Date
Nov. 27, 2024, 3:37 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 47.664656] ================================================================== [ 47.666031] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 47.667107] Read of size 1 at addr fff00000c4546400 by task kunit_try_catch/153 [ 47.668761] [ 47.669353] CPU: 1 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241127 #1 [ 47.670530] Tainted: [B]=BAD_PAGE, [N]=TEST [ 47.671105] Hardware name: linux,dummy-virt (DT) [ 47.671707] Call trace: [ 47.672051] show_stack+0x20/0x38 (C) [ 47.672714] dump_stack_lvl+0x8c/0xd0 [ 47.673753] print_report+0x118/0x5e0 [ 47.674416] kasan_report+0xc8/0x118 [ 47.675021] __asan_report_load1_noabort+0x20/0x30 [ 47.675729] krealloc_uaf+0x4c8/0x520 [ 47.676338] kunit_try_run_case+0x14c/0x3d0 [ 47.676967] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.677909] kthread+0x24c/0x2d0 [ 47.678816] ret_from_fork+0x10/0x20 [ 47.679456] [ 47.679789] Allocated by task 153: [ 47.680459] kasan_save_stack+0x3c/0x68 [ 47.680967] kasan_save_track+0x20/0x40 [ 47.681984] kasan_save_alloc_info+0x40/0x58 [ 47.682531] __kasan_kmalloc+0xd4/0xd8 [ 47.682989] __kmalloc_cache_noprof+0x15c/0x3c0 [ 47.683609] krealloc_uaf+0xc8/0x520 [ 47.684133] kunit_try_run_case+0x14c/0x3d0 [ 47.684663] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.685859] kthread+0x24c/0x2d0 [ 47.686323] ret_from_fork+0x10/0x20 [ 47.687421] [ 47.687935] Freed by task 153: [ 47.688408] kasan_save_stack+0x3c/0x68 [ 47.688878] kasan_save_track+0x20/0x40 [ 47.690327] kasan_save_free_info+0x4c/0x78 [ 47.690914] __kasan_slab_free+0x6c/0x98 [ 47.691539] kfree+0x114/0x3c8 [ 47.692043] krealloc_uaf+0x12c/0x520 [ 47.692615] kunit_try_run_case+0x14c/0x3d0 [ 47.693225] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.694058] kthread+0x24c/0x2d0 [ 47.695022] ret_from_fork+0x10/0x20 [ 47.695519] [ 47.695888] The buggy address belongs to the object at fff00000c4546400 [ 47.695888] which belongs to the cache kmalloc-256 of size 256 [ 47.697315] The buggy address is located 0 bytes inside of [ 47.697315] freed 256-byte region [fff00000c4546400, fff00000c4546500) [ 47.698885] [ 47.699190] The buggy address belongs to the physical page: [ 47.700032] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104546 [ 47.701345] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 47.702117] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 47.703134] page_type: f5(slab) [ 47.703658] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 47.704688] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 47.706347] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 47.707329] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 47.708310] head: 0bfffe0000000001 ffffc1ffc3115181 ffffffffffffffff 0000000000000000 [ 47.709505] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 47.710270] page dumped because: kasan: bad access detected [ 47.711255] [ 47.711802] Memory state around the buggy address: [ 47.712392] fff00000c4546300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.713189] fff00000c4546380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.714499] >fff00000c4546400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.715238] ^ [ 47.715781] fff00000c4546480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.716897] fff00000c4546500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.718073] ================================================================== [ 47.610625] ================================================================== [ 47.611859] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 47.612658] Read of size 1 at addr fff00000c4546400 by task kunit_try_catch/153 [ 47.613526] [ 47.613924] CPU: 1 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241127 #1 [ 47.615130] Tainted: [B]=BAD_PAGE, [N]=TEST [ 47.616077] Hardware name: linux,dummy-virt (DT) [ 47.616750] Call trace: [ 47.617563] show_stack+0x20/0x38 (C) [ 