Date
Dec. 6, 2024, 3:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.933941] ================================================================== [ 30.934881] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 30.936084] Read of size 1 at addr fff00000c1920800 by task kunit_try_catch/153 [ 30.936820] [ 30.937350] CPU: 0 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 30.938770] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.939342] Hardware name: linux,dummy-virt (DT) [ 30.939991] Call trace: [ 30.940429] show_stack+0x20/0x38 (C) [ 30.941157] dump_stack_lvl+0x8c/0xd0 [ 30.941811] print_report+0x118/0x5e0 [ 30.942740] kasan_report+0xc8/0x118 [ 30.943470] __asan_report_load1_noabort+0x20/0x30 [ 30.944113] krealloc_uaf+0x4c8/0x520 [ 30.944801] kunit_try_run_case+0x14c/0x3d0 [ 30.945431] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.946557] kthread+0x24c/0x2d0 [ 30.947055] ret_from_fork+0x10/0x20 [ 30.947685] [ 30.948075] Allocated by task 153: [ 30.948597] kasan_save_stack+0x3c/0x68 [ 30.949266] kasan_save_track+0x20/0x40 [ 30.949890] kasan_save_alloc_info+0x40/0x58 [ 30.950856] __kasan_kmalloc+0xd4/0xd8 [ 30.951425] __kmalloc_cache_noprof+0x15c/0x3c0 [ 30.952102] krealloc_uaf+0xc8/0x520 [ 30.952701] kunit_try_run_case+0x14c/0x3d0 [ 30.953320] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.954054] kthread+0x24c/0x2d0 [ 30.954656] ret_from_fork+0x10/0x20 [ 30.955247] [ 30.955636] Freed by task 153: [ 30.956148] kasan_save_stack+0x3c/0x68 [ 30.957112] kasan_save_track+0x20/0x40 [ 30.958261] kasan_save_free_info+0x4c/0x78 [ 30.959212] __kasan_slab_free+0x6c/0x98 [ 30.960077] kfree+0x114/0x3c8 [ 30.960801] krealloc_uaf+0x12c/0x520 [ 30.961550] kunit_try_run_case+0x14c/0x3d0 [ 30.962436] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.963145] kthread+0x24c/0x2d0 [ 30.963489] ret_from_fork+0x10/0x20 [ 30.964496] [ 30.964878] The buggy address belongs to the object at fff00000c1920800 [ 30.964878] which belongs to the cache kmalloc-256 of size 256 [ 30.966105] The buggy address is located 0 bytes inside of [ 30.966105] freed 256-byte region [fff00000c1920800, fff00000c1920900) [ 30.967904] [ 30.968356] The buggy address belongs to the physical page: [ 30.969140] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101920 [ 30.970076] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.971256] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.972238] page_type: f5(slab) [ 30.972824] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.973865] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.974977] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.976431] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.977443] head: 0bfffe0000000001 ffffc1ffc3064801 ffffffffffffffff 0000000000000000 [ 30.978600] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 30.979533] page dumped because: kasan: bad access detected [ 30.980315] [ 30.980785] Memory state around the buggy address: [ 30.981492] fff00000c1920700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.982532] fff00000c1920780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.983552] >fff00000c1920800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.984426] ^ [ 30.984932] fff00000c1920880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.985830] fff00000c1920900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.986979] ================================================================== [ 30.879429] ================================================================== [ 30.880568] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 30.881456] Read of size 1 at addr fff00000c1920800 by task kunit_try_catch/153 [ 30.882280] [ 30.883109] CPU: 0 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 30.884411] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.884798] Hardware name: linux,dummy-virt (DT) [ 30.885464] Call trace: [ 30.885867] show_stack+0x20/0x38 (C) [ 