Hay
Date
July 17, 2025, 10:12 a.m.

Environment
qemu-arm64
qemu-x86_64

[   30.920918] ==================================================================
[   30.921024] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x388/0x468
[   30.921122] Read of size 1 at addr fff00000c9b29000 by task kunit_try_catch/244
[   30.921174] 
[   30.921217] CPU: 1 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250717 #1 PREEMPT 
[   30.921305] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.921332] Hardware name: linux,dummy-virt (DT)
[   30.921367] Call trace:
[   30.921394]  show_stack+0x20/0x38 (C)
[   30.921448]  dump_stack_lvl+0x8c/0xd0
[   30.921502]  print_report+0x118/0x5d0
[   30.921548]  kasan_report+0xdc/0x128
[   30.921592]  __asan_report_load1_noabort+0x20/0x30
[   30.921642]  kmem_cache_rcu_uaf+0x388/0x468
[   30.921690]  kunit_try_run_case+0x170/0x3f0
[   30.921740]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.921793]  kthread+0x328/0x630
[   30.921838]  ret_from_fork+0x10/0x20
[   30.921889] 
[   30.921907] Allocated by task 244:
[   30.921939]  kasan_save_stack+0x3c/0x68
[   30.921979]  kasan_save_track+0x20/0x40
[   30.922013]  kasan_save_alloc_info+0x40/0x58
[   30.922051]  __kasan_slab_alloc+0xa8/0xb0
[   30.922152]  kmem_cache_alloc_noprof+0x10c/0x398
[   30.922197]  kmem_cache_rcu_uaf+0x12c/0x468
[   30.922235]  kunit_try_run_case+0x170/0x3f0
[   30.922272]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.922315]  kthread+0x328/0x630
[   30.922348]  ret_from_fork+0x10/0x20
[   30.922385] 
[   30.922405] Freed by task 0:
[   30.922431]  kasan_save_stack+0x3c/0x68
[   30.922468]  kasan_save_track+0x20/0x40
[   30.922501]  kasan_save_free_info+0x4c/0x78
[   30.922538]  __kasan_slab_free+0x6c/0x98
[   30.922572]  slab_free_after_rcu_debug+0xd4/0x2f8
[   30.922613]  rcu_core+0x9f4/0x1e58
[   30.922650]  rcu_core_si+0x18/0x30
[   30.922686]  handle_softirqs+0x374/0xb28
[   30.922725]  __do_softirq+0x1c/0x28
[   30.922757] 
[   30.922790] Last potentially related work creation:
[   30.922815]  kasan_save_stack+0x3c/0x68
[   30.922852]  kasan_record_aux_stack+0xb4/0xc8
[   30.922889]  kmem_cache_free+0x120/0x468
[   30.922928]  kmem_cache_rcu_uaf+0x16c/0x468
[   30.922967]  kunit_try_run_case+0x170/0x3f0
[   30.923004]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.923046]  kthread+0x328/0x630
[   30.923091]  ret_from_fork+0x10/0x20
[   30.923125] 
[   30.923143] The buggy address belongs to the object at fff00000c9b29000
[   30.923143]  which belongs to the cache test_cache of size 200
[   30.923203] The buggy address is located 0 bytes inside of
[   30.923203]  freed 200-byte region [fff00000c9b29000, fff00000c9b290c8)
[   30.923265] 
[   30.923294] The buggy address belongs to the physical page:
[   30.923329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b29
[   30.923388] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.923441] page_type: f5(slab)
[   30.923485] raw: 0bfffe0000000000 fff00000c5817500 dead000000000122 0000000000000000
[   30.923536] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000
[   30.923577] page dumped because: kasan: bad access detected
[   30.923609] 
[   30.923628] Memory state around the buggy address:
[   30.923662]  fff00000c9b28f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.923706]  fff00000c9b28f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.923749] >fff00000c9b29000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.923788]                    ^
[   30.923816]  fff00000c9b29080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[   30.923858]  fff00000c9b29100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.923897] ==================================================================

