Date
July 18, 2025, 1:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.466056] ================================================================== [ 31.466137] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 31.466219] Read of size 1 at addr fff00000c8f61e00 by task kunit_try_catch/195 [ 31.466268] [ 31.466298] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250718 #1 PREEMPT [ 31.466379] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.466421] Hardware name: linux,dummy-virt (DT) [ 31.466451] Call trace: [ 31.466478] show_stack+0x20/0x38 (C) [ 31.466526] dump_stack_lvl+0x8c/0xd0 [ 31.466571] print_report+0x118/0x5e8 [ 31.466613] kasan_report+0xdc/0x128 [ 31.466663] __kasan_check_byte+0x54/0x70 [ 31.466706] krealloc_noprof+0x44/0x360 [ 31.466752] krealloc_uaf+0x180/0x520 [ 31.466795] kunit_try_run_case+0x170/0x3f0 [ 31.466838] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.466887] kthread+0x328/0x630 [ 31.466926] ret_from_fork+0x10/0x20 [ 31.466971] [ 31.466989] Allocated by task 195: [ 31.467025] kasan_save_stack+0x3c/0x68 [ 31.467063] kasan_save_track+0x20/0x40 [ 31.467107] kasan_save_alloc_info+0x40/0x58 [ 31.467143] __kasan_kmalloc+0xd4/0xd8 [ 31.467176] __kmalloc_cache_noprof+0x16c/0x3c0 [ 31.467216] krealloc_uaf+0xc8/0x520 [ 31.467261] kunit_try_run_case+0x170/0x3f0 [ 31.467306] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.467347] kthread+0x328/0x630 [ 31.467378] ret_from_fork+0x10/0x20 [ 31.467413] [ 31.467451] Freed by task 195: [ 31.467497] kasan_save_stack+0x3c/0x68 [ 31.467534] kasan_save_track+0x20/0x40 [ 31.467569] kasan_save_free_info+0x4c/0x78 [ 31.467605] __kasan_slab_free+0x6c/0x98 [ 31.467640] kfree+0x214/0x3c8 [ 31.467674] krealloc_uaf+0x12c/0x520 [ 31.467710] kunit_try_run_case+0x170/0x3f0 [ 31.468629] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.468701] kthread+0x328/0x630 [ 31.468757] ret_from_fork+0x10/0x20 [ 31.468821] [ 31.468905] The buggy address belongs to the object at fff00000c8f61e00 [ 31.468905] which belongs to the cache kmalloc-256 of size 256 [ 31.469051] The buggy address is located 0 bytes inside of [ 31.469051] freed 256-byte region [fff00000c8f61e00, fff00000c8f61f00) [ 31.469340] [ 31.469497] The buggy address belongs to the physical page: [ 31.469730] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108f60 [ 31.469848] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.469926] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.470175] page_type: f5(slab) [ 31.470310] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 31.470515] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.470610] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 31.470982] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.471073] head: 0bfffe0000000001 ffffc1ffc323d801 00000000ffffffff 00000000ffffffff [ 31.471200] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 31.471243] page dumped because: kasan: bad access detected [ 31.471273] [ 31.471438] Memory state around the buggy address: [ 31.471510] fff00000c8f61d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.471566] fff00000c8f61d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.471825] >fff00000c8f61e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.471897] ^ [ 31.471956] fff00000c8f61e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.472003] fff00000c8f61f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.472039] ================================================================== [ 31.473884] ================================================================== [ 31.474348] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 31.474718] Read of size 1 at addr fff00000c8f61e00 by task kunit_try_catch/195 [ 31.474824] [ 31.474886] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250718 #1 PREEMPT [ 31.474977] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.475003] Hardware name: linux,dummy-virt (DT) [ 31.475319] Call trace: [ 31.475389] show_stack+0x20/0x38 (C) [ 31.475602] dump_stack_lvl+0x8c/0xd0 [ 31.475665] print_report+0x118/0x5e8 [ 31.475709] kasan_report+0xdc/0x128 [ 31.475930] __asan_report_load1_noabort+0x20/0x30 [ 31.476040] krealloc_uaf+0x4c8/0x520 [ 31.476374] kunit_try_run_case+0x170/0x3f0 [ 31.476590] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.476710] kthread+0x328/0x630 [ 31.476895] ret_from_fork+0x10/0x20 [ 31.477021] [ 31.477040] Allocated by task 195: [ 31.477088] kasan_save_stack+0x3c/0x68 [ 31.477144] kasan_save_track+0x20/0x40 [ 31.477354] kasan_save_alloc_info+0x40/0x58 [ 31.477520] __kasan_kmalloc+0xd4/0xd8 [ 31.477706] __kmalloc_cache_noprof+0x16c/0x3c0 [ 31.477782] krealloc_uaf+0xc8/0x520 [ 31.477998] kunit_try_run_case+0x170/0x3f0 [ 31.478219] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.478313] kthread+0x328/0x630 [ 31.478346] ret_from_fork+0x10/0x20 [ 31.478529] [ 31.478685] Freed by task 195: [ 31.478826] kasan_save_stack+0x3c/0x68 [ 31.478925] kasan_save_track+0x20/0x40 [ 31.479030] kasan_save_free_info+0x4c/0x78 [ 31.479228] __kasan_slab_free+0x6c/0x98 [ 31.479365] kfree+0x214/0x3c8 [ 31.479651] krealloc_uaf+0x12c/0x520 [ 31.479746] kunit_try_run_case+0x170/0x3f0 [ 31.479925] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.480010] kthread+0x328/0x630 [ 31.480043] ret_from_fork+0x10/0x20 [ 31.480092] [ 31.480111] The buggy address belongs to the object at fff00000c8f61e00 [ 31.480111] which belongs to the cache kmalloc-256 of size 256 [ 31.480350] The buggy address is located 0 bytes inside of [ 31.480350] freed 256-byte region [fff00000c8f61e00, fff00000c8f61f00) [ 31.480530] [ 31.480787] The buggy address belongs to the physical page: [ 31.481151] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108f60 [ 31.481222] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.481501] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.481681] page_type: f5(slab) [ 31.481831] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 31.481917] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.482040] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 31.482118] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.482332] head: 0bfffe0000000001 ffffc1ffc323d801 00000000ffffffff 00000000ffffffff [ 31.482596] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 31.482748] page dumped because: kasan: bad access detected [ 31.482834] [ 31.483161] Memory state around the buggy address: [ 31.483279] fff00000c8f61d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.483360] fff00000c8f61d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.483449] >fff00000c8f61e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.483572] ^ [ 31.483640] fff00000c8f61e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.483687] fff00000c8f61f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.483921] ==================================================================
[ 24.743070] ================================================================== [ 24.743739] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 24.744146] Read of size 1 at addr ffff88810500d800 by task kunit_try_catch/212 [ 24.744557] [ 24.744658] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250718 #1 PREEMPT(voluntary) [ 24.744710] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.744722] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.744744] Call Trace: [ 24.744757] <TASK> [ 24.744775] dump_stack_lvl+0x73/0xb0 [ 24.745143] print_report+0xd1/0x640 [ 24.745168] ? __virt_addr_valid+0x1db/0x2d0 [ 24.745205] ? krealloc_uaf+0x1b8/0x5e0 [ 24.745225] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.745250] ? krealloc_uaf+0x1b8/0x5e0 [ 24.745270] kasan_report+0x141/0x180 [ 24.745293] ? krealloc_uaf+0x1b8/0x5e0 [ 24.745316] ? krealloc_uaf+0x1b8/0x5e0 [ 24.745336] __kasan_check_byte+0x3d/0x50 [ 24.745357] krealloc_noprof+0x3f/0x340 [ 24.745384] krealloc_uaf+0x1b8/0x5e0 [ 24.745404] ? __pfx_krealloc_uaf+0x10/0x10 [ 24.745424] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 24.745454] ? __pfx_krealloc_uaf+0x10/0x10 [ 