Date
July 5, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.908959] ================================================================== [ 18.909067] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 18.909171] Read of size 1 at addr fff00000c091fa00 by task kunit_try_catch/165 [ 18.909277] [ 18.909339] CPU: 0 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.909522] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.909640] Hardware name: linux,dummy-virt (DT) [ 18.910011] Call trace: [ 18.910090] show_stack+0x20/0x38 (C) [ 18.910463] dump_stack_lvl+0x8c/0xd0 [ 18.910802] print_report+0x118/0x608 [ 18.911106] kasan_report+0xdc/0x128 [ 18.911247] __asan_report_load1_noabort+0x20/0x30 [ 18.911432] krealloc_uaf+0x4c8/0x520 [ 18.911525] kunit_try_run_case+0x170/0x3f0 [ 18.911767] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.912119] kthread+0x328/0x630 [ 18.912259] ret_from_fork+0x10/0x20 [ 18.912390] [ 18.912424] Allocated by task 165: [ 18.912473] kasan_save_stack+0x3c/0x68 [ 18.912548] kasan_save_track+0x20/0x40 [ 18.912617] kasan_save_alloc_info+0x40/0x58 [ 18.912693] __kasan_kmalloc+0xd4/0xd8 [ 18.912790] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.912884] krealloc_uaf+0xc8/0x520 [ 18.912990] kunit_try_run_case+0x170/0x3f0 [ 18.913098] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.913223] kthread+0x328/0x630 [ 18.913316] ret_from_fork+0x10/0x20 [ 18.913410] [ 18.913443] Freed by task 165: [ 18.913496] kasan_save_stack+0x3c/0x68 [ 18.913825] kasan_save_track+0x20/0x40 [ 18.914013] kasan_save_free_info+0x4c/0x78 [ 18.914110] __kasan_slab_free+0x6c/0x98 [ 18.914182] kfree+0x214/0x3c8 [ 18.914239] krealloc_uaf+0x12c/0x520 [ 18.914298] kunit_try_run_case+0x170/0x3f0 [ 18.914389] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.914484] kthread+0x328/0x630 [ 18.914561] ret_from_fork+0x10/0x20 [ 18.914636] [ 18.914675] The buggy address belongs to the object at fff00000c091fa00 [ 18.914675] which belongs to the cache kmalloc-256 of size 256 [ 18.914801] The buggy address is located 0 bytes inside of [ 18.914801] freed 256-byte region [fff00000c091fa00, fff00000c091fb00) [ 18.914945] [ 18.914982] The buggy address belongs to the physical page: [ 18.915043] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10091e [ 18.915409] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.915616] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.915716] page_type: f5(slab) [ 18.915790] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.915887] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.916412] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.916587] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.916695] head: 0bfffe0000000001 ffffc1ffc3024781 00000000ffffffff 00000000ffffffff [ 18.916788] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.916867] page dumped because: kasan: bad access detected [ 18.916941] [ 18.916976] Memory state around the buggy address: [ 18.917039] fff00000c091f900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.917433] fff00000c091f980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.917533] >fff00000c091fa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.917644] ^ [ 18.917714] fff00000c091fa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.917838] fff00000c091fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.917936] ================================================================== [ 18.896255] ================================================================== [ 18.896423] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 18.896528] Read of size 1 at addr fff00000c091fa00 by task kunit_try_catch/165 [ 18.897250] [ 18.897368] CPU: 0 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.897590] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.897671] Hardware name: linux,dummy-virt (DT) [ 18.897746] Call trace: [ 18.897790] show_stack+0x20/0x38 (C) [ 18.897888] dump_stack_lvl+0x8c/0xd0 [ 18.897984] print_report+0x118/0x608 [ 18.898383] kasan_report+0xdc/0x128 [ 18.898507] __kasan_check_byte+0x54/0x70 [ 18.898611] krealloc_noprof+0x44/0x360 [ 18.898696] krealloc_uaf+0x180/0x520 [ 18.899144] kunit_try_run_case+0x170/0x3f0 [ 18.899288] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.899433] kthread+0x328/0x630 [ 18.899578] ret_from_fork+0x10/0x20 [ 18.899704] [ 18.899754] Allocated by task 165: [ 18.899807] kasan_save_stack+0x3c/0x68 [ 18.899889] kasan_save_track+0x20/0x40 [ 18.899962] kasan_save_alloc_info+0x40/0x58 [ 18.900340] __kasan_kmalloc+0xd4/0xd8 [ 18.900442] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.900522] krealloc_uaf+0xc8/0x520 [ 18.900600] kunit_try_run_case+0x170/0x3f0 [ 18.900690] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.900779] kthread+0x328/0x630 [ 18.901071] ret_from_fork+0x10/0x20 [ 18.901146] [ 18.901187] Freed by task 165: [ 18.901635] kasan_save_stack+0x3c/0x68 [ 18.901892] kasan_save_track+0x20/0x40 [ 18.901969] kasan_save_free_info+0x4c/0x78 [ 18.902047] __kasan_slab_free+0x6c/0x98 [ 18.902124] kfree+0x214/0x3c8 [ 18.902316] krealloc_uaf+0x12c/0x520 [ 18.902630] kunit_try_run_case+0x170/0x3f0 [ 18.902771] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.902850] kthread+0x328/0x630 [ 18.902908] ret_from_fork+0x10/0x20 [ 18.902975] [ 18.903016] The buggy address belongs to the object at fff00000c091fa00 [ 18.903016] which belongs to the cache kmalloc-256 of size 256 [ 18.903270] The buggy address is located 0 bytes inside of [ 18.903270] freed 256-byte region [fff00000c091fa00, fff00000c091fb00) [ 18.903425] [ 18.903466] The buggy address belongs to the physical page: [ 18.903529] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10091e [ 18.903957] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.904055] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.904273] page_type: f5(slab) [ 18.904480] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.904587] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.904688] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.904791] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.904887] head: 0bfffe0000000001 ffffc1ffc3024781 00000000ffffffff 00000000ffffffff [ 18.904995] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.905178] page dumped because: kasan: bad access detected [ 18.905562] [ 18.905605] Memory state around the buggy address: [ 18.905673] fff00000c091f900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.905804] fff00000c091f980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.905934] >fff00000c091fa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.906054] ^ [ 18.906111] fff00000c091fa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.906541] fff00000c091fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.906803] ==================================================================
[ 13.545443] ================================================================== [ 13.545861] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 13.546536] Read of size 1 at addr ffff888100ab1000 by task kunit_try_catch/181 [ 13.547125] [ 13.547373] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.547430] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.547445] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.547471] Call Trace: [ 13.547494] <TASK> [ 13.547517] dump_stack_lvl+0x73/0xb0 [ 13.547640] print_report+0xd1/0x650 [ 13.547681] ? __virt_addr_valid+0x1db/0x2d0 [ 13.547708] ? krealloc_uaf+0x53c/0x5e0 [ 13.547733] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.547769] ? krealloc_uaf+0x53c/0x5e0 [ 13.547867] kasan_report+0x141/0x180 [ 13.547899] ? krealloc_uaf+0x53c/0x5e0 [ 13.547932] __asan_report_load1_noabort+0x18/0x20 [ 13.547962] krealloc_uaf+0x53c/0x5e0 [ 13.547987] ? __pfx_krealloc_uaf+0x10/0x10 [ 13.548012] ? finish_task_switch.isra.0+0x153/0x700 [ 13.548049] ? __switch_to+0x47/0xf50 [ 13.548079] ? __schedule+0x10cc/0x2b60 [ 13.548118] ? __pfx_read_tsc+0x10/0x10 [ 13.548142] ? ktime_get_ts64+0x86/0x230 [ 13.548170] kunit_try_run_case+0x1a5/0x480 [ 