Date
July 20, 2025, 8:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.339382] ================================================================== [ 15.339537] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468 [ 15.339591] Read of size 1 at addr fff00000c770c6a8 by task kunit_try_catch/189 [ 15.339665] [ 15.339757] CPU: 1 UID: 0 PID: 189 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.339862] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.340080] Hardware name: linux,dummy-virt (DT) [ 15.340257] Call trace: [ 15.340312] show_stack+0x20/0x38 (C) [ 15.340417] dump_stack_lvl+0x8c/0xd0 [ 15.340504] print_report+0x118/0x5d0 [ 15.340553] kasan_report+0xdc/0x128 [ 15.340766] __asan_report_load1_noabort+0x20/0x30 [ 15.340820] kmalloc_uaf2+0x3f4/0x468 [ 15.340980] kunit_try_run_case+0x170/0x3f0 [ 15.341234] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.341338] kthread+0x328/0x630 [ 15.341644] ret_from_fork+0x10/0x20 [ 15.341825] [ 15.341853] Allocated by task 189: [ 15.341886] kasan_save_stack+0x3c/0x68 [ 15.341931] kasan_save_track+0x20/0x40 [ 15.341978] kasan_save_alloc_info+0x40/0x58 [ 15.342028] __kasan_kmalloc+0xd4/0xd8 [ 15.342065] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.342127] kmalloc_uaf2+0xc4/0x468 [ 15.342163] kunit_try_run_case+0x170/0x3f0 [ 15.342213] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.342254] kthread+0x328/0x630 [ 15.342296] ret_from_fork+0x10/0x20 [ 15.342332] [ 15.342351] Freed by task 189: [ 15.342386] kasan_save_stack+0x3c/0x68 [ 15.342423] kasan_save_track+0x20/0x40 [ 15.342459] kasan_save_free_info+0x4c/0x78 [ 15.342500] __kasan_slab_free+0x6c/0x98 [ 15.342535] kfree+0x214/0x3c8 [ 15.342568] kmalloc_uaf2+0x134/0x468 [ 15.342603] kunit_try_run_case+0x170/0x3f0 [ 15.342648] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.342702] kthread+0x328/0x630 [ 15.342734] ret_from_fork+0x10/0x20 [ 15.342770] [ 15.342790] The buggy address belongs to the object at fff00000c770c680 [ 15.342790] which belongs to the cache kmalloc-64 of size 64 [ 15.342862] The buggy address is located 40 bytes inside of [ 15.342862] freed 64-byte region [fff00000c770c680, fff00000c770c6c0) [ 15.342943] [ 15.342972] The buggy address belongs to the physical page: [ 15.343004] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10770c [ 15.343059] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.343107] page_type: f5(slab) [ 15.343154] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 15.343717] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 15.343783] page dumped because: kasan: bad access detected [ 15.343863] [ 15.343932] Memory state around the buggy address: [ 15.343965] fff00000c770c580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 15.344562] fff00000c770c600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 15.344795] >fff00000c770c680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 15.344868] ^ [ 15.344905] fff00000c770c700: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc [ 15.344950] fff00000c770c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.345235] ==================================================================
[ 13.245681] ================================================================== [ 13.246865] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x4a8/0x520 [ 13.247521] Read of size 1 at addr ffff88810389baa8 by task kunit_try_catch/206 [ 13.248083] [ 13.248211] CPU: 1 UID: 0 PID: 206 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 13.248261] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.248272] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.248294] Call Trace: [ 13.248307] <TASK> [ 13.248323] dump_stack_lvl+0x73/0xb0 [ 13.248355] print_report+0xd1/0x610 [ 