Date
June 26, 2025, 11:12 a.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 37.415422] ================================================================== [ 37.416392] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 37.423075] Read of size 1 at addr ffff000803330000 by task kunit_try_catch/282 [ 37.430364] [ 37.431852] CPU: 7 UID: 0 PID: 282 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc3 #1 PREEMPT [ 37.431911] Tainted: [B]=BAD_PAGE, [N]=TEST [ 37.431927] Hardware name: WinLink E850-96 board (DT) [ 37.431948] Call trace: [ 37.431961] show_stack+0x20/0x38 (C) [ 37.432001] dump_stack_lvl+0x8c/0xd0 [ 37.432040] print_report+0x118/0x608 [ 37.432074] kasan_report+0xdc/0x128 [ 37.432105] __asan_report_load1_noabort+0x20/0x30 [ 37.432146] mempool_uaf_helper+0x314/0x340 [ 37.432181] mempool_page_alloc_uaf+0xc0/0x118 [ 37.432214] kunit_try_run_case+0x170/0x3f0 [ 37.432253] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.432295] kthread+0x328/0x630 [ 37.432330] ret_from_fork+0x10/0x20 [ 37.432367] [ 37.499115] The buggy address belongs to the physical page: [ 37.504673] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883330 [ 37.512658] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.519178] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 37.526897] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 37.534616] page dumped because: kasan: bad access detected [ 37.540173] [ 37.541648] Memory state around the buggy address: [ 37.546428] ffff00080332ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.553630] ffff00080332ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.560836] >ffff000803330000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.568036] ^ [ 37.571251] ffff000803330080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.578456] ffff000803330100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.585658] ================================================================== [ 36.853326] ================================================================== [ 36.862407] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 36.869091] Read of size 1 at addr ffff000803330000 by task kunit_try_catch/278 [ 36.876379] [ 36.877866] CPU: 7 UID: 0 PID: 278 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc3 #1 PREEMPT [ 36.877924] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.877940] Hardware name: WinLink E850-96 board (DT) [ 36.877964] Call trace: [ 36.877978] show_stack+0x20/0x38 (C) [ 36.878012] dump_stack_lvl+0x8c/0xd0 [ 36.878053] print_report+0x118/0x608 [ 36.878085] kasan_report+0xdc/0x128 [ 36.878114] __asan_report_load1_noabort+0x20/0x30 [ 36.878151] mempool_uaf_helper+0x314/0x340 [ 36.878184] mempool_kmalloc_large_uaf+0xc4/0x120 [ 36.878224] kunit_try_run_case+0x170/0x3f0 [ 36.878262] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.878301] kthread+0x328/0x630 [ 36.878337] ret_from_fork+0x10/0x20 [ 36.878374] [ 36.945393] The buggy address belongs to the physical page: [ 36.950949] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883330 [ 36.958934] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.966573] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.973515] page_type: f8(unknown) [ 36.976914] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.984630] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 36.992357] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 37.000169] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 37.007982] head: 0bfffe0000000002 fffffdffe00ccc01 00000000ffffffff 00000000ffffffff [ 37.015794] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 37.023599] page dumped because: kasan: bad access detected [ 37.029156] [ 37.030630] Memory state around the buggy address: [ 37.035411] ffff00080332ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.042614] ffff00080332ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.049819] >ffff000803330000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.057019] ^ [ 37.060235] ffff000803330080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.067439] ffff000803330100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.074641] ==================================================================
[ 20.017196] ================================================================== [ 20.017263] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 20.017322] Read of size 1 at addr fff00000c7a88000 by task kunit_try_catch/231 [ 20.017372] [ 20.017407] CPU: 0 UID: 0 PID: 231 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc3 #1 PREEMPT [ 20.018032] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.018078] Hardware name: linux,dummy-virt (DT) [ 20.018161] Call trace: [ 20.018188] show_stack+0x20/0x38 (C) [ 20.018599] dump_stack_lvl+0x8c/0xd0 [ 20.018792] print_report+0x118/0x608 [ 20.018920] kasan_report+0xdc/0x128 [ 20.019187] __asan_report_load1_noabort+0x20/0x30 [ 20.019293] mempool_uaf_helper+0x314/0x340 [ 20.019549] mempool_kmalloc_large_uaf+0xc4/0x120 [ 20.019641] kunit_try_run_case+0x170/0x3f0 [ 