Date
July 18, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.562193] ================================================================== [ 17.562349] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 17.562420] Read of size 4 at addr fff00000c788d940 by task swapper/1/0 [ 17.562467] [ 17.562513] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 17.562597] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.562624] Hardware name: linux,dummy-virt (DT) [ 17.562656] Call trace: [ 17.562680] show_stack+0x20/0x38 (C) [ 17.562730] dump_stack_lvl+0x8c/0xd0 [ 17.562781] print_report+0x118/0x5d0 [ 17.562827] kasan_report+0xdc/0x128 [ 17.562983] __asan_report_load4_noabort+0x20/0x30 [ 17.563069] rcu_uaf_reclaim+0x64/0x70 [ 17.563170] rcu_core+0x9f4/0x1e20 [ 17.563222] rcu_core_si+0x18/0x30 [ 17.563268] handle_softirqs+0x374/0xb28 [ 17.563331] __do_softirq+0x1c/0x28 [ 17.563453] ____do_softirq+0x18/0x30 [ 17.563550] call_on_irq_stack+0x24/0x30 [ 17.563871] do_softirq_own_stack+0x24/0x38 [ 17.564052] __irq_exit_rcu+0x1fc/0x318 [ 17.564104] irq_exit_rcu+0x1c/0x80 [ 17.564196] el1_interrupt+0x38/0x58 [ 17.564402] el1h_64_irq_handler+0x18/0x28 [ 17.564531] el1h_64_irq+0x6c/0x70 [ 17.564758] arch_local_irq_enable+0x4/0x8 (P) [ 17.564826] do_idle+0x384/0x4e8 [ 17.564889] cpu_startup_entry+0x64/0x80 [ 17.565161] secondary_start_kernel+0x288/0x340 [ 17.565338] __secondary_switched+0xc0/0xc8 [ 17.565436] [ 17.565574] Allocated by task 198: [ 17.565653] kasan_save_stack+0x3c/0x68 [ 17.565954] kasan_save_track+0x20/0x40 [ 17.566130] kasan_save_alloc_info+0x40/0x58 [ 17.566174] __kasan_kmalloc+0xd4/0xd8 [ 17.566465] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.566631] rcu_uaf+0xb0/0x2d8 [ 17.566680] kunit_try_run_case+0x170/0x3f0 [ 17.566779] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.566828] kthread+0x328/0x630 [ 17.566898] ret_from_fork+0x10/0x20 [ 17.566936] [ 17.566966] Freed by task 0: [ 17.566995] kasan_save_stack+0x3c/0x68 [ 17.567035] kasan_save_track+0x20/0x40 [ 17.567083] kasan_save_free_info+0x4c/0x78 [ 17.567123] __kasan_slab_free+0x6c/0x98 [ 17.567162] kfree+0x214/0x3c8 [ 17.567194] rcu_uaf_reclaim+0x28/0x70 [ 17.567230] rcu_core+0x9f4/0x1e20 [ 17.567273] rcu_core_si+0x18/0x30 [ 17.567307] handle_softirqs+0x374/0xb28 [ 17.567585] __do_softirq+0x1c/0x28 [ 17.567762] [ 17.567858] Last potentially related work creation: [ 17.568018] kasan_save_stack+0x3c/0x68 [ 17.568163] kasan_record_aux_stack+0xb4/0xc8 [ 17.568274] __call_rcu_common.constprop.0+0x74/0x8c8 [ 17.568355] call_rcu+0x18/0x30 [ 17.568563] rcu_uaf+0x14c/0x2d8 [ 17.568598] kunit_try_run_case+0x170/0x3f0 [ 17.568748] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.569002] kthread+0x328/0x630 [ 17.569117] ret_from_fork+0x10/0x20 [ 17.569296] [ 17.569364] The buggy address belongs to the object at fff00000c788d940 [ 17.569364] which belongs to the cache kmalloc-32 of size 32 [ 17.569555] The buggy address is located 0 bytes inside of [ 17.569555] freed 32-byte region [fff00000c788d940, fff00000c788d960) [ 17.569679] [ 17.569708] The buggy address belongs to the physical page: [ 17.569958] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10788d [ 17.570154] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.570250] page_type: f5(slab) [ 17.570414] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 17.570574] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 17.570661] page dumped because: kasan: bad access detected [ 17.570735] [ 17.570754] Memory state around the buggy address: [ 17.570986] fff00000c788d800: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 17.571121] fff00000c788d880: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 17.571291] >fff00000c788d900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 17.571483] ^ [ 17.571540] fff00000c788d980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.571617] fff00000c788da00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.571753] ==================================================================
