Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 23.060785] ================================================================== [ 23.060944] BUG: KASAN: slab-use-after-free in ksize_uaf+0x598/0x5f8 [ 23.061088] Read of size 1 at addr fff00000c76c5300 by task kunit_try_catch/200 [ 23.061200] [ 23.061280] CPU: 1 UID: 0 PID: 200 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT [ 23.061482] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.061542] Hardware name: linux,dummy-virt (DT) [ 23.061603] Call trace: [ 23.061651] show_stack+0x20/0x38 (C) [ 23.061765] dump_stack_lvl+0x8c/0xd0 [ 23.061878] print_report+0x118/0x608 [ 23.062639] kasan_report+0xdc/0x128 [ 23.063114] __asan_report_load1_noabort+0x20/0x30 [ 23.063382] ksize_uaf+0x598/0x5f8 [ 23.065255] kunit_try_run_case+0x170/0x3f0 [ 23.066091] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.066220] kthread+0x328/0x630 [ 23.066329] ret_from_fork+0x10/0x20 [ 23.067394] [ 23.067932] Allocated by task 200: [ 23.068021] kasan_save_stack+0x3c/0x68 [ 23.068120] kasan_save_track+0x20/0x40 [ 23.068195] kasan_save_alloc_info+0x40/0x58 [ 23.068269] __kasan_kmalloc+0xd4/0xd8 [ 23.068337] __kmalloc_cache_noprof+0x16c/0x3c0 [ 23.068442] ksize_uaf+0xb8/0x5f8 [ 23.068516] kunit_try_run_case+0x170/0x3f0 [ 23.068601] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.068701] kthread+0x328/0x630 [ 23.068781] ret_from_fork+0x10/0x20 [ 23.068858] [ 23.068895] Freed by task 200: [ 23.068957] kasan_save_stack+0x3c/0x68 [ 23.069043] kasan_save_track+0x20/0x40 [ 23.069132] kasan_save_free_info+0x4c/0x78 [ 23.069231] __kasan_slab_free+0x6c/0x98 [ 23.069326] kfree+0x214/0x3c8 [ 23.069414] ksize_uaf+0x11c/0x5f8 [ 23.069505] kunit_try_run_case+0x170/0x3f0 [ 23.070181] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.070367] kthread+0x328/0x630 [ 23.070541] ret_from_fork+0x10/0x20 [ 23.070631] [ 23.070683] The buggy address belongs to the object at fff00000c76c5300 [ 23.070683] which belongs to the cache kmalloc-128 of size 128 [ 23.070841] The buggy address is located 0 bytes inside of [ 23.070841] freed 128-byte region [fff00000c76c5300, fff00000c76c5380) [ 23.071645] [ 23.071770] The buggy address belongs to the physical page: [ 23.071864] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c5 [ 23.072054] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 23.072235] page_type: f5(slab) [ 23.072368] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 23.072641] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.072821] page dumped because: kasan: bad access detected [ 23.072930] [ 23.073348] Memory state around the buggy address: [ 23.073922] fff00000c76c5200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.074323] fff00000c76c5280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.074877] >fff00000c76c5300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.074983] ^ [ 23.075062] fff00000c76c5380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.075115] fff00000c76c5400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.075158] ================================================================== [ 23.077606] ================================================================== [ 23.077857] BUG: KASAN: slab-use-after-free in ksize_uaf+0x544/0x5f8 [ 23.078001] Read of size 1 at addr fff00000c76c5378 by task kunit_try_catch/200 [ 23.078125] [ 23.078446] CPU: 1 UID: 0 PID: 200 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT [ 23.078737] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.078895] Hardware name: linux,dummy-virt (DT) [ 23.079179] Call trace: [ 23.079261] show_stack+0x20/0x38 (C) [ 23.079578] dump_stack_lvl+0x8c/0xd0 [ 