Date
July 22, 2025, 5:13 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.280291] ================================================================== [ 30.280356] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 30.280691] Read of size 1 at addr fff00000c81a5000 by task kunit_try_catch/195 [ 30.280995] [ 30.281073] CPU: 1 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250722 #1 PREEMPT [ 30.281215] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 30.281244] Hardware name: linux,dummy-virt (DT) [ 30.281273] Call trace: [ 30.281295] show_stack+0x20/0x38 (C) [ 30.281611] dump_stack_lvl+0x8c/0xd0 [ 30.281665] print_report+0x118/0x5e8 [ 30.281708] kasan_report+0xdc/0x128 [ 30.281750] __kasan_check_byte+0x54/0x70 [ 30.281792] krealloc_noprof+0x44/0x360 [ 30.281848] krealloc_uaf+0x180/0x520 [ 30.282009] kunit_try_run_case+0x170/0x3f0 [ 30.282066] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.282116] kthread+0x328/0x630 [ 30.282179] ret_from_fork+0x10/0x20 [ 30.282236] [ 30.282265] Allocated by task 195: [ 30.282295] kasan_save_stack+0x3c/0x68 [ 30.282336] kasan_save_track+0x20/0x40 [ 30.282372] kasan_save_alloc_info+0x40/0x58 [ 30.282410] __kasan_kmalloc+0xd4/0xd8 [ 30.282443] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.282484] krealloc_uaf+0xc8/0x520 [ 30.282521] kunit_try_run_case+0x170/0x3f0 [ 30.282557] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.282600] kthread+0x328/0x630 [ 30.282633] ret_from_fork+0x10/0x20 [ 30.282678] [ 30.282697] Freed by task 195: [ 30.282730] kasan_save_stack+0x3c/0x68 [ 30.282765] kasan_save_track+0x20/0x40 [ 30.282809] kasan_save_free_info+0x4c/0x78 [ 30.283444] __kasan_slab_free+0x6c/0x98 [ 30.283520] kfree+0x214/0x3c8 [ 30.283586] krealloc_uaf+0x12c/0x520 [ 30.283920] kunit_try_run_case+0x170/0x3f0 [ 30.283987] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.284077] kthread+0x328/0x630 [ 30.284384] ret_from_fork+0x10/0x20 [ 30.284454] [ 30.284712] The buggy address belongs to the object at fff00000c81a5000 [ 30.284712] which belongs to the cache kmalloc-256 of size 256 [ 30.284904] The buggy address is located 0 bytes inside of [ 30.284904] freed 256-byte region [fff00000c81a5000, fff00000c81a5100) [ 30.285038] [ 30.285079] The buggy address belongs to the physical page: [ 30.285116] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1081a4 [ 30.285485] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.285638] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.285746] page_type: f5(slab) [ 30.286237] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 30.286320] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.286445] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 30.286792] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.286877] head: 0bfffe0000000001 ffffc1ffc3206901 00000000ffffffff 00000000ffffffff [ 30.286982] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.287035] page dumped because: kasan: bad access detected [ 30.287064] [ 30.287137] Memory state around the buggy address: [ 30.287497] fff00000c81a4f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.287547] fff00000c81a4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.287617] >fff00000c81a5000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.287805] ^ [ 30.287857] fff00000c81a5080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.288288] fff00000c81a5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.288359] ================================================================== [ 30.290149] ================================================================== [ 30.290207] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 30.290285] Read of size 1 at addr fff00000c81a5000 by task kunit_try_catch/195 [ 30.290406] [ 30.290444] CPU: 1 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250722 #1 PREEMPT [ 30.290590] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 30.290637] Hardware name: linux,dummy-virt (DT) [ 30.291005] Call trace: [ 30.291106] show_stack+0x20/0x38 (C) [ 30.291181] dump_stack_lvl+0x8c/0xd0 [ 30.291257] print_report+0x118/0x5e8 [ 30.291302] kasan_report+0xdc/0x128 [ 30.291384] __asan_report_load1_noabort+0x20/0x30 [ 30.291460] krealloc_uaf+0x4c8/0x520 [ 30.291603] kunit_try_run_case+0x170/0x3f0 [ 30.291687] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.291740] kthread+0x328/0x630 [ 30.292077] ret_from_fork+0x10/0x20 [ 30.292168] [ 30.292314] Allocated by task 195: [ 30.292353] kasan_save_stack+0x3c/0x68 [ 30.292405] kasan_save_track+0x20/0x40 [ 30.292534] kasan_save_alloc_info+0x40/0x58 [ 30.292580] __kasan_kmalloc+0xd4/0xd8 [ 30.292719] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.292764] krealloc_uaf+0xc8/0x520 [ 30.292800] kunit_try_run_case+0x170/0x3f0 [ 30.292913] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.293010] kthread+0x328/0x630 [ 30.293345] ret_from_fork+0x10/0x20 [ 30.293409] [ 30.293438] Freed by task 195: [ 30.293466] kasan_save_stack+0x3c/0x68 [ 30.293503] kasan_save_track+0x20/0x40 [ 30.293587] kasan_save_free_info+0x4c/0x78 [ 30.293625] __kasan_slab_free+0x6c/0x98 [ 30.293668] kfree+0x214/0x3c8 [ 30.293705] krealloc_uaf+0x12c/0x520 [ 30.293742] kunit_try_run_case+0x170/0x3f0 [ 30.293788] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.293843] kthread+0x328/0x630 [ 30.293875] ret_from_fork+0x10/0x20 [ 30.293912] [ 30.293931] The buggy address belongs to the object at fff00000c81a5000 [ 30.293931] which belongs to the cache kmalloc-256 of size 256 [ 30.293994] The buggy address is located 0 bytes inside of [ 30.293994] freed 256-byte region [fff00000c81a5000, fff00000c81a5100) [ 30.294052] [ 30.294085] The buggy address belongs to the physical page: [ 30.294117] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1081a4 [ 30.294203] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.294256] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.294304] page_type: f5(slab) [ 30.294356] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 30.294404] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.294450] head: 0bfffe0000000040 fff00000c0001b40 dead000000000100 dead000000000122 [ 30.294497] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.294544] head: 0bfffe0000000001 ffffc1ffc3206901 00000000ffffffff 00000000ffffffff [ 30.294600] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.294639] page dumped because: kasan: bad access detected [ 30.294677] [ 30.294696] Memory state around the buggy address: [ 30.294726] fff00000c81a4f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.294767] fff00000c81a4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.294807] >fff00000c81a5000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.295168] ^ [ 30.295372] fff00000c81a5080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.295431] fff00000c81a5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.295485] ==================================================================
[ 25.039373] ================================================================== [ 25.040299] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 25.040631] Read of size 1 at addr ffff888104a0fc00 by task kunit_try_catch/212 [ 25.041073] [ 25.041215] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250722 #1 PREEMPT(voluntary) [ 25.041264] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.041277] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.041298] Call Trace: [ 25.041311] <TASK> [ 25.041326] dump_stack_lvl+0x73/0xb0 [ 25.041356] print_report+0xd1/0x640 [ 25.041379] ? __virt_addr_valid+0x1db/0x2d0 [ 25.041402] ? krealloc_uaf+0x1b8/0x5e0 [ 25.041423] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.041449] ? krealloc_uaf+0x1b8/0x5e0 [ 25.041471] kasan_report+0x141/0x180 [ 25.041493] ? krealloc_uaf+0x1b8/0x5e0 [ 25.041517] ? krealloc_uaf+0x1b8/0x5e0 [ 25.041539] __kasan_check_byte+0x3d/0x50 [ 25.041561] krealloc_noprof+0x3f/0x340 [ 25.041588] krealloc_uaf+0x1b8/0x5e0 [ 25.041610] ? __pfx_krealloc_uaf+0x10/0x10 [ 25.041631] ? finish_task_switch.isra.0+0x153/0x700 [ 25.041652] ? __switch_to+0x47/0xf80 [ 25.041679] ? __schedule+0x10da/0x2b60 [ 25.041704] ? __pfx_read_tsc+0x10/0x10 [ 