Date
July 18, 2025, 2:09 p.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 |
[ 17.150837] ================================================================== [ 17.151906] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310 [ 17.152097] Write of size 33 at addr fff00000c7894e80 by task kunit_try_catch/186 [ 17.152219] [ 17.152362] CPU: 1 UID: 0 PID: 186 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 17.152474] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.152502] Hardware name: linux,dummy-virt (DT) [ 17.152535] Call trace: [ 17.152558] show_stack+0x20/0x38 (C) [ 17.152878] dump_stack_lvl+0x8c/0xd0 [ 17.152993] print_report+0x118/0x5d0 [ 17.153151] kasan_report+0xdc/0x128 [ 17.153260] kasan_check_range+0x100/0x1a8 [ 17.153432] __asan_memset+0x34/0x78 [ 17.153634] kmalloc_uaf_memset+0x170/0x310 [ 17.153706] kunit_try_run_case+0x170/0x3f0 [ 17.154019] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.154192] kthread+0x328/0x630 [ 17.154371] ret_from_fork+0x10/0x20 [ 17.154530] [ 17.154673] Allocated by task 186: [ 17.154709] kasan_save_stack+0x3c/0x68 [ 17.155018] kasan_save_track+0x20/0x40 [ 17.155189] kasan_save_alloc_info+0x40/0x58 [ 17.155277] __kasan_kmalloc+0xd4/0xd8 [ 17.155442] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.155528] kmalloc_uaf_memset+0xb8/0x310 [ 17.155703] kunit_try_run_case+0x170/0x3f0 [ 17.155741] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.155785] kthread+0x328/0x630 [ 17.156230] ret_from_fork+0x10/0x20 [ 17.156319] [ 17.156367] Freed by task 186: [ 17.156688] kasan_save_stack+0x3c/0x68 [ 17.156746] kasan_save_track+0x20/0x40 [ 17.157147] kasan_save_free_info+0x4c/0x78 [ 17.157456] __kasan_slab_free+0x6c/0x98 [ 17.157639] kfree+0x214/0x3c8 [ 17.157899] kmalloc_uaf_memset+0x11c/0x310 [ 17.158011] kunit_try_run_case+0x170/0x3f0 [ 17.158519] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.158658] kthread+0x328/0x630 [ 17.158730] ret_from_fork+0x10/0x20 [ 17.158918] [ 17.159007] The buggy address belongs to the object at fff00000c7894e80 [ 17.159007] which belongs to the cache kmalloc-64 of size 64 [ 17.159107] The buggy address is located 0 bytes inside of [ 17.159107] freed 64-byte region [fff00000c7894e80, fff00000c7894ec0) [ 17.159487] [ 17.159613] The buggy address belongs to the physical page: [ 17.159753] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107894 [ 17.159896] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.160010] page_type: f5(slab) [ 17.160098] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 17.160150] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 17.160192] page dumped because: kasan: bad access detected [ 17.160382] [ 17.160660] Memory state around the buggy address: [ 17.160706] fff00000c7894d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 17.160914] fff00000c7894e00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 17.161013] >fff00000c7894e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 17.161263] ^ [ 17.161387] fff00000c7894f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.161519] fff00000c7894f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.161609] ==================================================================
[ 16.783606] ================================================================== [ 16.783699] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310 [ 16.783862] Write of size 33 at addr fff00000c7951480 by task kunit_try_catch/186 [ 16.783917] [ 16.783978] CPU: 1 UID: 0 PID: 186 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.784411] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.784447] Hardware name: linux,dummy-virt (DT) [ 16.784557] Call trace: [ 16.784615] show_stack+0x20/0x38 (C) [ 16.784694] dump_stack_lvl+0x8c/0xd0 [ 16.784909] print_report+0x118/0x5d0 [ 16.785134] kasan_report+0xdc/0x128 [ 16.785248] kasan_check_range+0x100/0x1a8 [ 16.785376] __asan_memset+0x34/0x78 [ 16.785425] kmalloc_uaf_memset+0x170/0x310 [ 16.785675] kunit_try_run_case+0x170/0x3f0 [ 16.785853] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.785938] kthread+0x328/0x630 [ 16.786081] ret_from_fork+0x10/0x20 [ 16.786192] [ 16.786298] Allocated by task 186: [ 16.786398] kasan_save_stack+0x3c/0x68 [ 16.786825] kasan_save_track+0x20/0x40 [ 16.786914] kasan_save_alloc_info+0x40/0x58 [ 16.787077] __kasan_kmalloc+0xd4/0xd8 [ 16.787174] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.787335] kmalloc_uaf_memset+0xb8/0x310 [ 16.787549] kunit_try_run_case+0x170/0x3f0 [ 