Date
July 1, 2025, 11:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.354348] ================================================================== [ 18.354524] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 18.354588] Read of size 1 at addr fff00000c0b9ba00 by task kunit_try_catch/165 [ 18.354641] [ 18.354681] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.354770] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.354798] Hardware name: linux,dummy-virt (DT) [ 18.355012] Call trace: [ 18.355052] show_stack+0x20/0x38 (C) [ 18.355176] dump_stack_lvl+0x8c/0xd0 [ 18.355289] print_report+0x118/0x608 [ 18.355388] kasan_report+0xdc/0x128 [ 18.355451] __asan_report_load1_noabort+0x20/0x30 [ 18.355512] krealloc_uaf+0x4c8/0x520 [ 18.355559] kunit_try_run_case+0x170/0x3f0 [ 18.355635] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.355821] kthread+0x328/0x630 [ 18.355963] ret_from_fork+0x10/0x20 [ 18.356057] [ 18.356190] Allocated by task 165: [ 18.356283] kasan_save_stack+0x3c/0x68 [ 18.356328] kasan_save_track+0x20/0x40 [ 18.356367] kasan_save_alloc_info+0x40/0x58 [ 18.356437] __kasan_kmalloc+0xd4/0xd8 [ 18.356476] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.356518] krealloc_uaf+0xc8/0x520 [ 18.356686] kunit_try_run_case+0x170/0x3f0 [ 18.356793] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.356876] kthread+0x328/0x630 [ 18.356967] ret_from_fork+0x10/0x20 [ 18.357029] [ 18.357115] Freed by task 165: [ 18.357156] kasan_save_stack+0x3c/0x68 [ 18.357367] kasan_save_track+0x20/0x40 [ 18.357516] kasan_save_free_info+0x4c/0x78 [ 18.357580] __kasan_slab_free+0x6c/0x98 [ 18.357692] kfree+0x214/0x3c8 [ 18.357800] krealloc_uaf+0x12c/0x520 [ 18.357917] kunit_try_run_case+0x170/0x3f0 [ 18.358059] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.358119] kthread+0x328/0x630 [ 18.358165] ret_from_fork+0x10/0x20 [ 18.358202] [ 18.358223] The buggy address belongs to the object at fff00000c0b9ba00 [ 18.358223] which belongs to the cache kmalloc-256 of size 256 [ 18.358472] The buggy address is located 0 bytes inside of [ 18.358472] freed 256-byte region [fff00000c0b9ba00, fff00000c0b9bb00) [ 18.358585] [ 18.358638] The buggy address belongs to the physical page: [ 18.358783] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100b9a [ 18.358885] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.358937] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.359057] page_type: f5(slab) [ 18.359121] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.359189] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.359267] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.359320] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.359477] head: 0bfffe0000000001 ffffc1ffc302e681 00000000ffffffff 00000000ffffffff [ 18.359591] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.359672] page dumped because: kasan: bad access detected [ 18.359707] [ 18.359725] Memory state around the buggy address: [ 18.359808] fff00000c0b9b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.359868] fff00000c0b9b980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.359957] >fff00000c0b9ba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.360056] ^ [ 18.360094] fff00000c0b9ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.360165] fff00000c0b9bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.360208] ================================================================== [ 18.346483] ================================================================== [ 18.346606] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 18.346896] Read of size 1 at addr fff00000c0b9ba00 by task kunit_try_catch/165 [ 18.346987] [ 18.347034] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.347164] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.347255] Hardware name: linux,dummy-virt (DT) [ 18.347295] Call trace: [ 18.347320] show_stack+0x20/0x38 (C) [ 18.347379] dump_stack_lvl+0x8c/0xd0 [ 18.347538] print_report+0x118/0x608 [ 18.347591] kasan_report+0xdc/0x128 [ 18.347639] __kasan_check_byte+0x54/0x70 [ 18.347688] krealloc_noprof+0x44/0x360 [ 18.347985] krealloc_uaf+0x180/0x520 [ 18.348058] kunit_try_run_case+0x170/0x3f0 [ 18.348196] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.348296] kthread+0x328/0x630 [ 18.348356] ret_from_fork+0x10/0x20 [ 18.348462] [ 18.348536] Allocated by task 165: [ 18.348622] kasan_save_stack+0x3c/0x68 [ 18.348727] kasan_save_track+0x20/0x40 [ 18.348841] kasan_save_alloc_info+0x40/0x58 [ 18.348885] __kasan_kmalloc+0xd4/0xd8 [ 18.348925] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.348968] krealloc_uaf+0xc8/0x520 [ 18.349005] kunit_try_run_case+0x170/0x3f0 [ 18.349238] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.349319] kthread+0x328/0x630 [ 18.349356] ret_from_fork+0x10/0x20 [ 18.349395] [ 18.349469] Freed by task 165: [ 18.349514] kasan_save_stack+0x3c/0x68 [ 18.349715] kasan_save_track+0x20/0x40 [ 18.349869] kasan_save_free_info+0x4c/0x78 [ 18.349970] __kasan_slab_free+0x6c/0x98 [ 18.350099] kfree+0x214/0x3c8 [ 18.350261] krealloc_uaf+0x12c/0x520 [ 18.350327] kunit_try_run_case+0x170/0x3f0 [ 18.350479] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.350618] kthread+0x328/0x630 [ 18.350701] ret_from_fork+0x10/0x20 [ 18.350840] [ 18.350915] The buggy address belongs to the object at fff00000c0b9ba00 [ 18.350915] which belongs to the cache kmalloc-256 of size 256 [ 18.351072] The buggy address is located 0 bytes inside of [ 18.351072] freed 256-byte region [fff00000c0b9ba00, fff00000c0b9bb00) [ 18.351152] [ 18.351177] The buggy address belongs to the physical page: [ 18.351215] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100b9a [ 18.351427] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.351542] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.351701] page_type: f5(slab) [ 18.351819] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.351961] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.352014] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.352203] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.352261] head: 0bfffe0000000001 ffffc1ffc302e681 00000000ffffffff 00000000ffffffff [ 18.352450] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.352565] page dumped because: kasan: bad access detected [ 18.352638] [ 18.352794] Memory state around the buggy address: [ 18.352863] fff00000c0b9b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.352941] fff00000c0b9b980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.353036] >fff00000c0b9ba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.353079] ^ [ 18.353110] fff00000c0b9ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.353167] fff00000c0b9bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.353209] ==================================================================
[ 11.502816] ================================================================== [ 11.503333] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.503577] Read of size 1 at addr ffff88810033b800 by task kunit_try_catch/181 [ 11.503977] [ 11.504210] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.504256] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.504268] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.504287] Call Trace: [ 11.504300] <TASK> [ 11.504319] dump_stack_lvl+0x73/0xb0 [ 11.504348] print_report+0xd1/0x650 [ 11.504370] ? __virt_addr_valid+0x1db/0x2d0 [ 11.504411] ? krealloc_uaf+0x53c/0x5e0 [ 11.504430] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.504451] ? krealloc_uaf+0x53c/0x5e0 [ 11.504472] kasan_report+0x141/0x180 [ 11.504492] ? krealloc_uaf+0x53c/0x5e0 [ 11.504518] __asan_report_load1_noabort+0x18/0x20 [ 11.504540] krealloc_uaf+0x53c/0x5e0 [ 11.504560] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.504579] ? finish_task_switch.isra.0+0x153/0x700 [ 11.504601] ? __switch_to+0x47/0xf50 [ 11.504626] ? __schedule+0x10cc/0x2b60 [ 11.504647] ? __pfx_read_tsc+0x10/0x10 [ 11.504667] ? ktime_get_ts64+0x86/0x230 [ 11.504691] kunit_try_run_case+0x1a5/0x480 [ 