Date
July 23, 2025, 2:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.141575] ================================================================== [ 15.141649] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8 [ 15.141705] Read of size 1 at addr fff00000c6500000 by task kunit_try_catch/148 [ 15.141755] [ 15.141787] CPU: 1 UID: 0 PID: 148 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT [ 15.141883] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.142261] Hardware name: linux,dummy-virt (DT) [ 15.142441] Call trace: [ 15.142510] show_stack+0x20/0x38 (C) [ 15.143090] dump_stack_lvl+0x8c/0xd0 [ 15.143152] print_report+0x118/0x5d0 [ 15.143198] kasan_report+0xdc/0x128 [ 15.143318] __asan_report_load1_noabort+0x20/0x30 [ 15.143711] kmalloc_large_uaf+0x2cc/0x2f8 [ 15.143759] kunit_try_run_case+0x170/0x3f0 [ 15.144038] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.144173] kthread+0x328/0x630 [ 15.144255] ret_from_fork+0x10/0x20 [ 15.144309] [ 15.144415] The buggy address belongs to the physical page: [ 15.144525] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106500 [ 15.144623] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.144765] raw: 0bfffe0000000000 ffffc1ffc3194108 fff00000da478c40 0000000000000000 [ 15.144815] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 15.144892] page dumped because: kasan: bad access detected [ 15.145030] [ 15.145048] Memory state around the buggy address: [ 15.145079] fff00000c64fff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.145185] fff00000c64fff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.145228] >fff00000c6500000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 15.145265] ^ [ 15.145292] fff00000c6500080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 15.145334] fff00000c6500100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 15.145391] ==================================================================
[ 12.218861] ================================================================== [ 12.219349] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f1/0x340 [ 12.219640] Read of size 1 at addr ffff888102b40000 by task kunit_try_catch/165 [ 12.220203] [ 12.220394] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT(voluntary) [ 12.220440] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.220452] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.220474] Call Trace: [ 12.220486] <TASK> [ 12.220501] dump_stack_lvl+0x73/0xb0 [ 12.220531] print_report+0xd1/0x610 [ 12.220553] ? __virt_addr_valid+0x1db/0x2d0 [ 12.220575] ? kmalloc_large_uaf+0x2f1/0x340 [ 12.220595] ? kasan_addr_to_slab+0x11/0xa0 [ 12.220614] ? kmalloc_large_uaf+0x2f1/0x340 [ 12.220634] kasan_report+0x141/0x180 [ 12.220655] ? kmalloc_large_uaf+0x2f1/0x340 [ 12.220680] __asan_report_load1_noabort+0x18/0x20 [ 12.220703] kmalloc_large_uaf+0x2f1/0x340 [ 12.220723] ? __pfx_kmalloc_large_uaf+0x10/0x10 [ 12.220744] ? __schedule+0x10c6/0x2b60 [ 12.220766] ? __pfx_read_tsc+0x10/0x10 [ 12.220786] ? ktime_get_ts64+0x86/0x230 [ 12.220810] kunit_try_run_case+0x1a5/0x480 [ 12.220856] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.220877] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.220900] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.220923] ? __kthread_parkme+0x82/0x180 [ 12.220942] ? preempt_count_sub+0x50/0x80 [ 12.220965] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.220988] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.221010] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.221034] kthread+0x337/0x6f0 [ 12.221054] ? trace_preempt_on+0x20/0xc0 [ 12.221076] ? __pfx_kthread+0x10/0x10 [ 12.221096] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.221116] ? calculate_sigpending+0x7b/0xa0 [ 12.221140] ? __pfx_kthread+0x10/0x10 [ 12.221160] ret_from_fork+0x116/0x1d0 [ 12.221178] ? __pfx_kthread+0x10/0x10 [ 12.221198] ret_from_fork_asm+0x1a/0x30 [ 12.221245] </TASK> [ 12.221256] [ 12.228601] The buggy address belongs to the physical page: [ 12.228831] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b40 [ 12.229130] flags: 0x200000000000000(node=0|zone=2) [ 12.229311] raw: 0200000000000000 ffffea00040ad108 ffff88815b139f80 0000000000000000 [ 12.229601] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 12.229955] page dumped because: kasan: bad access detected [ 12.230206] [ 12.230300] Memory state around the buggy address: [ 12.230523] ffff888102b3ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.231071] ffff888102b3ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.231295] >ffff888102b40000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.231653] ^ [ 12.231837] ffff888102b40080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.232143] ffff888102b40100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.232483] ==================================================================