Date
June 17, 2025, 6:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.799647] ================================================================== [ 16.799702] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 16.799756] Read of size 1 at addr fff00000c176ba00 by task kunit_try_catch/173 [ 16.799807] [ 16.800084] CPU: 1 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT [ 16.800302] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.800332] Hardware name: linux,dummy-virt (DT) [ 16.800407] Call trace: [ 16.800593] show_stack+0x20/0x38 (C) [ 16.800792] dump_stack_lvl+0x8c/0xd0 [ 16.800856] print_report+0x118/0x608 [ 16.800966] kasan_report+0xdc/0x128 [ 16.801018] __asan_report_load1_noabort+0x20/0x30 [ 16.801065] krealloc_uaf+0x4c8/0x520 [ 16.801110] kunit_try_run_case+0x170/0x3f0 [ 16.801163] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.801399] kthread+0x328/0x630 [ 16.801486] ret_from_fork+0x10/0x20 [ 16.801552] [ 16.801576] Allocated by task 173: [ 16.801741] kasan_save_stack+0x3c/0x68 [ 16.801817] kasan_save_track+0x20/0x40 [ 16.802029] kasan_save_alloc_info+0x40/0x58 [ 16.802141] __kasan_kmalloc+0xd4/0xd8 [ 16.802324] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.802492] krealloc_uaf+0xc8/0x520 [ 16.802629] kunit_try_run_case+0x170/0x3f0 [ 16.802672] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.803070] kthread+0x328/0x630 [ 16.803172] ret_from_fork+0x10/0x20 [ 16.803246] [ 16.803344] Freed by task 173: [ 16.803402] kasan_save_stack+0x3c/0x68 [ 16.803485] kasan_save_track+0x20/0x40 [ 16.803636] kasan_save_free_info+0x4c/0x78 [ 16.803828] __kasan_slab_free+0x6c/0x98 [ 16.803954] kfree+0x214/0x3c8 [ 16.804131] krealloc_uaf+0x12c/0x520 [ 16.804274] kunit_try_run_case+0x170/0x3f0 [ 16.804352] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.804413] kthread+0x328/0x630 [ 16.804445] ret_from_fork+0x10/0x20 [ 16.804698] [ 16.804859] The buggy address belongs to the object at fff00000c176ba00 [ 16.804859] which belongs to the cache kmalloc-256 of size 256 [ 16.805006] The buggy address is located 0 bytes inside of [ 16.805006] freed 256-byte region [fff00000c176ba00, fff00000c176bb00) [ 16.805097] [ 16.805216] The buggy address belongs to the physical page: [ 16.805282] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10176a [ 16.805575] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.805697] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.805778] page_type: f5(slab) [ 16.805942] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 16.806015] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.806133] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 16.806184] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.806342] head: 0bfffe0000000001 ffffc1ffc305da81 00000000ffffffff 00000000ffffffff [ 16.806439] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.806636] page dumped because: kasan: bad access detected [ 16.806745] [ 16.806944] Memory state around the buggy address: [ 16.807056] fff00000c176b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.807193] fff00000c176b980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.807259] >fff00000c176ba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.807318] ^ [ 16.807437] fff00000c176ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.807481] fff00000c176bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.807554] ================================================================== [ 16.792308] ================================================================== [ 16.792391] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 16.792450] Read of size 1 at addr fff00000c176ba00 by task kunit_try_catch/173 [ 16.792516] [ 16.792700] CPU: 1 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT [ 16.792848] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.793001] Hardware name: linux,dummy-virt (DT) [ 16.793060] Call trace: [ 16.793100] show_stack+0x20/0x38 (C) [ 16.793154] dump_stack_lvl+0x8c/0xd0 [ 16.793310] print_report+0x118/0x608 [ 16.793394] kasan_report+0xdc/0x128 [ 16.793577] __kasan_check_byte+0x54/0x70 [ 16.793643] krealloc_noprof+0x44/0x360 [ 16.793710] krealloc_uaf+0x180/0x520 [ 16.793787] kunit_try_run_case+0x170/0x3f0 [ 16.793854] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.793923] kthread+0x328/0x630 [ 16.793984] ret_from_fork+0x10/0x20 [ 16.794033] [ 16.794066] Allocated by task 173: [ 16.794096] kasan_save_stack+0x3c/0x68 [ 16.794137] kasan_save_track+0x20/0x40 [ 16.794175] kasan_save_alloc_info+0x40/0x58 [ 16.794334] __kasan_kmalloc+0xd4/0xd8 [ 16.794371] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.794484] krealloc_uaf+0xc8/0x520 [ 16.794660] kunit_try_run_case+0x170/0x3f0 [ 16.794750] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.794870] kthread+0x328/0x630 [ 16.794914] ret_from_fork+0x10/0x20 [ 16.794960] [ 16.794988] Freed by task 173: [ 16.795323] kasan_save_stack+0x3c/0x68 [ 16.795407] kasan_save_track+0x20/0x40 [ 16.795478] kasan_save_free_info+0x4c/0x78 [ 16.795579] __kasan_slab_free+0x6c/0x98 [ 16.795618] kfree+0x214/0x3c8 [ 16.795651] krealloc_uaf+0x12c/0x520 [ 16.795879] kunit_try_run_case+0x170/0x3f0 [ 16.795990] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.796036] kthread+0x328/0x630 [ 16.796069] ret_from_fork+0x10/0x20 [ 16.796158] [ 16.796425] The buggy address belongs to the object at fff00000c176ba00 [ 16.796425] which belongs to the cache kmalloc-256 of size 256 [ 16.796607] The buggy address is located 0 bytes inside of [ 16.796607] freed 256-byte region [fff00000c176ba00, fff00000c176bb00) [ 16.796682] [ 16.796702] The buggy address belongs to the physical page: [ 16.796766] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10176a [ 16.796910] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.796969] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.797135] page_type: f5(slab) [ 16.797193] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 16.797244] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.797305] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 16.797353] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.797401] head: 0bfffe0000000001 ffffc1ffc305da81 00000000ffffffff 00000000ffffffff [ 16.797448] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.797487] page dumped because: kasan: bad access detected [ 16.797527] [ 16.797545] Memory state around the buggy address: [ 16.797582] fff00000c176b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.797624] fff00000c176b980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.797666] >fff00000c176ba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.797703] ^ [ 16.797730] fff00000c176ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.797770] fff00000c176bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.797807] ==================================================================
[ 17.822005] ================================================================== [ 17.822795] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 17.823583] Read of size 1 at addr ffff888100391a00 by task kunit_try_catch/191 [ 17.825068] [ 17.825278] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT(voluntary) [ 17.825401] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.825439] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.825495] Call Trace: [ 17.825532] <TASK> [ 17.825579] dump_stack_lvl+0x73/0xb0 [ 17.825660] print_report+0xd1/0x650 [ 17.825733] ? __virt_addr_valid+0x1db/0x2d0 [ 17.825803] ? krealloc_uaf+0x53c/0x5e0 [ 17.825888] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.825958] ? krealloc_uaf+0x53c/0x5e0 [ 17.826000] kasan_report+0x141/0x180 [ 17.826043] ? krealloc_uaf+0x53c/0x5e0 [ 17.826091] __asan_report_load1_noabort+0x18/0x20 [ 17.826128] krealloc_uaf+0x53c/0x5e0 [ 17.826157] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.826185] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 17.826228] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.826306] kunit_try_run_case+0x1a5/0x480 [ 17.826372] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.826406] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.826434] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.826469] ? __kthread_parkme+0x82/0x180 [ 17.826497] ? preempt_count_sub+0x50/0x80 [ 17.826528] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.826561] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.826592] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.826623] kthread+0x337/0x6f0 [ 17.826648] ? trace_preempt_on+0x20/0xc0 [ 17.826679] ? __pfx_kthread+0x10/0x10 [ 17.826706] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.826738] ? calculate_sigpending+0x7b/0xa0 [ 17.826771] ? __pfx_kthread+0x10/0x10 [ 17.826798] ret_from_fork+0x116/0x1d0 [ 17.826822] ? __pfx_kthread+0x10/0x10 [ 17.826877] ret_from_fork_asm+0x1a/0x30 [ 17.826919] </TASK> [ 17.826932] [ 17.844260] Allocated by task 191: [ 17.844575] kasan_save_stack+0x45/0x70 [ 17.844958] kasan_save_track+0x18/0x40 [ 17.845315] kasan_save_alloc_info+0x3b/0x50 [ 17.845731] __kasan_kmalloc+0xb7/0xc0 [ 17.846386] __kmalloc_cache_noprof+0x189/0x420 [ 17.846708] krealloc_uaf+0xbb/0x5e0 [ 17.846993] kunit_try_run_case+0x1a5/0x480 [ 17.847545] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.848042] kthread+0x337/0x6f0 [ 17.848855] ret_from_fork+0x116/0x1d0 [ 17.849398] ret_from_fork_asm+0x1a/0x30 [ 17.849883] [ 17.850081] Freed by task 191: [ 17.850619] kasan_save_stack+0x45/0x70 [ 17.851092] kasan_save_track+0x18/0x40 [ 17.851668] kasan_save_free_info+0x3f/0x60 [ 17.852109] __kasan_slab_free+0x56/0x70 [ 17.852668] kfree+0x222/0x3f0 [ 17.853037] krealloc_uaf+0x13d/0x5e0 [ 17.853856] kunit_try_run_case+0x1a5/0x480 [ 17.854514] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.855053] kthread+0x337/0x6f0 [ 17.855462] ret_from_fork+0x116/0x1d0 [ 17.855858] ret_from_fork_asm+0x1a/0x30 [ 17.856529] [ 17.856735] The buggy address belongs to the object at ffff888100391a00 [ 17.856735] which belongs to the cache kmalloc-256 of size 256 [ 17.858016] The buggy address is located 0 bytes inside of [ 17.858016] freed 256-byte region [ffff888100391a00, ffff888100391b00) [ 17.859593] [ 17.859808] The buggy address belongs to the physical page: [ 17.860547] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100390 [ 17.861391] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.862021] flags: 0x200000000000040(head|node=0|zone=2) [ 17.862691] page_type: f5(slab) [ 17.863037] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.864041] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.865011] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.865975] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.866915] head: 0200000000000001 ffffea000400e401 