Date
July 8, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.075984] ================================================================== [ 31.076051] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 31.076105] Read of size 1 at addr fff00000c91e0600 by task kunit_try_catch/195 [ 31.076153] [ 31.076186] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 31.076286] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.076311] Hardware name: linux,dummy-virt (DT) [ 31.076342] Call trace: [ 31.076378] show_stack+0x20/0x38 (C) [ 31.076430] dump_stack_lvl+0x8c/0xd0 [ 31.076538] print_report+0x118/0x5d0 [ 31.076643] kasan_report+0xdc/0x128 [ 31.076691] __kasan_check_byte+0x54/0x70 [ 31.076782] krealloc_noprof+0x44/0x360 [ 31.076831] krealloc_uaf+0x180/0x520 [ 31.076887] kunit_try_run_case+0x170/0x3f0 [ 31.076937] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.077088] kthread+0x328/0x630 [ 31.077180] ret_from_fork+0x10/0x20 [ 31.077287] [ 31.077369] Allocated by task 195: [ 31.077400] kasan_save_stack+0x3c/0x68 [ 31.077443] kasan_save_track+0x20/0x40 [ 31.077481] kasan_save_alloc_info+0x40/0x58 [ 31.077517] __kasan_kmalloc+0xd4/0xd8 [ 31.077563] __kmalloc_cache_noprof+0x16c/0x3c0 [ 31.077602] krealloc_uaf+0xc8/0x520 [ 31.077638] kunit_try_run_case+0x170/0x3f0 [ 31.077717] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.077771] kthread+0x328/0x630 [ 31.077803] ret_from_fork+0x10/0x20 [ 31.077838] [ 31.077857] Freed by task 195: [ 31.077882] kasan_save_stack+0x3c/0x68 [ 31.077920] kasan_save_track+0x20/0x40 [ 31.077956] kasan_save_free_info+0x4c/0x78 [ 31.077992] __kasan_slab_free+0x6c/0x98 [ 31.078029] kfree+0x214/0x3c8 [ 31.078062] krealloc_uaf+0x12c/0x520 [ 31.078120] kunit_try_run_case+0x170/0x3f0 [ 31.078159] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.078225] kthread+0x328/0x630 [ 31.078316] ret_from_fork+0x10/0x20 [ 31.078351] [ 31.078370] The buggy address belongs to the object at fff00000c91e0600 [ 31.078370] which belongs to the cache kmalloc-256 of size 256 [ 31.078473] The buggy address is located 0 bytes inside of [ 31.078473] freed 256-byte region [fff00000c91e0600, fff00000c91e0700) [ 31.078535] [ 31.078781] The buggy address belongs to the physical page: [ 31.078949] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c91e0000 pfn:0x1091e0 [ 31.079015] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.079061] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.079202] page_type: f5(slab) [ 31.079402] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 31.079499] raw: fff00000c91e0000 000000008010000f 00000000f5000000 0000000000000000 [ 31.079548] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 31.079595] head: fff00000c91e0000 000000008010000f 00000000f5000000 0000000000000000 [ 31.080008] head: 0bfffe0000000001 ffffc1ffc3247801 00000000ffffffff 00000000ffffffff [ 31.080126] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 31.080194] page dumped because: kasan: bad access detected [ 31.080276] [ 31.080361] Memory state around the buggy address: [ 31.080393] fff00000c91e0500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.080441] fff00000c91e0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.080482] >fff00000c91e0600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.080519] ^ [ 31.080547] fff00000c91e0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.080595] fff00000c91e0700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.080631] ================================================================== [ 31.081987] ================================================================== [ 31.082036] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 31.082084] Read of size 1 at addr fff00000c91e0600 by task kunit_try_catch/195 [ 31.082136] [ 31.082166] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 31.082278] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.082305] Hardware name: linux,dummy-virt (DT) [ 31.082335] Call trace: [ 31.082424] show_stack+0x20/0x38 (C) [ 31.082538] dump_stack_lvl+0x8c/0xd0 [ 31.082587] print_report+0x118/0x5d0 [ 