Date
May 23, 2025, 11:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 27.349218] ================================================================== [ 27.349441] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 27.349849] Read of size 1 at addr fff00000c1a54a00 by task kunit_try_catch/166 [ 27.350111] [ 27.350312] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7 #1 PREEMPT [ 27.350860] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.350942] Hardware name: linux,dummy-virt (DT) [ 27.351322] Call trace: [ 27.351508] show_stack+0x20/0x38 (C) [ 27.351737] dump_stack_lvl+0x8c/0xd0 [ 27.352246] print_report+0x118/0x608 [ 27.352387] kasan_report+0xdc/0x128 [ 27.352534] __kasan_check_byte+0x54/0x70 [ 27.352774] krealloc_noprof+0x44/0x360 [ 27.353030] krealloc_uaf+0x180/0x520 [ 27.353521] kunit_try_run_case+0x170/0x3f0 [ 27.353833] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.354129] kthread+0x328/0x630 [ 27.354500] ret_from_fork+0x10/0x20 [ 27.354899] [ 27.354984] Allocated by task 166: [ 27.355086] kasan_save_stack+0x3c/0x68 [ 27.355534] kasan_save_track+0x20/0x40 [ 27.355673] kasan_save_alloc_info+0x40/0x58 [ 27.355864] __kasan_kmalloc+0xd4/0xd8 [ 27.356013] __kmalloc_cache_noprof+0x15c/0x3c0 [ 27.356135] krealloc_uaf+0xc8/0x520 [ 27.356288] kunit_try_run_case+0x170/0x3f0 [ 27.356404] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.356525] kthread+0x328/0x630 [ 27.356603] ret_from_fork+0x10/0x20 [ 27.356715] [ 27.356769] Freed by task 166: [ 27.356845] kasan_save_stack+0x3c/0x68 [ 27.356953] kasan_save_track+0x20/0x40 [ 27.357051] kasan_save_free_info+0x4c/0x78 [ 27.357186] __kasan_slab_free+0x6c/0x98 [ 27.357291] kfree+0x214/0x3c8 [ 27.357389] krealloc_uaf+0x12c/0x520 [ 27.357528] kunit_try_run_case+0x170/0x3f0 [ 27.357644] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.357771] kthread+0x328/0x630 [ 27.357895] ret_from_fork+0x10/0x20 [ 27.358015] [ 27.358120] The buggy address belongs to the object at fff00000c1a54a00 [ 27.358120] which belongs to the cache kmalloc-256 of size 256 [ 27.358415] The buggy address is located 0 bytes inside of [ 27.358415] freed 256-byte region [fff00000c1a54a00, fff00000c1a54b00) [ 27.358636] [ 27.358699] The buggy address belongs to the physical page: [ 27.358800] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101a54 [ 27.359022] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 27.359208] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 27.359403] page_type: f5(slab) [ 27.359537] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 27.359734] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.359881] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 27.360054] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.360214] head: 0bfffe0000000001 ffffc1ffc3069501 00000000ffffffff 00000000ffffffff [ 27.360347] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 27.360501] page dumped because: kasan: bad access detected [ 27.360697] [ 27.360754] Memory state around the buggy address: [ 27.360845] fff00000c1a54900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.360957] fff00000c1a54980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.361052] >fff00000c1a54a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.361131] ^ [ 27.361237] fff00000c1a54a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.361380] fff00000c1a54b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.361503] ================================================================== [ 27.363181] ================================================================== [ 27.363382] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 27.363603] Read of size 1 at addr fff00000c1a54a00 by task kunit_try_catch/166 [ 27.363795] [ 27.363918] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7 #1 PREEMPT [ 27.364128] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.364201] Hardware name: linux,dummy-virt (DT) [ 27.364323] Call trace: [ 27.364401] show_stack+0x20/0x38 (C) [ 27.364554] dump_stack_lvl+0x8c/0xd0 [ 