30.886741] dump_stack_lvl+0x8c/0xd0 [ 30.887497] print_report+0x118/0x5e0 [ 30.888181] kasan_report+0xc8/0x118 [ 30.888782] __kasan_check_byte+0x54/0x70 [ 30.889477] krealloc_noprof+0x44/0x360 [ 30.890189] krealloc_uaf+0x180/0x520 [ 30.891139] kunit_try_run_case+0x14c/0x3d0 [ 30.891801] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.892531] kthread+0x24c/0x2d0 [ 30.893139] ret_from_fork+0x10/0x20 [ 30.893771] [ 30.894146] Allocated by task 153: [ 30.894597] kasan_save_stack+0x3c/0x68 [ 30.895236] kasan_save_track+0x20/0x40 [ 30.895789] kasan_save_alloc_info+0x40/0x58 [ 30.896442] __kasan_kmalloc+0xd4/0xd8 [ 30.897313] __kmalloc_cache_noprof+0x15c/0x3c0 [ 30.897887] krealloc_uaf+0xc8/0x520 [ 30.899206] kunit_try_run_case+0x14c/0x3d0 [ 30.899862] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.900586] kthread+0x24c/0x2d0 [ 30.901090] ret_from_fork+0x10/0x20 [ 30.901727] [ 30.902088] Freed by task 153: [ 30.902498] kasan_save_stack+0x3c/0x68 [ 30.903375] kasan_save_track+0x20/0x40 [ 30.904026] kasan_save_free_info+0x4c/0x78 [ 30.904653] __kasan_slab_free+0x6c/0x98 [ 30.905138] kfree+0x114/0x3c8 [ 30.905764] krealloc_uaf+0x12c/0x520 [ 30.906672] kunit_try_run_case+0x14c/0x3d0 [ 30.907333] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.908106] kthread+0x24c/0x2d0 [ 30.908731] ret_from_fork+0x10/0x20 [ 30.909304] [ 30.909694] The buggy address belongs to the object at fff00000c1920800 [ 30.909694] which belongs to the cache kmalloc-256 of size 256 [ 30.911653] The buggy address is located 0 bytes inside of [ 30.911653] freed 256-byte region [fff00000c1920800, fff00000c1920900) [ 30.913069] [ 30.913422] The buggy address belongs to the physical page: [ 30.914210] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101920 [ 30.915528] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.916458] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.917331] page_type: f5(slab) [ 30.917878] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.919033] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.920074] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.920817] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.921860] head: 0bfffe0000000001 ffffc1ffc3064801 ffffffffffffffff 0000000000000000 [ 30.922690] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 30.923935] page dumped because: kasan: bad access detected [ 30.924684] [ 30.925398] Memory state around the buggy address: [ 30.926029] fff00000c1920700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.927387] fff00000c1920780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.928219] >fff00000c1920800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.929282] ^ [ 30.929794] fff00000c1920880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.931031] fff00000c1920900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.931804] ==================================================================
[ 23.412691] ================================================================== [ 23.413180] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53e/0x5e0 [ 23.413593] Read of size 1 at addr ffff8881009a4c00 by task kunit_try_catch/172 [ 23.417232] [ 23.417731] CPU: 1 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 23.418537] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.419300] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.421232] Call Trace: [ 23.422021] <TASK> [ 23.422591] dump_stack_lvl+0x73/0xb0 [ 23.423319] print_report+0xd1/0x640 [ 23.423806] ? __virt_addr_valid+0x1db/0x2d0 [ 23.424814] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.425492] kasan_report+0x102/0x140 [ 23.426774] ? krealloc_uaf+0x53e/0x5e0 [ 23.427772] ? krealloc_uaf+0x53e/0x5e0 [ 23.428187] __asan_report_load1_noabort+0x18/0x20 [ 23.429174] krealloc_uaf+0x53e/0x5e0 [ 23.430151] ? __pfx_krealloc_uaf+0x10/0x10 [ 23.431303] ? finish_task_switch.isra.0+0x153/0x700 [ 23.432454] ? __switch_to+0x5d9/0xf60 [ 23.433097] ? __schedule+0xc70/0x27e0 [ 23.433583] ? __pfx_read_tsc+0x10/0x10 [ 23.434006] ? ktime_get_ts64+0x86/0x230 [ 23.434686] kunit_try_run_case+0x1b3/0x490 [ 23.436272] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.437039] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 23.437683] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.438387] ? __kthread_parkme+0x82/0x160 [ 23.438916] ? preempt_count_sub+0x50/0x80 [ 23.439523] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.440317] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.441076] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.441984] kthread+0x257/0x310 [ 23.443441] ? __pfx_kthread+0x10/0x10 [ 23.444352] ret_from_fork+0x41/0x80 [ 23.444687] ? __pfx_kthread+0x10/0x10 [ 23.445515] ret_from_fork_asm+0x1a/0x30 [ 23.446219] </TASK> [ 23.446519] [ 23.447575] Allocated by task 172: [ 23.448162] kasan_save_stack+0x3d/0x60 [ 23.449102] kasan_save_track+0x18/0x40 [ 23.449598] kasan_save_alloc_info+0x3b/0x50 [ 23.450166] __kasan_kmalloc+0xb7/0xc0 [ 23.451343] __kmalloc_cache_noprof+0x184/0x410 [ 23.451851] krealloc_uaf+0xbc/0x5e0 [ 23.452316] kunit_try_run_case+0x1b3/0x490 [ 23.453468] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.454534] kthread+0x257/0x310 [ 23.455383] ret_from_fork+0x41/0x80 [ 23.455793] ret_from_fork_asm+0x1a/0x30 [ 23.456317] [ 23.456699] Freed by task 172: [ 23.457045] kasan_save_stack+0x3d/0x60 [ 23.458300] kasan_save_track+0x18/0x40 [ 23.458777] kasan_save_free_info+0x3f/0x60 [ 23.460052] __kasan_slab_free+0x56/0x70 [ 23.461017] kfree+0x123/0x3f0 [ 23.461468] krealloc_uaf+0x13e/0x5e0 [ 23.461898] kunit_try_run_case+0x1b3/0x490 [ 23.462668] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.463722] kthread+0x257/0x310 [ 23.464847] ret_from_fork+0x41/0x80 [ 23.465559] ret_from_fork_asm+0x1a/0x30 [ 23.466152] [ 23.466777] The buggy address belongs to the object at ffff8881009a4c00 [ 23.466777] which belongs to the cache kmalloc-256 of size 256 [ 23.468814] The buggy address is located 0 bytes inside of [ 23.468814] freed 256-byte region [ffff8881009a4c00, ffff8881009a4d00) [ 23.470796] [ 23.471054] The buggy address belongs to the physical page: [ 23.471432] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1009a4 [ 23.473378] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.474343] flags: 0x200000000000040(head|node=0|zone=2) [ 23.474707] page_type: f5(slab) [ 23.475400] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 23.476395] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.477743] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 23.479167] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.480009] head: 0200000000000001 ffffea0004026901 ffffffffffffffff 0000000000000000 [ 23.480910] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 23.482111] page dumped because: kasan: bad access detected [ 23.482925] [ 23.483215] Memory state around the buggy address: [ 23.484528] ffff8881009a4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.485687] ffff8881009a4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.486711] >ffff8881009a4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.487356] ^ [ 23.488904] ffff8881009a4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.489743] ffff8881009a4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.490342] ================================================================== [ 23.335412] ================================================================== [ 23.336311] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b9/0x5e0 [ 23.337452] Read of size 1 at addr ffff8881009a4c00 by task kunit_try_catch/172 [ 23.338078] [ 23.338411] CPU: 1 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241206 #1 [ 23.340788] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.341286] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.341854] Call Trace: [ 23.342097] <TASK> [ 23.342405] dump_stack_lvl+0x73/0xb0 [ 23.342830] print_report+0xd1/0x640 [ 23.343747] ? __virt_addr_valid+0x1db/0x2d0 [ 23.344310] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.344726] kasan_report+0x102/0x140 [ 23.346134] ? krealloc_uaf+0x1b9/0x5e0 [ 23.346928] ? krealloc_uaf+0x1b9/0x5e0 [ 23.347424] ? krealloc_uaf+0x1b9/0x5e0 [ 23.347920] __kasan_check_byte+0x3d/0x50 [ 23.349234] krealloc_noprof+0x3f/0x340 [ 23.349871] krealloc_uaf+0x1b9/0x5e0 [ 23.350215] ? __pfx_krealloc_uaf+0x10/0x10 [ 23.350890] ? finish_task_switch.isra.0+0x153/0x700 [ 23.351260] ? __switch_to+0x5d9/0xf60 [ 23.352041] ? __schedule+0xc70/0x27e0 [ 23.352449] ? __pfx_read_tsc+0x10/0x10 [ 23.352855] ? ktime_get_ts64+0x86/0x230 [ 23.355254] kunit_try_run_case+0x1b3/0x490 [ 23.355953] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.356370] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 23.357127] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.358489] ? __kthread_parkme+0x82/0x160 [ 23.359456] ? preempt_count_sub+0x50/0x80 [ 23.359924] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.361260] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.361813] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.363096] kthread+0x257/0x310 [ 23.363476] ? __pfx_kthread+0x10/0x10 [ 23.363791] ret_from_fork+0x41/0x80 [ 23.364671] ? __pfx_kthread+0x10/0x10 [ 23.365523] ret_from_fork_asm+0x1a/0x30 [ 23.366080] </TASK> [ 23.366402] [ 23.366656] Allocated by task 172: [ 23.366955] kasan_save_stack+0x3d/0x60 [ 23.368325] kasan_save_track+0x18/0x40 [ 23.368807] kasan_save_alloc_info+0x3b/0x50 [ 23.369300] __kasan_kmalloc+0xb7/0xc0 [ 23.369687] __kmalloc_cache_noprof+0x184/0x410 [ 23.371561] krealloc_uaf+0xbc/0x5e0 [ 23.372986] kunit_try_run_case+0x1b3/0x490 [ 23.373459] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.374417] kthread+0x257/0x310 [ 23.375841] ret_from_fork+0x41/0x80 [ 23.376348] ret_from_fork_asm+0x1a/0x30 [ 23.376622] [ 23.376898] Freed by task 172: [ 23.378070] kasan_save_stack+0x3d/0x60 [ 23.378547] kasan_save_track+0x18/0x40 [ 23.379140] kasan_save_free_info+0x3f/0x60 [ 23.379958] __kasan_slab_free+0x56/0x70 [ 23.380366] kfree+0x123/0x3f0 [ 23.380959] krealloc_uaf+0x13e/0x5e0 [ 23.381849] kunit_try_run_case+0x1b3/0x490 [ 23.382735] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.383528] kthread+0x257/0x310 [ 23.384308] ret_from_fork+0x41/0x80 [ 23.384672] ret_from_fork_asm+0x1a/0x30 [ 23.385638] [ 23.385883] The buggy address belongs to the object at ffff8881009a4c00 [ 23.385883] which belongs to the cache kmalloc-256 of size 256 [ 23.387326] The buggy address is located 0 bytes inside of [ 23.387326] freed 256-byte region [ffff8881009a4c00, ffff8881009a4d00) [ 23.390388] [ 23.391335] The buggy address belongs to the physical page: [ 23.392020] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1009a4 [ 23.393181] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.393835] flags: 0x200000000000040(head|node=0|zone=2) [ 23.395134] page_type: f5(slab) [ 23.396516] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 23.397402] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.398604] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 23.399868] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.401314] head: 0200000000000001 ffffea0004026901 ffffffffffffffff 0000000000000000 [ 23.402965] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 23.403634] page dumped because: kasan: bad access detected [ 23.405196] [ 23.405477] Memory state around the buggy address: [ 23.405996] ffff8881009a4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.406868] ffff8881009a4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.408024] >ffff8881009a4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.409216] ^ [ 23.410065] ffff8881009a4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.410568] ffff8881009a4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.411295] ==================================================================