Date
June 2, 2025, 2:11 p.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.737221] ================================================================== [ 34.746745] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 34.753425] Read of size 1 at addr ffff000803244000 by task kunit_try_catch/276 [ 34.760716] [ 34.762203] CPU: 6 UID: 0 PID: 276 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT [ 34.762252] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.762269] Hardware name: WinLink E850-96 board (DT) [ 34.762291] Call trace: [ 34.762306] show_stack+0x20/0x38 (C) [ 34.762340] dump_stack_lvl+0x8c/0xd0 [ 34.762375] print_report+0x118/0x608 [ 34.762404] kasan_report+0xdc/0x128 [ 34.762432] __asan_report_load1_noabort+0x20/0x30 [ 34.762466] mempool_uaf_helper+0x314/0x340 [ 34.762500] mempool_kmalloc_large_uaf+0xc4/0x120 [ 34.762537] kunit_try_run_case+0x170/0x3f0 [ 34.762574] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.762613] kthread+0x328/0x630 [ 34.762647] ret_from_fork+0x10/0x20 [ 34.762682] [ 34.829730] The buggy address belongs to the physical page: [ 34.835286] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883244 [ 34.843271] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.850910] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.857850] page_type: f8(unknown) [ 34.861248] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 34.868968] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 34.876694] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 34.884505] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 34.892318] head: 0bfffe0000000002 fffffdffe00c9101 00000000ffffffff 00000000ffffffff [ 34.900130] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 34.907936] page dumped because: kasan: bad access detected [ 34.913492] [ 34.914967] Memory state around the buggy address: [ 34.919748] ffff000803243f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 34.926950] ffff000803243f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 34.934156] >ffff000803244000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 34.941356] ^ [ 34.944571] ffff000803244080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 34.951775] ffff000803244100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 34.958979] ================================================================== [ 35.297251] ================================================================== [ 35.300729] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 35.307412] Read of size 1 at addr ffff000803270000 by task kunit_try_catch/280 [ 35.314702] [ 35.316188] CPU: 7 UID: 0 PID: 280 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT [ 35.316243] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.316256] Hardware name: WinLink E850-96 board (DT) [ 35.316277] Call trace: [ 35.316293] show_stack+0x20/0x38 (C) [ 35.316331] dump_stack_lvl+0x8c/0xd0 [ 35.316362] print_report+0x118/0x608 [ 35.316394] kasan_report+0xdc/0x128 [ 35.316426] __asan_report_load1_noabort+0x20/0x30 [ 35.316460] mempool_uaf_helper+0x314/0x340 [ 35.316491] mempool_page_alloc_uaf+0xc0/0x118 [ 35.316523] kunit_try_run_case+0x170/0x3f0 [ 35.316560] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.316599] kthread+0x328/0x630 [ 35.316634] ret_from_fork+0x10/0x20 [ 35.316670] [ 35.383455] The buggy address belongs to the physical page: [ 35.389011] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883270 [ 35.396995] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 35.403518] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 35.411234] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 35.418954] page dumped because: kasan: bad access detected [ 35.424508] [ 35.425984] Memory state around the buggy address: [ 35.430766] ffff00080326ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.437967] ffff00080326ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.445171] >ffff000803270000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.452373] ^ [ 35.455588] ffff000803270080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.462793] ffff000803270100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.469996] ==================================================================
[ 20.532863] ================================================================== [ 20.532927] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 20.533028] Read of size 1 at addr fff00000c65c0000 by task kunit_try_catch/236 [ 20.533085] [ 20.533124] CPU: 0 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G B W N 6.15.1-rc1 #1 PREEMPT [ 20.533214] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 20.533272] Hardware name: linux,dummy-virt (DT) [ 20.533305] Call trace: [ 20.533329] show_stack+0x20/0x38 (C) [ 20.533397] dump_stack_lvl+0x8c/0xd0 [ 20.533447] print_report+0x118/0x608 [ 20.533494] kasan_report+0xdc/0x128 [ 20.533547] __asan_report_load1_noabort+0x20/0x30 [ 20.533599] mempool_uaf_helper+0x314/0x340 [ 20.533702] mempool_page_alloc_uaf+0xc0/0x118 [ 20.533827] kunit_try_run_case+0x170/0x3f0 [ 