Date
June 18, 2025, 6:43 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 20.249291] ================================================================== [ 20.249683] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 20.250178] Read of size 1 at addr fff00000c59a9000 by task kunit_try_catch/174 [ 20.250599] [ 20.250830] CPU: 0 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250618 #1 PREEMPT [ 20.251174] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.251239] Hardware name: linux,dummy-virt (DT) [ 20.251857] Call trace: [ 20.252039] show_stack+0x20/0x38 (C) [ 20.252263] dump_stack_lvl+0x8c/0xd0 [ 20.252385] print_report+0x118/0x608 [ 20.252639] kasan_report+0xdc/0x128 [ 20.253164] __asan_report_load1_noabort+0x20/0x30 [ 20.253371] krealloc_uaf+0x4c8/0x520 [ 20.253494] kunit_try_run_case+0x170/0x3f0 [ 20.253606] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.253719] kthread+0x328/0x630 [ 20.253814] ret_from_fork+0x10/0x20 [ 20.253928] [ 20.253968] Allocated by task 174: [ 20.254381] kasan_save_stack+0x3c/0x68 [ 20.254604] kasan_save_track+0x20/0x40 [ 20.254713] kasan_save_alloc_info+0x40/0x58 [ 20.254990] __kasan_kmalloc+0xd4/0xd8 [ 20.255306] __kmalloc_cache_noprof+0x16c/0x3c0 [ 20.255406] krealloc_uaf+0xc8/0x520 [ 20.255485] kunit_try_run_case+0x170/0x3f0 [ 20.255566] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.255660] kthread+0x328/0x630 [ 20.255732] ret_from_fork+0x10/0x20 [ 20.255809] [ 20.255851] Freed by task 174: [ 20.255910] kasan_save_stack+0x3c/0x68 [ 20.255995] kasan_save_track+0x20/0x40 [ 20.256096] kasan_save_free_info+0x4c/0x78 [ 20.256972] __kasan_slab_free+0x6c/0x98 [ 20.257871] kfree+0x214/0x3c8 [ 20.258614] krealloc_uaf+0x12c/0x520 [ 20.258731] kunit_try_run_case+0x170/0x3f0 [ 20.258922] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.259034] kthread+0x328/0x630 [ 20.259137] ret_from_fork+0x10/0x20 [ 20.259221] [ 20.259266] The buggy address belongs to the object at fff00000c59a9000 [ 20.259266] which belongs to the cache kmalloc-256 of size 256 [ 20.259478] The buggy address is located 0 bytes inside of [ 20.259478] freed 256-byte region [fff00000c59a9000, fff00000c59a9100) [ 20.260217] [ 20.260288] The buggy address belongs to the physical page: [ 20.260368] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059a8 [ 20.260744] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.260886] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 20.261276] page_type: f5(slab) [ 20.261384] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 20.261535] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.262008] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 20.262139] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.262478] head: 0bfffe0000000001 ffffc1ffc3166a01 00000000ffffffff 00000000ffffffff [ 20.262778] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 20.263092] page dumped because: kasan: bad access detected [ 20.263163] [ 20.263211] Memory state around the buggy address: [ 20.263288] fff00000c59a8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.263392] fff00000c59a8f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.263490] >fff00000c59a9000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.263574] ^ [ 20.263799] fff00000c59a9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.264063] fff00000c59a9100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.264251] ================================================================== [ 20.232221] ================================================================== [ 20.232407] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 20.232546] Read of size 1 at addr fff00000c59a9000 by task kunit_try_catch/174 [ 20.232667] [ 20.232751] CPU: 0 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250618 #1 PREEMPT [ 20.233007] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.233077] Hardware name: linux,dummy-virt (DT) [ 20.233191] Call trace: [ 20.233274] show_stack+0x20/0x38 (C) [ 20.233467] dump_stack_lvl+0x8c/0xd0 [ 20.233573] print_report+0x118/0x608 [ 20.233910] kasan_report+0xdc/0x128 [ 