Date
July 17, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.295772] ================================================================== [ 15.295872] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 15.296235] Read of size 1 at addr fff00000c0919c00 by task kunit_try_catch/165 [ 15.296434] [ 15.296561] CPU: 0 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.296698] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.296726] Hardware name: linux,dummy-virt (DT) [ 15.296755] Call trace: [ 15.296775] show_stack+0x20/0x38 (C) [ 15.296927] dump_stack_lvl+0x8c/0xd0 [ 15.297261] print_report+0x118/0x5d0 [ 15.297429] kasan_report+0xdc/0x128 [ 15.297510] __kasan_check_byte+0x54/0x70 [ 15.297636] krealloc_noprof+0x44/0x360 [ 15.297700] krealloc_uaf+0x180/0x520 [ 15.297804] kunit_try_run_case+0x170/0x3f0 [ 15.298331] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.298467] kthread+0x328/0x630 [ 15.298999] ret_from_fork+0x10/0x20 [ 15.299175] [ 15.299953] Allocated by task 165: [ 15.300068] kasan_save_stack+0x3c/0x68 [ 15.300115] kasan_save_track+0x20/0x40 [ 15.300152] kasan_save_alloc_info+0x40/0x58 [ 15.300217] __kasan_kmalloc+0xd4/0xd8 [ 15.300266] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.300305] krealloc_uaf+0xc8/0x520 [ 15.300349] kunit_try_run_case+0x170/0x3f0 [ 15.300385] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.300429] kthread+0x328/0x630 [ 15.300460] ret_from_fork+0x10/0x20 [ 15.300496] [ 15.300541] Freed by task 165: [ 15.300605] kasan_save_stack+0x3c/0x68 [ 15.300654] kasan_save_track+0x20/0x40 [ 15.300690] kasan_save_free_info+0x4c/0x78 [ 15.300741] __kasan_slab_free+0x6c/0x98 [ 15.300777] kfree+0x214/0x3c8 [ 15.300816] krealloc_uaf+0x12c/0x520 [ 15.300858] kunit_try_run_case+0x170/0x3f0 [ 15.300900] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.300957] kthread+0x328/0x630 [ 15.300999] ret_from_fork+0x10/0x20 [ 15.301062] [ 15.301085] The buggy address belongs to the object at fff00000c0919c00 [ 15.301085] which belongs to the cache kmalloc-256 of size 256 [ 15.301204] The buggy address is located 0 bytes inside of [ 15.301204] freed 256-byte region [fff00000c0919c00, fff00000c0919d00) [ 15.301278] [ 15.301297] The buggy address belongs to the physical page: [ 15.301350] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100918 [ 15.301403] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.301463] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.301515] page_type: f5(slab) [ 15.301561] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.301611] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.301668] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.301716] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.301770] head: 0bfffe0000000001 ffffc1ffc3024601 00000000ffffffff 00000000ffffffff [ 15.301825] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.301865] page dumped because: kasan: bad access detected [ 15.301905] [ 15.301930] Memory state around the buggy address: [ 15.301960] fff00000c0919b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.302375] fff00000c0919b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.302449] >fff00000c0919c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.302897] ^ [ 15.302931] fff00000c0919c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.303019] fff00000c0919d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.303111] ================================================================== [ 15.305407] ================================================================== [ 15.305483] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 15.305532] Read of size 1 at addr fff00000c0919c00 by task kunit_try_catch/165 [ 15.305589] [ 15.305617] CPU: 0 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.305889] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.305945] Hardware name: linux,dummy-virt (DT) [ 15.306018] Call trace: [ 15.306042] show_stack+0x20/0x38 (C) [ 15.306130] dump_stack_lvl+0x8c/0xd0 [ 15.306198] print_report+0x118/0x5d0 [ 15.306526] kasan_report+0xdc/0x128 [ 15.306607] __asan_report_load1_noabort+0x20/0x30 [ 15.306721] krealloc_uaf+0x4c8/0x520 [ 15.306772] kunit_try_run_case+0x170/0x3f0 [ 15.306858] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.307077] kthread+0x328/0x630 [ 15.307121] ret_from_fork+0x10/0x20 [ 15.307175] [ 15.307427] Allocated by task 165: [ 15.307593] kasan_save_stack+0x3c/0x68 [ 15.307646] kasan_save_track+0x20/0x40 [ 15.307683] kasan_save_alloc_info+0x40/0x58 [ 15.308029] __kasan_kmalloc+0xd4/0xd8 [ 15.308099] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.308410] krealloc_uaf+0xc8/0x520 [ 15.308489] kunit_try_run_case+0x170/0x3f0 [ 15.308527] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.308569] kthread+0x328/0x630 [ 15.308635] ret_from_fork+0x10/0x20 [ 15.308672] [ 15.308690] Freed by task 165: [ 15.308716] kasan_save_stack+0x3c/0x68 [ 15.308763] kasan_save_track+0x20/0x40 [ 15.308933] kasan_save_free_info+0x4c/0x78 [ 15.309003] __kasan_slab_free+0x6c/0x98 [ 15.309087] kfree+0x214/0x3c8 [ 15.309244] krealloc_uaf+0x12c/0x520 [ 15.309450] kunit_try_run_case+0x170/0x3f0 [ 15.309601] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.309701] kthread+0x328/0x630 [ 15.309810] ret_from_fork+0x10/0x20 [ 15.309924] [ 15.309972] The buggy address belongs to the object at fff00000c0919c00 [ 15.309972] which belongs to the cache kmalloc-256 of size 256 [ 15.310179] The buggy address is located 0 bytes inside of [ 15.310179] freed 256-byte region [fff00000c0919c00, fff00000c0919d00) [ 15.310425] [ 15.310468] The buggy address belongs to the physical page: [ 15.310539] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100918 [ 15.310673] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.310807] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.310858] page_type: f5(slab) [ 15.311210] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.311298] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.311369] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.311505] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.311659] head: 0bfffe0000000001 ffffc1ffc3024601 00000000ffffffff 00000000ffffffff [ 15.311760] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.311829] page dumped because: kasan: bad access detected [ 15.311860] [ 15.312161] Memory state around the buggy address: [ 15.312224] fff00000c0919b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.312280] fff00000c0919b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.312357] >fff00000c0919c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.312535] ^ [ 15.312619] fff00000c0919c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.312723] fff00000c0919d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.313409] ==================================================================
[ 12.987960] ================================================================== [ 12.989107] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.989378] Read of size 1 at addr ffff888100342c00 by task kunit_try_catch/181 [ 12.990424] [ 12.990631] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.990678] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.990690] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.990711] Call Trace: [ 12.990724] <TASK> [ 12.990795] dump_stack_lvl+0x73/0xb0 [ 12.990933] print_report+0xd1/0x610 [ 12.990962] ? __virt_addr_valid+0x1db/0x2d0 [ 12.990986] ? krealloc_uaf+0x1b8/0x5e0 [ 12.991104] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.991129] ? krealloc_uaf+0x1b8/0x5e0 [ 12.991163] kasan_report+0x141/0x180 [ 12.991185] ? krealloc_uaf+0x1b8/0x5e0 [ 12.991209] ? krealloc_uaf+0x1b8/0x5e0 [ 12.991243] __kasan_check_byte+0x3d/0x50 [ 12.991266] krealloc_noprof+0x3f/0x340 [ 12.991289] krealloc_uaf+0x1b8/0x5e0 [ 12.991322] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.991344] ? finish_task_switch.isra.0+0x153/0x700 [ 12.991368] ? __switch_to+0x47/0xf50 [ 12.991407] ? __schedule+0x10cc/0x2b60 [ 12.991429] ? __pfx_read_tsc+0x10/0x10 [ 12.991450] ? ktime_get_ts64+0x86/0x230 [ 