Date
July 2, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.114272] ================================================================== [ 18.114348] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 18.114405] Read of size 1 at addr fff00000c17aa800 by task kunit_try_catch/164 [ 18.114470] [ 18.114527] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.114638] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.114664] Hardware name: linux,dummy-virt (DT) [ 18.114712] Call trace: [ 18.114751] show_stack+0x20/0x38 (C) [ 18.114807] dump_stack_lvl+0x8c/0xd0 [ 18.114875] print_report+0x118/0x608 [ 18.114940] kasan_report+0xdc/0x128 [ 18.114997] __asan_report_load1_noabort+0x20/0x30 [ 18.115073] krealloc_uaf+0x4c8/0x520 [ 18.115118] kunit_try_run_case+0x170/0x3f0 [ 18.115164] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.115215] kthread+0x328/0x630 [ 18.115255] ret_from_fork+0x10/0x20 [ 18.115301] [ 18.115318] Allocated by task 164: [ 18.115343] kasan_save_stack+0x3c/0x68 [ 18.115381] kasan_save_track+0x20/0x40 [ 18.115416] kasan_save_alloc_info+0x40/0x58 [ 18.115454] __kasan_kmalloc+0xd4/0xd8 [ 18.115488] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.115544] krealloc_uaf+0xc8/0x520 [ 18.115588] kunit_try_run_case+0x170/0x3f0 [ 18.115652] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.115694] kthread+0x328/0x630 [ 18.115730] ret_from_fork+0x10/0x20 [ 18.115818] [ 18.115836] Freed by task 164: [ 18.115860] kasan_save_stack+0x3c/0x68 [ 18.115896] kasan_save_track+0x20/0x40 [ 18.115947] kasan_save_free_info+0x4c/0x78 [ 18.116012] __kasan_slab_free+0x6c/0x98 [ 18.116048] kfree+0x214/0x3c8 [ 18.116116] krealloc_uaf+0x12c/0x520 [ 18.116150] kunit_try_run_case+0x170/0x3f0 [ 18.116208] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.116276] kthread+0x328/0x630 [ 18.116324] ret_from_fork+0x10/0x20 [ 18.116408] [ 18.116426] The buggy address belongs to the object at fff00000c17aa800 [ 18.116426] which belongs to the cache kmalloc-256 of size 256 [ 18.116488] The buggy address is located 0 bytes inside of [ 18.116488] freed 256-byte region [fff00000c17aa800, fff00000c17aa900) [ 18.116546] [ 18.116564] The buggy address belongs to the physical page: [ 18.116602] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1017aa [ 18.116868] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.117054] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.117170] page_type: f5(slab) [ 18.117275] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.117352] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.117411] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.117459] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.117778] head: 0bfffe0000000001 ffffc1ffc305ea81 00000000ffffffff 00000000ffffffff [ 18.117894] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.117973] page dumped because: kasan: bad access detected [ 18.118059] [ 18.118163] Memory state around the buggy address: [ 18.118262] fff00000c17aa700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.118351] fff00000c17aa780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.118455] >fff00000c17aa800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.118512] ^ [ 18.118552] fff00000c17aa880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.118644] fff00000c17aa900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.118695] ================================================================== [ 18.110344] ================================================================== [ 18.110441] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 18.110497] Read of size 1 at addr fff00000c17aa800 by task kunit_try_catch/164 [ 18.110544] [ 18.110594] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.110678] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.110705] Hardware name: linux,dummy-virt (DT) [ 18.110736] Call trace: [ 18.110758] show_stack+0x20/0x38 (C) [ 18.110888] dump_stack_lvl+0x8c/0xd0 [ 18.110966] print_report+0x118/0x608 [ 18.111022] kasan_report+0xdc/0x128 [ 18.111075] __kasan_check_byte+0x54/0x70 [ 18.111121] krealloc_noprof+0x44/0x360 [ 18.111175] krealloc_uaf+0x180/0x520 [ 18.111243] kunit_try_run_case+0x170/0x3f0 [ 18.111290] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.111342] kthread+0x328/0x630 [ 18.111384] ret_from_fork+0x10/0x20 [ 18.111431] [ 18.111449] Allocated by task 164: [ 18.111495] kasan_save_stack+0x3c/0x68 [ 18.111553] kasan_save_track+0x20/0x40 [ 18.111600] kasan_save_alloc_info+0x40/0x58 [ 18.111650] __kasan_kmalloc+0xd4/0xd8 [ 18.111685] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.111736] krealloc_uaf+0xc8/0x520 [ 18.111778] kunit_try_run_case+0x170/0x3f0 [ 18.111815] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.111878] kthread+0x328/0x630 [ 18.111910] ret_from_fork+0x10/0x20 [ 18.111950] [ 18.111993] Freed by task 164: [ 18.112045] kasan_save_stack+0x3c/0x68 [ 18.112092] kasan_save_track+0x20/0x40 [ 18.112129] kasan_save_free_info+0x4c/0x78 [ 18.112173] __kasan_slab_free+0x6c/0x98 [ 18.112209] kfree+0x214/0x3c8 [ 18.112258] krealloc_uaf+0x12c/0x520 [ 18.112292] kunit_try_run_case+0x170/0x3f0 [ 18.112328] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.112370] kthread+0x328/0x630 [ 18.112404] ret_from_fork+0x10/0x20 [ 18.112464] [ 18.112502] The buggy address belongs to the object at fff00000c17aa800 [ 18.112502] which belongs to the cache kmalloc-256 of size 256 [ 18.112611] The buggy address is located 0 bytes inside of [ 18.112611] freed 256-byte region [fff00000c17aa800, fff00000c17aa900) [ 18.112672] [ 18.112699] The buggy address belongs to the physical page: [ 18.112733] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1017aa [ 18.112783] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.112827] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.112877] page_type: f5(slab) [ 18.112915] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.112962] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.113009] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 18.113056] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.113102] head: 0bfffe0000000001 ffffc1ffc305ea81 00000000ffffffff 00000000ffffffff [ 18.113149] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.113187] page dumped because: kasan: bad access detected [ 18.113386] [ 18.113404] Memory state around the buggy address: [ 18.113484] fff00000c17aa700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.113526] fff00000c17aa780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.113566] >fff00000c17aa800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.113612] ^ [ 18.113639] fff00000c17aa880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.113678] fff00000c17aa900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.113715] ==================================================================
[ 11.364212] ================================================================== [ 11.365212] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.365869] Read of size 1 at addr ffff888100a21e00 by task kunit_try_catch/183 [ 11.366678] [ 11.366929] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.366985] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.366996] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.367016] Call Trace: [ 11.367030] <TASK> [ 11.367048] dump_stack_lvl+0x73/0xb0 [ 11.367079] print_report+0xd1/0x650 [ 11.367102] ? __virt_addr_valid+0x1db/0x2d0 [ 11.367125] ? krealloc_uaf+0x53c/0x5e0 [ 11.367145] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.367165] ? krealloc_uaf+0x53c/0x5e0 [ 11.367186] kasan_report+0x141/0x180 [ 11.367206] ? krealloc_uaf+0x53c/0x5e0 [ 11.367232] __asan_report_load1_noabort+0x18/0x20 [ 11.367255] krealloc_uaf+0x53c/0x5e0 [ 11.367275] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.367295] ? finish_task_switch.isra.0+0x153/0x700 [ 11.367317] ? __switch_to+0x47/0xf50 [ 11.367342] ? __schedule+0x10cc/0x2b60 [ 11.367363] ? __pfx_read_tsc+0x10/0x10 [ 11.367397] ? ktime_get_ts64+0x86/0x230 [ 11.367420] kunit_try_run_case+0x1a5/0x480 [ 