Date
July 25, 2025, 3:13 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.626393] ================================================================== [ 34.626464] BUG: KASAN: slab-use-after-free in strcmp+0xc0/0xc8 [ 34.626622] Read of size 1 at addr fff00000c9a94390 by task kunit_try_catch/291 [ 34.626872] [ 34.627010] CPU: 0 UID: 0 PID: 291 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250725 #1 PREEMPT [ 34.627252] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 34.627283] Hardware name: linux,dummy-virt (DT) [ 34.627317] Call trace: [ 34.627401] show_stack+0x20/0x38 (C) [ 34.627505] dump_stack_lvl+0x8c/0xd0 [ 34.627552] print_report+0x118/0x5e8 [ 34.627692] kasan_report+0xdc/0x128 [ 34.627744] __asan_report_load1_noabort+0x20/0x30 [ 34.627796] strcmp+0xc0/0xc8 [ 34.627857] kasan_strings+0x340/0xb00 [ 34.628063] kunit_try_run_case+0x170/0x3f0 [ 34.628114] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.628202] kthread+0x328/0x630 [ 34.628265] ret_from_fork+0x10/0x20 [ 34.628420] [ 34.628472] Allocated by task 291: [ 34.628508] kasan_save_stack+0x3c/0x68 [ 34.628662] kasan_save_track+0x20/0x40 [ 34.628758] kasan_save_alloc_info+0x40/0x58 [ 34.628816] __kasan_kmalloc+0xd4/0xd8 [ 34.628853] __kmalloc_cache_noprof+0x16c/0x3c0 [ 34.628916] kasan_strings+0xc8/0xb00 [ 34.629101] kunit_try_run_case+0x170/0x3f0 [ 34.629142] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.629205] kthread+0x328/0x630 [ 34.629347] ret_from_fork+0x10/0x20 [ 34.629394] [ 34.629501] Freed by task 291: [ 34.629530] kasan_save_stack+0x3c/0x68 [ 34.629606] kasan_save_track+0x20/0x40 [ 34.629884] kasan_save_free_info+0x4c/0x78 [ 34.630118] __kasan_slab_free+0x7c/0xa8 [ 34.630172] kfree+0x214/0x3c8 [ 34.630425] kasan_strings+0x24c/0xb00 [ 34.630467] kunit_try_run_case+0x170/0x3f0 [ 34.630506] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.630551] kthread+0x328/0x630 [ 34.630586] ret_from_fork+0x10/0x20 [ 34.630625] [ 34.630676] The buggy address belongs to the object at fff00000c9a94380 [ 34.630676] which belongs to the cache kmalloc-32 of size 32 [ 34.630763] The buggy address is located 16 bytes inside of [ 34.630763] freed 32-byte region [fff00000c9a94380, fff00000c9a943a0) [ 34.630846] [ 34.630871] The buggy address belongs to the physical page: [ 34.630942] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109a94 [ 34.631061] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.631114] page_type: f5(slab) [ 34.631438] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 34.631552] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 34.631605] page dumped because: kasan: bad access detected [ 34.631667] [ 34.631698] Memory state around the buggy address: [ 34.631750] fff00000c9a94280: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 34.631806] fff00000c9a94300: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 34.631852] >fff00000c9a94380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 34.631892] ^ [ 34.631923] fff00000c9a94400: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 34.631969] fff00000c9a94480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 34.632025] ==================================================================
[ 27.735333] ================================================================== [ 27.736424] BUG: KASAN: slab-use-after-free in strcmp+0xb0/0xc0 [ 27.736699] Read of size 1 at addr ffff88810625ff90 by task kunit_try_catch/308 [ 27.737148] [ 27.737246] CPU: 1 UID: 0 PID: 308 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250725 #1 PREEMPT(voluntary) [ 27.737299] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.737312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.737335] Call Trace: [ 27.737349] <TASK> [ 27.737366] dump_stack_lvl+0x73/0xb0 [ 27.737395] print_report+0xd1/0x640 [ 