Date
July 4, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.532512] ================================================================== [ 29.532605] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 29.532658] Read of size 1 at addr fff00000c907f200 by task kunit_try_catch/197 [ 29.532707] [ 29.532739] CPU: 0 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT [ 29.532829] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.532855] Hardware name: linux,dummy-virt (DT) [ 29.532885] Call trace: [ 29.533217] show_stack+0x20/0x38 (C) [ 29.533378] dump_stack_lvl+0x8c/0xd0 [ 29.533425] print_report+0x118/0x608 [ 29.533679] kasan_report+0xdc/0x128 [ 29.533818] __kasan_check_byte+0x54/0x70 [ 29.533868] krealloc_noprof+0x44/0x360 [ 29.534043] krealloc_uaf+0x180/0x520 [ 29.534093] kunit_try_run_case+0x170/0x3f0 [ 29.534153] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.534407] kthread+0x328/0x630 [ 29.534591] ret_from_fork+0x10/0x20 [ 29.534804] [ 29.534906] Allocated by task 197: [ 29.534980] kasan_save_stack+0x3c/0x68 [ 29.535268] kasan_save_track+0x20/0x40 [ 29.535370] kasan_save_alloc_info+0x40/0x58 [ 29.535498] __kasan_kmalloc+0xd4/0xd8 [ 29.535654] __kmalloc_cache_noprof+0x16c/0x3c0 [ 29.535784] krealloc_uaf+0xc8/0x520 [ 29.535846] kunit_try_run_case+0x170/0x3f0 [ 29.536137] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.536243] kthread+0x328/0x630 [ 29.536342] ret_from_fork+0x10/0x20 [ 29.536413] [ 29.536643] Freed by task 197: [ 29.536999] kasan_save_stack+0x3c/0x68 [ 29.537147] kasan_save_track+0x20/0x40 [ 29.537308] kasan_save_free_info+0x4c/0x78 [ 29.537471] __kasan_slab_free+0x6c/0x98 [ 29.537550] kfree+0x214/0x3c8 [ 29.537641] krealloc_uaf+0x12c/0x520 [ 29.537691] kunit_try_run_case+0x170/0x3f0 [ 29.537830] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.537882] kthread+0x328/0x630 [ 29.537926] ret_from_fork+0x10/0x20 [ 29.537980] [ 29.538004] The buggy address belongs to the object at fff00000c907f200 [ 29.538004] which belongs to the cache kmalloc-256 of size 256 [ 29.538241] The buggy address is located 0 bytes inside of [ 29.538241] freed 256-byte region [fff00000c907f200, fff00000c907f300) [ 29.538531] [ 29.538655] The buggy address belongs to the physical page: [ 29.538815] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c907ea00 pfn:0x10907e [ 29.538890] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.538976] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.539068] page_type: f5(slab) [ 29.539116] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 29.539175] raw: fff00000c907ea00 000000008010000f 00000000f5000000 0000000000000000 [ 29.539229] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 29.539285] head: fff00000c907ea00 000000008010000f 00000000f5000000 0000000000000000 [ 29.539333] head: 0bfffe0000000001 ffffc1ffc3241f81 00000000ffffffff 00000000ffffffff [ 29.539389] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 29.539428] page dumped because: kasan: bad access detected [ 29.539487] [ 29.539526] Memory state around the buggy address: [ 29.539557] fff00000c907f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.539598] fff00000c907f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.539639] >fff00000c907f200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.539683] ^ [ 29.539711] fff00000c907f280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.539763] fff00000c907f300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.539801] ================================================================== [ 29.541492] ================================================================== [ 29.541752] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 29.541814] Read of size 1 at addr fff00000c907f200 by task kunit_try_catch/197 [ 29.541959] [ 29.541990] CPU: 0 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT [ 29.542216] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.542422] Hardware name: linux,dummy-virt (DT) [ 29.542546] Call trace: [ 29.542637] show_stack+0x20/0x38 (C) [ 29.542728] dump_stack_lvl+0x8c/0xd0 [ 29.542916] print_report+0x118/0x608 [ 