16.787748] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.787828] kthread+0x328/0x630 [ 16.787940] ret_from_fork+0x10/0x20 [ 16.788063] [ 16.788143] Freed by task 186: [ 16.788344] kasan_save_stack+0x3c/0x68 [ 16.788503] kasan_save_track+0x20/0x40 [ 16.788583] kasan_save_free_info+0x4c/0x78 [ 16.788975] __kasan_slab_free+0x6c/0x98 [ 16.789067] kfree+0x214/0x3c8 [ 16.789158] kmalloc_uaf_memset+0x11c/0x310 [ 16.789301] kunit_try_run_case+0x170/0x3f0 [ 16.789476] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.789524] kthread+0x328/0x630 [ 16.789872] ret_from_fork+0x10/0x20 [ 16.790053] [ 16.790123] The buggy address belongs to the object at fff00000c7951480 [ 16.790123] which belongs to the cache kmalloc-64 of size 64 [ 16.790295] The buggy address is located 0 bytes inside of [ 16.790295] freed 64-byte region [fff00000c7951480, fff00000c79514c0) [ 16.790504] [ 16.790565] The buggy address belongs to the physical page: [ 16.790621] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107951 [ 16.790851] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.790947] page_type: f5(slab) [ 16.791080] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 16.791189] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 16.791242] page dumped because: kasan: bad access detected [ 16.791274] [ 16.791313] Memory state around the buggy address: [ 16.791364] fff00000c7951380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.791408] fff00000c7951400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.791457] >fff00000c7951480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.791511] ^ [ 16.791551] fff00000c7951500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.791613] fff00000c7951580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.791651] ==================================================================
[ 16.798972] ================================================================== [ 16.799191] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310 [ 16.799337] Write of size 33 at addr fff00000c7752080 by task kunit_try_catch/186 [ 16.799428] [ 16.799465] CPU: 0 UID: 0 PID: 186 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.799566] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.799593] Hardware name: linux,dummy-virt (DT) [ 16.799626] Call trace: [ 16.799648] show_stack+0x20/0x38 (C) [ 16.799698] dump_stack_lvl+0x8c/0xd0 [ 16.799901] print_report+0x118/0x5d0 [ 16.799952] kasan_report+0xdc/0x128 [ 16.800000] kasan_check_range+0x100/0x1a8 [ 16.800050] __asan_memset+0x34/0x78 [ 16.800091] kmalloc_uaf_memset+0x170/0x310 [ 16.800329] kunit_try_run_case+0x170/0x3f0 [ 16.800415] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.800500] kthread+0x328/0x630 [ 16.800600] ret_from_fork+0x10/0x20 [ 16.800679] [ 16.800786] Allocated by task 186: [ 16.800901] kasan_save_stack+0x3c/0x68 [ 16.800999] kasan_save_track+0x20/0x40 [ 16.801094] kasan_save_alloc_info+0x40/0x58 [ 16.801212] __kasan_kmalloc+0xd4/0xd8 [ 16.801267] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.801311] kmalloc_uaf_memset+0xb8/0x310 [ 16.801624] kunit_try_run_case+0x170/0x3f0 [ 16.801689] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.801745] kthread+0x328/0x630 [ 16.801793] ret_from_fork+0x10/0x20 [ 16.801827] [ 16.801851] Freed by task 186: [ 16.801890] kasan_save_stack+0x3c/0x68 [ 16.801937] kasan_save_track+0x20/0x40 [ 16.801984] kasan_save_free_info+0x4c/0x78 [ 16.802023] __kasan_slab_free+0x6c/0x98 [ 16.802058] kfree+0x214/0x3c8 [ 16.802092] kmalloc_uaf_memset+0x11c/0x310 [ 16.802126] kunit_try_run_case+0x170/0x3f0 [ 16.802163] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.802206] kthread+0x328/0x630 [ 16.802236] ret_from_fork+0x10/0x20 [ 16.802287] [ 16.802305] The buggy address belongs to the object at fff00000c7752080 [ 16.802305] which belongs to the cache kmalloc-64 of size 64 [ 16.802362] The buggy address is located 0 bytes inside of [ 16.802362] freed 64-byte region [fff00000c7752080, fff00000c77520c0) [ 16.802421] [ 16.802441] The buggy address belongs to the physical page: [ 16.802473] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107752 [ 16.802525] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.802574] page_type: f5(slab) [ 16.802624] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 16.802693] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 16.802747] page dumped because: kasan: bad access detected [ 16.802779] [ 16.802797] Memory state around the buggy address: [ 16.802828] fff00000c7751f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.802871] fff00000c7752000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.802914] >fff00000c7752080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.802952] ^ [ 16.802980] fff00000c7752100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.803220] fff00000c7752180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.803358] ==================================================================
