1a5/0x480
[   25.949972]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.949992]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   25.950017]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   25.950046]  ? __kthread_parkme+0x82/0x180
[   25.950067]  ? preempt_count_sub+0x50/0x80
[   25.950090]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.950111]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.950136]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   25.950161]  kthread+0x337/0x6f0
[   25.950182]  ? trace_preempt_on+0x20/0xc0
[   25.950206]  ? __pfx_kthread+0x10/0x10
[   25.950226]  ? _raw_spin_unlock_irq+0x47/0x80
[   25.950247]  ? calculate_sigpending+0x7b/0xa0
[   25.950271]  ? __pfx_kthread+0x10/0x10
[   25.950293]  ret_from_fork+0x116/0x1d0
[   25.950312]  ? __pfx_kthread+0x10/0x10
[   25.950333]  ret_from_fork_asm+0x1a/0x30
[   25.950364]  </TASK>
[   25.950375] 
[   25.958268] The buggy address belongs to the physical page:
[   25.958550] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1061b4
[   25.959353] flags: 0x200000000000000(node=0|zone=2)
[   25.959587] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
[   25.960256] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   25.960680] page dumped because: kasan: bad access detected
[   25.961151] 
[   25.961248] Memory state around the buggy address:
[   25.961460]  ffff8881061b3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.961921]  ffff8881061b3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.962425] >ffff8881061b4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.962836]                    ^
[   25.962991]  ffff8881061b4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.963256]  ffff8881061b4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.963517] ==================================================================
[   25.881651] ==================================================================
[   25.882162] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400
[   25.882951] Read of size 1 at addr ffff888106144000 by task kunit_try_catch/278
[   25.883196] 
[   25.883309] CPU: 1 UID: 0 PID: 278 Comm: kunit_try_catch Tainted: G    B   W        N  6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary) 
[   25.883366] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   25.883380] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   25.883405] Call Trace:
[   25.883419]  <TASK>
[   25.883439]  dump_stack_lvl+0x73/0xb0
[   25.883475]  print_report+0xd1/0x610
[   25.883500]  ? __virt_addr_valid+0x1db/0x2d0
[   25.883526]  ? mempool_uaf_helper+0x392/0x400
[   25.883548]  ? kasan_addr_to_slab+0x11/0xa0
[   25.883569]  ? mempool_uaf_helper+0x392/0x400
[   25.883590]  kasan_report+0x141/0x180
[   25.883612]  ? mempool_uaf_helper+0x392/0x400
[   25.883690]  __asan_report_load1_noabort+0x18/0x20
[   25.883715]  mempool_uaf_helper+0x392/0x400
[   25.883738]  ? __pfx_mempool_uaf_helper+0x10/0x10
[   25.883771]  ? dequeue_entities+0x23f/0x1630
[   25.883860]  ? __kasan_check_write+0x18/0x20
[   25.883883]  ? __pfx_sched_clock_cpu+0x10/0x10
[   25.883905]  ? finish_task_switch.isra.0+0x153/0x700
[   25.883931]  mempool_kmalloc_large_uaf+0xef/0x140
[   25.883953]  ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10
[   25.883979]  ? __pfx_mempool_kmalloc+0x10/0x10
[   25.884004]  ? __pfx_mempool_kfree+0x10/0x10
[   25.884028]  ? __pfx_read_tsc+0x10/0x10
[   25.884059]  ? ktime_get_ts64+0x86/0x230
[   25.884085]  kunit_try_run_case+0x1a5/0x480
[   25.884110]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.884130]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   25.884154]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   25.884177]  ? __kthread_parkme+0x82/0x180
[   25.884199]  ? preempt_count_sub+0x50/0x80
[   25.884221]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.884242]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.884268]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   25.884296]  kthread+0x337/0x6f0
[   25.884315]  ? trace_preempt_on+0x20/0xc0
[   25.884339]  ? __pfx_kthread+0x10/0x10
[   25.884359]  ? _raw_spin_unlock_irq+0x47/0x80
[   25.884381]  ? calculate_sigpending+0x7b/0xa0
[   25.884407]  ? __pfx_kthread+0x10/0x10
[   25.884428]  ret_from_fork+0x116/0x1d0
[   25.884448]  ? __pfx_kthread+0x10/0x10
[   25.884469]  ret_from_fork_asm+0x1a/0x30
[   25.884501]  </TASK>
[   25.884512] 
[   25.896364] The buggy address belongs to the physical page:
[   25.896680] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106144
[   25.897281] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   25.897690] flags: 0x200000000000040(head|node=0|zone=2)
[   25.898068] page_type: f8(unknown)
[   25.898203] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   25.898551] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   25.899205] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   25.899590] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   25.900050] head: 0200000000000002 ffffea0004185101 00000000ffffffff 00000000ffffffff
[   25.900385] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   25.900722] page dumped because: kasan: bad access detected
[   25.901215] 
[   25.901297] Memory state around the buggy address:
[   25.901646]  ffff888106143f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.902196]  ffff888106143f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.902570] >ffff888106144000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.902980]                    ^
[   25.903424]  ffff888106144080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.903918]  ffff888106144100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   25.904260] ==================================================================
Metadata Full log Test run details