Date
July 12, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.332301] ================================================================== [ 19.332474] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 19.332655] Read of size 1 at addr fff00000c440ac00 by task kunit_try_catch/165 [ 19.332812] [ 19.332911] CPU: 0 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.333085] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.333143] Hardware name: linux,dummy-virt (DT) [ 19.333243] Call trace: [ 19.333304] show_stack+0x20/0x38 (C) [ 19.333413] dump_stack_lvl+0x8c/0xd0 [ 19.333560] print_report+0x118/0x608 [ 19.333703] kasan_report+0xdc/0x128 [ 19.333859] __asan_report_load1_noabort+0x20/0x30 [ 19.334021] krealloc_uaf+0x4c8/0x520 [ 19.334141] kunit_try_run_case+0x170/0x3f0 [ 19.334254] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.334394] kthread+0x328/0x630 [ 19.334541] ret_from_fork+0x10/0x20 [ 19.334704] [ 19.334768] Allocated by task 165: [ 19.334848] kasan_save_stack+0x3c/0x68 [ 19.334935] kasan_save_track+0x20/0x40 [ 19.335048] kasan_save_alloc_info+0x40/0x58 [ 19.335181] __kasan_kmalloc+0xd4/0xd8 [ 19.335284] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.335383] krealloc_uaf+0xc8/0x520 [ 19.335469] kunit_try_run_case+0x170/0x3f0 [ 19.335549] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.335634] kthread+0x328/0x630 [ 19.335697] ret_from_fork+0x10/0x20 [ 19.335765] [ 19.335803] Freed by task 165: [ 19.335879] kasan_save_stack+0x3c/0x68 [ 19.335991] kasan_save_track+0x20/0x40 [ 19.336100] kasan_save_free_info+0x4c/0x78 [ 19.336209] __kasan_slab_free+0x6c/0x98 [ 19.336353] kfree+0x214/0x3c8 [ 19.336436] krealloc_uaf+0x12c/0x520 [ 19.336511] kunit_try_run_case+0x170/0x3f0 [ 19.336593] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.336689] kthread+0x328/0x630 [ 19.336760] ret_from_fork+0x10/0x20 [ 19.336852] [ 19.336896] The buggy address belongs to the object at fff00000c440ac00 [ 19.336896] which belongs to the cache kmalloc-256 of size 256 [ 19.337032] The buggy address is located 0 bytes inside of [ 19.337032] freed 256-byte region [fff00000c440ac00, fff00000c440ad00) [ 19.337170] [ 19.337215] The buggy address belongs to the physical page: [ 19.337284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10440a [ 19.337388] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.337482] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.337616] page_type: f5(slab) [ 19.337696] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.337854] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.338005] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.338123] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.338245] head: 0bfffe0000000001 ffffc1ffc3110281 00000000ffffffff 00000000ffffffff [ 19.338363] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.338452] page dumped because: kasan: bad access detected [ 19.338522] [ 19.338584] Memory state around the buggy address: [ 19.338654] fff00000c440ab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.338796] fff00000c440ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.338901] >fff00000c440ac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.338975] ^ [ 19.339035] fff00000c440ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.339125] fff00000c440ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.339204] ================================================================== [ 19.322741] ================================================================== [ 19.322993] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 19.323168] Read of size 1 at addr fff00000c440ac00 by task kunit_try_catch/165 [ 19.323305] [ 19.323434] CPU: 0 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.323715] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.323793] Hardware name: linux,dummy-virt (DT) [ 19.323869] Call trace: [ 19.323911] show_stack+0x20/0x38 (C) [ 19.324005] dump_stack_lvl+0x8c/0xd0 [ 19.324098] print_report+0x118/0x608 [ 19.324230] kasan_report+0xdc/0x128 [ 19.324340] __kasan_check_byte+0x54/0x70 [ 19.324439] krealloc_noprof+0x44/0x360 [ 19.324540] krealloc_uaf+0x180/0x520 [ 19.324650] kunit_try_run_case+0x170/0x3f0 [ 19.324754] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.324925] kthread+0x328/0x630 [ 19.325047] ret_from_fork+0x10/0x20 [ 19.325722] [ 19.325775] Allocated by task 165: [ 19.325816] kasan_save_stack+0x3c/0x68 [ 19.325927] kasan_save_track+0x20/0x40 [ 19.326015] kasan_save_alloc_info+0x40/0x58 [ 19.326141] __kasan_kmalloc+0xd4/0xd8 [ 19.326353] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.326506] krealloc_uaf+0xc8/0x520 [ 19.326637] kunit_try_run_case+0x170/0x3f0 [ 19.326873] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.327015] kthread+0x328/0x630 [ 19.327132] ret_from_fork+0x10/0x20 [ 19.327248] [ 19.327313] Freed by task 165: [ 19.327403] kasan_save_stack+0x3c/0x68 [ 19.327498] kasan_save_track+0x20/0x40 [ 19.327597] kasan_save_free_info+0x4c/0x78 [ 19.327691] __kasan_slab_free+0x6c/0x98 [ 19.327786] kfree+0x214/0x3c8 [ 19.327916] krealloc_uaf+0x12c/0x520 [ 19.328059] kunit_try_run_case+0x170/0x3f0 [ 19.328151] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.328250] kthread+0x328/0x630 [ 19.328328] ret_from_fork+0x10/0x20 [ 19.328412] [ 19.328455] The buggy address belongs to the object at fff00000c440ac00 [ 