47.618127] dump_stack_lvl+0x8c/0xd0 [ 47.618765] print_report+0x118/0x5e0 [ 47.619337] kasan_report+0xc8/0x118 [ 47.619894] __kasan_check_byte+0x54/0x70 [ 47.620512] krealloc_noprof+0x44/0x360 [ 47.621373] krealloc_uaf+0x180/0x520 [ 47.621925] kunit_try_run_case+0x14c/0x3d0 [ 47.622644] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.623486] kthread+0x24c/0x2d0 [ 47.624183] ret_from_fork+0x10/0x20 [ 47.624745] [ 47.625330] Allocated by task 153: [ 47.625807] kasan_save_stack+0x3c/0x68 [ 47.626412] kasan_save_track+0x20/0x40 [ 47.626992] kasan_save_alloc_info+0x40/0x58 [ 47.627594] __kasan_kmalloc+0xd4/0xd8 [ 47.628065] __kmalloc_cache_noprof+0x15c/0x3c0 [ 47.628827] krealloc_uaf+0xc8/0x520 [ 47.630350] kunit_try_run_case+0x14c/0x3d0 [ 47.631162] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.631878] kthread+0x24c/0x2d0 [ 47.632454] ret_from_fork+0x10/0x20 [ 47.632841] [ 47.633253] Freed by task 153: [ 47.633810] kasan_save_stack+0x3c/0x68 [ 47.634329] kasan_save_track+0x20/0x40 [ 47.634889] kasan_save_free_info+0x4c/0x78 [ 47.635705] __kasan_slab_free+0x6c/0x98 [ 47.636220] kfree+0x114/0x3c8 [ 47.636744] krealloc_uaf+0x12c/0x520 [ 47.637451] kunit_try_run_case+0x14c/0x3d0 [ 47.638078] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.638777] kthread+0x24c/0x2d0 [ 47.639377] ret_from_fork+0x10/0x20 [ 47.639878] [ 47.640332] The buggy address belongs to the object at fff00000c4546400 [ 47.640332] which belongs to the cache kmalloc-256 of size 256 [ 47.642057] The buggy address is located 0 bytes inside of [ 47.642057] freed 256-byte region [fff00000c4546400, fff00000c4546500) [ 47.643532] [ 47.643855] The buggy address belongs to the physical page: [ 47.644503] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104546 [ 47.645788] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 47.646732] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 47.647636] page_type: f5(slab) [ 47.648148] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 47.649080] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 47.650571] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 47.651443] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 47.652497] head: 0bfffe0000000001 ffffc1ffc3115181 ffffffffffffffff 0000000000000000 [ 47.653643] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 47.654751] page dumped because: kasan: bad access detected [ 47.655264] [ 47.655656] Memory state around the buggy address: [ 47.656247] fff00000c4546300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.657223] fff00000c4546380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.657957] >fff00000c4546400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.659277] ^ [ 47.659805] fff00000c4546480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.660650] fff00000c4546500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.661761] ==================================================================
[ 24.885240] ================================================================== [ 24.886267] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53e/0x5e0 [ 24.886798] Read of size 1 at addr ffff888100999a00 by task kunit_try_catch/172 [ 24.888455] [ 24.889357] CPU: 1 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241127 #1 [ 24.889878] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.890528] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.891398] Call Trace: [ 24.892103] <TASK> [ 24.892316] dump_stack_lvl+0x73/0xb0 [ 24.892698] print_report+0xd1/0x640 [ 24.893607] ? __virt_addr_valid+0x1db/0x2d0 [ 24.894771] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.895946] kasan_report+0x102/0x140 [ 24.896552] ? krealloc_uaf+0x53e/0x5e0 [ 24.896927] ? krealloc_uaf+0x53e/0x5e0 [ 24.897865] __asan_report_load1_noabort+0x18/0x20 [ 24.898383] krealloc_uaf+0x53e/0x5e0 [ 24.898572] ? __pfx_krealloc_uaf+0x10/0x10 [ 24.898762] ? finish_task_switch.isra.0+0x153/0x700 [ 24.899300] ? __switch_to+0x5d9/0xf60 [ 