11.504715] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.504735] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.504758] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.504779] ? __kthread_parkme+0x82/0x180 [ 11.504798] ? preempt_count_sub+0x50/0x80 [ 11.504819] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.504841] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.504862] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.504883] kthread+0x337/0x6f0 [ 11.504901] ? trace_preempt_on+0x20/0xc0 [ 11.504923] ? __pfx_kthread+0x10/0x10 [ 11.504942] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.504961] ? calculate_sigpending+0x7b/0xa0 [ 11.504984] ? __pfx_kthread+0x10/0x10 [ 11.505049] ret_from_fork+0x116/0x1d0 [ 11.505068] ? __pfx_kthread+0x10/0x10 [ 11.505087] ret_from_fork_asm+0x1a/0x30 [ 11.505119] </TASK> [ 11.505130] [ 11.512713] Allocated by task 181: [ 11.512893] kasan_save_stack+0x45/0x70 [ 11.513150] kasan_save_track+0x18/0x40 [ 11.513340] kasan_save_alloc_info+0x3b/0x50 [ 11.513542] __kasan_kmalloc+0xb7/0xc0 [ 11.513726] __kmalloc_cache_noprof+0x189/0x420 [ 11.513917] krealloc_uaf+0xbb/0x5e0 [ 11.514314] kunit_try_run_case+0x1a5/0x480 [ 11.514520] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.514773] kthread+0x337/0x6f0 [ 11.515025] ret_from_fork+0x116/0x1d0 [ 11.515163] ret_from_fork_asm+0x1a/0x30 [ 11.515357] [ 11.515463] Freed by task 181: [ 11.515597] kasan_save_stack+0x45/0x70 [ 11.515761] kasan_save_track+0x18/0x40 [ 11.516013] kasan_save_free_info+0x3f/0x60 [ 11.516220] __kasan_slab_free+0x56/0x70 [ 11.516353] kfree+0x222/0x3f0 [ 11.516482] krealloc_uaf+0x13d/0x5e0 [ 11.516612] kunit_try_run_case+0x1a5/0x480 [ 11.516753] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.517132] kthread+0x337/0x6f0 [ 11.517308] ret_from_fork+0x116/0x1d0 [ 11.517504] ret_from_fork_asm+0x1a/0x30 [ 11.517848] [ 11.517958] The buggy address belongs to the object at ffff88810033b800 [ 11.517958] which belongs to the cache kmalloc-256 of size 256 [ 11.518312] The buggy address is located 0 bytes inside of [ 11.518312] freed 256-byte region [ffff88810033b800, ffff88810033b900) [ 11.519324] [ 11.519416] The buggy address belongs to the physical page: [ 11.519689] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10033a [ 11.519931] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.520565] flags: 0x200000000000040(head|node=0|zone=2) [ 11.520854] page_type: f5(slab) [ 11.521008] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.521240] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.521850] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.522697] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.523051] head: 0200000000000001 ffffea000400ce81 00000000ffffffff 00000000ffffffff [ 11.523393] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.523756] page dumped because: kasan: bad access detected [ 11.523928] [ 11.523997] Memory state around the buggy address: [ 11.524191] ffff88810033b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.524516] ffff88810033b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.524750] >ffff88810033b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.525066] ^ [ 11.525232] ffff88810033b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.525506] ffff88810033b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.525879] ================================================================== [ 11.475769] ================================================================== [ 11.476544] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.476930] Read of size 1 at addr ffff88810033b800 by task kunit_try_catch/181 [ 11.477236] [ 11.477364] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.477423] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.477435] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.477456] Call Trace: [ 11.477470] <TASK> [ 11.477490] dump_stack_lvl+0x73/0xb0 [ 11.477523] print_report+0xd1/0x650 [ 11.477546] ? __virt_addr_valid+0x1db/0x2d0 [ 11.477571] ? krealloc_uaf+0x1b8/0x5e0 [ 