Date
July 17, 2025, 10:12 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.505720] ================================================================== [ 29.505861] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 29.505916] Read of size 1 at addr fff00000c7809800 by task kunit_try_catch/195 [ 29.505964] [ 29.506194] CPU: 1 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT [ 29.506350] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.506389] Hardware name: linux,dummy-virt (DT) [ 29.506427] Call trace: [ 29.506469] show_stack+0x20/0x38 (C) [ 29.506573] dump_stack_lvl+0x8c/0xd0 [ 29.506624] print_report+0x118/0x5d0 [ 29.506667] kasan_report+0xdc/0x128 [ 29.506881] __asan_report_load1_noabort+0x20/0x30 [ 29.506939] krealloc_uaf+0x4c8/0x520 [ 29.507034] kunit_try_run_case+0x170/0x3f0 [ 29.507100] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.507151] kthread+0x328/0x630 [ 29.507194] ret_from_fork+0x10/0x20 [ 29.507286] [ 29.507325] Allocated by task 195: [ 29.507371] kasan_save_stack+0x3c/0x68 [ 29.507416] kasan_save_track+0x20/0x40 [ 29.507541] kasan_save_alloc_info+0x40/0x58 [ 29.507596] __kasan_kmalloc+0xd4/0xd8 [ 29.507629] __kmalloc_cache_noprof+0x16c/0x3c0 [ 29.507813] krealloc_uaf+0xc8/0x520 [ 29.507850] kunit_try_run_case+0x170/0x3f0 [ 29.507989] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.508034] kthread+0x328/0x630 [ 29.508077] ret_from_fork+0x10/0x20 [ 29.508111] [ 29.508144] Freed by task 195: [ 29.508222] kasan_save_stack+0x3c/0x68 [ 29.508259] kasan_save_track+0x20/0x40 [ 29.508292] kasan_save_free_info+0x4c/0x78 [ 29.508328] __kasan_slab_free+0x6c/0x98 [ 29.508362] kfree+0x214/0x3c8 [ 29.508473] krealloc_uaf+0x12c/0x520 [ 29.508552] kunit_try_run_case+0x170/0x3f0 [ 29.508616] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.508817] kthread+0x328/0x630 [ 29.508965] ret_from_fork+0x10/0x20 [ 29.509188] [ 29.509244] The buggy address belongs to the object at fff00000c7809800 [ 29.509244] which belongs to the cache kmalloc-256 of size 256 [ 29.509397] The buggy address is located 0 bytes inside of [ 29.509397] freed 256-byte region [fff00000c7809800, fff00000c7809900) [ 29.509500] [ 29.509557] The buggy address belongs to the physical page: [ 29.509597] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107808 [ 29.509724] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.509788] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.510099] page_type: f5(slab) [ 29.510201] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 29.510294] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.510399] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 29.510473] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.510604] head: 0bfffe0000000001 ffffc1ffc31e0201 00000000ffffffff 00000000ffffffff [ 29.510688] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 29.510827] page dumped because: kasan: bad access detected [ 29.510857] [ 29.510875] Memory state around the buggy address: [ 29.510921] fff00000c7809700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.511125] fff00000c7809780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.511221] >fff00000c7809800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.511377] ^ [ 29.511433] fff00000c7809880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.511587] fff00000c7809900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.511664] ================================================================== [ 29.498331] ================================================================== [ 29.498397] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 29.498452] Read of size 1 at addr fff00000c7809800 by task kunit_try_catch/195 [ 29.498500] [ 29.498529] CPU: 1 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT [ 29.498610] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.498635] Hardware name: linux,dummy-virt (DT) [ 29.498673] Call trace: [ 29.498697] show_stack+0x20/0x38 (C) [ 29.498744] dump_stack_lvl+0x8c/0xd0 [ 29.498799] print_report+0x118/0x5d0 [ 29.498853] kasan_report+0xdc/0x128 [ 