24.745478] kunit_try_run_case+0x1a5/0x480 [ 24.745503] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.745524] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.745558] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.745589] ? __kthread_parkme+0x82/0x180 [ 24.745609] ? preempt_count_sub+0x50/0x80 [ 24.745632] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.745654] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.745676] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.745698] kthread+0x337/0x6f0 [ 24.745717] ? trace_preempt_on+0x20/0xc0 [ 24.745740] ? __pfx_kthread+0x10/0x10 [ 24.745759] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.745809] ? calculate_sigpending+0x7b/0xa0 [ 24.745851] ? __pfx_kthread+0x10/0x10 [ 24.745872] ret_from_fork+0x116/0x1d0 [ 24.745892] ? __pfx_kthread+0x10/0x10 [ 24.745912] ret_from_fork_asm+0x1a/0x30 [ 24.745943] </TASK> [ 24.745955] [ 24.756050] Allocated by task 212: [ 24.756894] kasan_save_stack+0x45/0x70 [ 24.757078] kasan_save_track+0x18/0x40 [ 24.757528] kasan_save_alloc_info+0x3b/0x50 [ 24.757965] __kasan_kmalloc+0xb7/0xc0 [ 24.758297] __kmalloc_cache_noprof+0x189/0x420 [ 24.758658] krealloc_uaf+0xbb/0x5e0 [ 24.759031] kunit_try_run_case+0x1a5/0x480 [ 24.759242] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.759477] kthread+0x337/0x6f0 [ 24.759645] ret_from_fork+0x116/0x1d0 [ 24.760342] ret_from_fork_asm+0x1a/0x30 [ 24.760531] [ 24.760927] Freed by task 212: [ 24.761246] kasan_save_stack+0x45/0x70 [ 24.761571] kasan_save_track+0x18/0x40 [ 24.761769] kasan_save_free_info+0x3f/0x60 [ 24.762314] __kasan_slab_free+0x56/0x70 [ 24.762602] kfree+0x222/0x3f0 [ 24.763024] krealloc_uaf+0x13d/0x5e0 [ 24.763181] kunit_try_run_case+0x1a5/0x480 [ 24.763643] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.764167] kthread+0x337/0x6f0 [ 24.764332] ret_from_fork+0x116/0x1d0 [ 24.764744] ret_from_fork_asm+0x1a/0x30 [ 24.765185] [ 24.765267] The buggy address belongs to the object at ffff88810500d800 [ 24.765267] which belongs to the cache kmalloc-256 of size 256 [ 24.766305] The buggy address is located 0 bytes inside of [ 24.766305] freed 256-byte region [ffff88810500d800, ffff88810500d900) [ 24.767099] [ 24.767211] The buggy address belongs to the physical page: [ 24.767619] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10500c [ 24.768314] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.768999] flags: 0x200000000000040(head|node=0|zone=2) [ 24.769258] page_type: f5(slab) [ 24.769436] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.770076] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.770567] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.771092] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.771568] head: 0200000000000001 ffffea0004140301 00000000ffffffff 00000000ffffffff [ 24.772207] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.772706] page dumped because: kasan: bad access detected [ 24.772981] [ 24.773074] Memory state around the buggy address: [ 24.773310] ffff88810500d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.773604] ffff88810500d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.773907] >ffff88810500d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.774681] ^ [ 24.775041] ffff88810500d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.775523] ffff88810500d900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.776136] ================================================================== [ 24.779605] ================================================================== [ 24.780022] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 24.780344] Read of size 1 at addr ffff88810500d800 by task kunit_try_catch/212 [ 24.780656] [ 24.780756] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250718 #1 PREEMPT(voluntary) [ 24.780804] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.780815] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.780837] Call Trace: [ 24.780850] <TASK> [ 24.780868] dump_stack_lvl+0x73/0xb0 [ 