25.041725] ? ktime_get_ts64+0x86/0x230 [ 25.041751] kunit_try_run_case+0x1a5/0x480 [ 25.041776] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.041799] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.041824] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.041861] ? __kthread_parkme+0x82/0x180 [ 25.041881] ? preempt_count_sub+0x50/0x80 [ 25.041904] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.041928] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.041951] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.041975] kthread+0x337/0x6f0 [ 25.041995] ? trace_preempt_on+0x20/0xc0 [ 25.042018] ? __pfx_kthread+0x10/0x10 [ 25.042039] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.042063] ? calculate_sigpending+0x7b/0xa0 [ 25.042086] ? __pfx_kthread+0x10/0x10 [ 25.042108] ret_from_fork+0x116/0x1d0 [ 25.042127] ? __pfx_kthread+0x10/0x10 [ 25.042148] ret_from_fork_asm+0x1a/0x30 [ 25.042192] </TASK> [ 25.042203] [ 25.050098] Allocated by task 212: [ 25.050281] kasan_save_stack+0x45/0x70 [ 25.050448] kasan_save_track+0x18/0x40 [ 25.050646] kasan_save_alloc_info+0x3b/0x50 [ 25.050818] __kasan_kmalloc+0xb7/0xc0 [ 25.051016] __kmalloc_cache_noprof+0x189/0x420 [ 25.051403] krealloc_uaf+0xbb/0x5e0 [ 25.051619] kunit_try_run_case+0x1a5/0x480 [ 25.051773] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.051966] kthread+0x337/0x6f0 [ 25.052129] ret_from_fork+0x116/0x1d0 [ 25.052321] ret_from_fork_asm+0x1a/0x30 [ 25.052516] [ 25.052615] Freed by task 212: [ 25.052816] kasan_save_stack+0x45/0x70 [ 25.053280] kasan_save_track+0x18/0x40 [ 25.053438] kasan_save_free_info+0x3f/0x60 [ 25.053656] __kasan_slab_free+0x56/0x70 [ 25.053804] kfree+0x222/0x3f0 [ 25.053977] krealloc_uaf+0x13d/0x5e0 [ 25.054164] kunit_try_run_case+0x1a5/0x480 [ 25.054411] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.054784] kthread+0x337/0x6f0 [ 25.054945] ret_from_fork+0x116/0x1d0 [ 25.055307] ret_from_fork_asm+0x1a/0x30 [ 25.055485] [ 25.055595] The buggy address belongs to the object at ffff888104a0fc00 [ 25.055595] which belongs to the cache kmalloc-256 of size 256 [ 25.056120] The buggy address is located 0 bytes inside of [ 25.056120] freed 256-byte region [ffff888104a0fc00, ffff888104a0fd00) [ 25.056486] [ 25.056559] The buggy address belongs to the physical page: [ 25.056743] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104a0e [ 25.057164] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.057960] flags: 0x200000000000040(head|node=0|zone=2) [ 25.058219] page_type: f5(slab) [ 25.058344] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.058578] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.058813] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.059064] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.059905] head: 0200000000000001 ffffea0004128381 00000000ffffffff 00000000ffffffff [ 25.060415] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.060849] page dumped because: kasan: bad access detected [ 25.061262] [ 25.061360] Memory state around the buggy address: [ 25.061640] ffff888104a0fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.061890] ffff888104a0fb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.062146] >ffff888104a0fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.062542] ^ [ 25.062713] ffff888104a0fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.063026] ffff888104a0fd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.063303] ================================================================== [ 25.063921] ================================================================== [ 25.064560] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 25.064792] Read of size 1 at addr ffff888104a0fc00 by task kunit_try_catch/212 [ 25.065138] [ 25.065252] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250722 #1 PREEMPT(voluntary) [ 25.065298] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.065310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.065330] Call Trace: [ 25.065346] <TASK> [ 25.065362] dump_stack_lvl+0x73/0xb0 [ 25.065389] print_report+0xd1/0x640 [ 