24.899771] ? __schedule+0xc3e/0x2790 [ 24.900285] ? __pfx_read_tsc+0x10/0x10 [ 24.900743] ? ktime_get_ts64+0x84/0x230 [ 24.902254] kunit_try_run_case+0x1b3/0x490 [ 24.902873] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.903460] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 24.903836] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.904749] ? __kthread_parkme+0x82/0x160 [ 24.905684] ? preempt_count_sub+0x50/0x80 [ 24.906388] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.906890] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.908065] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.908559] kthread+0x257/0x310 [ 24.908903] ? __pfx_kthread+0x10/0x10 [ 24.909801] ret_from_fork+0x41/0x80 [ 24.910746] ? __pfx_kthread+0x10/0x10 [ 24.911146] ret_from_fork_asm+0x1a/0x30 [ 24.911601] </TASK> [ 24.911815] [ 24.912306] Allocated by task 172: [ 24.912944] kasan_save_stack+0x3d/0x60 [ 24.913515] kasan_save_track+0x18/0x40 [ 24.913914] kasan_save_alloc_info+0x3b/0x50 [ 24.915372] __kasan_kmalloc+0xb7/0xc0 [ 24.915765] __kmalloc_cache_noprof+0x184/0x410 [ 24.916234] krealloc_uaf+0xbc/0x5e0 [ 24.916920] kunit_try_run_case+0x1b3/0x490 [ 24.917568] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.918635] kthread+0x257/0x310 [ 24.919043] ret_from_fork+0x41/0x80 [ 24.919528] ret_from_fork_asm+0x1a/0x30 [ 24.920121] [ 24.920297] Freed by task 172: [ 24.921118] kasan_save_stack+0x3d/0x60 [ 24.921519] kasan_save_track+0x18/0x40 [ 24.922808] kasan_save_free_info+0x3f/0x60 [ 24.923200] __kasan_slab_free+0x56/0x70 [ 24.923800] kfree+0x123/0x3f0 [ 24.924495] krealloc_uaf+0x13e/0x5e0 [ 24.925247] kunit_try_run_case+0x1b3/0x490 [ 24.925677] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.926941] kthread+0x257/0x310 [ 24.927831] ret_from_fork+0x41/0x80 [ 24.928492] ret_from_fork_asm+0x1a/0x30 [ 24.929387] [ 24.929570] The buggy address belongs to the object at ffff888100999a00 [ 24.929570] which belongs to the cache kmalloc-256 of size 256 [ 24.931235] The buggy address is located 0 bytes inside of [ 24.931235] freed 256-byte region [ffff888100999a00, ffff888100999b00) [ 24.932581] [ 24.933043] The buggy address belongs to the physical page: [ 24.933757] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100998 [ 24.934551] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.935519] flags: 0x200000000000040(head|node=0|zone=2) [ 24.936360] page_type: f5(slab) [ 24.936616] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.937561] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 24.938581] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.939663] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 24.940564] head: 0200000000000001 ffffea0004026601 ffffffffffffffff 0000000000000000 [ 24.941435] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 24.942552] page dumped because: kasan: bad access detected [ 24.943626] [ 24.943824] Memory state around the buggy address: [ 24.944635] ffff888100999900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.945506] ffff888100999980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.946047] >ffff888100999a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.947542] ^ [ 24.947863] ffff888100999a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.948807] ffff888100999b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.949829] ================================================================== [ 24.825910] ================================================================== [ 24.827351] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b9/0x5e0 [ 24.827955] Read of size 1 at addr ffff888100999a00 by task kunit_try_catch/172 [ 24.829397] [ 24.829732] CPU: 1 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241127 #1 [ 24.830897] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.831600] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.832674] Call Trace: [ 24.833272] <TASK> [ 24.833496] dump_stack_lvl+0x73/0xb0 [ 