19.328455] which belongs to the cache kmalloc-256 of size 256 [ 19.328666] The buggy address is located 0 bytes inside of [ 19.328666] freed 256-byte region [fff00000c440ac00, fff00000c440ad00) [ 19.328910] [ 19.328967] The buggy address belongs to the physical page: [ 19.329053] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10440a [ 19.329186] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.329302] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.329443] page_type: f5(slab) [ 19.329571] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.329688] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.329789] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.329945] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.330066] head: 0bfffe0000000001 ffffc1ffc3110281 00000000ffffffff 00000000ffffffff [ 19.330173] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.330253] page dumped because: kasan: bad access detected [ 19.330321] [ 19.330366] Memory state around the buggy address: [ 19.330449] fff00000c440ab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.330553] fff00000c440ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.330627] >fff00000c440ac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.330712] ^ [ 19.330785] fff00000c440ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.330939] fff00000c440ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.331062] ==================================================================
[ 12.595947] ================================================================== [ 12.596437] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.596730] Read of size 1 at addr ffff888100a29200 by task kunit_try_catch/182 [ 12.597046] [ 12.597386] CPU: 1 UID: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.597432] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.597443] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.597463] Call Trace: [ 12.597474] <TASK> [ 12.597491] dump_stack_lvl+0x73/0xb0 [ 12.597524] print_report+0xd1/0x650 [ 12.597789] ? __virt_addr_valid+0x1db/0x2d0 [ 12.597815] ? krealloc_uaf+0x1b8/0x5e0 [ 12.597836] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.597886] ? krealloc_uaf+0x1b8/0x5e0 [ 12.597908] kasan_report+0x141/0x180 [ 12.597929] ? krealloc_uaf+0x1b8/0x5e0 [ 12.597953] ? krealloc_uaf+0x1b8/0x5e0 [ 12.597974] __kasan_check_byte+0x3d/0x50 [ 12.597995] krealloc_noprof+0x3f/0x340 [ 12.598018] krealloc_uaf+0x1b8/0x5e0 [ 12.598039] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.598060] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 12.598108] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.598133] kunit_try_run_case+0x1a5/0x480 [ 12.598159] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.598181] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.598206] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.598230] ? __kthread_parkme+0x82/0x180 [ 12.598250] ? preempt_count_sub+0x50/0x80 [ 12.598275] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.598299] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.598322] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.598347] kthread+0x337/0x6f0 [ 12.598373] ? trace_preempt_on+0x20/0xc0 [ 12.598396] ? __pfx_kthread+0x10/0x10 [ 12.598416] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.598437] ? calculate_sigpending+0x7b/0xa0 [ 12.598462] ? __pfx_kthread+0x10/0x10 [ 12.598483] ret_from_fork+0x116/0x1d0 [ 12.598503] ? __pfx_kthread+0x10/0x10 [ 12.598523] ret_from_fork_asm+0x1a/0x30 [ 12.598554] </TASK> [ 12.598564] [ 12.606681] Allocated by task 182: [ 12.607018] kasan_save_stack+0x45/0x70 [ 12.607209] kasan_save_track+0x18/0x40 [ 12.607347] kasan_save_alloc_info+0x3b/0x50 [ 12.607581] __kasan_kmalloc+0xb7/0xc0 [ 12.608040] __kmalloc_cache_noprof+0x189/0x420 [ 12.608262] krealloc_uaf+0xbb/0x5e0 [ 12.608457] kunit_try_run_case+0x1a5/0x480 [ 12.608641] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.608925] kthread+0x337/0x6f0 [ 12.609167] ret_from_fork+0x116/0x1d0 [ 12.609307] ret_from_fork_asm+0x1a/0x30 [ 12.609447] [ 12.609517] Freed by task 182: [ 12.609626] kasan_save_stack+0x45/0x70 [ 12.609844] kasan_save_track+0x18/0x40 [ 12.610060] kasan_save_free_info+0x3f/0x60 [ 12.610267] __kasan_slab_free+0x56/0x70 [ 12.610463] kfree+0x222/0x3f0 [ 12.610578] krealloc_uaf+0x13d/0x5e0 [ 12.610708] kunit_try_run_case+0x1a5/0x480 [ 12.611012] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.611299] kthread+0x337/0x6f0 [ 12.611469] ret_from_fork+0x116/0x1d0 [ 12.611841] ret_from_fork_asm+0x1a/0x30 [ 12.612053] [ 12.612172] The buggy address belongs to the object at ffff888100a29200 [ 12.612172] which belongs to the cache kmalloc-256 of size 256 [ 12.612605] The buggy address is located 0 bytes inside of [ 12.612605] freed 256-byte region [ffff888100a29200, ffff888100a29300) [ 12.613287] [ 12.613386] The buggy address belongs to the physical page: [ 12.613594] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a28 [ 12.614201] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.614452] flags: 0x200000000000040(head|node=0|zone=2) [ 12.614659] page_type: f5(slab) [ 12.614873] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.615219] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.615549] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.616062] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.616394] head: 