25.065412] ? __virt_addr_valid+0x1db/0x2d0 [ 25.065436] ? krealloc_uaf+0x53c/0x5e0 [ 25.065457] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.065565] ? krealloc_uaf+0x53c/0x5e0 [ 25.065593] kasan_report+0x141/0x180 [ 25.065616] ? krealloc_uaf+0x53c/0x5e0 [ 25.065642] __asan_report_load1_noabort+0x18/0x20 [ 25.065667] krealloc_uaf+0x53c/0x5e0 [ 25.065689] ? __pfx_krealloc_uaf+0x10/0x10 [ 25.065709] ? finish_task_switch.isra.0+0x153/0x700 [ 25.065731] ? __switch_to+0x47/0xf80 [ 25.065757] ? __schedule+0x10da/0x2b60 [ 25.065782] ? __pfx_read_tsc+0x10/0x10 [ 25.065804] ? ktime_get_ts64+0x86/0x230 [ 25.065841] kunit_try_run_case+0x1a5/0x480 [ 25.065866] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.065889] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.065913] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.065938] ? __kthread_parkme+0x82/0x180 [ 25.065958] ? preempt_count_sub+0x50/0x80 [ 25.065980] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.066004] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.066027] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.066051] kthread+0x337/0x6f0 [ 25.066071] ? trace_preempt_on+0x20/0xc0 [ 25.066093] ? __pfx_kthread+0x10/0x10 [ 25.066114] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.066137] ? calculate_sigpending+0x7b/0xa0 [ 25.066160] ? __pfx_kthread+0x10/0x10 [ 25.066192] ret_from_fork+0x116/0x1d0 [ 25.066212] ? __pfx_kthread+0x10/0x10 [ 25.066232] ret_from_fork_asm+0x1a/0x30 [ 25.066263] </TASK> [ 25.066274] [ 25.073974] Allocated by task 212: [ 25.074135] kasan_save_stack+0x45/0x70 [ 25.074362] kasan_save_track+0x18/0x40 [ 25.074644] kasan_save_alloc_info+0x3b/0x50 [ 25.074801] __kasan_kmalloc+0xb7/0xc0 [ 25.074949] __kmalloc_cache_noprof+0x189/0x420 [ 25.075106] krealloc_uaf+0xbb/0x5e0 [ 25.075285] kunit_try_run_case+0x1a5/0x480 [ 25.075502] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.075776] kthread+0x337/0x6f0 [ 25.076151] ret_from_fork+0x116/0x1d0 [ 25.076363] ret_from_fork_asm+0x1a/0x30 [ 25.076558] [ 25.076647] Freed by task 212: [ 25.076801] kasan_save_stack+0x45/0x70 [ 25.077005] kasan_save_track+0x18/0x40 [ 25.077155] kasan_save_free_info+0x3f/0x60 [ 25.077636] __kasan_slab_free+0x56/0x70 [ 25.077789] kfree+0x222/0x3f0 [ 25.077920] krealloc_uaf+0x13d/0x5e0 [ 25.078084] kunit_try_run_case+0x1a5/0x480 [ 25.078284] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.078646] kthread+0x337/0x6f0 [ 25.078810] ret_from_fork+0x116/0x1d0 [ 25.078955] ret_from_fork_asm+0x1a/0x30 [ 25.079094] [ 25.079162] The buggy address belongs to the object at ffff888104a0fc00 [ 25.079162] which belongs to the cache kmalloc-256 of size 256 [ 25.079684] The buggy address is located 0 bytes inside of [ 25.079684] freed 256-byte region [ffff888104a0fc00, ffff888104a0fd00) [ 25.080208] [ 25.080432] The buggy address belongs to the physical page: [ 25.080648] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104a0e [ 25.080941] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.081548] flags: 0x200000000000040(head|node=0|zone=2) [ 25.081812] page_type: f5(slab) [ 25.081989] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.082313] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.082694] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 25.082950] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.083187] head: 0200000000000001 ffffea0004128381 00000000ffffffff 00000000ffffffff [ 25.083421] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.083651] page dumped because: kasan: bad access detected [ 25.083890] [ 25.083980] Memory state around the buggy address: [ 25.084198] ffff888104a0fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.084582] ffff888104a0fb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.084920] >ffff888104a0fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.085317] ^ [ 25.085439] ffff888104a0fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.085734] ffff888104a0fd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.085961] ==================================================================