Hay
Date
July 17, 2025, 10:12 a.m.

Environment
qemu-arm64
qemu-x86_64

[   29.534637] ==================================================================
[   29.534699] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x3bc/0x438
[   29.535129] Read of size 16 at addr fff00000c7ac9340 by task kunit_try_catch/199
[   29.535223] 
[   29.535332] CPU: 1 UID: 0 PID: 199 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250717 #1 PREEMPT 
[   29.535556] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.535593] Hardware name: linux,dummy-virt (DT)
[   29.535719] Call trace:
[   29.535771]  show_stack+0x20/0x38 (C)
[   29.535826]  dump_stack_lvl+0x8c/0xd0
[   29.536155]  print_report+0x118/0x5d0
[   29.536221]  kasan_report+0xdc/0x128
[   29.536265]  __asan_report_load16_noabort+0x20/0x30
[   29.536423]  kmalloc_uaf_16+0x3bc/0x438
[   29.536479]  kunit_try_run_case+0x170/0x3f0
[   29.536886]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.536962]  kthread+0x328/0x630
[   29.537045]  ret_from_fork+0x10/0x20
[   29.537229] 
[   29.537288] Allocated by task 199:
[   29.537400]  kasan_save_stack+0x3c/0x68
[   29.537482]  kasan_save_track+0x20/0x40
[   29.537550]  kasan_save_alloc_info+0x40/0x58
[   29.537918]  __kasan_kmalloc+0xd4/0xd8
[   29.537974]  __kmalloc_cache_noprof+0x16c/0x3c0
[   29.538080]  kmalloc_uaf_16+0x140/0x438
[   29.538120]  kunit_try_run_case+0x170/0x3f0
[   29.538157]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.538211]  kthread+0x328/0x630
[   29.538243]  ret_from_fork+0x10/0x20
[   29.538278] 
[   29.538297] Freed by task 199:
[   29.538340]  kasan_save_stack+0x3c/0x68
[   29.538375]  kasan_save_track+0x20/0x40
[   29.538408]  kasan_save_free_info+0x4c/0x78
[   29.538444]  __kasan_slab_free+0x6c/0x98
[   29.538477]  kfree+0x214/0x3c8
[   29.538520]  kmalloc_uaf_16+0x190/0x438
[   29.538556]  kunit_try_run_case+0x170/0x3f0
[   29.538601]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.538641]  kthread+0x328/0x630
[   29.538674]  ret_from_fork+0x10/0x20
[   29.538709] 
[   29.538729] The buggy address belongs to the object at fff00000c7ac9340
[   29.538729]  which belongs to the cache kmalloc-16 of size 16
[   29.538798] The buggy address is located 0 bytes inside of
[   29.538798]  freed 16-byte region [fff00000c7ac9340, fff00000c7ac9350)
[   29.538873] 
[   29.538906] The buggy address belongs to the physical page:
[   29.538941] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107ac9
[   29.538994] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   29.539040] page_type: f5(slab)
[   29.539479] raw: 0bfffe0000000000 fff00000c0001640 dead000000000100 dead000000000122
[   29.539599] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   29.539695] page dumped because: kasan: bad access detected
[   29.539821] 
[   29.539863] Memory state around the buggy address:
[   29.539896]  fff00000c7ac9200: fa fb fc fc fa fb fc fc fa fb fc fc 00 00 fc fc
[   29.539946]  fff00000c7ac9280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   29.540003] >fff00000c7ac9300: fa fb fc fc 00 00 fc fc fa fb fc fc fc fc fc fc
[   29.540340]                                            ^
[   29.540425]  fff00000c7ac9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.540470]  fff00000c7ac9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.540572] ==================================================================

