Date
Nov. 20, 2024, 6:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 36.462933] ================================================================== [ 36.463957] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 36.464720] Read of size 1 at addr fff00000c449b800 by task kunit_try_catch/153 [ 36.465480] [ 36.466984] CPU: 1 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241120 #1 [ 36.468078] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.468534] Hardware name: linux,dummy-virt (DT) [ 36.469050] Call trace: [ 36.469956] show_stack+0x20/0x38 (C) [ 36.470583] dump_stack_lvl+0x8c/0xd0 [ 36.471117] print_report+0x118/0x5e0 [ 36.471715] kasan_report+0xc8/0x118 [ 36.472245] __kasan_check_byte+0x54/0x70 [ 36.472802] krealloc_noprof+0x44/0x360 [ 36.473411] krealloc_uaf+0x180/0x520 [ 36.473874] kunit_try_run_case+0x14c/0x3d0 [ 36.474807] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.475498] kthread+0x24c/0x2d0 [ 36.476044] ret_from_fork+0x10/0x20 [ 36.476651] [ 36.476948] Allocated by task 153: [ 36.477477] kasan_save_stack+0x3c/0x68 [ 36.477930] kasan_save_track+0x20/0x40 [ 36.479082] kasan_save_alloc_info+0x40/0x58 [ 36.479635] __kasan_kmalloc+0xd4/0xd8 [ 36.480193] __kmalloc_cache_noprof+0x15c/0x3c8 [ 36.480720] krealloc_uaf+0xc8/0x520 [ 36.481256] kunit_try_run_case+0x14c/0x3d0 [ 36.481901] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.482515] kthread+0x24c/0x2d0 [ 36.483032] ret_from_fork+0x10/0x20 [ 36.483859] [ 36.484146] Freed by task 153: [ 36.484597] kasan_save_stack+0x3c/0x68 [ 36.485101] kasan_save_track+0x20/0x40 [ 36.486057] kasan_save_free_info+0x4c/0x78 [ 36.486651] __kasan_slab_free+0x6c/0x98 [ 36.487481] kfree+0x114/0x3d0 [ 36.488112] krealloc_uaf+0x12c/0x520 [ 36.488784] kunit_try_run_case+0x14c/0x3d0 [ 36.489512] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.490375] kthread+0x24c/0x2d0 [ 36.491061] ret_from_fork+0x10/0x20 [ 36.491646] [ 36.491989] The buggy address belongs to the object at fff00000c449b800 [ 36.491989] which belongs to the cache kmalloc-256 of size 256 [ 36.493676] The buggy address is located 0 bytes inside of [ 36.493676] freed 256-byte region [fff00000c449b800, fff00000c449b900) [ 36.495155] [ 36.495538] The buggy address belongs to the physical page: [ 36.496228] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10449a [ 36.497138] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.498095] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.499077] page_type: f5(slab) [ 36.499679] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 36.500642] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 36.501562] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 36.502844] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 36.503712] head: 0bfffe0000000001 ffffc1ffc3112681 ffffffffffffffff 0000000000000000 [ 36.504589] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 36.505661] page dumped because: kasan: bad access detected [ 36.506403] [ 36.506800] Memory state around the buggy address: [ 36.507419] fff00000c449b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.508295] fff00000c449b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.509097] >fff00000c449b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.509933] ^ [ 36.510825] fff00000c449b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.511849] fff00000c449b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.512733] ================================================================== [ 36.515378] ================================================================== [ 36.516652] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 36.517612] Read of size 1 at addr fff00000c449b800 by task kunit_try_catch/153 [ 36.519290] [ 36.519610] CPU: 1 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241120 #1 [ 36.520970] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.521646] Hardware name: linux,dummy-virt (DT) [ 36.522666] Call trace: [ 