Date
July 8, 2025, 7:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.269867] ================================================================== [ 19.269922] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x3bc/0x438 [ 19.269970] Read of size 16 at addr fff00000c564f340 by task kunit_try_catch/168 [ 19.270019] [ 19.270048] CPU: 1 UID: 0 PID: 168 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.270125] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.270151] Hardware name: linux,dummy-virt (DT) [ 19.270179] Call trace: [ 19.270200] show_stack+0x20/0x38 (C) [ 19.270246] dump_stack_lvl+0x8c/0xd0 [ 19.270304] print_report+0x118/0x608 [ 19.270348] kasan_report+0xdc/0x128 [ 19.270413] __asan_report_load16_noabort+0x20/0x30 [ 19.270464] kmalloc_uaf_16+0x3bc/0x438 [ 19.270506] kunit_try_run_case+0x170/0x3f0 [ 19.270552] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.270602] kthread+0x328/0x630 [ 19.270641] ret_from_fork+0x10/0x20 [ 19.270695] [ 19.271481] Allocated by task 168: [ 19.271558] kasan_save_stack+0x3c/0x68 [ 19.271602] kasan_save_track+0x20/0x40 [ 19.271637] kasan_save_alloc_info+0x40/0x58 [ 19.271756] __kasan_kmalloc+0xd4/0xd8 [ 19.272788] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.272951] kmalloc_uaf_16+0x140/0x438 [ 19.273120] kunit_try_run_case+0x170/0x3f0 [ 19.273196] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.273239] kthread+0x328/0x630 [ 19.273669] ret_from_fork+0x10/0x20 [ 19.274367] [ 19.274497] Freed by task 168: [ 19.274575] kasan_save_stack+0x3c/0x68 [ 19.274739] kasan_save_track+0x20/0x40 [ 19.274896] kasan_save_free_info+0x4c/0x78 [ 19.274946] __kasan_slab_free+0x6c/0x98 [ 19.275120] kfree+0x214/0x3c8 [ 19.275564] kmalloc_uaf_16+0x190/0x438 [ 19.275648] kunit_try_run_case+0x170/0x3f0 [ 19.275754] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.275860] kthread+0x328/0x630 [ 19.275986] ret_from_fork+0x10/0x20 [ 19.276111] [ 19.276184] The buggy address belongs to the object at fff00000c564f340 [ 19.276184] which belongs to the cache kmalloc-16 of size 16 [ 19.276385] The buggy address is located 0 bytes inside of [ 19.276385] freed 16-byte region [fff00000c564f340, fff00000c564f350) [ 19.276471] [ 19.276490] The buggy address belongs to the physical page: [ 19.276845] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10564f [ 19.276953] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.277069] page_type: f5(slab) [ 19.277129] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 19.277197] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 19.277544] page dumped because: kasan: bad access detected [ 19.277604] [ 19.277639] Memory state around the buggy address: [ 19.277777] fff00000c564f200: fa fb fc fc fa fb fc fc 00 01 fc fc fa fb fc fc [ 19.277930] fff00000c564f280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 19.278165] >fff00000c564f300: fa fb fc fc 00 00 fc fc fa fb fc fc fc fc fc fc [ 19.278205] ^ [ 19.278574] fff00000c564f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.278702] fff00000c564f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.278752] ==================================================================
