Date
July 9, 2025, 2:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.823520] ================================================================== [ 17.823570] BUG: KASAN: slab-use-after-free in ksize_uaf+0x598/0x5f8 [ 17.823618] Read of size 1 at addr fff00000c7767900 by task kunit_try_catch/196 [ 17.823669] [ 17.823697] CPU: 0 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc5 #1 PREEMPT [ 17.823786] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 17.823815] Hardware name: linux,dummy-virt (DT) [ 17.823843] Call trace: [ 17.823866] show_stack+0x20/0x38 (C) [ 17.824220] dump_stack_lvl+0x8c/0xd0 [ 17.824650] print_report+0x118/0x608 [ 17.824710] kasan_report+0xdc/0x128 [ 17.824757] __asan_report_load1_noabort+0x20/0x30 [ 17.824810] ksize_uaf+0x598/0x5f8 [ 17.825181] kunit_try_run_case+0x170/0x3f0 [ 17.825245] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.825300] kthread+0x328/0x630 [ 17.825343] ret_from_fork+0x10/0x20 [ 17.825391] [ 17.825409] Allocated by task 196: [ 17.825444] kasan_save_stack+0x3c/0x68 [ 17.825617] kasan_save_track+0x20/0x40 [ 17.825656] kasan_save_alloc_info+0x40/0x58 [ 17.825818] __kasan_kmalloc+0xd4/0xd8 [ 17.825862] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.826249] ksize_uaf+0xb8/0x5f8 [ 17.826621] kunit_try_run_case+0x170/0x3f0 [ 17.826736] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.826781] kthread+0x328/0x630 [ 17.826815] ret_from_fork+0x10/0x20 [ 17.826851] [ 17.826901] Freed by task 196: [ 17.826929] kasan_save_stack+0x3c/0x68 [ 17.826967] kasan_save_track+0x20/0x40 [ 17.827005] kasan_save_free_info+0x4c/0x78 [ 17.827045] __kasan_slab_free+0x6c/0x98 [ 17.827093] kfree+0x214/0x3c8 [ 17.827127] ksize_uaf+0x11c/0x5f8 [ 17.827163] kunit_try_run_case+0x170/0x3f0 [ 17.827200] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.827244] kthread+0x328/0x630 [ 17.827277] ret_from_fork+0x10/0x20 [ 17.827312] [ 17.827332] The buggy address belongs to the object at fff00000c7767900 [ 17.827332] which belongs to the cache kmalloc-128 of size 128 [ 17.827958] The buggy address is located 0 bytes inside of [ 17.827958] freed 128-byte region [fff00000c7767900, fff00000c7767980) [ 17.828034] [ 17.828054] The buggy address belongs to the physical page: [ 17.828095] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107767 [ 17.828159] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.828212] page_type: f5(slab) [ 17.828250] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.828476] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.828590] page dumped because: kasan: bad access detected [ 17.828623] [ 17.828641] Memory state around the buggy address: [ 17.828675] fff00000c7767800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.828869] fff00000c7767880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.828914] >fff00000c7767900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.829000] ^ [ 17.829064] fff00000c7767980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.829182] fff00000c7767a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.829233] ================================================================== [ 17.830201] ================================================================== [ 17.830319] BUG: KASAN: slab-use-after-free in ksize_uaf+0x544/0x5f8 [ 17.830433] Read of size 1 at addr fff00000c7767978 by task kunit_try_catch/196 [ 17.830482] [ 17.830511] CPU: 0 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc5 #1 PREEMPT [ 17.830668] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 17.830704] Hardware name: linux,dummy-virt (DT) [ 17.830844] Call trace: [ 17.830869] show_stack+0x20/0x38 (C) [ 