Date
March 19, 2025, 10:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.017497] ================================================================== [ 34.017670] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 34.017814] Read of size 1 at addr fff00000c4a4a800 by task kunit_try_catch/166 [ 34.017966] [ 34.018076] CPU: 1 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 34.018348] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.018433] Hardware name: linux,dummy-virt (DT) [ 34.018531] Call trace: [ 34.018597] show_stack+0x20/0x38 (C) [ 34.018744] dump_stack_lvl+0x8c/0xd0 [ 34.019262] print_report+0x118/0x5f0 [ 34.019456] kasan_report+0xc8/0x118 [ 34.019668] __kasan_check_byte+0x54/0x70 [ 34.019895] krealloc_noprof+0x44/0x360 [ 34.020140] krealloc_uaf+0x180/0x520 [ 34.020501] kunit_try_run_case+0x14c/0x3d0 [ 34.020901] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.021435] kthread+0x318/0x618 [ 34.022112] ret_from_fork+0x10/0x20 [ 34.022314] [ 34.022374] Allocated by task 166: [ 34.022459] kasan_save_stack+0x3c/0x68 [ 34.022579] kasan_save_track+0x20/0x40 [ 34.023005] kasan_save_alloc_info+0x40/0x58 [ 34.023170] __kasan_kmalloc+0xd4/0xd8 [ 34.023355] __kmalloc_cache_noprof+0x15c/0x3c0 [ 34.023539] krealloc_uaf+0xc8/0x520 [ 34.023711] kunit_try_run_case+0x14c/0x3d0 [ 34.023885] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.024089] kthread+0x318/0x618 [ 34.024264] ret_from_fork+0x10/0x20 [ 34.024419] [ 34.024480] Freed by task 166: [ 34.024566] kasan_save_stack+0x3c/0x68 [ 34.024678] kasan_save_track+0x20/0x40 [ 34.024786] kasan_save_free_info+0x4c/0x78 [ 34.024919] __kasan_slab_free+0x6c/0x98 [ 34.025032] kfree+0x214/0x3c8 [ 34.025514] krealloc_uaf+0x12c/0x520 [ 34.025677] kunit_try_run_case+0x14c/0x3d0 [ 34.025840] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.025989] kthread+0x318/0x618 [ 34.026429] ret_from_fork+0x10/0x20 [ 34.026642] [ 34.026745] The buggy address belongs to the object at fff00000c4a4a800 [ 34.026745] which belongs to the cache kmalloc-256 of size 256 [ 34.027014] The buggy address is located 0 bytes inside of [ 34.027014] freed 256-byte region [fff00000c4a4a800, fff00000c4a4a900) [ 34.027239] [ 34.027304] The buggy address belongs to the physical page: [ 34.027404] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104a4a [ 34.027564] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.027727] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.027933] page_type: f5(slab) [ 34.028065] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 34.028217] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.028626] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 34.028966] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.029249] head: 0bfffe0000000001 ffffc1ffc3129281 00000000ffffffff 00000000ffffffff [ 34.029515] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 34.029644] page dumped because: kasan: bad access detected [ 34.029743] [ 34.029836] Memory state around the buggy address: [ 34.029931] fff00000c4a4a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.030307] fff00000c4a4a780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.030514] >fff00000c4a4a800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.030710] ^ [ 34.030807] fff00000c4a4a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.030954] fff00000c4a4a900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.031101] ================================================================== [ 34.032255] ================================================================== [ 34.032403] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 34.032542] Read of size 1 at addr fff00000c4a4a800 by task kunit_try_catch/166 [ 34.032693] [ 34.032781] CPU: 1 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 34.033024] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.033127] Hardware name: linux,dummy-virt (DT) [ 34.033223] Call trace: [ 34.033341] show_stack+0x20/0x38 (C) [ 34.033953] dump_stack_lvl+0x8c/0xd0 [ 34.034514] print_report+0x118/0x5f0 [ 34.034702] kasan_report+0xc8/0x118 [ 34.034847] __asan_report_load1_noabort+0x20/0x30 [ 34.035023] krealloc_uaf+0x4c8/0x520 [ 34.035191] kunit_try_run_case+0x14c/0x3d0 [ 34.035437] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.035705] kthread+0x318/0x618 [ 34.035905] ret_from_fork+0x10/0x20 [ 34.036088] [ 34.036143] Allocated by task 166: [ 34.036230] kasan_save_stack+0x3c/0x68 [ 34.036394] kasan_save_track+0x20/0x40 [ 34.036581] kasan_save_alloc_info+0x40/0x58 [ 34.036736] __kasan_kmalloc+0xd4/0xd8 [ 34.037092] __kmalloc_cache_noprof+0x15c/0x3c0 [ 34.037624] krealloc_uaf+0xc8/0x520 [ 34.037911] kunit_try_run_case+0x14c/0x3d0 [ 34.038037] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.038540] kthread+0x318/0x618 [ 34.038687] ret_from_fork+0x10/0x20 [ 34.038819] [ 34.038880] Freed by task 166: [ 34.038975] kasan_save_stack+0x3c/0x68 [ 34.039129] kasan_save_track+0x20/0x40 [ 34.039290] kasan_save_free_info+0x4c/0x78 [ 34.039421] __kasan_slab_free+0x6c/0x98 [ 34.039538] kfree+0x214/0x3c8 [ 34.039645] krealloc_uaf+0x12c/0x520 [ 34.039763] kunit_try_run_case+0x14c/0x3d0 [ 34.039887] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.040029] kthread+0x318/0x618 [ 34.040163] ret_from_fork+0x10/0x20 [ 34.040288] [ 34.040342] The buggy address belongs to the object at fff00000c4a4a800 [ 34.040342] which belongs to the cache kmalloc-256 of size 256 [ 34.040549] The buggy address is located 0 bytes inside of [ 34.040549] freed 256-byte region [fff00000c4a4a800, fff00000c4a4a900) [ 34.040768] [ 34.041195] The buggy address belongs to the physical page: [ 34.041347] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104a4a [ 34.041548] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.041698] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.041860] page_type: f5(slab) [ 34.041971] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 34.042172] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.042352] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 34.042539] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.042698] head: 0bfffe0000000001 ffffc1ffc3129281 00000000ffffffff 00000000ffffffff [ 34.043087] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 34.043418] page dumped because: kasan: bad access detected [ 34.043578] [ 34.043635] Memory state around the buggy address: [ 34.043749] fff00000c4a4a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.043883] fff00000c4a4a780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.044075] >fff00000c4a4a800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.044506] ^ [ 34.044564] fff00000c4a4a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.044694] fff00000c4a4a900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.044818] ==================================================================
[ 21.564991] ================================================================== [ 21.566247] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 21.567252] Read of size 1 at addr ffff888100338200 by task kunit_try_catch/185 [ 21.568400] [ 21.568692] CPU: 0 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 21.568852] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.568890] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.568945] Call Trace: [ 21.568976] <TASK> [ 21.569013] dump_stack_lvl+0x73/0xb0 [ 21.569146] print_report+0xd1/0x660 [ 21.569239] ? __virt_addr_valid+0x1db/0x2d0 [ 21.569364] ? kasan_complete_mode_report_info+0x64/0x200 [ 21.569433] kasan_report+0x104/0x140 [ 21.569469] ? krealloc_uaf+0x1b8/0x5e0 [ 21.569504] ? krealloc_uaf+0x1b8/0x5e0 [ 21.569541] ? krealloc_uaf+0x1b8/0x5e0 [ 21.569573] __kasan_check_byte+0x3d/0x50 [ 21.569605] krealloc_noprof+0x3f/0x370 [ 21.569641] krealloc_uaf+0x1b8/0x5e0 [ 21.569672] ? __pfx_krealloc_uaf+0x10/0x10 [ 21.569820] ? finish_task_switch.isra.0+0x153/0x730 [ 21.569862] ? __switch_to+0x5d9/0xf70 [ 21.569903] ? __schedule+0xd46/0x29c0 [ 21.569934] ? __pfx_read_tsc+0x10/0x10 [ 21.569964] ? ktime_get_ts64+0x86/0x240 [ 