Date
July 3, 2025, 3:13 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.017251] ================================================================== [ 16.017388] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8 [ 16.017516] Read of size 8 at addr fff00000c65c5580 by task kunit_try_catch/203 [ 16.017902] [ 16.018026] CPU: 1 UID: 0 PID: 203 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc1 #1 PREEMPT [ 16.018113] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.018140] Hardware name: linux,dummy-virt (DT) [ 16.018370] Call trace: [ 16.018411] show_stack+0x20/0x38 (C) [ 16.018470] dump_stack_lvl+0x8c/0xd0 [ 16.018752] print_report+0x118/0x608 [ 16.018811] kasan_report+0xdc/0x128 [ 16.018854] __asan_report_load8_noabort+0x20/0x30 [ 16.018903] workqueue_uaf+0x480/0x4a8 [ 16.019622] kunit_try_run_case+0x170/0x3f0 [ 16.019710] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.019788] kthread+0x328/0x630 [ 16.019835] ret_from_fork+0x10/0x20 [ 16.019882] [ 16.019902] Allocated by task 203: [ 16.019930] kasan_save_stack+0x3c/0x68 [ 16.019979] kasan_save_track+0x20/0x40 [ 16.020014] kasan_save_alloc_info+0x40/0x58 [ 16.020053] __kasan_kmalloc+0xd4/0xd8 [ 16.020090] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.020129] workqueue_uaf+0x13c/0x4a8 [ 16.020166] kunit_try_run_case+0x170/0x3f0 [ 16.021494] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.021728] kthread+0x328/0x630 [ 16.021770] ret_from_fork+0x10/0x20 [ 16.021807] [ 16.021826] Freed by task 51: [ 16.021854] kasan_save_stack+0x3c/0x68 [ 16.022504] kasan_save_track+0x20/0x40 [ 16.022592] kasan_save_free_info+0x4c/0x78 [ 16.022787] __kasan_slab_free+0x6c/0x98 [ 16.022838] kfree+0x214/0x3c8 [ 16.022869] workqueue_uaf_work+0x18/0x30 [ 16.022906] process_one_work+0x530/0xf98 [ 16.023538] worker_thread+0x618/0xf38 [ 16.023621] kthread+0x328/0x630 [ 16.023659] ret_from_fork+0x10/0x20 [ 16.023834] [ 16.024031] Last potentially related work creation: [ 16.024065] kasan_save_stack+0x3c/0x68 [ 16.024191] kasan_record_aux_stack+0xb4/0xc8 [ 16.024594] __queue_work+0x65c/0x1008 [ 16.024856] queue_work_on+0xbc/0xf8 [ 16.025170] workqueue_uaf+0x210/0x4a8 [ 16.025335] kunit_try_run_case+0x170/0x3f0 [ 16.025812] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.025906] kthread+0x328/0x630 [ 16.025941] ret_from_fork+0x10/0x20 [ 16.025986] [ 16.026006] The buggy address belongs to the object at fff00000c65c5580 [ 16.026006] which belongs to the cache kmalloc-32 of size 32 [ 16.026066] The buggy address is located 0 bytes inside of [ 16.026066] freed 32-byte region [fff00000c65c5580, fff00000c65c55a0) [ 16.026125] [ 16.026148] The buggy address belongs to the physical page: [ 16.026688] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065c5 [ 16.026821] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.026875] page_type: f5(slab) [ 16.027107] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 16.027666] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 16.027880] page dumped because: kasan: bad access detected [ 16.027944] [ 16.027972] Memory state around the buggy address: [ 16.028007] fff00000c65c5480: 00 00 03 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 16.028529] fff00000c65c5500: 00 00 00 fc fc fc fc fc 00 00 00 07 fc fc fc fc [ 16.028581] >fff00000c65c5580: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 16.028743] ^ [ 16.028801] fff00000c65c5600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.029227] fff00000c65c5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.029270] ==================================================================
