Date
July 24, 2025, 4:41 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 33.779417] ================================================================== [ 33.779553] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x388/0x468 [ 33.779642] Read of size 1 at addr fff00000c9a96000 by task kunit_try_catch/244 [ 33.779697] [ 33.779742] CPU: 0 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250724 #1 PREEMPT [ 33.779852] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.779881] Hardware name: linux,dummy-virt (DT) [ 33.779917] Call trace: [ 33.779942] show_stack+0x20/0x38 (C) [ 33.779995] dump_stack_lvl+0x8c/0xd0 [ 33.780046] print_report+0x118/0x5e8 [ 33.780091] kasan_report+0xdc/0x128 [ 33.780135] __asan_report_load1_noabort+0x20/0x30 [ 33.780184] kmem_cache_rcu_uaf+0x388/0x468 [ 33.780233] kunit_try_run_case+0x170/0x3f0 [ 33.780283] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.780337] kthread+0x328/0x630 [ 33.780382] ret_from_fork+0x10/0x20 [ 33.780435] [ 33.780453] Allocated by task 244: [ 33.780484] kasan_save_stack+0x3c/0x68 [ 33.780523] kasan_save_track+0x20/0x40 [ 33.780559] kasan_save_alloc_info+0x40/0x58 [ 33.780595] __kasan_slab_alloc+0xa8/0xb0 [ 33.780632] kmem_cache_alloc_noprof+0x10c/0x398 [ 33.780675] kmem_cache_rcu_uaf+0x12c/0x468 [ 33.780715] kunit_try_run_case+0x170/0x3f0 [ 33.780760] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.780803] kthread+0x328/0x630 [ 33.780835] ret_from_fork+0x10/0x20 [ 33.780872] [ 33.780890] Freed by task 0: [ 33.780919] kasan_save_stack+0x3c/0x68 [ 33.780954] kasan_save_track+0x20/0x40 [ 33.780989] kasan_save_free_info+0x4c/0x78 [ 33.781025] __kasan_slab_free+0x6c/0x98 [ 33.781062] slab_free_after_rcu_debug+0xd4/0x2f8 [ 33.781102] rcu_core+0x9f4/0x1e58 [ 33.781141] rcu_core_si+0x18/0x30 [ 33.781176] handle_softirqs+0x374/0xb28 [ 33.781214] __do_softirq+0x1c/0x28 [ 33.781248] [ 33.781267] Last potentially related work creation: [ 33.781295] kasan_save_stack+0x3c/0x68 [ 33.781330] kasan_record_aux_stack+0xb4/0xc8 [ 33.781369] kmem_cache_free+0x120/0x468 [ 33.781407] kmem_cache_rcu_uaf+0x16c/0x468 [ 33.781445] kunit_try_run_case+0x170/0x3f0 [ 33.781482] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.781523] kthread+0x328/0x630 [ 33.781556] ret_from_fork+0x10/0x20 [ 33.781591] [ 33.781611] The buggy address belongs to the object at fff00000c9a96000 [ 33.781611] which belongs to the cache test_cache of size 200 [ 33.781669] The buggy address is located 0 bytes inside of [ 33.781669] freed 200-byte region [fff00000c9a96000, fff00000c9a960c8) [ 33.781732] [ 33.781764] The buggy address belongs to the physical page: [ 33.781806] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109a96 [ 33.781863] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.781918] page_type: f5(slab) [ 33.781961] raw: 0bfffe0000000000 fff00000c58d78c0 dead000000000122 0000000000000000 [ 33.782012] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 33.782054] page dumped because: kasan: bad access detected [ 33.782086] [ 33.782106] Memory state around the buggy address: [ 33.782146] fff00000c9a95f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.782192] fff00000c9a95f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.782238] >fff00000c9a96000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.782278] ^ [ 33.782307] fff00000c9a96080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 33.782352] fff00000c9a96100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.782393] ==================================================================
[ 27.660068] ================================================================== [ 27.660553] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x3e3/0x510 [ 27.660967] Read of size 1 at addr ffff88810546b000 by task kunit_try_catch/261 [ 27.661733] [ 27.661837] CPU: 0 UID: 0 PID: 261 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250724 #1 PREEMPT(voluntary) [ 27.661968] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 27.661984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.662008] Call Trace: [ 27.662022] <TASK> [ 27.662042] dump_stack_lvl+0x73/0xb0 [ 27.662075] print_report+0xd1/0x640 [ 27.662099] ? __virt_addr_valid+0x1db/0x2d0 [ 27.662126] ? kmem_cache_rcu_uaf+0x3e3/0x510 [ 27.662150] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.662176] ? kmem_cache_rcu_uaf+0x3e3/0x510 [ 27.662200] kasan_report+0x141/0x180 [ 27.662221] ? kmem_cache_rcu_uaf+0x3e3/0x510 [ 27.662249] __asan_report_load1_noabort+0x18/0x20 [ 27.662273] kmem_cache_rcu_uaf+0x3e3/0x510 [ 27.662296] ? __pfx_kmem_cache_rcu_uaf+0x10/0x10 [ 27.662318] ? finish_task_switch.isra.0+0x153/0x700 [ 27.662340] ? __switch_to+0x47/0xf80 [ 27.662371] ? __pfx_read_tsc+0x10/0x10 [ 27.662393] ? ktime_get_ts64+0x86/0x230 [ 27.662420] kunit_try_run_case+0x1a5/0x480 [ 27.662446] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.662468] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.662494] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.662518] ? __kthread_parkme+0x82/0x180 [ 27.662539] ? preempt_count_sub+0x50/0x80 [ 27.662561] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.662597] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.662620] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.662643] kthread+0x337/0x6f0 [ 27.662663] ? trace_preempt_on+0x20/0xc0 [ 27.662688] ? __pfx_kthread+0x10/0x10 [ 27.662709] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.662732] ? calculate_sigpending+0x7b/0xa0 [ 27.662757] ? __pfx_kthread+0x10/0x10 [ 27.662778] ret_from_fork+0x116/0x1d0 [ 27.662992] ? __pfx_kthread+0x10/0x10 [ 27.663017] ret_from_fork_asm+0x1a/0x30 [ 27.663051] </TASK> [ 27.663062] [ 27.672385] Allocated by task 261: [ 27.672561] kasan_save_stack+0x45/0x70 [ 27.672760] kasan_save_track+0x18/0x40 [ 27.673400] kasan_save_alloc_info+0x3b/0x50 [ 27.673706] __kasan_slab_alloc+0x91/0xa0 [ 27.674192] kmem_cache_alloc_noprof+0x123/0x3f0 [ 27.674626] kmem_cache_rcu_uaf+0x155/0x510 [ 27.675097] kunit_try_run_case+0x1a5/0x480 [ 27.675522] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.676087] kthread+0x337/0x6f0 [ 27.676387] ret_from_fork+0x116/0x1d0 [ 27.676594] ret_from_fork_asm+0x1a/0x30 [ 27.676778] [ 27.677199] Freed by task 0: [ 27.677485] kasan_save_stack+0x45/0x70 [ 27.677911] kasan_save_track+0x18/0x40 [ 27.678252] kasan_save_free_info+0x3f/0x60 [ 27.678453] __kasan_slab_free+0x56/0x70 [ 27.678638] slab_free_after_rcu_debug+0xe4/0x310 [ 27.679169] rcu_core+0x66f/0x1c40 [ 27.679435] rcu_core_si+0x12/0x20 [ 27.679748] handle_softirqs+0x209/0x730 [ 27.680138] __irq_exit_rcu+0xc9/0x110 [ 27.680461] irq_exit_rcu+0x12/0x20 [ 27.680657] sysvec_apic_timer_interrupt+0x81/0x90 [ 27.681234] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 27.681535] [ 27.681642] Last potentially related work creation: [ 27.682188] kasan_save_stack+0x45/0x70 [ 27.682472] kasan_record_aux_stack+0xb2/0xc0 [ 27.682678] kmem_cache_free+0x131/0x420 [ 27.682849] kmem_cache_rcu_uaf+0x194/0x510 [ 27.683258] kunit_try_run_case+0x1a5/0x480 [ 27.683697] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.684216] kthread+0x337/0x6f0 [ 27.684538] ret_from_fork+0x116/0x1d0 [ 27.685020] ret_from_fork_asm+0x1a/0x30 [ 27.685404] [ 27.685492] The buggy address belongs to the object at ffff88810546b000 [ 27.685492] which belongs to the cache test_cache of size 200 [ 27.686417] The buggy address is located 0 bytes inside of [ 27.686417] freed 200-byte region [ffff88810546b000, ffff88810546b0c8) [ 27.687571] [ 27.687685] The buggy address belongs to the physical page: [ 27.688066] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10546b [ 27.688314] flags: 0x200000000000000(node=0|zone=2) [ 27.688511] page_type: f5(slab) [ 27.688692] raw: 0200000000000000 ffff888101d87780 dead000000000122 0000000000000000 [ 27.689017] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 27.689237] page dumped because: kasan: bad access detected [ 27.689489] [ 27.689994] Memory state around the buggy address: [ 27.690190] ffff88810546af00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.690496] ffff88810546af80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.690922] >ffff88810546b000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.691176] ^ [ 27.691369] ffff88810546b080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 27.691645] ffff88810546b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.692039] ==================================================================