21.570003] kunit_try_run_case+0x1b2/0x490 [ 21.570040] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.570071] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.570102] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.570160] ? __kthread_parkme+0x82/0x160 [ 21.570191] ? preempt_count_sub+0x50/0x80 [ 21.570225] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.570258] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.570291] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.570324] kthread+0x323/0x710 [ 21.570353] ? trace_preempt_on+0x20/0xc0 [ 21.570387] ? __pfx_kthread+0x10/0x10 [ 21.570418] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.570446] ? calculate_sigpending+0x7b/0xa0 [ 21.570477] ? __pfx_kthread+0x10/0x10 [ 21.570508] ret_from_fork+0x41/0x80 [ 21.570538] ? __pfx_kthread+0x10/0x10 [ 21.570569] ret_from_fork_asm+0x1a/0x30 [ 21.570616] </TASK> [ 21.570631] [ 21.590957] Allocated by task 185: [ 21.591413] kasan_save_stack+0x3d/0x60 [ 21.592073] kasan_save_track+0x18/0x40 [ 21.592375] kasan_save_alloc_info+0x3b/0x50 [ 21.593158] __kasan_kmalloc+0xb7/0xc0 [ 21.593651] __kmalloc_cache_noprof+0x183/0x410 [ 21.594443] krealloc_uaf+0xbb/0x5e0 [ 21.594840] kunit_try_run_case+0x1b2/0x490 [ 21.595451] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.596391] kthread+0x323/0x710 [ 21.596990] ret_from_fork+0x41/0x80 [ 21.597480] ret_from_fork_asm+0x1a/0x30 [ 21.598071] [ 21.598471] Freed by task 185: [ 21.599078] kasan_save_stack+0x3d/0x60 [ 21.599602] kasan_save_track+0x18/0x40 [ 21.600312] kasan_save_free_info+0x3f/0x60 [ 21.601065] __kasan_slab_free+0x56/0x70 [ 21.601500] kfree+0x222/0x3f0 [ 21.601761] krealloc_uaf+0x13d/0x5e0 [ 21.602222] kunit_try_run_case+0x1b2/0x490 [ 21.602735] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.603475] kthread+0x323/0x710 [ 21.604161] ret_from_fork+0x41/0x80 [ 21.604621] ret_from_fork_asm+0x1a/0x30 [ 21.605408] [ 21.605850] The buggy address belongs to the object at ffff888100338200 [ 21.605850] which belongs to the cache kmalloc-256 of size 256 [ 21.607304] The buggy address is located 0 bytes inside of [ 21.607304] freed 256-byte region [ffff888100338200, ffff888100338300) [ 21.608519] [ 21.609022] The buggy address belongs to the physical page: [ 21.609536] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100338 [ 21.610549] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.611281] flags: 0x200000000000040(head|node=0|zone=2) [ 21.611684] page_type: f5(slab) [ 21.611968] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.612672] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.613828] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.614504] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.615415] head: 0200000000000001 ffffea000400ce01 00000000ffffffff 00000000ffffffff [ 21.616050] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.617041] page dumped because: kasan: bad access detected [ 21.617570] [ 21.618069] Memory state around the buggy address: [ 21.618560] ffff888100338100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.619480] ffff888100338180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.620252] >ffff888100338200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.621204] ^ [ 21.621518] ffff888100338280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.622451] ffff888100338300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.623317] ================================================================== [ 21.626398] ================================================================== [ 21.627489] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 21.628416] Read of size 1 at addr ffff888100338200 by task kunit_try_catch/185 [ 21.629010] [ 21.629248] CPU: 0 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 21.630099] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.630183] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.630233] Call Trace: [ 21.630264] <TASK> [ 21.630295] dump_stack_lvl+0x73/0xb0 [ 21.630456] print_report+0xd1/0x660 [ 