Date
July 25, 2025, 3:13 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.637505] ================================================================== [ 34.637554] BUG: KASAN: slab-use-after-free in strlen+0xa8/0xb0 [ 34.637900] Read of size 1 at addr fff00000c9a94390 by task kunit_try_catch/291 [ 34.637997] [ 34.638032] CPU: 0 UID: 0 PID: 291 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250725 #1 PREEMPT [ 34.638147] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 34.638180] Hardware name: linux,dummy-virt (DT) [ 34.638213] Call trace: [ 34.638274] show_stack+0x20/0x38 (C) [ 34.638325] dump_stack_lvl+0x8c/0xd0 [ 34.638374] print_report+0x118/0x5e8 [ 34.638631] kasan_report+0xdc/0x128 [ 34.638694] __asan_report_load1_noabort+0x20/0x30 [ 34.638789] strlen+0xa8/0xb0 [ 34.638876] kasan_strings+0x418/0xb00 [ 34.638977] kunit_try_run_case+0x170/0x3f0 [ 34.639099] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.639218] kthread+0x328/0x630 [ 34.639310] ret_from_fork+0x10/0x20 [ 34.639422] [ 34.639443] Allocated by task 291: [ 34.639474] kasan_save_stack+0x3c/0x68 [ 34.639836] kasan_save_track+0x20/0x40 [ 34.639964] kasan_save_alloc_info+0x40/0x58 [ 34.640080] __kasan_kmalloc+0xd4/0xd8 [ 34.640207] __kmalloc_cache_noprof+0x16c/0x3c0 [ 34.640305] kasan_strings+0xc8/0xb00 [ 34.640412] kunit_try_run_case+0x170/0x3f0 [ 34.640509] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.640688] kthread+0x328/0x630 [ 34.640800] ret_from_fork+0x10/0x20 [ 34.640839] [ 34.641149] Freed by task 291: [ 34.641286] kasan_save_stack+0x3c/0x68 [ 34.641365] kasan_save_track+0x20/0x40 [ 34.641431] kasan_save_free_info+0x4c/0x78 [ 34.641471] __kasan_slab_free+0x7c/0xa8 [ 34.641728] kfree+0x214/0x3c8 [ 34.641814] kasan_strings+0x24c/0xb00 [ 34.641921] kunit_try_run_case+0x170/0x3f0 [ 34.642078] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.642225] kthread+0x328/0x630 [ 34.642319] ret_from_fork+0x10/0x20 [ 34.642453] [ 34.642558] The buggy address belongs to the object at fff00000c9a94380 [ 34.642558] which belongs to the cache kmalloc-32 of size 32 [ 34.642786] The buggy address is located 16 bytes inside of [ 34.642786] freed 32-byte region [fff00000c9a94380, fff00000c9a943a0) [ 34.642954] [ 34.643080] The buggy address belongs to the physical page: [ 34.643187] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109a94 [ 34.643316] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.643443] page_type: f5(slab) [ 34.643569] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 34.643651] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 34.643738] page dumped because: kasan: bad access detected [ 34.643782] [ 34.643802] Memory state around the buggy address: [ 34.643836] fff00000c9a94280: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 34.643880] fff00000c9a94300: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 34.643932] >fff00000c9a94380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 34.643974] ^ [ 34.644007] fff00000c9a94400: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 34.644054] fff00000c9a94480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 34.644105] ==================================================================
[ 27.779717] ================================================================== [ 27.780113] BUG: KASAN: slab-use-after-free in strlen+0x8f/0xb0 [ 27.780418] Read of size 1 at addr ffff88810625ff90 by task kunit_try_catch/308 [ 27.780761] [ 27.780862] CPU: 1 UID: 0 PID: 308 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250725 #1 PREEMPT(voluntary) [ 27.780908] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.780921] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.780951] Call Trace: [ 27.780966] <TASK> [ 27.780981] dump_stack_lvl+0x73/0xb0 [ 27.781008] print_report+0xd1/0x640 [ 