[ 12.525273] ================================================================== [ 12.525761] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360 [ 12.526092] Write of size 33 at addr ffff888102e2d900 by task kunit_try_catch/203 [ 12.526382] [ 12.526490] CPU: 0 UID: 0 PID: 203 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.526534] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.526545] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.526567] Call Trace: [ 12.526578] <TASK> [ 12.526596] dump_stack_lvl+0x73/0xb0 [ 12.526624] print_report+0xd1/0x610 [ 12.526646] ? __virt_addr_valid+0x1db/0x2d0 [ 12.526669] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.526689] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.526710] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.526730] kasan_report+0x141/0x180 [ 12.526751] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.526782] kasan_check_range+0x10c/0x1c0 [ 12.526805] __asan_memset+0x27/0x50 [ 12.526823] kmalloc_uaf_memset+0x1a3/0x360 [ 12.526842] ? __pfx_kmalloc_uaf_memset+0x10/0x10 [ 12.526863] ? __schedule+0x10cc/0x2b60 [ 12.526884] ? __pfx_read_tsc+0x10/0x10 [ 12.526945] ? ktime_get_ts64+0x86/0x230 [ 12.526987] kunit_try_run_case+0x1a5/0x480 [ 12.527012] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.527033] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.527058] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.527081] ? __kthread_parkme+0x82/0x180 [ 12.527101] ? preempt_count_sub+0x50/0x80 [ 12.527125] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.527148] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.527171] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.527194] kthread+0x337/0x6f0 [ 12.527213] ? trace_preempt_on+0x20/0xc0 [ 12.527236] ? __pfx_kthread+0x10/0x10 [ 12.527256] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.527276] ? calculate_sigpending+0x7b/0xa0 [ 12.527325] ? __pfx_kthread+0x10/0x10 [ 12.527345] ret_from_fork+0x116/0x1d0 [ 12.527363] ? __pfx_kthread+0x10/0x10 [ 12.527382] ret_from_fork_asm+0x1a/0x30 [ 12.527414] </TASK> [ 12.527425] [ 12.535349] Allocated by task 203: [ 12.535608] kasan_save_stack+0x45/0x70 [ 12.535844] kasan_save_track+0x18/0x40 [ 12.536048] kasan_save_alloc_info+0x3b/0x50 [ 12.536251] __kasan_kmalloc+0xb7/0xc0 [ 12.536422] __kmalloc_cache_noprof+0x189/0x420 [ 12.536703] kmalloc_uaf_memset+0xa9/0x360 [ 12.536948] kunit_try_run_case+0x1a5/0x480 [ 12.537172] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.537391] kthread+0x337/0x6f0 [ 12.537656] ret_from_fork+0x116/0x1d0 [ 12.537841] ret_from_fork_asm+0x1a/0x30 [ 12.538113] [ 12.538229] Freed by task 203: [ 12.538414] kasan_save_stack+0x45/0x70 [ 12.538686] kasan_save_track+0x18/0x40 [ 12.538887] kasan_save_free_info+0x3f/0x60 [ 12.539130] __kasan_slab_free+0x56/0x70 [ 12.539324] kfree+0x222/0x3f0 [ 12.539486] kmalloc_uaf_memset+0x12b/0x360 [ 12.539700] kunit_try_run_case+0x1a5/0x480 [ 12.539916] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.540220] kthread+0x337/0x6f0 [ 12.540360] ret_from_fork+0x116/0x1d0 [ 12.540663] ret_from_fork_asm+0x1a/0x30 [ 12.540885] [ 12.540994] The buggy address belongs to the object at ffff888102e2d900 [ 12.540994] which belongs to the cache kmalloc-64 of size 64 [ 12.541500] The buggy address is located 0 bytes inside of [ 12.541500] freed 64-byte region [ffff888102e2d900, ffff888102e2d940) [ 12.542111] [ 12.542228] The buggy address belongs to the physical page: [ 12.542482] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102e2d [ 12.542910] flags: 0x200000000000000(node=0|zone=2) [ 12.543187] page_type: f5(slab) [ 12.543342] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 12.543789] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 12.544192] page dumped because: kasan: bad access detected [ 12.544449] [ 12.544611] Memory state around the buggy address: [ 12.544840] ffff888102e2d800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.545163] ffff888102e2d880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.545478] >ffff888102e2d900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.545784] ^ [ 12.545954] ffff888102e2d980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.546167] ffff888102e2da00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.546377] ==================================================================