11.367444] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.367465] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.367488] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.367509] ? __kthread_parkme+0x82/0x180 [ 11.367529] ? preempt_count_sub+0x50/0x80 [ 11.367551] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.367575] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.367596] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.367618] kthread+0x337/0x6f0 [ 11.367637] ? trace_preempt_on+0x20/0xc0 [ 11.367661] ? __pfx_kthread+0x10/0x10 [ 11.367682] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.367706] ? calculate_sigpending+0x7b/0xa0 [ 11.367730] ? __pfx_kthread+0x10/0x10 [ 11.367750] ret_from_fork+0x116/0x1d0 [ 11.367768] ? __pfx_kthread+0x10/0x10 [ 11.367789] ret_from_fork_asm+0x1a/0x30 [ 11.367820] </TASK> [ 11.367831] [ 11.375481] Allocated by task 183: [ 11.375851] kasan_save_stack+0x45/0x70 [ 11.376061] kasan_save_track+0x18/0x40 [ 11.376230] kasan_save_alloc_info+0x3b/0x50 [ 11.376391] __kasan_kmalloc+0xb7/0xc0 [ 11.376578] __kmalloc_cache_noprof+0x189/0x420 [ 11.376897] krealloc_uaf+0xbb/0x5e0 [ 11.377070] kunit_try_run_case+0x1a5/0x480 [ 11.377228] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.377475] kthread+0x337/0x6f0 [ 11.377636] ret_from_fork+0x116/0x1d0 [ 11.377822] ret_from_fork_asm+0x1a/0x30 [ 11.378067] [ 11.378145] Freed by task 183: [ 11.378267] kasan_save_stack+0x45/0x70 [ 11.378471] kasan_save_track+0x18/0x40 [ 11.378779] kasan_save_free_info+0x3f/0x60 [ 11.378975] __kasan_slab_free+0x56/0x70 [ 11.379156] kfree+0x222/0x3f0 [ 11.379292] krealloc_uaf+0x13d/0x5e0 [ 11.379452] kunit_try_run_case+0x1a5/0x480 [ 11.379797] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.380061] kthread+0x337/0x6f0 [ 11.380200] ret_from_fork+0x116/0x1d0 [ 11.380354] ret_from_fork_asm+0x1a/0x30 [ 11.380565] [ 11.380712] The buggy address belongs to the object at ffff888100a21e00 [ 11.380712] which belongs to the cache kmalloc-256 of size 256 [ 11.381165] The buggy address is located 0 bytes inside of [ 11.381165] freed 256-byte region [ffff888100a21e00, ffff888100a21f00) [ 11.381519] [ 11.381601] The buggy address belongs to the physical page: [ 11.381853] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a20 [ 11.382217] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.382562] flags: 0x200000000000040(head|node=0|zone=2) [ 11.382971] page_type: f5(slab) [ 11.383156] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.383466] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.383918] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.384226] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.384519] head: 0200000000000001 ffffea0004028801 00000000ffffffff 00000000ffffffff [ 11.384939] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.385254] page dumped because: kasan: bad access detected [ 11.385437] [ 11.385506] Memory state around the buggy address: [ 11.385704] ffff888100a21d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.386017] ffff888100a21d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.386441] >ffff888100a21e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.386694] ^ [ 11.386834] ffff888100a21e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.387163] ffff888100a21f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.387391] ================================================================== [ 11.329267] ================================================================== [ 11.330124] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.330351] Read of size 1 at addr ffff888100a21e00 by task kunit_try_catch/183 [ 11.330649] [ 11.330910] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.330957] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.330968] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.330987] Call Trace: [ 11.330999] <TASK> [ 11.331049] dump_stack_lvl+0x73/0xb0 [ 11.331079] print_report+0xd1/0x650 [ 11.331102] ? __virt_addr_valid+0x1db/0x2d0 [ 11.331124] ? krealloc_uaf+0x1b8/0x5e0 [ 