17.830919] dump_stack_lvl+0x8c/0xd0 [ 17.830969] print_report+0x118/0x608 [ 17.831015] kasan_report+0xdc/0x128 [ 17.831062] __asan_report_load1_noabort+0x20/0x30 [ 17.831136] ksize_uaf+0x544/0x5f8 [ 17.831182] kunit_try_run_case+0x170/0x3f0 [ 17.831228] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.831542] kthread+0x328/0x630 [ 17.831585] ret_from_fork+0x10/0x20 [ 17.831634] [ 17.831662] Allocated by task 196: [ 17.831689] kasan_save_stack+0x3c/0x68 [ 17.831730] kasan_save_track+0x20/0x40 [ 17.831767] kasan_save_alloc_info+0x40/0x58 [ 17.832041] __kasan_kmalloc+0xd4/0xd8 [ 17.832171] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.832212] ksize_uaf+0xb8/0x5f8 [ 17.832257] kunit_try_run_case+0x170/0x3f0 [ 17.832434] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.832492] kthread+0x328/0x630 [ 17.832524] ret_from_fork+0x10/0x20 [ 17.832560] [ 17.832579] Freed by task 196: [ 17.832605] kasan_save_stack+0x3c/0x68 [ 17.832644] kasan_save_track+0x20/0x40 [ 17.832681] kasan_save_free_info+0x4c/0x78 [ 17.832722] __kasan_slab_free+0x6c/0x98 [ 17.832760] kfree+0x214/0x3c8 [ 17.832792] ksize_uaf+0x11c/0x5f8 [ 17.832828] kunit_try_run_case+0x170/0x3f0 [ 17.832980] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.833262] kthread+0x328/0x630 [ 17.833335] ret_from_fork+0x10/0x20 [ 17.833430] [ 17.833533] The buggy address belongs to the object at fff00000c7767900 [ 17.833533] which belongs to the cache kmalloc-128 of size 128 [ 17.833599] The buggy address is located 120 bytes inside of [ 17.833599] freed 128-byte region [fff00000c7767900, fff00000c7767980) [ 17.833662] [ 17.833714] The buggy address belongs to the physical page: [ 17.833746] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107767 [ 17.833798] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.833847] page_type: f5(slab) [ 17.833885] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.833938] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.834440] page dumped because: kasan: bad access detected [ 17.834474] [ 17.834492] Memory state around the buggy address: [ 17.834604] fff00000c7767800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.834651] fff00000c7767880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.834710] >fff00000c7767900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.834844] ^ [ 17.834983] fff00000c7767980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.835105] fff00000c7767a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.835144] ================================================================== [ 17.818334] ================================================================== [ 17.818400] BUG: KASAN: slab-use-after-free in ksize_uaf+0x168/0x5f8 [ 17.818459] Read of size 1 at addr fff00000c7767900 by task kunit_try_catch/196 [ 17.818512] [ 17.818591] CPU: 0 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc5 #1 PREEMPT [ 17.818843] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 17.818976] Hardware name: linux,dummy-virt (DT) [ 17.819009] Call trace: [ 17.819032] show_stack+0x20/0x38 (C) [ 17.819094] dump_stack_lvl+0x8c/0xd0 [ 17.819144] print_report+0x118/0x608 [ 17.819192] kasan_report+0xdc/0x128 [ 17.819239] __kasan_check_byte+0x54/0x70 [ 17.819297] ksize+0x30/0x88 [ 17.819342] ksize_uaf+0x168/0x5f8 [ 17.819385] kunit_try_run_case+0x170/0x3f0 [ 17.819432] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.819485] kthread+0x328/0x630 [ 17.819526] ret_from_fork+0x10/0x20 [ 17.819795] [ 17.819823] Allocated by task 196: [ 17.819966] kasan_save_stack+0x3c/0x68 [ 17.820009] kasan_save_track+0x20/0x40 [ 17.820061] kasan_save_alloc_info+0x40/0x58 [ 17.820192] __kasan_kmalloc+0xd4/0xd8 [ 