13.248394] ? __virt_addr_valid+0x1db/0x2d0 [ 13.248417] ? kmalloc_uaf2+0x4a8/0x520 [ 13.248437] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.248458] ? kmalloc_uaf2+0x4a8/0x520 [ 13.248488] kasan_report+0x141/0x180 [ 13.248510] ? kmalloc_uaf2+0x4a8/0x520 [ 13.248534] __asan_report_load1_noabort+0x18/0x20 [ 13.248558] kmalloc_uaf2+0x4a8/0x520 [ 13.248578] ? __pfx_kmalloc_uaf2+0x10/0x10 [ 13.248598] ? finish_task_switch.isra.0+0x153/0x700 [ 13.248621] ? __switch_to+0x47/0xf50 [ 13.248648] ? __schedule+0x10c6/0x2b60 [ 13.248671] ? __pfx_read_tsc+0x10/0x10 [ 13.248691] ? ktime_get_ts64+0x86/0x230 [ 13.248715] kunit_try_run_case+0x1a5/0x480 [ 13.248740] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.248782] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.248806] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.248829] ? __kthread_parkme+0x82/0x180 [ 13.248849] ? preempt_count_sub+0x50/0x80 [ 13.248872] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.248895] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.248918] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.248941] kthread+0x337/0x6f0 [ 13.248960] ? trace_preempt_on+0x20/0xc0 [ 13.248982] ? __pfx_kthread+0x10/0x10 [ 13.249002] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.249024] ? calculate_sigpending+0x7b/0xa0 [ 13.249048] ? __pfx_kthread+0x10/0x10 [ 13.249069] ret_from_fork+0x116/0x1d0 [ 13.249088] ? __pfx_kthread+0x10/0x10 [ 13.249137] ret_from_fork_asm+0x1a/0x30 [ 13.249168] </TASK> [ 13.249177] [ 13.261613] Allocated by task 206: [ 13.261761] kasan_save_stack+0x45/0x70 [ 13.262198] kasan_save_track+0x18/0x40 [ 13.262776] kasan_save_alloc_info+0x3b/0x50 [ 13.263240] __kasan_kmalloc+0xb7/0xc0 [ 13.263703] __kmalloc_cache_noprof+0x189/0x420 [ 13.264229] kmalloc_uaf2+0xc6/0x520 [ 13.264435] kunit_try_run_case+0x1a5/0x480 [ 13.264833] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.265084] kthread+0x337/0x6f0 [ 13.265445] ret_from_fork+0x116/0x1d0 [ 13.265870] ret_from_fork_asm+0x1a/0x30 [ 13.266454] [ 13.266620] Freed by task 206: [ 13.266802] kasan_save_stack+0x45/0x70 [ 13.266951] kasan_save_track+0x18/0x40 [ 13.267381] kasan_save_free_info+0x3f/0x60 [ 13.267793] __kasan_slab_free+0x56/0x70 [ 13.268238] kfree+0x222/0x3f0 [ 13.268369] kmalloc_uaf2+0x14c/0x520 [ 13.268520] kunit_try_run_case+0x1a5/0x480 [ 13.268675] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.269042] kthread+0x337/0x6f0 [ 13.269368] ret_from_fork+0x116/0x1d0 [ 13.269906] ret_from_fork_asm+0x1a/0x30 [ 13.270347] [ 13.270548] The buggy address belongs to the object at ffff88810389ba80 [ 13.270548] which belongs to the cache kmalloc-64 of size 64 [ 13.272048] The buggy address is located 40 bytes inside of [ 13.272048] freed 64-byte region [ffff88810389ba80, ffff88810389bac0) [ 13.272910] [ 13.272992] The buggy address belongs to the physical page: [ 13.273444] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10389b [ 13.274225] flags: 0x200000000000000(node=0|zone=2) [ 13.274837] page_type: f5(slab) [ 13.275140] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 13.275573] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 13.275826] page dumped because: kasan: bad access detected [ 13.276413] [ 13.276592] Memory state around the buggy address: [ 13.277159] ffff88810389b980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.277820] ffff88810389ba00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.278499] >ffff88810389ba80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.278726] ^ [ 13.279106] ffff88810389bb00: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc [ 13.279922] ffff88810389bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.280691] ==================================================================