27.781031] ? __virt_addr_valid+0x1db/0x2d0 [ 27.781062] ? strlen+0x8f/0xb0 [ 27.781082] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.781110] ? strlen+0x8f/0xb0 [ 27.781140] kasan_report+0x141/0x180 [ 27.781163] ? strlen+0x8f/0xb0 [ 27.781188] __asan_report_load1_noabort+0x18/0x20 [ 27.781215] strlen+0x8f/0xb0 [ 27.781237] kasan_strings+0x57b/0xe80 [ 27.781258] ? trace_hardirqs_on+0x37/0xe0 [ 27.781282] ? __pfx_kasan_strings+0x10/0x10 [ 27.781304] ? finish_task_switch.isra.0+0x153/0x700 [ 27.781327] ? __switch_to+0x47/0xf80 [ 27.781354] ? __schedule+0x10da/0x2b60 [ 27.781377] ? __pfx_read_tsc+0x10/0x10 [ 27.781400] ? ktime_get_ts64+0x86/0x230 [ 27.781424] kunit_try_run_case+0x1a5/0x480 [ 27.781450] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.781473] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.781496] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.781523] ? __kthread_parkme+0x82/0x180 [ 27.781543] ? preempt_count_sub+0x50/0x80 [ 27.781567] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.781592] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.781616] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.781641] kthread+0x337/0x6f0 [ 27.781662] ? trace_preempt_on+0x20/0xc0 [ 27.781684] ? __pfx_kthread+0x10/0x10 [ 27.781706] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.781731] ? calculate_sigpending+0x7b/0xa0 [ 27.781755] ? __pfx_kthread+0x10/0x10 [ 27.781778] ret_from_fork+0x116/0x1d0 [ 27.781799] ? __pfx_kthread+0x10/0x10 [ 27.781820] ret_from_fork_asm+0x1a/0x30 [ 27.781852] </TASK> [ 27.781862] [ 27.789899] Allocated by task 308: [ 27.790127] kasan_save_stack+0x45/0x70 [ 27.790332] kasan_save_track+0x18/0x40 [ 27.790521] kasan_save_alloc_info+0x3b/0x50 [ 27.790732] __kasan_kmalloc+0xb7/0xc0 [ 27.791037] __kmalloc_cache_noprof+0x189/0x420 [ 27.791308] kasan_strings+0xc0/0xe80 [ 27.791442] kunit_try_run_case+0x1a5/0x480 [ 27.791651] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.792017] kthread+0x337/0x6f0 [ 27.792231] ret_from_fork+0x116/0x1d0 [ 27.792431] ret_from_fork_asm+0x1a/0x30 [ 27.792603] [ 27.792711] Freed by task 308: [ 27.792914] kasan_save_stack+0x45/0x70 [ 27.793146] kasan_save_track+0x18/0x40 [ 27.793347] kasan_save_free_info+0x3f/0x60 [ 27.793531] __kasan_slab_free+0x5e/0x80 [ 27.793669] kfree+0x222/0x3f0 [ 27.793783] kasan_strings+0x2aa/0xe80 [ 27.793915] kunit_try_run_case+0x1a5/0x480 [ 27.795142] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.795998] kthread+0x337/0x6f0 [ 27.796424] ret_from_fork+0x116/0x1d0 [ 27.796950] ret_from_fork_asm+0x1a/0x30 [ 27.797510] [ 27.797834] The buggy address belongs to the object at ffff88810625ff80 [ 27.797834] which belongs to the cache kmalloc-32 of size 32 [ 27.798715] The buggy address is located 16 bytes inside of [ 27.798715] freed 32-byte region [ffff88810625ff80, ffff88810625ffa0) [ 27.800266] [ 27.800410] The buggy address belongs to the physical page: [ 27.800684] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10625f [ 27.801056] flags: 0x200000000000000(node=0|zone=2) [ 27.801299] page_type: f5(slab) [ 27.801916] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 27.802451] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000 [ 27.802985] page dumped because: kasan: bad access detected [ 27.803397] [ 27.803500] Memory state around the buggy address: [ 27.804044] ffff88810625fe80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 27.804444] ffff88810625ff00: 00 00 00 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 27.804855] >ffff88810625ff80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 27.805438] ^ [ 27.805635] ffff888106260000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.806253] ffff888106260080: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb [ 27.806637] ==================================================================