[ 16.973969] ================================================================== [ 16.974095] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 16.974166] Read of size 4 at addr fff00000c794c600 by task swapper/1/0 [ 16.974213] [ 16.974255] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.974353] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.974380] Hardware name: linux,dummy-virt (DT) [ 16.974412] Call trace: [ 16.974436] show_stack+0x20/0x38 (C) [ 16.974486] dump_stack_lvl+0x8c/0xd0 [ 16.974535] print_report+0x118/0x5d0 [ 16.974580] kasan_report+0xdc/0x128 [ 16.974625] __asan_report_load4_noabort+0x20/0x30 [ 16.974673] rcu_uaf_reclaim+0x64/0x70 [ 16.980249] rcu_core+0x9f4/0x1e20 [ 16.980663] rcu_core_si+0x18/0x30 [ 16.980714] handle_softirqs+0x374/0xb28 [ 16.980766] __do_softirq+0x1c/0x28 [ 16.981263] ____do_softirq+0x18/0x30 [ 16.982351] call_on_irq_stack+0x24/0x30 [ 16.982411] do_softirq_own_stack+0x24/0x38 [ 16.982460] __irq_exit_rcu+0x1fc/0x318 [ 16.982529] irq_exit_rcu+0x1c/0x80 [ 16.982574] el1_interrupt+0x38/0x58 [ 16.982625] el1h_64_irq_handler+0x18/0x28 [ 16.982673] el1h_64_irq+0x6c/0x70 [ 16.982775] arch_local_irq_enable+0x4/0x8 (P) [ 16.982827] do_idle+0x384/0x4e8 [ 16.982870] cpu_startup_entry+0x64/0x80 [ 16.982916] secondary_start_kernel+0x288/0x340 [ 16.982963] __secondary_switched+0xc0/0xc8 [ 16.983017] [ 16.983035] Allocated by task 198: [ 16.983065] kasan_save_stack+0x3c/0x68 [ 16.983107] kasan_save_track+0x20/0x40 [ 16.983146] kasan_save_alloc_info+0x40/0x58 [ 16.983185] __kasan_kmalloc+0xd4/0xd8 [ 16.983223] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.983261] rcu_uaf+0xb0/0x2d8 [ 16.983294] kunit_try_run_case+0x170/0x3f0 [ 16.983345] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.983456] kthread+0x328/0x630 [ 16.983526] ret_from_fork+0x10/0x20 [ 16.983563] [ 16.983620] Freed by task 0: [ 16.983707] kasan_save_stack+0x3c/0x68 [ 16.983756] kasan_save_track+0x20/0x40 [ 16.983832] kasan_save_free_info+0x4c/0x78 [ 16.983873] __kasan_slab_free+0x6c/0x98 [ 16.984243] kfree+0x214/0x3c8 [ 16.984423] rcu_uaf_reclaim+0x28/0x70 [ 16.984491] rcu_core+0x9f4/0x1e20 [ 16.984525] rcu_core_si+0x18/0x30 [ 16.984611] handle_softirqs+0x374/0xb28 [ 16.984688] __do_softirq+0x1c/0x28 [ 16.984803] [ 16.984864] Last potentially related work creation: [ 16.984899] kasan_save_stack+0x3c/0x68 [ 16.985058] kasan_record_aux_stack+0xb4/0xc8 [ 16.985187] __call_rcu_common.constprop.0+0x74/0x8c8 [ 16.985253] call_rcu+0x18/0x30 [ 16.985285] rcu_uaf+0x14c/0x2d8 [ 16.985330] kunit_try_run_case+0x170/0x3f0 [ 16.985368] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.985412] kthread+0x328/0x630 [ 16.985444] ret_from_fork+0x10/0x20 [ 16.985523] [ 16.985552] The buggy address belongs to the object at fff00000c794c600 [ 16.985552] which belongs to the cache kmalloc-32 of size 32 [ 16.985612] The buggy address is located 0 bytes inside of [ 16.985612] freed 32-byte region [fff00000c794c600, fff00000c794c620) [ 16.985671] [ 16.985691] The buggy address belongs to the physical page: [ 16.985724] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10794c [ 16.985801] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.985853] page_type: f5(slab) [ 16.985907] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 16.985957] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 16.986050] page dumped because: kasan: bad access detected [ 16.986120] [ 16.986138] Memory state around the buggy address: [ 16.986200] fff00000c794c500: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 16.986308] fff00000c794c580: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 16.986363] >fff00000c794c600: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 16.986433] ^ [ 16.986491] fff00000c794c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.986533] fff00000c794c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.986571] ==================================================================
[ 16.964756] ================================================================== [ 16.964892] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 16.964961] Read of size 4 at addr fff00000c771ff40 by task swapper/0/0 [ 16.965008] [ 16.965049] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.965130] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.965157] Hardware name: linux,dummy-virt (DT) [ 16.968369] Call trace: [ 16.968416] show_stack+0x20/0x38 (C) [ 16.968821] dump_stack_lvl+0x8c/0xd0 [ 16.969634] print_report+0x118/0x5d0 [ 16.970371] kasan_report+0xdc/0x128 [ 16.970507] __asan_report_load4_noabort+0x20/0x30 [ 16.970559] rcu_uaf_reclaim+0x64/0x70 [ 16.970605] rcu_core+0x9f4/0x1e20 [ 16.971248] rcu_core_si+0x18/0x30 [ 16.971848] handle_softirqs+0x374/0xb28 [ 16.972414] __do_softirq+0x1c/0x28 [ 16.972756] ____do_softirq+0x18/0x30 [ 16.973291] call_on_irq_stack+0x24/0x30 [ 16.973374] do_softirq_own_stack+0x24/0x38 [ 16.973422] __irq_exit_rcu+0x1fc/0x318 [ 16.974407] irq_exit_rcu+0x1c/0x80 [ 16.974563] el1_interrupt+0x38/0x58 [ 16.974847] el1h_64_irq_handler+0x18/0x28 [ 16.975163] el1h_64_irq+0x6c/0x70 [ 16.975282] arch_local_irq_enable+0x4/0x8 (P) [ 16.975996] do_idle+0x384/0x4e8 [ 16.976585] cpu_startup_entry+0x64/0x80 [ 16.977428] rest_init+0x160/0x188 [ 16.978023] start_kernel+0x30c/0x3d0 [ 16.978670] __primary_switched+0x8c/0xa0 [ 16.978893] [ 16.979194] Allocated by task 198: [ 16.979236] kasan_save_stack+0x3c/0x68 [ 16.979732] kasan_save_track+0x20/0x40 [ 16.979785] kasan_save_alloc_info+0x40/0x58 [ 16.979826] __kasan_kmalloc+0xd4/0xd8 [ 16.979863] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.979902] rcu_uaf+0xb0/0x2d8 [ 16.979934] kunit_try_run_case+0x170/0x3f0 [ 16.980275] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.980354] kthread+0x328/0x630 [ 16.980555] ret_from_fork+0x10/0x20 [ 16.980621] [ 16.981505] Freed by task 0: [ 16.981543] kasan_save_stack+0x3c/0x68 [ 16.981597] kasan_save_track+0x20/0x40 [ 16.981635] kasan_save_free_info+0x4c/0x78 [ 16.981676] __kasan_slab_free+0x6c/0x98 [ 16.981724] kfree+0x214/0x3c8 [ 16.981763] rcu_uaf_reclaim+0x28/0x70 [ 16.981799] rcu_core+0x9f4/0x1e20 [ 16.981833] rcu_core_si+0x18/0x30 [ 16.981871] handle_softirqs+0x374/0xb28 [ 16.981910] __do_softirq+0x1c/0x28 [ 16.982878] [ 16.982922] Last potentially related work creation: [ 16.982997] kasan_save_stack+0x3c/0x68 [ 16.983212] kasan_record_aux_stack+0xb4/0xc8 [ 16.983257] __call_rcu_common.constprop.0+0x74/0x8c8 [ 16.983299] call_rcu+0x18/0x30 [ 16.983331] rcu_uaf+0x14c/0x2d8 [ 16.983365] kunit_try_run_case+0x170/0x3f0 [ 16.983644] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.983703] kthread+0x328/0x630 [ 16.983961] ret_from_fork+0x10/0x20 [ 