0200000000000001 ffffea0004028a01 00000000ffffffff 00000000ffffffff [ 12.616624] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.616852] page dumped because: kasan: bad access detected [ 12.617191] [ 12.617290] Memory state around the buggy address: [ 12.617518] ffff888100a29100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.617854] ffff888100a29180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.618357] >ffff888100a29200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.618684] ^ [ 12.618805] ffff888100a29280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.619298] ffff888100a29300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.619608] ================================================================== [ 12.620134] ================================================================== [ 12.620454] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.620931] Read of size 1 at addr ffff888100a29200 by task kunit_try_catch/182 [ 12.621242] [ 12.621343] CPU: 1 UID: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.621409] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.621420] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.621438] Call Trace: [ 12.621451] <TASK> [ 12.621465] dump_stack_lvl+0x73/0xb0 [ 12.621494] print_report+0xd1/0x650 [ 12.621516] ? __virt_addr_valid+0x1db/0x2d0 [ 12.621538] ? krealloc_uaf+0x53c/0x5e0 [ 12.621559] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.621582] ? krealloc_uaf+0x53c/0x5e0 [ 12.621603] kasan_report+0x141/0x180 [ 12.621624] ? krealloc_uaf+0x53c/0x5e0 [ 12.621665] __asan_report_load1_noabort+0x18/0x20 [ 12.621690] krealloc_uaf+0x53c/0x5e0 [ 12.621711] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.621732] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 12.621773] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.621799] kunit_try_run_case+0x1a5/0x480 [ 12.621823] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.621845] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.621868] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.621892] ? __kthread_parkme+0x82/0x180 [ 12.621912] ? preempt_count_sub+0x50/0x80 [ 12.621935] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.621959] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.621984] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.622009] kthread+0x337/0x6f0 [ 12.622028] ? trace_preempt_on+0x20/0xc0 [ 12.622050] ? __pfx_kthread+0x10/0x10 [ 12.622070] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.622092] ? calculate_sigpending+0x7b/0xa0 [ 12.622115] ? __pfx_kthread+0x10/0x10 [ 12.622136] ret_from_fork+0x116/0x1d0 [ 12.622154] ? __pfx_kthread+0x10/0x10 [ 12.622203] ret_from_fork_asm+0x1a/0x30 [ 12.622234] </TASK> [ 12.622252] [ 12.629408] Allocated by task 182: [ 12.629606] kasan_save_stack+0x45/0x70 [ 12.630061] kasan_save_track+0x18/0x40 [ 12.630230] kasan_save_alloc_info+0x3b/0x50 [ 12.630387] __kasan_kmalloc+0xb7/0xc0 [ 12.630519] __kmalloc_cache_noprof+0x189/0x420 [ 12.630728] krealloc_uaf+0xbb/0x5e0 [ 12.630922] kunit_try_run_case+0x1a5/0x480 [ 12.631348] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.631767] kthread+0x337/0x6f0 [ 12.631889] ret_from_fork+0x116/0x1d0 [ 12.632020] ret_from_fork_asm+0x1a/0x30 [ 12.632584] [ 12.632755] Freed by task 182: [ 12.632873] kasan_save_stack+0x45/0x70 [ 12.633014] kasan_save_track+0x18/0x40 [ 12.633272] kasan_save_free_info+0x3f/0x60 [ 12.633506] __kasan_slab_free+0x56/0x70 [ 12.633831] kfree+0x222/0x3f0 [ 12.634020] krealloc_uaf+0x13d/0x5e0 [ 12.634209] kunit_try_run_case+0x1a5/0x480 [ 12.634358] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.634540] kthread+0x337/0x6f0 [ 12.634659] ret_from_fork+0x116/0x1d0 [ 12.634877] ret_from_fork_asm+0x1a/0x30 [ 12.635079] [ 12.635193] The buggy address belongs to the object at ffff888100a29200 [ 12.635193] which belongs to the cache kmalloc-256 of size 256 [ 12.636048] The buggy address is located 0 bytes inside of [ 12.636048] freed 256-byte region [ffff888100a29200, ffff888100a29300) [ 12.636624] [ 12.636878] The buggy address belongs to the physical page: [ 12.637142] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a28 [ 12.637503] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.637756] flags: 0x200000000000040(head|node=0|zone=2) [ 12.638031] page_type: f5(slab) [ 12.638209] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.638578] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.638861] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.639208] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.639788] head: 0200000000000001 ffffea0004028a01 00000000ffffffff 00000000ffffffff [ 12.640020] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.640716] page dumped because: kasan: bad access detected [ 12.641280] [ 12.641388] Memory state around the buggy address: [ 12.641612] ffff888100a29100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.641948] ffff888100a29180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.642248] >ffff888100a29200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.642777] ^ [ 12.642947] ffff888100a29280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.643234] ffff888100a29300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.643546] ==================================================================