23.079766] print_report+0x118/0x608 [ 23.079924] kasan_report+0xdc/0x128 [ 23.080074] __asan_report_load1_noabort+0x20/0x30 [ 23.080194] ksize_uaf+0x544/0x5f8 [ 23.080305] kunit_try_run_case+0x170/0x3f0 [ 23.080445] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.080645] kthread+0x328/0x630 [ 23.080753] ret_from_fork+0x10/0x20 [ 23.080869] [ 23.080911] Allocated by task 200: [ 23.080981] kasan_save_stack+0x3c/0x68 [ 23.081084] kasan_save_track+0x20/0x40 [ 23.081206] kasan_save_alloc_info+0x40/0x58 [ 23.081336] __kasan_kmalloc+0xd4/0xd8 [ 23.081763] __kmalloc_cache_noprof+0x16c/0x3c0 [ 23.082232] ksize_uaf+0xb8/0x5f8 [ 23.082453] kunit_try_run_case+0x170/0x3f0 [ 23.082575] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.082710] kthread+0x328/0x630 [ 23.082798] ret_from_fork+0x10/0x20 [ 23.082893] [ 23.082951] Freed by task 200: [ 23.083018] kasan_save_stack+0x3c/0x68 [ 23.083163] kasan_save_track+0x20/0x40 [ 23.083266] kasan_save_free_info+0x4c/0x78 [ 23.083352] __kasan_slab_free+0x6c/0x98 [ 23.083455] kfree+0x214/0x3c8 [ 23.083526] ksize_uaf+0x11c/0x5f8 [ 23.083604] kunit_try_run_case+0x170/0x3f0 [ 23.083728] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.083887] kthread+0x328/0x630 [ 23.083983] ret_from_fork+0x10/0x20 [ 23.084168] [ 23.084232] The buggy address belongs to the object at fff00000c76c5300 [ 23.084232] which belongs to the cache kmalloc-128 of size 128 [ 23.084486] The buggy address is located 120 bytes inside of [ 23.084486] freed 128-byte region [fff00000c76c5300, fff00000c76c5380) [ 23.084676] [ 23.084727] The buggy address belongs to the physical page: [ 23.084807] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c5 [ 23.084929] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 23.085173] page_type: f5(slab) [ 23.085255] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 23.085368] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.085512] page dumped because: kasan: bad access detected [ 23.085600] [ 23.085640] Memory state around the buggy address: [ 23.085741] fff00000c76c5200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.085882] fff00000c76c5280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.085983] >fff00000c76c5300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.086073] ^ [ 23.086236] fff00000c76c5380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.086413] fff00000c76c5400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.086524] ================================================================== [ 23.044230] ================================================================== [ 23.044741] BUG: KASAN: slab-use-after-free in ksize_uaf+0x168/0x5f8 [ 23.044965] Read of size 1 at addr fff00000c76c5300 by task kunit_try_catch/200 [ 23.045275] [ 23.045553] CPU: 1 UID: 0 PID: 200 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT [ 23.046218] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.046466] Hardware name: linux,dummy-virt (DT) [ 23.046568] Call trace: [ 23.046633] show_stack+0x20/0x38 (C) [ 23.046782] dump_stack_lvl+0x8c/0xd0 [ 23.047362] print_report+0x118/0x608 [ 23.047635] kasan_report+0xdc/0x128 [ 23.047744] __kasan_check_byte+0x54/0x70 [ 23.047835] ksize+0x30/0x88 [ 23.047917] ksize_uaf+0x168/0x5f8 [ 23.048022] kunit_try_run_case+0x170/0x3f0 [ 23.048189] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.048374] kthread+0x328/0x630 [ 23.048509] ret_from_fork+0x10/0x20 [ 23.048643] [ 23.048693] Allocated by task 200: [ 23.048769] kasan_save_stack+0x3c/0x68 [ 23.048875] kasan_save_track+0x20/0x40 [ 23.048967] kasan_save_alloc_info+0x40/0x58 [ 23.049068] __kasan_kmalloc+0xd4/0xd8 [ 23.049161] __kmalloc_cache_noprof+0x16c/0x3c0 [ 23.049270] ksize_uaf+0xb8/0x5f8 [ 23.049790] kunit_try_run_case+0x170/0x3f0 [ 23.050225] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.050488] kthread+0x328/0x630 [ 23.050668] ret_from_fork+0x10/0x20 [ 23.050900] [ 23.051074] Freed by task 200: [ 23.051182] kasan_save_stack+0x3c/0x68 [ 23.051555] kasan_save_track+0x20/0x40 [ 23.051652] kasan_save_free_info+0x4c/0x78 [ 23.051740] __kasan_slab_free+0x6c/0x98 [ 23.051831] kfree+0x214/0x3c8 [ 23.051902] ksize_uaf+0x11c/0x5f8 [ 23.051973] kunit_try_run_case+0x170/0x3f0 [ 23.052062] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.052158] kthread+0x328/0x630 [ 23.052236] ret_from_fork+0x10/0x20 [ 23.052311] [ 23.052352] The buggy address belongs to the object at fff00000c76c5300 [ 23.052352] which belongs to the cache kmalloc-128 of size 128 [ 23.052487] The buggy address is located 0 bytes inside of [ 23.052487] freed 128-byte region [fff00000c76c5300, fff00000c76c5380) [ 23.052613] [ 23.052662] The buggy address belongs to the physical page: [ 23.052729] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c5 [ 23.052845] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 23.052963] page_type: f5(slab) [ 23.053058] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 23.053180] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.053279] page dumped because: kasan: bad access detected [ 23.053352] [ 23.053391] Memory state around the buggy address: [ 23.053594] fff00000c76c5200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.054012] fff00000c76c5280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.054311] >fff00000c76c5300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.054680] ^ [ 23.054854] fff00000c76c5380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.054963] fff00000c76c5400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.055045] ==================================================================
[ 14.372255] ================================================================== [ 14.372669] BUG: KASAN: slab-use-after-free in ksize_uaf+0x5e4/0x6c0 [ 14.372979] Read of size 1 at addr ffff888102d90f78 by task kunit_try_catch/216 [ 14.373457] [ 14.374052] CPU: 1 UID: 0 PID: 216 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT(voluntary) [ 14.374154] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.374176] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.374198] Call Trace: [ 14.374215] <TASK> [ 14.374235] dump_stack_lvl+0x73/0xb0 [ 14.374271] print_report+0xd1/0x650 [ 14.374294] ? __virt_addr_valid+0x1db/0x2d0 [ 14.374326] ? ksize_uaf+0x5e4/0x6c0 [ 14.374358] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.374398] ? ksize_uaf+0x5e4/0x6c0 [ 14.374436] kasan_report+0x141/0x180 [ 14.374479] ? ksize_uaf+0x5e4/0x6c0 [ 14.374526] __asan_report_load1_noabort+0x18/0x20 [ 14.374621] ksize_uaf+0x5e4/0x6c0 [ 14.374659] ? __pfx_ksize_uaf+0x10/0x10 [ 14.374705] ? __schedule+0x10cc/0x2b30 [ 14.374740] ? __pfx_read_tsc+0x10/0x10 [ 14.374792] ? ktime_get_ts64+0x86/0x230 [ 14.374839] kunit_try_run_case+0x1a5/0x480 [ 14.374880] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.374920] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.374966] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.375010] ? __kthread_parkme+0x82/0x180 [ 14.375054] ? preempt_count_sub+0x50/0x80 [ 14.375109] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.375169] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.375222] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.375269] kthread+0x337/0x6f0 [ 14.375302] ? trace_preempt_on+0x20/0xc0 [ 14.375331] ? __pfx_kthread+0x10/0x10 [ 