16.984243] [ 16.984404] The buggy address belongs to the object at fff00000c771ff40 [ 16.984404] which belongs to the cache kmalloc-32 of size 32 [ 16.984469] The buggy address is located 0 bytes inside of [ 16.984469] freed 32-byte region [fff00000c771ff40, fff00000c771ff60) [ 16.984530] [ 16.985182] The buggy address belongs to the physical page: [ 16.985352] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10771f [ 16.985412] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.986101] page_type: f5(slab) [ 16.986263] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 16.986790] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 16.986853] page dumped because: kasan: bad access detected [ 16.986956] [ 16.987228] Memory state around the buggy address: [ 16.987273] fff00000c771fe00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 16.987317] fff00000c771fe80: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 16.987464] >fff00000c771ff00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 16.987738] ^ [ 16.987965] fff00000c771ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.988009] fff00000c7720000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.988292] ==================================================================
[ 12.786652] ================================================================== [ 12.787227] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60 [ 12.787603] Read of size 4 at addr ffff888102e2fa40 by task swapper/0/0 [ 12.788066] [ 12.788198] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.788266] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.788277] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.788300] Call Trace: [ 12.788346] <IRQ> [ 12.788366] dump_stack_lvl+0x73/0xb0 [ 12.788401] print_report+0xd1/0x610 [ 12.788424] ? __virt_addr_valid+0x1db/0x2d0 [ 12.788450] ? rcu_uaf_reclaim+0x50/0x60 [ 12.788469] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.788492] ? rcu_uaf_reclaim+0x50/0x60 [ 12.788583] kasan_report+0x141/0x180 [ 12.788610] ? rcu_uaf_reclaim+0x50/0x60 [ 12.788660] __asan_report_load4_noabort+0x18/0x20 [ 12.788685] rcu_uaf_reclaim+0x50/0x60 [ 12.788706] rcu_core+0x66f/0x1c40 [ 12.788737] ? __pfx_rcu_core+0x10/0x10 [ 12.788758] ? ktime_get+0x6b/0x150 [ 12.788786] rcu_core_si+0x12/0x20 [ 12.788805] handle_softirqs+0x209/0x730 [ 12.788827] ? hrtimer_interrupt+0x2fe/0x780 [ 12.788850] ? __pfx_handle_softirqs+0x10/0x10 [ 12.788903] __irq_exit_rcu+0xc9/0x110 [ 12.788923] irq_exit_rcu+0x12/0x20 [ 12.788943] sysvec_apic_timer_interrupt+0x81/0x90 [ 12.788988] </IRQ> [ 12.789016] <TASK> [ 12.789026] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 12.789117] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 12.789337] Code: 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 23 62 21 00 fb f4 <e9> 3c 1d 02 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 12.789417] RSP: 0000:ffffffff9ac07dd8 EFLAGS: 00010216 [ 12.789503] RAX: ffff8881bf072000 RBX: ffffffff9ac1cac0 RCX: ffffffff99a76125 [ 12.789748] RDX: ffffed102b60618b RSI: 0000000000000004 RDI: 000000000000517c [ 12.789800] RBP: ffffffff9ac07de0 R08: 0000000000000001 R09: ffffed102b60618a [ 12.789843] R10: ffff88815b030c53 R11: ffffffff9bfc36c0 R12: 0000000000000000 [ 12.789886] R13: fffffbfff3583958 R14: ffffffff9b7b1490 R15: 0000000000000000 [ 12.789964] ? ct_kernel_exit.constprop.0+0xa5/0xd0 [ 12.790050] ? default_idle+0xd/0x20 [ 12.790073] arch_cpu_idle+0xd/0x20 [ 12.790094] default_idle_call+0x48/0x80 [ 12.790113] do_idle+0x379/0x4f0 [ 12.790140] ? __pfx_do_idle+0x10/0x10 [ 12.790161] ? trace_preempt_on+0x20/0xc0 [ 12.790184] ? schedule+0x86/0x2e0 [ 12.790204] ? preempt_count_sub+0x50/0x80 [ 12.790228] cpu_startup_entry+0x5c/0x70 [ 12.790247] rest_init+0x11a/0x140 [ 12.790264] ? acpi_subsystem_init+0x5d/0x150 [ 12.790290] start_kernel+0x330/0x410 [ 12.790315] x86_64_start_reservations+0x1c/0x30 [ 12.790340] x86_64_start_kernel+0x10d/0x120 [ 12.790364] common_startup_64+0x13e/0x148 [ 12.790398] </TASK> [ 12.790409] [ 12.809217] Allocated by task 215: [ 12.809747] kasan_save_stack+0x45/0x70 [ 12.810135] kasan_save_track+0x18/0x40 [ 12.810275] kasan_save_alloc_info+0x3b/0x50 [ 12.810421] __kasan_kmalloc+0xb7/0xc0 [ 12.810643] __kmalloc_cache_noprof+0x189/0x420 [ 12.811210] rcu_uaf+0xb0/0x330 [ 12.811571] kunit_try_run_case+0x1a5/0x480 [ 12.812092] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.812653] kthread+0x337/0x6f0 [ 12.813024] ret_from_fork+0x116/0x1d0 [ 12.813359] ret_from_fork_asm+0x1a/0x30 [ 12.813499] [ 12.813866] Freed by task 0: [ 12.814209] kasan_save_stack+0x45/0x70 [ 12.814608] kasan_save_track+0x18/0x40 [ 12.815182] kasan_save_free_info+0x3f/0x60 [ 12.815364] __kasan_slab_free+0x56/0x70 [ 12.815507] kfree+0x222/0x3f0 [ 12.815634] rcu_uaf_reclaim+0x1f/0x60 [ 12.815774] rcu_core+0x66f/0x1c40 [ 12.816111] rcu_core_si+0x12/0x20 [ 12.816273] handle_softirqs+0x209/0x730 [ 12.816463] __irq_exit_rcu+0xc9/0x110 [ 12.817063] irq_exit_rcu+0x12/0x20 [ 12.817300] sysvec_apic_timer_interrupt+0x81/0x90 [ 12.817671] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 12.817911] [ 12.818073] Last potentially related work creation: [ 12.818318] kasan_save_stack+0x45/0x70 [ 12.818799] kasan_record_aux_stack+0xb2/0xc0 [ 12.819045] __call_rcu_common.constprop.0+0x7b/0x9e0 [ 12.819454] call_rcu+0x12/0x20 [ 12.819645] rcu_uaf+0x168/0x330 [ 12.820039] kunit_try_run_case+0x1a5/0x480 [ 12.820193] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.820662] kthread+0x337/0x6f0 [ 12.820951] ret_from_fork+0x116/0x1d0 [ 12.821142] ret_from_fork_asm+0x1a/0x30 [ 12.821498] [ 12.821617] The buggy address belongs to the object at ffff888102e2fa40 [ 12.821617] which belongs to the cache kmalloc-32 of size 32 [ 12.822262] The buggy address is located 0 bytes inside of [ 12.822262] freed 32-byte region [ffff888102e2fa40, ffff888102e2fa60) [ 12.823283] [ 12.823368] The buggy address belongs to the physical page: [ 12.823697] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102e2f [ 12.824198] flags: 0x200000000000000(node=0|zone=2) [ 12.824371] page_type: f5(slab) [ 12.824736] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 12.825235] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 12.825554] page dumped because: kasan: bad access detected [ 12.826018] [ 12.826192] Memory state around the buggy address: [ 12.826355] ffff888102e2f900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 12.826673] ffff888102e2f980: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 12.827232] >ffff888102e2fa00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 12.827588] ^ [ 12.828069] ffff888102e2fa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.828377] ffff888102e2fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.828938] ==================================================================
