Date
Dec. 5, 2024, 2:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.858672] ================================================================== [ 29.860557] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 29.861689] Read of size 1 at addr fff00000c18fba00 by task kunit_try_catch/153 [ 29.862626] [ 29.863029] CPU: 1 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 29.864987] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.865916] Hardware name: linux,dummy-virt (DT) [ 29.866719] Call trace: [ 29.867098] show_stack+0x20/0x38 (C) [ 29.867933] dump_stack_lvl+0x8c/0xd0 [ 29.868797] print_report+0x118/0x5e0 [ 29.869504] kasan_report+0xc8/0x118 [ 29.870189] __kasan_check_byte+0x54/0x70 [ 29.870919] krealloc_noprof+0x44/0x360 [ 29.871463] krealloc_uaf+0x180/0x520 [ 29.872447] kunit_try_run_case+0x14c/0x3d0 [ 29.873023] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.873829] kthread+0x24c/0x2d0 [ 29.874431] ret_from_fork+0x10/0x20 [ 29.874981] [ 29.875608] Allocated by task 153: [ 29.876209] kasan_save_stack+0x3c/0x68 [ 29.876867] kasan_save_track+0x20/0x40 [ 29.877543] kasan_save_alloc_info+0x40/0x58 [ 29.878087] __kasan_kmalloc+0xd4/0xd8 [ 29.878818] __kmalloc_cache_noprof+0x15c/0x3c0 [ 29.879750] krealloc_uaf+0xc8/0x520 [ 29.880542] kunit_try_run_case+0x14c/0x3d0 [ 29.881144] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.881817] kthread+0x24c/0x2d0 [ 29.882395] ret_from_fork+0x10/0x20 [ 29.882975] [ 29.883910] Freed by task 153: [ 29.884352] kasan_save_stack+0x3c/0x68 [ 29.884849] kasan_save_track+0x20/0x40 [ 29.885565] kasan_save_free_info+0x4c/0x78 [ 29.886305] __kasan_slab_free+0x6c/0x98 [ 29.887025] kfree+0x114/0x3c8 [ 29.887536] krealloc_uaf+0x12c/0x520 [ 29.888219] kunit_try_run_case+0x14c/0x3d0 [ 29.888697] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.889786] kthread+0x24c/0x2d0 [ 29.890282] ret_from_fork+0x10/0x20 [ 29.890812] [ 29.891549] The buggy address belongs to the object at fff00000c18fba00 [ 29.891549] which belongs to the cache kmalloc-256 of size 256 [ 29.892956] The buggy address is located 0 bytes inside of [ 29.892956] freed 256-byte region [fff00000c18fba00, fff00000c18fbb00) [ 29.894565] [ 29.894943] The buggy address belongs to the physical page: [ 29.896014] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1018fa [ 29.897039] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.897964] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.898828] page_type: f5(slab) [ 29.899628] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 29.900455] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.901455] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 29.902329] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.903389] head: 0bfffe0000000001 ffffc1ffc3063e81 ffffffffffffffff 0000000000000000 [ 29.904598] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 29.905512] page dumped because: kasan: bad access detected [ 29.906351] [ 29.906683] Memory state around the buggy address: [ 29.907683] fff00000c18fb900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.908610] fff00000c18fb980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.909459] >fff00000c18fba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.910297] ^ [ 29.910748] fff00000c18fba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.911988] fff00000c18fbb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.912813] ================================================================== [ 29.914394] ================================================================== [ 29.915048] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 29.916805] Read of size 1 at addr fff00000c18fba00 by task kunit_try_catch/153 [ 29.917819] [ 29.918492] CPU: 1 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 29.920175] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.920736] Hardware name: linux,dummy-virt (DT) [ 29.921818] Call trace: [ 29.922188] show_stack+0x20/0x38 (C) [ 29.922898] dump_stack_lvl+0x8c/0xd0 [ 29.923970] print_report+0x118/0x5e0 [ 29.925107] kasan_report+0xc8/0x118 [ 29.925843] __asan_report_load1_noabort+0x20/0x30 [ 29.926648] krealloc_uaf+0x4c8/0x520 [ 29.927667] kunit_try_run_case+0x14c/0x3d0 [ 29.928591] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.929711] kthread+0x24c/0x2d0 [ 29.930232] ret_from_fork+0x10/0x20 [ 29.930739] [ 29.931161] Allocated by task 153: [ 29.932071] kasan_save_stack+0x3c/0x68 [ 29.932655] kasan_save_track+0x20/0x40 [ 29.933449] kasan_save_alloc_info+0x40/0x58 [ 29.934013] __kasan_kmalloc+0xd4/0xd8 [ 29.934618] __kmalloc_cache_noprof+0x15c/0x3c0 [ 29.935416] krealloc_uaf+0xc8/0x520 [ 29.935845] kunit_try_run_case+0x14c/0x3d0 [ 29.936528] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.937685] kthread+0x24c/0x2d0 [ 29.938181] ret_from_fork+0x10/0x20 [ 29.938806] [ 29.939156] Freed by task 153: [ 29.939965] kasan_save_stack+0x3c/0x68 [ 29.940473] kasan_save_track+0x20/0x40 [ 29.941135] kasan_save_free_info+0x4c/0x78 [ 29.941734] __kasan_slab_free+0x6c/0x98 [ 29.942323] kfree+0x114/0x3c8 [ 29.942843] krealloc_uaf+0x12c/0x520 [ 29.944206] kunit_try_run_case+0x14c/0x3d0 [ 29.945009] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.945822] kthread+0x24c/0x2d0 [ 29.946562] ret_from_fork+0x10/0x20 [ 29.947317] [ 29.947853] The buggy address belongs to the object at fff00000c18fba00 [ 29.947853] which belongs to the cache kmalloc-256 of size 256 [ 29.949445] The buggy address is located 0 bytes inside of [ 29.949445] freed 256-byte region [fff00000c18fba00, fff00000c18fbb00) [ 29.951007] [ 29.951979] The buggy address belongs to the physical page: [ 29.953088] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1018fa [ 29.954233] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.955355] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.956461] page_type: f5(slab) [ 29.956986] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 29.958124] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.959079] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 29.960416] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.961457] head: 0bfffe0000000001 ffffc1ffc3063e81 ffffffffffffffff 0000000000000000 [ 29.962451] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 29.963479] page dumped because: kasan: bad access detected [ 29.964478] [ 29.964950] Memory state around the buggy address: [ 29.965717] fff00000c18fb900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.966705] fff00000c18fb980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.967729] >fff00000c18fba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.968521] ^ [ 29.969188] fff00000c18fba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.970547] fff00000c18fbb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.971660] ==================================================================
[ 27.658312] ================================================================== [ 27.659953] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53e/0x5e0 [ 27.660668] Read of size 1 at addr ffff8881009ab200 by task kunit_try_catch/171 [ 27.661826] [ 27.662043] CPU: 1 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 27.663458] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.664273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.665239] Call Trace: [ 27.665649] <TASK> [ 27.666133] dump_stack_lvl+0x73/0xb0 [ 27.666789] print_report+0xd1/0x640 [ 27.667233] ? __virt_addr_valid+0x1db/0x2d0 [ 27.668026] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.668542] kasan_report+0x102/0x140 [ 27.669196] ? krealloc_uaf+0x53e/0x5e0 [ 27.669622] ? krealloc_uaf+0x53e/0x5e0 [ 27.670315] __asan_report_load1_noabort+0x18/0x20 [ 27.671133] krealloc_uaf+0x53e/0x5e0 [ 27.671500] ? __pfx_krealloc_uaf+0x10/0x10 [ 27.672037] ? finish_task_switch.isra.0+0x153/0x700 [ 27.672869] ? __switch_to+0x5d9/0xf60 [ 27.673462] ? __schedule+0xc70/0x27e0 [ 27.673876] ? __pfx_read_tsc+0x10/0x10 [ 27.674592] ? ktime_get_ts64+0x86/0x230 [ 27.675729] kunit_try_run_case+0x1b3/0x490 [ 27.676330] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.676759] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 27.677557] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.678252] ? __kthread_parkme+0x82/0x160 [ 27.678726] ? preempt_count_sub+0x50/0x80 [ 27.679799] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.680252] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.680869] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.681564] kthread+0x257/0x310 [ 27.682018] ? __pfx_kthread+0x10/0x10 [ 27.682583] ret_from_fork+0x41/0x80 [ 27.682938] ? __pfx_kthread+0x10/0x10 [ 27.683482] ret_from_fork_asm+0x1a/0x30 [ 27.684199] </TASK> [ 27.684585] [ 27.684976] Allocated by task 171: [ 27.685329] kasan_save_stack+0x3d/0x60 [ 27.685952] kasan_save_track+0x18/0x40 [ 27.686269] kasan_save_alloc_info+0x3b/0x50 [ 27.686763] __kasan_kmalloc+0xb7/0xc0 [ 27.687254] __kmalloc_cache_noprof+0x184/0x410 [ 27.687670] krealloc_uaf+0xbc/0x5e0 [ 27.688330] kunit_try_run_case+0x1b3/0x490 [ 27.688882] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.689565] kthread+0x257/0x310 [ 27.690202] ret_from_fork+0x41/0x80 [ 27.690706] ret_from_fork_asm+0x1a/0x30 [ 27.691248] [ 27.691534] Freed by task 171: [ 27.691981] kasan_save_stack+0x3d/0x60 [ 27.692725] kasan_save_track+0x18/0x40 [ 27.693185] kasan_save_free_info+0x3f/0x60 [ 27.693913] __kasan_slab_free+0x56/0x70 [ 27.694468] kfree+0x123/0x3f0 [ 27.694840] krealloc_uaf+0x13e/0x5e0 [ 27.695311] kunit_try_run_case+0x1b3/0x490 [ 27.695875] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.696475] kthread+0x257/0x310 [ 27.696958] ret_from_fork+0x41/0x80 [ 27.697574] ret_from_fork_asm+0x1a/0x30 [ 27.698106] [ 27.698505] The buggy address belongs to the object at ffff8881009ab200 [ 27.698505] which belongs to the cache kmalloc-256 of size 256 [ 27.699643] The buggy address is located 0 bytes inside of [ 27.699643] freed 256-byte region [ffff8881009ab200, ffff8881009ab300) [ 27.701106] [ 27.701278] The buggy address belongs to the physical page: [ 27.702384] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1009aa [ 27.703149] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 27.704111] flags: 0x200000000000040(head|node=0|zone=2) [ 27.704745] page_type: f5(slab) [ 27.705131] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 27.705979] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.706739] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 27.707663] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.708475] head: 0200000000000001 ffffea0004026a81 ffffffffffffffff 0000000000000000 [ 27.709643] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 27.710469] page dumped because: kasan: bad access detected [ 27.711236] [ 27.711424] Memory state around the buggy address: [ 27.712151] ffff8881009ab100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.712875] ffff8881009ab180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.713510] >ffff8881009ab200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.715174] ^ [ 27.715783] ffff8881009ab280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.716078] ffff8881009ab300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.716346] ================================================================== [ 27.599361] ================================================================== [ 27.600747] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b9/0x5e0 [ 27.601915] Read of size 1 at addr ffff8881009ab200 by task kunit_try_catch/171 [ 27.603187] [ 27.603557] CPU: 1 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 27.604245] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.604429] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.604820] Call Trace: [ 27.605034] <TASK> [ 27.605278] dump_stack_lvl+0x73/0xb0 [ 27.605816] print_report+0xd1/0x640 [ 27.606442] ? __virt_addr_valid+0x1db/0x2d0 [ 27.606982] ? kasan_complete_mode_report_info+0x64/0x200 [ 27.607550] kasan_report+0x102/0x140 [ 27.608225] ? krealloc_uaf+0x1b9/0x5e0 [ 27.608990] ? krealloc_uaf+0x1b9/0x5e0 [ 27.609563] ? krealloc_uaf+0x1b9/0x5e0 [ 27.610284] __kasan_check_byte+0x3d/0x50 [ 27.611198] krealloc_noprof+0x3f/0x340 [ 27.611547] krealloc_uaf+0x1b9/0x5e0 [ 27.612252] ? __pfx_krealloc_uaf+0x10/0x10 [ 27.612593] ? finish_task_switch.isra.0+0x153/0x700 [ 27.613495] ? __switch_to+0x5d9/0xf60 [ 27.614293] ? __schedule+0xc70/0x27e0 [ 27.615122] ? __pfx_read_tsc+0x10/0x10 [ 27.615527] ? ktime_get_ts64+0x86/0x230 [ 27.616278] kunit_try_run_case+0x1b3/0x490 [ 27.616961] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.617590] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 27.618339] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.619202] ? __kthread_parkme+0x82/0x160 [ 27.620170] ? preempt_count_sub+0x50/0x80 [ 27.620592] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.621303] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.622412] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.622905] kthread+0x257/0x310 [ 27.623335] ? __pfx_kthread+0x10/0x10 [ 27.623780] ret_from_fork+0x41/0x80 [ 27.624934] ? __pfx_kthread+0x10/0x10 [ 27.625451] ret_from_fork_asm+0x1a/0x30 [ 27.625958] </TASK> [ 27.626631] [ 27.626814] Allocated by task 171: [ 27.627453] kasan_save_stack+0x3d/0x60 [ 27.628466] kasan_save_track+0x18/0x40 [ 27.628881] kasan_save_alloc_info+0x3b/0x50 [ 27.629422] __kasan_kmalloc+0xb7/0xc0 [ 27.630140] __kmalloc_cache_noprof+0x184/0x410 [ 27.630995] krealloc_uaf+0xbc/0x5e0 [ 27.631674] kunit_try_run_case+0x1b3/0x490 [ 27.632303] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.633184] kthread+0x257/0x310 [ 27.633676] ret_from_fork+0x41/0x80 [ 27.634274] ret_from_fork_asm+0x1a/0x30 [ 27.635008] [ 27.635144] Freed by task 171: [ 27.635320] kasan_save_stack+0x3d/0x60 [ 27.635504] kasan_save_track+0x18/0x40 [ 27.635715] kasan_save_free_info+0x3f/0x60 [ 27.636013] __kasan_slab_free+0x56/0x70 [ 27.636407] kfree+0x123/0x3f0 [ 27.636949] krealloc_uaf+0x13e/0x5e0 [ 27.637412] kunit_try_run_case+0x1b3/0x490 [ 27.637738] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.638580] kthread+0x257/0x310 [ 27.639318] ret_from_fork+0x41/0x80 [ 27.639596] ret_from_fork_asm+0x1a/0x30 [ 27.639940] [ 27.640226] The buggy address belongs to the object at ffff8881009ab200 [ 27.640226] which belongs to the cache kmalloc-256 of size 256 [ 27.642075] The buggy address is located 0 bytes inside of [ 27.642075] freed 256-byte region [ffff8881009ab200, ffff8881009ab300) [ 27.642780] [ 27.642976] The buggy address belongs to the physical page: [ 27.643798] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1009aa [ 27.644728] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 27.645472] flags: 0x200000000000040(head|node=0|zone=2) [ 27.645851] page_type: f5(slab) [ 27.646461] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 27.647509] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.648364] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 27.649156] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.649968] head: 0200000000000001 ffffea0004026a81 ffffffffffffffff 0000000000000000 [ 27.650531] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 27.651108] page dumped because: kasan: bad access detected [ 27.651671] [ 27.652115] Memory state around the buggy address: [ 27.652512] ffff8881009ab100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.653406] ffff8881009ab180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.654190] >ffff8881009ab200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.655070] ^ [ 27.655576] ffff8881009ab280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.656305] ffff8881009ab300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.657077] ==================================================================