Date
July 19, 2025, 11:11 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.259067] ================================================================== [ 15.259156] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 15.259346] Read of size 1 at addr fff00000c175d000 by task kunit_try_catch/165 [ 15.259398] [ 15.259485] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.259580] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.259606] Hardware name: linux,dummy-virt (DT) [ 15.259646] Call trace: [ 15.259669] show_stack+0x20/0x38 (C) [ 15.259720] dump_stack_lvl+0x8c/0xd0 [ 15.259764] print_report+0x118/0x5d0 [ 15.259809] kasan_report+0xdc/0x128 [ 15.259853] __kasan_check_byte+0x54/0x70 [ 15.259899] krealloc_noprof+0x44/0x360 [ 15.259944] krealloc_uaf+0x180/0x520 [ 15.259987] kunit_try_run_case+0x170/0x3f0 [ 15.260213] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.260283] kthread+0x328/0x630 [ 15.260472] ret_from_fork+0x10/0x20 [ 15.260660] [ 15.260684] Allocated by task 165: [ 15.260714] kasan_save_stack+0x3c/0x68 [ 15.260757] kasan_save_track+0x20/0x40 [ 15.260838] kasan_save_alloc_info+0x40/0x58 [ 15.260897] __kasan_kmalloc+0xd4/0xd8 [ 15.260934] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.261181] krealloc_uaf+0xc8/0x520 [ 15.261228] kunit_try_run_case+0x170/0x3f0 [ 15.261350] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.261397] kthread+0x328/0x630 [ 15.261466] ret_from_fork+0x10/0x20 [ 15.261579] [ 15.261616] Freed by task 165: [ 15.261674] kasan_save_stack+0x3c/0x68 [ 15.261789] kasan_save_track+0x20/0x40 [ 15.261864] kasan_save_free_info+0x4c/0x78 [ 15.261999] __kasan_slab_free+0x6c/0x98 [ 15.262233] kfree+0x214/0x3c8 [ 15.262279] krealloc_uaf+0x12c/0x520 [ 15.262315] kunit_try_run_case+0x170/0x3f0 [ 15.262540] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.262663] kthread+0x328/0x630 [ 15.262731] ret_from_fork+0x10/0x20 [ 15.262916] [ 15.262994] The buggy address belongs to the object at fff00000c175d000 [ 15.262994] which belongs to the cache kmalloc-256 of size 256 [ 15.263252] The buggy address is located 0 bytes inside of [ 15.263252] freed 256-byte region [fff00000c175d000, fff00000c175d100) [ 15.263628] [ 15.263765] The buggy address belongs to the physical page: [ 15.263843] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10175c [ 15.263911] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.263956] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.264006] page_type: f5(slab) [ 15.264044] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.264102] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.264165] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.264213] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.264266] head: 0bfffe0000000001 ffffc1ffc305d701 00000000ffffffff 00000000ffffffff [ 15.264323] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.264361] page dumped because: kasan: bad access detected [ 15.264392] [ 15.264411] Memory state around the buggy address: [ 15.264443] fff00000c175cf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.264485] fff00000c175cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.264546] >fff00000c175d000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.264811] ^ [ 15.264867] fff00000c175d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.264925] fff00000c175d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.264979] ================================================================== [ 15.266440] ================================================================== [ 15.266593] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 15.266644] Read of size 1 at addr fff00000c175d000 by task kunit_try_catch/165 [ 15.266692] [ 15.266721] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.267042] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.267083] Hardware name: linux,dummy-virt (DT) [ 15.267143] Call trace: [ 15.267267] show_stack+0x20/0x38 (C) [ 15.267351] dump_stack_lvl+0x8c/0xd0 [ 15.267454] print_report+0x118/0x5d0 [ 15.267520] kasan_report+0xdc/0x128 [ 