Date
June 16, 2025, 7:07 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.127877] ================================================================== [ 19.128135] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 19.128401] Read of size 1 at addr fff00000c604d400 by task kunit_try_catch/173 [ 19.128553] [ 19.128646] CPU: 0 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT [ 19.128929] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.129006] Hardware name: linux,dummy-virt (DT) [ 19.129286] Call trace: [ 19.129444] show_stack+0x20/0x38 (C) [ 19.129976] dump_stack_lvl+0x8c/0xd0 [ 19.130113] print_report+0x118/0x608 [ 19.130320] kasan_report+0xdc/0x128 [ 19.130644] __kasan_check_byte+0x54/0x70 [ 19.130862] krealloc_noprof+0x44/0x360 [ 19.131091] krealloc_uaf+0x180/0x520 [ 19.131375] kunit_try_run_case+0x170/0x3f0 [ 19.131590] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.132173] kthread+0x328/0x630 [ 19.132483] ret_from_fork+0x10/0x20 [ 19.132612] [ 19.132826] Allocated by task 173: [ 19.132944] kasan_save_stack+0x3c/0x68 [ 19.133063] kasan_save_track+0x20/0x40 [ 19.133167] kasan_save_alloc_info+0x40/0x58 [ 19.133587] __kasan_kmalloc+0xd4/0xd8 [ 19.133816] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.134361] krealloc_uaf+0xc8/0x520 [ 19.134467] kunit_try_run_case+0x170/0x3f0 [ 19.134601] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.134745] kthread+0x328/0x630 [ 19.134830] ret_from_fork+0x10/0x20 [ 19.134937] [ 19.135049] Freed by task 173: [ 19.135168] kasan_save_stack+0x3c/0x68 [ 19.135269] kasan_save_track+0x20/0x40 [ 19.135362] kasan_save_free_info+0x4c/0x78 [ 19.135449] __kasan_slab_free+0x6c/0x98 [ 19.135532] kfree+0x214/0x3c8 [ 19.135606] krealloc_uaf+0x12c/0x520 [ 19.135690] kunit_try_run_case+0x170/0x3f0 [ 19.135791] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.135936] kthread+0x328/0x630 [ 19.136038] ret_from_fork+0x10/0x20 [ 19.136169] [ 19.136223] The buggy address belongs to the object at fff00000c604d400 [ 19.136223] which belongs to the cache kmalloc-256 of size 256 [ 19.136406] The buggy address is located 0 bytes inside of [ 19.136406] freed 256-byte region [fff00000c604d400, fff00000c604d500) [ 19.136551] [ 19.136599] The buggy address belongs to the physical page: [ 19.136682] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10604c [ 19.136856] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.136961] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.137088] page_type: f5(slab) [ 19.137184] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.137312] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.137781] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.137983] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.138125] head: 0bfffe0000000001 ffffc1ffc3181301 00000000ffffffff 00000000ffffffff [ 19.138284] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.138406] page dumped because: kasan: bad access detected [ 19.138503] [ 19.138546] Memory state around the buggy address: [ 19.138662] fff00000c604d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.138784] fff00000c604d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.139217] >fff00000c604d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.139601] ^ [ 19.139716] fff00000c604d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.139828] fff00000c604d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.140034] ================================================================== [ 19.146211] ================================================================== [ 19.146428] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 19.146565] Read of size 1 at addr fff00000c604d400 by task kunit_try_catch/173 [ 19.146695] [ 19.146789] CPU: 0 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT [ 19.147817] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.148114] Hardware name: linux,dummy-virt (DT) [ 19.148303] Call trace: [ 19.148363] show_stack+0x20/0x38 (C) [ 19.148928] dump_stack_lvl+0x8c/0xd0 [ 19.149130] print_report+0x118/0x608 [ 19.149402] kasan_report+0xdc/0x128 [ 19.149543] __asan_report_load1_noabort+0x20/0x30 [ 19.149657] krealloc_uaf+0x4c8/0x520 [ 19.149750] kunit_try_run_case+0x170/0x3f0 [ 19.149876] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.150009] kthread+0x328/0x630 [ 19.150694] ret_from_fork+0x10/0x20 [ 19.151024] [ 19.151073] Allocated by task 173: [ 19.151144] kasan_save_stack+0x3c/0x68 [ 19.151249] kasan_save_track+0x20/0x40 [ 19.151362] kasan_save_alloc_info+0x40/0x58 [ 19.151466] __kasan_kmalloc+0xd4/0xd8 [ 19.151558] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.151656] krealloc_uaf+0xc8/0x520 [ 19.151748] kunit_try_run_case+0x170/0x3f0 [ 19.151870] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.151986] kthread+0x328/0x630 [ 19.152071] ret_from_fork+0x10/0x20 [ 19.152161] [ 19.152210] Freed by task 173: [ 19.152316] kasan_save_stack+0x3c/0x68 [ 19.152416] kasan_save_track+0x20/0x40 [ 19.152501] kasan_save_free_info+0x4c/0x78 [ 19.152584] __kasan_slab_free+0x6c/0x98 [ 19.152668] kfree+0x214/0x3c8 [ 19.152770] krealloc_uaf+0x12c/0x520 [ 19.152861] kunit_try_run_case+0x170/0x3f0 [ 19.153468] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.153851] kthread+0x328/0x630 [ 19.153940] ret_from_fork+0x10/0x20 [ 19.154852] [ 19.155181] The buggy address belongs to the object at fff00000c604d400 [ 19.155181] which belongs to the cache kmalloc-256 of size 256 [ 19.155343] The buggy address is located 0 bytes inside of [ 19.155343] freed 256-byte region [fff00000c604d400, fff00000c604d500) [ 19.155500] [ 19.156296] The buggy address belongs to the physical page: [ 19.157058] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10604c [ 19.157219] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.157339] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.157471] page_type: f5(slab) [ 19.157564] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.157668] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.158071] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.158257] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.158734] head: 0bfffe0000000001 ffffc1ffc3181301 00000000ffffffff 00000000ffffffff [ 19.159175] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.159313] page dumped because: kasan: bad access detected [ 19.159475] [ 19.159524] Memory state around the buggy address: [ 19.159869] fff00000c604d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.160018] fff00000c604d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.160154] >fff00000c604d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.160392] ^ [ 19.160611] fff00000c604d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.161219] fff00000c604d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.161354] ==================================================================
[ 11.328522] ================================================================== [ 11.329498] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.329924] Read of size 1 at addr ffff888100a2a200 by task kunit_try_catch/189 [ 11.330505] [ 11.330622] CPU: 1 UID: 0 PID: 189 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT(voluntary) [ 11.330668] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.330679] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.330697] Call Trace: [ 11.330709] <TASK> [ 11.330725] dump_stack_lvl+0x73/0xb0 [ 11.330753] print_report+0xd1/0x650 [ 11.330775] ? __virt_addr_valid+0x1db/0x2d0 [ 11.330796] ? krealloc_uaf+0x1b8/0x5e0 [ 11.330815] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.330836] ? krealloc_uaf+0x1b8/0x5e0 [ 11.330856] kasan_report+0x141/0x180 [ 11.330877] ? krealloc_uaf+0x1b8/0x5e0 [ 11.330900] ? krealloc_uaf+0x1b8/0x5e0 [ 11.330920] __kasan_check_byte+0x3d/0x50 [ 11.330954] krealloc_noprof+0x3f/0x340 [ 11.330972] ? __kasan_slab_free+0x61/0x70 [ 11.330992] krealloc_uaf+0x1b8/0x5e0 [ 11.331012] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.331031] ? finish_task_switch.isra.0+0x153/0x700 [ 11.331052] ? __switch_to+0x47/0xf50 [ 11.331075] ? __schedule+0x10cc/0x2b60 [ 11.331095] ? __pfx_read_tsc+0x10/0x10 [ 11.331114] ? ktime_get_ts64+0x86/0x230 [ 11.331140] kunit_try_run_case+0x1a5/0x480 [ 