Date
July 15, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.424808] ================================================================== [ 18.425070] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8 [ 18.425138] Read of size 8 at addr fff00000c59da2c0 by task kunit_try_catch/202 [ 18.425690] [ 18.425983] CPU: 0 UID: 0 PID: 202 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT [ 18.426348] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.426386] Hardware name: linux,dummy-virt (DT) [ 18.426454] Call trace: [ 18.426798] show_stack+0x20/0x38 (C) [ 18.427149] dump_stack_lvl+0x8c/0xd0 [ 18.427500] print_report+0x118/0x5d0 [ 18.427879] kasan_report+0xdc/0x128 [ 18.427982] __asan_report_load8_noabort+0x20/0x30 [ 18.428321] workqueue_uaf+0x480/0x4a8 [ 18.428549] kunit_try_run_case+0x170/0x3f0 [ 18.428862] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.429142] kthread+0x328/0x630 [ 18.429391] ret_from_fork+0x10/0x20 [ 18.429784] [ 18.429807] Allocated by task 202: [ 18.429837] kasan_save_stack+0x3c/0x68 [ 18.429877] kasan_save_track+0x20/0x40 [ 18.429912] kasan_save_alloc_info+0x40/0x58 [ 18.429952] __kasan_kmalloc+0xd4/0xd8 [ 18.430673] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.431076] workqueue_uaf+0x13c/0x4a8 [ 18.431139] kunit_try_run_case+0x170/0x3f0 [ 18.431180] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.431317] kthread+0x328/0x630 [ 18.431455] ret_from_fork+0x10/0x20 [ 18.431670] [ 18.431691] Freed by task 9: [ 18.431756] kasan_save_stack+0x3c/0x68 [ 18.431797] kasan_save_track+0x20/0x40 [ 18.431839] kasan_save_free_info+0x4c/0x78 [ 18.431876] __kasan_slab_free+0x6c/0x98 [ 18.431913] kfree+0x214/0x3c8 [ 18.431943] workqueue_uaf_work+0x18/0x30 [ 18.432433] process_one_work+0x530/0xf98 [ 18.432531] worker_thread+0x618/0xf38 [ 18.432881] kthread+0x328/0x630 [ 18.432994] ret_from_fork+0x10/0x20 [ 18.433225] [ 18.433265] Last potentially related work creation: [ 18.433294] kasan_save_stack+0x3c/0x68 [ 18.433338] kasan_record_aux_stack+0xb4/0xc8 [ 18.433386] __queue_work+0x65c/0x1008 [ 18.433445] queue_work_on+0xbc/0xf8 [ 18.433480] workqueue_uaf+0x210/0x4a8 [ 18.433707] kunit_try_run_case+0x170/0x3f0 [ 18.433884] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.433977] kthread+0x328/0x630 [ 18.434021] ret_from_fork+0x10/0x20 [ 18.434273] [ 18.434444] The buggy address belongs to the object at fff00000c59da2c0 [ 18.434444] which belongs to the cache kmalloc-32 of size 32 [ 18.434791] The buggy address is located 0 bytes inside of [ 18.434791] freed 32-byte region [fff00000c59da2c0, fff00000c59da2e0) [ 18.434983] [ 18.435057] The buggy address belongs to the physical page: [ 18.435091] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059da [ 18.435244] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.435326] page_type: f5(slab) [ 18.435364] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 18.435417] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 18.435460] page dumped because: kasan: bad access detected [ 18.435492] [ 18.436419] Memory state around the buggy address: [ 18.436555] fff00000c59da180: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 18.436768] fff00000c59da200: 00 00 03 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 18.436939] >fff00000c59da280: 00 00 00 07 fc fc fc fc fa fb fb fb fc fc fc fc [ 18.437179] ^ [ 18.437302] fff00000c59da300: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.437349] fff00000c59da380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.437390] ==================================================================