20.019745] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.019798] kthread+0x328/0x630 [ 20.019843] ret_from_fork+0x10/0x20 [ 20.020139] [ 20.020167] The buggy address belongs to the physical page: [ 20.020246] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107a88 [ 20.020307] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.020354] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 20.020410] page_type: f8(unknown) [ 20.020451] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.020504] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.020556] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.020607] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.020659] head: 0bfffe0000000002 ffffc1ffc31ea201 00000000ffffffff 00000000ffffffff [ 20.020710] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.020752] page dumped because: kasan: bad access detected [ 20.020784] [ 20.020802] Memory state around the buggy address: [ 20.020834] fff00000c7a87f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.020890] fff00000c7a87f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.021107] >fff00000c7a88000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.021148] ^ [ 20.021241] fff00000c7a88080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.021286] fff00000c7a88100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.021652] ================================================================== [ 20.102701] ================================================================== [ 20.102772] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 20.102838] Read of size 1 at addr fff00000c795c000 by task kunit_try_catch/235 [ 20.102910] [ 20.102946] CPU: 1 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc3 #1 PREEMPT [ 20.103035] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.103064] Hardware name: linux,dummy-virt (DT) [ 20.103099] Call trace: [ 20.103121] show_stack+0x20/0x38 (C) [ 20.103176] dump_stack_lvl+0x8c/0xd0 [ 20.103227] print_report+0x118/0x608 [ 20.103273] kasan_report+0xdc/0x128 [ 20.103317] __asan_report_load1_noabort+0x20/0x30 [ 20.103367] mempool_uaf_helper+0x314/0x340 [ 20.103416] mempool_page_alloc_uaf+0xc0/0x118 [ 20.103462] kunit_try_run_case+0x170/0x3f0 [ 20.103513] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.103567] kthread+0x328/0x630 [ 20.103614] ret_from_fork+0x10/0x20 [ 20.103664] [ 20.103684] The buggy address belongs to the physical page: [ 20.103718] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10795c [ 20.103772] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.103840] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 20.103938] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 20.103999] page dumped because: kasan: bad access detected [ 20.104033] [ 20.104051] Memory state around the buggy address: [ 20.104090] fff00000c795bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.104135] fff00000c795bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.104181] >fff00000c795c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.104222] ^ [ 20.104251] fff00000c795c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.104295] fff00000c795c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.104336] ==================================================================
[ 12.551230] ================================================================== [ 12.551696] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 12.552062] Read of size 1 at addr ffff888103a04000 by task kunit_try_catch/252 [ 12.552558] [ 12.552782] CPU: 0 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc3 #1 PREEMPT(voluntary) [ 12.552837] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.552992] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.553019] Call Trace: [ 12.553031] <TASK> [ 12.553050] dump_stack_lvl+0x73/0xb0 [ 12.553082] print_report+0xd1/0x650 [ 12.553105] ? __virt_addr_valid+0x1db/0x2d0 [ 12.553127] ? mempool_uaf_helper+0x392/0x400 [ 12.553150] ? kasan_addr_to_slab+0x11/0xa0 [ 12.553170] ? mempool_uaf_helper+0x392/0x400 [ 12.553193] kasan_report+0x141/0x180 [ 12.553226] ? mempool_uaf_helper+0x392/0x400 [ 12.553253] __asan_report_load1_noabort+0x18/0x20 [ 12.553286] mempool_uaf_helper+0x392/0x400 [ 12.553308] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 12.553331] ? dequeue_entities+0x852/0x1740 [ 12.553356] ? finish_task_switch.isra.0+0x153/0x700 [ 12.553384] mempool_page_alloc_uaf+0xed/0x140 [ 12.553404] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 12.553423] ? dequeue_task_fair+0x166/0x4e0 [ 12.553445] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 12.553468] ? __pfx_mempool_free_pages+0x10/0x10 [ 12.553499] ? __pfx_read_tsc+0x10/0x10 [ 12.553520] ? ktime_get_ts64+0x86/0x230 [ 12.553546] kunit_try_run_case+0x1a5/0x480 [ 12.553582] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.553604] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.553629] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.553651] ? __kthread_parkme+0x82/0x180 [ 12.553674] ? preempt_count_sub+0x50/0x80 [ 