Date
July 20, 2025, 11:12 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.320282] ================================================================== [ 15.320433] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 15.320486] Read of size 1 at addr fff00000c6144800 by task kunit_try_catch/164 [ 15.320554] [ 15.320614] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.320725] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.320765] Hardware name: linux,dummy-virt (DT) [ 15.320813] Call trace: [ 15.320851] show_stack+0x20/0x38 (C) [ 15.320945] dump_stack_lvl+0x8c/0xd0 [ 15.320990] print_report+0x118/0x5d0 [ 15.321035] kasan_report+0xdc/0x128 [ 15.321089] __asan_report_load1_noabort+0x20/0x30 [ 15.321244] krealloc_uaf+0x4c8/0x520 [ 15.321289] kunit_try_run_case+0x170/0x3f0 [ 15.321412] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.321507] kthread+0x328/0x630 [ 15.321556] ret_from_fork+0x10/0x20 [ 15.321621] [ 15.321640] Allocated by task 164: [ 15.321702] kasan_save_stack+0x3c/0x68 [ 15.321747] kasan_save_track+0x20/0x40 [ 15.321813] kasan_save_alloc_info+0x40/0x58 [ 15.321852] __kasan_kmalloc+0xd4/0xd8 [ 15.321887] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.321924] krealloc_uaf+0xc8/0x520 [ 15.321957] kunit_try_run_case+0x170/0x3f0 [ 15.321993] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.322140] kthread+0x328/0x630 [ 15.322198] ret_from_fork+0x10/0x20 [ 15.322287] [ 15.322358] Freed by task 164: [ 15.322385] kasan_save_stack+0x3c/0x68 [ 15.322421] kasan_save_track+0x20/0x40 [ 15.322510] kasan_save_free_info+0x4c/0x78 [ 15.322576] __kasan_slab_free+0x6c/0x98 [ 15.322613] kfree+0x214/0x3c8 [ 15.322645] krealloc_uaf+0x12c/0x520 [ 15.322803] kunit_try_run_case+0x170/0x3f0 [ 15.322906] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.323022] kthread+0x328/0x630 [ 15.323152] ret_from_fork+0x10/0x20 [ 15.323234] [ 15.323349] The buggy address belongs to the object at fff00000c6144800 [ 15.323349] which belongs to the cache kmalloc-256 of size 256 [ 15.323496] The buggy address is located 0 bytes inside of [ 15.323496] freed 256-byte region [fff00000c6144800, fff00000c6144900) [ 15.323584] [ 15.323629] The buggy address belongs to the physical page: [ 15.323660] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106144 [ 15.323721] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.323786] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.323838] page_type: f5(slab) [ 15.323875] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.323922] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.323970] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.324173] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.324272] head: 0bfffe0000000001 ffffc1ffc3185101 00000000ffffffff 00000000ffffffff [ 15.324407] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.324491] page dumped because: kasan: bad access detected [ 15.324521] [ 15.324539] Memory state around the buggy address: [ 15.324701] fff00000c6144700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.324779] fff00000c6144780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.324928] >fff00000c6144800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.325067] ^ [ 15.325106] fff00000c6144880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.325146] fff00000c6144900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.325227] ================================================================== [ 15.313886] ================================================================== [ 15.313984] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 15.314036] Read of size 1 at addr fff00000c6144800 by task kunit_try_catch/164 [ 15.314084] [ 15.314113] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.314347] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.314406] Hardware name: linux,dummy-virt (DT) [ 15.314454] Call trace: [ 15.314478] show_stack+0x20/0x38 (C) [ 15.314526] dump_stack_lvl+0x8c/0xd0 [ 15.314581] print_report+0x118/0x5d0 [ 15.314628] kasan_report+0xdc/0x128 [ 15.314773] __kasan_check_byte+0x54/0x70 [ 15.314861] krealloc_noprof+0x44/0x360 [ 15.314974] krealloc_uaf+0x180/0x520 [ 15.315162] kunit_try_run_case+0x170/0x3f0 [ 15.315230] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.315331] kthread+0x328/0x630 [ 15.315391] ret_from_fork+0x10/0x20 [ 15.315436] [ 15.315454] Allocated by task 164: [ 15.315483] kasan_save_stack+0x3c/0x68 [ 15.315523] kasan_save_track+0x20/0x40 [ 15.315559] kasan_save_alloc_info+0x40/0x58 [ 15.315597] __kasan_kmalloc+0xd4/0xd8 [ 15.315634] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.315683] krealloc_uaf+0xc8/0x520 [ 15.315718] kunit_try_run_case+0x170/0x3f0 [ 15.315920] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.316035] kthread+0x328/0x630 [ 15.316076] ret_from_fork+0x10/0x20 [ 15.316112] [ 15.316131] Freed by task 164: [ 15.316159] kasan_save_stack+0x3c/0x68 [ 15.316220] kasan_save_track+0x20/0x40 [ 15.316403] kasan_save_free_info+0x4c/0x78 [ 15.316498] __kasan_slab_free+0x6c/0x98 [ 15.316589] kfree+0x214/0x3c8 [ 15.316703] krealloc_uaf+0x12c/0x520 [ 15.316761] kunit_try_run_case+0x170/0x3f0 [ 15.316818] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.316976] kthread+0x328/0x630 [ 15.317152] ret_from_fork+0x10/0x20 [ 15.317328] [ 15.317409] The buggy address belongs to the object at fff00000c6144800 [ 15.317409] which belongs to the cache kmalloc-256 of size 256 [ 15.317610] The buggy address is located 0 bytes inside of [ 15.317610] freed 256-byte region [fff00000c6144800, fff00000c6144900) [ 15.317682] [ 15.317701] The buggy address belongs to the physical page: [ 15.317732] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106144 [ 15.317782] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.317852] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.318035] page_type: f5(slab) [ 15.318142] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.318231] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.318289] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.318395] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.318444] head: 0bfffe0000000001 ffffc1ffc3185101 00000000ffffffff 00000000ffffffff [ 15.318490] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.318527] page dumped because: kasan: bad access detected [ 15.318580] [ 15.318735] Memory state around the buggy address: [ 15.318807] fff00000c6144700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.318898] fff00000c6144780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.318984] >fff00000c6144800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.319086] ^ [ 15.319184] fff00000c6144880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.319255] fff00000c6144900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.319291] ==================================================================
[ 12.245796] ================================================================== [ 12.246154] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.246494] Read of size 1 at addr ffff888102b91800 by task kunit_try_catch/181 [ 12.246818] [ 12.246938] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.246978] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.246989] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.247009] Call Trace: [ 12.247020] <TASK> [ 12.247034] dump_stack_lvl+0x73/0xb0 [ 12.247067] print_report+0xd1/0x610 [ 12.247088] ? __virt_addr_valid+0x1db/0x2d0 [ 12.247109] ? krealloc_uaf+0x53c/0x5e0 [ 12.247129] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.247149] ? krealloc_uaf+0x53c/0x5e0 [ 12.247169] kasan_report+0x141/0x180 [ 12.247190] ? krealloc_uaf+0x53c/0x5e0 [ 12.247214] __asan_report_load1_noabort+0x18/0x20 [ 12.247237] krealloc_uaf+0x53c/0x5e0 [ 12.247257] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.247276] ? finish_task_switch.isra.0+0x153/0x700 [ 12.247298] ? __switch_to+0x47/0xf50 [ 12.247322] ? __schedule+0x10cc/0x2b60 [ 12.247343] ? __pfx_read_tsc+0x10/0x10 [ 12.247363] ? ktime_get_ts64+0x86/0x230 [ 12.247386] kunit_try_run_case+0x1a5/0x480 [ 