[ 12.289339] ================================================================== [ 12.289967] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360 [ 12.290210] Write of size 33 at addr ffff8881026e1080 by task kunit_try_catch/204 [ 12.290458] [ 12.290552] CPU: 1 UID: 0 PID: 204 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.290597] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.290608] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.290629] Call Trace: [ 12.290641] <TASK> [ 12.290658] dump_stack_lvl+0x73/0xb0 [ 12.290688] print_report+0xd1/0x610 [ 12.290710] ? __virt_addr_valid+0x1db/0x2d0 [ 12.290733] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.290754] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.290777] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.290798] kasan_report+0x141/0x180 [ 12.290819] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.290846] kasan_check_range+0x10c/0x1c0 [ 12.290869] __asan_memset+0x27/0x50 [ 12.290888] kmalloc_uaf_memset+0x1a3/0x360 [ 12.290909] ? __pfx_kmalloc_uaf_memset+0x10/0x10 [ 12.290931] ? __schedule+0x10cc/0x2b60 [ 12.290953] ? __pfx_read_tsc+0x10/0x10 [ 12.290973] ? ktime_get_ts64+0x86/0x230 [ 12.290999] kunit_try_run_case+0x1a5/0x480 [ 12.291023] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.291045] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.291068] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.291091] ? __kthread_parkme+0x82/0x180 [ 12.291110] ? preempt_count_sub+0x50/0x80 [ 12.291134] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.291158] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.291181] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.291204] kthread+0x337/0x6f0 [ 12.291222] ? trace_preempt_on+0x20/0xc0 [ 12.291245] ? __pfx_kthread+0x10/0x10 [ 12.291265] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.291285] ? calculate_sigpending+0x7b/0xa0 [ 12.291309] ? __pfx_kthread+0x10/0x10 [ 12.291330] ret_from_fork+0x116/0x1d0 [ 12.291348] ? __pfx_kthread+0x10/0x10 [ 12.291367] ret_from_fork_asm+0x1a/0x30 [ 12.291399] </TASK> [ 12.291409] [ 12.309934] Allocated by task 204: [ 12.310148] kasan_save_stack+0x45/0x70 [ 12.310669] kasan_save_track+0x18/0x40 [ 12.310998] kasan_save_alloc_info+0x3b/0x50 [ 12.311147] __kasan_kmalloc+0xb7/0xc0 [ 12.311276] __kmalloc_cache_noprof+0x189/0x420 [ 12.311496] kmalloc_uaf_memset+0xa9/0x360 [ 12.311951] kunit_try_run_case+0x1a5/0x480 [ 12.312354] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.312989] kthread+0x337/0x6f0 [ 12.313342] ret_from_fork+0x116/0x1d0 [ 12.313794] ret_from_fork_asm+0x1a/0x30 [ 12.314188] [ 12.314388] Freed by task 204: [ 12.314776] kasan_save_stack+0x45/0x70 [ 12.314918] kasan_save_track+0x18/0x40 [ 12.315049] kasan_save_free_info+0x3f/0x60 [ 12.315190] __kasan_slab_free+0x56/0x70 [ 12.315322] kfree+0x222/0x3f0 [ 12.315477] kmalloc_uaf_memset+0x12b/0x360 [ 12.315619] kunit_try_run_case+0x1a5/0x480 [ 12.315897] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.316384] kthread+0x337/0x6f0 [ 12.316837] ret_from_fork+0x116/0x1d0 [ 12.317083] ret_from_fork_asm+0x1a/0x30 [ 12.317226] [ 12.317297] The buggy address belongs to the object at ffff8881026e1080 [ 12.317297] which belongs to the cache kmalloc-64 of size 64 [ 12.318373] The buggy address is located 0 bytes inside of [ 12.318373] freed 64-byte region [ffff8881026e1080, ffff8881026e10c0) [ 12.319711] [ 12.319912] The buggy address belongs to the physical page: [ 12.320193] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1026e1 [ 12.320450] flags: 0x200000000000000(node=0|zone=2) [ 12.320870] page_type: f5(slab) [ 12.321211] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 12.322022] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 12.322796] page dumped because: kasan: bad access detected [ 12.322969] [ 12.323038] Memory state around the buggy address: [ 12.323189] ffff8881026e0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.323395] ffff8881026e1000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.323618] >ffff8881026e1080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.324001] ^ [ 12.324149] ffff8881026e1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.324377] ffff8881026e1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.324890] ==================================================================
