Date
July 12, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.685264] ================================================================== [ 16.685319] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 16.685365] Read of size 1 at addr fff00000c4786400 by task kunit_try_catch/164 [ 16.685414] [ 16.685456] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.685548] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.685574] Hardware name: linux,dummy-virt (DT) [ 16.685603] Call trace: [ 16.685624] show_stack+0x20/0x38 (C) [ 16.685673] dump_stack_lvl+0x8c/0xd0 [ 16.685727] print_report+0x118/0x5d0 [ 16.685774] kasan_report+0xdc/0x128 [ 16.685840] __asan_report_load1_noabort+0x20/0x30 [ 16.685890] krealloc_uaf+0x4c8/0x520 [ 16.685947] kunit_try_run_case+0x170/0x3f0 [ 16.685993] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.686044] kthread+0x328/0x630 [ 16.686085] ret_from_fork+0x10/0x20 [ 16.686137] [ 16.686154] Allocated by task 164: [ 16.687117] kasan_save_stack+0x3c/0x68 [ 16.687233] kasan_save_track+0x20/0x40 [ 16.687274] kasan_save_alloc_info+0x40/0x58 [ 16.687378] __kasan_kmalloc+0xd4/0xd8 [ 16.687505] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.687603] krealloc_uaf+0xc8/0x520 [ 16.687688] kunit_try_run_case+0x170/0x3f0 [ 16.687725] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.687780] kthread+0x328/0x630 [ 16.687819] ret_from_fork+0x10/0x20 [ 16.688137] [ 16.688241] Freed by task 164: [ 16.688352] kasan_save_stack+0x3c/0x68 [ 16.688704] kasan_save_track+0x20/0x40 [ 16.688836] kasan_save_free_info+0x4c/0x78 [ 16.688997] __kasan_slab_free+0x6c/0x98 [ 16.689075] kfree+0x214/0x3c8 [ 16.689121] krealloc_uaf+0x12c/0x520 [ 16.689163] kunit_try_run_case+0x170/0x3f0 [ 16.689444] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.689785] kthread+0x328/0x630 [ 16.689867] ret_from_fork+0x10/0x20 [ 16.689997] [ 16.690040] The buggy address belongs to the object at fff00000c4786400 [ 16.690040] which belongs to the cache kmalloc-256 of size 256 [ 16.690431] The buggy address is located 0 bytes inside of [ 16.690431] freed 256-byte region [fff00000c4786400, fff00000c4786500) [ 16.690596] [ 16.690635] The buggy address belongs to the physical page: [ 16.690691] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104786 [ 16.690909] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.691070] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.691283] page_type: f5(slab) [ 16.691323] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.691664] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.691812] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.691920] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.691994] head: 0bfffe0000000001 ffffc1ffc311e181 00000000ffffffff 00000000ffffffff [ 16.692256] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.692450] page dumped because: kasan: bad access detected [ 16.692510] [ 16.692570] Memory state around the buggy address: [ 16.692715] fff00000c4786300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.693101] fff00000c4786380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.693298] >fff00000c4786400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.693339] ^ [ 16.693381] fff00000c4786480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.693789] fff00000c4786500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.693862] ================================================================== [ 16.676779] ================================================================== [ 16.677231] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 16.677297] Read of size 1 at addr fff00000c4786400 by task kunit_try_catch/164 [ 16.677349] [ 16.677458] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.677547] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.677663] Hardware name: linux,dummy-virt (DT) [ 16.677735] Call trace: [ 16.677775] show_stack+0x20/0x38 (C) [ 16.677871] dump_stack_lvl+0x8c/0xd0 [ 16.677917] print_report+0x118/0x5d0 [ 16.677992] kasan_report+0xdc/0x128 [ 16.678307] __kasan_check_byte+0x54/0x70 [ 16.678372] krealloc_noprof+0x44/0x360 [ 16.678471] krealloc_uaf+0x180/0x520 [ 16.678517] kunit_try_run_case+0x170/0x3f0 [ 16.678562] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.678658] kthread+0x328/0x630 [ 16.678702] ret_from_fork+0x10/0x20 [ 16.678747] [ 16.678765] Allocated by task 164: [ 16.678793] kasan_save_stack+0x3c/0x68 [ 16.678973] kasan_save_track+0x20/0x40 [ 16.679011] kasan_save_alloc_info+0x40/0x58 [ 16.679166] __kasan_kmalloc+0xd4/0xd8 [ 16.679372] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.679416] krealloc_uaf+0xc8/0x520 [ 16.679451] kunit_try_run_case+0x170/0x3f0 [ 16.679640] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.679861] kthread+0x328/0x630 [ 16.680013] ret_from_fork+0x10/0x20 [ 16.680188] [ 16.680280] Freed by task 164: [ 16.680364] kasan_save_stack+0x3c/0x68 [ 16.680492] kasan_save_track+0x20/0x40 [ 16.680578] kasan_save_free_info+0x4c/0x78 [ 16.680624] __kasan_slab_free+0x6c/0x98 [ 16.681040] kfree+0x214/0x3c8 [ 16.681167] krealloc_uaf+0x12c/0x520 [ 16.681349] kunit_try_run_case+0x170/0x3f0 [ 16.681437] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.681765] kthread+0x328/0x630 [ 16.681849] ret_from_fork+0x10/0x20 [ 16.681914] [ 16.682012] The buggy address belongs to the object at fff00000c4786400 [ 16.682012] which belongs to the cache kmalloc-256 of size 256 [ 16.682143] The buggy address is located 0 bytes inside of [ 16.682143] freed 256-byte region [fff00000c4786400, fff00000c4786500) [ 16.682323] [ 16.682393] The buggy address belongs to the physical page: [ 16.682478] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104786 [ 16.682536] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.682649] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.683661] page_type: f5(slab) [ 16.683710] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.683763] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.683813] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.683861] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.683910] head: 0bfffe0000000001 ffffc1ffc311e181 00000000ffffffff 00000000ffffffff [ 16.683959] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.683998] page dumped because: kasan: bad access detected [ 16.684029] [ 16.684046] Memory state around the buggy address: [ 16.684077] fff00000c4786300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.684122] fff00000c4786380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.684180] >fff00000c4786400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.684218] ^ [ 16.684245] fff00000c4786480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.684286] fff00000c4786500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.684323] ==================================================================
[ 12.896739] ================================================================== [ 12.897375] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.897750] Read of size 1 at addr ffff888100a2e200 by task kunit_try_catch/181 [ 12.898064] [ 12.898253] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.898331] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.898342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.898364] Call Trace: [ 12.898378] <TASK> [ 12.898395] dump_stack_lvl+0x73/0xb0 [ 12.898429] print_report+0xd1/0x610 [ 12.898453] ? __virt_addr_valid+0x1db/0x2d0 [ 12.898479] ? krealloc_uaf+0x1b8/0x5e0 [ 12.898500] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.898523] ? krealloc_uaf+0x1b8/0x5e0 [ 12.898545] kasan_report+0x141/0x180 [ 12.898566] ? krealloc_uaf+0x1b8/0x5e0 [ 12.898590] ? krealloc_uaf+0x1b8/0x5e0 [ 12.898611] __kasan_check_byte+0x3d/0x50 [ 12.898633] krealloc_noprof+0x3f/0x340 [ 12.898657] krealloc_uaf+0x1b8/0x5e0 [ 12.898678] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.898699] ? finish_task_switch.isra.0+0x153/0x700 [ 12.898735] ? __switch_to+0x47/0xf50 [ 12.898782] ? __schedule+0x10cc/0x2b60 [ 12.898805] ? __pfx_read_tsc+0x10/0x10 [ 12.898827] ? ktime_get_ts64+0x86/0x230 [ 