14.375349] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.375369] ? calculate_sigpending+0x7b/0xa0 [ 14.375389] ? __pfx_kthread+0x10/0x10 [ 14.375407] ret_from_fork+0x41/0x80 [ 14.375426] ? __pfx_kthread+0x10/0x10 [ 14.375444] ret_from_fork_asm+0x1a/0x30 [ 14.375471] </TASK> [ 14.375485] [ 14.386514] Allocated by task 216: [ 14.387065] kasan_save_stack+0x45/0x70 [ 14.387472] kasan_save_track+0x18/0x40 [ 14.388000] kasan_save_alloc_info+0x3b/0x50 [ 14.388389] __kasan_kmalloc+0xb7/0xc0 [ 14.388635] __kmalloc_cache_noprof+0x189/0x420 [ 14.389017] ksize_uaf+0xaa/0x6c0 [ 14.389188] kunit_try_run_case+0x1a5/0x480 [ 14.389381] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.389603] kthread+0x337/0x6f0 [ 14.389763] ret_from_fork+0x41/0x80 [ 14.389937] ret_from_fork_asm+0x1a/0x30 [ 14.390228] [ 14.390963] Freed by task 216: [ 14.391321] kasan_save_stack+0x45/0x70 [ 14.391910] kasan_save_track+0x18/0x40 [ 14.392273] kasan_save_free_info+0x3f/0x60 [ 14.392603] __kasan_slab_free+0x56/0x70 [ 14.393067] kfree+0x222/0x3f0 [ 14.393352] ksize_uaf+0x12c/0x6c0 [ 14.393783] kunit_try_run_case+0x1a5/0x480 [ 14.394129] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.394442] kthread+0x337/0x6f0 [ 14.394832] ret_from_fork+0x41/0x80 [ 14.395174] ret_from_fork_asm+0x1a/0x30 [ 14.395962] [ 14.396318] The buggy address belongs to the object at ffff888102d90f00 [ 14.396318] which belongs to the cache kmalloc-128 of size 128 [ 14.397307] The buggy address is located 120 bytes inside of [ 14.397307] freed 128-byte region [ffff888102d90f00, ffff888102d90f80) [ 14.398053] [ 14.398351] The buggy address belongs to the physical page: [ 14.398661] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102d90 [ 14.398961] flags: 0x200000000000000(node=0|zone=2) [ 14.399190] page_type: f5(slab) [ 14.399462] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.400446] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 14.401930] page dumped because: kasan: bad access detected [ 14.402344] [ 14.402498] Memory state around the buggy address: [ 14.403191] ffff888102d90e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.403624] ffff888102d90e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.404234] >ffff888102d90f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.404527] ^ [ 14.405582] ffff888102d90f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.406301] ffff888102d91000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.406849] ================================================================== [ 14.301035] ================================================================== [ 14.301480] BUG: KASAN: slab-use-after-free in ksize_uaf+0x19d/0x6c0 [ 14.302529] Read of size 1 at addr ffff888102d90f00 by task kunit_try_catch/216 [ 14.302951] [ 14.303370] CPU: 1 UID: 0 PID: 216 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT(voluntary) [ 14.303490] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.303517] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.303590] Call Trace: [ 14.303620] <TASK> [ 14.304088] dump_stack_lvl+0x73/0xb0 [ 14.304139] print_report+0xd1/0x650 [ 14.304165] ? __virt_addr_valid+0x1db/0x2d0 [ 14.304187] ? ksize_uaf+0x19d/0x6c0 [ 14.304206] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.304226] ? ksize_uaf+0x19d/0x6c0 [ 14.304246] kasan_report+0x141/0x180 [ 14.304267] ? ksize_uaf+0x19d/0x6c0 [ 14.304288] ? ksize_uaf+0x19d/0x6c0 [ 14.304307] __kasan_check_byte+0x3d/0x50 [ 14.304328] ksize+0x20/0x60 [ 14.304349] ksize_uaf+0x19d/0x6c0 [ 14.304369] ? __pfx_ksize_uaf+0x10/0x10 [ 14.304388] ? __schedule+0x10cc/0x2b30 [ 14.304409] ? __pfx_read_tsc+0x10/0x10 [ 14.304429] ? ktime_get_ts64+0x86/0x230 [ 14.304453] kunit_try_run_case+0x1a5/0x480 [ 14.304477] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.304498] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.304520] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.304540] ? __kthread_parkme+0x82/0x180 [ 14.304584] ? preempt_count_sub+0x50/0x80 [ 14.304624] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.304659] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.304696] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.304718] kthread+0x337/0x6f0 [ 14.304734] ? trace_preempt_on+0x20/0xc0 [ 14.304757] ? __pfx_kthread+0x10/0x10 [ 14.304774] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.304793] ? calculate_sigpending+0x7b/0xa0 [ 14.304814] ? __pfx_kthread+0x10/0x10 [ 14.304831] ret_from_fork+0x41/0x80 [ 14.304850] ? __pfx_kthread+0x10/0x10 [ 14.304867] ret_from_fork_asm+0x1a/0x30 [ 14.304895] </TASK> [ 14.304909] [ 14.318502] Allocated by task 216: [ 14.319094] kasan_save_stack+0x45/0x70 [ 14.319362] kasan_save_track+0x18/0x40 [ 14.319626] kasan_save_alloc_info+0x3b/0x50 [ 14.320285] __kasan_kmalloc+0xb7/0xc0 [ 14.320464] __kmalloc_cache_noprof+0x189/0x420 [ 14.320967] ksize_uaf+0xaa/0x6c0 [ 14.321135] kunit_try_run_case+0x1a5/0x480 [ 14.321311] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.321510] kthread+0x337/0x6f0 [ 14.321808] ret_from_fork+0x41/0x80 [ 14.322110] ret_from_fork_asm+0x1a/0x30 [ 14.322861] [ 14.322992] Freed by task 216: [ 14.323186] kasan_save_stack+0x45/0x70 [ 14.323427] kasan_save_track+0x18/0x40 [ 14.323620] kasan_save_free_info+0x3f/0x60 [ 14.323775] __kasan_slab_free+0x56/0x70 [ 14.323935] kfree+0x222/0x3f0 [ 14.324063] ksize_uaf+0x12c/0x6c0 [ 14.324195] kunit_try_run_case+0x1a5/0x480 [ 14.324338] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.324508] kthread+0x337/0x6f0 [ 14.325152] ret_from_fork+0x41/0x80 [ 14.325368] ret_from_fork_asm+0x1a/0x30 [ 14.325853] [ 14.325978] The buggy address belongs to the object at ffff888102d90f00 [ 14.325978] which belongs to the cache kmalloc-128 of size 128 [ 14.326369] The buggy address is located 0 bytes inside of [ 14.326369] freed 128-byte region [ffff888102d90f00, ffff888102d90f80) [ 14.327173] [ 14.327357] The buggy address belongs to the physical page: [ 14.327842] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102d90 [ 14.328201] flags: 0x200000000000000(node=0|zone=2) [ 14.328415] page_type: f5(slab) [ 14.328591] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.329600] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 14.330279] page dumped because: kasan: bad access detected [ 14.330799] [ 14.330988] Memory state around the buggy address: [ 14.331273] ffff888102d90e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.331958] ffff888102d90e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.332343] >ffff888102d90f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.333146] ^ [ 14.333441] ffff888102d90f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.334070] ffff888102d91000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.334333] ================================================================== [ 14.335854] ================================================================== [ 14.336272] BUG: KASAN: slab-use-after-free in ksize_uaf+0x5fe/0x6c0 [ 14.337147] Read of size 1 at addr ffff888102d90f00 by task kunit_try_catch/216 [ 14.337531] [ 14.338028] CPU: 1 UID: 0 PID: 216 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT(voluntary) [ 14.338131] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.338157] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.338195] Call Trace: [ 14.338233] <TASK> [ 14.338270] dump_stack_lvl+0x73/0xb0 [ 