Date
June 5, 2025, 7:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 25.087213] ================================================================== [ 25.087324] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 25.087507] Read of size 1 at addr fff00000c4657200 by task kunit_try_catch/164 [ 25.087643] [ 25.087718] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250605 #1 PREEMPT [ 25.088033] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.088153] Hardware name: linux,dummy-virt (DT) [ 25.088314] Call trace: [ 25.088391] show_stack+0x20/0x38 (C) [ 25.088539] dump_stack_lvl+0x8c/0xd0 [ 25.088754] print_report+0x118/0x608 [ 25.088966] kasan_report+0xdc/0x128 [ 25.089100] __asan_report_load1_noabort+0x20/0x30 [ 25.089295] krealloc_uaf+0x4c8/0x520 [ 25.089439] kunit_try_run_case+0x170/0x3f0 [ 25.089605] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.089691] kthread+0x328/0x630 [ 25.089744] ret_from_fork+0x10/0x20 [ 25.089803] [ 25.089825] Allocated by task 164: [ 25.089860] kasan_save_stack+0x3c/0x68 [ 25.089911] kasan_save_track+0x20/0x40 [ 25.089957] kasan_save_alloc_info+0x40/0x58 [ 25.090006] __kasan_kmalloc+0xd4/0xd8 [ 25.090051] __kmalloc_cache_noprof+0x16c/0x3c0 [ 25.090101] krealloc_uaf+0xc8/0x520 [ 25.090145] kunit_try_run_case+0x170/0x3f0 [ 25.090192] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.090246] kthread+0x328/0x630 [ 25.090284] ret_from_fork+0x10/0x20 [ 25.090351] [ 25.090400] Freed by task 164: [ 25.090466] kasan_save_stack+0x3c/0x68 [ 25.090630] kasan_save_track+0x20/0x40 [ 25.090765] kasan_save_free_info+0x4c/0x78 [ 25.090866] __kasan_slab_free+0x6c/0x98 [ 25.091584] kfree+0x214/0x3c8 [ 25.092106] krealloc_uaf+0x12c/0x520 [ 25.092220] kunit_try_run_case+0x170/0x3f0 [ 25.092584] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.092699] kthread+0x328/0x630 [ 25.093025] ret_from_fork+0x10/0x20 [ 25.093436] [ 25.093487] The buggy address belongs to the object at fff00000c4657200 [ 25.093487] which belongs to the cache kmalloc-256 of size 256 [ 25.093628] The buggy address is located 0 bytes inside of [ 25.093628] freed 256-byte region [fff00000c4657200, fff00000c4657300) [ 25.094403] [ 25.094540] The buggy address belongs to the physical page: [ 25.094886] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104656 [ 25.095013] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.095545] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.096199] page_type: f5(slab) [ 25.096471] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.096596] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.096723] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.096845] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.097610] head: 0bfffe0000000001 ffffc1ffc3119581 00000000ffffffff 00000000ffffffff [ 25.097955] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.098233] page dumped because: kasan: bad access detected [ 25.098696] [ 25.098930] Memory state around the buggy address: [ 25.099068] fff00000c4657100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.099513] fff00000c4657180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.099991] >fff00000c4657200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.100088] ^ [ 25.100372] fff00000c4657280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.100761] fff00000c4657300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.101119] ================================================================== [ 25.065627] ================================================================== [ 25.067799] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 25.067971] Read of size 1 at addr fff00000c4657200 by task kunit_try_catch/164 [ 25.068105] [ 25.068189] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250605 #1 PREEMPT [ 25.068412] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.068481] Hardware name: linux,dummy-virt (DT) [ 25.068563] Call trace: [ 25.068614] show_stack+0x20/0x38 (C) [ 25.068817] dump_stack_lvl+0x8c/0xd0 [ 25.068938] print_report+0x118/0x608 [ 25.069041] kasan_report+0xdc/0x128 [ 