Date
June 2, 2025, 2:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.777400] ================================================================== [ 19.777886] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c4/0x510 [ 19.778341] Read of size 1 at addr fff00000c6042800 by task kunit_try_catch/151 [ 19.778785] [ 19.779062] CPU: 1 UID: 0 PID: 151 Comm: kunit_try_catch Tainted: G B N 6.12.32-rc1 #1 [ 19.779288] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.779361] Hardware name: linux,dummy-virt (DT) [ 19.779441] Call trace: [ 19.779495] dump_backtrace+0x9c/0x128 [ 19.779612] show_stack+0x20/0x38 [ 19.779696] dump_stack_lvl+0x8c/0xd0 [ 19.779787] print_report+0x118/0x5f0 [ 19.779882] kasan_report+0xdc/0x128 [ 19.779968] __asan_report_load1_noabort+0x20/0x30 [ 19.780064] krealloc_uaf+0x4c4/0x510 [ 19.780158] kunit_try_run_case+0x170/0x3f0 [ 19.780574] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.780654] kthread+0x24c/0x2d0 [ 19.780728] ret_from_fork+0x10/0x20 [ 19.780801] [ 19.786881] Allocated by task 151: [ 19.787537] kasan_save_stack+0x3c/0x68 [ 19.788128] kasan_save_track+0x20/0x40 [ 19.788680] kasan_save_alloc_info+0x40/0x58 [ 19.789075] __kasan_kmalloc+0xd4/0xd8 [ 19.789390] __kmalloc_cache_noprof+0x154/0x320 [ 19.789783] krealloc_uaf+0xc8/0x510 [ 19.790105] kunit_try_run_case+0x170/0x3f0 [ 19.790480] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.790902] kthread+0x24c/0x2d0 [ 19.791511] ret_from_fork+0x10/0x20 [ 19.791948] [ 19.792168] Freed by task 151: [ 19.792594] kasan_save_stack+0x3c/0x68 [ 19.792982] kasan_save_track+0x20/0x40 [ 19.793412] kasan_save_free_info+0x4c/0x78 [ 19.793866] __kasan_slab_free+0x6c/0x98 [ 19.794322] kfree+0x110/0x3b8 [ 19.794746] krealloc_uaf+0x130/0x510 [ 19.795454] kunit_try_run_case+0x170/0x3f0 [ 19.795919] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.796394] kthread+0x24c/0x2d0 [ 19.796695] ret_from_fork+0x10/0x20 [ 19.797009] [ 19.797841] The buggy address belongs to the object at fff00000c6042800 [ 19.797841] which belongs to the cache kmalloc-256 of size 256 [ 19.798796] The buggy address is located 0 bytes inside of [ 19.798796] freed 256-byte region [fff00000c6042800, fff00000c6042900) [ 19.800068] [ 19.800622] The buggy address belongs to the physical page: [ 19.801511] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106042 [ 19.802115] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.803268] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.803864] page_type: f5(slab) [ 19.804103] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.804486] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 19.804844] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.805197] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 19.806424] head: 0bfffe0000000001 ffffc1ffc3181081 ffffffffffffffff 0000000000000000 [ 19.807098] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 19.807953] page dumped because: kasan: bad access detected [ 19.808430] [ 19.808698] Memory state around the buggy address: [ 19.809177] fff00000c6042700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.809842] fff00000c6042780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.810542] >fff00000c6042800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.811601] ^ [ 19.811913] fff00000c6042880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.812459] fff00000c6042900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.813149] ================================================================== [ 19.738011] ================================================================== [ 19.738853] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x18c/0x510 [ 19.739609] Read of size 1 at addr fff00000c6042800 by task kunit_try_catch/151 [ 19.740747] [ 19.741124] CPU: 1 UID: 0 PID: 151 Comm: kunit_try_catch Tainted: G B N 6.12.32-rc1 #1 [ 19.741372] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.741447] Hardware name: linux,dummy-virt (DT) [ 19.741549] Call trace: [ 19.741627] dump_backtrace+0x9c/0x128 [ 19.741740] show_stack+0x20/0x38 [ 19.741789] dump_stack_lvl+0x8c/0xd0 [ 19.741838] print_report+0x118/0x5f0 [ 19.741880] kasan_report+0xdc/0x128 [ 19.741921] __kasan_check_byte+0x54/0x70 [ 19.741962] krealloc_noprof+0x48/0x1a0 [ 19.742006] krealloc_uaf+0x18c/0x510 [ 19.742048] kunit_try_run_case+0x170/0x3f0 [ 19.742092] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.742140] kthread+0x24c/0x2d0 [ 19.742181] ret_from_fork+0x10/0x20 [ 19.742228] [ 19.747938] Allocated by task 151: [ 19.748421] kasan_save_stack+0x3c/0x68 [ 19.748845] kasan_save_track+0x20/0x40 [ 19.749374] kasan_save_alloc_info+0x40/0x58 [ 19.749788] __kasan_kmalloc+0xd4/0xd8 [ 19.750287] __kmalloc_cache_noprof+0x154/0x320 [ 19.750863] krealloc_uaf+0xc8/0x510 [ 19.751601] kunit_try_run_case+0x170/0x3f0 [ 19.752003] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.752626] kthread+0x24c/0x2d0 [ 19.753048] ret_from_fork+0x10/0x20 [ 19.753466] [ 19.753826] Freed by task 151: [ 19.754301] kasan_save_stack+0x3c/0x68 [ 19.754753] kasan_save_track+0x20/0x40 [ 19.755419] kasan_save_free_info+0x4c/0x78 [ 19.755716] __kasan_slab_free+0x6c/0x98 [ 19.756228] kfree+0x110/0x3b8 [ 19.756659] krealloc_uaf+0x130/0x510 [ 19.757176] kunit_try_run_case+0x170/0x3f0 [ 19.757672] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.758197] kthread+0x24c/0x2d0 [ 19.758608] ret_from_fork+0x10/0x20 [ 19.759073] [ 19.759640] The buggy address belongs to the object at fff00000c6042800 [ 19.759640] which belongs to the cache kmalloc-256 of size 256 [ 19.761403] The buggy address is located 0 bytes inside of [ 19.761403] freed 256-byte region [fff00000c6042800, fff00000c6042900) [ 19.762273] [ 19.762530] The buggy address belongs to the physical page: [ 19.762986] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106042 [ 19.763978] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.764790] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.765447] page_type: f5(slab) [ 19.765836] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.766688] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 19.767634] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.768340] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 19.768926] head: 0bfffe0000000001 ffffc1ffc3181081 ffffffffffffffff 0000000000000000 [ 19.769824] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 19.770529] page dumped because: kasan: bad access detected [ 19.771368] [ 19.771826] Memory state around the buggy address: [ 19.772474] fff00000c6042700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.772976] fff00000c6042780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.773767] >fff00000c6042800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.774355] ^ [ 19.774948] fff00000c6042880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.775776] fff00000c6042900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.776120] ==================================================================
[ 12.011604] ================================================================== [ 12.011979] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53e/0x5e0 [ 12.012432] Read of size 1 at addr ffff888100994e00 by task kunit_try_catch/169 [ 12.013001] [ 12.013174] CPU: 1 UID: 0 PID: 169 Comm: kunit_try_catch Tainted: G B N 6.12.32-rc1 #1 [ 12.013273] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.013297] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.013342] Call Trace: [ 12.013381] <TASK> [ 12.013405] dump_stack_lvl+0x73/0xb0 [ 12.013449] print_report+0xd1/0x640 [ 12.013482] ? __virt_addr_valid+0x1db/0x2d0 [ 12.013517] ? krealloc_uaf+0x53e/0x5e0 [ 