[ 12.586550] ================================================================== [ 12.588284] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60 [ 12.589341] Read of size 4 at addr ffff888102ae5e40 by task swapper/0/0 [ 12.590363] [ 12.590788] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.590838] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.590850] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.591017] Call Trace: [ 12.591058] <IRQ> [ 12.591119] dump_stack_lvl+0x73/0xb0 [ 12.591156] print_report+0xd1/0x610 [ 12.591180] ? __virt_addr_valid+0x1db/0x2d0 [ 12.591204] ? rcu_uaf_reclaim+0x50/0x60 [ 12.591224] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.591246] ? rcu_uaf_reclaim+0x50/0x60 [ 12.591267] kasan_report+0x141/0x180 [ 12.591288] ? rcu_uaf_reclaim+0x50/0x60 [ 12.591314] __asan_report_load4_noabort+0x18/0x20 [ 12.591340] rcu_uaf_reclaim+0x50/0x60 [ 12.591360] rcu_core+0x66f/0x1c40 [ 12.591391] ? __pfx_rcu_core+0x10/0x10 [ 12.591630] ? ktime_get+0x6b/0x150 [ 12.591658] ? handle_softirqs+0x18e/0x730 [ 12.591685] rcu_core_si+0x12/0x20 [ 12.591705] handle_softirqs+0x209/0x730 [ 12.591724] ? hrtimer_interrupt+0x2fe/0x780 [ 12.591748] ? __pfx_handle_softirqs+0x10/0x10 [ 12.591775] __irq_exit_rcu+0xc9/0x110 [ 12.591795] irq_exit_rcu+0x12/0x20 [ 12.591814] sysvec_apic_timer_interrupt+0x81/0x90 [ 12.591839] </IRQ> [ 12.591871] <TASK> [ 12.591880] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 12.591977] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 12.592195] Code: 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 23 62 21 00 fb f4 <e9> 3c 1d 02 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 12.592276] RSP: 0000:ffffffffa9407dd8 EFLAGS: 00010202 [ 12.592362] RAX: ffff8881aa072000 RBX: ffffffffa941cac0 RCX: ffffffffa8276125 [ 12.592423] RDX: ffffed102a90618b RSI: 0000000000000004 RDI: 0000000000006074 [ 12.592481] RBP: ffffffffa9407de0 R08: 0000000000000001 R09: ffffed102a90618a [ 12.592522] R10: ffff888154830c53 R11: 0000000000058c00 R12: 0000000000000000 [ 12.592564] R13: fffffbfff5283958 R14: ffffffffa9fb1490 R15: 0000000000000000 [ 12.592622] ? ct_kernel_exit.constprop.0+0xa5/0xd0 [ 12.592677] ? default_idle+0xd/0x20 [ 12.592699] arch_cpu_idle+0xd/0x20 [ 12.592720] default_idle_call+0x48/0x80 [ 12.592738] do_idle+0x379/0x4f0 [ 12.592765] ? __pfx_do_idle+0x10/0x10 [ 12.592787] ? trace_preempt_on+0x20/0xc0 [ 12.592808] ? schedule+0x86/0x2e0 [ 12.592828] ? preempt_count_sub+0x50/0x80 [ 12.592852] cpu_startup_entry+0x5c/0x70 [ 12.592871] rest_init+0x11a/0x140 [ 12.592887] ? acpi_subsystem_init+0x5d/0x150 [ 12.592911] start_kernel+0x330/0x410 [ 12.592936] x86_64_start_reservations+0x1c/0x30 [ 12.592960] x86_64_start_kernel+0x10d/0x120 [ 12.592984] common_startup_64+0x13e/0x148 [ 12.593019] </TASK> [ 12.593029] [ 12.616448] Allocated by task 216: [ 12.616672] kasan_save_stack+0x45/0x70 [ 12.617323] kasan_save_track+0x18/0x40 [ 12.617811] kasan_save_alloc_info+0x3b/0x50 [ 12.618200] __kasan_kmalloc+0xb7/0xc0 [ 12.618740] __kmalloc_cache_noprof+0x189/0x420 [ 12.619167] rcu_uaf+0xb0/0x330 [ 12.619478] kunit_try_run_case+0x1a5/0x480 [ 12.619953] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.620253] kthread+0x337/0x6f0 [ 12.620377] ret_from_fork+0x116/0x1d0 [ 12.620788] ret_from_fork_asm+0x1a/0x30 [ 12.621164] [ 12.621319] Freed by task 0: [ 12.621703] kasan_save_stack+0x45/0x70 [ 12.621970] kasan_save_track+0x18/0x40 [ 12.622115] kasan_save_free_info+0x3f/0x60 [ 12.622266] __kasan_slab_free+0x56/0x70 [ 12.622404] kfree+0x222/0x3f0 [ 12.622811] rcu_uaf_reclaim+0x1f/0x60 [ 12.623142] rcu_core+0x66f/0x1c40 [ 12.623501] rcu_core_si+0x12/0x20 [ 12.623852] handle_softirqs+0x209/0x730 [ 12.624204] __irq_exit_rcu+0xc9/0x110 [ 12.624745] irq_exit_rcu+0x12/0x20 [ 12.625089] sysvec_apic_timer_interrupt+0x81/0x90 [ 12.625609] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 