20.234448] __kasan_check_byte+0x54/0x70 [ 20.234943] krealloc_noprof+0x44/0x360 [ 20.235510] krealloc_uaf+0x180/0x520 [ 20.235624] kunit_try_run_case+0x170/0x3f0 [ 20.235883] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.236662] kthread+0x328/0x630 [ 20.236961] ret_from_fork+0x10/0x20 [ 20.237093] [ 20.237601] Allocated by task 174: [ 20.237899] kasan_save_stack+0x3c/0x68 [ 20.238035] kasan_save_track+0x20/0x40 [ 20.238201] kasan_save_alloc_info+0x40/0x58 [ 20.238314] __kasan_kmalloc+0xd4/0xd8 [ 20.238508] __kmalloc_cache_noprof+0x16c/0x3c0 [ 20.238596] krealloc_uaf+0xc8/0x520 [ 20.238677] kunit_try_run_case+0x170/0x3f0 [ 20.239068] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.239180] kthread+0x328/0x630 [ 20.239380] ret_from_fork+0x10/0x20 [ 20.239914] [ 20.240025] Freed by task 174: [ 20.240119] kasan_save_stack+0x3c/0x68 [ 20.240217] kasan_save_track+0x20/0x40 [ 20.240302] kasan_save_free_info+0x4c/0x78 [ 20.240388] __kasan_slab_free+0x6c/0x98 [ 20.241002] kfree+0x214/0x3c8 [ 20.241121] krealloc_uaf+0x12c/0x520 [ 20.241206] kunit_try_run_case+0x170/0x3f0 [ 20.241291] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.241387] kthread+0x328/0x630 [ 20.241458] ret_from_fork+0x10/0x20 [ 20.242283] [ 20.242381] The buggy address belongs to the object at fff00000c59a9000 [ 20.242381] which belongs to the cache kmalloc-256 of size 256 [ 20.242854] The buggy address is located 0 bytes inside of [ 20.242854] freed 256-byte region [fff00000c59a9000, fff00000c59a9100) [ 20.243032] [ 20.243097] The buggy address belongs to the physical page: [ 20.243232] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059a8 [ 20.243618] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.243978] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 20.244149] page_type: f5(slab) [ 20.244241] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 20.244342] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.244455] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 20.245210] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.245749] head: 0bfffe0000000001 ffffc1ffc3166a01 00000000ffffffff 00000000ffffffff [ 20.245970] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 20.246289] page dumped because: kasan: bad access detected [ 20.246470] [ 20.246537] Memory state around the buggy address: [ 20.246636] fff00000c59a8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.246730] fff00000c59a8f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.247016] >fff00000c59a9000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.247118] ^ [ 20.247216] fff00000c59a9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.247755] fff00000c59a9100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.248000] ==================================================================
[ 11.088360] ================================================================== [ 11.088747] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.089163] Read of size 1 at addr ffff888100a22800 by task kunit_try_catch/190 [ 11.089737] [ 11.089850] CPU: 1 UID: 0 PID: 190 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250618 #1 PREEMPT(voluntary) [ 11.090257] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.090272] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.090293] Call Trace: [ 11.090310] <TASK> [ 11.090326] dump_stack_lvl+0x73/0xb0 [ 11.090355] print_report+0xd1/0x650 [ 11.090375] ? __virt_addr_valid+0x1db/0x2d0 [ 11.090397] ? krealloc_uaf+0x53c/0x5e0 [ 11.090416] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.090441] ? krealloc_uaf+0x53c/0x5e0 [ 11.090461] kasan_report+0x141/0x180 [ 11.090481] ? krealloc_uaf+0x53c/0x5e0 [ 11.090505] __asan_report_load1_noabort+0x18/0x20 [ 11.090528] krealloc_uaf+0x53c/0x5e0 [ 11.090547] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.090567] ? finish_task_switch.isra.0+0x153/0x700 [ 11.090587] ? __switch_to+0x47/0xf50 [ 11.090611] ? __schedule+0x10cc/0x2b60 [ 11.090631] ? __pfx_read_tsc+0x10/0x10 [ 11.090651] ? ktime_get_ts64+0x86/0x230 [ 11.090676] kunit_try_run_case+0x1a5/0x480 [ 