27.737421] ? __virt_addr_valid+0x1db/0x2d0 [ 27.737447] ? strcmp+0xb0/0xc0 [ 27.737469] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.737496] ? strcmp+0xb0/0xc0 [ 27.737518] kasan_report+0x141/0x180 [ 27.737541] ? strcmp+0xb0/0xc0 [ 27.737567] __asan_report_load1_noabort+0x18/0x20 [ 27.737593] strcmp+0xb0/0xc0 [ 27.737616] kasan_strings+0x431/0xe80 [ 27.737637] ? trace_hardirqs_on+0x37/0xe0 [ 27.737662] ? __pfx_kasan_strings+0x10/0x10 [ 27.737683] ? finish_task_switch.isra.0+0x153/0x700 [ 27.737706] ? __switch_to+0x47/0xf80 [ 27.737735] ? __schedule+0x10da/0x2b60 [ 27.737757] ? __pfx_read_tsc+0x10/0x10 [ 27.737842] ? ktime_get_ts64+0x86/0x230 [ 27.737872] kunit_try_run_case+0x1a5/0x480 [ 27.737900] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.737924] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.737956] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.737983] ? __kthread_parkme+0x82/0x180 [ 27.738005] ? preempt_count_sub+0x50/0x80 [ 27.738029] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.738072] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.738098] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.738124] kthread+0x337/0x6f0 [ 27.738144] ? trace_preempt_on+0x20/0xc0 [ 27.738168] ? __pfx_kthread+0x10/0x10 [ 27.738189] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.738214] ? calculate_sigpending+0x7b/0xa0 [ 27.738239] ? __pfx_kthread+0x10/0x10 [ 27.738262] ret_from_fork+0x116/0x1d0 [ 27.738282] ? __pfx_kthread+0x10/0x10 [ 27.738303] ret_from_fork_asm+0x1a/0x30 [ 27.738336] </TASK> [ 27.738347] [ 27.746299] Allocated by task 308: [ 27.746483] kasan_save_stack+0x45/0x70 [ 27.746683] kasan_save_track+0x18/0x40 [ 27.746925] kasan_save_alloc_info+0x3b/0x50 [ 27.747144] __kasan_kmalloc+0xb7/0xc0 [ 27.747320] __kmalloc_cache_noprof+0x189/0x420 [ 27.747536] kasan_strings+0xc0/0xe80 [ 27.747710] kunit_try_run_case+0x1a5/0x480 [ 27.748063] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.748360] kthread+0x337/0x6f0 [ 27.748500] ret_from_fork+0x116/0x1d0 [ 27.748678] ret_from_fork_asm+0x1a/0x30 [ 27.748926] [ 27.749035] Freed by task 308: [ 27.749210] kasan_save_stack+0x45/0x70 [ 27.749384] kasan_save_track+0x18/0x40 [ 27.749566] kasan_save_free_info+0x3f/0x60 [ 27.749752] __kasan_slab_free+0x5e/0x80 [ 27.749990] kfree+0x222/0x3f0 [ 27.750147] kasan_strings+0x2aa/0xe80 [ 27.750324] kunit_try_run_case+0x1a5/0x480 [ 27.750534] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.750764] kthread+0x337/0x6f0 [ 27.750974] ret_from_fork+0x116/0x1d0 [ 27.751192] ret_from_fork_asm+0x1a/0x30 [ 27.751362] [ 27.751454] The buggy address belongs to the object at ffff88810625ff80 [ 27.751454] which belongs to the cache kmalloc-32 of size 32 [ 27.752108] The buggy address is located 16 bytes inside of [ 27.752108] freed 32-byte region [ffff88810625ff80, ffff88810625ffa0) [ 27.752638] [ 27.752736] The buggy address belongs to the physical page: [ 27.753032] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10625f [ 27.753314] flags: 0x200000000000000(node=0|zone=2) [ 27.753483] page_type: f5(slab) [ 27.753605] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 27.753911] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000 [ 27.754288] page dumped because: kasan: bad access detected [ 27.754543] [ 27.754631] Memory state around the buggy address: [ 27.754923] ffff88810625fe80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 27.755284] ffff88810625ff00: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 27.755613] >ffff88810625ff80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 27.756109] ^ [ 27.756322] ffff888106260000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.756594] ffff888106260080: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb [ 27.756932] ==================================================================