Date
June 23, 2025, 7:07 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 32.759789] ================================================================== [ 32.759931] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 32.760122] Read of size 1 at addr fff00000c4511400 by task kunit_try_catch/176 [ 32.760358] [ 32.760483] CPU: 1 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250623 #1 PREEMPT [ 32.760892] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.761458] Hardware name: linux,dummy-virt (DT) [ 32.761835] Call trace: [ 32.762265] show_stack+0x20/0x38 (C) [ 32.762483] dump_stack_lvl+0x8c/0xd0 [ 32.762925] print_report+0x118/0x608 [ 32.763355] kasan_report+0xdc/0x128 [ 32.763875] __kasan_check_byte+0x54/0x70 [ 32.763998] krealloc_noprof+0x44/0x360 [ 32.764136] krealloc_uaf+0x180/0x520 [ 32.764244] kunit_try_run_case+0x170/0x3f0 [ 32.765291] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.765562] kthread+0x328/0x630 [ 32.766307] ret_from_fork+0x10/0x20 [ 32.766779] [ 32.766836] Allocated by task 176: [ 32.767263] kasan_save_stack+0x3c/0x68 [ 32.767397] kasan_save_track+0x20/0x40 [ 32.767736] kasan_save_alloc_info+0x40/0x58 [ 32.767946] __kasan_kmalloc+0xd4/0xd8 [ 32.768376] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.768577] krealloc_uaf+0xc8/0x520 [ 32.768668] kunit_try_run_case+0x170/0x3f0 [ 32.768759] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.768859] kthread+0x328/0x630 [ 32.768941] ret_from_fork+0x10/0x20 [ 32.769725] [ 32.769784] Freed by task 176: [ 32.770429] kasan_save_stack+0x3c/0x68 [ 32.770739] kasan_save_track+0x20/0x40 [ 32.770875] kasan_save_free_info+0x4c/0x78 [ 32.770983] __kasan_slab_free+0x6c/0x98 [ 32.771793] kfree+0x214/0x3c8 [ 32.772134] krealloc_uaf+0x12c/0x520 [ 32.772689] kunit_try_run_case+0x170/0x3f0 [ 32.772839] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.773458] kthread+0x328/0x630 [ 32.773654] ret_from_fork+0x10/0x20 [ 32.774171] [ 32.774232] The buggy address belongs to the object at fff00000c4511400 [ 32.774232] which belongs to the cache kmalloc-256 of size 256 [ 32.774560] The buggy address is located 0 bytes inside of [ 32.774560] freed 256-byte region [fff00000c4511400, fff00000c4511500) [ 32.774704] [ 32.775266] The buggy address belongs to the physical page: [ 32.775585] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104510 [ 32.775721] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.776087] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.776474] page_type: f5(slab) [ 32.776770] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 32.777112] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.777362] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 32.777481] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.777901] head: 0bfffe0000000001 ffffc1ffc3114401 00000000ffffffff 00000000ffffffff [ 32.778159] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 32.778256] page dumped because: kasan: bad access detected [ 32.779091] [ 32.779150] Memory state around the buggy address: [ 32.779236] fff00000c4511300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.779344] fff00000c4511380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.780075] >fff00000c4511400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.780169] ^ [ 32.780237] fff00000c4511480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.780345] fff00000c4511500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.780435] ================================================================== [ 32.790247] ================================================================== [ 32.790347] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 32.791078] Read of size 1 at addr fff00000c4511400 by task kunit_try_catch/176 [ 32.791211] [ 32.791284] CPU: 1 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250623 #1 PREEMPT [ 32.792232] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.792691] Hardware name: linux,dummy-virt (DT) [ 32.792772] Call trace: [ 32.792824] show_stack+0x20/0x38 (C) [ 32.792941] dump_stack_lvl+0x8c/0xd0 [ 32.793072] print_report+0x118/0x608 [ 32.793189] kasan_report+0xdc/0x128 [ 32.793302] __asan_report_load1_noabort+0x20/0x30 [ 32.794633] krealloc_uaf+0x4c8/0x520 [ 32.795792] kunit_try_run_case+0x170/0x3f0 [ 32.796330] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.797348] kthread+0x328/0x630 [ 32.798091] ret_from_fork+0x10/0x20 [ 32.798496] [ 32.798663] Allocated by task 176: [ 32.798932] kasan_save_stack+0x3c/0x68 [ 32.799606] kasan_save_track+0x20/0x40 [ 32.799792] kasan_save_alloc_info+0x40/0x58 [ 32.800488] __kasan_kmalloc+0xd4/0xd8 [ 32.800833] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.800949] krealloc_uaf+0xc8/0x520 [ 32.801904] kunit_try_run_case+0x170/0x3f0 [ 32.802826] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.803258] kthread+0x328/0x630 [ 32.804137] ret_from_fork+0x10/0x20 [ 32.804814] [ 32.804866] Freed by task 176: [ 32.805148] kasan_save_stack+0x3c/0x68 [ 32.805251] kasan_save_track+0x20/0x40 [ 32.805341] kasan_save_free_info+0x4c/0x78 [ 32.806202] __kasan_slab_free+0x6c/0x98 [ 32.806481] kfree+0x214/0x3c8 [ 32.806735] krealloc_uaf+0x12c/0x520 [ 32.806844] kunit_try_run_case+0x170/0x3f0 [ 32.807819] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.807967] kthread+0x328/0x630 [ 32.808081] ret_from_fork+0x10/0x20 [ 32.808186] [ 32.808240] The buggy address belongs to the object at fff00000c4511400 [ 32.808240] which belongs to the cache kmalloc-256 of size 256 [ 32.808382] The buggy address is located 0 bytes inside of [ 32.808382] freed 256-byte region [fff00000c4511400, fff00000c4511500) [ 32.808540] [ 32.808592] The buggy address belongs to the physical page: [ 32.808766] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104510 [ 32.808941] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.809286] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.809432] page_type: f5(slab) [ 32.809522] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 32.809634] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.809745] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 32.809854] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.809965] head: 0bfffe0000000001 ffffc1ffc3114401 00000000ffffffff 00000000ffffffff [ 32.810264] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 32.810630] page dumped because: kasan: bad access detected [ 32.810709] [ 32.810798] Memory state around the buggy address: [ 32.810982] fff00000c4511300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.811116] fff00000c4511380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.811228] >fff00000c4511400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.811325] ^ [ 32.811421] fff00000c4511480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.811674] fff00000c4511500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.811768] ==================================================================
[ 21.672053] ================================================================== [ 21.672559] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 21.673578] Read of size 1 at addr ffff888100377400 by task kunit_try_catch/193 [ 21.673913] [ 21.674051] CPU: 0 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250623 #1 PREEMPT(voluntary) [ 21.674135] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.674161] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.674195] Call Trace: [ 21.674216] <TASK> [ 21.674238] dump_stack_lvl+0x73/0xb0 [ 21.674280] print_report+0xd1/0x650 [ 21.674307] ? __virt_addr_valid+0x1db/0x2d0 [ 21.674337] ? krealloc_uaf+0x1b8/0x5e0 [ 21.674368] ? kasan_complete_mode_report_info+0x64/0x200 [ 21.674421] ? krealloc_uaf+0x1b8/0x5e0 [ 21.674448] kasan_report+0x141/0x180 [ 21.674468] ? krealloc_uaf+0x1b8/0x5e0 [ 21.674496] ? krealloc_uaf+0x1b8/0x5e0 [ 21.674517] __kasan_check_byte+0x3d/0x50 [ 21.674538] krealloc_noprof+0x3f/0x340 [ 21.674564] krealloc_uaf+0x1b8/0x5e0 [ 21.674584] ? __pfx_krealloc_uaf+0x10/0x10 [ 21.674603] ? finish_task_switch.isra.0+0x153/0x700 [ 21.674624] ? __switch_to+0x47/0xf50 [ 21.674650] ? __schedule+0x10cc/0x2b60 [ 21.674669] ? __pfx_read_tsc+0x10/0x10 [ 21.674690] ? ktime_get_ts64+0x86/0x230 [ 21.674715] kunit_try_run_case+0x1a5/0x480 [ 21.674738] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.674759] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.674780] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.674801] ? __kthread_parkme+0x82/0x180 [ 21.674819] ? preempt_count_sub+0x50/0x80 [ 21.674840] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.674862] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.674884] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.674906] kthread+0x337/0x6f0 [ 21.674924] ? trace_preempt_on+0x20/0xc0 [ 21.674945] ? __pfx_kthread+0x10/0x10 [ 21.674964] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.674983] ? calculate_sigpending+0x7b/0xa0 [ 21.675005] ? __pfx_kthread+0x10/0x10 [ 21.675023] ret_from_fork+0x116/0x1d0 [ 21.675039] ? __pfx_kthread+0x10/0x10 [ 21.675056] ret_from_fork_asm+0x1a/0x30 [ 21.675083] </TASK> [ 21.675094] [ 21.685710] Allocated by task 193: [ 21.685888] kasan_save_stack+0x45/0x70 [ 21.686065] kasan_save_track+0x18/0x40 [ 21.686525] kasan_save_alloc_info+0x3b/0x50 [ 21.686890] __kasan_kmalloc+0xb7/0xc0 [ 21.687282] __kmalloc_cache_noprof+0x189/0x420 [ 21.687621] krealloc_uaf+0xbb/0x5e0 [ 21.687907] kunit_try_run_case+0x1a5/0x480 [ 21.688157] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.688496] kthread+0x337/0x6f0 [ 21.688627] ret_from_fork+0x116/0x1d0 [ 21.689018] ret_from_fork_asm+0x1a/0x30 [ 21.689373] [ 21.689512] Freed by task 193: [ 21.689654] kasan_save_stack+0x45/0x70 [ 21.689915] kasan_save_track+0x18/0x40 [ 21.690204] kasan_save_free_info+0x3f/0x60 [ 21.690411] __kasan_slab_free+0x56/0x70 [ 21.690708] kfree+0x222/0x3f0 [ 21.690970] krealloc_uaf+0x13d/0x5e0 [ 21.691356] kunit_try_run_case+0x1a5/0x480 [ 21.691666] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.691865] kthread+0x337/0x6f0 [ 21.692246] ret_from_fork+0x116/0x1d0 [ 21.692451] ret_from_fork_asm+0x1a/0x30 [ 21.692690] [ 21.692786] The buggy address belongs to the object at ffff888100377400 [ 21.692786] which belongs to the cache kmalloc-256 of size 256 [ 21.693314] The buggy address is located 0 bytes inside of [ 21.693314] freed 256-byte region [ffff888100377400, ffff888100377500) [ 21.693980] [ 21.694143] The buggy address belongs to the physical page: [ 21.694409] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100376 [ 21.694850] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.695205] flags: 0x200000000000040(head|node=0|zone=2) [ 21.695747] page_type: f5(slab) [ 21.696007] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.696526] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.696941] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.697456] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.697705] head: 0200000000000001 ffffea000400dd81 00000000ffffffff 00000000ffffffff [ 21.697960] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.698561] page dumped because: kasan: bad access detected [ 21.698954] [ 21.699247] Memory state around the buggy address: [ 21.699583] ffff888100377300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.700466] ffff888100377380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.700956] >ffff888100377400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.701464] ^ [ 21.701654] ffff888100377480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.701935] ffff888100377500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.703266] ================================================================== [ 21.704629] ================================================================== [ 21.705515] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 21.706191] Read of size 1 at addr ffff888100377400 by task kunit_try_catch/193 [ 21.706854] [ 21.706973] CPU: 0 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250623 #1 PREEMPT(voluntary) [ 21.707031] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.707045] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.707066] Call Trace: [ 21.707567] <TASK> [ 21.707621] dump_stack_lvl+0x73/0xb0 [ 21.707679] print_report+0xd1/0x650 [ 