17.820238] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.820303] ksize_uaf+0xb8/0x5f8 [ 17.820338] kunit_try_run_case+0x170/0x3f0 [ 17.820377] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.820422] kthread+0x328/0x630 [ 17.820454] ret_from_fork+0x10/0x20 [ 17.820491] [ 17.820509] Freed by task 196: [ 17.820536] kasan_save_stack+0x3c/0x68 [ 17.820574] kasan_save_track+0x20/0x40 [ 17.820612] kasan_save_free_info+0x4c/0x78 [ 17.820718] __kasan_slab_free+0x6c/0x98 [ 17.820759] kfree+0x214/0x3c8 [ 17.820825] ksize_uaf+0x11c/0x5f8 [ 17.820867] kunit_try_run_case+0x170/0x3f0 [ 17.820967] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.821014] kthread+0x328/0x630 [ 17.821048] ret_from_fork+0x10/0x20 [ 17.821100] [ 17.821194] The buggy address belongs to the object at fff00000c7767900 [ 17.821194] which belongs to the cache kmalloc-128 of size 128 [ 17.821486] The buggy address is located 0 bytes inside of [ 17.821486] freed 128-byte region [fff00000c7767900, fff00000c7767980) [ 17.821671] [ 17.821691] The buggy address belongs to the physical page: [ 17.821722] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107767 [ 17.821777] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.821828] page_type: f5(slab) [ 17.821866] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.821918] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.822008] page dumped because: kasan: bad access detected [ 17.822040] [ 17.822059] Memory state around the buggy address: [ 17.822447] fff00000c7767800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.822493] fff00000c7767880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.822603] >fff00000c7767900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.822743] ^ [ 17.822815] fff00000c7767980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.822888] fff00000c7767a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.822928] ==================================================================
[ 13.284578] ================================================================== [ 13.285240] BUG: KASAN: slab-use-after-free in ksize_uaf+0x5fe/0x6c0 [ 13.285958] Read of size 1 at addr ffff8881029ade00 by task kunit_try_catch/213 [ 13.286208] [ 13.286302] CPU: 0 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 13.286345] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.286356] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.286377] Call Trace: [ 13.286396] <TASK> [ 13.286413] dump_stack_lvl+0x73/0xb0 [ 13.286443] print_report+0xd1/0x650 [ 13.286465] ? __virt_addr_valid+0x1db/0x2d0 [ 13.286488] ? ksize_uaf+0x5fe/0x6c0 [ 13.286506] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.286529] ? ksize_uaf+0x5fe/0x6c0 [ 13.286548] kasan_report+0x141/0x180 [ 13.286569] ? ksize_uaf+0x5fe/0x6c0 [ 13.286606] __asan_report_load1_noabort+0x18/0x20 [ 13.286630] ksize_uaf+0x5fe/0x6c0 [ 13.286650] ? __pfx_ksize_uaf+0x10/0x10 [ 13.286670] ? __schedule+0x10cc/0x2b60 [ 13.286692] ? __pfx_read_tsc+0x10/0x10 [ 13.286712] ? ktime_get_ts64+0x86/0x230 [ 13.286736] kunit_try_run_case+0x1a5/0x480 [ 13.286759] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.286782] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.286817] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.286847] ? __kthread_parkme+0x82/0x180 [ 13.286867] ? preempt_count_sub+0x50/0x80 [ 13.286891] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.286914] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.286938] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.286962] kthread+0x337/0x6f0 [ 13.286981] ? trace_preempt_on+0x20/0xc0 [ 13.287004] ? __pfx_kthread+0x10/0x10 [ 