Date
May 13, 2025, 12:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.247523] ================================================================== [ 19.247602] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 19.247687] Read of size 1 at addr fff00000c5b13e00 by task kunit_try_catch/164 [ 19.247743] [ 19.247788] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250513 #1 PREEMPT [ 19.248090] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.248137] Hardware name: linux,dummy-virt (DT) [ 19.248207] Call trace: [ 19.248785] show_stack+0x20/0x38 (C) [ 19.248871] dump_stack_lvl+0x8c/0xd0 [ 19.248927] print_report+0x118/0x608 [ 19.248994] kasan_report+0xdc/0x128 [ 19.249252] __asan_report_load1_noabort+0x20/0x30 [ 19.249497] krealloc_uaf+0x4c8/0x520 [ 19.249791] kunit_try_run_case+0x170/0x3f0 [ 19.249881] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.250122] kthread+0x328/0x630 [ 19.250192] ret_from_fork+0x10/0x20 [ 19.250252] [ 19.250275] Allocated by task 164: [ 19.250473] kasan_save_stack+0x3c/0x68 [ 19.250711] kasan_save_track+0x20/0x40 [ 19.250847] kasan_save_alloc_info+0x40/0x58 [ 19.251041] __kasan_kmalloc+0xd4/0xd8 [ 19.251095] __kmalloc_cache_noprof+0x15c/0x3c0 [ 19.251247] krealloc_uaf+0xc8/0x520 [ 19.251358] kunit_try_run_case+0x170/0x3f0 [ 19.251446] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.251566] kthread+0x328/0x630 [ 19.251833] ret_from_fork+0x10/0x20 [ 19.252018] [ 19.252055] Freed by task 164: [ 19.252249] kasan_save_stack+0x3c/0x68 [ 19.252366] kasan_save_track+0x20/0x40 [ 19.252410] kasan_save_free_info+0x4c/0x78 [ 19.252481] __kasan_slab_free+0x6c/0x98 [ 19.252538] kfree+0x214/0x3c8 [ 19.252603] krealloc_uaf+0x12c/0x520 [ 19.252919] kunit_try_run_case+0x170/0x3f0 [ 19.253076] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.253132] kthread+0x328/0x630 [ 19.253195] ret_from_fork+0x10/0x20 [ 19.253245] [ 19.253270] The buggy address belongs to the object at fff00000c5b13e00 [ 19.253270] which belongs to the cache kmalloc-256 of size 256 [ 19.253484] The buggy address is located 0 bytes inside of [ 19.253484] freed 256-byte region [fff00000c5b13e00, fff00000c5b13f00) [ 19.253695] [ 19.253741] The buggy address belongs to the physical page: [ 19.253781] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b12 [ 19.253870] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.253926] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.254352] page_type: f5(slab) [ 19.254535] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.254658] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.255028] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.255105] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.255162] head: 0bfffe0000000001 ffffc1ffc316c481 00000000ffffffff 00000000ffffffff [ 19.255217] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.255258] page dumped because: kasan: bad access detected [ 19.255292] [ 19.255311] Memory state around the buggy address: [ 19.255348] fff00000c5b13d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.255394] fff00000c5b13d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.255438] >fff00000c5b13e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.255476] ^ [ 19.255509] fff00000c5b13e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.255553] fff00000c5b13f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.255593] ================================================================== [ 19.237328] ================================================================== [ 19.237693] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 19.237798] Read of size 1 at addr fff00000c5b13e00 by task kunit_try_catch/164 [ 19.237877] [ 19.237927] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250513 #1 PREEMPT [ 19.238043] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.238077] Hardware name: linux,dummy-virt (DT) [ 19.238114] Call trace: [ 19.238654] show_stack+0x20/0x38 (C) [ 19.238942] dump_stack_lvl+0x8c/0xd0 [ 19.239200] print_report+0x118/0x608 [ 19.239269] kasan_report+0xdc/0x128 [ 