24.833888] print_report+0xd1/0x640 [ 24.834808] ? __virt_addr_valid+0x1db/0x2d0 [ 24.835529] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.836490] kasan_report+0x102/0x140 [ 24.836677] ? krealloc_uaf+0x1b9/0x5e0 [ 24.836863] ? krealloc_uaf+0x1b9/0x5e0 [ 24.837870] ? krealloc_uaf+0x1b9/0x5e0 [ 24.838721] __kasan_check_byte+0x3d/0x50 [ 24.839549] krealloc_noprof+0x3f/0x340 [ 24.840028] krealloc_uaf+0x1b9/0x5e0 [ 24.840392] ? __pfx_krealloc_uaf+0x10/0x10 [ 24.840745] ? finish_task_switch.isra.0+0x153/0x700 [ 24.841433] ? __switch_to+0x5d9/0xf60 [ 24.841796] ? __schedule+0xc3e/0x2790 [ 24.842510] ? __pfx_read_tsc+0x10/0x10 [ 24.842888] ? ktime_get_ts64+0x84/0x230 [ 24.843476] kunit_try_run_case+0x1b3/0x490 [ 24.844171] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.844614] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 24.845374] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.845889] ? __kthread_parkme+0x82/0x160 [ 24.846486] ? preempt_count_sub+0x50/0x80 [ 24.847051] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.847629] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.848446] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.848904] kthread+0x257/0x310 [ 24.849276] ? __pfx_kthread+0x10/0x10 [ 24.849682] ret_from_fork+0x41/0x80 [ 24.850399] ? __pfx_kthread+0x10/0x10 [ 24.850690] ret_from_fork_asm+0x1a/0x30 [ 24.851394] </TASK> [ 24.851716] [ 24.852008] Allocated by task 172: [ 24.852292] kasan_save_stack+0x3d/0x60 [ 24.852778] kasan_save_track+0x18/0x40 [ 24.853294] kasan_save_alloc_info+0x3b/0x50 [ 24.853637] __kasan_kmalloc+0xb7/0xc0 [ 24.854463] __kmalloc_cache_noprof+0x184/0x410 [ 24.855097] krealloc_uaf+0xbc/0x5e0 [ 24.855555] kunit_try_run_case+0x1b3/0x490 [ 24.856221] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.856579] kthread+0x257/0x310 [ 24.857140] ret_from_fork+0x41/0x80 [ 24.857599] ret_from_fork_asm+0x1a/0x30 [ 24.858419] [ 24.858677] Freed by task 172: [ 24.859208] kasan_save_stack+0x3d/0x60 [ 24.859648] kasan_save_track+0x18/0x40 [ 24.860137] kasan_save_free_info+0x3f/0x60 [ 24.860633] __kasan_slab_free+0x56/0x70 [ 24.861243] kfree+0x123/0x3f0 [ 24.861632] krealloc_uaf+0x13e/0x5e0 [ 24.862321] kunit_try_run_case+0x1b3/0x490 [ 24.862828] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.863372] kthread+0x257/0x310 [ 24.863668] ret_from_fork+0x41/0x80 [ 24.864266] ret_from_fork_asm+0x1a/0x30 [ 24.864577] [ 24.864794] The buggy address belongs to the object at ffff888100999a00 [ 24.864794] which belongs to the cache kmalloc-256 of size 256 [ 24.866645] The buggy address is located 0 bytes inside of [ 24.866645] freed 256-byte region [ffff888100999a00, ffff888100999b00) [ 24.867837] [ 24.868306] The buggy address belongs to the physical page: [ 24.868887] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100998 [ 24.869820] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.871127] flags: 0x200000000000040(head|node=0|zone=2) [ 24.871491] page_type: f5(slab) [ 24.872137] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.872815] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 24.873644] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.874594] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 24.875369] head: 0200000000000001 ffffea0004026601 ffffffffffffffff 0000000000000000 [ 24.876268] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 24.877141] page dumped because: kasan: bad access detected [ 24.877525] [ 24.877757] Memory state around the buggy address: [ 24.878639] ffff888100999900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.879560] ffff888100999980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.880406] >ffff888100999a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.881256] ^ [ 24.881580] ffff888100999a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.882508] ffff888100999b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.883315] ==================================================================