12.898852] kunit_try_run_case+0x1a5/0x480 [ 12.898879] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.898902] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.898927] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.898950] ? __kthread_parkme+0x82/0x180 [ 12.898972] ? preempt_count_sub+0x50/0x80 [ 12.899052] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.899077] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.899101] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.899127] kthread+0x337/0x6f0 [ 12.899147] ? trace_preempt_on+0x20/0xc0 [ 12.899171] ? __pfx_kthread+0x10/0x10 [ 12.899192] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.899213] ? calculate_sigpending+0x7b/0xa0 [ 12.899238] ? __pfx_kthread+0x10/0x10 [ 12.899260] ret_from_fork+0x116/0x1d0 [ 12.899291] ? __pfx_kthread+0x10/0x10 [ 12.899312] ret_from_fork_asm+0x1a/0x30 [ 12.899343] </TASK> [ 12.899354] [ 12.906565] Allocated by task 181: [ 12.906768] kasan_save_stack+0x45/0x70 [ 12.907230] kasan_save_track+0x18/0x40 [ 12.907453] kasan_save_alloc_info+0x3b/0x50 [ 12.907675] __kasan_kmalloc+0xb7/0xc0 [ 12.907865] __kmalloc_cache_noprof+0x189/0x420 [ 12.908256] krealloc_uaf+0xbb/0x5e0 [ 12.908422] kunit_try_run_case+0x1a5/0x480 [ 12.908612] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.908848] kthread+0x337/0x6f0 [ 12.910040] ret_from_fork+0x116/0x1d0 [ 12.910400] ret_from_fork_asm+0x1a/0x30 [ 12.910559] [ 12.910680] Freed by task 181: [ 12.910821] kasan_save_stack+0x45/0x70 [ 12.910971] kasan_save_track+0x18/0x40 [ 12.911108] kasan_save_free_info+0x3f/0x60 [ 12.911256] __kasan_slab_free+0x56/0x70 [ 12.911464] kfree+0x222/0x3f0 [ 12.911628] krealloc_uaf+0x13d/0x5e0 [ 12.911945] kunit_try_run_case+0x1a5/0x480 [ 12.912243] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.912517] kthread+0x337/0x6f0 [ 12.912707] ret_from_fork+0x116/0x1d0 [ 12.912896] ret_from_fork_asm+0x1a/0x30 [ 12.913286] [ 12.913481] The buggy address belongs to the object at ffff888100a2e200 [ 12.913481] which belongs to the cache kmalloc-256 of size 256 [ 12.914826] The buggy address is located 0 bytes inside of [ 12.914826] freed 256-byte region [ffff888100a2e200, ffff888100a2e300) [ 12.915950] [ 12.916166] The buggy address belongs to the physical page: [ 12.916617] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a2e [ 12.917199] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.917743] flags: 0x200000000000040(head|node=0|zone=2) [ 12.917932] page_type: f5(slab) [ 12.918312] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.919114] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.919648] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.920203] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.920670] head: 0200000000000001 ffffea0004028b81 00000000ffffffff 00000000ffffffff [ 12.920906] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.921599] page dumped because: kasan: bad access detected [ 12.922141] [ 12.922307] Memory state around the buggy address: [ 12.922813] ffff888100a2e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.923238] ffff888100a2e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.923585] >ffff888100a2e200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.924319] ^ [ 12.924643] ffff888100a2e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.925288] ffff888100a2e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.925515] ================================================================== [ 12.928755] ================================================================== [ 12.929719] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.930383] Read of size 1 at addr ffff888100a2e200 by task kunit_try_catch/181 [ 12.931187] [ 12.931427] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.931473] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.931484] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.931504] Call Trace: [ 12.931517] <TASK> [ 12.931535] dump_stack_lvl+0x73/0xb0 [ 12.931567] print_report+0xd1/0x610 [ 12.931591] ? __virt_addr_valid+0x1db/0x2d0 [ 