29.543089] kasan_report+0xdc/0x128 [ 29.543227] __asan_report_load1_noabort+0x20/0x30 [ 29.543485] krealloc_uaf+0x4c8/0x520 [ 29.543664] kunit_try_run_case+0x170/0x3f0 [ 29.543841] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.543992] kthread+0x328/0x630 [ 29.544212] ret_from_fork+0x10/0x20 [ 29.544373] [ 29.544394] Allocated by task 197: [ 29.544422] kasan_save_stack+0x3c/0x68 [ 29.544651] kasan_save_track+0x20/0x40 [ 29.544821] kasan_save_alloc_info+0x40/0x58 [ 29.544932] __kasan_kmalloc+0xd4/0xd8 [ 29.545095] __kmalloc_cache_noprof+0x16c/0x3c0 [ 29.545257] krealloc_uaf+0xc8/0x520 [ 29.545356] kunit_try_run_case+0x170/0x3f0 [ 29.545439] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.545802] kthread+0x328/0x630 [ 29.545966] ret_from_fork+0x10/0x20 [ 29.546054] [ 29.546143] Freed by task 197: [ 29.546274] kasan_save_stack+0x3c/0x68 [ 29.546380] kasan_save_track+0x20/0x40 [ 29.546506] kasan_save_free_info+0x4c/0x78 [ 29.546780] __kasan_slab_free+0x6c/0x98 [ 29.546834] kfree+0x214/0x3c8 [ 29.546867] krealloc_uaf+0x12c/0x520 [ 29.546915] kunit_try_run_case+0x170/0x3f0 [ 29.546953] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.547023] kthread+0x328/0x630 [ 29.547171] ret_from_fork+0x10/0x20 [ 29.547296] [ 29.547470] The buggy address belongs to the object at fff00000c907f200 [ 29.547470] which belongs to the cache kmalloc-256 of size 256 [ 29.547670] The buggy address is located 0 bytes inside of [ 29.547670] freed 256-byte region [fff00000c907f200, fff00000c907f300) [ 29.547842] [ 29.548272] The buggy address belongs to the physical page: [ 29.548342] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c907ea00 pfn:0x10907e [ 29.548471] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.548518] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.548568] page_type: f5(slab) [ 29.548615] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 29.548663] raw: fff00000c907ea00 000000008010000f 00000000f5000000 0000000000000000 [ 29.548712] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 29.548759] head: fff00000c907ea00 000000008010000f 00000000f5000000 0000000000000000 [ 29.548823] head: 0bfffe0000000001 ffffc1ffc3241f81 00000000ffffffff 00000000ffffffff [ 29.548879] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 29.548948] page dumped because: kasan: bad access detected [ 29.549233] [ 29.549280] Memory state around the buggy address: [ 29.549376] fff00000c907f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.549420] fff00000c907f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.549766] >fff00000c907f200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.549810] ^ [ 29.549840] fff00000c907f280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.550026] fff00000c907f300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.550069] ==================================================================
[ 24.852939] ================================================================== [ 24.853292] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 24.853856] Read of size 1 at addr ffff888105d7ea00 by task kunit_try_catch/213 [ 24.854177] [ 24.854323] CPU: 0 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT(voluntary) [ 24.854378] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.854406] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.854431] Call Trace: [ 24.854453] <TASK> [ 24.854474] dump_stack_lvl+0x73/0xb0 [ 24.854506] print_report+0xd1/0x650 [ 24.854531] ? __virt_addr_valid+0x1db/0x2d0 [ 24.854557] ? krealloc_uaf+0x53c/0x5e0 [ 24.854581] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.854610] ? krealloc_uaf+0x53c/0x5e0 [ 24.854634] kasan_report+0x141/0x180 [ 24.854833] ? krealloc_uaf+0x53c/0x5e0 [ 24.854876] __asan_report_load1_noabort+0x18/0x20 [ 24.854904] krealloc_uaf+0x53c/0x5e0 [ 24.854928] ? __pfx_krealloc_uaf+0x10/0x10 [ 24.854953] ? __kasan_check_write+0x18/0x20 [ 24.854979] ? queued_spin_lock_slowpath+0x116/0xb40 [ 24.855007] ? irqentry_exit+0x2a/0x60 [ 24.855033] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 24.855062] ? trace_hardirqs_on+0x37/0xe0 [ 24.855089] ? __pfx_read_tsc+0x10/0x10 [ 24.855114] ? ktime_get_ts64+0x86/0x230 [ 24.855153] kunit_try_run_case+0x1a5/0x480 [ 24.855184] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.855212] ? queued_spin_lock_slowpath+0x116/0xb40 [ 24.855239] ? __kthread_parkme+0x82/0x180 [ 24.855262] ? preempt_count_sub+0x50/0x80 [ 24.855289] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.855318] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.855345] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.855373] kthread+0x337/0x6f0 [ 24.855411] ? trace_preempt_on+0x20/0xc0 [ 24.855436] ? __pfx_kthread+0x10/0x10 [ 24.855459] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.855485] ? calculate_sigpending+0x7b/0xa0 [ 24.855512] ? __pfx_kthread+0x10/0x10 [ 24.855537] ret_from_fork+0x116/0x1d0 [ 24.855559] ? __pfx_kthread+0x10/0x10 [ 24.855582] ret_from_fork_asm+0x1a/0x30 [ 24.855619] </TASK> [ 24.855632] [ 24.864785] Allocated by task 213: [ 24.864937] kasan_save_stack+0x45/0x70 [ 24.865133] kasan_save_track+0x18/0x40 [ 24.865403] kasan_save_alloc_info+0x3b/0x50 [ 24.865637] __kasan_kmalloc+0xb7/0xc0 [ 24.866005] __kmalloc_cache_noprof+0x189/0x420 [ 24.866488] krealloc_uaf+0xbb/0x5e0 [ 24.866718] kunit_try_run_case+0x1a5/0x480 [ 24.866975] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.867209] kthread+0x337/0x6f0 [ 24.867420] ret_from_fork+0x116/0x1d0 [ 24.867599] ret_from_fork_asm+0x1a/0x30 [ 24.867783] [ 24.867871] Freed by task 213: [ 24.868068] kasan_save_stack+0x45/0x70 [ 24.868255] kasan_save_track+0x18/0x40 [ 24.868414] kasan_save_free_info+0x3f/0x60 [ 24.868575] __kasan_slab_free+0x56/0x70 [ 24.868725] kfree+0x222/0x3f0 [ 24.868895] krealloc_uaf+0x13d/0x5e0 [ 24.869269] kunit_try_run_case+0x1a5/0x480 [ 24.869696] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.870062] kthread+0x337/0x6f0 [ 24.870641] ret_from_fork+0x116/0x1d0 [ 24.870845] ret_from_fork_asm+0x1a/0x30 [ 24.871041] [ 24.871145] The buggy address belongs to the object at ffff888105d7ea00 [ 24.871145] which belongs to the cache kmalloc-256 of size 256 [ 24.871722] The buggy address is located 0 bytes inside of [ 24.871722] freed 256-byte region [ffff888105d7ea00, ffff888105d7eb00) [ 24.872270] [ 24.872378] The buggy address belongs to the physical page: [ 24.872726] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105d7e [ 24.873120] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.873539] flags: 0x200000000000040(head|node=0|zone=2) [ 24.873750] page_type: f5(slab) [ 24.873885] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.874154] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.874554] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.874949] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.875739] head: 0200000000000001 ffffea0004175f81 00000000ffffffff 00000000ffffffff [ 24.876305] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.876673] page dumped because: kasan: bad access detected [ 24.876919] [ 24.877026] Memory state around the buggy address: [ 24.877381] ffff888105d7e900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.877654] ffff888105d7e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.877898] >ffff888105d7ea00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.878218] ^ [ 24.878414] ffff888105d7ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.878776] ffff888105d7eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.879341] ================================================================== [ 24.810620] ================================================================== [ 24.811131] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 24.811715] Read of size 1 at addr ffff888105d7ea00 by task kunit_try_catch/213 [ 24.812061] [ 24.812364] CPU: 0 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT(voluntary) [ 24.812439] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.812453] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.812478] Call Trace: [ 24.812493] <TASK> [ 24.812514] dump_stack_lvl+0x73/0xb0 [ 24.812548] print_report+0xd1/0x650 [ 24.812572] ? __virt_addr_valid+0x1db/0x2d0 [ 24.812599] ? krealloc_uaf+0x1b8/0x5e0 [ 