Date
July 4, 2025, 3:11 p.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 35.347500] ================================================================== [ 35.352385] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 35.359063] Read of size 1 at addr ffff000803260000 by task kunit_try_catch/282 [ 35.366354] [ 35.367841] CPU: 6 UID: 0 PID: 282 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc2 #1 PREEMPT [ 35.367896] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.367914] Hardware name: WinLink E850-96 board (DT) [ 35.367938] Call trace: [ 35.367952] show_stack+0x20/0x38 (C) [ 35.367988] dump_stack_lvl+0x8c/0xd0 [ 35.368026] print_report+0x118/0x608 [ 35.368056] kasan_report+0xdc/0x128 [ 35.368085] __asan_report_load1_noabort+0x20/0x30 [ 35.368124] mempool_uaf_helper+0x314/0x340 [ 35.368159] mempool_page_alloc_uaf+0xc0/0x118 [ 35.368192] kunit_try_run_case+0x170/0x3f0 [ 35.368227] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.368266] kthread+0x328/0x630 [ 35.368300] ret_from_fork+0x10/0x20 [ 35.368340] [ 35.435108] The buggy address belongs to the physical page: [ 35.440661] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883260 [ 35.448647] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 35.455170] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 35.462887] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 35.470609] page dumped because: kasan: bad access detected [ 35.476162] [ 35.477637] Memory state around the buggy address: [ 35.482418] ffff00080325ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.489620] ffff00080325ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.496827] >ffff000803260000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.504026] ^ [ 35.507242] ffff000803260080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.514446] ffff000803260100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.521649] ================================================================== [ 34.788938] ================================================================== [ 34.798398] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 34.805081] Read of size 1 at addr ffff000801eb0000 by task kunit_try_catch/278 [ 34.812370] [ 34.813857] CPU: 4 UID: 0 PID: 278 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc2 #1 PREEMPT [ 34.813913] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.813932] Hardware name: WinLink E850-96 board (DT) [ 34.813954] Call trace: [ 34.813967] show_stack+0x20/0x38 (C) [ 34.814001] dump_stack_lvl+0x8c/0xd0 [ 34.814040] print_report+0x118/0x608 [ 34.814072] kasan_report+0xdc/0x128 [ 34.814103] __asan_report_load1_noabort+0x20/0x30 [ 34.814141] mempool_uaf_helper+0x314/0x340 [ 34.814175] mempool_kmalloc_large_uaf+0xc4/0x120 [ 34.814210] kunit_try_run_case+0x170/0x3f0 [ 34.814247] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.814282] kthread+0x328/0x630 [ 34.814320] ret_from_fork+0x10/0x20 [ 34.814356] [ 34.881380] The buggy address belongs to the physical page: [ 34.886938] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x881eb0 [ 34.894924] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.902562] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.909505] page_type: f8(unknown) [ 34.912902] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 34.920621] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 34.928347] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 34.936159] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 34.943972] head: 0bfffe0000000002 fffffdffe007ac01 00000000ffffffff 00000000ffffffff [ 34.951784] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 34.959590] page dumped because: kasan: bad access detected [ 34.965145] [ 34.966620] Memory state around the buggy address: [ 34.971404] ffff000801eaff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 34.978603] ffff000801eaff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 34.985812] >ffff000801eb0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 34.993009] ^ [ 34.996225] ffff000801eb0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.003429] ffff000801eb0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 35.010632] ==================================================================
[ 17.657994] ================================================================== [ 17.658057] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 17.658448] Read of size 1 at addr fff00000c7850000 by task kunit_try_catch/238 [ 17.658684] [ 17.658770] CPU: 1 UID: 0 PID: 238 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc2 #1 PREEMPT [ 17.659096] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.659124] Hardware name: linux,dummy-virt (DT) [ 17.659170] Call trace: [ 17.659196] show_stack+0x20/0x38 (C) [ 17.659250] dump_stack_lvl+0x8c/0xd0 [ 17.659366] print_report+0x118/0x608 [ 17.659415] kasan_report+0xdc/0x128 [ 17.659460] __asan_report_load1_noabort+0x20/0x30 [ 17.659530] mempool_uaf_helper+0x314/0x340 [ 17.659581] mempool_page_alloc_uaf+0xc0/0x118 [ 17.659626] kunit_try_run_case+0x170/0x3f0 [ 