12.931618] ? krealloc_uaf+0x53c/0x5e0 [ 12.931640] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.931663] ? krealloc_uaf+0x53c/0x5e0 [ 12.931684] kasan_report+0x141/0x180 [ 12.931706] ? krealloc_uaf+0x53c/0x5e0 [ 12.931734] __asan_report_load1_noabort+0x18/0x20 [ 12.931760] krealloc_uaf+0x53c/0x5e0 [ 12.931781] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.931802] ? finish_task_switch.isra.0+0x153/0x700 [ 12.931826] ? __switch_to+0x47/0xf50 [ 12.931853] ? __schedule+0x10cc/0x2b60 [ 12.931877] ? __pfx_read_tsc+0x10/0x10 [ 12.931898] ? ktime_get_ts64+0x86/0x230 [ 12.931933] kunit_try_run_case+0x1a5/0x480 [ 12.931959] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.931982] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.932017] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.932041] ? __kthread_parkme+0x82/0x180 [ 12.932061] ? preempt_count_sub+0x50/0x80 [ 12.932084] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.932109] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.932139] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.932164] kthread+0x337/0x6f0 [ 12.932183] ? trace_preempt_on+0x20/0xc0 [ 12.932208] ? __pfx_kthread+0x10/0x10 [ 12.932228] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.932249] ? calculate_sigpending+0x7b/0xa0 [ 12.932284] ? __pfx_kthread+0x10/0x10 [ 12.932324] ret_from_fork+0x116/0x1d0 [ 12.932343] ? __pfx_kthread+0x10/0x10 [ 12.932380] ret_from_fork_asm+0x1a/0x30 [ 12.932412] </TASK> [ 12.932423] [ 12.949097] Allocated by task 181: [ 12.949336] kasan_save_stack+0x45/0x70 [ 12.949781] kasan_save_track+0x18/0x40 [ 12.950241] kasan_save_alloc_info+0x3b/0x50 [ 12.950590] __kasan_kmalloc+0xb7/0xc0 [ 12.950844] __kmalloc_cache_noprof+0x189/0x420 [ 12.951296] krealloc_uaf+0xbb/0x5e0 [ 12.951723] kunit_try_run_case+0x1a5/0x480 [ 12.952032] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.952224] kthread+0x337/0x6f0 [ 12.952362] ret_from_fork+0x116/0x1d0 [ 12.952612] ret_from_fork_asm+0x1a/0x30 [ 12.953012] [ 12.953181] Freed by task 181: [ 12.953520] kasan_save_stack+0x45/0x70 [ 12.953906] kasan_save_track+0x18/0x40 [ 12.954371] kasan_save_free_info+0x3f/0x60 [ 12.954840] __kasan_slab_free+0x56/0x70 [ 12.955287] kfree+0x222/0x3f0 [ 12.955495] krealloc_uaf+0x13d/0x5e0 [ 12.955787] kunit_try_run_case+0x1a5/0x480 [ 12.956196] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.956636] kthread+0x337/0x6f0 [ 12.957022] ret_from_fork+0x116/0x1d0 [ 12.957419] ret_from_fork_asm+0x1a/0x30 [ 12.957567] [ 12.957641] The buggy address belongs to the object at ffff888100a2e200 [ 12.957641] which belongs to the cache kmalloc-256 of size 256 [ 12.958495] The buggy address is located 0 bytes inside of [ 12.958495] freed 256-byte region [ffff888100a2e200, ffff888100a2e300) [ 12.959777] [ 12.960163] The buggy address belongs to the physical page: [ 12.960815] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a2e [ 12.961822] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.962438] flags: 0x200000000000040(head|node=0|zone=2) [ 12.962622] page_type: f5(slab) [ 12.962752] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.963026] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.964053] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.964948] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.965751] head: 0200000000000001 ffffea0004028b81 00000000ffffffff 00000000ffffffff [ 12.966880] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.967543] page dumped because: kasan: bad access detected [ 12.967906] [ 12.968184] Memory state around the buggy address: [ 12.968528] ffff888100a2e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.969028] ffff888100a2e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.969653] >ffff888100a2e200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.970310] ^ [ 12.970431] ffff888100a2e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.970649] ffff888100a2e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.970873] ==================================================================