Date
July 15, 2025, 11:35 a.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 54.499193] ================================================================== [ 54.499379] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 54.499503] Read of size 1 at addr ffff00080506c000 by task kunit_try_catch/314 [ 54.501862] [ 54.503351] CPU: 3 UID: 0 PID: 314 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250715 #1 PREEMPT [ 54.503414] Tainted: [B]=BAD_PAGE, [N]=TEST [ 54.503431] Hardware name: WinLink E850-96 board (DT) [ 54.503455] Call trace: [ 54.503468] show_stack+0x20/0x38 (C) [ 54.503505] dump_stack_lvl+0x8c/0xd0 [ 54.503541] print_report+0x118/0x5d0 [ 54.503570] kasan_report+0xdc/0x128 [ 54.503598] __asan_report_load1_noabort+0x20/0x30 [ 54.503635] mempool_uaf_helper+0x314/0x340 [ 54.503667] mempool_page_alloc_uaf+0xc0/0x118 [ 54.503705] kunit_try_run_case+0x170/0x3f0 [ 54.503734] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.503768] kthread+0x328/0x630 [ 54.503796] ret_from_fork+0x10/0x20 [ 54.503830] [ 54.571831] The buggy address belongs to the physical page: [ 54.577386] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x88506c [ 54.585371] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 54.591891] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 54.599611] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 54.607331] page dumped because: kasan: bad access detected [ 54.612885] [ 54.614360] Memory state around the buggy address: [ 54.619144] ffff00080506bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.626343] ffff00080506bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.633548] >ffff00080506c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.640749] ^ [ 54.643964] ffff00080506c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.651169] ffff00080506c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.658372] ================================================================== [ 53.918341] ================================================================== [ 53.927805] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 53.934488] Read of size 1 at addr ffff000803ec8000 by task kunit_try_catch/310 [ 53.941778] [ 53.943263] CPU: 0 UID: 0 PID: 310 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250715 #1 PREEMPT [ 53.943321] Tainted: [B]=BAD_PAGE, [N]=TEST [ 53.943337] Hardware name: WinLink E850-96 board (DT) [ 53.943361] Call trace: [ 53.943374] show_stack+0x20/0x38 (C) [ 53.943409] dump_stack_lvl+0x8c/0xd0 [ 53.943445] print_report+0x118/0x5d0 [ 53.943471] kasan_report+0xdc/0x128 [ 53.943497] __asan_report_load1_noabort+0x20/0x30 [ 53.943531] mempool_uaf_helper+0x314/0x340 [ 53.943565] mempool_kmalloc_large_uaf+0xc4/0x120 [ 53.943602] kunit_try_run_case+0x170/0x3f0 [ 53.943634] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.943667] kthread+0x328/0x630 [ 53.943694] ret_from_fork+0x10/0x20 [ 53.943729] [ 54.012003] The buggy address belongs to the physical page: [ 54.017560] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883ec8 [ 54.025544] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 54.033183] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 54.040126] page_type: f8(unknown) [ 54.043522] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 54.051243] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 54.058970] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 54.066780] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 54.074593] head: 0bfffe0000000002 fffffdffe00fb201 00000000ffffffff 00000000ffffffff [ 54.082405] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 54.090213] page dumped because: kasan: bad access detected [ 54.095766] [ 54.097241] Memory state around the buggy address: [ 54.102025] ffff000803ec7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.109224] ffff000803ec7f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.116429] >ffff000803ec8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.123630] ^ [ 54.126846] ffff000803ec8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.134050] ffff000803ec8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.141253] ==================================================================
[ 32.649604] ================================================================== [ 32.649665] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 32.649725] Read of size 1 at addr fff00000c6398000 by task kunit_try_catch/261 [ 32.649774] [ 32.649811] CPU: 1 UID: 0 PID: 261 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250715 #1 PREEMPT [ 32.649898] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.649925] Hardware name: linux,dummy-virt (DT) [ 32.649958] Call trace: [ 32.649983] show_stack+0x20/0x38 (C) [ 32.650041] dump_stack_lvl+0x8c/0xd0 [ 32.650283] print_report+0x118/0x5d0 [ 32.650413] kasan_report+0xdc/0x128 [ 32.650465] __asan_report_load1_noabort+0x20/0x30 [ 32.650514] mempool_uaf_helper+0x314/0x340 [ 32.650560] mempool_kmalloc_large_uaf+0xc4/0x120 [ 32.650608] kunit_try_run_case+0x170/0x3f0 [ 32.650787] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.651113] kthread+0x328/0x630 [ 32.651215] ret_from_fork+0x10/0x20 [ 32.651569] [ 32.651592] The buggy address belongs to the physical page: [ 32.651626] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106398 [ 32.651792] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.651848] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.651903] page_type: f8(unknown) [ 32.651944] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.652135] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.652185] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.652412] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.652473] head: 0bfffe0000000002 ffffc1ffc318e601 00000000ffffffff 00000000ffffffff [ 32.652550] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 32.652605] page dumped because: kasan: bad access detected [ 32.652726] [ 32.652745] Memory state around the buggy address: [ 32.652777] fff00000c6397f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.652819] fff00000c6397f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.652902] >fff00000c6398000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.653452] ^ [ 32.653582] fff00000c6398080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.653761] fff00000c6398100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.653803] ================================================================== [ 32.713571] ================================================================== [ 32.713664] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 32.714338] Read of size 1 at addr fff00000c9b28000 by task kunit_try_catch/265 [ 32.714431] [ 32.714539] CPU: 1 UID: 0 PID: 265 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250715 #1 PREEMPT [ 32.714845] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.714876] Hardware name: linux,dummy-virt (DT) [ 32.714910] Call trace: [ 32.714937] show_stack+0x20/0x38 (C) [ 32.715091] dump_stack_lvl+0x8c/0xd0 [ 32.715157] print_report+0x118/0x5d0 [ 32.715202] kasan_report+0xdc/0x128 [ 32.715255] __asan_report_load1_noabort+0x20/0x30 [ 32.715466] mempool_uaf_helper+0x314/0x340 [ 32.715532] mempool_page_alloc_uaf+0xc0/0x118 [ 32.715602] kunit_try_run_case+0x170/0x3f0 [ 32.715653] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.715846] kthread+0x328/0x630 [ 32.715902] ret_from_fork+0x10/0x20 [ 32.715950] [ 32.715972] The buggy address belongs to the physical page: [ 32.716248] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b28 [ 32.716353] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.716495] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 32.716625] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 32.716710] page dumped because: kasan: bad access detected [ 32.716853] [ 32.716871] Memory state around the buggy address: [ 32.716964] fff00000c9b27f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.717044] fff00000c9b27f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.717134] >fff00000c9b28000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.717185] ^ [ 32.717249] fff00000c9b28080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.717407] fff00000c9b28100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.717477] ==================================================================
[ 25.592211] ================================================================== [ 25.592637] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 25.592939] Read of size 1 at addr ffff888106128000 by task kunit_try_catch/277 [ 25.593225] [ 25.593335] CPU: 1 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250715 #1 PREEMPT(voluntary) [ 25.593387] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.593400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.593423] Call Trace: [ 25.593436] <TASK> [ 25.593455] dump_stack_lvl+0x73/0xb0 [ 25.593487] print_report+0xd1/0x610 [ 25.593510] ? __virt_addr_valid+0x1db/0x2d0 [ 25.593549] ? mempool_uaf_helper+0x392/0x400 [ 25.593571] ? kasan_addr_to_slab+0x11/0xa0 [ 25.593592] ? mempool_uaf_helper+0x392/0x400 [ 25.593614] kasan_report+0x141/0x180 [ 25.593636] ? mempool_uaf_helper+0x392/0x400 [ 25.593664] __asan_report_load1_noabort+0x18/0x20 [ 25.593688] mempool_uaf_helper+0x392/0x400 [ 25.593711] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 25.593734] ? dequeue_entities+0x23f/0x1630 [ 25.593760] ? __kasan_check_write+0x18/0x20 [ 25.593784] ? __pfx_sched_clock_cpu+0x10/0x10 [ 25.593807] ? finish_task_switch.isra.0+0x153/0x700 [ 25.593834] mempool_kmalloc_large_uaf+0xef/0x140 [ 25.593858] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 25.593884] ? __pfx_mempool_kmalloc+0x10/0x10 [ 25.593908] ? __pfx_mempool_kfree+0x10/0x10 [ 25.593933] ? __pfx_read_tsc+0x10/0x10 [ 25.593956] ? ktime_get_ts64+0x86/0x230 [ 25.593983] kunit_try_run_case+0x1a5/0x480 [ 25.594009] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.594049] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.594071] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.594094] ? __kthread_parkme+0x82/0x180 [ 25.594116] ? preempt_count_sub+0x50/0x80 [ 