13.548198] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.548224] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.548251] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.548277] ? __kthread_parkme+0x82/0x180 [ 13.548300] ? preempt_count_sub+0x50/0x80 [ 13.548325] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.548352] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.548378] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.548404] kthread+0x337/0x6f0 [ 13.548426] ? trace_preempt_on+0x20/0xc0 [ 13.548453] ? __pfx_kthread+0x10/0x10 [ 13.548477] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.548500] ? calculate_sigpending+0x7b/0xa0 [ 13.548528] ? __pfx_kthread+0x10/0x10 [ 13.548552] ret_from_fork+0x116/0x1d0 [ 13.548573] ? __pfx_kthread+0x10/0x10 [ 13.548597] ret_from_fork_asm+0x1a/0x30 [ 13.548633] </TASK> [ 13.548645] [ 13.558408] Allocated by task 181: [ 13.558639] kasan_save_stack+0x45/0x70 [ 13.558925] kasan_save_track+0x18/0x40 [ 13.559152] kasan_save_alloc_info+0x3b/0x50 [ 13.559534] __kasan_kmalloc+0xb7/0xc0 [ 13.560097] __kmalloc_cache_noprof+0x189/0x420 [ 13.560386] krealloc_uaf+0xbb/0x5e0 [ 13.560599] kunit_try_run_case+0x1a5/0x480 [ 13.561393] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.562293] kthread+0x337/0x6f0 [ 13.562974] ret_from_fork+0x116/0x1d0 [ 13.563209] ret_from_fork_asm+0x1a/0x30 [ 13.563436] [ 13.563548] Freed by task 181: [ 13.563737] kasan_save_stack+0x45/0x70 [ 13.564434] kasan_save_track+0x18/0x40 [ 13.565139] kasan_save_free_info+0x3f/0x60 [ 13.565380] __kasan_slab_free+0x56/0x70 [ 13.565602] kfree+0x222/0x3f0 [ 13.566096] krealloc_uaf+0x13d/0x5e0 [ 13.566392] kunit_try_run_case+0x1a5/0x480 [ 13.566673] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.567315] kthread+0x337/0x6f0 [ 13.567946] ret_from_fork+0x116/0x1d0 [ 13.568282] ret_from_fork_asm+0x1a/0x30 [ 13.568689] [ 13.568998] The buggy address belongs to the object at ffff888100ab1000 [ 13.568998] which belongs to the cache kmalloc-256 of size 256 [ 13.569630] The buggy address is located 0 bytes inside of [ 13.569630] freed 256-byte region [ffff888100ab1000, ffff888100ab1100) [ 13.570282] [ 13.570388] The buggy address belongs to the physical page: [ 13.570681] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100ab0 [ 13.571393] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.571751] flags: 0x200000000000040(head|node=0|zone=2) [ 13.571974] page_type: f5(slab) [ 13.572123] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.572427] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.573010] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.573341] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.573792] head: 0200000000000001 ffffea000402ac01 00000000ffffffff 00000000ffffffff [ 13.574194] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 13.574601] page dumped because: kasan: bad access detected [ 13.574863] [ 13.574952] Memory state around the buggy address: [ 13.575174] ffff888100ab0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.575635] ffff888100ab0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.576281] >ffff888100ab1000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.576660] ^ [ 13.576911] ffff888100ab1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.577340] ffff888100ab1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.577615] ================================================================== [ 13.511951] ================================================================== [ 13.512599] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 13.513063] Read of size 1 at addr ffff888100ab1000 by task kunit_try_catch/181 [ 13.513581] [ 13.513723] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.513830] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.513846] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.513892] Call Trace: [ 13.513907] <TASK> [ 13.513928] dump_stack_lvl+0x73/0xb0 [ 13.514017] print_report+0xd1/0x650 [ 13.514047] ? __virt_addr_valid+0x1db/0x2d0 [ 13.514134] ? krealloc_uaf+0x1b8/0x5e0 [ 13.514159] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.514199] ? krealloc_uaf+0x1b8/0x5e0 [ 13.514225] kasan_report+0x141/0x180 [ 13.514250] ? krealloc_uaf+0x1b8/0x5e0 [ 13.514278] ? krealloc_uaf+0x1b8/0x5e0 [ 13.514303] __kasan_check_byte+0x3d/0x50 [ 13.514328] krealloc_noprof+0x3f/0x340 [ 13.514352] ? __kasan_slab_free+0x61/0x70 [ 13.514377] krealloc_uaf+0x1b8/0x5e0 [ 13.514402] ? __pfx_krealloc_uaf+0x10/0x10 [ 13.514430] ? finish_task_switch.isra.0+0x153/0x700 [ 13.514456] ? __switch_to+0x47/0xf50 [ 13.514487] ? __schedule+0x10cc/0x2b60 [ 13.514512] ? __pfx_read_tsc+0x10/0x10 [ 13.514536] ? ktime_get_ts64+0x86/0x230 [ 13.514565] kunit_try_run_case+0x1a5/0x480 [ 13.514595] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.514620] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.514658] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.514684] ? __kthread_parkme+0x82/0x180 [ 13.514746] ? preempt_count_sub+0x50/0x80 [ 13.514772] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.514811] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.514837] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.514863] kthread+0x337/0x6f0 [ 13.514886] ? trace_preempt_on+0x20/0xc0 [ 13.514913] ? __pfx_kthread+0x10/0x10 [ 13.514936] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.514962] ? calculate_sigpending+0x7b/0xa0 [ 13.514990] ? __pfx_kthread+0x10/0x10 [ 13.515015] ret_from_fork+0x116/0x1d0 [ 13.515036] ? __pfx_kthread+0x10/0x10 [ 13.515059] ret_from_fork_asm+0x1a/0x30 [ 13.515096] </TASK> [ 13.515110] [ 13.526296] Allocated by task 181: [ 13.526986] kasan_save_stack+0x45/0x70 [ 13.527286] kasan_save_track+0x18/0x40 [ 13.527509] kasan_save_alloc_info+0x3b/0x50 [ 13.527697] __kasan_kmalloc+0xb7/0xc0 [ 13.527854] __kmalloc_cache_noprof+0x189/0x420 [ 13.528278] krealloc_uaf+0xbb/0x5e0 [ 13.528838] kunit_try_run_case+0x1a5/0x480 [ 13.529174] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.529465] kthread+0x337/0x6f0 [ 13.529690] ret_from_fork+0x116/0x1d0 [ 13.530105] ret_from_fork_asm+0x1a/0x30 [ 13.530337] [ 13.530559] Freed by task 181: [ 13.530757] kasan_save_stack+0x45/0x70 [ 13.531014] kasan_save_track+0x18/0x40 [ 13.531212] kasan_save_free_info+0x3f/0x60 [ 13.531421] __kasan_slab_free+0x56/0x70 [ 13.531668] kfree+0x222/0x3f0 [ 13.532043] krealloc_uaf+0x13d/0x5e0 [ 13.532282] kunit_try_run_case+0x1a5/0x480 [ 13.532603] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.533311] kthread+0x337/0x6f0 [ 13.533540] ret_from_fork+0x116/0x1d0 [ 13.533906] ret_from_fork_asm+0x1a/0x30 [ 13.534114] [ 13.534199] The buggy address belongs to the object at ffff888100ab1000 [ 13.534199] which belongs to the cache kmalloc-256 of size 256 [ 13.535145] The buggy address is located 0 bytes inside of [ 13.535145] freed 256-byte region [ffff888100ab1000, ffff888100ab1100) [ 13.535676] [ 13.535917] The buggy address belongs to the physical page: [ 13.536300] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100ab0 [ 13.536761] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.537303] flags: 0x200000000000040(head|node=0|zone=2) [ 13.537635] page_type: f5(slab) [ 13.537925] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.538394] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.538907] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.539313] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.539663] head: 0200000000000001 ffffea000402ac01 00000000ffffffff 00000000ffffffff [ 13.540276] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 13.540692] page dumped because: kasan: bad access detected [ 13.541117] [ 13.541211] Memory state around the buggy address: [ 13.541980] ffff888100ab0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.542399] ffff888100ab0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.542873] >ffff888100ab1000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.543246] ^ [ 13.543581] ffff888100ab1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.544158] ffff888100ab1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.544604] ==================================================================