29.498905] __kasan_check_byte+0x54/0x70 [ 29.498948] krealloc_noprof+0x44/0x360 [ 29.498996] krealloc_uaf+0x180/0x520 [ 29.499049] kunit_try_run_case+0x170/0x3f0 [ 29.499109] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.499160] kthread+0x328/0x630 [ 29.499200] ret_from_fork+0x10/0x20 [ 29.499246] [ 29.499265] Allocated by task 195: [ 29.499293] kasan_save_stack+0x3c/0x68 [ 29.499331] kasan_save_track+0x20/0x40 [ 29.499374] kasan_save_alloc_info+0x40/0x58 [ 29.499412] __kasan_kmalloc+0xd4/0xd8 [ 29.499454] __kmalloc_cache_noprof+0x16c/0x3c0 [ 29.499508] krealloc_uaf+0xc8/0x520 [ 29.499544] kunit_try_run_case+0x170/0x3f0 [ 29.499588] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.499629] kthread+0x328/0x630 [ 29.499661] ret_from_fork+0x10/0x20 [ 29.499696] [ 29.499715] Freed by task 195: [ 29.499739] kasan_save_stack+0x3c/0x68 [ 29.499779] kasan_save_track+0x20/0x40 [ 29.499817] kasan_save_free_info+0x4c/0x78 [ 29.499854] __kasan_slab_free+0x6c/0x98 [ 29.499896] kfree+0x214/0x3c8 [ 29.499930] krealloc_uaf+0x12c/0x520 [ 29.499965] kunit_try_run_case+0x170/0x3f0 [ 29.500008] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.500063] kthread+0x328/0x630 [ 29.500947] ret_from_fork+0x10/0x20 [ 29.501013] [ 29.501149] The buggy address belongs to the object at fff00000c7809800 [ 29.501149] which belongs to the cache kmalloc-256 of size 256 [ 29.501387] The buggy address is located 0 bytes inside of [ 29.501387] freed 256-byte region [fff00000c7809800, fff00000c7809900) [ 29.501489] [ 29.501537] The buggy address belongs to the physical page: [ 29.501569] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107808 [ 29.501752] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.501804] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.501917] page_type: f5(slab) [ 29.502040] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 29.502121] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.502253] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 29.502333] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.502387] head: 0bfffe0000000001 ffffc1ffc31e0201 00000000ffffffff 00000000ffffffff [ 29.502677] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 29.502742] page dumped because: kasan: bad access detected [ 29.502900] [ 29.502959] Memory state around the buggy address: [ 29.503021] fff00000c7809700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.503146] fff00000c7809780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.503198] >fff00000c7809800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.503327] ^ [ 29.503441] fff00000c7809880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.503481] fff00000c7809900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.503672] ==================================================================
[ 25.635828] ================================================================== [ 25.636343] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 25.636661] Read of size 1 at addr ffff8881060c4a00 by task kunit_try_catch/213 [ 25.636952] [ 25.637058] CPU: 1 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT(voluntary) [ 25.637114] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.637125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.637145] Call Trace: [ 25.637157] <TASK> [ 25.637172] dump_stack_lvl+0x73/0xb0 [ 25.637202] print_report+0xd1/0x610 [ 25.637224] ? __virt_addr_valid+0x1db/0x2d0 [ 25.637248] ? krealloc_uaf+0x1b8/0x5e0 [ 25.637267] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.637417] ? krealloc_uaf+0x1b8/0x5e0 [ 25.637439] kasan_report+0x141/0x180 [ 25.637460] ? krealloc_uaf+0x1b8/0x5e0 [ 25.637485] ? krealloc_uaf+0x1b8/0x5e0 [ 25.637506] __kasan_check_byte+0x3d/0x50 [ 25.637527] krealloc_noprof+0x3f/0x340 [ 25.637554] krealloc_uaf+0x1b8/0x5e0 [ 25.637576] ? __pfx_krealloc_uaf+0x10/0x10 [ 25.637597] ? finish_task_switch.isra.0+0x153/0x700 [ 25.637619] ? __switch_to+0x47/0xf80 [ 25.637645] ? __schedule+0x10c6/0x2b60 [ 25.637669] ? __pfx_read_tsc+0x10/0x10 [ 25.637689] ? ktime_get_ts64+0x86/0x230 [ 