Date
July 6, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.003471] ================================================================== [ 18.003521] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 18.003567] Read of size 1 at addr fff00000c0b97e00 by task kunit_try_catch/164 [ 18.003614] [ 18.003643] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.003719] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.003744] Hardware name: linux,dummy-virt (DT) [ 18.003773] Call trace: [ 18.003793] show_stack+0x20/0x38 (C) [ 18.003839] dump_stack_lvl+0x8c/0xd0 [ 18.003884] print_report+0x118/0x608 [ 18.003929] kasan_report+0xdc/0x128 [ 18.003973] __asan_report_load1_noabort+0x20/0x30 [ 18.004021] krealloc_uaf+0x4c8/0x520 [ 18.004064] kunit_try_run_case+0x170/0x3f0 [ 18.004109] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.004159] kthread+0x328/0x630 [ 18.005311] ret_from_fork+0x10/0x20 [ 18.005373] [ 18.005391] Allocated by task 164: [ 18.005418] kasan_save_stack+0x3c/0x68 [ 18.005477] kasan_save_track+0x20/0x40 [ 18.005515] kasan_save_alloc_info+0x40/0x58 [ 18.006319] __kasan_kmalloc+0xd4/0xd8 [ 18.006913] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.006953] krealloc_uaf+0xc8/0x520 [ 18.006991] kunit_try_run_case+0x170/0x3f0 [ 18.007374] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.007494] kthread+0x328/0x630 [ 18.007624] ret_from_fork+0x10/0x20 [ 18.007701] [ 18.007895] Freed by task 164: [ 18.008038] kasan_save_stack+0x3c/0x68 [ 18.008122] kasan_save_track+0x20/0x40 [ 18.008365] kasan_save_free_info+0x4c/0x78 [ 18.008514] __kasan_slab_free+0x6c/0x98 [ 18.008654] kfree+0x214/0x3c8 [ 18.008800] krealloc_uaf+0x12c/0x520 [ 18.008889] kunit_try_run_case+0x170/0x3f0 [ 18.008937] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.009139] kthread+0x328/0x630 [ 18.009188] ret_from_fork+0x10/0x20 [ 18.009323] [ 18.009429] The buggy address belongs to the object at fff00000c0b97e00 [ 18.009429] which belongs to the cache kmalloc-256 of size 256 [ 18.009588] The buggy address is located 0 bytes inside of [ 18.009588] freed 256-byte region [fff00000c0b97e00, fff00000c0b97f00) [ 18.009725] [ 18.009870] The buggy address belongs to the physical page: [ 18.009982] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100b96 [ 18.010045] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.010091] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.010422] page_type: f5(slab) [ 18.010617] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.010799] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.010948] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.011065] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.011129] head: 0bfffe0000000001 ffffc1ffc302e581 00000000ffffffff 00000000ffffffff [ 18.011176] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.011391] page dumped because: kasan: bad access detected [ 18.011653] [ 18.011787] Memory state around the buggy address: [ 18.011836] fff00000c0b97d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.011880] fff00000c0b97d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.011927] >fff00000c0b97e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.011964] ^ [ 18.011996] fff00000c0b97e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.012048] fff00000c0b97f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.012084] ================================================================== [ 17.988467] ================================================================== [ 17.988550] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 17.988603] Read of size 1 at addr fff00000c0b97e00 by task kunit_try_catch/164 [ 17.988650] [ 17.988680] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 17.988765] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.988790] Hardware name: linux,dummy-virt (DT) [ 17.988819] Call trace: [ 17.988840] show_stack+0x20/0x38 (C) [ 17.988885] dump_stack_lvl+0x8c/0xd0 [ 17.988944] print_report+0x118/0x608 [ 17.988989] kasan_report+0xdc/0x128 [ 17.989042] __kasan_check_byte+0x54/0x70 [ 17.989087] krealloc_noprof+0x44/0x360 [ 17.989132] krealloc_uaf+0x180/0x520 [ 17.989174] kunit_try_run_case+0x170/0x3f0 [ 17.990076] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.990135] kthread+0x328/0x630 [ 17.990177] ret_from_fork+0x10/0x20 [ 17.990514] [ 17.990580] Allocated by task 164: [ 17.990703] kasan_save_stack+0x3c/0x68 [ 17.990750] kasan_save_track+0x20/0x40 [ 17.990787] kasan_save_alloc_info+0x40/0x58 [ 17.991143] __kasan_kmalloc+0xd4/0xd8 [ 17.991317] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.991739] krealloc_uaf+0xc8/0x520 [ 17.991830] kunit_try_run_case+0x170/0x3f0 [ 17.991971] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.992154] kthread+0x328/0x630 [ 17.992263] ret_from_fork+0x10/0x20 [ 17.992574] [ 17.992632] Freed by task 164: [ 17.992799] kasan_save_stack+0x3c/0x68 [ 17.992860] kasan_save_track+0x20/0x40 [ 17.993134] kasan_save_free_info+0x4c/0x78 [ 17.993261] __kasan_slab_free+0x6c/0x98 [ 17.993361] kfree+0x214/0x3c8 [ 17.993486] krealloc_uaf+0x12c/0x520 [ 17.993574] kunit_try_run_case+0x170/0x3f0 [ 17.993622] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.993670] kthread+0x328/0x630 [ 17.993956] ret_from_fork+0x10/0x20 [ 17.994164] [ 17.994274] The buggy address belongs to the object at fff00000c0b97e00 [ 17.994274] which belongs to the cache kmalloc-256 of size 256 [ 17.994769] The buggy address is located 0 bytes inside of [ 17.994769] freed 256-byte region [fff00000c0b97e00, fff00000c0b97f00) [ 17.995098] [ 17.995168] The buggy address belongs to the physical page: [ 17.995485] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100b96 [ 17.995607] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.995673] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.997025] page_type: f5(slab) [ 17.999349] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.999534] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.999646] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.000853] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.000926] head: 0bfffe0000000001 ffffc1ffc302e581 00000000ffffffff 00000000ffffffff [ 18.000974] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.002571] page dumped because: kasan: bad access detected [ 18.002609] [ 18.002628] Memory state around the buggy address: [ 18.002661] fff00000c0b97d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.002703] fff00000c0b97d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.002743] >fff00000c0b97e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.002779] ^ [ 18.002807] fff00000c0b97e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.002847] fff00000c0b97f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.002883] ==================================================================
[ 11.551785] ================================================================== [ 11.552338] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.552835] Read of size 1 at addr ffff888100aa0200 by task kunit_try_catch/181 [ 11.553336] [ 11.553462] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.553519] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.553531] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.553553] Call Trace: [ 11.553565] <TASK> [ 11.553583] dump_stack_lvl+0x73/0xb0 [ 11.553613] print_report+0xd1/0x650 [ 11.553734] ? __virt_addr_valid+0x1db/0x2d0 [ 11.553764] ? krealloc_uaf+0x1b8/0x5e0 [ 11.553785] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.553806] ? krealloc_uaf+0x1b8/0x5e0 [ 11.553827] kasan_report+0x141/0x180 [ 11.553849] ? krealloc_uaf+0x1b8/0x5e0 [ 11.553873] ? krealloc_uaf+0x1b8/0x5e0 [ 11.553893] __kasan_check_byte+0x3d/0x50 [ 11.553915] krealloc_noprof+0x3f/0x340 [ 11.553947] krealloc_uaf+0x1b8/0x5e0 [ 11.553968] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.553988] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 11.554019] ? __pfx_read_tsc+0x10/0x10 [ 11.554040] ? ktime_get_ts64+0x86/0x230 [ 11.554084] kunit_try_run_case+0x1a5/0x480 [ 11.554109] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.554131] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.554155] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.554177] ? __kthread_parkme+0x82/0x180 [ 11.554199] ? preempt_count_sub+0x50/0x80 [ 11.554224] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.554248] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.554270] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.554292] kthread+0x337/0x6f0 [ 11.554311] ? trace_preempt_on+0x20/0xc0 [ 11.554334] ? __pfx_kthread+0x10/0x10 [ 11.554354] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.554374] ? calculate_sigpending+0x7b/0xa0 [ 11.554399] ? __pfx_kthread+0x10/0x10 [ 11.554420] ret_from_fork+0x116/0x1d0 [ 11.554438] ? __pfx_kthread+0x10/0x10 [ 11.554458] ret_from_fork_asm+0x1a/0x30 [ 11.554531] </TASK> [ 11.554542] [ 11.568109] Allocated by task 181: [ 11.568611] kasan_save_stack+0x45/0x70 [ 11.568777] kasan_save_track+0x18/0x40 [ 11.568913] kasan_save_alloc_info+0x3b/0x50 [ 11.569091] __kasan_kmalloc+0xb7/0xc0 [ 11.569236] __kmalloc_cache_noprof+0x189/0x420 [ 11.569463] krealloc_uaf+0xbb/0x5e0 [ 11.569605] kunit_try_run_case+0x1a5/0x480 [ 11.569789] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.570006] kthread+0x337/0x6f0 [ 11.570268] ret_from_fork+0x116/0x1d0 [ 11.570426] ret_from_fork_asm+0x1a/0x30 [ 11.570624] [ 11.570747] Freed by task 181: [ 11.570926] kasan_save_stack+0x45/0x70 [ 11.571174] kasan_save_track+0x18/0x40 [ 11.571339] kasan_save_free_info+0x3f/0x60 [ 11.571537] __kasan_slab_free+0x56/0x70 [ 11.571674] kfree+0x222/0x3f0 [ 11.571832] krealloc_uaf+0x13d/0x5e0 [ 11.572029] kunit_try_run_case+0x1a5/0x480 [ 11.572269] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.572513] kthread+0x337/0x6f0 [ 11.572636] ret_from_fork+0x116/0x1d0 [ 11.572825] ret_from_fork_asm+0x1a/0x30 [ 11.573049] [ 11.573335] The buggy address belongs to the object at ffff888100aa0200 [ 11.573335] which belongs to the cache kmalloc-256 of size 256 [ 11.573947] The buggy address is located 0 bytes inside of [ 11.573947] freed 256-byte region [ffff888100aa0200, ffff888100aa0300) [ 11.574454] [ 11.574560] The buggy address belongs to the physical page: [ 11.574902] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa0 [ 11.575278] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.575507] flags: 0x200000000000040(head|node=0|zone=2) [ 11.575926] page_type: f5(slab) [ 11.576160] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.576699] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.577039] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.577357] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.577685] head: 0200000000000001 ffffea000402a801 00000000ffffffff 00000000ffffffff [ 11.577987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.578329] page dumped because: kasan: bad access detected [ 11.578610] [ 11.578685] Memory state around the buggy address: [ 11.578872] ffff888100aa0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.579352] ffff888100aa0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.579582] >ffff888100aa0200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.579956] ^ [ 11.580149] ffff888100aa0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.580379] ffff888100aa0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.580760] ================================================================== [ 11.581397] ================================================================== [ 11.582152] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.582406] Read of size 1 at addr ffff888100aa0200 by task kunit_try_catch/181 [ 11.582731] [ 11.582888] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.582942] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.583004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.583026] Call Trace: [ 11.583043] <TASK> [ 11.583059] dump_stack_lvl+0x73/0xb0 [ 11.583086] print_report+0xd1/0x650 [ 11.583113] ? __virt_addr_valid+0x1db/0x2d0 [ 11.583136] ? krealloc_uaf+0x53c/0x5e0 [ 11.583156] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.583178] ? krealloc_uaf+0x53c/0x5e0 [ 11.583199] kasan_report+0x141/0x180 [ 11.583220] ? krealloc_uaf+0x53c/0x5e0 [ 11.583246] __asan_report_load1_noabort+0x18/0x20 [ 11.583270] krealloc_uaf+0x53c/0x5e0 [ 11.583291] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.583311] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 11.583340] ? __pfx_read_tsc+0x10/0x10 [ 11.583361] ? ktime_get_ts64+0x86/0x230 [ 11.583384] kunit_try_run_case+0x1a5/0x480 [ 11.583408] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.583429] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.583451] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.583506] ? __kthread_parkme+0x82/0x180 [ 11.583527] ? preempt_count_sub+0x50/0x80 [ 11.583550] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.583574] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.583596] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.583619] kthread+0x337/0x6f0 [ 11.583637] ? trace_preempt_on+0x20/0xc0 [ 11.583661] ? __pfx_kthread+0x10/0x10 [ 11.583681] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.583701] ? calculate_sigpending+0x7b/0xa0 [ 11.583724] ? __pfx_kthread+0x10/0x10 [ 11.583745] ret_from_fork+0x116/0x1d0 [ 11.583763] ? __pfx_kthread+0x10/0x10 [ 11.583783] ret_from_fork_asm+0x1a/0x30 [ 11.583813] </TASK> [ 11.583824] [ 11.591013] Allocated by task 181: [ 11.591287] kasan_save_stack+0x45/0x70 [ 11.591443] kasan_save_track+0x18/0x40 [ 11.591578] kasan_save_alloc_info+0x3b/0x50 [ 11.591754] __kasan_kmalloc+0xb7/0xc0 [ 11.591962] __kmalloc_cache_noprof+0x189/0x420 [ 11.592185] krealloc_uaf+0xbb/0x5e0 [ 11.592426] kunit_try_run_case+0x1a5/0x480 [ 11.592790] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.593026] kthread+0x337/0x6f0 [ 11.593226] ret_from_fork+0x116/0x1d0 [ 11.593358] ret_from_fork_asm+0x1a/0x30 [ 11.593496] [ 11.593567] Freed by task 181: [ 11.593723] kasan_save_stack+0x45/0x70 [ 11.593915] kasan_save_track+0x18/0x40 [ 11.594319] kasan_save_free_info+0x3f/0x60 [ 11.594490] __kasan_slab_free+0x56/0x70 [ 11.594686] kfree+0x222/0x3f0 [ 11.594811] krealloc_uaf+0x13d/0x5e0 [ 11.595009] kunit_try_run_case+0x1a5/0x480 [ 11.595252] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.595512] kthread+0x337/0x6f0 [ 11.595649] ret_from_fork+0x116/0x1d0 [ 11.595835] ret_from_fork_asm+0x1a/0x30 [ 11.595987] [ 11.596059] The buggy address belongs to the object at ffff888100aa0200 [ 11.596059] which belongs to the cache kmalloc-256 of size 256 [ 11.596698] The buggy address is located 0 bytes inside of [ 11.596698] freed 256-byte region [ffff888100aa0200, ffff888100aa0300) [ 11.597360] [ 11.597445] The buggy address belongs to the physical page: [ 11.597691] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa0 [ 11.598028] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.598424] flags: 0x200000000000040(head|node=0|zone=2) [ 11.598598] page_type: f5(slab) [ 11.598717] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.599311] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.599659] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.599908] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.600663] head: 0200000000000001 ffffea000402a801 00000000ffffffff 00000000ffffffff [ 11.600998] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.601326] page dumped because: kasan: bad access detected [ 11.601523] [ 11.601594] Memory state around the buggy address: [ 11.601747] ffff888100aa0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.602094] ffff888100aa0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.602425] >ffff888100aa0200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.602736] ^ [ 11.602898] ffff888100aa0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.603356] ffff888100aa0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.603696] ==================================================================