[   25.712760] ==================================================================
[   25.713197] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x47b/0x4c0
[   25.713654] Read of size 16 at addr ffff8881048d1ac0 by task kunit_try_catch/217
[   25.713963] 
[   25.714068] CPU: 0 UID: 0 PID: 217 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250717 #1 PREEMPT(voluntary) 
[   25.714125] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.714136] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   25.714156] Call Trace:
[   25.714169]  <TASK>
[   25.714183]  dump_stack_lvl+0x73/0xb0
[   25.714213]  print_report+0xd1/0x610
[   25.714234]  ? __virt_addr_valid+0x1db/0x2d0
[   25.714451]  ? kmalloc_uaf_16+0x47b/0x4c0
[   25.714481]  ? kasan_complete_mode_report_info+0x64/0x200
[   25.714507]  ? kmalloc_uaf_16+0x47b/0x4c0
[   25.714527]  kasan_report+0x141/0x180
[   25.714550]  ? kmalloc_uaf_16+0x47b/0x4c0
[   25.714575]  __asan_report_load16_noabort+0x18/0x20
[   25.714598]  kmalloc_uaf_16+0x47b/0x4c0
[   25.714618]  ? __pfx_kmalloc_uaf_16+0x10/0x10
[   25.714639]  ? __schedule+0x10c6/0x2b60
[   25.714662]  ? __pfx_read_tsc+0x10/0x10
[   25.714682]  ? ktime_get_ts64+0x86/0x230
[   25.714706]  kunit_try_run_case+0x1a5/0x480
[   25.714730]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.714751]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   25.714773]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   25.714795]  ? __kthread_parkme+0x82/0x180
[   25.714819]  ? preempt_count_sub+0x50/0x80
[   25.714842]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.714864]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.714887]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   25.714909]  kthread+0x337/0x6f0
[   25.714927]  ? trace_preempt_on+0x20/0xc0
[   25.714950]  ? __pfx_kthread+0x10/0x10
[   25.714969]  ? _raw_spin_unlock_irq+0x47/0x80
[   25.714989]  ? calculate_sigpending+0x7b/0xa0
[   25.715012]  ? __pfx_kthread+0x10/0x10
[   25.715033]  ret_from_fork+0x116/0x1d0
[   25.715051]  ? __pfx_kthread+0x10/0x10
[   25.715070]  ret_from_fork_asm+0x1a/0x30
[   25.715115]  </TASK>
[   25.715124] 
[   25.722608] Allocated by task 217:
[   25.722842]  kasan_save_stack+0x45/0x70
[   25.722978]  kasan_save_track+0x18/0x40
[   25.723116]  kasan_save_alloc_info+0x3b/0x50
[   25.723255]  __kasan_kmalloc+0xb7/0xc0
[   25.723778]  __kmalloc_cache_noprof+0x189/0x420
[   25.724013]  kmalloc_uaf_16+0x15b/0x4c0
[   25.724217]  kunit_try_run_case+0x1a5/0x480
[   25.724477]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.724712]  kthread+0x337/0x6f0
[   25.724861]  ret_from_fork+0x116/0x1d0
[   25.725047]  ret_from_fork_asm+0x1a/0x30
[   25.725189] 
[   25.725252] Freed by task 217:
[   25.725356]  kasan_save_stack+0x45/0x70
[   25.725598]  kasan_save_track+0x18/0x40
[   25.725787]  kasan_save_free_info+0x3f/0x60
[   25.726022]  __kasan_slab_free+0x56/0x70
[   25.726164]  kfree+0x222/0x3f0
[   25.726279]  kmalloc_uaf_16+0x1d6/0x4c0
[   25.726408]  kunit_try_run_case+0x1a5/0x480
[   25.726545]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.727003]  kthread+0x337/0x6f0
[   25.727204]  ret_from_fork+0x116/0x1d0
[   25.727393]  ret_from_fork_asm+0x1a/0x30
[   25.727730] 
[   25.728055] The buggy address belongs to the object at ffff8881048d1ac0
[   25.728055]  which belongs to the cache kmalloc-16 of size 16
[   25.728747] The buggy address is located 0 bytes inside of
[   25.728747]  freed 16-byte region [ffff8881048d1ac0, ffff8881048d1ad0)
[   25.729198] 
[   25.729305] The buggy address belongs to the physical page:
[   25.729565] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1048d1
[   25.729864] flags: 0x200000000000000(node=0|zone=2)
[   25.730024] page_type: f5(slab)
[   25.730177] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   25.730574] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   25.730913] page dumped because: kasan: bad access detected
[   25.731164] 
[   25.731254] Memory state around the buggy address:
[   25.731596]  ffff8881048d1980: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   25.731866]  ffff8881048d1a00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   25.732142] >ffff8881048d1a80: fa fb fc fc 00 00 fc fc fa fb fc fc fc fc fc fc
[   25.732596]                                            ^
[   25.732761]  ffff8881048d1b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.732965]  ffff8881048d1b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.733259] ==================================================================