25.069147] __kasan_check_byte+0x54/0x70 [ 25.069261] krealloc_noprof+0x44/0x360 [ 25.069411] krealloc_uaf+0x180/0x520 [ 25.069517] kunit_try_run_case+0x170/0x3f0 [ 25.069626] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.069750] kthread+0x328/0x630 [ 25.069852] ret_from_fork+0x10/0x20 [ 25.069958] [ 25.069999] Allocated by task 164: [ 25.070067] kasan_save_stack+0x3c/0x68 [ 25.070754] kasan_save_track+0x20/0x40 [ 25.070897] kasan_save_alloc_info+0x40/0x58 [ 25.071077] __kasan_kmalloc+0xd4/0xd8 [ 25.071709] __kmalloc_cache_noprof+0x16c/0x3c0 [ 25.071818] krealloc_uaf+0xc8/0x520 [ 25.071911] kunit_try_run_case+0x170/0x3f0 [ 25.072211] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.072497] kthread+0x328/0x630 [ 25.073001] ret_from_fork+0x10/0x20 [ 25.073446] [ 25.073714] Freed by task 164: [ 25.073805] kasan_save_stack+0x3c/0x68 [ 25.073907] kasan_save_track+0x20/0x40 [ 25.074000] kasan_save_free_info+0x4c/0x78 [ 25.074094] __kasan_slab_free+0x6c/0x98 [ 25.074183] kfree+0x214/0x3c8 [ 25.075227] krealloc_uaf+0x12c/0x520 [ 25.075363] kunit_try_run_case+0x170/0x3f0 [ 25.075921] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.076010] kthread+0x328/0x630 [ 25.076083] ret_from_fork+0x10/0x20 [ 25.076189] [ 25.076232] The buggy address belongs to the object at fff00000c4657200 [ 25.076232] which belongs to the cache kmalloc-256 of size 256 [ 25.078227] The buggy address is located 0 bytes inside of [ 25.078227] freed 256-byte region [fff00000c4657200, fff00000c4657300) [ 25.078322] [ 25.078391] The buggy address belongs to the physical page: [ 25.078476] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104656 [ 25.078894] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.079045] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.079204] page_type: f5(slab) [ 25.079310] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.079658] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.079855] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.079991] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.080174] head: 0bfffe0000000001 ffffc1ffc3119581 00000000ffffffff 00000000ffffffff [ 25.080309] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.080449] page dumped because: kasan: bad access detected [ 25.080788] [ 25.080898] Memory state around the buggy address: [ 25.081349] fff00000c4657100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.081793] fff00000c4657180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.082029] >fff00000c4657200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.082154] ^ [ 25.082282] fff00000c4657280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.082582] fff00000c4657300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.083112] ==================================================================
[ 11.316477] ================================================================== [ 11.317247] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.317563] Read of size 1 at addr ffff888100a28000 by task kunit_try_catch/181 [ 11.317920] [ 11.318086] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250605 #1 PREEMPT(voluntary) [ 11.318153] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.318165] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.318185] Call Trace: [ 11.318197] <TASK> [ 11.318226] dump_stack_lvl+0x73/0xb0 [ 11.318252] print_report+0xd1/0x650 [ 11.318275] ? __virt_addr_valid+0x1db/0x2d0 [ 11.318296] ? krealloc_uaf+0x1b8/0x5e0 [ 11.318317] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.318339] ? krealloc_uaf+0x1b8/0x5e0 [ 11.318361] kasan_report+0x141/0x180 [ 11.318382] ? krealloc_uaf+0x1b8/0x5e0 [ 11.318406] ? krealloc_uaf+0x1b8/0x5e0 [ 11.318427] __kasan_check_byte+0x3d/0x50 [ 11.318449] krealloc_noprof+0x3f/0x340 [ 11.318491] krealloc_uaf+0x1b8/0x5e0 [ 11.318512] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.318532] ? finish_task_switch.isra.0+0x153/0x700 [ 11.318553] ? __switch_to+0x47/0xf50 [ 11.318577] ? __schedule+0x10cc/0x2b60 [ 11.318601] ? __pfx_read_tsc+0x10/0x10 [ 11.318620] ? ktime_get_ts64+0x86/0x230 [ 