Date
July 24, 2025, 4:41 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 32.425886] ================================================================== [ 32.425948] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 32.426080] Read of size 1 at addr fff00000c9260000 by task kunit_try_catch/195 [ 32.426143] [ 32.426180] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250724 #1 PREEMPT [ 32.426271] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.426297] Hardware name: linux,dummy-virt (DT) [ 32.426370] Call trace: [ 32.426396] show_stack+0x20/0x38 (C) [ 32.426483] dump_stack_lvl+0x8c/0xd0 [ 32.426869] print_report+0x118/0x5e8 [ 32.426931] kasan_report+0xdc/0x128 [ 32.427107] __asan_report_load1_noabort+0x20/0x30 [ 32.427307] krealloc_uaf+0x4c8/0x520 [ 32.427355] kunit_try_run_case+0x170/0x3f0 [ 32.427420] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.427814] kthread+0x328/0x630 [ 32.427887] ret_from_fork+0x10/0x20 [ 32.428042] [ 32.428102] Allocated by task 195: [ 32.428221] kasan_save_stack+0x3c/0x68 [ 32.428332] kasan_save_track+0x20/0x40 [ 32.428409] kasan_save_alloc_info+0x40/0x58 [ 32.428812] __kasan_kmalloc+0xd4/0xd8 [ 32.428905] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.428980] krealloc_uaf+0xc8/0x520 [ 32.429476] kunit_try_run_case+0x170/0x3f0 [ 32.429845] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.429960] kthread+0x328/0x630 [ 32.430024] ret_from_fork+0x10/0x20 [ 32.430098] [ 32.430158] Freed by task 195: [ 32.430324] kasan_save_stack+0x3c/0x68 [ 32.430609] kasan_save_track+0x20/0x40 [ 32.430697] kasan_save_free_info+0x4c/0x78 [ 32.431085] __kasan_slab_free+0x6c/0x98 [ 32.431385] kfree+0x214/0x3c8 [ 32.431674] krealloc_uaf+0x12c/0x520 [ 32.431877] kunit_try_run_case+0x170/0x3f0 [ 32.431955] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.432255] kthread+0x328/0x630 [ 32.432327] ret_from_fork+0x10/0x20 [ 32.432492] [ 32.432597] The buggy address belongs to the object at fff00000c9260000 [ 32.432597] which belongs to the cache kmalloc-256 of size 256 [ 32.432782] The buggy address is located 0 bytes inside of [ 32.432782] freed 256-byte region [fff00000c9260000, fff00000c9260100) [ 32.432888] [ 32.432943] The buggy address belongs to the physical page: [ 32.433066] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109260 [ 32.433163] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.433228] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.433480] page_type: f5(slab) [ 32.433725] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 32.433876] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.433946] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 32.434167] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.434384] head: 0bfffe0000000001 ffffc1ffc3249801 00000000ffffffff 00000000ffffffff [ 32.434842] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 32.435167] page dumped because: kasan: bad access detected [ 32.435306] [ 32.435335] Memory state around the buggy address: [ 32.435370] fff00000c925ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.435414] fff00000c925ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.435812] >fff00000c9260000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.436098] ^ [ 32.436428] fff00000c9260080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.436481] fff00000c9260100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.436862] ================================================================== [ 32.412980] ================================================================== [ 32.413357] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 32.413437] Read of size 1 at addr fff00000c9260000 by task kunit_try_catch/195 [ 32.413488] [ 32.413526] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250724 #1 PREEMPT [ 32.413613] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.413639] Hardware name: linux,dummy-virt (DT) [ 32.413671] Call trace: [ 32.413706] show_stack+0x20/0x38 (C) [ 32.413775] dump_stack_lvl+0x8c/0xd0 [ 32.413820] print_report+0x118/0x5e8 [ 32.413862] kasan_report+0xdc/0x128 [ 32.413903] __kasan_check_byte+0x54/0x70 [ 32.413947] krealloc_noprof+0x44/0x360 [ 32.413990] krealloc_uaf+0x180/0x520 [ 32.414038] kunit_try_run_case+0x170/0x3f0 [ 32.414084] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.414139] kthread+0x328/0x630 [ 32.414181] ret_from_fork+0x10/0x20 [ 32.414244] [ 32.414263] Allocated by task 195: [ 32.414351] kasan_save_stack+0x3c/0x68 [ 32.414392] kasan_save_track+0x20/0x40 [ 32.414435] kasan_save_alloc_info+0x40/0x58 [ 32.414473] __kasan_kmalloc+0xd4/0xd8 [ 32.414516] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.414557] krealloc_uaf+0xc8/0x520 [ 32.414601] kunit_try_run_case+0x170/0x3f0 [ 32.414637] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.414688] kthread+0x328/0x630 [ 32.414721] ret_from_fork+0x10/0x20 [ 32.415326] [ 32.415628] Freed by task 195: [ 32.415905] kasan_save_stack+0x3c/0x68 [ 32.416067] kasan_save_track+0x20/0x40 [ 32.416371] kasan_save_free_info+0x4c/0x78 [ 32.416471] __kasan_slab_free+0x6c/0x98 [ 32.416573] kfree+0x214/0x3c8 [ 32.416610] krealloc_uaf+0x12c/0x520 [ 32.416688] kunit_try_run_case+0x170/0x3f0 [ 32.416783] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.417184] kthread+0x328/0x630 [ 32.417293] ret_from_fork+0x10/0x20 [ 32.417487] [ 32.417556] The buggy address belongs to the object at fff00000c9260000 [ 32.417556] which belongs to the cache kmalloc-256 of size 256 [ 32.418170] The buggy address is located 0 bytes inside of [ 32.418170] freed 256-byte region [fff00000c9260000, fff00000c9260100) [ 32.418284] [ 32.418332] The buggy address belongs to the physical page: [ 32.418437] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109260 [ 32.418543] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.418807] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.419110] page_type: f5(slab) [ 32.419293] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 32.419390] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.419525] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 32.419584] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.419838] head: 0bfffe0000000001 ffffc1ffc3249801 00000000ffffffff 00000000ffffffff [ 32.420249] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 32.420330] page dumped because: kasan: bad access detected [ 32.420406] [ 32.420476] Memory state around the buggy address: [ 32.420554] fff00000c925ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.421008] fff00000c925ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.421139] >fff00000c9260000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.421282] ^ [ 32.421557] fff00000c9260080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.421739] fff00000c9260100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.422243] ==================================================================
[ 26.818210] ================================================================== [ 26.818526] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 26.819474] Read of size 1 at addr ffff888104a4cc00 by task kunit_try_catch/212 [ 26.819736] [ 26.819832] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250724 #1 PREEMPT(voluntary) [ 26.819882] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 26.819896] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.819917] Call Trace: [ 26.819938] <TASK> [ 26.819956] dump_stack_lvl+0x73/0xb0 [ 26.819985] print_report+0xd1/0x640 [ 26.820007] ? __virt_addr_valid+0x1db/0x2d0 [ 26.820033] ? krealloc_uaf+0x53c/0x5e0 [ 26.820053] ? kasan_complete_mode_report_info+0x64/0x200 [ 26.820078] ? krealloc_uaf+0x53c/0x5e0 [ 26.820099] kasan_report+0x141/0x180 [ 26.820120] ? krealloc_uaf+0x53c/0x5e0 [ 26.820146] __asan_report_load1_noabort+0x18/0x20 [ 26.820169] krealloc_uaf+0x53c/0x5e0 [ 26.820190] ? __pfx_krealloc_uaf+0x10/0x10 [ 26.820210] ? finish_task_switch.isra.0+0x153/0x700 [ 26.820231] ? __switch_to+0x47/0xf80 [ 26.820256] ? __schedule+0x10da/0x2b60 [ 26.820281] ? __pfx_read_tsc+0x10/0x10 [ 26.820302] ? ktime_get_ts64+0x86/0x230 [ 26.820326] kunit_try_run_case+0x1a5/0x480 [ 