Date
June 19, 2025, 12:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.373279] ================================================================== [ 30.374255] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 30.374469] Read of size 1 at addr fff00000c46d1200 by task kunit_try_catch/175 [ 30.374584] [ 30.374668] CPU: 1 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250619 #1 PREEMPT [ 30.374846] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.374914] Hardware name: linux,dummy-virt (DT) [ 30.374997] Call trace: [ 30.375063] show_stack+0x20/0x38 (C) [ 30.375171] dump_stack_lvl+0x8c/0xd0 [ 30.375273] print_report+0x118/0x608 [ 30.375379] kasan_report+0xdc/0x128 [ 30.375495] __asan_report_load1_noabort+0x20/0x30 [ 30.375621] krealloc_uaf+0x4c8/0x520 [ 30.375769] kunit_try_run_case+0x170/0x3f0 [ 30.375896] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.376008] kthread+0x328/0x630 [ 30.376102] ret_from_fork+0x10/0x20 [ 30.376209] [ 30.376256] Allocated by task 175: [ 30.376341] kasan_save_stack+0x3c/0x68 [ 30.376473] kasan_save_track+0x20/0x40 [ 30.376559] kasan_save_alloc_info+0x40/0x58 [ 30.377436] __kasan_kmalloc+0xd4/0xd8 [ 30.377530] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.377618] krealloc_uaf+0xc8/0x520 [ 30.377685] kunit_try_run_case+0x170/0x3f0 [ 30.377767] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.377865] kthread+0x328/0x630 [ 30.377953] ret_from_fork+0x10/0x20 [ 30.378028] [ 30.378074] Freed by task 175: [ 30.378139] kasan_save_stack+0x3c/0x68 [ 30.378228] kasan_save_track+0x20/0x40 [ 30.378328] kasan_save_free_info+0x4c/0x78 [ 30.378423] __kasan_slab_free+0x6c/0x98 [ 30.378516] kfree+0x214/0x3c8 [ 30.378595] krealloc_uaf+0x12c/0x520 [ 30.378684] kunit_try_run_case+0x170/0x3f0 [ 30.378808] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.378971] kthread+0x328/0x630 [ 30.379049] ret_from_fork+0x10/0x20 [ 30.379121] [ 30.379158] The buggy address belongs to the object at fff00000c46d1200 [ 30.379158] which belongs to the cache kmalloc-256 of size 256 [ 30.379268] The buggy address is located 0 bytes inside of [ 30.379268] freed 256-byte region [fff00000c46d1200, fff00000c46d1300) [ 30.379424] [ 30.379483] The buggy address belongs to the physical page: [ 30.379573] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1046d0 [ 30.379748] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.379919] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.380038] page_type: f5(slab) [ 30.380126] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 30.380222] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.380331] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 30.380434] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.380578] head: 0bfffe0000000001 ffffc1ffc311b401 00000000ffffffff 00000000ffffffff [ 30.380717] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.380841] page dumped because: kasan: bad access detected [ 30.380976] [ 30.381026] Memory state around the buggy address: [ 30.381130] fff00000c46d1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.381275] fff00000c46d1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.381392] >fff00000c46d1200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.381475] ^ [ 30.381533] fff00000c46d1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.381629] fff00000c46d1300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.381705] ================================================================== [ 30.354459] ================================================================== [ 30.354640] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 30.354788] Read of size 1 at addr fff00000c46d1200 by task kunit_try_catch/175 [ 30.355123] [ 30.355223] CPU: 1 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250619 #1 PREEMPT [ 30.356211] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.356406] Hardware name: linux,dummy-virt (DT) [ 30.356567] Call trace: [ 30.356708] show_stack+0x20/0x38 (C) [ 30.357028] dump_stack_lvl+0x8c/0xd0 [ 30.357190] print_report+0x118/0x608 [ 30.357309] kasan_report+0xdc/0x128 [ 30.357434] __kasan_check_byte+0x54/0x70 [ 30.357553] krealloc_noprof+0x44/0x360 [ 30.357661] krealloc_uaf+0x180/0x520 [ 30.357770] kunit_try_run_case+0x170/0x3f0 [ 30.357897] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.358374] kthread+0x328/0x630 [ 30.358662] ret_from_fork+0x10/0x20 [ 30.359092] [ 30.359309] Allocated by task 175: [ 30.359401] kasan_save_stack+0x3c/0x68 [ 30.359499] kasan_save_track+0x20/0x40 [ 30.359714] kasan_save_alloc_info+0x40/0x58 [ 30.359894] __kasan_kmalloc+0xd4/0xd8 [ 30.360080] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.360393] krealloc_uaf+0xc8/0x520 [ 30.360489] kunit_try_run_case+0x170/0x3f0 [ 30.360589] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.360706] kthread+0x328/0x630 [ 30.360791] ret_from_fork+0x10/0x20 [ 30.360910] [ 30.360981] Freed by task 175: [ 30.361060] kasan_save_stack+0x3c/0x68 [ 30.361152] kasan_save_track+0x20/0x40 [ 30.361244] kasan_save_free_info+0x4c/0x78 [ 30.361341] __kasan_slab_free+0x6c/0x98 [ 30.361902] kfree+0x214/0x3c8 [ 30.362015] krealloc_uaf+0x12c/0x520 [ 30.362245] kunit_try_run_case+0x170/0x3f0 [ 30.362390] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.363068] kthread+0x328/0x630 [ 30.363247] ret_from_fork+0x10/0x20 [ 30.363894] [ 30.364053] The buggy address belongs to the object at fff00000c46d1200 [ 30.364053] which belongs to the cache kmalloc-256 of size 256 [ 30.364322] The buggy address is located 0 bytes inside of [ 30.364322] freed 256-byte region [fff00000c46d1200, fff00000c46d1300) [ 30.364469] [ 30.364521] The buggy address belongs to the physical page: [ 30.364601] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1046d0 [ 30.364726] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.364840] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.364986] page_type: f5(slab) [ 30.365084] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 30.365204] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.365328] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 30.366479] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.366910] head: 0bfffe0000000001 ffffc1ffc311b401 00000000ffffffff 00000000ffffffff [ 30.367198] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.367472] page dumped because: kasan: bad access detected [ 30.368221] [ 30.368277] Memory state around the buggy address: [ 30.368512] fff00000c46d1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.369245] fff00000c46d1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.369450] >fff00000c46d1200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.369706] ^ [ 30.369814] fff00000c46d1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.370401] fff00000c46d1300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.370502] ==================================================================
[ 26.744455] ================================================================== [ 26.745000] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 26.746180] Read of size 1 at addr ffff888103914200 by task kunit_try_catch/193 [ 26.747191] [ 26.747395] CPU: 1 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250619 #1 PREEMPT(voluntary) [ 26.747925] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.747954] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.748054] Call Trace: [ 26.748076] <TASK> [ 26.748132] dump_stack_lvl+0x73/0xb0 [ 26.748194] print_report+0xd1/0x650 [ 26.748221] ? __virt_addr_valid+0x1db/0x2d0 [ 26.748249] ? krealloc_uaf+0x1b8/0x5e0 [ 26.748272] ? kasan_complete_mode_report_info+0x64/0x200 [ 26.748299] ? krealloc_uaf+0x1b8/0x5e0 [ 26.748321] kasan_report+0x141/0x180 [ 26.748344] ? krealloc_uaf+0x1b8/0x5e0 [ 26.748369] ? krealloc_uaf+0x1b8/0x5e0 [ 26.748390] __kasan_check_byte+0x3d/0x50 [ 26.748413] krealloc_noprof+0x3f/0x340 [ 26.748438] krealloc_uaf+0x1b8/0x5e0 [ 26.748460] ? __pfx_krealloc_uaf+0x10/0x10 [ 26.748482] ? finish_task_switch.isra.0+0x153/0x700 [ 26.748507] ? __switch_to+0x47/0xf50 [ 26.748535] ? __schedule+0x10cc/0x2b60 [ 26.748558] ? __pfx_read_tsc+0x10/0x10 [ 26.748582] ? ktime_get_ts64+0x86/0x230 [ 