[ 12.918474] ================================================================== [ 12.919622] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x47b/0x4c0 [ 12.920261] Read of size 16 at addr ffff88810256a300 by task kunit_try_catch/185 [ 12.920996] [ 12.921240] CPU: 1 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.921286] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.921298] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.921318] Call Trace: [ 12.921330] <TASK> [ 12.921347] dump_stack_lvl+0x73/0xb0 [ 12.921377] print_report+0xd1/0x650 [ 12.921399] ? __virt_addr_valid+0x1db/0x2d0 [ 12.921422] ? kmalloc_uaf_16+0x47b/0x4c0 [ 12.921441] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.921466] ? kmalloc_uaf_16+0x47b/0x4c0 [ 12.921485] kasan_report+0x141/0x180 [ 12.921525] ? kmalloc_uaf_16+0x47b/0x4c0 [ 12.921555] __asan_report_load16_noabort+0x18/0x20 [ 12.921578] kmalloc_uaf_16+0x47b/0x4c0 [ 12.921597] ? __pfx_kmalloc_uaf_16+0x10/0x10 [ 12.921618] ? __schedule+0x10cc/0x2b60 [ 12.921640] ? __pfx_read_tsc+0x10/0x10 [ 12.921660] ? ktime_get_ts64+0x86/0x230 [ 12.921684] kunit_try_run_case+0x1a5/0x480 [ 12.921707] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.921728] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.921750] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.921771] ? __kthread_parkme+0x82/0x180 [ 12.921791] ? preempt_count_sub+0x50/0x80 [ 12.921814] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.921836] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.921857] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.921879] kthread+0x337/0x6f0 [ 12.921897] ? trace_preempt_on+0x20/0xc0 [ 12.921919] ? __pfx_kthread+0x10/0x10 [ 12.921938] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.921957] ? calculate_sigpending+0x7b/0xa0 [ 12.921980] ? __pfx_kthread+0x10/0x10 [ 12.922000] ret_from_fork+0x116/0x1d0 [ 12.922018] ? __pfx_kthread+0x10/0x10 [ 12.922037] ret_from_fork_asm+0x1a/0x30 [ 12.922090] </TASK> [ 12.922101] [ 12.931643] Allocated by task 185: [ 12.932070] kasan_save_stack+0x45/0x70 [ 12.932432] kasan_save_track+0x18/0x40 [ 12.932820] kasan_save_alloc_info+0x3b/0x50 [ 12.933302] __kasan_kmalloc+0xb7/0xc0 [ 12.933700] __kmalloc_cache_noprof+0x189/0x420 [ 12.934135] kmalloc_uaf_16+0x15b/0x4c0 [ 12.934474] kunit_try_run_case+0x1a5/0x480 [ 12.934896] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.935491] kthread+0x337/0x6f0 [ 12.935844] ret_from_fork+0x116/0x1d0 [ 12.936145] ret_from_fork_asm+0x1a/0x30 [ 12.936656] [ 12.936829] Freed by task 185: [ 12.937164] kasan_save_stack+0x45/0x70 [ 12.937535] kasan_save_track+0x18/0x40 [ 12.937935] kasan_save_free_info+0x3f/0x60 [ 12.938368] __kasan_slab_free+0x56/0x70 [ 12.938794] kfree+0x222/0x3f0 [ 12.939101] kmalloc_uaf_16+0x1d6/0x4c0 [ 12.939547] kunit_try_run_case+0x1a5/0x480 [ 12.940003] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.940332] kthread+0x337/0x6f0 [ 12.940635] ret_from_fork+0x116/0x1d0 [ 12.941110] ret_from_fork_asm+0x1a/0x30 [ 12.941451] [ 12.941535] The buggy address belongs to the object at ffff88810256a300 [ 12.941535] which belongs to the cache kmalloc-16 of size 16 [ 12.941896] The buggy address is located 0 bytes inside of [ 12.941896] freed 16-byte region [ffff88810256a300, ffff88810256a310) [ 12.942619] [ 12.942756] The buggy address belongs to the physical page: [ 12.943026] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10256a [ 12.943386] flags: 0x200000000000000(node=0|zone=2) [ 12.943666] page_type: f5(slab) [ 12.943816] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 12.944088] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 12.944350] page dumped because: kasan: bad access detected [ 12.944696] [ 12.944788] Memory state around the buggy address: [ 12.945009] ffff88810256a200: 00 02 fc fc 00 02 fc fc 00 02 fc fc fa fb fc fc [ 12.945893] ffff88810256a280: fa fb fc fc fa fb fc fc 00 05 fc fc 00 00 fc fc [ 12.946447] >ffff88810256a300: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.946896] ^ [ 12.947310] ffff88810256a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.947766] ffff88810256a400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.948324] ==================================================================