Date
May 12, 2025, 11:48 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.588984] ================================================================== [ 16.589137] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 16.589241] Read of size 1 at addr fff00000c450a600 by task kunit_try_catch/164 [ 16.589338] [ 16.589394] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250512 #1 PREEMPT [ 16.590013] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.590166] Hardware name: linux,dummy-virt (DT) [ 16.590250] Call trace: [ 16.590299] show_stack+0x20/0x38 (C) [ 16.590408] dump_stack_lvl+0x8c/0xd0 [ 16.590492] print_report+0x118/0x608 [ 16.590572] kasan_report+0xdc/0x128 [ 16.590657] __kasan_check_byte+0x54/0x70 [ 16.590753] krealloc_noprof+0x44/0x360 [ 16.590848] krealloc_uaf+0x180/0x520 [ 16.590938] kunit_try_run_case+0x170/0x3f0 [ 16.591033] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.591371] kthread+0x328/0x630 [ 16.591672] ret_from_fork+0x10/0x20 [ 16.591776] [ 16.591818] Allocated by task 164: [ 16.591882] kasan_save_stack+0x3c/0x68 [ 16.592224] kasan_save_track+0x20/0x40 [ 16.592455] kasan_save_alloc_info+0x40/0x58 [ 16.592597] __kasan_kmalloc+0xd4/0xd8 [ 16.592709] __kmalloc_cache_noprof+0x15c/0x3c0 [ 16.592782] krealloc_uaf+0xc8/0x520 [ 16.593189] kunit_try_run_case+0x170/0x3f0 [ 16.593283] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.593581] kthread+0x328/0x630 [ 16.593661] ret_from_fork+0x10/0x20 [ 16.594007] [ 16.594240] Freed by task 164: [ 16.594323] kasan_save_stack+0x3c/0x68 [ 16.594472] kasan_save_track+0x20/0x40 [ 16.594552] kasan_save_free_info+0x4c/0x78 [ 16.594822] __kasan_slab_free+0x6c/0x98 [ 16.594896] kfree+0x214/0x3c8 [ 16.594972] krealloc_uaf+0x12c/0x520 [ 16.595054] kunit_try_run_case+0x170/0x3f0 [ 16.595134] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.595591] kthread+0x328/0x630 [ 16.595687] ret_from_fork+0x10/0x20 [ 16.595833] [ 16.595874] The buggy address belongs to the object at fff00000c450a600 [ 16.595874] which belongs to the cache kmalloc-256 of size 256 [ 16.596442] The buggy address is located 0 bytes inside of [ 16.596442] freed 256-byte region [fff00000c450a600, fff00000c450a700) [ 16.596653] [ 16.596699] The buggy address belongs to the physical page: [ 16.596926] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10450a [ 16.597133] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.597232] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.597330] page_type: f5(slab) [ 16.597408] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.597513] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.598561] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.598742] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.598857] head: 0bfffe0000000001 ffffc1ffc3114281 00000000ffffffff 00000000ffffffff [ 16.598959] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.599056] page dumped because: kasan: bad access detected [ 16.599163] [ 16.599218] Memory state around the buggy address: [ 16.599285] fff00000c450a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.599373] fff00000c450a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.599453] >fff00000c450a600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.599540] ^ [ 16.599622] fff00000c450a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.599711] fff00000c450a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.599789] ================================================================== [ 16.600690] ================================================================== [ 16.600786] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 16.600925] Read of size 1 at addr fff00000c450a600 by task kunit_try_catch/164 [ 16.601028] [ 16.601115] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250512 #1 PREEMPT [ 16.601325] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.601402] Hardware name: linux,dummy-virt (DT) [ 16.601505] Call trace: [ 16.601573] show_stack+0x20/0x38 (C) [ 16.601679] dump_stack_lvl+0x8c/0xd0 [ 16.601808] print_report+0x118/0x608 [ 