12.626136] [ 12.626252] Last potentially related work creation: [ 12.626424] kasan_save_stack+0x45/0x70 [ 12.626867] kasan_record_aux_stack+0xb2/0xc0 [ 12.627253] __call_rcu_common.constprop.0+0x7b/0x9e0 [ 12.627787] call_rcu+0x12/0x20 [ 12.628021] rcu_uaf+0x168/0x330 [ 12.628139] kunit_try_run_case+0x1a5/0x480 [ 12.628283] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.628544] kthread+0x337/0x6f0 [ 12.628898] ret_from_fork+0x116/0x1d0 [ 12.629231] ret_from_fork_asm+0x1a/0x30 [ 12.629854] [ 12.630045] The buggy address belongs to the object at ffff888102ae5e40 [ 12.630045] which belongs to the cache kmalloc-32 of size 32 [ 12.631239] The buggy address is located 0 bytes inside of [ 12.631239] freed 32-byte region [ffff888102ae5e40, ffff888102ae5e60) [ 12.632239] [ 12.632317] The buggy address belongs to the physical page: [ 12.632500] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ae5 [ 12.633251] flags: 0x200000000000000(node=0|zone=2) [ 12.633830] page_type: f5(slab) [ 12.634143] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 12.634881] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 12.635113] page dumped because: kasan: bad access detected [ 12.635287] [ 12.635355] Memory state around the buggy address: [ 12.635893] ffff888102ae5d00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 12.636703] ffff888102ae5d80: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 12.637482] >ffff888102ae5e00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 12.638169] ^ [ 12.638813] ffff888102ae5e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.639516] ffff888102ae5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.639732] ==================================================================
[ 12.778158] ================================================================== [ 12.779057] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60 [ 12.779588] Read of size 4 at addr ffff888103410bc0 by task swapper/1/0 [ 12.780264] [ 12.780525] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.780575] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.780586] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.780608] Call Trace: [ 12.780642] <IRQ> [ 12.780661] dump_stack_lvl+0x73/0xb0 [ 12.780695] print_report+0xd1/0x610 [ 12.780719] ? __virt_addr_valid+0x1db/0x2d0 [ 12.780743] ? rcu_uaf_reclaim+0x50/0x60 [ 12.780762] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.780784] ? rcu_uaf_reclaim+0x50/0x60 [ 12.780804] kasan_report+0x141/0x180 [ 12.780825] ? rcu_uaf_reclaim+0x50/0x60 [ 12.780855] __asan_report_load4_noabort+0x18/0x20 [ 12.780880] rcu_uaf_reclaim+0x50/0x60 [ 12.780900] rcu_core+0x66f/0x1c40 [ 12.780928] ? __pfx_rcu_core+0x10/0x10 [ 12.780949] ? ktime_get+0x6b/0x150 [ 12.780974] rcu_core_si+0x12/0x20 [ 12.780993] handle_softirqs+0x209/0x730 [ 12.781116] ? hrtimer_interrupt+0x2fe/0x780 [ 12.781142] ? __pfx_handle_softirqs+0x10/0x10 [ 12.781180] __irq_exit_rcu+0xc9/0x110 [ 12.781200] irq_exit_rcu+0x12/0x20 [ 12.781220] sysvec_apic_timer_interrupt+0x81/0x90 [ 12.781247] </IRQ> [ 12.781276] <TASK> [ 12.781286] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 12.781378] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 12.781590] Code: 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 23 62 21 00 fb f4 <e9> 3c 1d 02 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 12.781672] RSP: 0000:ffff888100877dc8 EFLAGS: 00010216 [ 12.781758] RAX: ffff88819ef72000 RBX: ffff888100853000 RCX: ffffffffb9c76125 [ 12.781802] RDX: ffffed102b62618b RSI: 0000000000000004 