12.013545] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.013577] ? krealloc_uaf+0x53e/0x5e0 [ 12.013607] kasan_report+0x140/0x180 [ 12.013640] ? krealloc_uaf+0x53e/0x5e0 [ 12.013692] __asan_report_load1_noabort+0x18/0x20 [ 12.013727] krealloc_uaf+0x53e/0x5e0 [ 12.013758] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.013788] ? finish_task_switch.isra.0+0x153/0x700 [ 12.013826] ? __switch_to+0x5d9/0xf60 [ 12.013873] ? __schedule+0xc49/0x27a0 [ 12.013926] ? __pfx_read_tsc+0x10/0x10 [ 12.013966] ? ktime_get_ts64+0x84/0x230 [ 12.014018] kunit_try_run_case+0x1a6/0x480 [ 12.014098] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.014138] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 12.014178] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.014223] ? __kthread_parkme+0x82/0x160 [ 12.014256] ? preempt_count_sub+0x50/0x80 [ 12.014289] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.014320] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.014361] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.014424] kthread+0x257/0x310 [ 12.014454] ? __pfx_kthread+0x10/0x10 [ 12.014482] ret_from_fork+0x41/0x80 [ 12.014510] ? __pfx_kthread+0x10/0x10 [ 12.014536] ret_from_fork_asm+0x1a/0x30 [ 12.014580] </TASK> [ 12.014599] [ 12.022219] Allocated by task 169: [ 12.022436] kasan_save_stack+0x45/0x70 [ 12.022767] kasan_save_track+0x18/0x40 [ 12.022978] kasan_save_alloc_info+0x3b/0x50 [ 12.023255] __kasan_kmalloc+0xb7/0xc0 [ 12.023614] __kmalloc_cache_noprof+0x168/0x350 [ 12.023918] krealloc_uaf+0xbc/0x5e0 [ 12.024136] kunit_try_run_case+0x1a6/0x480 [ 12.024363] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.024601] kthread+0x257/0x310 [ 12.024785] ret_from_fork+0x41/0x80 [ 12.024975] ret_from_fork_asm+0x1a/0x30 [ 12.025196] [ 12.025315] Freed by task 169: [ 12.025481] kasan_save_stack+0x45/0x70 [ 12.025685] kasan_save_track+0x18/0x40 [ 12.025970] kasan_save_free_info+0x3f/0x60 [ 12.026314] __kasan_slab_free+0x56/0x70 [ 12.026684] kfree+0x123/0x3d0 [ 12.026919] krealloc_uaf+0x13e/0x5e0 [ 12.027224] kunit_try_run_case+0x1a6/0x480 [ 12.027562] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.027942] kthread+0x257/0x310 [ 12.028302] ret_from_fork+0x41/0x80 [ 12.028567] ret_from_fork_asm+0x1a/0x30 [ 12.028872] [ 12.029030] The buggy address belongs to the object at ffff888100994e00 [ 12.029030] which belongs to the cache kmalloc-256 of size 256 [ 12.030119] The buggy address is located 0 bytes inside of [ 12.030119] freed 256-byte region [ffff888100994e00, ffff888100994f00) [ 12.030625] [ 12.030778] The buggy address belongs to the physical page: [ 12.030998] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100994 [ 12.031731] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.032129] flags: 0x200000000000040(head|node=0|zone=2) [ 12.032389] page_type: f5(slab) [ 12.032546] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.032802] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 12.033044] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.033676] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 12.034203] head: 0200000000000001 ffffea0004026501 ffffffffffffffff 0000000000000000 [ 12.034708] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 12.035393] page dumped because: kasan: bad access detected [ 12.035554] [ 12.035636] Memory state around the buggy address: [ 12.035952] ffff888100994d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.036603] ffff888100994d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.036879] >ffff888100994e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.037277] ^ [ 12.037428] ffff888100994e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.037667] ffff888100994f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.038038] ================================================================== [ 