19.239462] __kasan_check_byte+0x54/0x70 [ 19.239519] krealloc_noprof+0x44/0x360 [ 19.240022] krealloc_uaf+0x180/0x520 [ 19.240130] kunit_try_run_case+0x170/0x3f0 [ 19.240341] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.240570] kthread+0x328/0x630 [ 19.240695] ret_from_fork+0x10/0x20 [ 19.240762] [ 19.240950] Allocated by task 164: [ 19.241005] kasan_save_stack+0x3c/0x68 [ 19.241062] kasan_save_track+0x20/0x40 [ 19.241453] kasan_save_alloc_info+0x40/0x58 [ 19.241631] __kasan_kmalloc+0xd4/0xd8 [ 19.241739] __kmalloc_cache_noprof+0x15c/0x3c0 [ 19.241840] krealloc_uaf+0xc8/0x520 [ 19.241898] kunit_try_run_case+0x170/0x3f0 [ 19.241945] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.242210] kthread+0x328/0x630 [ 19.242273] ret_from_fork+0x10/0x20 [ 19.242332] [ 19.242361] Freed by task 164: [ 19.242394] kasan_save_stack+0x3c/0x68 [ 19.242439] kasan_save_track+0x20/0x40 [ 19.242479] kasan_save_free_info+0x4c/0x78 [ 19.242521] __kasan_slab_free+0x6c/0x98 [ 19.242561] kfree+0x214/0x3c8 [ 19.242597] krealloc_uaf+0x12c/0x520 [ 19.242636] kunit_try_run_case+0x170/0x3f0 [ 19.242675] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.242723] kthread+0x328/0x630 [ 19.242761] ret_from_fork+0x10/0x20 [ 19.242801] [ 19.242838] The buggy address belongs to the object at fff00000c5b13e00 [ 19.242838] which belongs to the cache kmalloc-256 of size 256 [ 19.242962] The buggy address is located 0 bytes inside of [ 19.242962] freed 256-byte region [fff00000c5b13e00, fff00000c5b13f00) [ 19.243069] [ 19.243098] The buggy address belongs to the physical page: [ 19.243137] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b12 [ 19.243209] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.243263] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.243324] page_type: f5(slab) [ 19.243374] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.243429] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.243498] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.243552] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.243603] head: 0bfffe0000000001 ffffc1ffc316c481 00000000ffffffff 00000000ffffffff [ 19.243674] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.243733] page dumped because: kasan: bad access detected [ 19.243769] [ 19.243790] Memory state around the buggy address: [ 19.243827] fff00000c5b13d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.243889] fff00000c5b13d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.243936] >fff00000c5b13e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.244334] ^ [ 19.244402] fff00000c5b13e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.244453] fff00000c5b13f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.244819] ==================================================================
[ 11.042246] ================================================================== [ 11.042668] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.042963] Read of size 1 at addr ffff888100356c00 by task kunit_try_catch/181 [ 11.043354] [ 11.043450] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250513 #1 PREEMPT(voluntary) [ 11.043526] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.043539] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.043558] Call Trace: [ 11.043569] <TASK> [ 11.043583] dump_stack_lvl+0x73/0xb0 [ 11.043611] print_report+0xd1/0x650 [ 11.043644] ? __virt_addr_valid+0x1db/0x2d0 [ 11.043666] ? krealloc_uaf+0x53c/0x5e0 [ 11.043687] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.043744] ? krealloc_uaf+0x53c/0x5e0 [ 11.043766] kasan_report+0x141/0x180 [ 11.043788] ? krealloc_uaf+0x53c/0x5e0 [ 11.043815] __asan_report_load1_noabort+0x18/0x20 [ 11.043835] krealloc_uaf+0x53c/0x5e0 [ 11.043856] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.043907] ? finish_task_switch.isra.0+0x153/0x700 [ 11.043947] ? __switch_to+0x47/0xf50 [ 11.043973] ? __schedule+0x10cc/0x2b60 [ 11.043995] ? __pfx_read_tsc+0x10/0x10 [ 11.044014] ? ktime_get_ts64+0x86/0x230 [ 11.044038] kunit_try_run_case+0x1a5/0x480 [ 