26.748610] kunit_try_run_case+0x1a5/0x480 [ 26.748637] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.748660] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.748683] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.748707] ? __kthread_parkme+0x82/0x180 [ 26.748730] ? preempt_count_sub+0x50/0x80 [ 26.748754] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.748778] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.748802] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.748825] kthread+0x337/0x6f0 [ 26.748846] ? trace_preempt_on+0x20/0xc0 [ 26.748872] ? __pfx_kthread+0x10/0x10 [ 26.748894] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.748947] ? calculate_sigpending+0x7b/0xa0 [ 26.748995] ? __pfx_kthread+0x10/0x10 [ 26.749019] ret_from_fork+0x116/0x1d0 [ 26.749040] ? __pfx_kthread+0x10/0x10 [ 26.749061] ret_from_fork_asm+0x1a/0x30 [ 26.749093] </TASK> [ 26.749125] [ 26.763591] Allocated by task 193: [ 26.763837] kasan_save_stack+0x45/0x70 [ 26.764806] kasan_save_track+0x18/0x40 [ 26.765011] kasan_save_alloc_info+0x3b/0x50 [ 26.765472] __kasan_kmalloc+0xb7/0xc0 [ 26.765772] __kmalloc_cache_noprof+0x189/0x420 [ 26.766034] krealloc_uaf+0xbb/0x5e0 [ 26.766208] kunit_try_run_case+0x1a5/0x480 [ 26.767443] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.767883] kthread+0x337/0x6f0 [ 26.768485] ret_from_fork+0x116/0x1d0 [ 26.768676] ret_from_fork_asm+0x1a/0x30 [ 26.769139] [ 26.769345] Freed by task 193: [ 26.769522] kasan_save_stack+0x45/0x70 [ 26.769729] kasan_save_track+0x18/0x40 [ 26.770428] kasan_save_free_info+0x3f/0x60 [ 26.770918] __kasan_slab_free+0x56/0x70 [ 26.771285] kfree+0x222/0x3f0 [ 26.771541] krealloc_uaf+0x13d/0x5e0 [ 26.771706] kunit_try_run_case+0x1a5/0x480 [ 26.772046] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.773193] kthread+0x337/0x6f0 [ 26.773443] ret_from_fork+0x116/0x1d0 [ 26.773630] ret_from_fork_asm+0x1a/0x30 [ 26.773790] [ 26.773935] The buggy address belongs to the object at ffff888103914200 [ 26.773935] which belongs to the cache kmalloc-256 of size 256 [ 26.775703] The buggy address is located 0 bytes inside of [ 26.775703] freed 256-byte region [ffff888103914200, ffff888103914300) [ 26.776574] [ 26.776763] The buggy address belongs to the physical page: [ 26.777846] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103914 [ 26.778248] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.778411] flags: 0x200000000000040(head|node=0|zone=2) [ 26.778542] page_type: f5(slab) [ 26.778635] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 26.778775] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.778922] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 26.780587] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.780860] head: 0200000000000001 ffffea00040e4501 00000000ffffffff 00000000ffffffff [ 26.781558] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.782307] page dumped because: kasan: bad access detected [ 26.782585] [ 26.782760] Memory state around the buggy address: [ 26.783792] ffff888103914100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.784212] ffff888103914180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.785288] >ffff888103914200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.785550] ^ [ 26.785894] ffff888103914280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.786397] ffff888103914300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.787354] ================================================================== [ 26.789480] ================================================================== [ 26.789978] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 26.790395] Read of size 1 at addr ffff888103914200 by task kunit_try_catch/193 [ 26.790636] [ 26.790768] CPU: 1 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250619 #1 PREEMPT(voluntary) [ 26.790842] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.790857] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.790882] Call Trace: [ 26.790898] <TASK> [ 26.790922] dump_stack_lvl+0x73/0xb0 [ 26.790963] print_report+0xd1/0x650 [ 