27.364710] print_report+0x118/0x608 [ 27.364844] kasan_report+0xdc/0x128 [ 27.364960] __asan_report_load1_noabort+0x20/0x30 [ 27.365082] krealloc_uaf+0x4c8/0x520 [ 27.365200] kunit_try_run_case+0x170/0x3f0 [ 27.365351] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.365557] kthread+0x328/0x630 [ 27.365774] ret_from_fork+0x10/0x20 [ 27.366000] [ 27.366077] Allocated by task 166: [ 27.366155] kasan_save_stack+0x3c/0x68 [ 27.366309] kasan_save_track+0x20/0x40 [ 27.366417] kasan_save_alloc_info+0x40/0x58 [ 27.366533] __kasan_kmalloc+0xd4/0xd8 [ 27.366630] __kmalloc_cache_noprof+0x15c/0x3c0 [ 27.366744] krealloc_uaf+0xc8/0x520 [ 27.366854] kunit_try_run_case+0x170/0x3f0 [ 27.366965] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.367088] kthread+0x328/0x630 [ 27.367193] ret_from_fork+0x10/0x20 [ 27.367296] [ 27.367350] Freed by task 166: [ 27.367437] kasan_save_stack+0x3c/0x68 [ 27.367561] kasan_save_track+0x20/0x40 [ 27.367703] kasan_save_free_info+0x4c/0x78 [ 27.367813] __kasan_slab_free+0x6c/0x98 [ 27.367947] kfree+0x214/0x3c8 [ 27.368047] krealloc_uaf+0x12c/0x520 [ 27.368157] kunit_try_run_case+0x170/0x3f0 [ 27.368260] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.368421] kthread+0x328/0x630 [ 27.368550] ret_from_fork+0x10/0x20 [ 27.368656] [ 27.368711] The buggy address belongs to the object at fff00000c1a54a00 [ 27.368711] which belongs to the cache kmalloc-256 of size 256 [ 27.368883] The buggy address is located 0 bytes inside of [ 27.368883] freed 256-byte region [fff00000c1a54a00, fff00000c1a54b00) [ 27.369045] [ 27.369091] The buggy address belongs to the physical page: [ 27.369162] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101a54 [ 27.369683] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 27.369826] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 27.369992] page_type: f5(slab) [ 27.370149] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 27.370298] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.370461] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 27.370608] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.370773] head: 0bfffe0000000001 ffffc1ffc3069501 00000000ffffffff 00000000ffffffff [ 27.370974] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 27.371142] page dumped because: kasan: bad access detected [ 27.371226] [ 27.371276] Memory state around the buggy address: [ 27.371411] fff00000c1a54900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.371550] fff00000c1a54980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.371774] >fff00000c1a54a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.371886] ^ [ 27.371967] fff00000c1a54a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.372113] fff00000c1a54b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.372245] ==================================================================
[ 12.547007] ================================================================== [ 12.547358] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.548015] Read of size 1 at addr ffff888100347a00 by task kunit_try_catch/183 [ 12.548314] [ 12.548410] CPU: 0 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7 #1 PREEMPT(voluntary) [ 12.548455] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.548467] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.548487] Call Trace: [ 12.548499] <TASK> [ 12.548513] dump_stack_lvl+0x73/0xb0 [ 12.548540] print_report+0xd1/0x650 [ 12.548562] ? __virt_addr_valid+0x1db/0x2d0 [ 12.548583] ? krealloc_uaf+0x53c/0x5e0 [ 12.548604] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.548625] ? krealloc_uaf+0x53c/0x5e0 [ 12.548647] kasan_report+0x141/0x180 [ 12.548669] ? krealloc_uaf+0x53c/0x5e0 [ 12.548694] __asan_report_load1_noabort+0x18/0x20 [ 12.548714] krealloc_uaf+0x53c/0x5e0 [ 12.548736] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.548756] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 12.548785] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.548810] kunit_try_run_case+0x1a5/0x480 [ 