15.267603] __asan_report_load1_noabort+0x20/0x30 [ 15.267657] krealloc_uaf+0x4c8/0x520 [ 15.267701] kunit_try_run_case+0x170/0x3f0 [ 15.267747] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.268014] kthread+0x328/0x630 [ 15.268158] ret_from_fork+0x10/0x20 [ 15.268235] [ 15.268262] Allocated by task 165: [ 15.268289] kasan_save_stack+0x3c/0x68 [ 15.268347] kasan_save_track+0x20/0x40 [ 15.268599] kasan_save_alloc_info+0x40/0x58 [ 15.268678] __kasan_kmalloc+0xd4/0xd8 [ 15.268724] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.268850] krealloc_uaf+0xc8/0x520 [ 15.268896] kunit_try_run_case+0x170/0x3f0 [ 15.269040] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.269117] kthread+0x328/0x630 [ 15.269151] ret_from_fork+0x10/0x20 [ 15.269211] [ 15.269232] Freed by task 165: [ 15.269487] kasan_save_stack+0x3c/0x68 [ 15.269590] kasan_save_track+0x20/0x40 [ 15.269635] kasan_save_free_info+0x4c/0x78 [ 15.269716] __kasan_slab_free+0x6c/0x98 [ 15.269790] kfree+0x214/0x3c8 [ 15.269937] krealloc_uaf+0x12c/0x520 [ 15.270035] kunit_try_run_case+0x170/0x3f0 [ 15.270159] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.270227] kthread+0x328/0x630 [ 15.270271] ret_from_fork+0x10/0x20 [ 15.270314] [ 15.270636] The buggy address belongs to the object at fff00000c175d000 [ 15.270636] which belongs to the cache kmalloc-256 of size 256 [ 15.270790] The buggy address is located 0 bytes inside of [ 15.270790] freed 256-byte region [fff00000c175d000, fff00000c175d100) [ 15.270909] [ 15.271009] The buggy address belongs to the physical page: [ 15.271090] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10175c [ 15.271257] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.271348] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.271418] page_type: f5(slab) [ 15.271467] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.271604] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.271662] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.271726] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.271790] head: 0bfffe0000000001 ffffc1ffc305d701 00000000ffffffff 00000000ffffffff [ 15.271837] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.271882] page dumped because: kasan: bad access detected [ 15.271920] [ 15.271938] Memory state around the buggy address: [ 15.271968] fff00000c175cf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.272009] fff00000c175cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.272050] >fff00000c175d000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.272096] ^ [ 15.272123] fff00000c175d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.272172] fff00000c175d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.272208] ==================================================================
[ 12.022223] ================================================================== [ 12.022716] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.023437] Read of size 1 at addr ffff888100a3c000 by task kunit_try_catch/182 [ 12.024005] [ 12.024211] CPU: 1 UID: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.024259] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.024270] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.024293] Call Trace: [ 12.024304] <TASK> [ 12.024321] dump_stack_lvl+0x73/0xb0 [ 12.024354] print_report+0xd1/0x610 [ 12.024592] ? __virt_addr_valid+0x1db/0x2d0 [ 12.024624] ? krealloc_uaf+0x1b8/0x5e0 [ 12.024645] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.024667] ? krealloc_uaf+0x1b8/0x5e0 [ 12.024688] kasan_report+0x141/0x180 [ 12.024709] ? krealloc_uaf+0x1b8/0x5e0 [ 12.024732] ? krealloc_uaf+0x1b8/0x5e0 [ 12.024752] __kasan_check_byte+0x3d/0x50 [ 12.024773] krealloc_noprof+0x3f/0x340 [ 12.024793] ? stack_depot_save_flags+0x48b/0x840 [ 12.024824] krealloc_uaf+0x1b8/0x5e0 [ 12.024845] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.024864] ? finish_task_switch.isra.0+0x153/0x700 [ 12.024888] ? __switch_to+0x47/0xf50 [ 12.024914] ? __schedule+0x10cc/0x2b60 [ 12.024936] ? __pfx_read_tsc+0x10/0x10 [ 12.024957] ? ktime_get_ts64+0x86/0x230 [ 12.024981] kunit_try_run_case+0x1a5/0x480 [ 12.025007] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.025029] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.025121] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.025145] ? __kthread_parkme+0x82/0x180 [ 12.025174] ? preempt_count_sub+0x50/0x80 [ 12.025196] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.025220] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.025243] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.025266] kthread+0x337/0x6f0 [ 12.025285] ? trace_preempt_on+0x20/0xc0 [ 12.025309] ? __pfx_kthread+0x10/0x10 [ 12.025328] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.025349] ? calculate_sigpending+0x7b/0xa0 [ 12.025373] ? __pfx_kthread+0x10/0x10 [ 12.025393] ret_from_fork+0x116/0x1d0 [ 12.025412] ? __pfx_kthread+0x10/0x10 [ 12.025433] ret_from_fork_asm+0x1a/0x30 [ 12.025463] </TASK> [ 12.025474] [ 12.037677] Allocated by task 182: [ 12.037863] kasan_save_stack+0x45/0x70 [ 12.038050] kasan_save_track+0x18/0x40 [ 12.038532] kasan_save_alloc_info+0x3b/0x50 [ 12.038807] __kasan_kmalloc+0xb7/0xc0 [ 12.038943] __kmalloc_cache_noprof+0x189/0x420 [ 12.039105] krealloc_uaf+0xbb/0x5e0 [ 12.039232] kunit_try_run_case+0x1a5/0x480 [ 12.039370] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.039547] kthread+0x337/0x6f0 [ 12.039663] ret_from_fork+0x116/0x1d0 [ 12.039789] ret_from_fork_asm+0x1a/0x30 [ 12.039922] [ 12.039990] Freed by task 182: [ 12.040099] kasan_save_stack+0x45/0x70 [ 12.040229] kasan_save_track+0x18/0x40 [ 12.040359] kasan_save_free_info+0x3f/0x60 [ 12.041176] __kasan_slab_free+0x56/0x70 [ 12.041655] kfree+0x222/0x3f0 [ 12.042302] krealloc_uaf+0x13d/0x5e0 [ 12.042763] kunit_try_run_case+0x1a5/0x480 [ 12.043449] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.044323] kthread+0x337/0x6f0 [ 12.044778] ret_from_fork+0x116/0x1d0 [ 12.045294] ret_from_fork_asm+0x1a/0x30 [ 12.045797] [ 12.046116] The buggy address belongs to the object at ffff888100a3c000 [ 12.046116] which belongs to the cache kmalloc-256 of size 256 [ 12.047653] The buggy address is located 0 bytes inside of [ 12.047653] freed 256-byte region [ffff888100a3c000, ffff888100a3c100) [ 12.049168] [ 12.049462] The buggy address belongs to the physical page: [ 12.050140] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a3c [ 12.051050] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.052023] flags: 0x200000000000040(head|node=0|zone=2) [ 12.052785] page_type: f5(slab) [ 12.053359] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.054160] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.054678] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.054917] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.055700] head: 0200000000000001 ffffea0004028f01 00000000ffffffff 00000000ffffffff [ 12.056465] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.056716] page dumped because: kasan: bad access detected [ 12.056886] [ 12.056956] Memory state around the buggy address: [ 12.057113] ffff888100a3bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.057793] ffff888100a3bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.058511] >ffff888100a3c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.059290] ^ [ 12.059644] ffff888100a3c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.060340] ffff888100a3c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.060966] ================================================================== [ 12.062001] ================================================================== [ 12.062997] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.063675] Read of size 1 at addr ffff888100a3c000 by task kunit_try_catch/182 [ 12.064398] [ 12.064605] CPU: 1 UID: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.064653] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.064663] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.064685] Call Trace: [ 12.064703] <TASK> [ 12.064721] dump_stack_lvl+0x73/0xb0 [ 12.064750] print_report+0xd1/0x610 [ 12.064771] ? __virt_addr_valid+0x1db/0x2d0 [ 12.064793] ? krealloc_uaf+0x53c/0x5e0 [ 12.064813] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.064835] ? krealloc_uaf+0x53c/0x5e0 [ 12.064856] kasan_report+0x141/0x180 [ 12.064877] ? krealloc_uaf+0x53c/0x5e0 [ 12.064903] __asan_report_load1_noabort+0x18/0x20 [ 12.064927] krealloc_uaf+0x53c/0x5e0 [ 12.064948] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.064968] ? finish_task_switch.isra.0+0x153/0x700 [ 12.064993] ? __switch_to+0x47/0xf50 [ 12.065020] ? __schedule+0x10cc/0x2b60 [ 12.065042] ? __pfx_read_tsc+0x10/0x10 [ 12.065064] ? ktime_get_ts64+0x86/0x230 [ 12.065088] kunit_try_run_case+0x1a5/0x480 [ 12.065112] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.065134] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.065170] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.065193] ? __kthread_parkme+0x82/0x180 [ 12.065213] ? preempt_count_sub+0x50/0x80 [ 12.065235] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.065258] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.065281] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.065303] kthread+0x337/0x6f0 [ 12.065321] ? trace_preempt_on+0x20/0xc0 [ 12.065344] ? __pfx_kthread+0x10/0x10 [ 12.065363] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.065384] ? calculate_sigpending+0x7b/0xa0 [ 12.065407] ? __pfx_kthread+0x10/0x10 [ 12.065428] ret_from_fork+0x116/0x1d0 [ 12.065445] ? __pfx_kthread+0x10/0x10 [ 12.065465] ret_from_fork_asm+0x1a/0x30 [ 12.065505] </TASK> [ 12.065515] [ 12.078010] Allocated by task 182: [ 12.078151] kasan_save_stack+0x45/0x70 [ 12.078752] kasan_save_track+0x18/0x40 [ 12.079102] kasan_save_alloc_info+0x3b/0x50 [ 12.079483] __kasan_kmalloc+0xb7/0xc0 [ 12.079907] __kmalloc_cache_noprof+0x189/0x420 [ 12.080328] krealloc_uaf+0xbb/0x5e0 [ 12.080722] kunit_try_run_case+0x1a5/0x480 [ 12.081154] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.081638] kthread+0x337/0x6f0 [ 12.081937] ret_from_fork+0x116/0x1d0 [ 12.082317] ret_from_fork_asm+0x1a/0x30 [ 12.082683] [ 12.082836] Freed by task 182: [ 12.082956] kasan_save_stack+0x45/0x70 [ 12.083109] kasan_save_track+0x18/0x40 [ 12.083677] kasan_save_free_info+0x3f/0x60 [ 12.084114] __kasan_slab_free+0x56/0x70 [ 12.084522] kfree+0x222/0x3f0 [ 12.084810] krealloc_uaf+0x13d/0x5e0 [ 12.085011] kunit_try_run_case+0x1a5/0x480 [ 12.085351] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.085834] kthread+0x337/0x6f0 [ 12.086078] ret_from_fork+0x116/0x1d0 [ 12.086425] ret_from_fork_asm+0x1a/0x30 [ 12.086680] [ 12.086751] The buggy address belongs to the object at ffff888100a3c000 [ 12.086751] which belongs to the cache kmalloc-256 of size 256 [ 12.087459] The buggy address is located 0 bytes inside of [ 12.087459] freed 256-byte region [ffff888100a3c000, ffff888100a3c100) [ 12.088615] [ 12.088791] The buggy address belongs to the physical page: [ 12.089512] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a3c [ 12.090212] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.090445] flags: 0x200000000000040(head|node=0|zone=2) [ 12.090637] page_type: f5(slab) [ 12.090758] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.090986] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.091228] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.091645] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.091930] head: 0200000000000001 ffffea0004028f01 00000000ffffffff 00000000ffffffff [ 12.092268] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.092622] page dumped because: kasan: bad access detected [ 12.092828] [ 12.092897] Memory state around the buggy address: [ 12.093172] ffff888100a3bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.093489] ffff888100a3bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.093745] >ffff888100a3c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.093988] ^ [ 12.094143] ffff888100a3c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.094587] ffff888100a3c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.094854] ==================================================================