11.318661] kunit_try_run_case+0x1a5/0x480 [ 11.318681] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.318700] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.318723] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.318747] ? __kthread_parkme+0x82/0x180 [ 11.318766] ? preempt_count_sub+0x50/0x80 [ 11.318788] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.318808] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.318832] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.318856] kthread+0x337/0x6f0 [ 11.318874] ? trace_preempt_on+0x20/0xc0 [ 11.318908] ? __pfx_kthread+0x10/0x10 [ 11.318927] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.318959] ? calculate_sigpending+0x7b/0xa0 [ 11.318982] ? __pfx_kthread+0x10/0x10 [ 11.319002] ret_from_fork+0x116/0x1d0 [ 11.319020] ? __pfx_kthread+0x10/0x10 [ 11.319040] ret_from_fork_asm+0x1a/0x30 [ 11.319069] </TASK> [ 11.319078] [ 11.332278] Allocated by task 181: [ 11.332601] kasan_save_stack+0x45/0x70 [ 11.333118] kasan_save_track+0x18/0x40 [ 11.333564] kasan_save_alloc_info+0x3b/0x50 [ 11.334137] __kasan_kmalloc+0xb7/0xc0 [ 11.334412] __kmalloc_cache_noprof+0x189/0x420 [ 11.334935] krealloc_uaf+0xbb/0x5e0 [ 11.335393] kunit_try_run_case+0x1a5/0x480 [ 11.335542] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.336084] kthread+0x337/0x6f0 [ 11.336496] ret_from_fork+0x116/0x1d0 [ 11.336995] ret_from_fork_asm+0x1a/0x30 [ 11.337436] [ 11.337743] Freed by task 181: [ 11.338127] kasan_save_stack+0x45/0x70 [ 11.338286] kasan_save_track+0x18/0x40 [ 11.338425] kasan_save_free_info+0x3f/0x60 [ 11.338571] __kasan_slab_free+0x56/0x70 [ 11.338757] kfree+0x222/0x3f0 [ 11.338876] krealloc_uaf+0x13d/0x5e0 [ 11.339171] kunit_try_run_case+0x1a5/0x480 [ 11.339775] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.340243] kthread+0x337/0x6f0 [ 11.340550] ret_from_fork+0x116/0x1d0 [ 11.340917] ret_from_fork_asm+0x1a/0x30 [ 11.341198] [ 11.341312] The buggy address belongs to the object at ffff888100a28000 [ 11.341312] which belongs to the cache kmalloc-256 of size 256 [ 11.342277] The buggy address is located 0 bytes inside of [ 11.342277] freed 256-byte region [ffff888100a28000, ffff888100a28100) [ 11.342854] [ 11.343103] The buggy address belongs to the physical page: [ 11.343425] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a28 [ 11.343927] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.344218] flags: 0x200000000000040(head|node=0|zone=2) [ 11.344470] page_type: f5(slab) [ 11.344625] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.345283] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.345730] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.346222] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.346661] head: 0200000000000001 ffffea0004028a01 00000000ffffffff 00000000ffffffff [ 11.347219] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.347616] page dumped because: kasan: bad access detected [ 11.348160] [ 11.348247] Memory state around the buggy address: [ 11.348465] ffff888100a27f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.348778] ffff888100a27f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.349122] >ffff888100a28000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.349444] ^ [ 11.349567] ffff888100a28080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.349987] ffff888100a28100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.350584] ================================================================== [ 11.351712] ================================================================== [ 11.351970] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.352759] Read of size 1 at addr ffff888100a28000 by task kunit_try_catch/181 [ 11.353312] [ 11.353526] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250605 #1 PREEMPT(voluntary) [ 11.353571] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.353583] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.353603] Call Trace: [ 11.353615] <TASK> [ 11.353629] dump_stack_lvl+0x73/0xb0 [ 11.353656] print_report+0xd1/0x650 [ 11.353678] ? __virt_addr_valid+0x1db/0x2d0 [ 11.353700] ? krealloc_uaf+0x53c/0x5e0 [ 11.353721] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.353837] ? krealloc_uaf+0x53c/0x5e0 [ 11.353861] kasan_report+0x141/0x180 [ 11.353883] ? krealloc_uaf+0x53c/0x5e0 [ 11.353920] __asan_report_load1_noabort+0x18/0x20 [ 11.353957] krealloc_uaf+0x53c/0x5e0 [ 11.353978] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.353999] ? finish_task_switch.isra.0+0x153/0x700 [ 11.354020] ? __switch_to+0x47/0xf50 [ 11.354045] ? __schedule+0x10cc/0x2b60 [ 11.354068] ? __pfx_read_tsc+0x10/0x10 [ 11.354087] ? ktime_get_ts64+0x86/0x230 [ 11.354111] kunit_try_run_case+0x1a5/0x480 [ 11.354131] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.354150] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.354173] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.354197] ? __kthread_parkme+0x82/0x180 [ 11.354216] ? preempt_count_sub+0x50/0x80 [ 11.354238] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.354259] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.354282] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.354305] kthread+0x337/0x6f0 [ 11.354324] ? trace_preempt_on+0x20/0xc0 [ 11.354345] ? __pfx_kthread+0x10/0x10 [ 11.354364] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.354386] ? calculate_sigpending+0x7b/0xa0 [ 11.354409] ? __pfx_kthread+0x10/0x10 [ 11.354429] ret_from_fork+0x116/0x1d0 [ 11.354447] ? __pfx_kthread+0x10/0x10 [ 11.354466] ret_from_fork_asm+0x1a/0x30 [ 11.354495] </TASK> [ 11.354505] [ 11.365405] Allocated by task 181: [ 11.365571] kasan_save_stack+0x45/0x70 [ 11.365738] kasan_save_track+0x18/0x40 [ 11.366249] kasan_save_alloc_info+0x3b/0x50 [ 11.366433] __kasan_kmalloc+0xb7/0xc0 [ 11.366935] __kmalloc_cache_noprof+0x189/0x420 [ 11.367492] krealloc_uaf+0xbb/0x5e0 [ 11.367784] kunit_try_run_case+0x1a5/0x480 [ 11.368124] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.368384] kthread+0x337/0x6f0 [ 11.368546] ret_from_fork+0x116/0x1d0 [ 11.369055] ret_from_fork_asm+0x1a/0x30 [ 11.369251] [ 11.369325] Freed by task 181: [ 11.369612] kasan_save_stack+0x45/0x70 [ 11.369768] kasan_save_track+0x18/0x40 [ 11.370157] kasan_save_free_info+0x3f/0x60 [ 11.370457] __kasan_slab_free+0x56/0x70 [ 11.370759] kfree+0x222/0x3f0 [ 11.370914] krealloc_uaf+0x13d/0x5e0 [ 11.371297] kunit_try_run_case+0x1a5/0x480 [ 11.371588] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.372171] kthread+0x337/0x6f0 [ 11.372501] ret_from_fork+0x116/0x1d0 [ 11.372674] ret_from_fork_asm+0x1a/0x30 [ 11.373051] [ 11.373136] The buggy address belongs to the object at ffff888100a28000 [ 11.373136] which belongs to the cache kmalloc-256 of size 256 [ 11.373662] The buggy address is located 0 bytes inside of [ 11.373662] freed 256-byte region [ffff888100a28000, ffff888100a28100) [ 11.374423] [ 11.374530] The buggy address belongs to the physical page: [ 11.375099] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a28 [ 11.375524] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.375888] flags: 0x200000000000040(head|node=0|zone=2) [ 11.376275] page_type: f5(slab) [ 11.376445] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.376932] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.377439] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.377784] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.378099] head: 0200000000000001 ffffea0004028a01 00000000ffffffff 00000000ffffffff [ 11.378451] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.378742] page dumped because: kasan: bad access detected [ 11.378997] [ 11.379136] Memory state around the buggy address: [ 11.379340] ffff888100a27f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.379618] ffff888100a27f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.379956] >ffff888100a28000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.380447] ^ [ 11.380601] ffff888100a28080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.380846] ffff888100a28100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.381399] ==================================================================