12.548833] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.548854] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.548877] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.548899] ? __kthread_parkme+0x82/0x180 [ 12.548919] ? preempt_count_sub+0x50/0x80 [ 12.548944] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.548966] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.548988] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.549009] kthread+0x337/0x6f0 [ 12.549026] ? trace_preempt_on+0x20/0xc0 [ 12.549048] ? __pfx_kthread+0x10/0x10 [ 12.549065] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.549085] ? calculate_sigpending+0x7b/0xa0 [ 12.549146] ? __pfx_kthread+0x10/0x10 [ 12.549167] ret_from_fork+0x41/0x80 [ 12.549187] ? __pfx_kthread+0x10/0x10 [ 12.549205] ret_from_fork_asm+0x1a/0x30 [ 12.549235] </TASK> [ 12.549246] [ 12.556774] Allocated by task 183: [ 12.557019] kasan_save_stack+0x45/0x70 [ 12.557167] kasan_save_track+0x18/0x40 [ 12.557315] kasan_save_alloc_info+0x3b/0x50 [ 12.557547] __kasan_kmalloc+0xb7/0xc0 [ 12.557737] __kmalloc_cache_noprof+0x189/0x420 [ 12.558101] krealloc_uaf+0xbb/0x5e0 [ 12.558307] kunit_try_run_case+0x1a5/0x480 [ 12.558583] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.558829] kthread+0x337/0x6f0 [ 12.558951] ret_from_fork+0x41/0x80 [ 12.559083] ret_from_fork_asm+0x1a/0x30 [ 12.559327] [ 12.559427] Freed by task 183: [ 12.559583] kasan_save_stack+0x45/0x70 [ 12.559799] kasan_save_track+0x18/0x40 [ 12.559990] kasan_save_free_info+0x3f/0x60 [ 12.560179] __kasan_slab_free+0x56/0x70 [ 12.560366] kfree+0x222/0x3f0 [ 12.561452] krealloc_uaf+0x13d/0x5e0 [ 12.562284] kunit_try_run_case+0x1a5/0x480 [ 12.562753] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.563038] kthread+0x337/0x6f0 [ 12.563223] ret_from_fork+0x41/0x80 [ 12.563400] ret_from_fork_asm+0x1a/0x30 [ 12.563842] [ 12.563992] The buggy address belongs to the object at ffff888100347a00 [ 12.563992] which belongs to the cache kmalloc-256 of size 256 [ 12.564622] The buggy address is located 0 bytes inside of [ 12.564622] freed 256-byte region [ffff888100347a00, ffff888100347b00) [ 12.565342] [ 12.565432] The buggy address belongs to the physical page: [ 12.565956] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100346 [ 12.566288] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.566639] flags: 0x200000000000040(head|node=0|zone=2) [ 12.567032] page_type: f5(slab) [ 12.567284] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.567699] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.568115] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.568449] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.568922] head: 0200000000000001 ffffea000400d181 00000000ffffffff 00000000ffffffff [ 12.569431] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.569880] page dumped because: kasan: bad access detected [ 12.570194] [ 12.570437] Memory state around the buggy address: [ 12.570624] ffff888100347900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.571223] ffff888100347980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.571718] >ffff888100347a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.572093] ^ [ 12.572218] ffff888100347a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.572694] ffff888100347b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.572975] ================================================================== [ 12.524177] ================================================================== [ 12.524709] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.524979] Read of size 1 at addr ffff888100347a00 by task kunit_try_catch/183 [ 12.525376] [ 12.525528] CPU: 0 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7 #1 PREEMPT(voluntary) [ 12.525575] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.525587] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.525607] Call Trace: [ 12.525619] <TASK> [ 12.525635] dump_stack_lvl+0x73/0xb0 [ 12.525663] print_report+0xd1/0x650 [ 12.525684] ? __virt_addr_valid+0x1db/0x2d0 [ 