Date
July 8, 2025, 4:38 p.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 |
[ 17.843969] ================================================================== [ 17.844023] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x3bc/0x438 [ 17.844074] Read of size 16 at addr fff00000c5cff6e0 by task kunit_try_catch/170 [ 17.844122] [ 17.844161] CPU: 1 UID: 0 PID: 170 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT [ 17.844318] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.844357] Hardware name: linux,dummy-virt (DT) [ 17.844387] Call trace: [ 17.844500] show_stack+0x20/0x38 (C) [ 17.844596] dump_stack_lvl+0x8c/0xd0 [ 17.844914] print_report+0x118/0x608 [ 17.844962] kasan_report+0xdc/0x128 [ 17.845007] __asan_report_load16_noabort+0x20/0x30 [ 17.845059] kmalloc_uaf_16+0x3bc/0x438 [ 17.845106] kunit_try_run_case+0x170/0x3f0 [ 17.845450] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.845560] kthread+0x328/0x630 [ 17.845767] ret_from_fork+0x10/0x20 [ 17.845821] [ 17.845952] Allocated by task 170: [ 17.845981] kasan_save_stack+0x3c/0x68 [ 17.846068] kasan_save_track+0x20/0x40 [ 17.846472] kasan_save_alloc_info+0x40/0x58 [ 17.846522] __kasan_kmalloc+0xd4/0xd8 [ 17.846559] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.846608] kmalloc_uaf_16+0x140/0x438 [ 17.846745] kunit_try_run_case+0x170/0x3f0 [ 17.846783] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.846825] kthread+0x328/0x630 [ 17.846892] ret_from_fork+0x10/0x20 [ 17.846927] [ 17.846946] Freed by task 170: [ 17.847028] kasan_save_stack+0x3c/0x68 [ 17.847065] kasan_save_track+0x20/0x40 [ 17.847099] kasan_save_free_info+0x4c/0x78 [ 17.847136] __kasan_slab_free+0x6c/0x98 [ 17.847171] kfree+0x214/0x3c8 [ 17.847202] kmalloc_uaf_16+0x190/0x438 [ 17.847239] kunit_try_run_case+0x170/0x3f0 [ 17.847276] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.847318] kthread+0x328/0x630 [ 17.847365] ret_from_fork+0x10/0x20 [ 17.847740] [ 17.847798] The buggy address belongs to the object at fff00000c5cff6e0 [ 17.847798] which belongs to the cache kmalloc-16 of size 16 [ 17.847855] The buggy address is located 0 bytes inside of [ 17.847855] freed 16-byte region [fff00000c5cff6e0, fff00000c5cff6f0) [ 17.847913] [ 17.847933] The buggy address belongs to the physical page: [ 17.847968] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105cff [ 17.848194] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.848270] page_type: f5(slab) [ 17.848358] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 17.848555] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 17.849155] page dumped because: kasan: bad access detected [ 17.849198] [ 17.849230] Memory state around the buggy address: [ 17.849263] fff00000c5cff580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 17.849327] fff00000c5cff600: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 17.849380] >fff00000c5cff680: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 17.849614] ^ [ 17.849692] fff00000c5cff700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.849810] fff00000c5cff780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.849858] ==================================================================