11.331143] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.331164] ? krealloc_uaf+0x1b8/0x5e0 [ 11.331216] kasan_report+0x141/0x180 [ 11.331237] ? krealloc_uaf+0x1b8/0x5e0 [ 11.331260] ? krealloc_uaf+0x1b8/0x5e0 [ 11.331279] __kasan_check_byte+0x3d/0x50 [ 11.331300] krealloc_noprof+0x3f/0x340 [ 11.331322] krealloc_uaf+0x1b8/0x5e0 [ 11.331342] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.331362] ? finish_task_switch.isra.0+0x153/0x700 [ 11.331394] ? __switch_to+0x47/0xf50 [ 11.331419] ? __schedule+0x10cc/0x2b60 [ 11.331469] ? __pfx_read_tsc+0x10/0x10 [ 11.331490] ? ktime_get_ts64+0x86/0x230 [ 11.331538] kunit_try_run_case+0x1a5/0x480 [ 11.331563] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.331625] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.331650] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.331671] ? __kthread_parkme+0x82/0x180 [ 11.331707] ? preempt_count_sub+0x50/0x80 [ 11.331728] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.331750] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.331772] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.331793] kthread+0x337/0x6f0 [ 11.331811] ? trace_preempt_on+0x20/0xc0 [ 11.331835] ? __pfx_kthread+0x10/0x10 [ 11.331855] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.331875] ? calculate_sigpending+0x7b/0xa0 [ 11.331897] ? __pfx_kthread+0x10/0x10 [ 11.331917] ret_from_fork+0x116/0x1d0 [ 11.331934] ? __pfx_kthread+0x10/0x10 [ 11.331953] ret_from_fork_asm+0x1a/0x30 [ 11.331982] </TASK> [ 11.331993] [ 11.344481] Allocated by task 183: [ 11.345241] kasan_save_stack+0x45/0x70 [ 11.345440] kasan_save_track+0x18/0x40 [ 11.345835] kasan_save_alloc_info+0x3b/0x50 [ 11.346175] __kasan_kmalloc+0xb7/0xc0 [ 11.346462] __kmalloc_cache_noprof+0x189/0x420 [ 11.346862] krealloc_uaf+0xbb/0x5e0 [ 11.347045] kunit_try_run_case+0x1a5/0x480 [ 11.347251] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.347502] kthread+0x337/0x6f0 [ 11.347967] ret_from_fork+0x116/0x1d0 [ 11.348146] ret_from_fork_asm+0x1a/0x30 [ 11.348543] [ 11.348734] Freed by task 183: [ 11.348880] kasan_save_stack+0x45/0x70 [ 11.349212] kasan_save_track+0x18/0x40 [ 11.349492] kasan_save_free_info+0x3f/0x60 [ 11.350037] __kasan_slab_free+0x56/0x70 [ 11.350199] kfree+0x222/0x3f0 [ 11.350367] krealloc_uaf+0x13d/0x5e0 [ 11.350557] kunit_try_run_case+0x1a5/0x480 [ 11.351167] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.351430] kthread+0x337/0x6f0 [ 11.351814] ret_from_fork+0x116/0x1d0 [ 11.351994] ret_from_fork_asm+0x1a/0x30 [ 11.352317] [ 11.352421] The buggy address belongs to the object at ffff888100a21e00 [ 11.352421] which belongs to the cache kmalloc-256 of size 256 [ 11.353537] The buggy address is located 0 bytes inside of [ 11.353537] freed 256-byte region [ffff888100a21e00, ffff888100a21f00) [ 11.354307] [ 11.354422] The buggy address belongs to the physical page: [ 11.355076] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a20 [ 11.355420] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.355882] flags: 0x200000000000040(head|node=0|zone=2) [ 11.356144] page_type: f5(slab) [ 11.356310] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.356598] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.357208] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.357497] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.358089] head: 0200000000000001 ffffea0004028801 00000000ffffffff 00000000ffffffff [ 11.358570] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.359023] page dumped because: kasan: bad access detected [ 11.359352] [ 11.359462] Memory state around the buggy address: [ 11.359914] ffff888100a21d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.360296] ffff888100a21d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.360715] >ffff888100a21e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.361642] ^ [ 11.361782] ffff888100a21e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.362002] ffff888100a21f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.362217] ==================================================================