Date
Dec. 3, 2024, 11:38 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.187707] ================================================================== [ 30.189169] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 30.189998] Read of size 1 at addr fff00000c1b68c00 by task kunit_try_catch/153 [ 30.190754] [ 30.191111] CPU: 1 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 30.193546] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.194306] Hardware name: linux,dummy-virt (DT) [ 30.194861] Call trace: [ 30.195347] show_stack+0x20/0x38 (C) [ 30.195955] dump_stack_lvl+0x8c/0xd0 [ 30.196615] print_report+0x118/0x5e0 [ 30.197195] kasan_report+0xc8/0x118 [ 30.197741] __kasan_check_byte+0x54/0x70 [ 30.198252] krealloc_noprof+0x44/0x360 [ 30.198944] krealloc_uaf+0x180/0x520 [ 30.199603] kunit_try_run_case+0x14c/0x3d0 [ 30.200301] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.201111] kthread+0x24c/0x2d0 [ 30.201638] ret_from_fork+0x10/0x20 [ 30.202265] [ 30.202624] Allocated by task 153: [ 30.203096] kasan_save_stack+0x3c/0x68 [ 30.203762] kasan_save_track+0x20/0x40 [ 30.204297] kasan_save_alloc_info+0x40/0x58 [ 30.204998] __kasan_kmalloc+0xd4/0xd8 [ 30.205501] __kmalloc_cache_noprof+0x15c/0x3c0 [ 30.206221] krealloc_uaf+0xc8/0x520 [ 30.206694] kunit_try_run_case+0x14c/0x3d0 [ 30.207397] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.208048] kthread+0x24c/0x2d0 [ 30.208726] ret_from_fork+0x10/0x20 [ 30.209273] [ 30.209580] Freed by task 153: [ 30.210057] kasan_save_stack+0x3c/0x68 [ 30.210704] kasan_save_track+0x20/0x40 [ 30.211398] kasan_save_free_info+0x4c/0x78 [ 30.212008] __kasan_slab_free+0x6c/0x98 [ 30.212620] kfree+0x114/0x3c8 [ 30.213051] krealloc_uaf+0x12c/0x520 [ 30.213690] kunit_try_run_case+0x14c/0x3d0 [ 30.214287] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.215041] kthread+0x24c/0x2d0 [ 30.215515] ret_from_fork+0x10/0x20 [ 30.216158] [ 30.216530] The buggy address belongs to the object at fff00000c1b68c00 [ 30.216530] which belongs to the cache kmalloc-256 of size 256 [ 30.218196] The buggy address is located 0 bytes inside of [ 30.218196] freed 256-byte region [fff00000c1b68c00, fff00000c1b68d00) [ 30.219552] [ 30.219830] The buggy address belongs to the physical page: [ 30.220602] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101b68 [ 30.221568] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.222560] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.223453] page_type: f5(slab) [ 30.223926] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.224803] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.225817] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.226852] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.227788] head: 0bfffe0000000001 ffffc1ffc306da01 ffffffffffffffff 0000000000000000 [ 30.228771] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 30.229670] page dumped because: kasan: bad access detected [ 30.230310] [ 30.230689] Memory state around the buggy address: [ 30.231413] fff00000c1b68b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.232202] fff00000c1b68b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.233037] >fff00000c1b68c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.234143] ^ [ 30.234808] fff00000c1b68c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.235853] fff00000c1b68d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.236804] ================================================================== [ 30.239465] ================================================================== [ 30.240381] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 30.241802] Read of size 1 at addr fff00000c1b68c00 by task kunit_try_catch/153 [ 30.242616] [ 30.243577] CPU: 1 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 30.245110] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.245669] Hardware name: linux,dummy-virt (DT) [ 30.246319] Call trace: [ 30.246723] show_stack+0x20/0x38 (C) [ 