11.090699] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.090721] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.090742] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.090763] ? __kthread_parkme+0x82/0x180 [ 11.090782] ? preempt_count_sub+0x50/0x80 [ 11.090803] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.090825] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.090846] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.090867] kthread+0x337/0x6f0 [ 11.090885] ? trace_preempt_on+0x20/0xc0 [ 11.090907] ? __pfx_kthread+0x10/0x10 [ 11.090926] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.090946] ? calculate_sigpending+0x7b/0xa0 [ 11.090968] ? __pfx_kthread+0x10/0x10 [ 11.090988] ret_from_fork+0x116/0x1d0 [ 11.091005] ? __pfx_kthread+0x10/0x10 [ 11.091024] ret_from_fork_asm+0x1a/0x30 [ 11.091053] </TASK> [ 11.091063] [ 11.102552] Allocated by task 190: [ 11.102714] kasan_save_stack+0x45/0x70 [ 11.102894] kasan_save_track+0x18/0x40 [ 11.103045] kasan_save_alloc_info+0x3b/0x50 [ 11.103773] __kasan_kmalloc+0xb7/0xc0 [ 11.104056] __kmalloc_cache_noprof+0x189/0x420 [ 11.104368] krealloc_uaf+0xbb/0x5e0 [ 11.104683] kunit_try_run_case+0x1a5/0x480 [ 11.105049] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.105414] kthread+0x337/0x6f0 [ 11.105753] ret_from_fork+0x116/0x1d0 [ 11.105944] ret_from_fork_asm+0x1a/0x30 [ 11.106125] [ 11.106220] Freed by task 190: [ 11.106843] kasan_save_stack+0x45/0x70 [ 11.107001] kasan_save_track+0x18/0x40 [ 11.107359] kasan_save_free_info+0x3f/0x60 [ 11.107735] __kasan_slab_free+0x56/0x70 [ 11.107899] kfree+0x222/0x3f0 [ 11.108060] krealloc_uaf+0x13d/0x5e0 [ 11.108244] kunit_try_run_case+0x1a5/0x480 [ 11.108753] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.109077] kthread+0x337/0x6f0 [ 11.109201] ret_from_fork+0x116/0x1d0 [ 11.109932] ret_from_fork_asm+0x1a/0x30 [ 11.110133] [ 11.110218] The buggy address belongs to the object at ffff888100a22800 [ 11.110218] which belongs to the cache kmalloc-256 of size 256 [ 11.111235] The buggy address is located 0 bytes inside of [ 11.111235] freed 256-byte region [ffff888100a22800, ffff888100a22900) [ 11.111956] [ 11.112034] The buggy address belongs to the physical page: [ 11.112335] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a22 [ 11.113023] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.113663] anon flags: 0x200000000000040(head|node=0|zone=2) [ 11.114259] page_type: f5(slab) [ 11.114378] raw: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 11.114710] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.115851] head: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 11.116805] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.117373] head: 0200000000000001 ffffea0004028881 00000000ffffffff 00000000ffffffff [ 11.118119] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.118726] page dumped because: kasan: bad access detected [ 11.119097] [ 11.119265] Memory state around the buggy address: [ 11.119800] ffff888100a22700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.120012] ffff888100a22780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.120307] >ffff888100a22800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.121187] ^ [ 11.121671] ffff888100a22880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.122723] ffff888100a22900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.123089] ================================================================== [ 11.057181] ================================================================== [ 11.057701] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.058031] Read of size 1 at addr ffff888100a22800 by task kunit_try_catch/190 [ 11.058331] [ 11.058433] CPU: 1 UID: 0 PID: 190 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250618 #1 PREEMPT(voluntary) [ 11.058479] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.058490] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.058510] Call Trace: [ 11.058521] <TASK> [ 11.058534] dump_stack_lvl+0x73/0xb0 [ 11.058559] print_report+0xd1/0x650 [ 11.058579] ? __virt_addr_valid+0x1db/0x2d0 [ 11.058601] ? krealloc_uaf+0x1b8/0x5e0 [ 