Date
July 4, 2025, 11:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.005758] ================================================================== [ 18.006100] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 18.006371] Read of size 1 at addr fff00000c5d29600 by task kunit_try_catch/164 [ 18.006695] [ 18.006748] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.006950] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.007000] Hardware name: linux,dummy-virt (DT) [ 18.007139] Call trace: [ 18.007338] show_stack+0x20/0x38 (C) [ 18.007475] dump_stack_lvl+0x8c/0xd0 [ 18.007648] print_report+0x118/0x608 [ 18.007880] kasan_report+0xdc/0x128 [ 18.007972] __kasan_check_byte+0x54/0x70 [ 18.008206] krealloc_noprof+0x44/0x360 [ 18.008381] krealloc_uaf+0x180/0x520 [ 18.008564] kunit_try_run_case+0x170/0x3f0 [ 18.008926] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.009116] kthread+0x328/0x630 [ 18.009166] ret_from_fork+0x10/0x20 [ 18.009545] [ 18.009592] Allocated by task 164: [ 18.009720] kasan_save_stack+0x3c/0x68 [ 18.009881] kasan_save_track+0x20/0x40 [ 18.009979] kasan_save_alloc_info+0x40/0x58 [ 18.010095] __kasan_kmalloc+0xd4/0xd8 [ 18.010130] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.010426] krealloc_uaf+0xc8/0x520 [ 18.010555] kunit_try_run_case+0x170/0x3f0 [ 18.010708] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.010849] kthread+0x328/0x630 [ 18.011024] ret_from_fork+0x10/0x20 [ 18.011085] [ 18.011151] Freed by task 164: [ 18.011199] kasan_save_stack+0x3c/0x68 [ 18.011517] kasan_save_track+0x20/0x40 [ 18.011631] kasan_save_free_info+0x4c/0x78 [ 18.011706] __kasan_slab_free+0x6c/0x98 [ 18.011853] kfree+0x214/0x3c8 [ 18.011976] krealloc_uaf+0x12c/0x520 [ 18.012138] kunit_try_run_case+0x170/0x3f0 [ 18.012176] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.012234] kthread+0x328/0x630 [ 18.012382] ret_from_fork+0x10/0x20 [ 18.012452] [ 18.012478] The buggy address belongs to the object at fff00000c5d29600 [ 18.012478] which belongs to the cache kmalloc-256 of size 256 [ 18.012586] The buggy address is located 0 bytes inside of [ 18.012586] freed 256-byte region [fff00000c5d29600, fff00000c5d29700) [ 18.012646] [ 18.012675] The buggy address belongs to the physical page: [ 18.012709] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105d28 [ 18.012763] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.012827] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.012900] page_type: f5(slab) [ 18.012948] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.012996] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.013044] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.013101] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.013149] head: 0bfffe0000000001 ffffc1ffc3174a01 00000000ffffffff 00000000ffffffff [ 18.013199] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.013245] page dumped because: kasan: bad access detected [ 18.013275] [ 18.013309] Memory state around the buggy address: [ 18.013342] fff00000c5d29500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.013383] fff00000c5d29580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.013433] >fff00000c5d29600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.013469] ^ [ 18.013497] fff00000c5d29680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.013546] fff00000c5d29700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.013591] ================================================================== [ 18.016040] ================================================================== [ 18.016100] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 18.016153] Read of size 1 at addr fff00000c5d29600 by task kunit_try_catch/164 [ 18.016200] [ 18.016234] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.016499] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.016761] Hardware name: linux,dummy-virt (DT) [ 18.017248] Call trace: [ 18.017317] show_stack+0x20/0x38 (C) [ 18.017593] dump_stack_lvl+0x8c/0xd0 [ 18.017686] print_report+0x118/0x608 [ 18.017817] kasan_report+0xdc/0x128 [ 18.017912] __asan_report_load1_noabort+0x20/0x30 [ 18.017966] krealloc_uaf+0x4c8/0x520 [ 18.018050] kunit_try_run_case+0x170/0x3f0 [ 18.018220] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.018450] kthread+0x328/0x630 [ 18.018778] ret_from_fork+0x10/0x20 [ 18.018870] [ 18.018941] Allocated by task 164: [ 18.019035] kasan_save_stack+0x3c/0x68 [ 18.019366] kasan_save_track+0x20/0x40 [ 18.019449] kasan_save_alloc_info+0x40/0x58 [ 18.019613] __kasan_kmalloc+0xd4/0xd8 [ 18.019758] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.019878] krealloc_uaf+0xc8/0x520 [ 18.019920] kunit_try_run_case+0x170/0x3f0 [ 18.020280] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.020385] kthread+0x328/0x630 [ 18.020502] ret_from_fork+0x10/0x20 [ 18.020779] [ 18.020851] Freed by task 164: [ 18.020946] kasan_save_stack+0x3c/0x68 [ 18.021088] kasan_save_track+0x20/0x40 [ 18.021141] kasan_save_free_info+0x4c/0x78 [ 18.021243] __kasan_slab_free+0x6c/0x98 [ 18.021704] kfree+0x214/0x3c8 [ 18.021820] krealloc_uaf+0x12c/0x520 [ 18.022042] kunit_try_run_case+0x170/0x3f0 [ 18.022159] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.022523] kthread+0x328/0x630 [ 18.022691] ret_from_fork+0x10/0x20 [ 18.022799] [ 18.022911] The buggy address belongs to the object at fff00000c5d29600 [ 18.022911] which belongs to the cache kmalloc-256 of size 256 [ 18.023018] The buggy address is located 0 bytes inside of [ 18.023018] freed 256-byte region [fff00000c5d29600, fff00000c5d29700) [ 18.023518] [ 18.023645] The buggy address belongs to the physical page: [ 18.023699] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105d28 [ 18.023768] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.023959] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.024149] page_type: f5(slab) [ 18.024292] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.024676] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.024747] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.025151] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.025376] head: 0bfffe0000000001 ffffc1ffc3174a01 00000000ffffffff 00000000ffffffff [ 18.025617] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.025839] page dumped because: kasan: bad access detected [ 18.025905] [ 18.025924] Memory state around the buggy address: [ 18.025957] fff00000c5d29500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.026125] fff00000c5d29580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.026191] >fff00000c5d29600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.026228] ^ [ 18.026257] fff00000c5d29680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.026296] fff00000c5d29700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.026339] ==================================================================
[ 11.830380] ================================================================== [ 11.830672] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.830947] Read of size 1 at addr ffff888100aa3200 by task kunit_try_catch/181 [ 11.831504] [ 11.831644] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.831694] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.831706] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.831727] Call Trace: [ 11.831741] <TASK> [ 11.831759] dump_stack_lvl+0x73/0xb0 [ 11.831791] print_report+0xd1/0x650 [ 11.831813] ? __virt_addr_valid+0x1db/0x2d0 [ 11.831835] ? krealloc_uaf+0x53c/0x5e0 [ 11.831855] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.831876] ? krealloc_uaf+0x53c/0x5e0 [ 11.831896] kasan_report+0x141/0x180 [ 11.831917] ? krealloc_uaf+0x53c/0x5e0 [ 11.831942] __asan_report_load1_noabort+0x18/0x20 [ 11.831965] krealloc_uaf+0x53c/0x5e0 [ 11.831986] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.832006] ? finish_task_switch.isra.0+0x153/0x700 [ 11.832027] ? __switch_to+0x47/0xf50 [ 11.832052] ? __schedule+0x10cc/0x2b60 [ 11.832073] ? __pfx_read_tsc+0x10/0x10 [ 11.832093] ? ktime_get_ts64+0x86/0x230 [ 11.832115] kunit_try_run_case+0x1a5/0x480 [ 