30.247827] dump_stack_lvl+0x8c/0xd0 [ 30.248353] print_report+0x118/0x5e0 [ 30.248998] kasan_report+0xc8/0x118 [ 30.249568] __asan_report_load1_noabort+0x20/0x30 [ 30.250241] krealloc_uaf+0x4c8/0x520 [ 30.250889] kunit_try_run_case+0x14c/0x3d0 [ 30.251488] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.252369] kthread+0x24c/0x2d0 [ 30.252913] ret_from_fork+0x10/0x20 [ 30.253521] [ 30.253835] Allocated by task 153: [ 30.254266] kasan_save_stack+0x3c/0x68 [ 30.254976] kasan_save_track+0x20/0x40 [ 30.255647] kasan_save_alloc_info+0x40/0x58 [ 30.256268] __kasan_kmalloc+0xd4/0xd8 [ 30.256833] __kmalloc_cache_noprof+0x15c/0x3c0 [ 30.257445] krealloc_uaf+0xc8/0x520 [ 30.257999] kunit_try_run_case+0x14c/0x3d0 [ 30.258759] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.260191] kthread+0x24c/0x2d0 [ 30.260605] ret_from_fork+0x10/0x20 [ 30.261020] [ 30.261196] Freed by task 153: [ 30.261964] kasan_save_stack+0x3c/0x68 [ 30.262647] kasan_save_track+0x20/0x40 [ 30.263126] kasan_save_free_info+0x4c/0x78 [ 30.264078] __kasan_slab_free+0x6c/0x98 [ 30.264776] kfree+0x114/0x3c8 [ 30.265408] krealloc_uaf+0x12c/0x520 [ 30.266066] kunit_try_run_case+0x14c/0x3d0 [ 30.266831] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.267554] kthread+0x24c/0x2d0 [ 30.268050] ret_from_fork+0x10/0x20 [ 30.268649] [ 30.268936] The buggy address belongs to the object at fff00000c1b68c00 [ 30.268936] which belongs to the cache kmalloc-256 of size 256 [ 30.270496] The buggy address is located 0 bytes inside of [ 30.270496] freed 256-byte region [fff00000c1b68c00, fff00000c1b68d00) [ 30.271856] [ 30.272160] The buggy address belongs to the physical page: [ 30.272859] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101b68 [ 30.273754] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.274806] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.275602] page_type: f5(slab) [ 30.276283] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.277487] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.278403] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.279319] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.280245] head: 0bfffe0000000001 ffffc1ffc306da01 ffffffffffffffff 0000000000000000 [ 30.281226] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 30.282273] page dumped because: kasan: bad access detected [ 30.283196] [ 30.283672] Memory state around the buggy address: [ 30.284500] fff00000c1b68b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.285345] fff00000c1b68b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.286180] >fff00000c1b68c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.286817] ^ [ 30.287204] fff00000c1b68c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.287922] fff00000c1b68d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.288781] ==================================================================
[ 25.838931] ================================================================== [ 25.839561] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53e/0x5e0 [ 25.840750] Read of size 1 at addr ffff888100398600 by task kunit_try_catch/173 [ 25.842370] [ 25.842549] CPU: 0 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 25.843416] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.843654] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.844675] Call Trace: [ 25.844904] <TASK> [ 25.845196] dump_stack_lvl+0x73/0xb0 [ 25.845597] print_report+0xd1/0x640 [ 25.846857] ? __virt_addr_valid+0x1db/0x2d0 [ 25.847284] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.847830] kasan_report+0x102/0x140 [ 25.848268] ? krealloc_uaf+0x53e/0x5e0 [ 25.848770] ? krealloc_uaf+0x53e/0x5e0 [ 25.849165] __asan_report_load1_noabort+0x18/0x20 [ 25.849578] krealloc_uaf+0x53e/0x5e0 [ 25.850114] ? __pfx_krealloc_uaf+0x10/0x10 [ 25.850527] ? finish_task_switch.isra.0+0x153/0x700 [ 25.851179] ? __switch_to+0x5d9/0xf60 [ 25.851558] ? __schedule+0xc3e/0x2790 [ 25.852860] ? __pfx_read_tsc+0x10/0x10 [ 25.853181] ? ktime_get_ts64+0x86/0x230 [ 25.853502] kunit_try_run_case+0x1b3/0x490 [ 25.853836] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.854202] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 25.854562] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.854958] ? __kthread_parkme+0x82/0x160 [ 25.856095] ? preempt_count_sub+0x50/0x80 [ 25.856381] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.856683] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.857733] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.858227] kthread+0x257/0x310 [ 25.858991] ? __pfx_kthread+0x10/0x10 [ 25.859379] ret_from_fork+0x41/0x80 [ 25.860233] ? __pfx_kthread+0x10/0x10 [ 25.860761] ret_from_fork_asm+0x1a/0x30 [ 25.861348] </TASK> [ 25.861546] [ 25.862132] Allocated by task 173: [ 25.862348] kasan_save_stack+0x3d/0x60 [ 25.863215] kasan_save_track+0x18/0x40 [ 25.863438] kasan_save_alloc_info+0x3b/0x50 [ 25.863659] __kasan_kmalloc+0xb7/0xc0 [ 25.864069] __kmalloc_cache_noprof+0x184/0x410 [ 25.864712] krealloc_uaf+0xbc/0x5e0 [ 25.865083] kunit_try_run_case+0x1b3/0x490 [ 25.865444] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.866871] kthread+0x257/0x310 [ 25.867150] ret_from_fork+0x41/0x80 [ 25.867611] ret_from_fork_asm+0x1a/0x30 [ 25.868191] [ 25.868351] Freed by task 173: [ 25.868994] kasan_save_stack+0x3d/0x60 [ 25.869864] kasan_save_track+0x18/0x40 [ 25.870453] kasan_save_free_info+0x3f/0x60 [ 25.871154] __kasan_slab_free+0x56/0x70 [ 25.871695] kfree+0x123/0x3f0 [ 25.872027] krealloc_uaf+0x13e/0x5e0 [ 25.872435] kunit_try_run_case+0x1b3/0x490 [ 25.873613] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.873881] kthread+0x257/0x310 [ 25.874084] ret_from_fork+0x41/0x80 [ 25.874442] ret_from_fork_asm+0x1a/0x30 [ 25.875677] [ 25.875905] The buggy address belongs to the object at ffff888100398600 [ 25.875905] which belongs to the cache kmalloc-256 of size 256 [ 25.877203] The buggy address is located 0 bytes inside of [ 25.877203] freed 256-byte region [ffff888100398600, ffff888100398700) [ 25.878301] [ 25.878814] The buggy address belongs to the physical page: [ 25.879314] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100398 [ 25.880034] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.881434] flags: 0x200000000000040(head|node=0|zone=2) [ 25.881985] page_type: f5(slab) [ 25.882948] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.883486] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.884482] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.885816] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.886311] head: 0200000000000001 ffffea000400e601 ffffffffffffffff 0000000000000000 [ 25.887529] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 25.888314] page dumped because: kasan: bad access detected [ 25.889049] [ 25.889313] Memory state around the buggy address: [ 25.890027] ffff888100398500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.890358] ffff888100398580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.892083] >ffff888100398600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.892523] ^ [ 25.892931] ffff888100398680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.894168] ffff888100398700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.894635] ================================================================== [ 25.776905] ================================================================== [ 25.777541] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b9/0x5e0 [ 25.778251] Read of size 1 at addr ffff888100398600 by task kunit_try_catch/173 [ 25.778928] [ 25.779731] CPU: 0 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 25.780285] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.781366] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.782194] Call Trace: [ 25.782438] <TASK> [ 25.783265] dump_stack_lvl+0x73/0xb0 [ 25.784164] print_report+0xd1/0x640 [ 25.784669] ? __virt_addr_valid+0x1db/0x2d0 [ 25.785521] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.785998] kasan_report+0x102/0x140 [ 25.786372] ? krealloc_uaf+0x1b9/0x5e0 [ 25.787023] ? krealloc_uaf+0x1b9/0x5e0 [ 25.787383] ? krealloc_uaf+0x1b9/0x5e0 [ 25.789012] __kasan_check_byte+0x3d/0x50 [ 25.789371] krealloc_noprof+0x3f/0x340 [ 25.789936] ? stack_depot_save_flags+0x43d/0x7c0 [ 25.790359] krealloc_uaf+0x1b9/0x5e0 [ 25.791304] ? __pfx_krealloc_uaf+0x10/0x10 [ 25.792005] ? finish_task_switch.isra.0+0x153/0x700 [ 25.792417] ? __switch_to+0x5d9/0xf60 [ 25.793049] ? __schedule+0xc3e/0x2790 [ 25.793930] ? __pfx_read_tsc+0x10/0x10 [ 25.794274] ? ktime_get_ts64+0x86/0x230 [ 25.794667] kunit_try_run_case+0x1b3/0x490 [ 25.795280] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.796133] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 25.796632] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.797251] ? __kthread_parkme+0x82/0x160 [ 25.798163] ? preempt_count_sub+0x50/0x80 [ 25.798414] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.799370] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.800334] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.801410] kthread+0x257/0x310 [ 25.801833] ? __pfx_kthread+0x10/0x10 [ 25.802186] ret_from_fork+0x41/0x80 [ 25.802549] ? __pfx_kthread+0x10/0x10 [ 25.803639] ret_from_fork_asm+0x1a/0x30 [ 25.804026] </TASK> [ 25.804320] [ 25.804525] Allocated by task 173: [ 25.804824] kasan_save_stack+0x3d/0x60 [ 25.805155] kasan_save_track+0x18/0x40 [ 25.805529] kasan_save_alloc_info+0x3b/0x50 [ 25.806244] __kasan_kmalloc+0xb7/0xc0 [ 25.806540] __kmalloc_cache_noprof+0x184/0x410 [ 25.806831] krealloc_uaf+0xbc/0x5e0 [ 25.807357] kunit_try_run_case+0x1b3/0x490 [ 25.808031] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.808563] kthread+0x257/0x310 [ 25.809321] ret_from_fork+0x41/0x80 [ 25.809676] ret_from_fork_asm+0x1a/0x30 [ 25.810096] [ 25.810302] Freed by task 173: [ 25.810963] kasan_save_stack+0x3d/0x60 [ 25.811242] kasan_save_track+0x18/0x40 [ 25.811642] kasan_save_free_info+0x3f/0x60 [ 25.812203] __kasan_slab_free+0x56/0x70 [ 25.812670] kfree+0x123/0x3f0 [ 25.813021] krealloc_uaf+0x13e/0x5e0 [ 25.814387] kunit_try_run_case+0x1b3/0x490 [ 25.814962] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.815493] kthread+0x257/0x310 [ 25.815953] ret_from_fork+0x41/0x80 [ 25.816960] ret_from_fork_asm+0x1a/0x30 [ 25.817218] [ 25.817369] The buggy address belongs to the object at ffff888100398600 [ 25.817369] which belongs to the cache kmalloc-256 of size 256 [ 25.819487] The buggy address is located 0 bytes inside of [ 25.819487] freed 256-byte region [ffff888100398600, ffff888100398700) [ 25.820445] [ 25.821123] The buggy address belongs to the physical page: [ 25.821694] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100398 [ 25.822671] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.823928] flags: 0x200000000000040(head|node=0|zone=2) [ 25.824480] page_type: f5(slab) [ 25.824726] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.825380] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.826493] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.827299] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.828733] head: 0200000000000001 ffffea000400e601 ffffffffffffffff 0000000000000000 [ 25.829207] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 25.829888] page dumped because: kasan: bad access detected [ 25.830859] [ 25.831139] Memory state around the buggy address: [ 25.832166] ffff888100398500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.833071] ffff888100398580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.834212] >ffff888100398600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.834751] ^ [ 25.835405] ffff888100398680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.835952] ffff888100398700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.836539] ==================================================================