11.058620] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.058645] ? krealloc_uaf+0x1b8/0x5e0 [ 11.058665] kasan_report+0x141/0x180 [ 11.058685] ? krealloc_uaf+0x1b8/0x5e0 [ 11.058707] ? krealloc_uaf+0x1b8/0x5e0 [ 11.058727] __kasan_check_byte+0x3d/0x50 [ 11.058747] krealloc_noprof+0x3f/0x340 [ 11.058772] krealloc_uaf+0x1b8/0x5e0 [ 11.058792] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.058811] ? finish_task_switch.isra.0+0x153/0x700 [ 11.058832] ? __switch_to+0x47/0xf50 [ 11.058856] ? __schedule+0x10cc/0x2b60 [ 11.058878] ? __pfx_read_tsc+0x10/0x10 [ 11.058899] ? ktime_get_ts64+0x86/0x230 [ 11.058923] kunit_try_run_case+0x1a5/0x480 [ 11.058945] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.058966] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.058987] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.059008] ? __kthread_parkme+0x82/0x180 [ 11.059028] ? preempt_count_sub+0x50/0x80 [ 11.059049] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.059071] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.059092] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.059113] kthread+0x337/0x6f0 [ 11.059131] ? trace_preempt_on+0x20/0xc0 [ 11.059153] ? __pfx_kthread+0x10/0x10 [ 11.059172] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.059191] ? calculate_sigpending+0x7b/0xa0 [ 11.059223] ? __pfx_kthread+0x10/0x10 [ 11.059244] ret_from_fork+0x116/0x1d0 [ 11.059261] ? __pfx_kthread+0x10/0x10 [ 11.059280] ret_from_fork_asm+0x1a/0x30 [ 11.059308] </TASK> [ 11.059318] [ 11.066928] Allocated by task 190: [ 11.067104] kasan_save_stack+0x45/0x70 [ 11.067384] kasan_save_track+0x18/0x40 [ 11.067585] kasan_save_alloc_info+0x3b/0x50 [ 11.067853] __kasan_kmalloc+0xb7/0xc0 [ 11.067977] __kmalloc_cache_noprof+0x189/0x420 [ 11.068381] krealloc_uaf+0xbb/0x5e0 [ 11.068780] kunit_try_run_case+0x1a5/0x480 [ 11.068973] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.069248] kthread+0x337/0x6f0 [ 11.069376] ret_from_fork+0x116/0x1d0 [ 11.069635] ret_from_fork_asm+0x1a/0x30 [ 11.069772] [ 11.069836] Freed by task 190: [ 11.069938] kasan_save_stack+0x45/0x70 [ 11.070122] kasan_save_track+0x18/0x40 [ 11.070514] kasan_save_free_info+0x3f/0x60 [ 11.070711] __kasan_slab_free+0x56/0x70 [ 11.070842] kfree+0x222/0x3f0 [ 11.071395] krealloc_uaf+0x13d/0x5e0 [ 11.071578] kunit_try_run_case+0x1a5/0x480 [ 11.071771] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.072009] kthread+0x337/0x6f0 [ 11.072162] ret_from_fork+0x116/0x1d0 [ 11.074119] ret_from_fork_asm+0x1a/0x30 [ 11.074622] [ 11.074695] The buggy address belongs to the object at ffff888100a22800 [ 11.074695] which belongs to the cache kmalloc-256 of size 256 [ 11.075104] The buggy address is located 0 bytes inside of [ 11.075104] freed 256-byte region [ffff888100a22800, ffff888100a22900) [ 11.075468] [ 11.075536] The buggy address belongs to the physical page: [ 11.075704] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a22 [ 11.075940] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.076159] anon flags: 0x200000000000040(head|node=0|zone=2) [ 11.078184] page_type: f5(slab) [ 11.079026] raw: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 11.080344] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.080787] head: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 11.081920] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.082353] head: 0200000000000001 ffffea0004028881 00000000ffffffff 00000000ffffffff [ 11.082854] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.083378] page dumped because: kasan: bad access detected [ 11.083841] [ 11.084142] Memory state around the buggy address: [ 11.084344] ffff888100a22700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.084868] ffff888100a22780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.085363] >ffff888100a22800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.085993] ^ [ 11.086332] ffff888100a22880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.086860] ffff888100a22900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.087203] ==================================================================