11.832138] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.832159] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.832181] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.832527] ? __kthread_parkme+0x82/0x180 [ 11.832560] ? preempt_count_sub+0x50/0x80 [ 11.832582] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.832605] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.832628] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.832649] kthread+0x337/0x6f0 [ 11.832668] ? trace_preempt_on+0x20/0xc0 [ 11.832981] ? __pfx_kthread+0x10/0x10 [ 11.833010] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.833032] ? calculate_sigpending+0x7b/0xa0 [ 11.833055] ? __pfx_kthread+0x10/0x10 [ 11.833075] ret_from_fork+0x116/0x1d0 [ 11.833093] ? __pfx_kthread+0x10/0x10 [ 11.833112] ret_from_fork_asm+0x1a/0x30 [ 11.833142] </TASK> [ 11.833154] [ 11.843789] Allocated by task 181: [ 11.844000] kasan_save_stack+0x45/0x70 [ 11.844678] kasan_save_track+0x18/0x40 [ 11.844858] kasan_save_alloc_info+0x3b/0x50 [ 11.845147] __kasan_kmalloc+0xb7/0xc0 [ 11.845383] __kmalloc_cache_noprof+0x189/0x420 [ 11.845928] krealloc_uaf+0xbb/0x5e0 [ 11.846139] kunit_try_run_case+0x1a5/0x480 [ 11.846544] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.846727] kthread+0x337/0x6f0 [ 11.846901] ret_from_fork+0x116/0x1d0 [ 11.847091] ret_from_fork_asm+0x1a/0x30 [ 11.847541] [ 11.847641] Freed by task 181: [ 11.847792] kasan_save_stack+0x45/0x70 [ 11.847962] kasan_save_track+0x18/0x40 [ 11.848142] kasan_save_free_info+0x3f/0x60 [ 11.848731] __kasan_slab_free+0x56/0x70 [ 11.848910] kfree+0x222/0x3f0 [ 11.849406] krealloc_uaf+0x13d/0x5e0 [ 11.849561] kunit_try_run_case+0x1a5/0x480 [ 11.849990] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.850456] kthread+0x337/0x6f0 [ 11.851027] ret_from_fork+0x116/0x1d0 [ 11.851193] ret_from_fork_asm+0x1a/0x30 [ 11.851770] [ 11.851910] The buggy address belongs to the object at ffff888100aa3200 [ 11.851910] which belongs to the cache kmalloc-256 of size 256 [ 11.852854] The buggy address is located 0 bytes inside of [ 11.852854] freed 256-byte region [ffff888100aa3200, ffff888100aa3300) [ 11.853454] [ 11.853545] The buggy address belongs to the physical page: [ 11.854087] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa2 [ 11.854625] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.855049] flags: 0x200000000000040(head|node=0|zone=2) [ 11.855735] page_type: f5(slab) [ 11.855992] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.856624] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.856923] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.857527] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.857844] head: 0200000000000001 ffffea000402a881 00000000ffffffff 00000000ffffffff [ 11.858514] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.858930] page dumped because: kasan: bad access detected [ 11.859612] [ 11.859844] Memory state around the buggy address: [ 11.860090] ffff888100aa3100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.860713] ffff888100aa3180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.860995] >ffff888100aa3200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.861257] ^ [ 11.861450] ffff888100aa3280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.861895] ffff888100aa3300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.862185] ================================================================== [ 11.792811] ================================================================== [ 11.793820] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.794830] Read of size 1 at addr ffff888100aa3200 by task kunit_try_catch/181 [ 11.795918] [ 11.796267] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.796324] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.796336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.796359] Call Trace: [ 11.796376] <TASK> [ 11.796396] dump_stack_lvl+0x73/0xb0 [ 11.796434] print_report+0xd1/0x650 [ 11.796457] ? __virt_addr_valid+0x1db/0x2d0 [ 11.796479] ? krealloc_uaf+0x1b8/0x5e0 [ 