36.523255] show_stack+0x20/0x38 (C) [ 36.523805] dump_stack_lvl+0x8c/0xd0 [ 36.524550] print_report+0x118/0x5e0 [ 36.525151] kasan_report+0xc8/0x118 [ 36.526032] __asan_report_load1_noabort+0x20/0x30 [ 36.526692] krealloc_uaf+0x4c8/0x520 [ 36.527180] kunit_try_run_case+0x14c/0x3d0 [ 36.528064] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.528814] kthread+0x24c/0x2d0 [ 36.529842] ret_from_fork+0x10/0x20 [ 36.530322] [ 36.530588] Allocated by task 153: [ 36.530964] kasan_save_stack+0x3c/0x68 [ 36.531966] kasan_save_track+0x20/0x40 [ 36.532465] kasan_save_alloc_info+0x40/0x58 [ 36.533119] __kasan_kmalloc+0xd4/0xd8 [ 36.533774] __kmalloc_cache_noprof+0x15c/0x3c8 [ 36.534643] krealloc_uaf+0xc8/0x520 [ 36.535174] kunit_try_run_case+0x14c/0x3d0 [ 36.535760] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.536563] kthread+0x24c/0x2d0 [ 36.537039] ret_from_fork+0x10/0x20 [ 36.537582] [ 36.538371] Freed by task 153: [ 36.539010] kasan_save_stack+0x3c/0x68 [ 36.539620] kasan_save_track+0x20/0x40 [ 36.540396] kasan_save_free_info+0x4c/0x78 [ 36.540955] __kasan_slab_free+0x6c/0x98 [ 36.541724] kfree+0x114/0x3d0 [ 36.542125] krealloc_uaf+0x12c/0x520 [ 36.543036] kunit_try_run_case+0x14c/0x3d0 [ 36.543782] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.544504] kthread+0x24c/0x2d0 [ 36.545000] ret_from_fork+0x10/0x20 [ 36.545568] [ 36.546223] The buggy address belongs to the object at fff00000c449b800 [ 36.546223] which belongs to the cache kmalloc-256 of size 256 [ 36.547369] The buggy address is located 0 bytes inside of [ 36.547369] freed 256-byte region [fff00000c449b800, fff00000c449b900) [ 36.549420] [ 36.549782] The buggy address belongs to the physical page: [ 36.550370] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10449a [ 36.551436] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.552577] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.553494] page_type: f5(slab) [ 36.554033] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 36.555408] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 36.556540] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 36.557662] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 36.558601] head: 0bfffe0000000001 ffffc1ffc3112681 ffffffffffffffff 0000000000000000 [ 36.559512] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 36.560393] page dumped because: kasan: bad access detected [ 36.561086] [ 36.561750] Memory state around the buggy address: [ 36.562313] fff00000c449b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.562992] fff00000c449b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.564609] >fff00000c449b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.565888] ^ [ 36.566382] fff00000c449b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.567078] fff00000c449b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.567921] ==================================================================
[ 27.949513] ================================================================== [ 27.949979] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53e/0x5e0 [ 27.950455] Read of size 1 at addr ffff888100aa1a00 by task kunit_try_catch/171 [ 27.950965] [ 27.951250] CPU: 1 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241120 #1 [ 27.952547] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.953103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.954866] Call Trace: [ 27.955744] <TASK> [ 27.956261] dump_stack_lvl+0x73/0xb0 [ 27.956878] print_report+0xd1/0x640 [ 27.957510] ? __virt_addr_valid+0x1db/0x2d0 [ 27.958279] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.958804] kasan_report+0x102/0x140 [ 27.959050] ? krealloc_uaf+0x53e/0x5e0 [ 27.959404] ? krealloc_uaf+0x53e/0x5e0 [ 27.959912] __asan_report_load1_noabort+0x18/0x20 [ 27.960838] krealloc_uaf+0x53e/0x5e0 [ 27.961494] ? __pfx_krealloc_uaf+0x10/0x10 [ 27.962000] ? finish_task_switch.isra.0+0x153/0x700 [ 27.962413] ? __switch_to+0x5d9/0xf60 [ 27.962725] ? __schedule+0xc3e/0x2790 [ 27.962981] ? __pfx_read_tsc+0x10/0x10 [ 27.963315] ? ktime_get_ts64+0x84/0x230 [ 27.963565] kunit_try_run_case+0x1b3/0x490 [ 27.964328] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.964644] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 27.965566] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.966396] ? __kthread_parkme+0x82/0x160 [ 27.967304] ? preempt_count_sub+0x50/0x80 [ 27.967645] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.968860] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.969473] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.970786] kthread+0x257/0x310 [ 27.971340] ? __pfx_kthread+0x10/0x10 [ 27.972015] ret_from_fork+0x41/0x80 [ 27.972503] ? __pfx_kthread+0x10/0x10 [ 27.972947] ret_from_fork_asm+0x1a/0x30 [ 27.973773] </TASK> [ 27.974266] [ 27.974537] Allocated by task 171: [ 27.975486] kasan_save_stack+0x3d/0x60 [ 27.976571] kasan_save_track+0x18/0x40 [ 27.977086] kasan_save_alloc_info+0x3b/0x50 [ 27.977566] __kasan_kmalloc+0xb7/0xc0 [ 27.978417] __kmalloc_cache_noprof+0x184/0x410 [ 27.979104] krealloc_uaf+0xbc/0x5e0 [ 27.979591] kunit_try_run_case+0x1b3/0x490 [ 27.980098] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.980595] kthread+0x257/0x310 [ 27.981776] ret_from_fork+0x41/0x80 [ 27.982657] ret_from_fork_asm+0x1a/0x30 [ 27.983073] [ 27.983521] Freed by task 171: [ 27.984002] kasan_save_stack+0x3d/0x60 [ 27.984529] kasan_save_track+0x18/0x40 [ 27.985341] kasan_save_free_info+0x3f/0x60 [ 27.985835] __kasan_slab_free+0x56/0x70 [ 27.986913] kfree+0x123/0x3f0 [ 27.987312] krealloc_uaf+0x13e/0x5e0 [ 27.988030] kunit_try_run_case+0x1b3/0x490 [ 27.988547] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.989759] kthread+0x257/0x310 [ 27.990419] ret_from_fork+0x41/0x80 [ 27.990900] ret_from_fork_asm+0x1a/0x30 [ 27.991758] [ 27.992047] The buggy address belongs to the object at ffff888100aa1a00 [ 27.992047] which belongs to the cache kmalloc-256 of size 256 [ 27.993551] The buggy address is located 0 bytes inside of [ 27.993551] freed 256-byte region [ffff888100aa1a00, ffff888100aa1b00) [ 27.995490] [ 27.995925] The buggy address belongs to the physical page: [ 27.996780] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa0 [ 27.997990] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 27.998774] flags: 0x200000000000040(head|node=0|zone=2) [ 27.999473] page_type: f5(slab) [ 28.000206] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 28.001099] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 28.002652] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 28.003241] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 28.004409] head: 0200000000000001 ffffea000402a801 ffffffffffffffff 0000000000000000 [ 28.005465] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 28.006404] page dumped because: kasan: bad access detected [ 28.006865] [ 28.007449] Memory state around the buggy address: [ 28.008204] ffff888100aa1900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.009115] ffff888100aa1980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.010229] >ffff888100aa1a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.010895] ^ [ 28.011674] ffff888100aa1a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.012553] ffff888100aa1b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.013626] ================================================================== [ 27.883330] ================================================================== [ 27.884986] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b9/0x5e0 [ 27.885736] Read of size 1 at addr ffff888100aa1a00 by task kunit_try_catch/171 [ 27.886396] [ 27.886609] CPU: 1 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241120 #1 [ 27.888654] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.889411] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.890291] Call Trace: [ 27.890484] <TASK> [ 27.890812] dump_stack_lvl+0x73/0xb0 [ 27.891661] print_report+0xd1/0x640 [ 27.892079] ? __virt_addr_valid+0x1db/0x2d0 [ 27.892543] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.893646] kasan_report+0x102/0x140 [ 27.894305] ? krealloc_uaf+0x1b9/0x5e0 [ 27.895080] ? krealloc_uaf+0x1b9/0x5e0 [ 27.895744] ? krealloc_uaf+0x1b9/0x5e0 [ 27.896815] __kasan_check_byte+0x3d/0x50 [ 27.897252] krealloc_noprof+0x3f/0x340 [ 27.898195] krealloc_uaf+0x1b9/0x5e0 [ 27.898565] ? __pfx_krealloc_uaf+0x10/0x10 [ 27.899291] ? finish_task_switch.isra.0+0x153/0x700 [ 27.900212] ? __switch_to+0x5d9/0xf60 [ 27.900914] ? __schedule+0xc3e/0x2790 [ 27.901869] ? __pfx_read_tsc+0x10/0x10 [ 27.902236] ? ktime_get_ts64+0x84/0x230 [ 27.902737] kunit_try_run_case+0x1b3/0x490 [ 27.903777] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.904090] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 27.905031] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.905710] ? __kthread_parkme+0x82/0x160 [ 27.906103] ? preempt_count_sub+0x50/0x80 [ 27.907239] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.907708] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.908468] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.909110] kthread+0x257/0x310 [ 27.909494] ? __pfx_kthread+0x10/0x10 [ 27.910161] ret_from_fork+0x41/0x80 [ 27.910945] ? __pfx_kthread+0x10/0x10 [ 27.911397] ret_from_fork_asm+0x1a/0x30 [ 27.912841] </TASK> [ 27.913028] [ 27.913215] Allocated by task 171: [ 27.913545] kasan_save_stack+0x3d/0x60 [ 27.914573] kasan_save_track+0x18/0x40 [ 27.915462] kasan_save_alloc_info+0x3b/0x50 [ 27.915911] __kasan_kmalloc+0xb7/0xc0 [ 27.916338] __kmalloc_cache_noprof+0x184/0x410 [ 27.916775] krealloc_uaf+0xbc/0x5e0 [ 27.917221] kunit_try_run_case+0x1b3/0x490 [ 27.917796] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.918636] kthread+0x257/0x310 [ 27.919022] ret_from_fork+0x41/0x80 [ 27.919701] ret_from_fork_asm+0x1a/0x30 [ 27.920064] [ 27.920303] Freed by task 171: [ 27.920985] kasan_save_stack+0x3d/0x60 [ 27.921637] kasan_save_track+0x18/0x40 [ 27.922238] kasan_save_free_info+0x3f/0x60 [ 27.922732] __kasan_slab_free+0x56/0x70 [ 27.923320] kfree+0x123/0x3f0 [ 27.923774] krealloc_uaf+0x13e/0x5e0 [ 27.924382] kunit_try_run_case+0x1b3/0x490 [ 27.924975] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.925621] kthread+0x257/0x310 [ 27.925947] ret_from_fork+0x41/0x80 [ 27.926541] ret_from_fork_asm+0x1a/0x30 [ 27.926987] [ 27.927398] The buggy address belongs to the object at ffff888100aa1a00 [ 27.927398] which belongs to the cache kmalloc-256 of size 256 [ 27.928756] The buggy address is located 0 bytes inside of [ 27.928756] freed 256-byte region [ffff888100aa1a00, ffff888100aa1b00) [ 27.930236] [ 27.930595] The buggy address belongs to the physical page: [ 27.931142] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa0 [ 27.932022] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 27.933012] flags: 0x200000000000040(head|node=0|zone=2) [ 27.933597] page_type: f5(slab) [ 27.934003] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 27.934726] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 27.935968] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 27.936855] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 27.937732] head: 0200000000000001 ffffea000402a801 ffffffffffffffff 0000000000000000 [ 27.938523] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 27.939922] page dumped because: kasan: bad access detected [ 27.940559] [ 27.940842] Memory state around the buggy address: [ 27.941254] ffff888100aa1900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.942126] ffff888100aa1980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.942483] >ffff888100aa1a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.942871] ^ [ 27.943075] ffff888100aa1a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.943425] ffff888100aa1b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.945794] ==================================================================