26.820349] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.820371] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.820395] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.820419] ? __kthread_parkme+0x82/0x180 [ 26.820438] ? preempt_count_sub+0x50/0x80 [ 26.820461] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.820485] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.820508] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.820531] kthread+0x337/0x6f0 [ 26.820551] ? trace_preempt_on+0x20/0xc0 [ 26.820584] ? __pfx_kthread+0x10/0x10 [ 26.820604] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.820627] ? calculate_sigpending+0x7b/0xa0 [ 26.820650] ? __pfx_kthread+0x10/0x10 [ 26.820671] ret_from_fork+0x116/0x1d0 [ 26.820690] ? __pfx_kthread+0x10/0x10 [ 26.820709] ret_from_fork_asm+0x1a/0x30 [ 26.820741] </TASK> [ 26.820751] [ 26.835465] Allocated by task 212: [ 26.835601] kasan_save_stack+0x45/0x70 [ 26.835741] kasan_save_track+0x18/0x40 [ 26.835869] kasan_save_alloc_info+0x3b/0x50 [ 26.836276] __kasan_kmalloc+0xb7/0xc0 [ 26.836656] __kmalloc_cache_noprof+0x189/0x420 [ 26.837166] krealloc_uaf+0xbb/0x5e0 [ 26.837594] kunit_try_run_case+0x1a5/0x480 [ 26.838010] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.838605] kthread+0x337/0x6f0 [ 26.838974] ret_from_fork+0x116/0x1d0 [ 26.839358] ret_from_fork_asm+0x1a/0x30 [ 26.839799] [ 26.840005] Freed by task 212: [ 26.840317] kasan_save_stack+0x45/0x70 [ 26.840756] kasan_save_track+0x18/0x40 [ 26.841123] kasan_save_free_info+0x3f/0x60 [ 26.841482] __kasan_slab_free+0x56/0x70 [ 26.841637] kfree+0x222/0x3f0 [ 26.841921] krealloc_uaf+0x13d/0x5e0 [ 26.842298] kunit_try_run_case+0x1a5/0x480 [ 26.842773] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.843332] kthread+0x337/0x6f0 [ 26.843540] ret_from_fork+0x116/0x1d0 [ 26.843956] ret_from_fork_asm+0x1a/0x30 [ 26.844280] [ 26.844460] The buggy address belongs to the object at ffff888104a4cc00 [ 26.844460] which belongs to the cache kmalloc-256 of size 256 [ 26.845242] The buggy address is located 0 bytes inside of [ 26.845242] freed 256-byte region [ffff888104a4cc00, ffff888104a4cd00) [ 26.845693] [ 26.845760] The buggy address belongs to the physical page: [ 26.846198] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104a4c [ 26.846927] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.847714] flags: 0x200000000000040(head|node=0|zone=2) [ 26.848222] page_type: f5(slab) [ 26.848585] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 26.849309] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.849532] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 26.849766] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.850006] head: 0200000000000001 ffffea0004129301 00000000ffffffff 00000000ffffffff [ 26.850378] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.850876] page dumped because: kasan: bad access detected [ 26.851381] [ 26.851548] Memory state around the buggy address: [ 26.851916] ffff888104a4cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.852136] ffff888104a4cb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.852341] >ffff888104a4cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.852543] ^ [ 26.852685] ffff888104a4cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.853006] ffff888104a4cd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.853344] ================================================================== [ 26.783218] ================================================================== [ 26.784772] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 26.785972] Read of size 1 at addr ffff888104a4cc00 by task kunit_try_catch/212 [ 26.787110] [ 26.787429] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250724 #1 PREEMPT(voluntary) [ 26.787486] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 26.787500] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.787521] Call Trace: [ 26.787641] <TASK> [ 26.787663] dump_stack_lvl+0x73/0xb0 [ 26.787696] print_report+0xd1/0x640 [ 26.787719] ? __virt_addr_valid+0x1db/0x2d0 [ 26.787743] ? krealloc_uaf+0x1b8/0x5e0 [ 26.787764] ? kasan_complete_mode_report_info+0x64/0x200 [ 26.787818] ? krealloc_uaf+0x1b8/0x5e0 [ 26.787839] kasan_report+0x141/0x180 [ 26.787861] ? krealloc_uaf+0x1b8/0x5e0 [ 26.787884] ? krealloc_uaf+0x1b8/0x5e0 [ 26.787919] __kasan_check_byte+0x3d/0x50 [ 26.787941] krealloc_noprof+0x3f/0x340 [ 26.787968] krealloc_uaf+0x1b8/0x5e0 [ 26.787988] ? __pfx_krealloc_uaf+0x10/0x10 [ 26.788008] ? finish_task_switch.isra.0+0x153/0x700 [ 26.788030] ? __switch_to+0x47/0xf80 [ 26.788055] ? __schedule+0x10da/0x2b60 [ 26.788080] ? __pfx_read_tsc+0x10/0x10 [ 26.788101] ? ktime_get_ts64+0x86/0x230 [ 26.788125] kunit_try_run_case+0x1a5/0x480 [ 26.788150] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.788172] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.788196] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.788221] ? __kthread_parkme+0x82/0x180 [ 26.788241] ? preempt_count_sub+0x50/0x80 [ 26.788262] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.788287] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.788309] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.788332] kthread+0x337/0x6f0 [ 26.788352] ? trace_preempt_on+0x20/0xc0 [ 26.788375] ? __pfx_kthread+0x10/0x10 [ 26.788395] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.788417] ? calculate_sigpending+0x7b/0xa0 [ 26.788440] ? __pfx_kthread+0x10/0x10 [ 26.788461] ret_from_fork+0x116/0x1d0 [ 26.788480] ? __pfx_kthread+0x10/0x10 [ 26.788499] ret_from_fork_asm+0x1a/0x30 [ 26.788529] </TASK> [ 26.788539] [ 26.798691] Allocated by task 212: [ 26.799062] kasan_save_stack+0x45/0x70 [ 26.799285] kasan_save_track+0x18/0x40 [ 26.799462] kasan_save_alloc_info+0x3b/0x50 [ 26.799687] __kasan_kmalloc+0xb7/0xc0 [ 26.799863] __kmalloc_cache_noprof+0x189/0x420 [ 26.800425] krealloc_uaf+0xbb/0x5e0 [ 26.800601] kunit_try_run_case+0x1a5/0x480 [ 26.801024] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.801479] kthread+0x337/0x6f0 [ 26.801768] ret_from_fork+0x116/0x1d0 [ 26.802156] ret_from_fork_asm+0x1a/0x30 [ 26.802481] [ 26.802597] Freed by task 212: [ 26.803031] kasan_save_stack+0x45/0x70 [ 26.803322] kasan_save_track+0x18/0x40 [ 26.803524] kasan_save_free_info+0x3f/0x60 [ 26.804101] __kasan_slab_free+0x56/0x70 [ 26.804297] kfree+0x222/0x3f0 [ 26.804675] krealloc_uaf+0x13d/0x5e0 [ 26.805030] kunit_try_run_case+0x1a5/0x480 [ 26.805342] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.805694] kthread+0x337/0x6f0 [ 26.806067] ret_from_fork+0x116/0x1d0 [ 26.806410] ret_from_fork_asm+0x1a/0x30 [ 26.806628] [ 26.806715] The buggy address belongs to the object at ffff888104a4cc00 [ 26.806715] which belongs to the cache kmalloc-256 of size 256 [ 26.807849] The buggy address is located 0 bytes inside of [ 26.807849] freed 256-byte region [ffff888104a4cc00, ffff888104a4cd00) [ 26.808507] [ 26.808623] The buggy address belongs to the physical page: [ 26.809023] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104a4c [ 26.809452] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.809900] flags: 0x200000000000040(head|node=0|zone=2) [ 26.810105] page_type: f5(slab) [ 26.810428] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 26.810868] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.811340] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 26.811791] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.812339] head: 0200000000000001 ffffea0004129301 00000000ffffffff 00000000ffffffff [ 26.812874] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.813427] page dumped because: kasan: bad access detected [ 26.813794] [ 26.814231] Memory state around the buggy address: [ 26.814462] ffff888104a4cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.814768] ffff888104a4cb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.815449] >ffff888104a4cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.815899] ^ [ 26.816200] ffff888104a4cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.816619] ffff888104a4cd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.817095] ==================================================================