Date
July 4, 2025, 3:11 p.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-x86_64 |
[ 39.024310] ================================================================== [ 39.031321] BUG: KASAN: slab-use-after-free in strnlen+0x80/0x88 [ 39.037307] Read of size 1 at addr ffff000800cab9d0 by task kunit_try_catch/308 [ 39.044598] [ 39.046082] CPU: 6 UID: 0 PID: 308 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc2 #1 PREEMPT [ 39.046134] Tainted: [B]=BAD_PAGE, [N]=TEST [ 39.046152] Hardware name: WinLink E850-96 board (DT) [ 39.046172] Call trace: [ 39.046184] show_stack+0x20/0x38 (C) [ 39.046221] dump_stack_lvl+0x8c/0xd0 [ 39.046254] print_report+0x118/0x608 [ 39.046287] kasan_report+0xdc/0x128 [ 39.046316] __asan_report_load1_noabort+0x20/0x30 [ 39.046350] strnlen+0x80/0x88 [ 39.046376] kasan_strings+0x478/0xb00 [ 39.046408] kunit_try_run_case+0x170/0x3f0 [ 39.046445] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.046483] kthread+0x328/0x630 [ 39.046515] ret_from_fork+0x10/0x20 [ 39.046551] [ 39.111524] Allocated by task 308: [ 39.114911] kasan_save_stack+0x3c/0x68 [ 39.118728] kasan_save_track+0x20/0x40 [ 39.122548] kasan_save_alloc_info+0x40/0x58 [ 39.126801] __kasan_kmalloc+0xd4/0xd8 [ 39.130534] __kmalloc_cache_noprof+0x16c/0x3c0 [ 39.135048] kasan_strings+0xc8/0xb00 [ 39.138693] kunit_try_run_case+0x170/0x3f0 [ 39.142860] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.148329] kthread+0x328/0x630 [ 39.151540] ret_from_fork+0x10/0x20 [ 39.155100] [ 39.156575] Freed by task 308: [ 39.159614] kasan_save_stack+0x3c/0x68 [ 39.163433] kasan_save_track+0x20/0x40 [ 39.167252] kasan_save_free_info+0x4c/0x78 [ 39.171419] __kasan_slab_free+0x6c/0x98 [ 39.175325] kfree+0x214/0x3c8 [ 39.178363] kasan_strings+0x24c/0xb00 [ 39.182095] kunit_try_run_case+0x170/0x3f0 [ 39.186262] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.191731] kthread+0x328/0x630 [ 39.194943] ret_from_fork+0x10/0x20 [ 39.198502] [ 39.199977] The buggy address belongs to the object at ffff000800cab9c0 [ 39.199977] which belongs to the cache kmalloc-32 of size 32 [ 39.212307] The buggy address is located 16 bytes inside of [ 39.212307] freed 32-byte region [ffff000800cab9c0, ffff000800cab9e0) [ 39.224369] [ 39.225847] The buggy address belongs to the physical page: [ 39.231403] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880cab [ 39.239386] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 39.245897] page_type: f5(slab) [ 39.249033] raw: 0bfffe0000000000 ffff000800002780 dead000000000122 0000000000000000 [ 39.256755] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 39.264474] page dumped because: kasan: bad access detected [ 39.270028] [ 39.271504] Memory state around the buggy address: [ 39.276287] ffff000800cab880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 39.283487] ffff000800cab900: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 39.290693] >ffff000800cab980: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 39.297893] ^ [ 39.303712] ffff000800caba00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 39.310917] ffff000800caba80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 39.318119] ==================================================================
[ 16.832133] ================================================================== [ 16.834010] BUG: KASAN: slab-use-after-free in strnlen+0x73/0x80 [ 16.834459] Read of size 1 at addr ffff8881029f4750 by task kunit_try_catch/280 [ 16.834747] [ 16.834901] CPU: 1 UID: 0 PID: 280 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc2 #1 PREEMPT(voluntary) [ 16.835007] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.835036] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.835082] Call Trace: [ 16.835128] <TASK> [ 16.835176] dump_stack_lvl+0x73/0xb0 [ 16.835232] print_report+0xd1/0x650 [ 16.835277] ? __virt_addr_valid+0x1db/0x2d0 [ 16.835319] ? strnlen+0x73/0x80 [ 16.835374] ? kasan_complete_mode_report_info+0x64/0x200 [ 16.835447] ? strnlen+0x73/0x80 [ 16.835490] kasan_report+0x141/0x180 [ 16.835552] ? strnlen+0x73/0x80 [ 16.835610] __asan_report_load1_noabort+0x18/0x20 [ 16.835666] strnlen+0x73/0x80 [ 16.835702] kasan_strings+0x615/0xe80 [ 16.835745] ? __pfx_kasan_strings+0x10/0x10 [ 16.835785] ? __schedule+0x207f/0x2b60 [ 16.835830] ? schedule+0x7c/0x2e0 [ 16.835874] ? trace_hardirqs_on+0x37/0xe0 [ 16.835928] ? __schedule+0x207f/0x2b60 [ 16.835978] ? __pfx_read_tsc+0x10/0x10 [ 16.836017] ? ktime_get_ts64+0x86/0x230 [ 16.836064] kunit_try_run_case+0x1a5/0x480 [ 16.836111] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.836154] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.836228] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.836279] ? __kthread_parkme+0x82/0x180 [ 16.836323] ? preempt_count_sub+0x50/0x80 [ 16.836394] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.836441] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.836509] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.836556] kthread+0x337/0x6f0 [ 16.836594] ? trace_preempt_on+0x20/0xc0 [ 16.836640] ? __pfx_kthread+0x10/0x10 [ 16.836677] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.836708] ? calculate_sigpending+0x7b/0xa0 [ 16.836733] ? __pfx_kthread+0x10/0x10 [ 16.836753] ret_from_fork+0x41/0x80 [ 16.836775] ? __pfx_kthread+0x10/0x10 [ 16.836795] ret_from_fork_asm+0x1a/0x30 [ 16.836829] </TASK> [ 16.836844] [ 16.852077] Allocated by task 280: [ 16.853239] kasan_save_stack+0x45/0x70 [ 16.854524] kasan_save_track+0x18/0x40 [ 16.855367] kasan_save_alloc_info+0x3b/0x50 [ 16.855586] __kasan_kmalloc+0xb7/0xc0 [ 16.855750] __kmalloc_cache_noprof+0x189/0x420 [ 16.855939] kasan_strings+0xc0/0xe80 [ 16.856845] kunit_try_run_case+0x1a5/0x480 [ 16.858037] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.858590] kthread+0x337/0x6f0 [ 16.858954] ret_from_fork+0x41/0x80 [ 16.859431] ret_from_fork_asm+0x1a/0x30 [ 16.859774] [ 16.859890] Freed by task 280: [ 16.860482] kasan_save_stack+0x45/0x70 [ 16.860662] kasan_save_track+0x18/0x40 [ 16.861135] kasan_save_free_info+0x3f/0x60 [ 16.861643] __kasan_slab_free+0x56/0x70 [ 16.861983] kfree+0x222/0x3f0 [ 16.862448] kasan_strings+0x2aa/0xe80 [ 16.862903] kunit_try_run_case+0x1a5/0x480 [ 16.863089] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.863701] kthread+0x337/0x6f0 [ 16.864097] ret_from_fork+0x41/0x80 [ 16.864317] ret_from_fork_asm+0x1a/0x30 [ 16.864764] [ 16.864968] The buggy address belongs to the object at ffff8881029f4740 [ 16.864968] which belongs to the cache kmalloc-32 of size 32 [ 16.865928] The buggy address is located 16 bytes inside of [ 16.865928] freed 32-byte region [ffff8881029f4740, ffff8881029f4760) [ 16.866796] [ 16.866941] The buggy address belongs to the physical page: [ 16.867190] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029f4 [ 16.867837] flags: 0x200000000000000(node=0|zone=2) [ 16.868101] page_type: f5(slab) [ 16.868497] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 16.868864] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 16.869496] page dumped because: kasan: bad access detected [ 16.869888] [ 16.870138] Memory state around the buggy address: [ 16.870470] ffff8881029f4600: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 16.870978] ffff8881029f4680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 16.871535] >ffff8881029f4700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 16.872012] ^ [ 16.872329] ffff8881029f4780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 16.872861] ffff8881029f4800: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 16.873397] ==================================================================