Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 21.598212] ================================================================== [ 21.599165] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x30c/0x340 [ 21.599892] Read of size 1 at addr fff00000c662ad88 by task kunit_try_catch/172 [ 21.600710] [ 21.601096] CPU: 1 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 21.601301] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.601376] Hardware name: linux,dummy-virt (DT) [ 21.601461] Call trace: [ 21.601527] dump_backtrace+0x9c/0x128 [ 21.601643] show_stack+0x20/0x38 [ 21.601750] dump_stack_lvl+0x8c/0xd0 [ 21.601869] print_report+0x118/0x5f0 [ 21.602000] kasan_report+0xdc/0x128 [ 21.602108] __asan_report_load1_noabort+0x20/0x30 [ 21.602229] kmalloc_uaf+0x30c/0x340 [ 21.602336] kunit_try_run_case+0x170/0x3f0 [ 21.602430] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.602488] kthread+0x24c/0x2d0 [ 21.602532] ret_from_fork+0x10/0x20 [ 21.602584] [ 21.607609] Allocated by task 172: [ 21.608005] kasan_save_stack+0x3c/0x68 [ 21.608562] kasan_save_track+0x20/0x40 [ 21.609222] kasan_save_alloc_info+0x40/0x58 [ 21.609925] __kasan_kmalloc+0xd4/0xd8 [ 21.610543] __kmalloc_cache_noprof+0x154/0x320 [ 21.611167] kmalloc_uaf+0xb8/0x340 [ 21.612117] kunit_try_run_case+0x170/0x3f0 [ 21.612689] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.613414] kthread+0x24c/0x2d0 [ 21.613902] ret_from_fork+0x10/0x20 [ 21.614426] [ 21.614736] Freed by task 172: [ 21.615214] kasan_save_stack+0x3c/0x68 [ 21.615750] kasan_save_track+0x20/0x40 [ 21.616240] kasan_save_free_info+0x4c/0x78 [ 21.616688] __kasan_slab_free+0x6c/0x98 [ 21.617294] kfree+0x110/0x3b8 [ 21.617897] kmalloc_uaf+0x120/0x340 [ 21.618430] kunit_try_run_case+0x170/0x3f0 [ 21.619125] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.619862] kthread+0x24c/0x2d0 [ 21.620403] ret_from_fork+0x10/0x20 [ 21.620923] [ 21.621302] The buggy address belongs to the object at fff00000c662ad80 [ 21.621302] which belongs to the cache kmalloc-16 of size 16 [ 21.622467] The buggy address is located 8 bytes inside of [ 21.622467] freed 16-byte region [fff00000c662ad80, fff00000c662ad90) [ 21.623726] [ 21.624067] The buggy address belongs to the physical page: [ 21.624737] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10662a [ 21.625674] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.626498] page_type: f5(slab) [ 21.627063] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 21.627871] raw: 0000000000000000 0000000080800080 00000001f5000000 0000000000000000 [ 21.628690] page dumped because: kasan: bad access detected [ 21.629374] [ 21.629730] Memory state around the buggy address: [ 21.630316] fff00000c662ac80: fa fb fc fc 00 04 fc fc 00 05 fc fc fa fb fc fc [ 21.631048] fff00000c662ad00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 21.631734] >fff00000c662ad80: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.632280] ^ [ 21.632633] fff00000c662ae00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.633282] fff00000c662ae80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.634147] ==================================================================
