Date
July 9, 2025, 2:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.249274] ================================================================== [ 19.249342] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 19.249416] Read of size 1 at addr fff00000c789c000 by task kunit_try_catch/233 [ 19.249466] [ 19.249508] CPU: 1 UID: 0 PID: 233 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc5 #1 PREEMPT [ 19.249645] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 19.249678] Hardware name: linux,dummy-virt (DT) [ 19.249730] Call trace: [ 19.249769] show_stack+0x20/0x38 (C) [ 19.249853] dump_stack_lvl+0x8c/0xd0 [ 19.249938] print_report+0x118/0x608 [ 19.250166] kasan_report+0xdc/0x128 [ 19.250588] __asan_report_load1_noabort+0x20/0x30 [ 19.250645] mempool_uaf_helper+0x314/0x340 [ 19.250693] mempool_page_alloc_uaf+0xc0/0x118 [ 19.250743] kunit_try_run_case+0x170/0x3f0 [ 19.250795] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.251180] kthread+0x328/0x630 [ 19.251262] ret_from_fork+0x10/0x20 [ 19.251349] [ 19.251450] The buggy address belongs to the physical page: [ 19.251484] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10789c [ 19.251577] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.251891] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 19.251998] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 19.252047] page dumped because: kasan: bad access detected [ 19.252126] [ 19.252194] Memory state around the buggy address: [ 19.252275] fff00000c789bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.252337] fff00000c789bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.252536] >fff00000c789c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.252714] ^ [ 19.252781] fff00000c789c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.252944] fff00000c789c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.253072] ================================================================== [ 19.170544] ================================================================== [ 19.170610] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 19.170668] Read of size 1 at addr fff00000c789c000 by task kunit_try_catch/229 [ 19.170865] [ 19.170922] CPU: 1 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc5 #1 PREEMPT [ 19.171031] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 19.171066] Hardware name: linux,dummy-virt (DT) [ 19.171109] Call trace: [ 19.171135] show_stack+0x20/0x38 (C) [ 19.171189] dump_stack_lvl+0x8c/0xd0 [ 19.171239] print_report+0x118/0x608 [ 19.171286] kasan_report+0xdc/0x128 [ 19.171332] __asan_report_load1_noabort+0x20/0x30 [ 19.171408] mempool_uaf_helper+0x314/0x340 [ 19.171457] mempool_kmalloc_large_uaf+0xc4/0x120 [ 19.171508] kunit_try_run_case+0x170/0x3f0 [ 19.171577] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.171634] kthread+0x328/0x630 [ 19.171976] ret_from_fork+0x10/0x20 [ 19.172238] [ 19.172373] The buggy address belongs to the physical page: [ 19.172450] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10789c [ 19.172600] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.172655] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.172722] page_type: f8(unknown) [ 19.172763] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.172958] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.173032] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.173305] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.173439] head: 0bfffe0000000002 ffffc1ffc31e2701 00000000ffffffff 00000000ffffffff [ 19.173493] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 19.173581] page dumped because: kasan: bad access detected [ 19.173832] [ 19.173891] Memory state around the buggy address: [ 19.174021] fff00000c789bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.174128] fff00000c789bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.174280] >fff00000c789c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.174380] ^ [ 19.174534] fff00000c789c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.174611] fff00000c789c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.174660] ==================================================================
[ 14.399007] ================================================================== [ 14.399959] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 14.400209] Read of size 1 at addr ffff888103a40000 by task kunit_try_catch/250 [ 14.400433] [ 14.400528] CPU: 0 UID: 0 PID: 250 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.400577] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.400588] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.400621] Call Trace: [ 14.400634] <TASK> [ 14.400652] dump_stack_lvl+0x73/0xb0 [ 14.400683] print_report+0xd1/0x650 [ 14.400705] ? __virt_addr_valid+0x1db/0x2d0 [ 14.400731] ? mempool_uaf_helper+0x392/0x400 [ 14.400755] ? kasan_addr_to_slab+0x11/0xa0 [ 14.400801] ? mempool_uaf_helper+0x392/0x400 [ 14.400825] kasan_report+0x141/0x180 [ 14.400847] ? mempool_uaf_helper+0x392/0x400 [ 14.400874] __asan_report_load1_noabort+0x18/0x20 [ 14.400900] mempool_uaf_helper+0x392/0x400 [ 14.400923] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 14.400947] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.400972] ? finish_task_switch.isra.0+0x153/0x700 [ 14.401000] mempool_page_alloc_uaf+0xed/0x140 [ 14.401024] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 14.401051] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 14.401079] ? __pfx_mempool_free_pages+0x10/0x10 [ 14.401105] ? __pfx_read_tsc+0x10/0x10 [ 14.401128] ? ktime_get_ts64+0x86/0x230 [ 14.401154] kunit_try_run_case+0x1a5/0x480 [ 14.401180] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.401203] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.401229] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.401253] ? __kthread_parkme+0x82/0x180 [ 14.401275] ? preempt_count_sub+0x50/0x80 [ 14.401298] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.401323] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.401347] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.401372] kthread+0x337/0x6f0 [ 14.401391] ? trace_preempt_on+0x20/0xc0 [ 14.401415] ? __pfx_kthread+0x10/0x10 [ 14.401435] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.401457] ? calculate_sigpending+0x7b/0xa0 [ 14.401482] ? __pfx_kthread+0x10/0x10 [ 14.401503] ret_from_fork+0x116/0x1d0 [ 14.401522] ? __pfx_kthread+0x10/0x10 [ 14.401542] ret_from_fork_asm+0x1a/0x30 [ 14.401588] </TASK> [ 14.401608] [ 14.409549] The buggy address belongs to the physical page: [ 14.409753] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a40 [ 14.410014] flags: 0x200000000000000(node=0|zone=2) [ 14.410269] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 14.410619] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 14.410906] page dumped because: kasan: bad access detected [ 14.411078] [ 14.411146] Memory state around the buggy address: [ 14.411564] ffff888103a3ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.411909] ffff888103a3ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.412426] >ffff888103a40000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.412654] ^ [ 14.412770] ffff888103a40080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.413433] ffff888103a40100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.414166] ================================================================== [ 14.329520] ================================================================== [ 14.330098] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 14.330763] Read of size 1 at addr ffff888103a40000 by task kunit_try_catch/246 [ 14.331248] [ 14.331349] CPU: 0 UID: 0 PID: 246 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.331395] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.331407] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.331428] Call Trace: [ 14.331441] <TASK> [ 14.331457] dump_stack_lvl+0x73/0xb0 [ 14.331488] print_report+0xd1/0x650 [ 14.331510] ? __virt_addr_valid+0x1db/0x2d0 [ 14.331534] ? mempool_uaf_helper+0x392/0x400 [ 14.331555] ? kasan_addr_to_slab+0x11/0xa0 [ 14.331575] ? mempool_uaf_helper+0x392/0x400 [ 14.331610] kasan_report+0x141/0x180 [ 14.331631] ? mempool_uaf_helper+0x392/0x400 [ 14.331658] __asan_report_load1_noabort+0x18/0x20 [ 14.331683] mempool_uaf_helper+0x392/0x400 [ 14.331705] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 14.331730] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.331753] ? finish_task_switch.isra.0+0x153/0x700 [ 14.331792] mempool_kmalloc_large_uaf+0xef/0x140 [ 14.331816] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 14.331844] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.331868] ? __pfx_mempool_kfree+0x10/0x10 [ 14.331917] ? __pfx_read_tsc+0x10/0x10 [ 14.331938] ? ktime_get_ts64+0x86/0x230 [ 14.331963] kunit_try_run_case+0x1a5/0x480 [ 14.331989] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.332013] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.332059] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.332083] ? __kthread_parkme+0x82/0x180 [ 14.332105] ? preempt_count_sub+0x50/0x80 [ 14.332127] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.332151] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.332194] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.332220] kthread+0x337/0x6f0 [ 14.332238] ? trace_preempt_on+0x20/0xc0 [ 14.332262] ? __pfx_kthread+0x10/0x10 [ 14.332282] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.332303] ? calculate_sigpending+0x7b/0xa0 [ 14.332328] ? __pfx_kthread+0x10/0x10 [ 14.332349] ret_from_fork+0x116/0x1d0 [ 14.332367] ? __pfx_kthread+0x10/0x10 [ 14.332387] ret_from_fork_asm+0x1a/0x30 [ 14.332418] </TASK> [ 14.332428] [ 14.345516] The buggy address belongs to the physical page: [ 14.345920] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a40 [ 14.346421] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 14.346745] flags: 0x200000000000040(head|node=0|zone=2) [ 14.347036] page_type: f8(unknown) [ 14.347217] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.347573] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.347827] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.348360] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.348813] head: 0200000000000002 ffffea00040e9001 00000000ffffffff 00000000ffffffff [ 14.349170] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 14.349408] page dumped because: kasan: bad access detected [ 14.349689] [ 14.349785] Memory state around the buggy address: [ 14.350221] ffff888103a3ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.350512] ffff888103a3ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.350803] >ffff888103a40000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.351244] ^ [ 14.351426] ffff888103a40080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.351677] ffff888103a40100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.352214] ==================================================================