00000000ffffffff 00000000ffffffff [ 17.867610] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.867892] page dumped because: kasan: bad access detected [ 17.868074] [ 17.868149] Memory state around the buggy address: [ 17.869464] ffff888100391900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.870469] ffff888100391980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.871079] >ffff888100391a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.871695] ^ [ 17.872052] ffff888100391a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.872797] ffff888100391b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.873474] ================================================================== [ 17.766725] ================================================================== [ 17.768122] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 17.768795] Read of size 1 at addr ffff888100391a00 by task kunit_try_catch/191 [ 17.769467] [ 17.769729] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250617 #1 PREEMPT(voluntary) [ 17.769876] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.769913] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.769969] Call Trace: [ 17.770033] <TASK> [ 17.770102] dump_stack_lvl+0x73/0xb0 [ 17.770183] print_report+0xd1/0x650 [ 17.770351] ? __virt_addr_valid+0x1db/0x2d0 [ 17.770427] ? krealloc_uaf+0x1b8/0x5e0 [ 17.770492] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.770537] ? krealloc_uaf+0x1b8/0x5e0 [ 17.770568] kasan_report+0x141/0x180 [ 17.770599] ? krealloc_uaf+0x1b8/0x5e0 [ 17.770659] ? krealloc_uaf+0x1b8/0x5e0 [ 17.770732] __kasan_check_byte+0x3d/0x50 [ 17.770798] krealloc_noprof+0x3f/0x340 [ 17.770858] krealloc_uaf+0x1b8/0x5e0 [ 17.770901] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.770931] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 17.770970] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.771004] kunit_try_run_case+0x1a5/0x480 [ 17.771036] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.771067] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.771095] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.771132] ? __kthread_parkme+0x82/0x180 [ 17.771159] ? preempt_count_sub+0x50/0x80 [ 17.771190] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.771232] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.771307] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.771373] kthread+0x337/0x6f0 [ 17.771405] ? trace_preempt_on+0x20/0xc0 [ 17.771440] ? __pfx_kthread+0x10/0x10 [ 17.771468] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.771500] ? calculate_sigpending+0x7b/0xa0 [ 17.771534] ? __pfx_kthread+0x10/0x10 [ 17.771582] ret_from_fork+0x116/0x1d0 [ 17.771609] ? __pfx_kthread+0x10/0x10 [ 17.771636] ret_from_fork_asm+0x1a/0x30 [ 17.771677] </TASK> [ 17.771693] [ 17.790220] Allocated by task 191: [ 17.791013] kasan_save_stack+0x45/0x70 [ 17.791867] kasan_save_track+0x18/0x40 [ 17.792636] kasan_save_alloc_info+0x3b/0x50 [ 17.793149] __kasan_kmalloc+0xb7/0xc0 [ 17.793502] __kmalloc_cache_noprof+0x189/0x420 [ 17.793883] krealloc_uaf+0xbb/0x5e0 [ 17.794247] kunit_try_run_case+0x1a5/0x480 [ 17.794599] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.795769] kthread+0x337/0x6f0 [ 17.796130] ret_from_fork+0x116/0x1d0 [ 17.796661] ret_from_fork_asm+0x1a/0x30 [ 17.797031] [ 17.797378] Freed by task 191: [ 17.797721] kasan_save_stack+0x45/0x70 [ 17.798072] kasan_save_track+0x18/0x40 [ 17.798623] kasan_save_free_info+0x3f/0x60 [ 17.799037] __kasan_slab_free+0x56/0x70 [ 17.799865] kfree+0x222/0x3f0 [ 17.800144] krealloc_uaf+0x13d/0x5e0 [ 17.800705] kunit_try_run_case+0x1a5/0x480 [ 17.801096] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.801746] kthread+0x337/0x6f0 [ 17.802063] ret_from_fork+0x116/0x1d0 [ 17.802631] ret_from_fork_asm+0x1a/0x30 [ 17.803028] [ 17.803349] The buggy address belongs to the object at ffff888100391a00 [ 17.803349] which belongs to the cache kmalloc-256 of size 256 [ 17.804778] The buggy address is located 0 bytes inside of [ 17.804778] freed 256-byte region [ffff888100391a00, ffff888100391b00) [ 17.805953] [ 17.806128] The buggy address belongs to the physical page: [ 17.806768] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100390 [ 17.807577] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.808124] flags: 0x200000000000040(head|node=0|zone=2) [ 17.808781] page_type: f5(slab) [ 17.809148] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.810152] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.810928] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.811573] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.812406] head: 0200000000000001 ffffea000400e401 00000000ffffffff 00000000ffffffff [ 17.813369] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.813968] page dumped because: kasan: bad access detected [ 17.814779] [ 17.815384] Memory state around the buggy address: [ 17.816099] ffff888100391900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.816672] ffff888100391980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.817243] >ffff888100391a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.817815] ^ [ 17.818524] ffff888100391a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.819135] ffff888100391b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.819923] ==================================================================