25.594140] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.594164] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.594190] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.594217] kthread+0x337/0x6f0 [ 25.594237] ? trace_preempt_on+0x20/0xc0 [ 25.594261] ? __pfx_kthread+0x10/0x10 [ 25.594282] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.594308] ? calculate_sigpending+0x7b/0xa0 [ 25.594333] ? __pfx_kthread+0x10/0x10 [ 25.594355] ret_from_fork+0x116/0x1d0 [ 25.594375] ? __pfx_kthread+0x10/0x10 [ 25.594395] ret_from_fork_asm+0x1a/0x30 [ 25.594428] </TASK> [ 25.594440] [ 25.604690] The buggy address belongs to the physical page: [ 25.605356] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106128 [ 25.606073] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.606936] flags: 0x200000000000040(head|node=0|zone=2) [ 25.607452] page_type: f8(unknown) [ 25.607809] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.608775] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 25.609452] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.610250] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 25.611056] head: 0200000000000002 ffffea0004184a01 00000000ffffffff 00000000ffffffff [ 25.611861] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.612500] page dumped because: kasan: bad access detected [ 25.613063] [ 25.613239] Memory state around the buggy address: [ 25.613735] ffff888106127f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.614048] ffff888106127f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.614263] >ffff888106128000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.614476] ^ [ 25.614662] ffff888106128080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.614955] ffff888106128100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.615237] ================================================================== [ 25.667825] ================================================================== [ 25.668286] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 25.668704] Read of size 1 at addr ffff888106228000 by task kunit_try_catch/281 [ 25.669009] [ 25.669128] CPU: 0 UID: 0 PID: 281 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250715 #1 PREEMPT(voluntary) [ 25.669188] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.669203] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.669229] Call Trace: [ 25.669245] <TASK> [ 25.669268] dump_stack_lvl+0x73/0xb0 [ 25.669307] print_report+0xd1/0x610 [ 25.669335] ? __virt_addr_valid+0x1db/0x2d0 [ 25.669367] ? mempool_uaf_helper+0x392/0x400 [ 25.669416] ? kasan_addr_to_slab+0x11/0xa0 [ 25.669443] ? mempool_uaf_helper+0x392/0x400 [ 25.669471] kasan_report+0x141/0x180 [ 25.669500] ? mempool_uaf_helper+0x392/0x400 [ 25.669562] __asan_report_load1_noabort+0x18/0x20 [ 25.669594] mempool_uaf_helper+0x392/0x400 [ 25.669624] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 25.669652] ? dequeue_entities+0x23f/0x1630 [ 25.669702] ? __pfx_sched_clock_cpu+0x10/0x10 [ 25.669743] ? finish_task_switch.isra.0+0x153/0x700 [ 25.669776] mempool_page_alloc_uaf+0xed/0x140 [ 25.669806] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 25.669838] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 25.669870] ? __pfx_mempool_free_pages+0x10/0x10 [ 25.669902] ? __pfx_read_tsc+0x10/0x10 [ 25.669929] ? ktime_get_ts64+0x86/0x230 [ 25.669962] kunit_try_run_case+0x1a5/0x480 [ 25.669993] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.670019] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.670048] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.670076] ? __kthread_parkme+0x82/0x180 [ 25.670103] ? preempt_count_sub+0x50/0x80 [ 25.670132] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.670160] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.670193] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.670225] kthread+0x337/0x6f0 [ 25.670250] ? trace_preempt_on+0x20/0xc0 [ 25.670279] ? __pfx_kthread+0x10/0x10 [ 25.670304] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.670335] ? calculate_sigpending+0x7b/0xa0 [ 25.670364] ? __pfx_kthread+0x10/0x10 [ 25.670391] ret_from_fork+0x116/0x1d0 [ 25.670416] ? __pfx_kthread+0x10/0x10 [ 25.670441] ret_from_fork_asm+0x1a/0x30 [ 25.670751] </TASK> [ 25.670764] [ 25.681055] The buggy address belongs to the physical page: [ 25.681428] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106228 [ 25.682001] flags: 0x200000000000000(node=0|zone=2) [ 25.682235] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 25.682759] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 25.683262] page dumped because: kasan: bad access detected [ 25.683510] [ 25.683605] Memory state around the buggy address: [ 25.683814] ffff888106227f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.684096] ffff888106227f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.684378] >ffff888106228000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.685077] ^ [ 25.685378] ffff888106228080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.685935] ffff888106228100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.686167] ==================================================================