Date
July 10, 2025, 6:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.936715] ================================================================== [ 18.937018] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 18.937202] Read of size 1 at addr fff00000c7958000 by task kunit_try_catch/233 [ 18.937398] [ 18.937600] CPU: 0 UID: 0 PID: 233 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 18.937976] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.938002] Hardware name: linux,dummy-virt (DT) [ 18.938483] Call trace: [ 18.938602] show_stack+0x20/0x38 (C) [ 18.938681] dump_stack_lvl+0x8c/0xd0 [ 18.938755] print_report+0x118/0x608 [ 18.938876] kasan_report+0xdc/0x128 [ 18.938925] __asan_report_load1_noabort+0x20/0x30 [ 18.939367] mempool_uaf_helper+0x314/0x340 [ 18.939470] mempool_page_alloc_uaf+0xc0/0x118 [ 18.939519] kunit_try_run_case+0x170/0x3f0 [ 18.939583] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.939635] kthread+0x328/0x630 [ 18.939919] ret_from_fork+0x10/0x20 [ 18.940300] [ 18.940325] The buggy address belongs to the physical page: [ 18.940370] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107958 [ 18.940732] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.940809] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 18.940860] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 18.940902] page dumped because: kasan: bad access detected [ 18.940943] [ 18.940962] Memory state around the buggy address: [ 18.940993] fff00000c7957f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.941352] fff00000c7957f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.941399] >fff00000c7958000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.941712] ^ [ 18.941833] fff00000c7958080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.941876] fff00000c7958100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.942233] ================================================================== [ 18.875701] ================================================================== [ 18.875919] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 18.876102] Read of size 1 at addr fff00000c7954000 by task kunit_try_catch/229 [ 18.876273] [ 18.876617] CPU: 0 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 18.877424] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.877658] Hardware name: linux,dummy-virt (DT) [ 18.877848] Call trace: [ 18.877896] show_stack+0x20/0x38 (C) [ 18.878575] dump_stack_lvl+0x8c/0xd0 [ 18.878668] print_report+0x118/0x608 [ 18.878786] kasan_report+0xdc/0x128 [ 18.879142] __asan_report_load1_noabort+0x20/0x30 [ 18.879314] mempool_uaf_helper+0x314/0x340 [ 18.879373] mempool_kmalloc_large_uaf+0xc4/0x120 [ 18.879424] kunit_try_run_case+0x170/0x3f0 [ 18.879786] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.879876] kthread+0x328/0x630 [ 18.879938] ret_from_fork+0x10/0x20 [ 18.880019] [ 18.880042] The buggy address belongs to the physical page: [ 18.880310] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107954 [ 18.880384] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.880442] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.880496] page_type: f8(unknown) [ 18.880753] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.880955] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.881072] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.881389] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.881459] head: 0bfffe0000000002 ffffc1ffc31e5501 00000000ffffffff 00000000ffffffff [ 18.881545] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.881588] page dumped because: kasan: bad access detected [ 18.881620] [ 18.881660] Memory state around the buggy address: [ 18.881790] fff00000c7953f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.881833] fff00000c7953f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.881951] >fff00000c7954000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.881991] ^ [ 18.882020] fff00000c7954080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.882063] fff00000c7954100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.882367] ==================================================================
[ 14.016677] ================================================================== [ 14.017302] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 14.017533] Read of size 1 at addr ffff888102ad0000 by task kunit_try_catch/246 [ 14.018401] [ 14.018680] CPU: 0 UID: 0 PID: 246 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.018730] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.018744] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.018766] Call Trace: [ 14.018779] <TASK> [ 14.018793] dump_stack_lvl+0x73/0xb0 [ 14.018825] print_report+0xd1/0x650 [ 14.018848] ? __virt_addr_valid+0x1db/0x2d0 [ 14.018872] ? mempool_uaf_helper+0x392/0x400 [ 14.018895] ? kasan_addr_to_slab+0x11/0xa0 [ 14.018916] ? mempool_uaf_helper+0x392/0x400 [ 14.018940] kasan_report+0x141/0x180 [ 14.018962] ? mempool_uaf_helper+0x392/0x400 [ 14.018990] __asan_report_load1_noabort+0x18/0x20 [ 14.019016] mempool_uaf_helper+0x392/0x400 [ 14.019049] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 14.019075] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.019099] ? finish_task_switch.isra.0+0x153/0x700 [ 14.019126] mempool_kmalloc_large_uaf+0xef/0x140 [ 14.019149] ? __pfx_mempool_kmalloc_large_uaf+0x10/0x10 [ 14.019177] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.019201] ? __pfx_mempool_kfree+0x10/0x10 [ 14.019227] ? __pfx_read_tsc+0x10/0x10 [ 14.019249] ? ktime_get_ts64+0x86/0x230 [ 14.019273] kunit_try_run_case+0x1a5/0x480 [ 14.019298] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.019321] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.019345] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.019370] ? __kthread_parkme+0x82/0x180 [ 14.019390] ? preempt_count_sub+0x50/0x80 [ 14.019414] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.019439] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.019464] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.019489] kthread+0x337/0x6f0 [ 14.019508] ? trace_preempt_on+0x20/0xc0 [ 14.019532] ? __pfx_kthread+0x10/0x10 [ 14.019552] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.019574] ? calculate_sigpending+0x7b/0xa0 [ 14.019598] ? __pfx_kthread+0x10/0x10 [ 14.019619] ret_from_fork+0x116/0x1d0 [ 14.019639] ? __pfx_kthread+0x10/0x10 [ 14.019659] ret_from_fork_asm+0x1a/0x30 [ 14.019689] </TASK> [ 14.019699] [ 14.034285] The buggy address belongs to the physical page: [ 14.034785] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ad0 [ 14.035566] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 14.036359] flags: 0x200000000000040(head|node=0|zone=2) [ 14.036712] page_type: f8(unknown) [ 14.037269] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.037609] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.037950] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.038863] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.039594] head: 0200000000000002 ffffea00040ab401 00000000ffffffff 00000000ffffffff [ 14.040286] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 14.040738] page dumped because: kasan: bad access detected [ 14.041225] [ 14.041384] Memory state around the buggy address: [ 14.041847] ffff888102acff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.042481] ffff888102acff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.042712] >ffff888102ad0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.043057] ^ [ 14.043406] ffff888102ad0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.044101] ffff888102ad0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.044730] ================================================================== [ 14.093608] ================================================================== [ 14.094774] BUG: KASAN: use-after-free in mempool_uaf_helper+0x392/0x400 [ 14.095020] Read of size 1 at addr ffff888102ad4000 by task kunit_try_catch/250 [ 14.095639] [ 14.095848] CPU: 0 UID: 0 PID: 250 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.095931] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.095952] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.095986] Call Trace: [ 14.095999] <TASK> [ 14.096015] dump_stack_lvl+0x73/0xb0 [ 14.096060] print_report+0xd1/0x650 [ 14.096082] ? __virt_addr_valid+0x1db/0x2d0 [ 14.096107] ? mempool_uaf_helper+0x392/0x400 [ 14.096129] ? kasan_addr_to_slab+0x11/0xa0 [ 14.096149] ? mempool_uaf_helper+0x392/0x400 [ 14.096171] kasan_report+0x141/0x180 [ 14.096192] ? mempool_uaf_helper+0x392/0x400 [ 14.096247] __asan_report_load1_noabort+0x18/0x20 [ 14.096274] mempool_uaf_helper+0x392/0x400 [ 14.096297] ? __pfx_mempool_uaf_helper+0x10/0x10 [ 14.096323] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.096347] ? finish_task_switch.isra.0+0x153/0x700 [ 14.096375] mempool_page_alloc_uaf+0xed/0x140 [ 14.096399] ? __pfx_mempool_page_alloc_uaf+0x10/0x10 [ 14.096426] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 14.096451] ? __pfx_mempool_free_pages+0x10/0x10 [ 14.096478] ? __pfx_read_tsc+0x10/0x10 [ 14.096500] ? ktime_get_ts64+0x86/0x230 [ 14.096525] kunit_try_run_case+0x1a5/0x480 [ 14.096550] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.096573] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.096597] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.096621] ? __kthread_parkme+0x82/0x180 [ 14.096641] ? preempt_count_sub+0x50/0x80 [ 14.096665] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.096688] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.096713] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.096738] kthread+0x337/0x6f0 [ 14.096757] ? trace_preempt_on+0x20/0xc0 [ 14.096780] ? __pfx_kthread+0x10/0x10 [ 14.096801] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.096836] ? calculate_sigpending+0x7b/0xa0 [ 14.096860] ? __pfx_kthread+0x10/0x10 [ 14.096881] ret_from_fork+0x116/0x1d0 [ 14.096901] ? __pfx_kthread+0x10/0x10 [ 14.096921] ret_from_fork_asm+0x1a/0x30 [ 14.096960] </TASK> [ 14.096970] [ 14.110975] The buggy address belongs to the physical page: [ 14.111196] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ad4 [ 14.111688] flags: 0x200000000000000(node=0|zone=2) [ 14.111866] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 14.112470] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 14.112694] page dumped because: kasan: bad access detected [ 14.113183] [ 14.113283] Memory state around the buggy address: [ 14.113550] ffff888102ad3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.113886] ffff888102ad3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.114219] >ffff888102ad4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.114454] ^ [ 14.114615] ffff888102ad4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.115189] ffff888102ad4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.115514] ==================================================================