13.287024] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.287045] ? calculate_sigpending+0x7b/0xa0 [ 13.287069] ? __pfx_kthread+0x10/0x10 [ 13.287090] ret_from_fork+0x116/0x1d0 [ 13.287107] ? __pfx_kthread+0x10/0x10 [ 13.287127] ret_from_fork_asm+0x1a/0x30 [ 13.287157] </TASK> [ 13.287167] [ 13.294464] Allocated by task 213: [ 13.294655] kasan_save_stack+0x45/0x70 [ 13.295120] kasan_save_track+0x18/0x40 [ 13.295323] kasan_save_alloc_info+0x3b/0x50 [ 13.295518] __kasan_kmalloc+0xb7/0xc0 [ 13.295660] __kmalloc_cache_noprof+0x189/0x420 [ 13.296005] ksize_uaf+0xaa/0x6c0 [ 13.296176] kunit_try_run_case+0x1a5/0x480 [ 13.296317] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.296487] kthread+0x337/0x6f0 [ 13.296615] ret_from_fork+0x116/0x1d0 [ 13.296743] ret_from_fork_asm+0x1a/0x30 [ 13.296941] [ 13.297035] Freed by task 213: [ 13.297193] kasan_save_stack+0x45/0x70 [ 13.297388] kasan_save_track+0x18/0x40 [ 13.297580] kasan_save_free_info+0x3f/0x60 [ 13.297858] __kasan_slab_free+0x56/0x70 [ 13.298059] kfree+0x222/0x3f0 [ 13.298196] ksize_uaf+0x12c/0x6c0 [ 13.298350] kunit_try_run_case+0x1a5/0x480 [ 13.298531] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.298776] kthread+0x337/0x6f0 [ 13.298986] ret_from_fork+0x116/0x1d0 [ 13.299158] ret_from_fork_asm+0x1a/0x30 [ 13.299292] [ 13.299359] The buggy address belongs to the object at ffff8881029ade00 [ 13.299359] which belongs to the cache kmalloc-128 of size 128 [ 13.299901] The buggy address is located 0 bytes inside of [ 13.299901] freed 128-byte region [ffff8881029ade00, ffff8881029ade80) [ 13.300548] [ 13.300633] The buggy address belongs to the physical page: [ 13.300810] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029ad [ 13.301179] flags: 0x200000000000000(node=0|zone=2) [ 13.301760] page_type: f5(slab) [ 13.301942] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 13.302183] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.302411] page dumped because: kasan: bad access detected [ 13.302585] [ 13.302692] Memory state around the buggy address: [ 13.302930] ffff8881029add00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.303253] ffff8881029add80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.303578] >ffff8881029ade00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.304156] ^ [ 13.304326] ffff8881029ade80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.304605] ffff8881029adf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.304979] ================================================================== [ 13.251533] ================================================================== [ 13.252197] BUG: KASAN: slab-use-after-free in ksize_uaf+0x19d/0x6c0 [ 13.252424] Read of size 1 at addr ffff8881029ade00 by task kunit_try_catch/213 [ 13.252661] [ 13.252755] CPU: 0 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 13.252844] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.252855] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.252876] Call Trace: [ 13.252888] <TASK> [ 13.252904] dump_stack_lvl+0x73/0xb0 [ 13.252934] print_report+0xd1/0x650 [ 13.252957] ? __virt_addr_valid+0x1db/0x2d0 [ 13.252980] ? ksize_uaf+0x19d/0x6c0 [ 13.252998] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.253021] ? ksize_uaf+0x19d/0x6c0 [ 13.253040] kasan_report+0x141/0x180 [ 13.253061] ? ksize_uaf+0x19d/0x6c0 [ 13.253083] ? ksize_uaf+0x19d/0x6c0 [ 13.253103] __kasan_check_byte+0x3d/0x50 [ 13.253124] ksize+0x20/0x60 [ 13.253143] ksize_uaf+0x19d/0x6c0 [ 13.253162] ? __pfx_ksize_uaf+0x10/0x10 [ 13.253183] ? __schedule+0x10cc/0x2b60 [ 13.253206] ? __pfx_read_tsc+0x10/0x10 [ 13.253227] ? ktime_get_ts64+0x86/0x230 [ 13.253250] kunit_try_run_case+0x1a5/0x480 [ 13.253275] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.253297] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.253321] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.253344] ? __kthread_parkme+0x82/0x180 [ 13.253367] ? preempt_count_sub+0x50/0x80 [ 13.253393] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.253418] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.253443] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.253468] kthread+0x337/0x6f0 [ 13.253486] ? trace_preempt_on+0x20/0xc0 [ 13.253509] ? __pfx_kthread+0x10/0x10 [ 13.253529] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.253550] ? calculate_sigpending+0x7b/0xa0 [ 13.253575] ? __pfx_kthread+0x10/0x10 [ 13.253607] ret_from_fork+0x116/0x1d0 [ 13.253626] ? __pfx_kthread+0x10/0x10 [ 13.253646] ret_from_fork_asm+0x1a/0x30 [ 13.253678] </TASK> [ 13.253688] [ 13.266426] Allocated by task 213: [ 13.266863] kasan_save_stack+0x45/0x70 [ 13.267251] kasan_save_track+0x18/0x40 [ 13.267611] kasan_save_alloc_info+0x3b/0x50 [ 13.268069] __kasan_kmalloc+0xb7/0xc0 [ 13.268400] __kmalloc_cache_noprof+0x189/0x420 [ 13.268909] ksize_uaf+0xaa/0x6c0 [ 13.269231] kunit_try_run_case+0x1a5/0x480 [ 13.269622] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.270146] kthread+0x337/0x6f0 [ 13.270288] ret_from_fork+0x116/0x1d0 [ 13.270422] ret_from_fork_asm+0x1a/0x30 [ 13.270563] [ 13.270645] Freed by task 213: [ 13.270757] kasan_save_stack+0x45/0x70 [ 13.271522] kasan_save_track+0x18/0x40 [ 13.271918] kasan_save_free_info+0x3f/0x60 [ 13.272397] __kasan_slab_free+0x56/0x70 [ 13.272847] kfree+0x222/0x3f0 [ 13.273151] ksize_uaf+0x12c/0x6c0 [ 13.273457] kunit_try_run_case+0x1a5/0x480 [ 13.273831] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.274335] kthread+0x337/0x6f0 [ 13.274459] ret_from_fork+0x116/0x1d0 [ 13.274591] ret_from_fork_asm+0x1a/0x30 [ 13.274742] [ 13.274895] The buggy address belongs to the object at ffff8881029ade00 [ 13.274895] which belongs to the cache kmalloc-128 of size 128 [ 13.276044] The buggy address is located 0 bytes inside of [ 13.276044] freed 128-byte region [ffff8881029ade00, ffff8881029ade80) [ 13.277029] [ 13.277185] The buggy address belongs to the physical page: [ 13.277533] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029ad [ 13.277847] flags: 0x200000000000000(node=0|zone=2) [ 13.278278] page_type: f5(slab) [ 13.278570] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 13.279285] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.279714] page dumped because: kasan: bad access detected [ 13.280119] [ 13.280273] Memory state around the buggy address: [ 13.280700] ffff8881029add00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.281361] ffff8881029add80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.281718] >ffff8881029ade00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.282304] ^ [ 13.282711] ffff8881029ade80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.283348] ffff8881029adf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.283686] ================================================================== [ 13.305686] ================================================================== [ 13.306039] BUG: KASAN: slab-use-after-free in ksize_uaf+0x5e4/0x6c0 [ 13.306358] Read of size 1 at addr ffff8881029ade78 by task kunit_try_catch/213 [ 13.306915] [ 13.307009] CPU: 0 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 13.307052] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.307062] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.307082] Call Trace: [ 13.307093] <TASK> [ 13.307109] dump_stack_lvl+0x73/0xb0 [ 13.307140] print_report+0xd1/0x650 [ 13.307161] ? __virt_addr_valid+0x1db/0x2d0 [ 13.307184] ? ksize_uaf+0x5e4/0x6c0 [ 13.307203] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.307226] ? ksize_uaf+0x5e4/0x6c0 [ 13.307245] kasan_report+0x141/0x180 [ 13.307266] ? ksize_uaf+0x5e4/0x6c0 [ 13.307290] __asan_report_load1_noabort+0x18/0x20 [ 13.307314] ksize_uaf+0x5e4/0x6c0 [ 13.307333] ? __pfx_ksize_uaf+0x10/0x10 [ 13.307354] ? __schedule+0x10cc/0x2b60 [ 13.307375] ? __pfx_read_tsc+0x10/0x10 [ 13.307396] ? ktime_get_ts64+0x86/0x230 [ 13.307421] kunit_try_run_case+0x1a5/0x480 [ 13.307444] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.307466] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.307491] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.307516] ? __kthread_parkme+0x82/0x180 [ 13.307536] ? preempt_count_sub+0x50/0x80 [ 13.307560] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.307584] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.307618] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.307643] kthread+0x337/0x6f0 [ 13.307661] ? trace_preempt_on+0x20/0xc0 [ 13.307685] ? __pfx_kthread+0x10/0x10 [ 13.307704] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.307725] ? calculate_sigpending+0x7b/0xa0 [ 13.307749] ? __pfx_kthread+0x10/0x10 [ 13.307770] ret_from_fork+0x116/0x1d0 [ 13.307788] ? __pfx_kthread+0x10/0x10 [ 13.307807] ret_from_fork_asm+0x1a/0x30 [ 13.307837] </TASK> [ 13.307848] [ 13.314783] Allocated by task 213: [ 13.314980] kasan_save_stack+0x45/0x70 [ 13.315239] kasan_save_track+0x18/0x40 [ 13.315436] kasan_save_alloc_info+0x3b/0x50 [ 13.315659] __kasan_kmalloc+0xb7/0xc0 [ 13.315944] __kmalloc_cache_noprof+0x189/0x420 [ 13.316183] ksize_uaf+0xaa/0x6c0 [ 13.316342] kunit_try_run_case+0x1a5/0x480 [ 13.316526] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.316724] kthread+0x337/0x6f0 [ 13.316847] ret_from_fork+0x116/0x1d0 [ 13.316980] ret_from_fork_asm+0x1a/0x30 [ 13.317122] [ 13.317315] Freed by task 213: [ 13.317477] kasan_save_stack+0x45/0x70 [ 13.317688] kasan_save_track+0x18/0x40 [ 13.317878] kasan_save_free_info+0x3f/0x60 [ 13.318087] __kasan_slab_free+0x56/0x70 [ 13.318415] kfree+0x222/0x3f0 [ 13.318655] ksize_uaf+0x12c/0x6c0 [ 13.318917] kunit_try_run_case+0x1a5/0x480 [ 13.319073] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.319258] kthread+0x337/0x6f0 [ 13.319378] ret_from_fork+0x116/0x1d0 [ 13.319516] ret_from_fork_asm+0x1a/0x30 [ 13.319729] [ 13.319826] The buggy address belongs to the object at ffff8881029ade00 [ 13.319826] which belongs to the cache kmalloc-128 of size 128 [ 13.320658] The buggy address is located 120 bytes inside of [ 13.320658] freed 128-byte region [ffff8881029ade00, ffff8881029ade80) [ 13.321235] [ 13.321340] The buggy address belongs to the physical page: [ 13.321535] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029ad [ 13.321791] flags: 0x200000000000000(node=0|zone=2) [ 13.322027] page_type: f5(slab) [ 13.322194] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 13.322747] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.322995] page dumped because: kasan: bad access detected [ 13.323167] [ 13.323235] Memory state around the buggy address: [ 13.323391] ffff8881029add00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.323664] ffff8881029add80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.323999] >ffff8881029ade00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.324320] ^ [ 13.324922] ffff8881029ade80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.325463] ffff8881029adf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.325771] ==================================================================