21.707765] ? __virt_addr_valid+0x1db/0x2d0 [ 21.707807] ? krealloc_uaf+0x53c/0x5e0 [ 21.707854] ? kasan_complete_mode_report_info+0x64/0x200 [ 21.707881] ? krealloc_uaf+0x53c/0x5e0 [ 21.707899] kasan_report+0x141/0x180 [ 21.707918] ? krealloc_uaf+0x53c/0x5e0 [ 21.707939] __asan_report_load1_noabort+0x18/0x20 [ 21.707960] krealloc_uaf+0x53c/0x5e0 [ 21.707978] ? __pfx_krealloc_uaf+0x10/0x10 [ 21.707995] ? finish_task_switch.isra.0+0x153/0x700 [ 21.708013] ? __switch_to+0x47/0xf50 [ 21.708036] ? __schedule+0x10cc/0x2b60 [ 21.708054] ? __pfx_read_tsc+0x10/0x10 [ 21.708076] ? ktime_get_ts64+0x86/0x230 [ 21.708109] kunit_try_run_case+0x1a5/0x480 [ 21.708140] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.708167] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.708196] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.708220] ? __kthread_parkme+0x82/0x180 [ 21.708238] ? preempt_count_sub+0x50/0x80 [ 21.708257] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.708278] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.708298] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.708318] kthread+0x337/0x6f0 [ 21.708335] ? trace_preempt_on+0x20/0xc0 [ 21.708354] ? __pfx_kthread+0x10/0x10 [ 21.708371] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.708407] ? calculate_sigpending+0x7b/0xa0 [ 21.708428] ? __pfx_kthread+0x10/0x10 [ 21.708446] ret_from_fork+0x116/0x1d0 [ 21.708462] ? __pfx_kthread+0x10/0x10 [ 21.708480] ret_from_fork_asm+0x1a/0x30 [ 21.708507] </TASK> [ 21.708518] [ 21.717553] Allocated by task 193: [ 21.717641] kasan_save_stack+0x45/0x70 [ 21.717888] kasan_save_track+0x18/0x40 [ 21.718181] kasan_save_alloc_info+0x3b/0x50 [ 21.719523] __kasan_kmalloc+0xb7/0xc0 [ 21.719808] __kmalloc_cache_noprof+0x189/0x420 [ 21.719992] krealloc_uaf+0xbb/0x5e0 [ 21.720164] kunit_try_run_case+0x1a5/0x480 [ 21.720322] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.720489] kthread+0x337/0x6f0 [ 21.720614] ret_from_fork+0x116/0x1d0 [ 21.720754] ret_from_fork_asm+0x1a/0x30 [ 21.721040] [ 21.721180] Freed by task 193: [ 21.721640] kasan_save_stack+0x45/0x70 [ 21.721980] kasan_save_track+0x18/0x40 [ 21.722515] kasan_save_free_info+0x3f/0x60 [ 21.722881] __kasan_slab_free+0x56/0x70 [ 21.723692] kfree+0x222/0x3f0 [ 21.724000] krealloc_uaf+0x13d/0x5e0 [ 21.724548] kunit_try_run_case+0x1a5/0x480 [ 21.724908] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.725472] kthread+0x337/0x6f0 [ 21.725727] ret_from_fork+0x116/0x1d0 [ 21.726316] ret_from_fork_asm+0x1a/0x30 [ 21.726669] [ 21.726823] The buggy address belongs to the object at ffff888100377400 [ 21.726823] which belongs to the cache kmalloc-256 of size 256 [ 21.727496] The buggy address is located 0 bytes inside of [ 21.727496] freed 256-byte region [ffff888100377400, ffff888100377500) [ 21.728130] [ 21.728323] The buggy address belongs to the physical page: [ 21.728691] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100376 [ 21.729422] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.729647] flags: 0x200000000000040(head|node=0|zone=2) [ 21.730370] page_type: f5(slab) [ 21.730845] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.731409] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.731725] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.732428] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.732652] head: 0200000000000001 ffffea000400dd81 00000000ffffffff 00000000ffffffff [ 21.732938] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.733551] page dumped because: kasan: bad access detected [ 21.733806] [ 21.734001] Memory state around the buggy address: [ 21.734513] ffff888100377300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.734940] ffff888100377380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.735455] >ffff888100377400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.736034] ^ [ 21.736369] ffff888100377480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.737028] ffff888100377500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.737400] ==================================================================