Date
June 2, 2025, 2:11 p.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 32.282681] ================================================================== [ 32.282876] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x388/0x468 [ 32.283009] Read of size 1 at addr ffff000801dd6000 by task kunit_try_catch/260 [ 32.286394] [ 32.287880] CPU: 6 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT [ 32.287933] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.287952] Hardware name: WinLink E850-96 board (DT) [ 32.287976] Call trace: [ 32.287991] show_stack+0x20/0x38 (C) [ 32.288024] dump_stack_lvl+0x8c/0xd0 [ 32.288061] print_report+0x118/0x608 [ 32.288093] kasan_report+0xdc/0x128 [ 32.288121] __asan_report_load1_noabort+0x20/0x30 [ 32.288154] kmem_cache_rcu_uaf+0x388/0x468 [ 32.288189] kunit_try_run_case+0x170/0x3f0 [ 32.288228] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.288265] kthread+0x328/0x630 [ 32.288299] ret_from_fork+0x10/0x20 [ 32.288339] [ 32.350716] Allocated by task 260: [ 32.354103] kasan_save_stack+0x3c/0x68 [ 32.357920] kasan_save_track+0x20/0x40 [ 32.361739] kasan_save_alloc_info+0x40/0x58 [ 32.365992] __kasan_slab_alloc+0xa8/0xb0 [ 32.369985] kmem_cache_alloc_noprof+0x10c/0x398 [ 32.374586] kmem_cache_rcu_uaf+0x12c/0x468 [ 32.378753] kunit_try_run_case+0x170/0x3f0 [ 32.382919] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.388389] kthread+0x328/0x630 [ 32.391601] ret_from_fork+0x10/0x20 [ 32.395158] [ 32.396636] Freed by task 0: [ 32.399502] kasan_save_stack+0x3c/0x68 [ 32.403318] kasan_save_track+0x20/0x40 [ 32.407139] kasan_save_free_info+0x4c/0x78 [ 32.411304] __kasan_slab_free+0x6c/0x98 [ 32.415211] slab_free_after_rcu_debug+0xd4/0x2f8 [ 32.419898] rcu_core+0x9f4/0x1e20 [ 32.423283] rcu_core_si+0x18/0x30 [ 32.426668] handle_softirqs+0x374/0xb28 [ 32.430575] __do_softirq+0x1c/0x28 [ 32.434047] [ 32.435522] Last potentially related work creation: [ 32.440385] kasan_save_stack+0x3c/0x68 [ 32.444203] kasan_record_aux_stack+0xb4/0xc8 [ 32.448545] kmem_cache_free+0x120/0x468 [ 32.452450] kmem_cache_rcu_uaf+0x16c/0x468 [ 32.456616] kunit_try_run_case+0x170/0x3f0 [ 32.460783] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.466251] kthread+0x328/0x630 [ 32.469463] ret_from_fork+0x10/0x20 [ 32.473022] [ 32.474498] The buggy address belongs to the object at ffff000801dd6000 [ 32.474498] which belongs to the cache test_cache of size 200 [ 32.486913] The buggy address is located 0 bytes inside of [ 32.486913] freed 200-byte region [ffff000801dd6000, ffff000801dd60c8) [ 32.498978] [ 32.500456] The buggy address belongs to the physical page: [ 32.506012] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x881dd6 [ 32.513997] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.521636] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.528579] page_type: f5(slab) [ 32.531716] raw: 0bfffe0000000040 ffff000801dd2140 dead000000000122 0000000000000000 [ 32.539434] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 32.547161] head: 0bfffe0000000040 ffff000801dd2140 dead000000000122 0000000000000000 [ 32.554972] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 32.562785] head: 0bfffe0000000001 fffffdffe0077581 00000000ffffffff 00000000ffffffff [ 32.570596] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 32.578402] page dumped because: kasan: bad access detected [ 32.583958] [ 32.585433] Memory state around the buggy address: [ 32.590213] ffff000801dd5f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.597416] ffff000801dd5f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.604622] >ffff000801dd6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.611822] ^ [ 32.615038] ffff000801dd6080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 32.622242] ffff000801dd6100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.629445] ==================================================================