11.796499] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.796520] ? krealloc_uaf+0x1b8/0x5e0 [ 11.796539] kasan_report+0x141/0x180 [ 11.796560] ? krealloc_uaf+0x1b8/0x5e0 [ 11.796582] ? krealloc_uaf+0x1b8/0x5e0 [ 11.796602] __kasan_check_byte+0x3d/0x50 [ 11.796622] krealloc_noprof+0x3f/0x340 [ 11.796644] krealloc_uaf+0x1b8/0x5e0 [ 11.796664] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.796837] ? finish_task_switch.isra.0+0x153/0x700 [ 11.796874] ? __switch_to+0x47/0xf50 [ 11.796902] ? __schedule+0x10cc/0x2b60 [ 11.796924] ? __pfx_read_tsc+0x10/0x10 [ 11.796944] ? ktime_get_ts64+0x86/0x230 [ 11.796968] kunit_try_run_case+0x1a5/0x480 [ 11.796993] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.797014] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.797036] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.797058] ? __kthread_parkme+0x82/0x180 [ 11.797077] ? preempt_count_sub+0x50/0x80 [ 11.797098] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.797119] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.797139] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.797160] kthread+0x337/0x6f0 [ 11.797179] ? trace_preempt_on+0x20/0xc0 [ 11.797232] ? __pfx_kthread+0x10/0x10 [ 11.797292] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.797312] ? calculate_sigpending+0x7b/0xa0 [ 11.797334] ? __pfx_kthread+0x10/0x10 [ 11.797354] ret_from_fork+0x116/0x1d0 [ 11.797371] ? __pfx_kthread+0x10/0x10 [ 11.797390] ret_from_fork_asm+0x1a/0x30 [ 11.797419] </TASK> [ 11.797431] [ 11.812772] Allocated by task 181: [ 11.812946] kasan_save_stack+0x45/0x70 [ 11.813106] kasan_save_track+0x18/0x40 [ 11.813251] kasan_save_alloc_info+0x3b/0x50 [ 11.813540] __kasan_kmalloc+0xb7/0xc0 [ 11.813666] __kmalloc_cache_noprof+0x189/0x420 [ 11.813991] krealloc_uaf+0xbb/0x5e0 [ 11.814352] kunit_try_run_case+0x1a5/0x480 [ 11.814519] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.814686] kthread+0x337/0x6f0 [ 11.814803] ret_from_fork+0x116/0x1d0 [ 11.814930] ret_from_fork_asm+0x1a/0x30 [ 11.815327] [ 11.815531] Freed by task 181: [ 11.815832] kasan_save_stack+0x45/0x70 [ 11.816277] kasan_save_track+0x18/0x40 [ 11.816673] kasan_save_free_info+0x3f/0x60 [ 11.817100] __kasan_slab_free+0x56/0x70 [ 11.817452] kfree+0x222/0x3f0 [ 11.817800] krealloc_uaf+0x13d/0x5e0 [ 11.818161] kunit_try_run_case+0x1a5/0x480 [ 11.818616] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.819156] kthread+0x337/0x6f0 [ 11.819493] ret_from_fork+0x116/0x1d0 [ 11.819848] ret_from_fork_asm+0x1a/0x30 [ 11.820029] [ 11.820108] The buggy address belongs to the object at ffff888100aa3200 [ 11.820108] which belongs to the cache kmalloc-256 of size 256 [ 11.820537] The buggy address is located 0 bytes inside of [ 11.820537] freed 256-byte region [ffff888100aa3200, ffff888100aa3300) [ 11.821409] [ 11.821582] The buggy address belongs to the physical page: [ 11.821870] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa2 [ 11.822432] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.823128] flags: 0x200000000000040(head|node=0|zone=2) [ 11.823768] page_type: f5(slab) [ 11.824136] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.824868] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.825095] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.825372] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.825631] head: 0200000000000001 ffffea000402a881 00000000ffffffff 00000000ffffffff [ 11.825874] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.826473] page dumped because: kasan: bad access detected [ 11.826956] [ 11.827159] Memory state around the buggy address: [ 11.827672] ffff888100aa3100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.828478] ffff888100aa3180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.828933] >ffff888100aa3200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.829141] ^ [ 11.829297] ffff888100aa3280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.829528] ffff888100aa3300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.829747] ==================================================================