11.331163] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.331184] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.331204] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.331225] ? __kthread_parkme+0x82/0x180 [ 11.331244] ? preempt_count_sub+0x50/0x80 [ 11.331265] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.331287] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.331308] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.331329] kthread+0x337/0x6f0 [ 11.331347] ? trace_preempt_on+0x20/0xc0 [ 11.331370] ? __pfx_kthread+0x10/0x10 [ 11.331389] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.331581] ? calculate_sigpending+0x7b/0xa0 [ 11.331620] ? __pfx_kthread+0x10/0x10 [ 11.331641] ret_from_fork+0x116/0x1d0 [ 11.331659] ? __pfx_kthread+0x10/0x10 [ 11.331679] ret_from_fork_asm+0x1a/0x30 [ 11.331708] </TASK> [ 11.331719] [ 11.347187] Allocated by task 189: [ 11.347325] kasan_save_stack+0x45/0x70 [ 11.348339] kasan_save_track+0x18/0x40 [ 11.349005] kasan_save_alloc_info+0x3b/0x50 [ 11.349636] __kasan_kmalloc+0xb7/0xc0 [ 11.350205] __kmalloc_cache_noprof+0x189/0x420 [ 11.350869] krealloc_uaf+0xbb/0x5e0 [ 11.351365] kunit_try_run_case+0x1a5/0x480 [ 11.351546] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.351717] kthread+0x337/0x6f0 [ 11.351830] ret_from_fork+0x116/0x1d0 [ 11.352468] ret_from_fork_asm+0x1a/0x30 [ 11.353224] [ 11.353426] Freed by task 189: [ 11.353983] kasan_save_stack+0x45/0x70 [ 11.354508] kasan_save_track+0x18/0x40 [ 11.355111] kasan_save_free_info+0x3f/0x60 [ 11.355718] __kasan_slab_free+0x56/0x70 [ 11.355871] kfree+0x222/0x3f0 [ 11.356104] krealloc_uaf+0x13d/0x5e0 [ 11.356508] kunit_try_run_case+0x1a5/0x480 [ 11.356894] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.357279] kthread+0x337/0x6f0 [ 11.357463] ret_from_fork+0x116/0x1d0 [ 11.357878] ret_from_fork_asm+0x1a/0x30 [ 11.358242] [ 11.358314] The buggy address belongs to the object at ffff888100a2a200 [ 11.358314] which belongs to the cache kmalloc-256 of size 256 [ 11.359288] The buggy address is located 0 bytes inside of [ 11.359288] freed 256-byte region [ffff888100a2a200, ffff888100a2a300) [ 11.360448] [ 11.360675] The buggy address belongs to the physical page: [ 11.360990] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a2a [ 11.361232] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.361708] flags: 0x200000000000040(head|node=0|zone=2) [ 11.362179] page_type: f5(slab) [ 11.362538] raw: 0200000000000040 ffff888100041b40 ffffea0004028c00 dead000000000002 [ 11.363176] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.364007] head: 0200000000000040 ffff888100041b40 ffffea0004028c00 dead000000000002 [ 11.364555] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.365100] head: 0200000000000001 ffffea0004028a81 00000000ffffffff 00000000ffffffff [ 11.365323] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.366035] page dumped because: kasan: bad access detected [ 11.366583] [ 11.366742] Memory state around the buggy address: [ 11.367166] ffff888100a2a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.367688] ffff888100a2a180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.367905] >ffff888100a2a200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.368124] ^ [ 11.368237] ffff888100a2a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.368663] ffff888100a2a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.369277] ================================================================== [ 11.370249] ================================================================== [ 11.370947] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.371694] Read of size 1 at addr ffff888100a2a200 by task kunit_try_catch/189 [ 11.372312] [ 11.372511] CPU: 1 UID: 0 PID: 189 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT(voluntary) [ 11.372559] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.372569] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.372589] Call Trace: [ 11.372609] <TASK> [ 11.372628] dump_stack_lvl+0x73/0xb0 [ 11.372659] print_report+0xd1/0x650 [ 11.372682] ? __virt_addr_valid+0x1db/0x2d0 [ 11.372703] ? krealloc_uaf+0x53c/0x5e0 [ 11.372723] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.372744] ? krealloc_uaf+0x53c/0x5e0 [ 11.372764] kasan_report+0x141/0x180 [ 11.372784] ? krealloc_uaf+0x53c/0x5e0 [ 11.372822] __asan_report_load1_noabort+0x18/0x20 [ 11.372845] krealloc_uaf+0x53c/0x5e0 [ 11.372866] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.372885] ? finish_task_switch.isra.0+0x153/0x700 [ 11.372906] ? __switch_to+0x47/0xf50 [ 11.372941] ? __schedule+0x10cc/0x2b60 [ 11.372964] ? __pfx_read_tsc+0x10/0x10 [ 11.372984] ? ktime_get_ts64+0x86/0x230 [ 11.373009] kunit_try_run_case+0x1a5/0x480 [ 11.373032] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.373053] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.373074] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.373097] ? __kthread_parkme+0x82/0x180 [ 11.373116] ? preempt_count_sub+0x50/0x80 [ 11.373137] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.373159] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.373182] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.373203] kthread+0x337/0x6f0 [ 11.373221] ? trace_preempt_on+0x20/0xc0 [ 11.373244] ? __pfx_kthread+0x10/0x10 [ 11.373263] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.373282] ? calculate_sigpending+0x7b/0xa0 [ 11.373305] ? __pfx_kthread+0x10/0x10 [ 11.373325] ret_from_fork+0x116/0x1d0 [ 11.373342] ? __pfx_kthread+0x10/0x10 [ 11.373362] ret_from_fork_asm+0x1a/0x30 [ 11.373414] </TASK> [ 11.373425] [ 11.385098] Allocated by task 189: [ 11.385230] kasan_save_stack+0x45/0x70 [ 11.385372] kasan_save_track+0x18/0x40 [ 11.385817] kasan_save_alloc_info+0x3b/0x50 [ 11.386192] __kasan_kmalloc+0xb7/0xc0 [ 11.386583] __kmalloc_cache_noprof+0x189/0x420 [ 11.387007] krealloc_uaf+0xbb/0x5e0 [ 11.387331] kunit_try_run_case+0x1a5/0x480 [ 11.387856] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.388333] kthread+0x337/0x6f0 [ 11.388722] ret_from_fork+0x116/0x1d0 [ 11.389079] ret_from_fork_asm+0x1a/0x30 [ 11.389500] [ 11.389656] Freed by task 189: [ 11.389780] kasan_save_stack+0x45/0x70 [ 11.389910] kasan_save_track+0x18/0x40 [ 11.390052] kasan_save_free_info+0x3f/0x60 [ 11.390191] __kasan_slab_free+0x56/0x70 [ 11.390319] kfree+0x222/0x3f0 [ 11.390600] krealloc_uaf+0x13d/0x5e0 [ 11.390925] kunit_try_run_case+0x1a5/0x480 [ 11.391312] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.391925] kthread+0x337/0x6f0 [ 11.392234] ret_from_fork+0x116/0x1d0 [ 11.392647] ret_from_fork_asm+0x1a/0x30 [ 11.392999] [ 11.393152] The buggy address belongs to the object at ffff888100a2a200 [ 11.393152] which belongs to the cache kmalloc-256 of size 256 [ 11.394263] The buggy address is located 0 bytes inside of [ 11.394263] freed 256-byte region [ffff888100a2a200, ffff888100a2a300) [ 11.394833] [ 11.394905] The buggy address belongs to the physical page: [ 11.395084] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a2a [ 11.395323] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.396080] flags: 0x200000000000040(head|node=0|zone=2) [ 11.396607] page_type: f5(slab) [ 11.396905] raw: 0200000000000040 ffff888100041b40 ffffea0004028c00 dead000000000002 [ 11.397600] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.398316] head: 0200000000000040 ffff888100041b40 ffffea0004028c00 dead000000000002 [ 11.399029] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.399810] head: 0200000000000001 ffffea0004028a81 00000000ffffffff 00000000ffffffff [ 11.400058] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.400277] page dumped because: kasan: bad access detected [ 11.400666] [ 11.400822] Memory state around the buggy address: [ 11.401229] ffff888100a2a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.401907] ffff888100a2a180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.402586] >ffff888100a2a200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.403177] ^ [ 11.403629] ffff888100a2a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.403988] ffff888100a2a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.404192] ==================================================================