21.630610] ? __virt_addr_valid+0x1db/0x2d0 [ 21.630775] ? kasan_complete_mode_report_info+0x64/0x200 [ 21.630858] kasan_report+0x104/0x140 [ 21.631055] ? krealloc_uaf+0x53c/0x5e0 [ 21.631145] ? krealloc_uaf+0x53c/0x5e0 [ 21.631189] __asan_report_load1_noabort+0x18/0x20 [ 21.631222] krealloc_uaf+0x53c/0x5e0 [ 21.631254] ? __pfx_krealloc_uaf+0x10/0x10 [ 21.631284] ? finish_task_switch.isra.0+0x153/0x730 [ 21.631318] ? __switch_to+0x5d9/0xf70 [ 21.631355] ? __schedule+0xd46/0x29c0 [ 21.631385] ? __pfx_read_tsc+0x10/0x10 [ 21.631414] ? ktime_get_ts64+0x86/0x240 [ 21.631451] kunit_try_run_case+0x1b2/0x490 [ 21.631498] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.631530] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.631585] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.631671] ? __kthread_parkme+0x82/0x160 [ 21.631785] ? preempt_count_sub+0x50/0x80 [ 21.631874] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.631914] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.631961] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.631994] kthread+0x323/0x710 [ 21.632023] ? trace_preempt_on+0x20/0xc0 [ 21.632057] ? __pfx_kthread+0x10/0x10 [ 21.632088] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.632141] ? calculate_sigpending+0x7b/0xa0 [ 21.632173] ? __pfx_kthread+0x10/0x10 [ 21.632205] ret_from_fork+0x41/0x80 [ 21.632236] ? __pfx_kthread+0x10/0x10 [ 21.632266] ret_from_fork_asm+0x1a/0x30 [ 21.632313] </TASK> [ 21.632329] [ 21.650551] Allocated by task 185: [ 21.651187] kasan_save_stack+0x3d/0x60 [ 21.652261] kasan_save_track+0x18/0x40 [ 21.652857] kasan_save_alloc_info+0x3b/0x50 [ 21.653548] __kasan_kmalloc+0xb7/0xc0 [ 21.654091] __kmalloc_cache_noprof+0x183/0x410 [ 21.654485] krealloc_uaf+0xbb/0x5e0 [ 21.654856] kunit_try_run_case+0x1b2/0x490 [ 21.655468] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.656350] kthread+0x323/0x710 [ 21.656652] ret_from_fork+0x41/0x80 [ 21.657563] ret_from_fork_asm+0x1a/0x30 [ 21.658257] [ 21.658502] Freed by task 185: [ 21.658835] kasan_save_stack+0x3d/0x60 [ 21.659132] kasan_save_track+0x18/0x40 [ 21.659739] kasan_save_free_info+0x3f/0x60 [ 21.660422] __kasan_slab_free+0x56/0x70 [ 21.660832] kfree+0x222/0x3f0 [ 21.661521] krealloc_uaf+0x13d/0x5e0 [ 21.661814] kunit_try_run_case+0x1b2/0x490 [ 21.662865] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.663257] kthread+0x323/0x710 [ 21.663666] ret_from_fork+0x41/0x80 [ 21.664375] ret_from_fork_asm+0x1a/0x30 [ 21.665073] [ 21.665402] The buggy address belongs to the object at ffff888100338200 [ 21.665402] which belongs to the cache kmalloc-256 of size 256 [ 21.666249] The buggy address is located 0 bytes inside of [ 21.666249] freed 256-byte region [ffff888100338200, ffff888100338300) [ 21.668080] [ 21.668338] The buggy address belongs to the physical page: [ 21.669019] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100338 [ 21.669535] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.670475] flags: 0x200000000000040(head|node=0|zone=2) [ 21.671471] page_type: f5(slab) [ 21.672103] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.672621] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.673438] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.674030] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.674822] head: 0200000000000001 ffffea000400ce01 00000000ffffffff 00000000ffffffff [ 21.675954] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.676520] page dumped because: kasan: bad access detected [ 21.676902] [ 21.677057] Memory state around the buggy address: [ 21.677605] ffff888100338100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.678851] ffff888100338180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.679422] >ffff888100338200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.680206] ^ [ 21.680548] ffff888100338280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.680932] ffff888100338300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.681738] ==================================================================