Date
June 25, 2025, 8:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 26.550391] ================================================================== [ 26.550462] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 26.550578] Read of size 1 at addr fff00000c470f800 by task kunit_try_catch/176 [ 26.550775] [ 26.550874] CPU: 1 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT [ 26.551241] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.551276] Hardware name: linux,dummy-virt (DT) [ 26.551345] Call trace: [ 26.551384] show_stack+0x20/0x38 (C) [ 26.551499] dump_stack_lvl+0x8c/0xd0 [ 26.551575] print_report+0x118/0x608 [ 26.551815] kasan_report+0xdc/0x128 [ 26.552001] __asan_report_load1_noabort+0x20/0x30 [ 26.552199] krealloc_uaf+0x4c8/0x520 [ 26.552315] kunit_try_run_case+0x170/0x3f0 [ 26.552417] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.552601] kthread+0x328/0x630 [ 26.552689] ret_from_fork+0x10/0x20 [ 26.552744] [ 26.553047] Allocated by task 176: [ 26.553320] kasan_save_stack+0x3c/0x68 [ 26.553439] kasan_save_track+0x20/0x40 [ 26.553583] kasan_save_alloc_info+0x40/0x58 [ 26.553629] __kasan_kmalloc+0xd4/0xd8 [ 26.553665] __kmalloc_cache_noprof+0x16c/0x3c0 [ 26.553703] krealloc_uaf+0xc8/0x520 [ 26.553736] kunit_try_run_case+0x170/0x3f0 [ 26.553823] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.553882] kthread+0x328/0x630 [ 26.553921] ret_from_fork+0x10/0x20 [ 26.553961] [ 26.553981] Freed by task 176: [ 26.554007] kasan_save_stack+0x3c/0x68 [ 26.554044] kasan_save_track+0x20/0x40 [ 26.554079] kasan_save_free_info+0x4c/0x78 [ 26.554121] __kasan_slab_free+0x6c/0x98 [ 26.554165] kfree+0x214/0x3c8 [ 26.554197] krealloc_uaf+0x12c/0x520 [ 26.554230] kunit_try_run_case+0x170/0x3f0 [ 26.554272] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.554323] kthread+0x328/0x630 [ 26.554362] ret_from_fork+0x10/0x20 [ 26.554406] [ 26.554424] The buggy address belongs to the object at fff00000c470f800 [ 26.554424] which belongs to the cache kmalloc-256 of size 256 [ 26.554479] The buggy address is located 0 bytes inside of [ 26.554479] freed 256-byte region [fff00000c470f800, fff00000c470f900) [ 26.554536] [ 26.554555] The buggy address belongs to the physical page: [ 26.554586] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10470e [ 26.554644] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.554689] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.554746] page_type: f5(slab) [ 26.554783] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 26.554830] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.554877] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 26.554923] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.554979] head: 0bfffe0000000001 ffffc1ffc311c381 00000000ffffffff 00000000ffffffff [ 26.555025] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.555063] page dumped because: kasan: bad access detected [ 26.555098] [ 26.555115] Memory state around the buggy address: [ 26.555144] fff00000c470f700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.555185] fff00000c470f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.555234] >fff00000c470f800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.555279] ^ [ 26.555313] fff00000c470f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.555363] fff00000c470f900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.556142] ================================================================== [ 26.537629] ================================================================== [ 26.538014] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 26.538085] Read of size 1 at addr fff00000c470f800 by task kunit_try_catch/176 [ 26.538149] [ 26.538184] CPU: 1 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT [ 26.538652] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.538707] Hardware name: linux,dummy-virt (DT) [ 26.538742] Call trace: [ 26.538930] show_stack+0x20/0x38 (C) [ 26.539169] dump_stack_lvl+0x8c/0xd0 [ 26.539260] print_report+0x118/0x608 [ 26.539309] kasan_report+0xdc/0x128 [ 26.539353] __kasan_check_byte+0x54/0x70 [ 26.539565] krealloc_noprof+0x44/0x360 [ 26.539625] krealloc_uaf+0x180/0x520 [ 26.539895] kunit_try_run_case+0x170/0x3f0 [ 26.540155] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.540216] kthread+0x328/0x630 [ 26.540257] ret_from_fork+0x10/0x20 [ 26.540303] [ 26.540321] Allocated by task 176: [ 26.540351] kasan_save_stack+0x3c/0x68 [ 26.540390] kasan_save_track+0x20/0x40 [ 26.540440] kasan_save_alloc_info+0x40/0x58 [ 26.540476] __kasan_kmalloc+0xd4/0xd8 [ 26.540512] __kmalloc_cache_noprof+0x16c/0x3c0 [ 26.540552] krealloc_uaf+0xc8/0x520 [ 26.540989] kunit_try_run_case+0x170/0x3f0 [ 26.541294] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.541485] kthread+0x328/0x630 [ 26.541871] ret_from_fork+0x10/0x20 [ 26.541993] [ 26.542119] Freed by task 176: [ 26.542321] kasan_save_stack+0x3c/0x68 [ 26.542367] kasan_save_track+0x20/0x40 [ 26.542788] kasan_save_free_info+0x4c/0x78 [ 26.542929] __kasan_slab_free+0x6c/0x98 [ 26.543073] kfree+0x214/0x3c8 [ 26.543308] krealloc_uaf+0x12c/0x520 [ 26.543540] kunit_try_run_case+0x170/0x3f0 [ 26.543665] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.543805] kthread+0x328/0x630 [ 26.544041] ret_from_fork+0x10/0x20 [ 26.544092] [ 26.544114] The buggy address belongs to the object at fff00000c470f800 [ 26.544114] which belongs to the cache kmalloc-256 of size 256 [ 26.544676] The buggy address is located 0 bytes inside of [ 26.544676] freed 256-byte region [fff00000c470f800, fff00000c470f900) [ 26.544930] [ 26.544977] The buggy address belongs to the physical page: [ 26.545072] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10470e [ 26.545126] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.545370] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.545725] page_type: f5(slab) [ 26.546079] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 26.546139] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.546352] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 26.546622] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.546760] head: 0bfffe0000000001 ffffc1ffc311c381 00000000ffffffff 00000000ffffffff [ 26.546871] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.546912] page dumped because: kasan: bad access detected [ 26.546944] [ 26.546963] Memory state around the buggy address: [ 26.547002] fff00000c470f700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.547058] fff00000c470f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.547106] >fff00000c470f800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.547151] ^ [ 26.547177] fff00000c470f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.547225] fff00000c470f900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.547271] ==================================================================
[ 21.764096] ================================================================== [ 21.764856] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 21.765124] Read of size 1 at addr ffff888100a8e000 by task kunit_try_catch/193 [ 21.765589] [ 21.765683] CPU: 1 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) [ 21.765735] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.765748] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.765767] Call Trace: [ 21.765779] <TASK> [ 21.765793] dump_stack_lvl+0x73/0xb0 [ 21.765820] print_report+0xd1/0x650 [ 21.765851] ? __virt_addr_valid+0x1db/0x2d0 [ 21.765874] ? krealloc_uaf+0x1b8/0x5e0 [ 21.765893] ? kasan_complete_mode_report_info+0x64/0x200 [ 21.765917] ? krealloc_uaf+0x1b8/0x5e0 [ 21.765969] kasan_report+0x141/0x180 [ 21.765991] ? krealloc_uaf+0x1b8/0x5e0 [ 21.766027] ? krealloc_uaf+0x1b8/0x5e0 [ 21.766047] __kasan_check_byte+0x3d/0x50 [ 21.766081] krealloc_noprof+0x3f/0x340 [ 21.766128] krealloc_uaf+0x1b8/0x5e0 [ 21.766147] ? __pfx_krealloc_uaf+0x10/0x10 [ 21.766166] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 21.766192] ? __pfx_krealloc_uaf+0x10/0x10 [ 21.766216] kunit_try_run_case+0x1a5/0x480 [ 21.766239] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.766260] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.766279] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.766304] ? __kthread_parkme+0x82/0x180 [ 21.766323] ? preempt_count_sub+0x50/0x80 [ 21.766344] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.766367] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.766388] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.766409] kthread+0x337/0x6f0 [ 21.766427] ? trace_preempt_on+0x20/0xc0 [ 21.766448] ? __pfx_kthread+0x10/0x10 [ 21.766467] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.766488] ? calculate_sigpending+0x7b/0xa0 [ 21.766528] ? __pfx_kthread+0x10/0x10 [ 21.766547] ret_from_fork+0x116/0x1d0 [ 21.766566] ? __pfx_kthread+0x10/0x10 [ 21.766585] ret_from_fork_asm+0x1a/0x30 [ 21.766629] </TASK> [ 21.766639] [ 21.777322] Allocated by task 193: [ 21.777719] kasan_save_stack+0x45/0x70 [ 21.777882] kasan_save_track+0x18/0x40 [ 21.778353] kasan_save_alloc_info+0x3b/0x50 [ 21.778710] __kasan_kmalloc+0xb7/0xc0 [ 21.779036] __kmalloc_cache_noprof+0x189/0x420 [ 21.779326] krealloc_uaf+0xbb/0x5e0 [ 21.779485] kunit_try_run_case+0x1a5/0x480 [ 21.779696] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.780223] kthread+0x337/0x6f0 [ 21.780469] ret_from_fork+0x116/0x1d0 [ 21.780764] ret_from_fork_asm+0x1a/0x30 [ 21.781135] [ 21.781213] Freed by task 193: [ 21.781619] kasan_save_stack+0x45/0x70 [ 21.781773] kasan_save_track+0x18/0x40 [ 21.781967] kasan_save_free_info+0x3f/0x60 [ 21.782198] __kasan_slab_free+0x56/0x70 [ 21.782583] kfree+0x222/0x3f0 [ 21.782865] krealloc_uaf+0x13d/0x5e0 [ 21.783181] kunit_try_run_case+0x1a5/0x480 [ 21.783398] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.783747] kthread+0x337/0x6f0 [ 21.783992] ret_from_fork+0x116/0x1d0 [ 21.784239] ret_from_fork_asm+0x1a/0x30 [ 21.784583] [ 21.784659] The buggy address belongs to the object at ffff888100a8e000 [ 21.784659] which belongs to the cache kmalloc-256 of size 256 [ 21.785529] The buggy address is located 0 bytes inside of [ 21.785529] freed 256-byte region [ffff888100a8e000, ffff888100a8e100) [ 21.786066] [ 21.786252] The buggy address belongs to the physical page: [ 21.786470] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a8e [ 21.787126] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.787673] anon flags: 0x200000000000040(head|node=0|zone=2) [ 21.788083] page_type: f5(slab) [ 21.788337] raw: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 21.788913] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.789363] head: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 21.789800] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.790325] head: 0200000000000001 ffffea000402a381 00000000ffffffff 00000000ffffffff [ 21.790632] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.791129] page dumped because: kasan: bad access detected [ 21.791482] [ 21.791618] Memory state around the buggy address: [ 21.791868] ffff888100a8df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.792449] ffff888100a8df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.792799] >ffff888100a8e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.793314] ^ [ 21.793513] ffff888100a8e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.794042] ffff888100a8e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.794378] ================================================================== [ 21.795174] ================================================================== [ 21.795488] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 21.795782] Read of size 1 at addr ffff888100a8e000 by task kunit_try_catch/193 [ 21.796091] [ 21.796230] CPU: 1 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) [ 21.796674] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.796687] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.796706] Call Trace: [ 21.796720] <TASK> [ 21.796735] dump_stack_lvl+0x73/0xb0 [ 21.796760] print_report+0xd1/0x650 [ 21.796780] ? __virt_addr_valid+0x1db/0x2d0 [ 21.796801] ? krealloc_uaf+0x53c/0x5e0 [ 21.796820] ? kasan_complete_mode_report_info+0x64/0x200 [ 21.796843] ? krealloc_uaf+0x53c/0x5e0 [ 21.796862] kasan_report+0x141/0x180 [ 21.796882] ? krealloc_uaf+0x53c/0x5e0 [ 21.796905] __asan_report_load1_noabort+0x18/0x20 [ 21.796927] krealloc_uaf+0x53c/0x5e0 [ 21.796957] ? __pfx_krealloc_uaf+0x10/0x10 [ 21.796977] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 21.797013] ? __pfx_krealloc_uaf+0x10/0x10 [ 21.797036] kunit_try_run_case+0x1a5/0x480 [ 21.797058] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.797079] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.797098] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.797129] ? __kthread_parkme+0x82/0x180 [ 21.797147] ? preempt_count_sub+0x50/0x80 [ 21.797169] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.797191] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.797212] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.797234] kthread+0x337/0x6f0 [ 21.797251] ? trace_preempt_on+0x20/0xc0 [ 21.797273] ? __pfx_kthread+0x10/0x10 [ 21.797292] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.797313] ? calculate_sigpending+0x7b/0xa0 [ 21.797335] ? __pfx_kthread+0x10/0x10 [ 21.797355] ret_from_fork+0x116/0x1d0 [ 21.797372] ? __pfx_kthread+0x10/0x10 [ 21.797391] ret_from_fork_asm+0x1a/0x30 [ 21.797419] </TASK> [ 21.797428] [ 21.805934] Allocated by task 193: [ 21.806340] kasan_save_stack+0x45/0x70 [ 21.806530] kasan_save_track+0x18/0x40 [ 21.806769] kasan_save_alloc_info+0x3b/0x50 [ 21.807045] __kasan_kmalloc+0xb7/0xc0 [ 21.807514] __kmalloc_cache_noprof+0x189/0x420 [ 21.807745] krealloc_uaf+0xbb/0x5e0 [ 21.807992] kunit_try_run_case+0x1a5/0x480 [ 21.808395] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.808669] kthread+0x337/0x6f0 [ 21.808786] ret_from_fork+0x116/0x1d0 [ 21.809212] ret_from_fork_asm+0x1a/0x30 [ 21.809458] [ 21.809542] Freed by task 193: [ 21.809648] kasan_save_stack+0x45/0x70 [ 21.809835] kasan_save_track+0x18/0x40 [ 21.810058] kasan_save_free_info+0x3f/0x60 [ 21.810566] __kasan_slab_free+0x56/0x70 [ 21.810748] kfree+0x222/0x3f0 [ 21.811021] krealloc_uaf+0x13d/0x5e0 [ 21.811399] kunit_try_run_case+0x1a5/0x480 [ 21.811652] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.812018] kthread+0x337/0x6f0 [ 21.812177] ret_from_fork+0x116/0x1d0 [ 21.812584] ret_from_fork_asm+0x1a/0x30 [ 21.812737] [ 21.812983] The buggy address belongs to the object at ffff888100a8e000 [ 21.812983] which belongs to the cache kmalloc-256 of size 256 [ 21.813646] The buggy address is located 0 bytes inside of [ 21.813646] freed 256-byte region [ffff888100a8e000, ffff888100a8e100) [ 21.814444] [ 21.814581] The buggy address belongs to the physical page: [ 21.814787] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a8e [ 21.815184] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.815494] anon flags: 0x200000000000040(head|node=0|zone=2) [ 21.816097] page_type: f5(slab) [ 21.816243] raw: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 21.816698] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.817208] head: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 21.817664] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.818075] head: 0200000000000001 ffffea000402a381 00000000ffffffff 00000000ffffffff [ 21.818344] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.818917] page dumped because: kasan: bad access detected [ 21.819164] [ 21.819412] Memory state around the buggy address: [ 21.819582] ffff888100a8df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.820006] ffff888100a8df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.820457] >ffff888100a8e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.820809] ^ [ 21.821110] ffff888100a8e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.821512] ffff888100a8e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.822061] ==================================================================