12.525705] ? krealloc_uaf+0x1b8/0x5e0 [ 12.525725] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.525747] ? krealloc_uaf+0x1b8/0x5e0 [ 12.525769] kasan_report+0x141/0x180 [ 12.525790] ? krealloc_uaf+0x1b8/0x5e0 [ 12.525815] ? krealloc_uaf+0x1b8/0x5e0 [ 12.525836] __kasan_check_byte+0x3d/0x50 [ 12.525858] krealloc_noprof+0x3f/0x340 [ 12.525882] krealloc_uaf+0x1b8/0x5e0 [ 12.525903] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.525924] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 12.525995] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.526021] kunit_try_run_case+0x1a5/0x480 [ 12.526046] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.526067] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.526090] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.526112] ? __kthread_parkme+0x82/0x180 [ 12.526133] ? preempt_count_sub+0x50/0x80 [ 12.526157] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.526179] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.526201] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.526223] kthread+0x337/0x6f0 [ 12.526239] ? trace_preempt_on+0x20/0xc0 [ 12.526262] ? __pfx_kthread+0x10/0x10 [ 12.526280] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.526314] ? calculate_sigpending+0x7b/0xa0 [ 12.526334] ? __pfx_kthread+0x10/0x10 [ 12.526353] ret_from_fork+0x41/0x80 [ 12.526373] ? __pfx_kthread+0x10/0x10 [ 12.526390] ret_from_fork_asm+0x1a/0x30 [ 12.526420] </TASK> [ 12.526444] [ 12.533942] Allocated by task 183: [ 12.534128] kasan_save_stack+0x45/0x70 [ 12.534356] kasan_save_track+0x18/0x40 [ 12.534772] kasan_save_alloc_info+0x3b/0x50 [ 12.535033] __kasan_kmalloc+0xb7/0xc0 [ 12.535187] __kmalloc_cache_noprof+0x189/0x420 [ 12.535357] krealloc_uaf+0xbb/0x5e0 [ 12.535536] kunit_try_run_case+0x1a5/0x480 [ 12.535791] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.536106] kthread+0x337/0x6f0 [ 12.536247] ret_from_fork+0x41/0x80 [ 12.536448] ret_from_fork_asm+0x1a/0x30 [ 12.536627] [ 12.536745] Freed by task 183: [ 12.536953] kasan_save_stack+0x45/0x70 [ 12.537142] kasan_save_track+0x18/0x40 [ 12.537323] kasan_save_free_info+0x3f/0x60 [ 12.537547] __kasan_slab_free+0x56/0x70 [ 12.537719] kfree+0x222/0x3f0 [ 12.537868] krealloc_uaf+0x13d/0x5e0 [ 12.538009] kunit_try_run_case+0x1a5/0x480 [ 12.538154] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.538339] kthread+0x337/0x6f0 [ 12.538460] ret_from_fork+0x41/0x80 [ 12.538608] ret_from_fork_asm+0x1a/0x30 [ 12.538869] [ 12.538967] The buggy address belongs to the object at ffff888100347a00 [ 12.538967] which belongs to the cache kmalloc-256 of size 256 [ 12.539541] The buggy address is located 0 bytes inside of [ 12.539541] freed 256-byte region [ffff888100347a00, ffff888100347b00) [ 12.540267] [ 12.540363] The buggy address belongs to the physical page: [ 12.540838] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100346 [ 12.541237] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.541652] flags: 0x200000000000040(head|node=0|zone=2) [ 12.541923] page_type: f5(slab) [ 12.542070] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.542358] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.542701] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.543307] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.543615] head: 0200000000000001 ffffea000400d181 00000000ffffffff 00000000ffffffff [ 12.543861] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.544209] page dumped because: kasan: bad access detected [ 12.544531] [ 12.544609] Memory state around the buggy address: [ 12.544768] ffff888100347900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.545168] ffff888100347980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.545535] >ffff888100347a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.545858] ^ [ 12.546061] ffff888100347a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.546354] ffff888100347b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.546601] ==================================================================