[   26.456414] ==================================================================
[   26.456849] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x3e3/0x510
[   26.457110] Read of size 1 at addr ffff888106182000 by task kunit_try_catch/262
[   26.457349] 
[   26.457436] CPU: 0 UID: 0 PID: 262 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250717 #1 PREEMPT(voluntary) 
[   26.457491] Tainted: [B]=BAD_PAGE, [N]=TEST
[   26.457503] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   26.457526] Call Trace:
[   26.457540]  <TASK>
[   26.457624]  dump_stack_lvl+0x73/0xb0
[   26.457660]  print_report+0xd1/0x610
[   26.457685]  ? __virt_addr_valid+0x1db/0x2d0
[   26.457712]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   26.457735]  ? kasan_complete_mode_report_info+0x64/0x200
[   26.457762]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   26.457786]  kasan_report+0x141/0x180
[   26.457808]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   26.457836]  __asan_report_load1_noabort+0x18/0x20
[   26.457861]  kmem_cache_rcu_uaf+0x3e3/0x510
[   26.457885]  ? __pfx_kmem_cache_rcu_uaf+0x10/0x10
[   26.457908]  ? finish_task_switch.isra.0+0x153/0x700
[   26.457935]  ? __switch_to+0x47/0xf80
[   26.457967]  ? __pfx_read_tsc+0x10/0x10
[   26.457989]  ? ktime_get_ts64+0x86/0x230
[   26.458017]  kunit_try_run_case+0x1a5/0x480
[   26.458043]  ? __pfx_kunit_try_run_case+0x10/0x10
[   26.458065]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   26.458102]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   26.458126]  ? __kthread_parkme+0x82/0x180
[   26.458153]  ? preempt_count_sub+0x50/0x80
[   26.458176]  ? __pfx_kunit_try_run_case+0x10/0x10
[   26.458221]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   26.458263]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   26.458287]  kthread+0x337/0x6f0
[   26.458307]  ? trace_preempt_on+0x20/0xc0
[   26.458339]  ? __pfx_kthread+0x10/0x10
[   26.458360]  ? _raw_spin_unlock_irq+0x47/0x80
[   26.458382]  ? calculate_sigpending+0x7b/0xa0
[   26.458408]  ? __pfx_kthread+0x10/0x10
[   26.458429]  ret_from_fork+0x116/0x1d0
[   26.458449]  ? __pfx_kthread+0x10/0x10
[   26.458469]  ret_from_fork_asm+0x1a/0x30
[   26.458522]  </TASK>
[   26.458533] 
[   26.468731] Allocated by task 262:
[   26.468892]  kasan_save_stack+0x45/0x70
[   26.469074]  kasan_save_track+0x18/0x40
[   26.469241]  kasan_save_alloc_info+0x3b/0x50
[   26.469506]  __kasan_slab_alloc+0x91/0xa0
[   26.469728]  kmem_cache_alloc_noprof+0x123/0x3f0
[   26.469934]  kmem_cache_rcu_uaf+0x155/0x510
[   26.470165]  kunit_try_run_case+0x1a5/0x480
[   26.470405]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   26.470845]  kthread+0x337/0x6f0
[   26.471015]  ret_from_fork+0x116/0x1d0
[   26.471201]  ret_from_fork_asm+0x1a/0x30
[   26.471531] 
[   26.471625] Freed by task 0:
[   26.471756]  kasan_save_stack+0x45/0x70
[   26.471918]  kasan_save_track+0x18/0x40
[   26.472124]  kasan_save_free_info+0x3f/0x60
[   26.472363]  __kasan_slab_free+0x56/0x70
[   26.472635]  slab_free_after_rcu_debug+0xe4/0x310
[   26.472860]  rcu_core+0x66f/0x1c40
[   26.473054]  rcu_core_si+0x12/0x20
[   26.473255]  handle_softirqs+0x209/0x730
[   26.473460]  __irq_exit_rcu+0xc9/0x110
[   26.473639]  irq_exit_rcu+0x12/0x20
[   26.473815]  sysvec_apic_timer_interrupt+0x81/0x90
[   26.474018]  asm_sysvec_apic_timer_interrupt+0x1f/0x30
[   26.474454] 
[   26.474559] Last potentially related work creation:
[   26.474709]  kasan_save_stack+0x45/0x70
[   26.474885]  kasan_record_aux_stack+0xb2/0xc0
[   26.475109]  kmem_cache_free+0x131/0x420
[   26.475568]  kmem_cache_rcu_uaf+0x194/0x510
[   26.475965]  kunit_try_run_case+0x1a5/0x480
[   26.476518]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   26.477275]  kthread+0x337/0x6f0
[   26.477508]  ret_from_fork+0x116/0x1d0
[   26.477650]  ret_from_fork_asm+0x1a/0x30
[   26.478069] 
[   26.478175] The buggy address belongs to the object at ffff888106182000
[   26.478175]  which belongs to the cache test_cache of size 200
[   26.479066] The buggy address is located 0 bytes inside of
[   26.479066]  freed 200-byte region [ffff888106182000, ffff8881061820c8)
[   26.479854] 
[   26.480134] The buggy address belongs to the physical page:
[   26.480513] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106182
[   26.480858] flags: 0x200000000000000(node=0|zone=2)
[   26.481068] page_type: f5(slab)
[   26.481244] raw: 0200000000000000 ffff888101e9e640 dead000000000122 0000000000000000
[   26.481856] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000
[   26.482292] page dumped because: kasan: bad access detected
[   26.482721] 
[   26.483052] Memory state around the buggy address:
[   26.483285]  ffff888106181f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.483659]  ffff888106181f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.484096] >ffff888106182000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.484671]                    ^
[   26.484815]  ffff888106182080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[   26.485280]  ffff888106182100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.485738] ==================================================================