26.790988] ? __virt_addr_valid+0x1db/0x2d0 [ 26.791519] ? krealloc_uaf+0x53c/0x5e0 [ 26.791571] ? kasan_complete_mode_report_info+0x64/0x200 [ 26.791616] ? krealloc_uaf+0x53c/0x5e0 [ 26.791658] kasan_report+0x141/0x180 [ 26.791704] ? krealloc_uaf+0x53c/0x5e0 [ 26.791755] __asan_report_load1_noabort+0x18/0x20 [ 26.791805] krealloc_uaf+0x53c/0x5e0 [ 26.791850] ? __pfx_krealloc_uaf+0x10/0x10 [ 26.791890] ? finish_task_switch.isra.0+0x153/0x700 [ 26.792465] ? __switch_to+0x47/0xf50 [ 26.792528] ? __schedule+0x10cc/0x2b60 [ 26.792555] ? __pfx_read_tsc+0x10/0x10 [ 26.792578] ? ktime_get_ts64+0x86/0x230 [ 26.792607] kunit_try_run_case+0x1a5/0x480 [ 26.792637] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.792659] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.792684] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.792708] ? __kthread_parkme+0x82/0x180 [ 26.792730] ? preempt_count_sub+0x50/0x80 [ 26.792755] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.792779] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.792804] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.792828] kthread+0x337/0x6f0 [ 26.792849] ? trace_preempt_on+0x20/0xc0 [ 26.792873] ? __pfx_kthread+0x10/0x10 [ 26.792895] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.792933] ? calculate_sigpending+0x7b/0xa0 [ 26.792970] ? __pfx_kthread+0x10/0x10 [ 26.793411] ret_from_fork+0x116/0x1d0 [ 26.793438] ? __pfx_kthread+0x10/0x10 [ 26.793459] ret_from_fork_asm+0x1a/0x30 [ 26.793492] </TASK> [ 26.793506] [ 26.807417] Allocated by task 193: [ 26.807717] kasan_save_stack+0x45/0x70 [ 26.808589] kasan_save_track+0x18/0x40 [ 26.809184] kasan_save_alloc_info+0x3b/0x50 [ 26.809893] __kasan_kmalloc+0xb7/0xc0 [ 26.810422] __kmalloc_cache_noprof+0x189/0x420 [ 26.810570] krealloc_uaf+0xbb/0x5e0 [ 26.810658] kunit_try_run_case+0x1a5/0x480 [ 26.810751] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.810857] kthread+0x337/0x6f0 [ 26.811499] ret_from_fork+0x116/0x1d0 [ 26.811909] ret_from_fork_asm+0x1a/0x30 [ 26.812306] [ 26.812709] Freed by task 193: [ 26.813384] kasan_save_stack+0x45/0x70 [ 26.813626] kasan_save_track+0x18/0x40 [ 26.814709] kasan_save_free_info+0x3f/0x60 [ 26.815006] __kasan_slab_free+0x56/0x70 [ 26.815177] kfree+0x222/0x3f0 [ 26.815696] krealloc_uaf+0x13d/0x5e0 [ 26.816120] kunit_try_run_case+0x1a5/0x480 [ 26.816310] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.816810] kthread+0x337/0x6f0 [ 26.817002] ret_from_fork+0x116/0x1d0 [ 26.817363] ret_from_fork_asm+0x1a/0x30 [ 26.817616] [ 26.817720] The buggy address belongs to the object at ffff888103914200 [ 26.817720] which belongs to the cache kmalloc-256 of size 256 [ 26.818505] The buggy address is located 0 bytes inside of [ 26.818505] freed 256-byte region [ffff888103914200, ffff888103914300) [ 26.819429] [ 26.819584] The buggy address belongs to the physical page: [ 26.819750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103914 [ 26.821758] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.822468] flags: 0x200000000000040(head|node=0|zone=2) [ 26.822918] page_type: f5(slab) [ 26.823380] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 26.823637] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.823900] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 26.825054] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.825833] head: 0200000000000001 ffffea00040e4501 00000000ffffffff 00000000ffffffff [ 26.826656] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.827292] page dumped because: kasan: bad access detected [ 26.828333] [ 26.828466] Memory state around the buggy address: [ 26.829285] ffff888103914100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.829670] ffff888103914180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.830335] >ffff888103914200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.830594] ^ [ 26.831298] ffff888103914280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.831678] ffff888103914300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.832834] ==================================================================