20.533997] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.534087] kthread+0x328/0x630 [ 20.534196] ret_from_fork+0x10/0x20 [ 20.534246] [ 20.534269] The buggy address belongs to the physical page: [ 20.534574] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065c0 [ 20.534631] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.534696] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 20.534789] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 20.534880] page dumped because: kasan: bad access detected [ 20.534945] [ 20.534964] Memory state around the buggy address: [ 20.535019] fff00000c65bff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.535103] fff00000c65bff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.535241] >fff00000c65c0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.535358] ^ [ 20.535422] fff00000c65c0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.535478] fff00000c65c0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.535829] ================================================================== [ 20.497502] ================================================================== [ 20.497585] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 20.497648] Read of size 1 at addr fff00000c65c0000 by task kunit_try_catch/232 [ 20.497697] [ 20.497730] CPU: 0 UID: 0 PID: 232 Comm: kunit_try_catch Tainted: G B W N 6.15.1-rc1 #1 PREEMPT [ 20.497866] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 20.497964] Hardware name: linux,dummy-virt (DT) [ 20.497998] Call trace: [ 20.498070] show_stack+0x20/0x38 (C) [ 20.498217] dump_stack_lvl+0x8c/0xd0 [ 20.498395] print_report+0x118/0x608 [ 20.498495] kasan_report+0xdc/0x128 [ 20.498641] __asan_report_load1_noabort+0x20/0x30 [ 20.498754] mempool_uaf_helper+0x314/0x340 [ 20.498807] mempool_kmalloc_large_uaf+0xc4/0x120 [ 20.499006] kunit_try_run_case+0x170/0x3f0 [ 20.499065] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.499123] kthread+0x328/0x630 [ 20.499255] ret_from_fork+0x10/0x20 [ 20.499425] [ 20.499505] The buggy address belongs to the physical page: [ 20.499625] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065c0 [ 20.499711] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.499839] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 20.499957] page_type: f8(unknown) [ 20.500103] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.500221] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.500306] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.500386] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.500496] head: 0bfffe0000000002 ffffc1ffc3197001 00000000ffffffff 00000000ffffffff [ 20.500690] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.500731] page dumped because: kasan: bad access detected [ 20.500778] [ 20.500893] Memory state around the buggy address: [ 20.500984] fff00000c65bff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.501065] fff00000c65bff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.501196] >fff00000c65c0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.501302] ^ [ 20.501390] fff00000c65c0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.501469] fff00000c65c0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.501569] ==================================================================
[ 18.401137] ================================================================== [ 18.401988] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 18.402554] Read of size 1 at addr ffff888102a98000 by task kunit_try_catch/250 [ 18.403521] [ 18.403713] CPU: 0 UID: 0 PID: 250 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT(voluntary) [ 18.403825] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.403852] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.403896] Call Trace: [ 18.403924] <TASK> [ 18.403964] dump_stack_lvl+0x73/0xb0 [ 18.404036] print_report+0xd1/0x650 [ 18.404082] ? __virt_addr_valid+0x1db/0x2d0 [ 18.404129] ? mempool_uaf_helper+0x392/0x400 [ 18.404167] ? kasan_addr_to_slab+0x11/0xa0 [ 18.404207] ? mempool_uaf_helper+0x392/0x400 [ 18.404254] kasan_report+0x141/0x180 [ 18.404343] ? mempool_uaf_helper+0x392/0x400 [ 18.404470] __asan_report_load1_noabort+0x18/0x20 [ 18.404533] mempool_uaf_helper+0x392/0x400 [ 18.404588] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 18.404641] ? dequeue_entities+0x852/0x1740 [ 18.405045] ? finish_task_switch.isra.0+0x153/0x700 [ 18.405147] mempool_kmalloc_large_uaf+0xef/0x140 [ 18.405198] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 18.405241] ? dequeue_task_fair+0x166/0x4e0 [ 18.405311] ? __pfx_mempool_kmalloc+0x10/0x10 [ 18.405357] ? __pfx_mempool_kfree+0x10/0x10 [ 18.405398] ? __pfx_read_tsc+0x10/0x10 [ 18.405424] ? ktime_get_ts64+0x86/0x230 [ 18.405457] kunit_try_run_case+0x1a5/0x480 [ 18.405488] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.405513] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.405542] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.405569] ? __kthread_parkme+0x82/0x180 [ 18.405596] ? preempt_count_sub+0x50/0x80 [ 