RDI: 000000000001343c [ 12.781844] RBP: ffff888100877dd0 R08: 0000000000000001 R09: ffffed102b62618a [ 12.781886] R10: ffff88815b130c53 R11: 0000000000041000 R12: 0000000000000001 [ 12.781927] R13: ffffed102010a600 R14: ffffffffbb9b1490 R15: 0000000000000000 [ 12.781981] ? ct_kernel_exit.constprop.0+0xa5/0xd0 [ 12.782098] ? default_idle+0xd/0x20 [ 12.782127] arch_cpu_idle+0xd/0x20 [ 12.782148] default_idle_call+0x48/0x80 [ 12.782167] do_idle+0x379/0x4f0 [ 12.782193] ? __pfx_do_idle+0x10/0x10 [ 12.782213] ? common_startup_64+0x13e/0x148 [ 12.782242] cpu_startup_entry+0x5c/0x70 [ 12.782261] start_secondary+0x211/0x290 [ 12.782283] ? __pfx_start_secondary+0x10/0x10 [ 12.782307] common_startup_64+0x13e/0x148 [ 12.782337] </TASK> [ 12.782347] [ 12.800047] Allocated by task 215: [ 12.800494] kasan_save_stack+0x45/0x70 [ 12.800987] kasan_save_track+0x18/0x40 [ 12.801225] kasan_save_alloc_info+0x3b/0x50 [ 12.801763] __kasan_kmalloc+0xb7/0xc0 [ 12.801956] __kmalloc_cache_noprof+0x189/0x420 [ 12.802481] rcu_uaf+0xb0/0x330 [ 12.802801] kunit_try_run_case+0x1a5/0x480 [ 12.802962] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.803962] kthread+0x337/0x6f0 [ 12.804402] ret_from_fork+0x116/0x1d0 [ 12.804684] ret_from_fork_asm+0x1a/0x30 [ 12.804832] [ 12.804915] Freed by task 0: [ 12.805120] kasan_save_stack+0x45/0x70 [ 12.805530] kasan_save_track+0x18/0x40 [ 12.805982] kasan_save_free_info+0x3f/0x60 [ 12.806488] __kasan_slab_free+0x56/0x70 [ 12.806889] kfree+0x222/0x3f0 [ 12.807288] rcu_uaf_reclaim+0x1f/0x60 [ 12.807451] rcu_core+0x66f/0x1c40 [ 12.807772] rcu_core_si+0x12/0x20 [ 12.807981] handle_softirqs+0x209/0x730 [ 12.808404] __irq_exit_rcu+0xc9/0x110 [ 12.808840] irq_exit_rcu+0x12/0x20 [ 12.809227] sysvec_apic_timer_interrupt+0x81/0x90 [ 12.809404] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 12.809905] [ 12.810148] Last potentially related work creation: [ 12.810727] kasan_save_stack+0x45/0x70 [ 12.810905] kasan_record_aux_stack+0xb2/0xc0 [ 12.811155] __call_rcu_common.constprop.0+0x7b/0x9e0 [ 12.811661] call_rcu+0x12/0x20 [ 12.811978] rcu_uaf+0x168/0x330 [ 12.812416] kunit_try_run_case+0x1a5/0x480 [ 12.812734] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.813088] kthread+0x337/0x6f0 [ 12.813784] ret_from_fork+0x116/0x1d0 [ 12.814140] ret_from_fork_asm+0x1a/0x30 [ 12.814313] [ 12.814400] The buggy address belongs to the object at ffff888103410bc0 [ 12.814400] which belongs to the cache kmalloc-32 of size 32 [ 12.814764] The buggy address is located 0 bytes inside of [ 12.814764] freed 32-byte region [ffff888103410bc0, ffff888103410be0) [ 12.815359] [ 12.815583] The buggy address belongs to the physical page: [ 12.816117] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103410 [ 12.816884] flags: 0x200000000000000(node=0|zone=2) [ 12.817525] page_type: f5(slab) [ 12.817972] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 12.819125] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 12.819904] page dumped because: kasan: bad access detected [ 12.820567] [ 12.820644] Memory state around the buggy address: [ 12.820805] ffff888103410a80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 12.821044] ffff888103410b00: 00 00 00 fc fc fc fc fc 00 00 05 fc fc fc fc fc [ 12.821262] >ffff888103410b80: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 12.821644] ^ [ 12.822200] ffff888103410c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.823024] ffff888103410c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.824003] ==================================================================