16.601913] kasan_report+0xdc/0x128 [ 16.602049] __asan_report_load1_noabort+0x20/0x30 [ 16.602165] krealloc_uaf+0x4c8/0x520 [ 16.602268] kunit_try_run_case+0x170/0x3f0 [ 16.602352] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.602451] kthread+0x328/0x630 [ 16.602528] ret_from_fork+0x10/0x20 [ 16.602676] [ 16.602723] Allocated by task 164: [ 16.602780] kasan_save_stack+0x3c/0x68 [ 16.602858] kasan_save_track+0x20/0x40 [ 16.602921] kasan_save_alloc_info+0x40/0x58 [ 16.602990] __kasan_kmalloc+0xd4/0xd8 [ 16.603074] __kmalloc_cache_noprof+0x15c/0x3c0 [ 16.603191] krealloc_uaf+0xc8/0x520 [ 16.603289] kunit_try_run_case+0x170/0x3f0 [ 16.603364] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.603456] kthread+0x328/0x630 [ 16.603556] ret_from_fork+0x10/0x20 [ 16.603650] [ 16.603705] Freed by task 164: [ 16.603781] kasan_save_stack+0x3c/0x68 [ 16.603872] kasan_save_track+0x20/0x40 [ 16.603941] kasan_save_free_info+0x4c/0x78 [ 16.604037] __kasan_slab_free+0x6c/0x98 [ 16.604315] kfree+0x214/0x3c8 [ 16.604394] krealloc_uaf+0x12c/0x520 [ 16.604463] kunit_try_run_case+0x170/0x3f0 [ 16.604536] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.604622] kthread+0x328/0x630 [ 16.604784] ret_from_fork+0x10/0x20 [ 16.604846] [ 16.604885] The buggy address belongs to the object at fff00000c450a600 [ 16.604885] which belongs to the cache kmalloc-256 of size 256 [ 16.605009] The buggy address is located 0 bytes inside of [ 16.605009] freed 256-byte region [fff00000c450a600, fff00000c450a700) [ 16.605184] [ 16.605225] The buggy address belongs to the physical page: [ 16.605291] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10450a [ 16.605419] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.605542] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.605675] page_type: f5(slab) [ 16.605772] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.605910] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.605969] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.606015] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.606095] head: 0bfffe0000000001 ffffc1ffc3114281 00000000ffffffff 00000000ffffffff [ 16.606141] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.606178] page dumped because: kasan: bad access detected [ 16.606207] [ 16.606225] Memory state around the buggy address: [ 16.606254] fff00000c450a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.606293] fff00000c450a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.606332] >fff00000c450a600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.606365] ^ [ 16.606391] fff00000c450a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.606429] fff00000c450a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.606463] ==================================================================
[ 16.521481] ================================================================== [ 16.521919] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 16.522461] Read of size 1 at addr ffff888100a36000 by task kunit_try_catch/181 [ 16.522933] [ 16.523252] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250512 #1 PREEMPT(voluntary) [ 16.523389] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.523417] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.523464] Call Trace: [ 16.523498] <TASK> [ 16.523536] dump_stack_lvl+0x73/0xb0 [ 16.523602] print_report+0xd1/0x650 [ 16.523649] ? __virt_addr_valid+0x1db/0x2d0 [ 16.523887] ? krealloc_uaf+0x53c/0x5e0 [ 16.523943] ? kasan_complete_mode_report_info+0x64/0x200 [ 16.524002] ? krealloc_uaf+0x53c/0x5e0 [ 16.524052] kasan_report+0x141/0x180 [ 16.524102] ? krealloc_uaf+0x53c/0x5e0 [ 16.524160] __asan_report_load1_noabort+0x18/0x20 [ 16.524183] krealloc_uaf+0x53c/0x5e0 [ 16.524207] ? __pfx_krealloc_uaf+0x10/0x10 [ 16.524230] ? finish_task_switch.isra.0+0x153/0x700 [ 16.524280] ? __switch_to+0x47/0xf50 [ 16.524330] ? __schedule+0x10cc/0x2b60 [ 16.524356] ? __pfx_read_tsc+0x10/0x10 [ 16.524379] ? ktime_get_ts64+0x86/0x230 [ 16.524405] kunit_try_run_case+0x1a5/0x480 [ 