12.991487] kunit_try_run_case+0x1a5/0x480 [ 12.991512] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.991535] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.991579] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.991603] ? __kthread_parkme+0x82/0x180 [ 12.991764] ? preempt_count_sub+0x50/0x80 [ 12.991792] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.991830] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.991856] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.991881] kthread+0x337/0x6f0 [ 12.991901] ? trace_preempt_on+0x20/0xc0 [ 12.991925] ? __pfx_kthread+0x10/0x10 [ 12.991946] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.991967] ? calculate_sigpending+0x7b/0xa0 [ 12.991992] ? __pfx_kthread+0x10/0x10 [ 12.992013] ret_from_fork+0x116/0x1d0 [ 12.992032] ? __pfx_kthread+0x10/0x10 [ 12.992058] ret_from_fork_asm+0x1a/0x30 [ 12.992089] </TASK> [ 12.992100] [ 13.008726] Allocated by task 181: [ 13.008874] kasan_save_stack+0x45/0x70 [ 13.009026] kasan_save_track+0x18/0x40 [ 13.009163] kasan_save_alloc_info+0x3b/0x50 [ 13.009874] __kasan_kmalloc+0xb7/0xc0 [ 13.010245] __kmalloc_cache_noprof+0x189/0x420 [ 13.010881] krealloc_uaf+0xbb/0x5e0 [ 13.011528] kunit_try_run_case+0x1a5/0x480 [ 13.012100] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.013009] kthread+0x337/0x6f0 [ 13.013344] ret_from_fork+0x116/0x1d0 [ 13.013852] ret_from_fork_asm+0x1a/0x30 [ 13.014195] [ 13.014568] Freed by task 181: [ 13.015020] kasan_save_stack+0x45/0x70 [ 13.015408] kasan_save_track+0x18/0x40 [ 13.015908] kasan_save_free_info+0x3f/0x60 [ 13.016072] __kasan_slab_free+0x56/0x70 [ 13.016213] kfree+0x222/0x3f0 [ 13.016852] krealloc_uaf+0x13d/0x5e0 [ 13.017333] kunit_try_run_case+0x1a5/0x480 [ 13.017903] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.018666] kthread+0x337/0x6f0 [ 13.019007] ret_from_fork+0x116/0x1d0 [ 13.019148] ret_from_fork_asm+0x1a/0x30 [ 13.019598] [ 13.019881] The buggy address belongs to the object at ffff888100342c00 [ 13.019881] which belongs to the cache kmalloc-256 of size 256 [ 13.021255] The buggy address is located 0 bytes inside of [ 13.021255] freed 256-byte region [ffff888100342c00, ffff888100342d00) [ 13.022036] [ 13.022113] The buggy address belongs to the physical page: [ 13.022309] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100342 [ 13.023543] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.024372] flags: 0x200000000000040(head|node=0|zone=2) [ 13.024862] page_type: f5(slab) [ 13.024989] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.025211] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.025674] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.026340] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.027248] head: 0200000000000001 ffffea000400d081 00000000ffffffff 00000000ffffffff [ 13.028132] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 13.028855] page dumped because: kasan: bad access detected [ 13.029028] [ 13.029096] Memory state around the buggy address: [ 13.029259] ffff888100342b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.030047] ffff888100342b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.031018] >ffff888100342c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.031791] ^ [ 13.031969] ffff888100342c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.032692] ffff888100342d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.033125] ================================================================== [ 13.033911] ================================================================== [ 13.034934] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 13.035708] Read of size 1 at addr ffff888100342c00 by task kunit_try_catch/181 [ 13.036244] [ 13.036497] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 13.036544] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.036570] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.036591] Call Trace: [ 13.036603] <TASK> [ 13.036620] dump_stack_lvl+0x73/0xb0 [ 13.036673] print_report+0xd1/0x610 [ 13.036695] ? __virt_addr_valid+0x1db/0x2d0 [ 13.036718] ? krealloc_uaf+0x53c/0x5e0 [ 13.036740] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.036763] ? krealloc_uaf+0x53c/0x5e0 [ 13.036784] kasan_report+0x141/0x180 [ 13.036806] ? krealloc_uaf+0x53c/0x5e0 [ 13.036832] __asan_report_load1_noabort+0x18/0x20 [ 13.036857] krealloc_uaf+0x53c/0x5e0 [ 13.036878] ? __pfx_krealloc_uaf+0x10/0x10 [ 13.036899] ? finish_task_switch.isra.0+0x153/0x700 [ 13.036922] ? __switch_to+0x47/0xf50 [ 13.036948] ? __schedule+0x10cc/0x2b60 [ 13.036970] ? __pfx_read_tsc+0x10/0x10 [ 13.036991] ? ktime_get_ts64+0x86/0x230 [ 13.037015] kunit_try_run_case+0x1a5/0x480 [ 13.037039] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.037062] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.037086] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.037110] ? __kthread_parkme+0x82/0x180 [ 13.037130] ? preempt_count_sub+0x50/0x80 [ 13.037154] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.037179] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.037204] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.037229] kthread+0x337/0x6f0 [ 13.037407] ? trace_preempt_on+0x20/0xc0 [ 13.037433] ? __pfx_kthread+0x10/0x10 [ 13.037454] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.037475] ? calculate_sigpending+0x7b/0xa0 [ 13.037500] ? __pfx_kthread+0x10/0x10 [ 13.037521] ret_from_fork+0x116/0x1d0 [ 13.037540] ? __pfx_kthread+0x10/0x10 [ 13.037575] ret_from_fork_asm+0x1a/0x30 [ 13.037606] </TASK> [ 13.037616] [ 13.049393] Allocated by task 181: [ 13.049801] kasan_save_stack+0x45/0x70 [ 13.050222] kasan_save_track+0x18/0x40 [ 13.050467] kasan_save_alloc_info+0x3b/0x50 [ 13.050919] __kasan_kmalloc+0xb7/0xc0 [ 13.051059] __kmalloc_cache_noprof+0x189/0x420 [ 13.051217] krealloc_uaf+0xbb/0x5e0 [ 13.051625] kunit_try_run_case+0x1a5/0x480 [ 13.052148] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.052927] kthread+0x337/0x6f0 [ 13.053406] ret_from_fork+0x116/0x1d0 [ 13.053760] ret_from_fork_asm+0x1a/0x30 [ 13.053901] [ 13.053971] Freed by task 181: [ 13.054079] kasan_save_stack+0x45/0x70 [ 13.054210] kasan_save_track+0x18/0x40 [ 13.054655] kasan_save_free_info+0x3f/0x60 [ 13.055125] __kasan_slab_free+0x56/0x70 [ 13.055617] kfree+0x222/0x3f0 [ 13.055921] krealloc_uaf+0x13d/0x5e0 [ 13.056372] kunit_try_run_case+0x1a5/0x480 [ 13.056798] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.057227] kthread+0x337/0x6f0 [ 13.057651] ret_from_fork+0x116/0x1d0 [ 13.057791] ret_from_fork_asm+0x1a/0x30 [ 13.057926] [ 13.057995] The buggy address belongs to the object at ffff888100342c00 [ 13.057995] which belongs to the cache kmalloc-256 of size 256 [ 13.058390] The buggy address is located 0 bytes inside of [ 13.058390] freed 256-byte region [ffff888100342c00, ffff888100342d00) [ 13.059354] [ 13.059435] The buggy address belongs to the physical page: [ 13.059776] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100342 [ 13.060214] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.060613] flags: 0x200000000000040(head|node=0|zone=2) [ 13.060875] page_type: f5(slab) [ 13.061039] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.061511] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.061987] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.062384] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.062731] head: 0200000000000001 ffffea000400d081 00000000ffffffff 00000000ffffffff [ 13.063041] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 13.063474] page dumped because: kasan: bad access detected [ 13.063719] [ 13.063816] Memory state around the buggy address: [ 13.063991] ffff888100342b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.064410] ffff888100342b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.064692] >ffff888100342c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.065074] ^ [ 13.065231] ffff888100342c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.065475] ffff888100342d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.066027] ==================================================================