14.338333] print_report+0xd1/0x650 [ 14.338376] ? __virt_addr_valid+0x1db/0x2d0 [ 14.338418] ? ksize_uaf+0x5fe/0x6c0 [ 14.338455] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.338490] ? ksize_uaf+0x5fe/0x6c0 [ 14.338523] kasan_report+0x141/0x180 [ 14.338573] ? ksize_uaf+0x5fe/0x6c0 [ 14.338796] __asan_report_load1_noabort+0x18/0x20 [ 14.338854] ksize_uaf+0x5fe/0x6c0 [ 14.338893] ? __pfx_ksize_uaf+0x10/0x10 [ 14.338932] ? __schedule+0x10cc/0x2b30 [ 14.338972] ? __pfx_read_tsc+0x10/0x10 [ 14.339008] ? ktime_get_ts64+0x86/0x230 [ 14.339057] kunit_try_run_case+0x1a5/0x480 [ 14.339099] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.339148] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.339197] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.339245] ? __kthread_parkme+0x82/0x180 [ 14.339288] ? preempt_count_sub+0x50/0x80 [ 14.339336] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.339385] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.339431] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.339478] kthread+0x337/0x6f0 [ 14.339513] ? trace_preempt_on+0x20/0xc0 [ 14.339556] ? __pfx_kthread+0x10/0x10 [ 14.339772] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.339834] ? calculate_sigpending+0x7b/0xa0 [ 14.339885] ? __pfx_kthread+0x10/0x10 [ 14.339929] ret_from_fork+0x41/0x80 [ 14.339975] ? __pfx_kthread+0x10/0x10 [ 14.340005] ret_from_fork_asm+0x1a/0x30 [ 14.340039] </TASK> [ 14.340055] [ 14.350821] Allocated by task 216: [ 14.351104] kasan_save_stack+0x45/0x70 [ 14.351444] kasan_save_track+0x18/0x40 [ 14.351907] kasan_save_alloc_info+0x3b/0x50 [ 14.352235] __kasan_kmalloc+0xb7/0xc0 [ 14.352534] __kmalloc_cache_noprof+0x189/0x420 [ 14.353276] ksize_uaf+0xaa/0x6c0 [ 14.353586] kunit_try_run_case+0x1a5/0x480 [ 14.354061] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.354289] kthread+0x337/0x6f0 [ 14.354545] ret_from_fork+0x41/0x80 [ 14.354997] ret_from_fork_asm+0x1a/0x30 [ 14.355264] [ 14.355392] Freed by task 216: [ 14.355828] kasan_save_stack+0x45/0x70 [ 14.356069] kasan_save_track+0x18/0x40 [ 14.356355] kasan_save_free_info+0x3f/0x60 [ 14.356584] __kasan_slab_free+0x56/0x70 [ 14.357240] kfree+0x222/0x3f0 [ 14.357512] ksize_uaf+0x12c/0x6c0 [ 14.358035] kunit_try_run_case+0x1a5/0x480 [ 14.358369] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.358767] kthread+0x337/0x6f0 [ 14.359079] ret_from_fork+0x41/0x80 [ 14.359309] ret_from_fork_asm+0x1a/0x30 [ 14.359496] [ 14.359843] The buggy address belongs to the object at ffff888102d90f00 [ 14.359843] which belongs to the cache kmalloc-128 of size 128 [ 14.360985] The buggy address is located 0 bytes inside of [ 14.360985] freed 128-byte region [ffff888102d90f00, ffff888102d90f80) [ 14.361812] [ 14.362014] The buggy address belongs to the physical page: [ 14.362293] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102d90 [ 14.362970] flags: 0x200000000000000(node=0|zone=2) [ 14.363326] page_type: f5(slab) [ 14.363567] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.364300] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 14.365125] page dumped because: kasan: bad access detected [ 14.365381] [ 14.365553] Memory state around the buggy address: [ 14.366162] ffff888102d90e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.366585] ffff888102d90e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.367264] >ffff888102d90f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.367873] ^ [ 14.368091] ffff888102d90f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.368422] ffff888102d91000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.369272] ==================================================================