[ 19.813963] ================================================================== [ 19.814100] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x388/0x468 [ 19.814200] Read of size 1 at addr fff00000c3fa1000 by task kunit_try_catch/216 [ 19.814255] [ 19.814304] CPU: 0 UID: 0 PID: 216 Comm: kunit_try_catch Tainted: G B W N 6.15.1-rc1 #1 PREEMPT [ 19.814420] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 19.814449] Hardware name: linux,dummy-virt (DT) [ 19.814486] Call trace: [ 19.814513] show_stack+0x20/0x38 (C) [ 19.814571] dump_stack_lvl+0x8c/0xd0 [ 19.814627] print_report+0x118/0x608 [ 19.814674] kasan_report+0xdc/0x128 [ 19.814721] __asan_report_load1_noabort+0x20/0x30 [ 19.814773] kmem_cache_rcu_uaf+0x388/0x468 [ 19.814825] kunit_try_run_case+0x170/0x3f0 [ 19.814879] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.814936] kthread+0x328/0x630 [ 19.814986] ret_from_fork+0x10/0x20 [ 19.815044] [ 19.815063] Allocated by task 216: [ 19.815097] kasan_save_stack+0x3c/0x68 [ 19.815138] kasan_save_track+0x20/0x40 [ 19.815178] kasan_save_alloc_info+0x40/0x58 [ 19.815218] __kasan_slab_alloc+0xa8/0xb0 [ 19.815255] kmem_cache_alloc_noprof+0x10c/0x398 [ 19.815298] kmem_cache_rcu_uaf+0x12c/0x468 [ 19.815339] kunit_try_run_case+0x170/0x3f0 [ 19.815391] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.815438] kthread+0x328/0x630 [ 19.815475] ret_from_fork+0x10/0x20 [ 19.815513] [ 19.815531] Freed by task 0: [ 19.815559] kasan_save_stack+0x3c/0x68 [ 19.815597] kasan_save_track+0x20/0x40 [ 19.815632] kasan_save_free_info+0x4c/0x78 [ 19.815672] __kasan_slab_free+0x6c/0x98 [ 19.815710] slab_free_after_rcu_debug+0xd4/0x2f8 [ 19.815750] rcu_core+0x9f4/0x1e20 [ 19.815789] rcu_core_si+0x18/0x30 [ 19.815824] handle_softirqs+0x374/0xb28 [ 19.815863] __do_softirq+0x1c/0x28 [ 19.815899] [ 19.815921] Last potentially related work creation: [ 19.815949] kasan_save_stack+0x3c/0x68 [ 19.815988] kasan_record_aux_stack+0xb4/0xc8 [ 19.816030] kmem_cache_free+0x120/0x468 [ 19.816067] kmem_cache_rcu_uaf+0x16c/0x468 [ 19.816109] kunit_try_run_case+0x170/0x3f0 [ 19.816150] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.816197] kthread+0x328/0x630 [ 19.816234] ret_from_fork+0x10/0x20 [ 19.816271] [ 19.816290] The buggy address belongs to the object at fff00000c3fa1000 [ 19.816290] which belongs to the cache test_cache of size 200 [ 19.816358] The buggy address is located 0 bytes inside of [ 19.816358] freed 200-byte region [fff00000c3fa1000, fff00000c3fa10c8) [ 19.816420] [ 19.816442] The buggy address belongs to the physical page: [ 19.816477] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103fa1 [ 19.816535] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.816590] page_type: f5(slab) [ 19.816635] raw: 0bfffe0000000000 fff00000c3ef3280 dead000000000122 0000000000000000 [ 19.816687] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 19.816730] page dumped because: kasan: bad access detected [ 19.816760] [ 19.816780] Memory state around the buggy address: [ 19.816815] fff00000c3fa0f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.816860] fff00000c3fa0f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.816904] >fff00000c3fa1000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.816942] ^ [ 19.816970] fff00000c3fa1080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 19.817013] fff00000c3fa1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.817052] ==================================================================
[ 17.587739] ================================================================== [ 17.588391] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x3e3/0x510 [ 17.588868] Read of size 1 at addr ffff888101e00000 by task kunit_try_catch/234 [ 17.589109] [ 17.589294] CPU: 1 UID: 0 PID: 234 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT(voluntary) [ 17.589359] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.589373] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.589399] Call Trace: [ 17.589416] <TASK> [ 17.589443] dump_stack_lvl+0x73/0xb0 [ 17.589479] print_report+0xd1/0x650 [ 17.589504] ? __virt_addr_valid+0x1db/0x2d0 [ 17.589531] ? kmem_cache_rcu_uaf+0x3e3/0x510 [ 17.589552] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.589897] ? kmem_cache_rcu_uaf+0x3e3/0x510 [ 17.589925] kasan_report+0x141/0x180 [ 17.589952] ? kmem_cache_rcu_uaf+0x3e3/0x510 [ 17.589981] __asan_report_load1_noabort+0x18/0x20 [ 17.590004] kmem_cache_rcu_uaf+0x3e3/0x510 [ 17.590026] ? __pfx_kmem_cache_rcu_uaf+0x10/0x10 [ 17.590048] ? finish_task_switch.isra.0+0x153/0x700 [ 17.590078] ? __switch_to+0x5d9/0xf60 [ 17.590102] ? dequeue_task_fair+0x156/0x4e0 [ 17.590161] ? __pfx_read_tsc+0x10/0x10 [ 17.590184] ? ktime_get_ts64+0x86/0x230 [ 17.590215] kunit_try_run_case+0x1a5/0x480 [ 17.590244] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.590268] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.590295] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.590320] ? __kthread_parkme+0x82/0x180 [ 17.590346] ? preempt_count_sub+0x50/0x80 [ 17.590380] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.590405] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.590430] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.590454] kthread+0x337/0x6f0 [ 17.590474] ? trace_preempt_on+0x20/0xc0 [ 17.590501] ? __pfx_kthread+0x10/0x10 [ 17.590521] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.590557] ? calculate_sigpending+0x7b/0xa0 [ 17.590583] ? __pfx_kthread+0x10/0x10 [ 17.590603] ret_from_fork+0x41/0x80 [ 17.590626] ? __pfx_kthread+0x10/0x10 [ 17.590648] ret_from_fork_asm+0x1a/0x30 [ 17.590683] </TASK> [ 17.590698] [ 17.599927] Allocated by task 234: [ 17.600282] kasan_save_stack+0x45/0x70 [ 17.600651] kasan_save_track+0x18/0x40 [ 17.601031] kasan_save_alloc_info+0x3b/0x50 [ 17.601326] __kasan_slab_alloc+0x91/0xa0 [ 17.601449] kmem_cache_alloc_noprof+0x123/0x3f0 [ 17.601579] kmem_cache_rcu_uaf+0x155/0x510 [ 17.601695] kunit_try_run_case+0x1a5/0x480 [ 17.601828] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.602067] kthread+0x337/0x6f0 [ 17.602325] ret_from_fork+0x41/0x80 [ 17.602536] ret_from_fork_asm+0x1a/0x30 [ 17.602866] [ 17.602999] Freed by task 0: [ 17.603280] kasan_save_stack+0x45/0x70 [ 17.603447] kasan_save_track+0x18/0x40 [ 17.603690] kasan_save_free_info+0x3f/0x60 [ 17.603838] __kasan_slab_free+0x56/0x70 [ 17.604129] slab_free_after_rcu_debug+0xe4/0x310 [ 17.604493] rcu_core+0x66c/0x1c30 [ 17.604687] rcu_core_si+0x12/0x20 [ 17.604836] handle_softirqs+0x209/0x730 [ 17.605457] __irq_exit_rcu+0xc9/0x110 [ 17.605862] irq_exit_rcu+0x12/0x20 [ 17.606218] sysvec_apic_timer_interrupt+0x81/0x90 [ 17.606376] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 17.606802] [ 17.606994] Last potentially related work creation: [ 17.607320] kasan_save_stack+0x45/0x70 [ 17.607656] kasan_record_aux_stack+0xb2/0xc0 [ 17.607976] kmem_cache_free+0x131/0x420 [ 17.608293] kmem_cache_rcu_uaf+0x194/0x510 [ 17.608463] kunit_try_run_case+0x1a5/0x480 [ 17.608766] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.609178] kthread+0x337/0x6f0 [ 17.609526] ret_from_fork+0x41/0x80 [ 17.609883] ret_from_fork_asm+0x1a/0x30 [ 17.610316] [ 17.610525] The buggy address belongs to the object at ffff888101e00000 [ 17.610525] which belongs to the cache test_cache of size 200 [ 17.611373] The buggy address is located 0 bytes inside of [ 17.611373] freed 200-byte region [ffff888101e00000, ffff888101e000c8) [ 17.612067] [ 17.612336] The buggy address belongs to the physical page: [ 17.612691] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e00 [ 17.613545] flags: 0x200000000000000(node=0|zone=2) [ 17.613861] page_type: f5(slab) [ 17.614185] raw: 0200000000000000 ffff88810166da00 dead000000000122 0000000000000000 [ 17.614494] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 17.615732] page dumped because: kasan: bad access detected [ 17.616416] [ 17.616543] Memory state around the buggy address: [ 17.617369] ffff888101dfff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.617784] ffff888101dfff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.618275] >ffff888101e00000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.618779] ^ [ 17.619338] ffff888101e00080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 17.619669] ffff888101e00100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.620424] ==================================================================