17.659694] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.659759] kthread+0x328/0x630 [ 17.659804] ret_from_fork+0x10/0x20 [ 17.659858] [ 17.659880] The buggy address belongs to the physical page: [ 17.659912] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107850 [ 17.660167] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.660274] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 17.660339] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 17.660425] page dumped because: kasan: bad access detected [ 17.660493] [ 17.660656] Memory state around the buggy address: [ 17.660805] fff00000c784ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.661031] fff00000c784ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.661169] >fff00000c7850000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.661298] ^ [ 17.661368] fff00000c7850080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.661461] fff00000c7850100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.661557] ================================================================== [ 17.602589] ================================================================== [ 17.603416] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 17.603486] Read of size 1 at addr fff00000c7850000 by task kunit_try_catch/234 [ 17.603536] [ 17.603576] CPU: 1 UID: 0 PID: 234 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc2 #1 PREEMPT [ 17.603679] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.603708] Hardware name: linux,dummy-virt (DT) [ 17.603955] Call trace: [ 17.604043] show_stack+0x20/0x38 (C) [ 17.604127] dump_stack_lvl+0x8c/0xd0 [ 17.604178] print_report+0x118/0x608 [ 17.604229] kasan_report+0xdc/0x128 [ 17.604273] __asan_report_load1_noabort+0x20/0x30 [ 17.604323] mempool_uaf_helper+0x314/0x340 [ 17.604695] mempool_kmalloc_large_uaf+0xc4/0x120 [ 17.604834] kunit_try_run_case+0x170/0x3f0 [ 17.604933] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.605279] kthread+0x328/0x630 [ 17.605457] ret_from_fork+0x10/0x20 [ 17.605544] [ 17.605574] The buggy address belongs to the physical page: [ 17.606027] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107850 [ 17.606137] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.606251] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.606305] page_type: f8(unknown) [ 17.606343] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.606726] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.606814] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.607092] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.607267] head: 0bfffe0000000002 ffffc1ffc31e1401 00000000ffffffff 00000000ffffffff [ 17.607356] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 17.607793] page dumped because: kasan: bad access detected [ 17.607976] [ 17.608020] Memory state around the buggy address: [ 17.608196] fff00000c784ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.608243] fff00000c784ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.608292] >fff00000c7850000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.608332] ^ [ 17.608361] fff00000c7850080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.608719] fff00000c7850100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.608816] ==================================================================
[ 16.291009] ================================================================== [ 16.291906] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 16.292605] Read of size 1 at addr ffff8881039d8000 by task kunit_try_catch/254 [ 16.293449] [ 16.293698] CPU: 0 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc2 #1 PREEMPT(voluntary) [ 16.293809] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.293841] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.293891] Call Trace: [ 16.293923] <TASK> [ 16.293966] dump_stack_lvl+0x73/0xb0 [ 16.294037] print_report+0xd1/0x650 [ 16.294103] ? __virt_addr_valid+0x1db/0x2d0 [ 16.294151] ? mempool_uaf_helper+0x392/0x400 [ 16.294196] ? kasan_addr_to_slab+0x11/0xa0 [ 16.294239] ? mempool_uaf_helper+0x392/0x400 [ 16.294295] kasan_report+0x141/0x180 [ 16.294365] ? mempool_uaf_helper+0x392/0x400 [ 16.294427] __asan_report_load1_noabort+0x18/0x20 [ 16.294476] mempool_uaf_helper+0x392/0x400 [ 16.294529] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 16.294576] ? dequeue_entities+0x852/0x1740 [ 16.294638] ? finish_task_switch.isra.0+0x153/0x700 [ 16.294702] mempool_page_alloc_uaf+0xed/0x140 [ 16.294760] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 16.294797] ? dequeue_task_fair+0x166/0x4e0 [ 16.294837] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 16.294878] ? __pfx_mempool_free_pages+0x10/0x10 [ 16.294917] ? __pfx_read_tsc+0x10/0x10 [ 16.294956] ? ktime_get_ts64+0x86/0x230 [ 16.295003] kunit_try_run_case+0x1a5/0x480 [ 16.295052] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.295090] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.295136] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.295164] ? __kthread_parkme+0x82/0x180 [ 16.295192] ? preempt_count_sub+0x50/0x80 [ 