31.083198] kasan_report+0xdc/0x128 [ 31.083417] __asan_report_load1_noabort+0x20/0x30 [ 31.083498] krealloc_uaf+0x4c8/0x520 [ 31.083737] kunit_try_run_case+0x170/0x3f0 [ 31.083786] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.083846] kthread+0x328/0x630 [ 31.083976] ret_from_fork+0x10/0x20 [ 31.084070] [ 31.084139] Allocated by task 195: [ 31.084224] kasan_save_stack+0x3c/0x68 [ 31.084266] kasan_save_track+0x20/0x40 [ 31.084303] kasan_save_alloc_info+0x40/0x58 [ 31.084339] __kasan_kmalloc+0xd4/0xd8 [ 31.084382] __kmalloc_cache_noprof+0x16c/0x3c0 [ 31.084532] krealloc_uaf+0xc8/0x520 [ 31.084892] kunit_try_run_case+0x170/0x3f0 [ 31.085227] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.085278] kthread+0x328/0x630 [ 31.085310] ret_from_fork+0x10/0x20 [ 31.085345] [ 31.085431] Freed by task 195: [ 31.085553] kasan_save_stack+0x3c/0x68 [ 31.085771] kasan_save_track+0x20/0x40 [ 31.085819] kasan_save_free_info+0x4c/0x78 [ 31.085854] __kasan_slab_free+0x6c/0x98 [ 31.085955] kfree+0x214/0x3c8 [ 31.085994] krealloc_uaf+0x12c/0x520 [ 31.086030] kunit_try_run_case+0x170/0x3f0 [ 31.086427] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.086474] kthread+0x328/0x630 [ 31.086576] ret_from_fork+0x10/0x20 [ 31.086611] [ 31.086630] The buggy address belongs to the object at fff00000c91e0600 [ 31.086630] which belongs to the cache kmalloc-256 of size 256 [ 31.086945] The buggy address is located 0 bytes inside of [ 31.086945] freed 256-byte region [fff00000c91e0600, fff00000c91e0700) [ 31.087039] [ 31.087059] The buggy address belongs to the physical page: [ 31.087109] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c91e0000 pfn:0x1091e0 [ 31.087279] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.087477] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.087629] page_type: f5(slab) [ 31.087667] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 31.087716] raw: fff00000c91e0000 000000008010000f 00000000f5000000 0000000000000000 [ 31.087770] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 31.087818] head: fff00000c91e0000 000000008010000f 00000000f5000000 0000000000000000 [ 31.087904] head: 0bfffe0000000001 ffffc1ffc3247801 00000000ffffffff 00000000ffffffff [ 31.088220] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 31.088428] page dumped because: kasan: bad access detected [ 31.088459] [ 31.088477] Memory state around the buggy address: [ 31.088554] fff00000c91e0500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.088602] fff00000c91e0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.088644] >fff00000c91e0600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.088835] ^ [ 31.089041] fff00000c91e0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.089086] fff00000c91e0700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.089122] ==================================================================
[ 23.298096] ================================================================== [ 23.298615] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 23.298912] Read of size 1 at addr ffff888105653200 by task kunit_try_catch/212 [ 23.299381] [ 23.299499] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 23.299553] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.299566] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.299590] Call Trace: [ 23.299605] <TASK> [ 23.299626] dump_stack_lvl+0x73/0xb0 [ 23.299659] print_report+0xd1/0x610 [ 23.299684] ? __virt_addr_valid+0x1db/0x2d0 [ 23.299709] ? krealloc_uaf+0x1b8/0x5e0 [ 23.299731] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.299760] ? krealloc_uaf+0x1b8/0x5e0 [ 23.299784] kasan_report+0x141/0x180 [ 23.299806] ? krealloc_uaf+0x1b8/0x5e0 [ 23.299832] ? krealloc_uaf+0x1b8/0x5e0 [ 23.299854] __kasan_check_byte+0x3d/0x50 [ 23.299979] krealloc_noprof+0x3f/0x340 [ 23.300014] krealloc_uaf+0x1b8/0x5e0 [ 23.300037] ? __pfx_krealloc_uaf+0x10/0x10 [ 23.300059] ? finish_task_switch.isra.0+0x153/0x700 [ 23.300083] ? __switch_to+0x47/0xf50 [ 23.300113] ? __schedule+0x10cc/0x2b60 [ 23.300142] ? __pfx_read_tsc+0x10/0x10 [ 23.300167] ? ktime_get_ts64+0x86/0x230 [ 23.300195] kunit_try_run_case+0x1a5/0x480 [ 23.300219] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.300254] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.300276] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.300305] ? __kthread_parkme+0x82/0x180 [ 23.300326] ? preempt_count_sub+0x50/0x80 [ 23.300349] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.300371] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.300398] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.300425] kthread+0x337/0x6f0 [ 23.300446] ? trace_preempt_on+0x20/0xc0 [ 23.300471] ? __pfx_kthread+0x10/0x10 [ 23.300494] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.300521] ? calculate_sigpending+0x7b/0xa0 [ 23.300549] ? __pfx_kthread+0x10/0x10 [ 23.300572] ret_from_fork+0x116/0x1d0 [ 23.300592] ? __pfx_kthread+0x10/0x10 [ 23.300614] ret_from_fork_asm+0x1a/0x30 [ 23.300648] </TASK> [ 23.300661] [ 23.307820] Allocated by task 212: [ 23.307951] kasan_save_stack+0x45/0x70 [ 23.308416] kasan_save_track+0x18/0x40 [ 23.308616] kasan_save_alloc_info+0x3b/0x50 [ 23.308824] __kasan_kmalloc+0xb7/0xc0 [ 23.309008] __kmalloc_cache_noprof+0x189/0x420 [ 23.309284] krealloc_uaf+0xbb/0x5e0 [ 23.309461] kunit_try_run_case+0x1a5/0x480 [ 23.309730] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.310088] kthread+0x337/0x6f0 [ 23.310234] ret_from_fork+0x116/0x1d0 [ 23.310392] ret_from_fork_asm+0x1a/0x30 [ 23.310580] [ 23.310648] Freed by task 212: [ 23.310874] kasan_save_stack+0x45/0x70 [ 23.311031] kasan_save_track+0x18/0x40 [ 23.311158] kasan_save_free_info+0x3f/0x60 [ 23.311310] __kasan_slab_free+0x56/0x70 [ 23.311442] kfree+0x222/0x3f0 [ 23.311555] krealloc_uaf+0x13d/0x5e0 [ 23.311704] kunit_try_run_case+0x1a5/0x480 [ 23.311894] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.312136] kthread+0x337/0x6f0 [ 23.312304] ret_from_fork+0x116/0x1d0 [ 23.312485] ret_from_fork_asm+0x1a/0x30 [ 23.312887] [ 23.312965] The buggy address belongs to the object at ffff888105653200 [ 23.312965] which belongs to the cache kmalloc-256 of size 256 [ 23.313404] The buggy address is located 0 bytes inside of [ 23.313404] freed 256-byte region [ffff888105653200, ffff888105653300) [ 23.314390] [ 23.314493] The buggy address belongs to the physical page: [ 23.314747] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105652 [ 23.315102] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.315383] flags: 0x200000000000040(head|node=0|zone=2) [ 23.315558] page_type: f5(slab) [ 23.315677] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 23.316139] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.316488] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 23.316954] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.317313] head: 0200000000000001 ffffea0004159481 00000000ffffffff 00000000ffffffff [ 23.317610] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 23.318119] page dumped because: kasan: bad access detected [ 23.318358] [ 23.318449] Memory state around the buggy address: [ 23.318617] ffff888105653100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.318826] ffff888105653180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.319031] >ffff888105653200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.319246] ^ [ 23.319477] ffff888105653280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.319788] ffff888105653300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.320087] ================================================================== [ 23.320756] ================================================================== [ 23.321129] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 23.321448] Read of size 1 at addr ffff888105653200 by task kunit_try_catch/212 [ 23.321666] [ 23.321792] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 23.321846] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.321858] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.321880] Call Trace: [ 23.321894] <TASK> [ 23.321913] dump_stack_lvl+0x73/0xb0 [ 23.321944] print_report+0xd1/0x610 [ 23.321968] ? __virt_addr_valid+0x1db/0x2d0 [ 23.321993] ? krealloc_uaf+0x53c/0x5e0 [ 23.322015] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.322043] ? krealloc_uaf+0x53c/0x5e0 [ 23.322067] kasan_report+0x141/0x180 [ 23.322090] ? krealloc_uaf+0x53c/0x5e0 [ 23.322117] __asan_report_load1_noabort+0x18/0x20 [ 23.322145] krealloc_uaf+0x53c/0x5e0 [ 23.322168] ? __pfx_krealloc_uaf+0x10/0x10 [ 23.322190] ? finish_task_switch.isra.0+0x153/0x700 [ 23.322212] ? __switch_to+0x47/0xf50 [ 23.322255] ? __schedule+0x10cc/0x2b60 [ 23.322284] ? __pfx_read_tsc+0x10/0x10 [ 23.322309] ? ktime_get_ts64+0x86/0x230 [ 23.322336] kunit_try_run_case+0x1a5/0x480 [ 23.322358] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.322378] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.322400] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.322430] ? __kthread_parkme+0x82/0x180 [ 23.322451] ? preempt_count_sub+0x50/0x80 [ 23.322474] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.322495] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.322522] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.322548] kthread+0x337/0x6f0 [ 23.322570] ? trace_preempt_on+0x20/0xc0 [ 23.322595] ? __pfx_kthread+0x10/0x10 [ 23.322617] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.322644] ? calculate_sigpending+0x7b/0xa0 [ 23.322671] ? __pfx_kthread+0x10/0x10 [ 23.322694] ret_from_fork+0x116/0x1d0 [ 23.322713] ? __pfx_kthread+0x10/0x10 [ 23.322735] ret_from_fork_asm+0x1a/0x30 [ 23.322819] </TASK> [ 23.322834] [ 23.330029] Allocated by task 212: [ 23.330182] kasan_save_stack+0x45/0x70 [ 23.330393] kasan_save_track+0x18/0x40 [ 23.330575] kasan_save_alloc_info+0x3b/0x50 [ 23.330750] __kasan_kmalloc+0xb7/0xc0 [ 23.330996] __kmalloc_cache_noprof+0x189/0x420 [ 23.331188] krealloc_uaf+0xbb/0x5e0 [ 23.331327] kunit_try_run_case+0x1a5/0x480 [ 23.331464] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.331675] kthread+0x337/0x6f0 [ 23.331845] ret_from_fork+0x116/0x1d0 [ 23.332023] ret_from_fork_asm+0x1a/0x30 [ 23.332191] [ 23.332263] Freed by task 212: [ 23.332367] kasan_save_stack+0x45/0x70 [ 23.332493] kasan_save_track+0x18/0x40 [ 23.332638] kasan_save_free_info+0x3f/0x60 [ 23.332869] __kasan_slab_free+0x56/0x70 [ 23.333058] kfree+0x222/0x3f0 [ 23.333226] krealloc_uaf+0x13d/0x5e0 [ 23.333419] kunit_try_run_case+0x1a5/0x480 [ 23.333623] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.333885] kthread+0x337/0x6f0 [ 23.334009] ret_from_fork+0x116/0x1d0 [ 23.334134] ret_from_fork_asm+0x1a/0x30 [ 23.334278] [ 23.334344] The buggy address belongs to the object at ffff888105653200 [ 23.334344] which belongs to the cache kmalloc-256 of size 256 [ 23.334692] The buggy address is located 0 bytes inside of [ 23.334692] freed 256-byte region [ffff888105653200, ffff888105653300) [ 23.335186] [ 23.335284] The buggy address belongs to the physical page: [ 23.335743] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105652 [ 23.336115] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.336353] flags: 0x200000000000040(head|node=0|zone=2) [ 23.336529] page_type: f5(slab) [ 23.336649] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 23.336875] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.338171] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 23.338626] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.339154] head: 0200000000000001 ffffea0004159481 00000000ffffffff 00000000ffffffff [ 23.339828] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 23.340148] page dumped because: kasan: bad access detected [ 23.340384] [ 23.340466] Memory state around the buggy address: [ 23.340670] ffff888105653100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.341261] ffff888105653180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.341552] >ffff888105653200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.341957] ^ [ 23.342115] ffff888105653280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.342408] ffff888105653300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.342686] ==================================================================