[ 12.469364] ================================================================== [ 12.470547] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360 [ 12.471236] Write of size 33 at addr ffff888103412500 by task kunit_try_catch/203 [ 12.472300] [ 12.472546] CPU: 1 UID: 0 PID: 203 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.472606] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.472618] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.472640] Call Trace: [ 12.472653] <TASK> [ 12.472672] dump_stack_lvl+0x73/0xb0 [ 12.472705] print_report+0xd1/0x610 [ 12.472728] ? __virt_addr_valid+0x1db/0x2d0 [ 12.472752] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.472772] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.472796] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.472817] kasan_report+0x141/0x180 [ 12.472838] ? kmalloc_uaf_memset+0x1a3/0x360 [ 12.472869] kasan_check_range+0x10c/0x1c0 [ 12.472892] __asan_memset+0x27/0x50 [ 12.472911] kmalloc_uaf_memset+0x1a3/0x360 [ 12.472932] ? __pfx_kmalloc_uaf_memset+0x10/0x10 [ 12.472955] ? __pfx_kmalloc_uaf_memset+0x10/0x10 [ 12.472980] kunit_try_run_case+0x1a5/0x480 [ 12.473006] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.473203] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.473231] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.473254] ? __kthread_parkme+0x82/0x180 [ 12.473275] ? preempt_count_sub+0x50/0x80 [ 12.473300] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.473324] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.473347] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.473371] kthread+0x337/0x6f0 [ 12.473390] ? trace_preempt_on+0x20/0xc0 [ 12.473413] ? __pfx_kthread+0x10/0x10 [ 12.473444] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.473465] ? calculate_sigpending+0x7b/0xa0 [ 12.473489] ? __pfx_kthread+0x10/0x10 [ 12.473509] ret_from_fork+0x116/0x1d0 [ 12.473528] ? __pfx_kthread+0x10/0x10 [ 12.473548] ret_from_fork_asm+0x1a/0x30 [ 12.473579] </TASK> [ 12.473590] [ 12.483829] Allocated by task 203: [ 12.484152] kasan_save_stack+0x45/0x70 [ 12.484333] kasan_save_track+0x18/0x40 [ 12.484613] kasan_save_alloc_info+0x3b/0x50 [ 12.484815] __kasan_kmalloc+0xb7/0xc0 [ 12.484987] __kmalloc_cache_noprof+0x189/0x420 [ 12.485403] kmalloc_uaf_memset+0xa9/0x360 [ 12.485627] kunit_try_run_case+0x1a5/0x480 [ 12.485837] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.486165] kthread+0x337/0x6f0 [ 12.486571] ret_from_fork+0x116/0x1d0 [ 12.486754] ret_from_fork_asm+0x1a/0x30 [ 12.486944] [ 12.487051] Freed by task 203: [ 12.487490] kasan_save_stack+0x45/0x70 [ 12.487671] kasan_save_track+0x18/0x40 [ 12.487984] kasan_save_free_info+0x3f/0x60 [ 12.488238] __kasan_slab_free+0x56/0x70 [ 12.488424] kfree+0x222/0x3f0 [ 12.488754] kmalloc_uaf_memset+0x12b/0x360 [ 12.488965] kunit_try_run_case+0x1a5/0x480 [ 12.489300] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.489550] kthread+0x337/0x6f0 [ 12.489893] ret_from_fork+0x116/0x1d0 [ 12.490403] ret_from_fork_asm+0x1a/0x30 [ 12.490600] [ 12.490687] The buggy address belongs to the object at ffff888103412500 [ 12.490687] which belongs to the cache kmalloc-64 of size 64 [ 12.491386] The buggy address is located 0 bytes inside of [ 12.491386] freed 64-byte region [ffff888103412500, ffff888103412540) [ 12.491888] [ 12.491984] The buggy address belongs to the physical page: [ 12.492461] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103412 [ 12.492798] flags: 0x200000000000000(node=0|zone=2) [ 12.493025] page_type: f5(slab) [ 12.493255] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 12.493668] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 12.493970] page dumped because: kasan: bad access detected [ 12.494631] [ 12.494724] Memory state around the buggy address: [ 12.494892] ffff888103412400: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 12.495792] ffff888103412480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.496067] >ffff888103412500: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.496383] ^ [ 12.496842] ffff888103412580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.497299] ffff888103412600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.497738] ==================================================================