16.295236] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.295275] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.295311] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.295357] kthread+0x337/0x6f0 [ 16.295380] ? trace_preempt_on+0x20/0xc0 [ 16.295410] ? __pfx_kthread+0x10/0x10 [ 16.295431] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.295459] ? calculate_sigpending+0x7b/0xa0 [ 16.295485] ? __pfx_kthread+0x10/0x10 [ 16.295506] ret_from_fork+0x41/0x80 [ 16.295531] ? __pfx_kthread+0x10/0x10 [ 16.295551] ret_from_fork_asm+0x1a/0x30 [ 16.295588] </TASK> [ 16.295601] [ 16.307687] The buggy address belongs to the physical page: [ 16.308650] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039d8 [ 16.309492] flags: 0x200000000000000(node=0|zone=2) [ 16.309976] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 16.310834] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 16.311270] page dumped because: kasan: bad access detected [ 16.311518] [ 16.311680] Memory state around the buggy address: [ 16.312010] ffff8881039d7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.312507] ffff8881039d7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.312900] >ffff8881039d8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 16.314001] ^ [ 16.314258] ffff8881039d8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 16.314622] ffff8881039d8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 16.315074] ================================================================== [ 16.202820] ================================================================== [ 16.203711] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 16.203993] Read of size 1 at addr ffff888103ab4000 by task kunit_try_catch/250 [ 16.204393] [ 16.204539] CPU: 1 UID: 0 PID: 250 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc2 #1 PREEMPT(voluntary) [ 16.204643] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.204672] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.204757] Call Trace: [ 16.204786] <TASK> [ 16.204838] dump_stack_lvl+0x73/0xb0 [ 16.204899] print_report+0xd1/0x650 [ 16.204943] ? __virt_addr_valid+0x1db/0x2d0 [ 16.204982] ? mempool_uaf_helper+0x392/0x400 [ 16.205026] ? kasan_addr_to_slab+0x11/0xa0 [ 16.205093] ? mempool_uaf_helper+0x392/0x400 [ 16.205133] kasan_report+0x141/0x180 [ 16.205176] ? mempool_uaf_helper+0x392/0x400 [ 16.205234] __asan_report_load1_noabort+0x18/0x20 [ 16.205283] mempool_uaf_helper+0x392/0x400 [ 16.205352] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 16.205407] ? dequeue_entities+0x852/0x1740 [ 16.205466] ? finish_task_switch.isra.0+0x153/0x700 [ 16.205527] mempool_kmalloc_large_uaf+0xef/0x140 [ 16.205579] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 16.205622] ? dequeue_task_fair+0x166/0x4e0 [ 16.205664] ? __pfx_mempool_kmalloc+0x10/0x10 [ 16.205708] ? __pfx_mempool_kfree+0x10/0x10 [ 16.205751] ? __pfx_read_tsc+0x10/0x10 [ 16.205826] ? ktime_get_ts64+0x86/0x230 [ 16.205898] kunit_try_run_case+0x1a5/0x480 [ 16.205954] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.206025] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.206104] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.206160] ? __kthread_parkme+0x82/0x180 [ 16.206233] ? preempt_count_sub+0x50/0x80 [ 16.206265] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.206290] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.206318] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.206364] kthread+0x337/0x6f0 [ 16.206385] ? trace_preempt_on+0x20/0xc0 [ 16.206411] ? __pfx_kthread+0x10/0x10 [ 16.206431] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.206455] ? calculate_sigpending+0x7b/0xa0 [ 16.206480] ? __pfx_kthread+0x10/0x10 [ 16.206502] ret_from_fork+0x41/0x80 [ 16.206524] ? __pfx_kthread+0x10/0x10 [ 16.206544] ret_from_fork_asm+0x1a/0x30 [ 16.206577] </TASK> [ 16.206590] [ 16.218210] The buggy address belongs to the physical page: [ 16.218533] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103ab4 [ 16.219112] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.219650] flags: 0x200000000000040(head|node=0|zone=2) [ 16.220099] page_type: f8(unknown) [ 16.220423] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.220934] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.221523] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.221849] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.222141] head: 0200000000000002 ffffea00040ead01 00000000ffffffff 00000000ffffffff [ 16.222904] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 16.223475] page dumped because: kasan: bad access detected [ 16.223830] [ 16.223950] Memory state around the buggy address: [ 16.224159] ffff888103ab3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 16.224446] ffff888103ab3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 16.224716] >ffff888103ab4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 16.225295] ^ [ 16.225619] ffff888103ab4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 16.226283] ffff888103ab4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 16.226954] ==================================================================