24.780900] print_report+0xd1/0x640 [ 24.780922] ? __virt_addr_valid+0x1db/0x2d0 [ 24.780945] ? krealloc_uaf+0x53c/0x5e0 [ 24.780964] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.780990] ? krealloc_uaf+0x53c/0x5e0 [ 24.781010] kasan_report+0x141/0x180 [ 24.781031] ? krealloc_uaf+0x53c/0x5e0 [ 24.781055] __asan_report_load1_noabort+0x18/0x20 [ 24.781078] krealloc_uaf+0x53c/0x5e0 [ 24.781099] ? __pfx_krealloc_uaf+0x10/0x10 [ 24.781118] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 24.781148] ? __pfx_krealloc_uaf+0x10/0x10 [ 24.781173] kunit_try_run_case+0x1a5/0x480 [ 24.781207] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.781228] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.781263] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.781684] ? __kthread_parkme+0x82/0x180 [ 24.781712] ? preempt_count_sub+0x50/0x80 [ 24.781736] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.781760] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.781783] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.781819] kthread+0x337/0x6f0 [ 24.781856] ? trace_preempt_on+0x20/0xc0 [ 24.781882] ? __pfx_kthread+0x10/0x10 [ 24.781901] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.781932] ? calculate_sigpending+0x7b/0xa0 [ 24.781955] ? __pfx_kthread+0x10/0x10 [ 24.781975] ret_from_fork+0x116/0x1d0 [ 24.781995] ? __pfx_kthread+0x10/0x10 [ 24.782014] ret_from_fork_asm+0x1a/0x30 [ 24.782045] </TASK> [ 24.782056] [ 24.793577] Allocated by task 212: [ 24.793775] kasan_save_stack+0x45/0x70 [ 24.794529] kasan_save_track+0x18/0x40 [ 24.794805] kasan_save_alloc_info+0x3b/0x50 [ 24.795206] __kasan_kmalloc+0xb7/0xc0 [ 24.795758] __kmalloc_cache_noprof+0x189/0x420 [ 24.796245] krealloc_uaf+0xbb/0x5e0 [ 24.796430] kunit_try_run_case+0x1a5/0x480 [ 24.796717] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.797382] kthread+0x337/0x6f0 [ 24.797564] ret_from_fork+0x116/0x1d0 [ 24.797705] ret_from_fork_asm+0x1a/0x30 [ 24.798220] [ 24.798290] Freed by task 212: [ 24.798444] kasan_save_stack+0x45/0x70 [ 24.798643] kasan_save_track+0x18/0x40 [ 24.798807] kasan_save_free_info+0x3f/0x60 [ 24.799444] __kasan_slab_free+0x56/0x70 [ 24.799740] kfree+0x222/0x3f0 [ 24.800074] krealloc_uaf+0x13d/0x5e0 [ 24.800546] kunit_try_run_case+0x1a5/0x480 [ 24.801012] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.801322] kthread+0x337/0x6f0 [ 24.801792] ret_from_fork+0x116/0x1d0 [ 24.802238] ret_from_fork_asm+0x1a/0x30 [ 24.802389] [ 24.802458] The buggy address belongs to the object at ffff88810500d800 [ 24.802458] which belongs to the cache kmalloc-256 of size 256 [ 24.802819] The buggy address is located 0 bytes inside of [ 24.802819] freed 256-byte region [ffff88810500d800, ffff88810500d900) [ 24.803159] [ 24.803747] The buggy address belongs to the physical page: [ 24.804525] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10500c [ 24.805547] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.806098] flags: 0x200000000000040(head|node=0|zone=2) [ 24.806364] page_type: f5(slab) [ 24.806538] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.806881] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.807729] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 24.808369] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.808764] head: 0200000000000001 ffffea0004140301 00000000ffffffff 00000000ffffffff [ 24.809452] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.809906] page dumped because: kasan: bad access detected [ 24.810158] [ 24.810236] Memory state around the buggy address: [ 24.810462] ffff88810500d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.810782] ffff88810500d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.811085] >ffff88810500d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.811963] ^ [ 24.812452] ffff88810500d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.812754] ffff88810500d900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.813301] ==================================================================