11.044061] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.044083] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.044105] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.044126] ? __kthread_parkme+0x82/0x180 [ 11.044146] ? preempt_count_sub+0x50/0x80 [ 11.044168] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.044224] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.044264] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.044287] kthread+0x337/0x6f0 [ 11.044306] ? trace_preempt_on+0x20/0xc0 [ 11.044329] ? __pfx_kthread+0x10/0x10 [ 11.044349] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.044369] ? calculate_sigpending+0x7b/0xa0 [ 11.044392] ? __pfx_kthread+0x10/0x10 [ 11.044413] ret_from_fork+0x116/0x1d0 [ 11.044430] ? __pfx_kthread+0x10/0x10 [ 11.044450] ret_from_fork_asm+0x1a/0x30 [ 11.044482] </TASK> [ 11.044492] [ 11.052224] Allocated by task 181: [ 11.052411] kasan_save_stack+0x45/0x70 [ 11.052867] kasan_save_track+0x18/0x40 [ 11.053071] kasan_save_alloc_info+0x3b/0x50 [ 11.053409] __kasan_kmalloc+0xb7/0xc0 [ 11.053682] __kmalloc_cache_noprof+0x189/0x420 [ 11.053893] krealloc_uaf+0xbb/0x5e0 [ 11.054050] kunit_try_run_case+0x1a5/0x480 [ 11.054214] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.054503] kthread+0x337/0x6f0 [ 11.054750] ret_from_fork+0x116/0x1d0 [ 11.054929] ret_from_fork_asm+0x1a/0x30 [ 11.055067] [ 11.055137] Freed by task 181: [ 11.055249] kasan_save_stack+0x45/0x70 [ 11.055385] kasan_save_track+0x18/0x40 [ 11.055521] kasan_save_free_info+0x3f/0x60 [ 11.055799] __kasan_slab_free+0x56/0x70 [ 11.056024] kfree+0x222/0x3f0 [ 11.056185] krealloc_uaf+0x13d/0x5e0 [ 11.056375] kunit_try_run_case+0x1a5/0x480 [ 11.056585] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.056899] kthread+0x337/0x6f0 [ 11.057254] ret_from_fork+0x116/0x1d0 [ 11.057453] ret_from_fork_asm+0x1a/0x30 [ 11.057889] [ 11.057968] The buggy address belongs to the object at ffff888100356c00 [ 11.057968] which belongs to the cache kmalloc-256 of size 256 [ 11.058493] The buggy address is located 0 bytes inside of [ 11.058493] freed 256-byte region [ffff888100356c00, ffff888100356d00) [ 11.058850] [ 11.058925] The buggy address belongs to the physical page: [ 11.059302] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100356 [ 11.059885] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.060267] flags: 0x200000000000040(head|node=0|zone=2) [ 11.060507] page_type: f5(slab) [ 11.060706] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.060940] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.061170] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.061399] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.061639] head: 0200000000000001 ffffea000400d581 00000000ffffffff 00000000ffffffff [ 11.061984] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.062328] page dumped because: kasan: bad access detected [ 11.062589] [ 11.062692] Memory state around the buggy address: [ 11.062920] ffff888100356b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.063541] ffff888100356b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.064076] >ffff888100356c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.064511] ^ [ 11.064750] ffff888100356c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.065039] ffff888100356d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.065378] ================================================================== [ 11.017951] ================================================================== [ 11.018434] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.018849] Read of size 1 at addr ffff888100356c00 by task kunit_try_catch/181 [ 11.019117] [ 11.019228] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250513 #1 PREEMPT(voluntary) [ 11.019276] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.019288] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.019308] Call Trace: [ 11.019320] <TASK> [ 11.019335] dump_stack_lvl+0x73/0xb0 [ 11.019363] print_report+0xd1/0x650 [ 11.019386] ? __virt_addr_valid+0x1db/0x2d0 [ 11.019409] ? krealloc_uaf+0x1b8/0x5e0 [ 