24.812621] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.812649] ? krealloc_uaf+0x1b8/0x5e0 [ 24.812671] kasan_report+0x141/0x180 [ 24.812695] ? krealloc_uaf+0x1b8/0x5e0 [ 24.812720] ? krealloc_uaf+0x1b8/0x5e0 [ 24.812742] __kasan_check_byte+0x3d/0x50 [ 24.812765] krealloc_noprof+0x3f/0x340 [ 24.812794] krealloc_uaf+0x1b8/0x5e0 [ 24.812817] ? __pfx_krealloc_uaf+0x10/0x10 [ 24.812840] ? __kasan_check_write+0x18/0x20 [ 24.812864] ? queued_spin_lock_slowpath+0x116/0xb40 [ 24.812891] ? irqentry_exit+0x2a/0x60 [ 24.812916] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 24.812943] ? trace_hardirqs_on+0x37/0xe0 [ 24.812970] ? __pfx_read_tsc+0x10/0x10 [ 24.812994] ? ktime_get_ts64+0x86/0x230 [ 24.813023] kunit_try_run_case+0x1a5/0x480 [ 24.813052] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.813080] ? queued_spin_lock_slowpath+0x116/0xb40 [ 24.813105] ? __kthread_parkme+0x82/0x180 [ 24.813129] ? preempt_count_sub+0x50/0x80 [ 24.813155] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.813182] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.813208] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.813234] kthread+0x337/0x6f0 [ 24.813256] ? trace_preempt_on+0x20/0xc0 [ 24.813279] ? __pfx_kthread+0x10/0x10 [ 24.813301] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.813325] ? calculate_sigpending+0x7b/0xa0 [ 24.813351] ? __pfx_kthread+0x10/0x10 [ 24.813374] ret_from_fork+0x116/0x1d0 [ 24.813405] ? __pfx_kthread+0x10/0x10 [ 24.813427] ret_from_fork_asm+0x1a/0x30 [ 24.813461] </TASK> [ 24.813475] [ 24.828757] Allocated by task 213: [ 24.829410] kasan_save_stack+0x45/0x70 [ 24.829826] kasan_save_track+0x18/0x40 [ 24.830225] kasan_save_alloc_info+0x3b/0x50 [ 24.830500] __kasan_kmalloc+0xb7/0xc0 [ 24.830650] __kmalloc_cache_noprof+0x189/0x420 [ 24.830814] krealloc_uaf+0xbb/0x5e0 [ 24.831292] kunit_try_run_case+0x1a5/0x480 [ 24.831738] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.832411] kthread+0x337/0x6f0 [ 24.832803] ret_from_fork+0x116/0x1d0 [ 24.833258] ret_from_fork_asm+0x1a/0x30 [ 24.833664] [ 24.833835] Freed by task 213: [ 24.834327] kasan_save_stack+0x45/0x70 [ 24.834614] kasan_save_track+0x18/0x40 [ 24.834759] kasan_save_free_info+0x3f/0x60 [ 24.834985] __kasan_slab_free+0x56/0x70 [ 24.835490] kfree+0x222/0x3f0 [ 24.835810] krealloc_uaf+0x13d/0x5e0 [ 24.836273] kunit_try_run_case+0x1a5/0x480 [ 24.836706] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.837258] kthread+0x337/0x6f0 [ 24.837509] ret_from_fork+0x116/0x1d0 [ 24.837659] ret_from_fork_asm+0x1a/0x30 [ 24.837805] [ 24.837879] The buggy address belongs to the object at ffff888105d7ea00 [ 24.837879] which belongs to the cache kmalloc-256 of size 256 [ 24.838741] The buggy address is located 0 bytes inside of [ 24.838741] freed 256-byte region [ffff888105d7ea00, ffff888105d7eb00) [ 24.840037] [ 24.840231] The buggy address belongs to the physical page: [ 24.840848] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105d7e [ 24.841858] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.842825] flags: 0x200000000000040(head|node=0|zone=2) [ 24.843509] page_type: f5(slab) [ 24.843716] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.844155] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.844933] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.845623] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.845894] head: 0200000000000001 ffffea0004175f81 00000000ffffffff 00000000ffffffff [ 24.846810] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.847736] page dumped because: kasan: bad access detected [ 24.848350] [ 24.848489] Memory state around the buggy address: [ 24.848662] ffff888105d7e900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.848917] ffff888105d7e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.849642] >ffff888105d7ea00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.850417] ^ [ 24.850920] ffff888105d7ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.851702] ffff888105d7eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.852304] ==================================================================