18.405624] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.405652] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.405678] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.405704] kthread+0x337/0x6f0 [ 18.405724] ? trace_preempt_on+0x20/0xc0 [ 18.405776] ? __pfx_kthread+0x10/0x10 [ 18.405800] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.405825] ? calculate_sigpending+0x7b/0xa0 [ 18.405852] ? __pfx_kthread+0x10/0x10 [ 18.405873] ret_from_fork+0x41/0x80 [ 18.405900] ? __pfx_kthread+0x10/0x10 [ 18.405921] ret_from_fork_asm+0x1a/0x30 [ 18.405959] </TASK> [ 18.405974] [ 18.421666] The buggy address belongs to the physical page: [ 18.422134] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a98 [ 18.422961] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.423640] flags: 0x200000000000040(head|node=0|zone=2) [ 18.423987] page_type: f8(unknown) [ 18.424346] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.425510] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.425979] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.426803] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.427330] head: 0200000000000002 ffffea00040aa601 00000000ffffffff 00000000ffffffff [ 18.427775] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.428475] page dumped because: kasan: bad access detected [ 18.428807] [ 18.428996] Memory state around the buggy address: [ 18.429426] ffff888102a97f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.430192] ffff888102a97f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.430510] >ffff888102a98000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.431125] ^ [ 18.431340] ffff888102a98080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.432724] ffff888102a98100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.433003] ================================================================== [ 18.505715] ================================================================== [ 18.506500] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 18.507381] Read of size 1 at addr ffff888103a18000 by task kunit_try_catch/254 [ 18.508663] [ 18.509055] CPU: 1 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT(voluntary) [ 18.509345] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.509371] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.509401] Call Trace: [ 18.509423] <TASK> [ 18.509451] dump_stack_lvl+0x73/0xb0 [ 18.509505] print_report+0xd1/0x650 [ 18.509533] ? __virt_addr_valid+0x1db/0x2d0 [ 18.509560] ? mempool_uaf_helper+0x392/0x400 [ 18.509585] ? kasan_addr_to_slab+0x11/0xa0 [ 18.509608] ? mempool_uaf_helper+0x392/0x400 [ 18.509632] kasan_report+0x141/0x180 [ 18.509657] ? mempool_uaf_helper+0x392/0x400 [ 18.509687] __asan_report_load1_noabort+0x18/0x20 [ 18.509711] mempool_uaf_helper+0x392/0x400 [ 18.509736] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 18.509799] ? finish_task_switch.isra.0+0x153/0x700 [ 18.509860] mempool_page_alloc_uaf+0xed/0x140 [ 18.509909] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 18.509957] ? dequeue_task_fair+0x156/0x4e0 [ 18.510012] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 18.510065] ? __pfx_mempool_free_pages+0x10/0x10 [ 18.510114] ? __pfx_read_tsc+0x10/0x10 [ 18.510157] ? ktime_get_ts64+0x86/0x230 [ 18.510221] kunit_try_run_case+0x1a5/0x480 [ 18.510269] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.510309] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.510350] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.510376] ? __kthread_parkme+0x82/0x180 [ 18.510401] ? preempt_count_sub+0x50/0x80 [ 18.510428] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.510454] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.510479] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.510503] kthread+0x337/0x6f0 [ 18.510522] ? trace_preempt_on+0x20/0xc0 [ 18.510548] ? __pfx_kthread+0x10/0x10 [ 18.510569] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.510591] ? calculate_sigpending+0x7b/0xa0 [ 18.510619] ? __pfx_kthread+0x10/0x10 [ 18.510639] ret_from_fork+0x41/0x80 [ 18.510662] ? __pfx_kthread+0x10/0x10 [ 18.510682] ret_from_fork_asm+0x1a/0x30 [ 18.510718] </TASK> [ 18.510732] [ 18.525316] The buggy address belongs to the physical page: [ 18.526140] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a18 [ 18.527611] flags: 0x200000000000000(node=0|zone=2) [ 18.527962] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 18.528664] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 18.529332] page dumped because: kasan: bad access detected [ 18.529711] [ 18.529853] Memory state around the buggy address: [ 18.530879] ffff888103a17f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.531229] ffff888103a17f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.531723] >ffff888103a18000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.532140] ^ [ 18.532451] ffff888103a18080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.532848] ffff888103a18100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.533618] ==================================================================