11.477590] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.477611] ? krealloc_uaf+0x1b8/0x5e0 [ 11.477633] kasan_report+0x141/0x180 [ 11.477654] ? krealloc_uaf+0x1b8/0x5e0 [ 11.477678] ? krealloc_uaf+0x1b8/0x5e0 [ 11.477698] __kasan_check_byte+0x3d/0x50 [ 11.477719] krealloc_noprof+0x3f/0x340 [ 11.477741] krealloc_uaf+0x1b8/0x5e0 [ 11.477761] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.477781] ? finish_task_switch.isra.0+0x153/0x700 [ 11.477804] ? __switch_to+0x47/0xf50 [ 11.477829] ? __schedule+0x10cc/0x2b60 [ 11.477851] ? __pfx_read_tsc+0x10/0x10 [ 11.477872] ? ktime_get_ts64+0x86/0x230 [ 11.477895] kunit_try_run_case+0x1a5/0x480 [ 11.477920] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.477942] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.477965] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.477987] ? __kthread_parkme+0x82/0x180 [ 11.478008] ? preempt_count_sub+0x50/0x80 [ 11.478029] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.478051] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.478072] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.478094] kthread+0x337/0x6f0 [ 11.478112] ? trace_preempt_on+0x20/0xc0 [ 11.478135] ? __pfx_kthread+0x10/0x10 [ 11.478154] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.478173] ? calculate_sigpending+0x7b/0xa0 [ 11.478196] ? __pfx_kthread+0x10/0x10 [ 11.478216] ret_from_fork+0x116/0x1d0 [ 11.478234] ? __pfx_kthread+0x10/0x10 [ 11.478268] ret_from_fork_asm+0x1a/0x30 [ 11.478299] </TASK> [ 11.478310] [ 11.486729] Allocated by task 181: [ 11.486934] kasan_save_stack+0x45/0x70 [ 11.487315] kasan_save_track+0x18/0x40 [ 11.487520] kasan_save_alloc_info+0x3b/0x50 [ 11.488056] __kasan_kmalloc+0xb7/0xc0 [ 11.488211] __kmalloc_cache_noprof+0x189/0x420 [ 11.488435] krealloc_uaf+0xbb/0x5e0 [ 11.488614] kunit_try_run_case+0x1a5/0x480 [ 11.488799] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.489004] kthread+0x337/0x6f0 [ 11.489260] ret_from_fork+0x116/0x1d0 [ 11.489465] ret_from_fork_asm+0x1a/0x30 [ 11.489623] [ 11.489730] Freed by task 181: [ 11.489863] kasan_save_stack+0x45/0x70 [ 11.490016] kasan_save_track+0x18/0x40 [ 11.490260] kasan_save_free_info+0x3f/0x60 [ 11.490484] __kasan_slab_free+0x56/0x70 [ 11.490753] kfree+0x222/0x3f0 [ 11.491099] krealloc_uaf+0x13d/0x5e0 [ 11.491237] kunit_try_run_case+0x1a5/0x480 [ 11.491394] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.491667] kthread+0x337/0x6f0 [ 11.491836] ret_from_fork+0x116/0x1d0 [ 11.492349] ret_from_fork_asm+0x1a/0x30 [ 11.492619] [ 11.492717] The buggy address belongs to the object at ffff88810033b800 [ 11.492717] which belongs to the cache kmalloc-256 of size 256 [ 11.493331] The buggy address is located 0 bytes inside of [ 11.493331] freed 256-byte region [ffff88810033b800, ffff88810033b900) [ 11.493756] [ 11.493833] The buggy address belongs to the physical page: [ 11.494020] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10033a [ 11.494559] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.494801] flags: 0x200000000000040(head|node=0|zone=2) [ 11.494981] page_type: f5(slab) [ 11.495104] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.495460] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.496046] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.496368] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.496767] head: 0200000000000001 ffffea000400ce81 00000000ffffffff 00000000ffffffff [ 11.497039] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.497499] page dumped because: kasan: bad access detected [ 11.498512] [ 11.498917] Memory state around the buggy address: [ 11.499529] ffff88810033b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.499945] ffff88810033b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.500385] >ffff88810033b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.500846] ^ [ 11.500972] ffff88810033b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.501434] ffff88810033b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.501838] ==================================================================