Date
July 16, 2025, 12:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.542345] ================================================================== [ 30.542796] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 30.543324] Read of size 1 at addr fff00000c1d5d400 by task kunit_try_catch/195 [ 30.543545] [ 30.543660] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250716 #1 PREEMPT [ 30.543825] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.543896] Hardware name: linux,dummy-virt (DT) [ 30.544045] Call trace: [ 30.544124] show_stack+0x20/0x38 (C) [ 30.544200] dump_stack_lvl+0x8c/0xd0 [ 30.544248] print_report+0x118/0x5d0 [ 30.544291] kasan_report+0xdc/0x128 [ 30.544534] __asan_report_load1_noabort+0x20/0x30 [ 30.544759] krealloc_uaf+0x4c8/0x520 [ 30.544872] kunit_try_run_case+0x170/0x3f0 [ 30.545045] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.545330] kthread+0x328/0x630 [ 30.545737] ret_from_fork+0x10/0x20 [ 30.545968] [ 30.546040] Allocated by task 195: [ 30.546150] kasan_save_stack+0x3c/0x68 [ 30.546318] kasan_save_track+0x20/0x40 [ 30.546383] kasan_save_alloc_info+0x40/0x58 [ 30.546480] __kasan_kmalloc+0xd4/0xd8 [ 30.546589] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.546762] krealloc_uaf+0xc8/0x520 [ 30.547000] kunit_try_run_case+0x170/0x3f0 [ 30.547062] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.547178] kthread+0x328/0x630 [ 30.547319] ret_from_fork+0x10/0x20 [ 30.547544] [ 30.547798] Freed by task 195: [ 30.547921] kasan_save_stack+0x3c/0x68 [ 30.548085] kasan_save_track+0x20/0x40 [ 30.548179] kasan_save_free_info+0x4c/0x78 [ 30.548224] __kasan_slab_free+0x6c/0x98 [ 30.548259] kfree+0x214/0x3c8 [ 30.548293] krealloc_uaf+0x12c/0x520 [ 30.548328] kunit_try_run_case+0x170/0x3f0 [ 30.548575] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.548628] kthread+0x328/0x630 [ 30.549158] ret_from_fork+0x10/0x20 [ 30.549528] [ 30.549623] The buggy address belongs to the object at fff00000c1d5d400 [ 30.549623] which belongs to the cache kmalloc-256 of size 256 [ 30.549720] The buggy address is located 0 bytes inside of [ 30.549720] freed 256-byte region [fff00000c1d5d400, fff00000c1d5d500) [ 30.549931] [ 30.550033] The buggy address belongs to the physical page: [ 30.550096] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101d5c [ 30.550155] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.550202] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.550316] page_type: f5(slab) [ 30.550377] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.550435] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.550494] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.550552] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.550606] head: 0bfffe0000000001 ffffc1ffc3075701 00000000ffffffff 00000000ffffffff [ 30.550655] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.550700] page dumped because: kasan: bad access detected [ 30.550731] [ 30.550763] Memory state around the buggy address: [ 30.550813] fff00000c1d5d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.550857] fff00000c1d5d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.550909] >fff00000c1d5d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.550953] ^ [ 30.550980] fff00000c1d5d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.551029] fff00000c1d5d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.551066] ================================================================== [ 30.527957] ================================================================== [ 30.528068] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 30.528398] Read of size 1 at addr fff00000c1d5d400 by task kunit_try_catch/195 [ 30.528459] [ 30.528499] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250716 #1 PREEMPT [ 30.528910] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.529074] Hardware name: linux,dummy-virt (DT) [ 30.529125] Call trace: [ 30.529148] show_stack+0x20/0x38 (C) [ 30.529694] dump_stack_lvl+0x8c/0xd0 [ 30.529833] print_report+0x118/0x5d0 [ 30.530017] kasan_report+0xdc/0x128 [ 30.530226] __kasan_check_byte+0x54/0x70 [ 30.530316] krealloc_noprof+0x44/0x360 [ 30.530370] krealloc_uaf+0x180/0x520 [ 30.530540] kunit_try_run_case+0x170/0x3f0 [ 30.530888] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.530966] kthread+0x328/0x630 [ 30.531310] ret_from_fork+0x10/0x20 [ 30.531528] [ 30.531550] Allocated by task 195: [ 30.531758] kasan_save_stack+0x3c/0x68 [ 30.531951] kasan_save_track+0x20/0x40 [ 30.532062] kasan_save_alloc_info+0x40/0x58 [ 30.532374] __kasan_kmalloc+0xd4/0xd8 [ 30.532476] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.532835] krealloc_uaf+0xc8/0x520 [ 30.532891] kunit_try_run_case+0x170/0x3f0 [ 30.533183] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.533372] kthread+0x328/0x630 [ 30.533616] ret_from_fork+0x10/0x20 [ 30.533774] [ 30.533870] Freed by task 195: [ 30.533901] kasan_save_stack+0x3c/0x68 [ 30.534137] kasan_save_track+0x20/0x40 [ 30.534334] kasan_save_free_info+0x4c/0x78 [ 30.534408] __kasan_slab_free+0x6c/0x98 [ 30.534614] kfree+0x214/0x3c8 [ 30.534922] krealloc_uaf+0x12c/0x520 [ 30.535346] kunit_try_run_case+0x170/0x3f0 [ 30.535503] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.535652] kthread+0x328/0x630 [ 30.535688] ret_from_fork+0x10/0x20 [ 30.535893] [ 30.536127] The buggy address belongs to the object at fff00000c1d5d400 [ 30.536127] which belongs to the cache kmalloc-256 of size 256 [ 30.536395] The buggy address is located 0 bytes inside of [ 30.536395] freed 256-byte region [fff00000c1d5d400, fff00000c1d5d500) [ 30.536470] [ 30.536652] The buggy address belongs to the physical page: [ 30.536968] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101d5c [ 30.537030] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.537299] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.537469] page_type: f5(slab) [ 30.537667] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.538119] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.538182] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 30.538638] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.538721] head: 0bfffe0000000001 ffffc1ffc3075701 00000000ffffffff 00000000ffffffff [ 30.538907] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.539133] page dumped because: kasan: bad access detected [ 30.539330] [ 30.539433] Memory state around the buggy address: [ 30.539574] fff00000c1d5d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.539810] fff00000c1d5d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.540134] >fff00000c1d5d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.540260] ^ [ 30.540425] fff00000c1d5d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.540470] fff00000c1d5d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.540524] ==================================================================
[ 23.220838] ================================================================== [ 23.221329] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 23.221964] Read of size 1 at addr ffff888100aa0e00 by task kunit_try_catch/213 [ 23.222613] [ 23.222713] CPU: 1 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250716 #1 PREEMPT(voluntary) [ 23.222761] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.222774] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.222795] Call Trace: [ 23.222808] <TASK> [ 23.222827] dump_stack_lvl+0x73/0xb0 [ 23.222859] print_report+0xd1/0x610 [ 23.222949] ? __virt_addr_valid+0x1db/0x2d0 [ 23.222975] ? krealloc_uaf+0x1b8/0x5e0 [ 23.222995] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.223021] ? krealloc_uaf+0x1b8/0x5e0 [ 23.223042] kasan_report+0x141/0x180 [ 23.223063] ? krealloc_uaf+0x1b8/0x5e0 [ 23.223086] ? krealloc_uaf+0x1b8/0x5e0 [ 23.223106] __kasan_check_byte+0x3d/0x50 [ 23.223128] krealloc_noprof+0x3f/0x340 [ 23.223154] krealloc_uaf+0x1b8/0x5e0 [ 23.223175] ? __pfx_krealloc_uaf+0x10/0x10 [ 23.223195] ? finish_task_switch.isra.0+0x153/0x700 [ 23.223217] ? __switch_to+0x47/0xf80 [ 23.223243] ? __schedule+0x10c6/0x2b60 [ 23.223265] ? __pfx_read_tsc+0x10/0x10 [ 23.223301] ? ktime_get_ts64+0x86/0x230 [ 23.223326] kunit_try_run_case+0x1a5/0x480 [ 23.223351] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.223372] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.223394] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.223416] ? __kthread_parkme+0x82/0x180 [ 23.223437] ? preempt_count_sub+0x50/0x80 [ 23.223459] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.223482] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.223508] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.223533] kthread+0x337/0x6f0 [ 23.223563] ? trace_preempt_on+0x20/0xc0 [ 23.223586] ? __pfx_kthread+0x10/0x10 [ 23.223606] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.223626] ? calculate_sigpending+0x7b/0xa0 [ 23.223649] ? __pfx_kthread+0x10/0x10 [ 23.223670] ret_from_fork+0x116/0x1d0 [ 23.223688] ? __pfx_kthread+0x10/0x10 [ 23.223708] ret_from_fork_asm+0x1a/0x30 [ 23.223739] </TASK> [ 23.223750] [ 23.231854] Allocated by task 213: [ 23.232029] kasan_save_stack+0x45/0x70 [ 23.232331] kasan_save_track+0x18/0x40 [ 23.232500] kasan_save_alloc_info+0x3b/0x50 [ 23.232707] __kasan_kmalloc+0xb7/0xc0 [ 23.232834] __kmalloc_cache_noprof+0x189/0x420 [ 23.233086] krealloc_uaf+0xbb/0x5e0 [ 23.233331] kunit_try_run_case+0x1a5/0x480 [ 23.233542] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.233801] kthread+0x337/0x6f0 [ 23.233953] ret_from_fork+0x116/0x1d0 [ 23.234234] ret_from_fork_asm+0x1a/0x30 [ 23.234430] [ 23.234498] Freed by task 213: [ 23.234603] kasan_save_stack+0x45/0x70 [ 23.234732] kasan_save_track+0x18/0x40 [ 23.234996] kasan_save_free_info+0x3f/0x60 [ 23.235214] __kasan_slab_free+0x56/0x70 [ 23.235413] kfree+0x222/0x3f0 [ 23.235552] krealloc_uaf+0x13d/0x5e0 [ 23.235697] kunit_try_run_case+0x1a5/0x480 [ 23.235835] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.236010] kthread+0x337/0x6f0 [ 23.236123] ret_from_fork+0x116/0x1d0 [ 23.236250] ret_from_fork_asm+0x1a/0x30 [ 23.236619] [ 23.236710] The buggy address belongs to the object at ffff888100aa0e00 [ 23.236710] which belongs to the cache kmalloc-256 of size 256 [ 23.237859] The buggy address is located 0 bytes inside of [ 23.237859] freed 256-byte region [ffff888100aa0e00, ffff888100aa0f00) [ 23.239187] [ 23.239315] The buggy address belongs to the physical page: [ 23.239585] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa0 [ 23.239827] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.240192] anon flags: 0x200000000000040(head|node=0|zone=2) [ 23.240415] page_type: f5(slab) [ 23.240568] raw: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 23.240990] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.241299] head: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 23.241542] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.242032] head: 0200000000000001 ffffea000402a801 00000000ffffffff 00000000ffffffff [ 23.242327] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 23.242653] page dumped because: kasan: bad access detected [ 23.242864] [ 23.243008] Memory state around the buggy address: [ 23.243206] ffff888100aa0d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.243491] ffff888100aa0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.243707] >ffff888100aa0e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.243914] ^ [ 23.244025] ffff888100aa0e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.244237] ffff888100aa0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.244453] ================================================================== [ 23.244997] ================================================================== [ 23.245235] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 23.245461] Read of size 1 at addr ffff888100aa0e00 by task kunit_try_catch/213 [ 23.245825] [ 23.245905] CPU: 1 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250716 #1 PREEMPT(voluntary) [ 23.245949] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.245961] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.245980] Call Trace: [ 23.245997] <TASK> [ 23.246011] dump_stack_lvl+0x73/0xb0 [ 23.246039] print_report+0xd1/0x610 [ 23.246060] ? __virt_addr_valid+0x1db/0x2d0 [ 23.246081] ? krealloc_uaf+0x53c/0x5e0 [ 23.246101] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.246126] ? krealloc_uaf+0x53c/0x5e0 [ 23.246146] kasan_report+0x141/0x180 [ 23.246167] ? krealloc_uaf+0x53c/0x5e0 [ 23.246191] __asan_report_load1_noabort+0x18/0x20 [ 23.246214] krealloc_uaf+0x53c/0x5e0 [ 23.246234] ? __pfx_krealloc_uaf+0x10/0x10 [ 23.246253] ? finish_task_switch.isra.0+0x153/0x700 [ 23.246507] ? __switch_to+0x47/0xf80 [ 23.246543] ? __schedule+0x10c6/0x2b60 [ 23.246579] ? __pfx_read_tsc+0x10/0x10 [ 23.246602] ? ktime_get_ts64+0x86/0x230 [ 23.246625] kunit_try_run_case+0x1a5/0x480 [ 23.246649] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.246670] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.246693] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.246715] ? __kthread_parkme+0x82/0x180 [ 23.246735] ? preempt_count_sub+0x50/0x80 [ 23.246756] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.246779] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.246804] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.246830] kthread+0x337/0x6f0 [ 23.246849] ? trace_preempt_on+0x20/0xc0 [ 23.246871] ? __pfx_kthread+0x10/0x10 [ 23.246891] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.246911] ? calculate_sigpending+0x7b/0xa0 [ 23.246934] ? __pfx_kthread+0x10/0x10 [ 23.246955] ret_from_fork+0x116/0x1d0 [ 23.246973] ? __pfx_kthread+0x10/0x10 [ 23.246993] ret_from_fork_asm+0x1a/0x30 [ 23.247022] </TASK> [ 23.247037] [ 23.254616] Allocated by task 213: [ 23.254743] kasan_save_stack+0x45/0x70 [ 23.254884] kasan_save_track+0x18/0x40 [ 23.255011] kasan_save_alloc_info+0x3b/0x50 [ 23.255152] __kasan_kmalloc+0xb7/0xc0 [ 23.255292] __kmalloc_cache_noprof+0x189/0x420 [ 23.255507] krealloc_uaf+0xbb/0x5e0 [ 23.255751] kunit_try_run_case+0x1a5/0x480 [ 23.255953] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.256204] kthread+0x337/0x6f0 [ 23.256388] ret_from_fork+0x116/0x1d0 [ 23.256715] ret_from_fork_asm+0x1a/0x30 [ 23.257113] [ 23.257200] Freed by task 213: [ 23.257314] kasan_save_stack+0x45/0x70 [ 23.257444] kasan_save_track+0x18/0x40 [ 23.257627] kasan_save_free_info+0x3f/0x60 [ 23.258208] __kasan_slab_free+0x56/0x70 [ 23.258437] kfree+0x222/0x3f0 [ 23.258654] krealloc_uaf+0x13d/0x5e0 [ 23.258835] kunit_try_run_case+0x1a5/0x480 [ 23.259086] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.259346] kthread+0x337/0x6f0 [ 23.259531] ret_from_fork+0x116/0x1d0 [ 23.259676] ret_from_fork_asm+0x1a/0x30 [ 23.259809] [ 23.259891] The buggy address belongs to the object at ffff888100aa0e00 [ 23.259891] which belongs to the cache kmalloc-256 of size 256 [ 23.260411] The buggy address is located 0 bytes inside of [ 23.260411] freed 256-byte region [ffff888100aa0e00, ffff888100aa0f00) [ 23.260759] [ 23.260940] The buggy address belongs to the physical page: [ 23.261343] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa0 [ 23.261837] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.262244] anon flags: 0x200000000000040(head|node=0|zone=2) [ 23.262661] page_type: f5(slab) [ 23.262892] raw: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 23.263262] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.263549] head: 0200000000000040 ffff888100041b40 0000000000000000 dead000000000001 [ 23.263885] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.264280] head: 0200000000000001 ffffea000402a801 00000000ffffffff 00000000ffffffff [ 23.264685] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 23.265096] page dumped because: kasan: bad access detected [ 23.265334] [ 23.265490] Memory state around the buggy address: [ 23.265718] ffff888100aa0d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.265930] ffff888100aa0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.266138] >ffff888100aa0e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.266542] ^ [ 23.266919] ffff888100aa0e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.267471] ffff888100aa0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.268079] ==================================================================