11.019431] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.019470] ? krealloc_uaf+0x1b8/0x5e0 [ 11.019492] kasan_report+0x141/0x180 [ 11.019514] ? krealloc_uaf+0x1b8/0x5e0 [ 11.019539] ? krealloc_uaf+0x1b8/0x5e0 [ 11.019561] __kasan_check_byte+0x3d/0x50 [ 11.019583] krealloc_noprof+0x3f/0x340 [ 11.019608] krealloc_uaf+0x1b8/0x5e0 [ 11.019642] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.019663] ? finish_task_switch.isra.0+0x153/0x700 [ 11.019685] ? __switch_to+0x47/0xf50 [ 11.019711] ? __schedule+0x10cc/0x2b60 [ 11.019733] ? __pfx_read_tsc+0x10/0x10 [ 11.019753] ? ktime_get_ts64+0x86/0x230 [ 11.019778] kunit_try_run_case+0x1a5/0x480 [ 11.019803] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.019824] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.019846] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.019868] ? __kthread_parkme+0x82/0x180 [ 11.019889] ? preempt_count_sub+0x50/0x80 [ 11.019911] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.019934] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.019956] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.019978] kthread+0x337/0x6f0 [ 11.019997] ? trace_preempt_on+0x20/0xc0 [ 11.020021] ? __pfx_kthread+0x10/0x10 [ 11.020041] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.020060] ? calculate_sigpending+0x7b/0xa0 [ 11.020084] ? __pfx_kthread+0x10/0x10 [ 11.020105] ret_from_fork+0x116/0x1d0 [ 11.020123] ? __pfx_kthread+0x10/0x10 [ 11.020143] ret_from_fork_asm+0x1a/0x30 [ 11.020174] </TASK> [ 11.020213] [ 11.028089] Allocated by task 181: [ 11.028219] kasan_save_stack+0x45/0x70 [ 11.028601] kasan_save_track+0x18/0x40 [ 11.028859] kasan_save_alloc_info+0x3b/0x50 [ 11.029066] __kasan_kmalloc+0xb7/0xc0 [ 11.029311] __kmalloc_cache_noprof+0x189/0x420 [ 11.029459] krealloc_uaf+0xbb/0x5e0 [ 11.029735] kunit_try_run_case+0x1a5/0x480 [ 11.029914] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.030198] kthread+0x337/0x6f0 [ 11.030371] ret_from_fork+0x116/0x1d0 [ 11.030603] ret_from_fork_asm+0x1a/0x30 [ 11.030758] [ 11.030827] Freed by task 181: [ 11.030935] kasan_save_stack+0x45/0x70 [ 11.031064] kasan_save_track+0x18/0x40 [ 11.031198] kasan_save_free_info+0x3f/0x60 [ 11.031462] __kasan_slab_free+0x56/0x70 [ 11.031940] kfree+0x222/0x3f0 [ 11.032104] krealloc_uaf+0x13d/0x5e0 [ 11.032285] kunit_try_run_case+0x1a5/0x480 [ 11.032585] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.032826] kthread+0x337/0x6f0 [ 11.032944] ret_from_fork+0x116/0x1d0 [ 11.033070] ret_from_fork_asm+0x1a/0x30 [ 11.033203] [ 11.033272] The buggy address belongs to the object at ffff888100356c00 [ 11.033272] which belongs to the cache kmalloc-256 of size 256 [ 11.033998] The buggy address is located 0 bytes inside of [ 11.033998] freed 256-byte region [ffff888100356c00, ffff888100356d00) [ 11.034977] [ 11.035065] The buggy address belongs to the physical page: [ 11.035347] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100356 [ 11.035865] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.036087] flags: 0x200000000000040(head|node=0|zone=2) [ 11.036256] page_type: f5(slab) [ 11.036375] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.036871] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.037427] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.037959] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.038301] head: 0200000000000001 ffffea000400d581 00000000ffffffff 00000000ffffffff [ 11.038529] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.038846] page dumped because: kasan: bad access detected [ 11.039229] [ 11.039365] Memory state around the buggy address: [ 11.039604] ffff888100356b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.039922] ffff888100356b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.040388] >ffff888100356c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.040671] ^ [ 11.040910] ffff888100356c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.041152] ffff888100356d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.041468] ==================================================================