[ 11.605895] ================================================================== [ 11.606270] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560 [ 11.606491] Read of size 8 at addr ffff888102f3b380 by task kunit_try_catch/219 [ 11.606713] [ 11.606801] CPU: 1 UID: 0 PID: 219 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT(voluntary) [ 11.606846] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.606857] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.606888] Call Trace: [ 11.606900] <TASK> [ 11.606917] dump_stack_lvl+0x73/0xb0 [ 11.606940] print_report+0xd1/0x610 [ 11.606962] ? __virt_addr_valid+0x1db/0x2d0 [ 11.606983] ? workqueue_uaf+0x4d6/0x560 [ 11.607003] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.607024] ? workqueue_uaf+0x4d6/0x560 [ 11.607045] kasan_report+0x141/0x180 [ 11.607067] ? workqueue_uaf+0x4d6/0x560 [ 11.607092] __asan_report_load8_noabort+0x18/0x20 [ 11.607112] workqueue_uaf+0x4d6/0x560 [ 11.607133] ? __pfx_workqueue_uaf+0x10/0x10 [ 11.607155] ? __schedule+0x10cc/0x2b60 [ 11.607177] ? __pfx_read_tsc+0x10/0x10 [ 11.607195] ? ktime_get_ts64+0x86/0x230 [ 11.607219] kunit_try_run_case+0x1a5/0x480 [ 11.607239] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.607256] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.607280] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.607303] ? __kthread_parkme+0x82/0x180 [ 11.607324] ? preempt_count_sub+0x50/0x80 [ 11.607348] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.607367] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.607389] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.607410] kthread+0x337/0x6f0 [ 11.607426] ? trace_preempt_on+0x20/0xc0 [ 11.607448] ? __pfx_kthread+0x10/0x10 [ 11.607465] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.607486] ? calculate_sigpending+0x7b/0xa0 [ 11.607506] ? __pfx_kthread+0x10/0x10 [ 11.607523] ret_from_fork+0x41/0x80 [ 11.607543] ? __pfx_kthread+0x10/0x10 [ 11.607559] ret_from_fork_asm+0x1a/0x30 [ 11.607588] </TASK> [ 11.607599] [ 11.624681] Allocated by task 219: [ 11.625031] kasan_save_stack+0x45/0x70 [ 11.625390] kasan_save_track+0x18/0x40 [ 11.625673] kasan_save_alloc_info+0x3b/0x50 [ 11.626194] __kasan_kmalloc+0xb7/0xc0 [ 11.626364] __kmalloc_cache_noprof+0x189/0x420 [ 11.626897] workqueue_uaf+0x152/0x560 [ 11.627270] kunit_try_run_case+0x1a5/0x480 [ 11.627452] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.627859] kthread+0x337/0x6f0 [ 11.628403] ret_from_fork+0x41/0x80 [ 11.628761] ret_from_fork_asm+0x1a/0x30 [ 11.629208] [ 11.629286] Freed by task 48: [ 11.629394] kasan_save_stack+0x45/0x70 [ 11.629531] kasan_save_track+0x18/0x40 [ 11.629663] kasan_save_free_info+0x3f/0x60 [ 11.630073] __kasan_slab_free+0x56/0x70 [ 11.630533] kfree+0x222/0x3f0 [ 11.630912] workqueue_uaf_work+0x12/0x20 [ 11.631358] process_one_work+0x5ee/0xf60 [ 11.631741] worker_thread+0x758/0x1220 [ 11.632185] kthread+0x337/0x6f0 [ 11.632500] ret_from_fork+0x41/0x80 [ 11.632932] ret_from_fork_asm+0x1a/0x30 [ 11.633080] [ 11.633155] Last potentially related work creation: [ 11.633308] kasan_save_stack+0x45/0x70 [ 11.633443] kasan_record_aux_stack+0xb2/0xc0 [ 11.633587] __queue_work+0x626/0xeb0 [ 11.633733] queue_work_on+0xb6/0xc0 [ 11.633859] workqueue_uaf+0x26d/0x560 [ 11.634169] kunit_try_run_case+0x1a5/0x480 [ 11.634377] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.634630] kthread+0x337/0x6f0 [ 11.634905] ret_from_fork+0x41/0x80 [ 11.635097] ret_from_fork_asm+0x1a/0x30 [ 11.635455] [ 11.635522] The buggy address belongs to the object at ffff888102f3b380 [ 11.635522] which belongs to the cache kmalloc-32 of size 32 [ 11.636327] The buggy address is located 0 bytes inside of [ 11.636327] freed 32-byte region [ffff888102f3b380, ffff888102f3b3a0) [ 11.637345] [ 11.637423] The buggy address belongs to the physical page: [ 11.637596] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102f3b [ 11.638346] flags: 0x200000000000000(node=0|zone=2) [ 11.638889] page_type: f5(slab) [ 11.639200] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 11.639924] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 11.640430] page dumped because: kasan: bad access detected [ 11.640602] [ 11.640671] Memory state around the buggy address: [ 11.641288] ffff888102f3b280: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 11.641991] ffff888102f3b300: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 11.642670] >ffff888102f3b380: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 11.643151] ^ [ 11.643425] ffff888102f3b400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.643635] ffff888102f3b480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.644221] ==================================================================