[ 17.980922] ================================================================== [ 17.982074] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x322/0x380 [ 17.983521] Read of size 1 at addr ffff8881025abd68 by task kunit_try_catch/189 [ 17.984153] [ 17.984543] CPU: 0 UID: 0 PID: 189 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 17.984665] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.984701] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.984756] Call Trace: [ 17.984794] <TASK> [ 17.984840] dump_stack_lvl+0x73/0xb0 [ 17.985240] print_report+0xd1/0x640 [ 17.985281] ? __virt_addr_valid+0x1db/0x2d0 [ 17.985318] ? kmalloc_uaf+0x322/0x380 [ 17.985347] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.985381] ? kmalloc_uaf+0x322/0x380 [ 17.985411] kasan_report+0x140/0x180 [ 17.985457] ? kmalloc_uaf+0x322/0x380 [ 17.985581] __asan_report_load1_noabort+0x18/0x20 [ 17.985617] kmalloc_uaf+0x322/0x380 [ 17.985649] ? __pfx_kmalloc_uaf+0x10/0x10 [ 17.985681] ? __schedule+0xc49/0x27a0 [ 17.985710] ? __pfx_read_tsc+0x10/0x10 [ 17.985737] ? ktime_get_ts64+0x84/0x230 [ 17.985773] kunit_try_run_case+0x1a6/0x480 [ 17.985821] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.985869] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 17.985898] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.985932] ? __kthread_parkme+0x82/0x160 [ 17.985959] ? preempt_count_sub+0x50/0x80 [ 17.985988] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.986016] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.986052] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.986088] kthread+0x257/0x310 [ 17.986112] ? __pfx_kthread+0x10/0x10 [ 17.986140] ret_from_fork+0x41/0x80 [ 17.986169] ? __pfx_kthread+0x10/0x10 [ 17.986194] ret_from_fork_asm+0x1a/0x30 [ 17.986260] </TASK> [ 17.986275] [ 18.004329] Allocated by task 189: [ 18.004701] kasan_save_stack+0x45/0x70 [ 18.005940] kasan_save_track+0x18/0x40 [ 18.006525] kasan_save_alloc_info+0x3b/0x50 [ 18.007205] __kasan_kmalloc+0xb7/0xc0 [ 18.007817] __kmalloc_cache_noprof+0x168/0x350 [ 18.008444] kmalloc_uaf+0xab/0x380 [ 18.009065] kunit_try_run_case+0x1a6/0x480 [ 18.009518] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.010624] kthread+0x257/0x310 [ 18.010941] ret_from_fork+0x41/0x80 [ 18.011453] ret_from_fork_asm+0x1a/0x30 [ 18.012184] [ 18.012430] Freed by task 189: [ 18.013304] kasan_save_stack+0x45/0x70 [ 18.014093] kasan_save_track+0x18/0x40 [ 18.014536] kasan_save_free_info+0x3f/0x60 [ 18.014938] __kasan_slab_free+0x56/0x70 [ 18.015323] kfree+0x123/0x3d0 [ 18.015683] kmalloc_uaf+0x12d/0x380 [ 18.016768] kunit_try_run_case+0x1a6/0x480 [ 18.017885] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.018303] kthread+0x257/0x310 [ 18.019136] ret_from_fork+0x41/0x80 [ 18.019469] ret_from_fork_asm+0x1a/0x30 [ 18.020299] [ 18.020977] The buggy address belongs to the object at ffff8881025abd60 [ 18.020977] which belongs to the cache kmalloc-16 of size 16 [ 18.021896] The buggy address is located 8 bytes inside of [ 18.021896] freed 16-byte region [ffff8881025abd60, ffff8881025abd70) [ 18.023533] [ 18.024336] The buggy address belongs to the physical page: [ 18.024710] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1025ab [ 18.025749] flags: 0x200000000000000(node=0|zone=2) [ 18.026160] page_type: f5(slab) [ 18.026511] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 18.027921] raw: 0000000000000000 0000000080800080 00000001f5000000 0000000000000000 [ 18.028418] page dumped because: kasan: bad access detected [ 18.029447] [ 18.029944] Memory state around the buggy address: [ 18.030565] ffff8881025abc00: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 02 fc fc [ 18.031022] ffff8881025abc80: fa fb fc fc fa fb fc fc fa fb fc fc 00 05 fc fc [ 18.032409] >ffff8881025abd00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 18.033092] ^ [ 18.033654] ffff8881025abd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.034728] ffff8881025abe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.035305] ==================================================================