[ 11.763898] ================================================================== [ 11.764454] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560 [ 11.764944] Read of size 8 at addr ffff888102dd0540 by task kunit_try_catch/219 [ 11.765376] [ 11.765567] CPU: 1 UID: 0 PID: 219 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc1 #1 PREEMPT(voluntary) [ 11.765613] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.765625] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.765646] Call Trace: [ 11.765659] <TASK> [ 11.765674] dump_stack_lvl+0x73/0xb0 [ 11.765699] print_report+0xd1/0x650 [ 11.765721] ? __virt_addr_valid+0x1db/0x2d0 [ 11.765742] ? workqueue_uaf+0x4d6/0x560 [ 11.765762] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.765785] ? workqueue_uaf+0x4d6/0x560 [ 11.765806] kasan_report+0x141/0x180 [ 11.765829] ? workqueue_uaf+0x4d6/0x560 [ 11.765855] __asan_report_load8_noabort+0x18/0x20 [ 11.765875] workqueue_uaf+0x4d6/0x560 [ 11.765897] ? __pfx_workqueue_uaf+0x10/0x10 [ 11.765920] ? __schedule+0x10cc/0x2b60 [ 11.765942] ? __pfx_read_tsc+0x10/0x10 [ 11.765961] ? ktime_get_ts64+0x86/0x230 [ 11.765985] kunit_try_run_case+0x1a5/0x480 [ 11.766008] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.766029] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.766052] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.766075] ? __kthread_parkme+0x82/0x180 [ 11.766096] ? preempt_count_sub+0x50/0x80 [ 11.766120] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.766143] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.766165] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.766188] kthread+0x337/0x6f0 [ 11.766204] ? trace_preempt_on+0x20/0xc0 [ 11.766227] ? __pfx_kthread+0x10/0x10 [ 11.766257] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.766302] ? calculate_sigpending+0x7b/0xa0 [ 11.766324] ? __pfx_kthread+0x10/0x10 [ 11.766342] ret_from_fork+0x41/0x80 [ 11.766362] ? __pfx_kthread+0x10/0x10 [ 11.766380] ret_from_fork_asm+0x1a/0x30 [ 11.766410] </TASK> [ 11.766420] [ 11.776087] Allocated by task 219: [ 11.776381] kasan_save_stack+0x45/0x70 [ 11.776604] kasan_save_track+0x18/0x40 [ 11.777067] kasan_save_alloc_info+0x3b/0x50 [ 11.777331] __kasan_kmalloc+0xb7/0xc0 [ 11.777630] __kmalloc_cache_noprof+0x189/0x420 [ 11.778007] workqueue_uaf+0x152/0x560 [ 11.778168] kunit_try_run_case+0x1a5/0x480 [ 11.778530] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.778910] kthread+0x337/0x6f0 [ 11.779185] ret_from_fork+0x41/0x80 [ 11.779399] ret_from_fork_asm+0x1a/0x30 [ 11.779564] [ 11.779663] Freed by task 48: [ 11.779809] kasan_save_stack+0x45/0x70 [ 11.779980] kasan_save_track+0x18/0x40 [ 11.780167] kasan_save_free_info+0x3f/0x60 [ 11.780767] __kasan_slab_free+0x56/0x70 [ 11.780965] kfree+0x222/0x3f0 [ 11.781118] workqueue_uaf_work+0x12/0x20 [ 11.781593] process_one_work+0x5ee/0xf60 [ 11.781970] worker_thread+0x758/0x1220 [ 11.782182] kthread+0x337/0x6f0 [ 11.782503] ret_from_fork+0x41/0x80 [ 11.782666] ret_from_fork_asm+0x1a/0x30 [ 11.782866] [ 11.783044] Last potentially related work creation: [ 11.783269] kasan_save_stack+0x45/0x70 [ 11.783755] kasan_record_aux_stack+0xb2/0xc0 [ 11.784105] __queue_work+0x626/0xeb0 [ 11.784290] queue_work_on+0xb6/0xc0 [ 11.784737] workqueue_uaf+0x26d/0x560 [ 11.784921] kunit_try_run_case+0x1a5/0x480 [ 11.785115] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.785501] kthread+0x337/0x6f0 [ 11.785672] ret_from_fork+0x41/0x80 [ 11.785867] ret_from_fork_asm+0x1a/0x30 [ 11.786220] [ 11.786364] The buggy address belongs to the object at ffff888102dd0540 [ 11.786364] which belongs to the cache kmalloc-32 of size 32 [ 11.787215] The buggy address is located 0 bytes inside of [ 11.787215] freed 32-byte region [ffff888102dd0540, ffff888102dd0560) [ 11.788052] [ 11.788263] The buggy address belongs to the physical page: [ 11.788548] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102dd0 [ 11.789049] flags: 0x200000000000000(node=0|zone=2) [ 11.789373] page_type: f5(slab) [ 11.789596] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 11.790171] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 11.790675] page dumped because: kasan: bad access detected [ 11.790918] [ 11.791017] Memory state around the buggy address: [ 11.791255] ffff888102dd0400: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 11.791628] ffff888102dd0480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 11.792285] >ffff888102dd0500: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 11.792783] ^ [ 11.793137] ffff888102dd0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.793549] ffff888102dd0600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.794046] ==================================================================