[ 11.264582] ================================================================== [ 11.265541] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x47b/0x4c0 [ 11.266312] Read of size 16 at addr ffff8881021715e0 by task kunit_try_catch/188 [ 11.267082] [ 11.267184] CPU: 1 UID: 0 PID: 188 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT(voluntary) [ 11.267232] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.267243] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.267265] Call Trace: [ 11.267277] <TASK> [ 11.267293] dump_stack_lvl+0x73/0xb0 [ 11.267322] print_report+0xd1/0x650 [ 11.267346] ? __virt_addr_valid+0x1db/0x2d0 [ 11.267369] ? kmalloc_uaf_16+0x47b/0x4c0 [ 11.267390] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.267414] ? kmalloc_uaf_16+0x47b/0x4c0 [ 11.267435] kasan_report+0x141/0x180 [ 11.267458] ? kmalloc_uaf_16+0x47b/0x4c0 [ 11.267485] __asan_report_load16_noabort+0x18/0x20 [ 11.267517] kmalloc_uaf_16+0x47b/0x4c0 [ 11.267539] ? __pfx_kmalloc_uaf_16+0x10/0x10 [ 11.267562] ? __schedule+0x10cc/0x2b60 [ 11.267654] ? __pfx_read_tsc+0x10/0x10 [ 11.267676] ? ktime_get_ts64+0x86/0x230 [ 11.267710] kunit_try_run_case+0x1a5/0x480 [ 11.267732] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.267751] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.267777] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.267801] ? __kthread_parkme+0x82/0x180 [ 11.267824] ? preempt_count_sub+0x50/0x80 [ 11.267901] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.267923] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.267946] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.267981] kthread+0x337/0x6f0 [ 11.267998] ? trace_preempt_on+0x20/0xc0 [ 11.268022] ? __pfx_kthread+0x10/0x10 [ 11.268041] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.268063] ? calculate_sigpending+0x7b/0xa0 [ 11.268085] ? __pfx_kthread+0x10/0x10 [ 11.268104] ret_from_fork+0x41/0x80 [ 11.268124] ? __pfx_kthread+0x10/0x10 [ 11.268143] ret_from_fork_asm+0x1a/0x30 [ 11.268174] </TASK> [ 11.268185] [ 11.281211] Allocated by task 188: [ 11.281528] kasan_save_stack+0x45/0x70 [ 11.282124] kasan_save_track+0x18/0x40 [ 11.282496] kasan_save_alloc_info+0x3b/0x50 [ 11.282886] __kasan_kmalloc+0xb7/0xc0 [ 11.283246] __kmalloc_cache_noprof+0x189/0x420 [ 11.283402] kmalloc_uaf_16+0x15b/0x4c0 [ 11.283588] kunit_try_run_case+0x1a5/0x480 [ 11.283971] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.284588] kthread+0x337/0x6f0 [ 11.284966] ret_from_fork+0x41/0x80 [ 11.285304] ret_from_fork_asm+0x1a/0x30 [ 11.285532] [ 11.285607] Freed by task 188: [ 11.285717] kasan_save_stack+0x45/0x70 [ 11.286034] kasan_save_track+0x18/0x40 [ 11.286404] kasan_save_free_info+0x3f/0x60 [ 11.286822] __kasan_slab_free+0x56/0x70 [ 11.287258] kfree+0x222/0x3f0 [ 11.287554] kmalloc_uaf_16+0x1d6/0x4c0 [ 11.287803] kunit_try_run_case+0x1a5/0x480 [ 11.288020] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.288201] kthread+0x337/0x6f0 [ 11.288322] ret_from_fork+0x41/0x80 [ 11.288452] ret_from_fork_asm+0x1a/0x30 [ 11.288735] [ 11.288908] The buggy address belongs to the object at ffff8881021715e0 [ 11.288908] which belongs to the cache kmalloc-16 of size 16 [ 11.290256] The buggy address is located 0 bytes inside of [ 11.290256] freed 16-byte region [ffff8881021715e0, ffff8881021715f0) [ 11.291346] [ 11.291508] The buggy address belongs to the physical page: [ 11.292107] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102171 [ 11.292463] flags: 0x200000000000000(node=0|zone=2) [ 11.292901] page_type: f5(slab) [ 11.293302] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 11.294013] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 11.294473] page dumped because: kasan: bad access detected [ 11.294733] [ 11.294903] Memory state around the buggy address: [ 11.295394] ffff888102171480: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 02 fc fc [ 11.296150] ffff888102171500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 11.296652] >ffff888102171580: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 11.297406] ^ [ 11.297800] ffff888102171600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.298278] ffff888102171680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.298500] ==================================================================