25.637714] kunit_try_run_case+0x1a5/0x480 [ 25.637738] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.637759] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.637781] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.637804] ? __kthread_parkme+0x82/0x180 [ 25.637827] ? preempt_count_sub+0x50/0x80 [ 25.637849] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.637872] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.637894] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.637916] kthread+0x337/0x6f0 [ 25.637942] ? trace_preempt_on+0x20/0xc0 [ 25.637964] ? __pfx_kthread+0x10/0x10 [ 25.637984] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.638005] ? calculate_sigpending+0x7b/0xa0 [ 25.638027] ? __pfx_kthread+0x10/0x10 [ 25.638047] ret_from_fork+0x116/0x1d0 [ 25.638065] ? __pfx_kthread+0x10/0x10 [ 25.638095] ret_from_fork_asm+0x1a/0x30 [ 25.638126] </TASK> [ 25.638136] [ 25.648545] Allocated by task 213: [ 25.648673] kasan_save_stack+0x45/0x70 [ 25.648813] kasan_save_track+0x18/0x40 [ 25.648940] kasan_save_alloc_info+0x3b/0x50 [ 25.649275] __kasan_kmalloc+0xb7/0xc0 [ 25.649454] __kmalloc_cache_noprof+0x189/0x420 [ 25.649716] krealloc_uaf+0xbb/0x5e0 [ 25.649893] kunit_try_run_case+0x1a5/0x480 [ 25.650040] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.650218] kthread+0x337/0x6f0 [ 25.650593] ret_from_fork+0x116/0x1d0 [ 25.650775] ret_from_fork_asm+0x1a/0x30 [ 25.650969] [ 25.651044] Freed by task 213: [ 25.651183] kasan_save_stack+0x45/0x70 [ 25.652058] kasan_save_track+0x18/0x40 [ 25.652293] kasan_save_free_info+0x3f/0x60 [ 25.652482] __kasan_slab_free+0x56/0x70 [ 25.652643] kfree+0x222/0x3f0 [ 25.652802] krealloc_uaf+0x13d/0x5e0 [ 25.652979] kunit_try_run_case+0x1a5/0x480 [ 25.653168] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.654013] kthread+0x337/0x6f0 [ 25.654203] ret_from_fork+0x116/0x1d0 [ 25.654394] ret_from_fork_asm+0x1a/0x30 [ 25.654570] [ 25.654662] The buggy address belongs to the object at ffff8881060c4a00 [ 25.654662] which belongs to the cache kmalloc-256 of size 256 [ 25.655221] The buggy address is located 0 bytes inside of [ 25.655221] freed 256-byte region [ffff8881060c4a00, ffff8881060c4b00) [ 25.656231] [ 25.656389] The buggy address belongs to the physical page: [ 25.656611] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1060c4 [ 25.657150] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.657620] flags: 0x200000000000040(head|node=0|zone=2) [ 25.657840] page_type: f5(slab) [ 25.658163] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.658650] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.659287] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.659887] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.660214] head: 0200000000000001 ffffea0004183101 00000000ffffffff 00000000ffffffff [ 25.660651] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.661140] page dumped because: kasan: bad access detected [ 25.661364] [ 25.661713] Memory state around the buggy address: [ 25.662045] ffff8881060c4900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.662515] ffff8881060c4980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.662817] >ffff8881060c4a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.663224] ^ [ 25.663449] ffff8881060c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.663902] ffff8881060c4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.664262] ================================================================== [ 25.664901] ================================================================== [ 25.665204] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 25.666191] Read of size 1 at addr ffff8881060c4a00 by task kunit_try_catch/213 [ 25.666566] [ 25.666676] CPU: 1 UID: 0 PID: 213 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT(voluntary) [ 25.666727] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.666740] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.666760] Call Trace: [ 25.666774] <TASK> [ 25.666789] dump_stack_lvl+0x73/0xb0 [ 25.666819] print_report+0xd1/0x610 [ 