12.553699] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.553723] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.553834] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.553860] kthread+0x337/0x6f0 [ 12.553877] ? trace_preempt_on+0x20/0xc0 [ 12.553901] ? __pfx_kthread+0x10/0x10 [ 12.553929] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.553952] ? calculate_sigpending+0x7b/0xa0 [ 12.553974] ? __pfx_kthread+0x10/0x10 [ 12.553993] ret_from_fork+0x41/0x80 [ 12.554014] ? __pfx_kthread+0x10/0x10 [ 12.554032] ret_from_fork_asm+0x1a/0x30 [ 12.554063] </TASK> [ 12.554075] [ 12.563052] The buggy address belongs to the physical page: [ 12.563334] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a04 [ 12.563995] flags: 0x200000000000000(node=0|zone=2) [ 12.564476] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 12.565060] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 12.565490] page dumped because: kasan: bad access detected [ 12.565778] [ 12.566021] Memory state around the buggy address: [ 12.566257] ffff888103a03f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.566591] ffff888103a03f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.566812] >ffff888103a04000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.567157] ^ [ 12.567323] ffff888103a04080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.567563] ffff888103a04100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.568010] ================================================================== [ 12.490876] ================================================================== [ 12.491549] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 12.491894] Read of size 1 at addr ffff888102f7c000 by task kunit_try_catch/248 [ 12.492236] [ 12.492362] CPU: 1 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc3 #1 PREEMPT(voluntary) [ 12.492414] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.492426] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.492449] Call Trace: [ 12.492462] <TASK> [ 12.492537] dump_stack_lvl+0x73/0xb0 [ 12.492624] print_report+0xd1/0x650 [ 12.492649] ? __virt_addr_valid+0x1db/0x2d0 [ 12.492673] ? mempool_uaf_helper+0x392/0x400 [ 12.492696] ? kasan_addr_to_slab+0x11/0xa0 [ 12.492877] ? mempool_uaf_helper+0x392/0x400 [ 12.492909] kasan_report+0x141/0x180 [ 12.493235] ? mempool_uaf_helper+0x392/0x400 [ 12.493267] __asan_report_load1_noabort+0x18/0x20 [ 12.493288] mempool_uaf_helper+0x392/0x400 [ 12.493311] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 12.493333] ? dequeue_entities+0x852/0x1740 [ 12.493359] ? finish_task_switch.isra.0+0x153/0x700 [ 12.493387] mempool_kmalloc_large_uaf+0xef/0x140 [ 12.493411] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 12.493434] ? dequeue_task_fair+0x166/0x4e0 [ 12.493456] ? __pfx_mempool_kmalloc+0x10/0x10 [ 12.493478] ? __pfx_mempool_kfree+0x10/0x10 [ 12.493499] ? __pfx_read_tsc+0x10/0x10 [ 12.493520] ? ktime_get_ts64+0x86/0x230 [ 12.493546] kunit_try_run_case+0x1a5/0x480 [ 12.493612] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.493635] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.493674] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.493698] ? __kthread_parkme+0x82/0x180 [ 12.493795] ? preempt_count_sub+0x50/0x80 [ 12.493826] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.493851] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.493876] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.493899] kthread+0x337/0x6f0 [ 12.493928] ? trace_preempt_on+0x20/0xc0 [ 12.493953] ? __pfx_kthread+0x10/0x10 [ 12.493971] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.493992] ? calculate_sigpending+0x7b/0xa0 [ 12.494014] ? __pfx_kthread+0x10/0x10 [ 12.494032] ret_from_fork+0x41/0x80 [ 12.494054] ? __pfx_kthread+0x10/0x10 [ 12.494071] ret_from_fork_asm+0x1a/0x30 [ 12.494103] </TASK> [ 12.494115] [ 12.503778] The buggy address belongs to the physical page: [ 12.504208] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102f7c [ 12.504699] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.504989] flags: 0x200000000000040(head|node=0|zone=2) [ 12.505174] page_type: f8(unknown) [ 12.505611] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 12.506004] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 12.506655] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 12.507054] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 12.507352] head: 0200000000000002 ffffea00040bdf01 00000000ffffffff 00000000ffffffff [ 12.507808] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 12.508238] page dumped because: kasan: bad access detected [ 12.508500] [ 12.508630] Memory state around the buggy address: [ 12.509068] ffff888102f7bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.509402] ffff888102f7bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.509798] >ffff888102f7c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.510072] ^ [ 12.510311] ffff888102f7c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.510613] ffff888102f7c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.511081] ==================================================================