12.247408] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.247429] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.247451] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.247473] ? __kthread_parkme+0x82/0x180 [ 12.247491] ? preempt_count_sub+0x50/0x80 [ 12.247512] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.247535] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.247556] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.247579] kthread+0x337/0x6f0 [ 12.247597] ? trace_preempt_on+0x20/0xc0 [ 12.247619] ? __pfx_kthread+0x10/0x10 [ 12.247638] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.247657] ? calculate_sigpending+0x7b/0xa0 [ 12.247680] ? __pfx_kthread+0x10/0x10 [ 12.247700] ret_from_fork+0x116/0x1d0 [ 12.247717] ? __pfx_kthread+0x10/0x10 [ 12.247736] ret_from_fork_asm+0x1a/0x30 [ 12.247765] </TASK> [ 12.247774] [ 12.255855] Allocated by task 181: [ 12.256029] kasan_save_stack+0x45/0x70 [ 12.256208] kasan_save_track+0x18/0x40 [ 12.256343] kasan_save_alloc_info+0x3b/0x50 [ 12.256492] __kasan_kmalloc+0xb7/0xc0 [ 12.256634] __kmalloc_cache_noprof+0x189/0x420 [ 12.256894] krealloc_uaf+0xbb/0x5e0 [ 12.257094] kunit_try_run_case+0x1a5/0x480 [ 12.257299] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.257485] kthread+0x337/0x6f0 [ 12.257605] ret_from_fork+0x116/0x1d0 [ 12.258035] ret_from_fork_asm+0x1a/0x30 [ 12.258251] [ 12.258353] Freed by task 181: [ 12.258577] kasan_save_stack+0x45/0x70 [ 12.258817] kasan_save_track+0x18/0x40 [ 12.258992] kasan_save_free_info+0x3f/0x60 [ 12.259160] __kasan_slab_free+0x56/0x70 [ 12.259355] kfree+0x222/0x3f0 [ 12.259597] krealloc_uaf+0x13d/0x5e0 [ 12.259828] kunit_try_run_case+0x1a5/0x480 [ 12.260037] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.260282] kthread+0x337/0x6f0 [ 12.260492] ret_from_fork+0x116/0x1d0 [ 12.260674] ret_from_fork_asm+0x1a/0x30 [ 12.260847] [ 12.260930] The buggy address belongs to the object at ffff888102b91800 [ 12.260930] which belongs to the cache kmalloc-256 of size 256 [ 12.261603] The buggy address is located 0 bytes inside of [ 12.261603] freed 256-byte region [ffff888102b91800, ffff888102b91900) [ 12.262069] [ 12.262141] The buggy address belongs to the physical page: [ 12.262316] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b90 [ 12.262566] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.262802] flags: 0x200000000000040(head|node=0|zone=2) [ 12.263041] page_type: f5(slab) [ 12.263274] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.264059] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.264489] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.264719] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.264961] head: 0200000000000001 ffffea00040ae401 00000000ffffffff 00000000ffffffff [ 12.265192] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.266067] page dumped because: kasan: bad access detected [ 12.266336] [ 12.266430] Memory state around the buggy address: [ 12.266661] ffff888102b91700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.267062] ffff888102b91780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.267458] >ffff888102b91800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.267824] ^ [ 12.268008] ffff888102b91880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.268246] ffff888102b91900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.268579] ================================================================== [ 12.208489] ================================================================== [ 12.208944] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.209222] Read of size 1 at addr ffff888102b91800 by task kunit_try_catch/181 [ 12.209750] [ 12.209933] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.209979] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.209991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.210011] Call Trace: [ 12.210023] <TASK> [ 12.210038] dump_stack_lvl+0x73/0xb0 [ 12.210069] print_report+0xd1/0x610 [ 12.210090] ? __virt_addr_valid+0x1db/0x2d0 [ 12.210112] ? krealloc_uaf+0x1b8/0x5e0 [ 12.210132] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.210153] ? krealloc_uaf+0x1b8/0x5e0 [ 12.210173] kasan_report+0x141/0x180 [ 12.210193] ? krealloc_uaf+0x1b8/0x5e0 [ 12.210216] ? krealloc_uaf+0x1b8/0x5e0 [ 12.210236] __kasan_check_byte+0x3d/0x50 [ 12.210256] krealloc_noprof+0x3f/0x340 [ 12.210274] ? stack_depot_save_flags+0x48b/0x840 [ 12.210299] krealloc_uaf+0x1b8/0x5e0 [ 12.210319] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.210338] ? finish_task_switch.isra.0+0x153/0x700 [ 12.210360] ? __switch_to+0x47/0xf50 [ 12.210384] ? __schedule+0x10cc/0x2b60 [ 12.210419] ? __pfx_read_tsc+0x10/0x10 [ 12.210438] ? ktime_get_ts64+0x86/0x230 [ 12.210461] kunit_try_run_case+0x1a5/0x480 [ 12.210485] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.210506] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.210528] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.210550] ? __kthread_parkme+0x82/0x180 [ 12.210569] ? preempt_count_sub+0x50/0x80 [ 12.210590] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.210612] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.210634] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.210655] kthread+0x337/0x6f0 [ 12.210673] ? trace_preempt_on+0x20/0xc0 [ 12.210695] ? __pfx_kthread+0x10/0x10 [ 12.210715] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.210735] ? calculate_sigpending+0x7b/0xa0 [ 12.210771] ? __pfx_kthread+0x10/0x10 [ 12.210792] ret_from_fork+0x116/0x1d0 [ 12.210809] ? __pfx_kthread+0x10/0x10 [ 12.210828] ret_from_fork_asm+0x1a/0x30 [ 12.210857] </TASK> [ 12.210868] [ 12.226273] Allocated by task 181: [ 12.226683] kasan_save_stack+0x45/0x70 [ 12.227167] kasan_save_track+0x18/0x40 [ 12.227616] kasan_save_alloc_info+0x3b/0x50 [ 12.228156] __kasan_kmalloc+0xb7/0xc0 [ 12.228685] __kmalloc_cache_noprof+0x189/0x420 [ 12.229112] krealloc_uaf+0xbb/0x5e0 [ 12.229479] kunit_try_run_case+0x1a5/0x480 [ 12.229953] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.230185] kthread+0x337/0x6f0 [ 12.230308] ret_from_fork+0x116/0x1d0 [ 12.230667] ret_from_fork_asm+0x1a/0x30 [ 12.231049] [ 12.231208] Freed by task 181: [ 12.231491] kasan_save_stack+0x45/0x70 [ 12.231897] kasan_save_track+0x18/0x40 [ 12.232313] kasan_save_free_info+0x3f/0x60 [ 12.232745] __kasan_slab_free+0x56/0x70 [ 12.233193] kfree+0x222/0x3f0 [ 12.233500] krealloc_uaf+0x13d/0x5e0 [ 12.233771] kunit_try_run_case+0x1a5/0x480 [ 12.233934] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.234110] kthread+0x337/0x6f0 [ 12.234230] ret_from_fork+0x116/0x1d0 [ 12.234427] ret_from_fork_asm+0x1a/0x30 [ 12.234774] [ 12.234940] The buggy address belongs to the object at ffff888102b91800 [ 12.234940] which belongs to the cache kmalloc-256 of size 256 [ 12.236150] The buggy address is located 0 bytes inside of [ 12.236150] freed 256-byte region [ffff888102b91800, ffff888102b91900) [ 12.237421] [ 12.237588] The buggy address belongs to the physical page: [ 12.238170] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b90 [ 12.238998] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.239470] flags: 0x200000000000040(head|node=0|zone=2) [ 12.240021] page_type: f5(slab) [ 12.240312] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.240848] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.241102] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.241336] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.241572] head: 0200000000000001 ffffea00040ae401 00000000ffffffff 00000000ffffffff [ 12.241962] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.242415] page dumped because: kasan: bad access detected [ 12.242647] [ 12.242744] Memory state around the buggy address: [ 12.242982] ffff888102b91700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.243286] ffff888102b91780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.243639] >ffff888102b91800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.243939] ^ [ 12.244115] ffff888102b91880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.244484] ffff888102b91900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.244959] ==================================================================