Hay
Date
July 25, 2025, 3:13 a.m.

Environment
qemu-arm64

[   32.338692] ==================================================================
[   32.338780] BUG: KFENCE: use-after-free read in __memcpy+0xc/0x30
[   32.338780] 
[   32.339324] Use-after-free read at 0x00000000fc6b217a (in kfence-#96):
[   32.340463]  __memcpy+0xc/0x30
[   32.340545]  krealloc_uaf+0x180/0x520
[   32.340594]  kunit_try_run_case+0x170/0x3f0
[   32.340943]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.341041]  kthread+0x328/0x630
[   32.341129]  ret_from_fork+0x10/0x20
[   32.341281] 
[   32.341958] kfence-#96: 0x00000000fc6b217a-0x000000007ad0ddf6, size=201, cache=kmalloc-256
[   32.341958] 
[   32.342214] allocated by task 196 on cpu 1 at 32.337151s (0.004965s ago):
[   32.342699]  krealloc_uaf+0xc8/0x520
[   32.342761]  kunit_try_run_case+0x170/0x3f0
[   32.342798]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.342861]  kthread+0x328/0x630
[   32.342893]  ret_from_fork+0x10/0x20
[   32.343780] 
[   32.344734] freed by task 196 on cpu 1 at 32.337250s (0.006958s ago):
[   32.345130]  krealloc_uaf+0x12c/0x520
[   32.345411]  kunit_try_run_case+0x170/0x3f0
[   32.345624]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.345779]  kthread+0x328/0x630
[   32.345829]  ret_from_fork+0x10/0x20
[   32.345978] 
[   32.346450] CPU: 1 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G    B   W        N  6.16.0-rc7-next-20250725 #1 PREEMPT 
[   32.346627] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   32.346748] Hardware name: linux,dummy-virt (DT)
[   32.346949] ==================================================================