16.524434] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.524458] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.524484] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.524507] ? __kthread_parkme+0x82/0x180 [ 16.524530] ? preempt_count_sub+0x50/0x80 [ 16.524553] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.524578] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.524602] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.524626] kthread+0x337/0x6f0 [ 16.524647] ? trace_preempt_on+0x20/0xc0 [ 16.524684] ? __pfx_kthread+0x10/0x10 [ 16.524749] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.524808] ? calculate_sigpending+0x7b/0xa0 [ 16.524844] ? __pfx_kthread+0x10/0x10 [ 16.524868] ret_from_fork+0x116/0x1d0 [ 16.524890] ? __pfx_kthread+0x10/0x10 [ 16.524912] ret_from_fork_asm+0x1a/0x30 [ 16.524944] </TASK> [ 16.524958] [ 16.540650] Allocated by task 181: [ 16.541337] kasan_save_stack+0x45/0x70 [ 16.541670] kasan_save_track+0x18/0x40 [ 16.542443] kasan_save_alloc_info+0x3b/0x50 [ 16.542759] __kasan_kmalloc+0xb7/0xc0 [ 16.543168] __kmalloc_cache_noprof+0x189/0x420 [ 16.543433] krealloc_uaf+0xbb/0x5e0 [ 16.543791] kunit_try_run_case+0x1a5/0x480 [ 16.544171] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.544590] kthread+0x337/0x6f0 [ 16.545032] ret_from_fork+0x116/0x1d0 [ 16.545370] ret_from_fork_asm+0x1a/0x30 [ 16.545528] [ 16.545619] Freed by task 181: [ 16.545832] kasan_save_stack+0x45/0x70 [ 16.546865] kasan_save_track+0x18/0x40 [ 16.547491] kasan_save_free_info+0x3f/0x60 [ 16.547978] __kasan_slab_free+0x56/0x70 [ 16.548511] kfree+0x222/0x3f0 [ 16.548965] krealloc_uaf+0x13d/0x5e0 [ 16.549242] kunit_try_run_case+0x1a5/0x480 [ 16.549793] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.550538] kthread+0x337/0x6f0 [ 16.550876] ret_from_fork+0x116/0x1d0 [ 16.551208] ret_from_fork_asm+0x1a/0x30 [ 16.551592] [ 16.551941] The buggy address belongs to the object at ffff888100a36000 [ 16.551941] which belongs to the cache kmalloc-256 of size 256 [ 16.553093] The buggy address is located 0 bytes inside of [ 16.553093] freed 256-byte region [ffff888100a36000, ffff888100a36100) [ 16.553967] [ 16.554595] The buggy address belongs to the physical page: [ 16.554861] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a36 [ 16.555507] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.556215] flags: 0x200000000000040(head|node=0|zone=2) [ 16.556623] page_type: f5(slab) [ 16.556979] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.557533] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.558024] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.558623] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.559541] head: 0200000000000001 ffffea0004028d81 00000000ffffffff 00000000ffffffff [ 16.559949] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.560604] page dumped because: kasan: bad access detected [ 16.561157] [ 16.561313] Memory state around the buggy address: [ 16.561647] ffff888100a35f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.562300] ffff888100a35f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.562922] >ffff888100a36000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.563392] ^ [ 16.563686] ffff888100a36080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.564070] ffff888100a36100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.564960] ================================================================== [ 16.477449] ================================================================== [ 16.478160] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 16.478893] Read of size 1 at addr ffff888100a36000 by task kunit_try_catch/181 [ 16.479879] [ 16.480269] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250512 #1 PREEMPT(voluntary) [ 16.480383] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.480408] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.480449] Call Trace: [ 16.480475] <TASK> [ 16.480508] dump_stack_lvl+0x73/0xb0 [ 16.480575] print_report+0xd1/0x650 [ 16.480616] ? __virt_addr_valid+0x1db/0x2d0 [ 16.480658] ? krealloc_uaf+0x1b8/0x5e0 [ 