25.666841] ? __virt_addr_valid+0x1db/0x2d0 [ 25.666864] ? krealloc_uaf+0x53c/0x5e0 [ 25.666884] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.666909] ? krealloc_uaf+0x53c/0x5e0 [ 25.666930] kasan_report+0x141/0x180 [ 25.666951] ? krealloc_uaf+0x53c/0x5e0 [ 25.666977] __asan_report_load1_noabort+0x18/0x20 [ 25.667001] krealloc_uaf+0x53c/0x5e0 [ 25.667021] ? __pfx_krealloc_uaf+0x10/0x10 [ 25.667041] ? finish_task_switch.isra.0+0x153/0x700 [ 25.667061] ? __switch_to+0x47/0xf80 [ 25.667098] ? __schedule+0x10c6/0x2b60 [ 25.667120] ? __pfx_read_tsc+0x10/0x10 [ 25.667139] ? ktime_get_ts64+0x86/0x230 [ 25.667163] kunit_try_run_case+0x1a5/0x480 [ 25.667186] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.667206] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.667228] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.667250] ? __kthread_parkme+0x82/0x180 [ 25.667283] ? preempt_count_sub+0x50/0x80 [ 25.667305] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.667327] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.667349] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.667371] kthread+0x337/0x6f0 [ 25.667390] ? trace_preempt_on+0x20/0xc0 [ 25.667412] ? __pfx_kthread+0x10/0x10 [ 25.667432] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.667452] ? calculate_sigpending+0x7b/0xa0 [ 25.667474] ? __pfx_kthread+0x10/0x10 [ 25.667495] ret_from_fork+0x116/0x1d0 [ 25.667512] ? __pfx_kthread+0x10/0x10 [ 25.667531] ret_from_fork_asm+0x1a/0x30 [ 25.667563] </TASK> [ 25.667573] [ 25.674348] Allocated by task 213: [ 25.674524] kasan_save_stack+0x45/0x70 [ 25.674717] kasan_save_track+0x18/0x40 [ 25.674902] kasan_save_alloc_info+0x3b/0x50 [ 25.675119] __kasan_kmalloc+0xb7/0xc0 [ 25.675334] __kmalloc_cache_noprof+0x189/0x420 [ 25.675525] krealloc_uaf+0xbb/0x5e0 [ 25.675688] kunit_try_run_case+0x1a5/0x480 [ 25.675862] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.676090] kthread+0x337/0x6f0 [ 25.676204] ret_from_fork+0x116/0x1d0 [ 25.676617] ret_from_fork_asm+0x1a/0x30 [ 25.676778] [ 25.676841] Freed by task 213: [ 25.676945] kasan_save_stack+0x45/0x70 [ 25.677072] kasan_save_track+0x18/0x40 [ 25.677267] kasan_save_free_info+0x3f/0x60 [ 25.677468] __kasan_slab_free+0x56/0x70 [ 25.677658] kfree+0x222/0x3f0 [ 25.678010] krealloc_uaf+0x13d/0x5e0 [ 25.678157] kunit_try_run_case+0x1a5/0x480 [ 25.678301] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.678465] kthread+0x337/0x6f0 [ 25.678578] ret_from_fork+0x116/0x1d0 [ 25.678759] ret_from_fork_asm+0x1a/0x30 [ 25.678957] [ 25.679042] The buggy address belongs to the object at ffff8881060c4a00 [ 25.679042] which belongs to the cache kmalloc-256 of size 256 [ 25.680117] The buggy address is located 0 bytes inside of [ 25.680117] freed 256-byte region [ffff8881060c4a00, ffff8881060c4b00) [ 25.680677] [ 25.680770] The buggy address belongs to the physical page: [ 25.680975] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1060c4 [ 25.681383] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.681612] flags: 0x200000000000040(head|node=0|zone=2) [ 25.681780] page_type: f5(slab) [ 25.681893] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.682738] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.683642] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.684000] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.684825] head: 0200000000000001 ffffea0004183101 00000000ffffffff 00000000ffffffff [ 25.685538] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.686008] page dumped because: kasan: bad access detected [ 25.686460] [ 25.686552] Memory state around the buggy address: [ 25.686766] ffff8881060c4900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.687053] ffff8881060c4980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.687276] >ffff8881060c4a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.687686] ^ [ 25.687848] ffff8881060c4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.688159] ffff8881060c4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.688414] ==================================================================