16.480696] ? kasan_complete_mode_report_info+0x64/0x200 [ 16.480741] ? krealloc_uaf+0x1b8/0x5e0 [ 16.480785] kasan_report+0x141/0x180 [ 16.480860] ? krealloc_uaf+0x1b8/0x5e0 [ 16.480890] ? krealloc_uaf+0x1b8/0x5e0 [ 16.480914] __kasan_check_byte+0x3d/0x50 [ 16.480938] krealloc_noprof+0x3f/0x340 [ 16.480964] krealloc_uaf+0x1b8/0x5e0 [ 16.481000] ? __pfx_krealloc_uaf+0x10/0x10 [ 16.481035] ? finish_task_switch.isra.0+0x153/0x700 [ 16.481182] ? __switch_to+0x47/0xf50 [ 16.481213] ? __schedule+0x10cc/0x2b60 [ 16.481237] ? __pfx_read_tsc+0x10/0x10 [ 16.481279] ? ktime_get_ts64+0x86/0x230 [ 16.481310] kunit_try_run_case+0x1a5/0x480 [ 16.481339] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.481363] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.481387] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.481411] ? __kthread_parkme+0x82/0x180 [ 16.481433] ? preempt_count_sub+0x50/0x80 [ 16.481456] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.481481] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.481504] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.481529] kthread+0x337/0x6f0 [ 16.481549] ? trace_preempt_on+0x20/0xc0 [ 16.481575] ? __pfx_kthread+0x10/0x10 [ 16.481597] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.481618] ? calculate_sigpending+0x7b/0xa0 [ 16.481644] ? __pfx_kthread+0x10/0x10 [ 16.481676] ret_from_fork+0x116/0x1d0 [ 16.481715] ? __pfx_kthread+0x10/0x10 [ 16.481738] ret_from_fork_asm+0x1a/0x30 [ 16.481770] </TASK> [ 16.481785] [ 16.495088] Allocated by task 181: [ 16.495604] kasan_save_stack+0x45/0x70 [ 16.495977] kasan_save_track+0x18/0x40 [ 16.496915] kasan_save_alloc_info+0x3b/0x50 [ 16.497426] __kasan_kmalloc+0xb7/0xc0 [ 16.497805] __kmalloc_cache_noprof+0x189/0x420 [ 16.498314] krealloc_uaf+0xbb/0x5e0 [ 16.498657] kunit_try_run_case+0x1a5/0x480 [ 16.499015] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.499334] kthread+0x337/0x6f0 [ 16.499520] ret_from_fork+0x116/0x1d0 [ 16.499825] ret_from_fork_asm+0x1a/0x30 [ 16.500182] [ 16.500589] Freed by task 181: [ 16.500966] kasan_save_stack+0x45/0x70 [ 16.501384] kasan_save_track+0x18/0x40 [ 16.501758] kasan_save_free_info+0x3f/0x60 [ 16.502662] __kasan_slab_free+0x56/0x70 [ 16.502888] kfree+0x222/0x3f0 [ 16.503314] krealloc_uaf+0x13d/0x5e0 [ 16.503658] kunit_try_run_case+0x1a5/0x480 [ 16.503995] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.504386] kthread+0x337/0x6f0 [ 16.504704] ret_from_fork+0x116/0x1d0 [ 16.505162] ret_from_fork_asm+0x1a/0x30 [ 16.505583] [ 16.505799] The buggy address belongs to the object at ffff888100a36000 [ 16.505799] which belongs to the cache kmalloc-256 of size 256 [ 16.506556] The buggy address is located 0 bytes inside of [ 16.506556] freed 256-byte region [ffff888100a36000, ffff888100a36100) [ 16.507675] [ 16.507823] The buggy address belongs to the physical page: [ 16.508739] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a36 [ 16.509552] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.510225] flags: 0x200000000000040(head|node=0|zone=2) [ 16.510630] page_type: f5(slab) [ 16.510921] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.511352] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.511897] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.512424] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.513107] head: 0200000000000001 ffffea0004028d81 00000000ffffffff 00000000ffffffff [ 16.513449] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.514110] page dumped because: kasan: bad access detected [ 16.515285] [ 16.515589] Memory state around the buggy address: [ 16.516093] ffff888100a35f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.516835] ffff888100a35f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.517491] >ffff888100a36000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.517919] ^ [ 16.518169] ffff888100a36080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.518668] ffff888100a36100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.519151] ==================================================================