11.979727] ================================================================== [ 11.980213] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b9/0x5e0 [ 11.980645] Read of size 1 at addr ffff888100994e00 by task kunit_try_catch/169 [ 11.981113] [ 11.981259] CPU: 1 UID: 0 PID: 169 Comm: kunit_try_catch Tainted: G B N 6.12.32-rc1 #1 [ 11.981337] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.981359] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.981396] Call Trace: [ 11.981424] <TASK> [ 11.981455] dump_stack_lvl+0x73/0xb0 [ 11.981766] print_report+0xd1/0x640 [ 11.981813] ? __virt_addr_valid+0x1db/0x2d0 [ 11.981851] ? krealloc_uaf+0x1b9/0x5e0 [ 11.981883] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.981935] ? krealloc_uaf+0x1b9/0x5e0 [ 11.982018] kasan_report+0x140/0x180 [ 11.982085] ? krealloc_uaf+0x1b9/0x5e0 [ 11.982122] ? krealloc_uaf+0x1b9/0x5e0 [ 11.982153] __kasan_check_byte+0x3d/0x50 [ 11.982192] krealloc_noprof+0x35/0x140 [ 11.982231] krealloc_uaf+0x1b9/0x5e0 [ 11.982268] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.982302] ? finish_task_switch.isra.0+0x153/0x700 [ 11.982339] ? __switch_to+0x5d9/0xf60 [ 11.982367] ? __schedule+0xc49/0x27a0 [ 11.982388] ? __pfx_read_tsc+0x10/0x10 [ 11.982405] ? ktime_get_ts64+0x84/0x230 [ 11.982429] kunit_try_run_case+0x1a6/0x480 [ 11.982450] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.982468] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 11.982486] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.982508] ? __kthread_parkme+0x82/0x160 [ 11.982526] ? preempt_count_sub+0x50/0x80 [ 11.982546] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.982563] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.982585] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.982606] kthread+0x257/0x310 [ 11.982623] ? __pfx_kthread+0x10/0x10 [ 11.982640] ret_from_fork+0x41/0x80 [ 11.982676] ? __pfx_kthread+0x10/0x10 [ 11.982715] ret_from_fork_asm+0x1a/0x30 [ 11.982759] </TASK> [ 11.982776] [ 11.992315] Allocated by task 169: [ 11.992612] kasan_save_stack+0x45/0x70 [ 11.992936] kasan_save_track+0x18/0x40 [ 11.993425] kasan_save_alloc_info+0x3b/0x50 [ 11.993668] __kasan_kmalloc+0xb7/0xc0 [ 11.993836] __kmalloc_cache_noprof+0x168/0x350 [ 11.994036] krealloc_uaf+0xbc/0x5e0 [ 11.994491] kunit_try_run_case+0x1a6/0x480 [ 11.994827] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.995615] kthread+0x257/0x310 [ 11.995911] ret_from_fork+0x41/0x80 [ 11.996355] ret_from_fork_asm+0x1a/0x30 [ 11.996679] [ 11.996878] Freed by task 169: [ 11.997362] kasan_save_stack+0x45/0x70 [ 11.997602] kasan_save_track+0x18/0x40 [ 11.997786] kasan_save_free_info+0x3f/0x60 [ 11.998260] __kasan_slab_free+0x56/0x70 [ 11.998574] kfree+0x123/0x3d0 [ 11.998851] krealloc_uaf+0x13e/0x5e0 [ 11.999532] kunit_try_run_case+0x1a6/0x480 [ 11.999870] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.000335] kthread+0x257/0x310 [ 12.000612] ret_from_fork+0x41/0x80 [ 12.000858] ret_from_fork_asm+0x1a/0x30 [ 12.001303] [ 12.001512] The buggy address belongs to the object at ffff888100994e00 [ 12.001512] which belongs to the cache kmalloc-256 of size 256 [ 12.002240] The buggy address is located 0 bytes inside of [ 12.002240] freed 256-byte region [ffff888100994e00, ffff888100994f00) [ 12.002835] [ 12.002995] The buggy address belongs to the physical page: [ 12.003719] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100994 [ 12.004086] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.004473] flags: 0x200000000000040(head|node=0|zone=2) [ 12.004681] page_type: f5(slab) [ 12.004933] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.005311] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 12.005685] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.005942] head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 12.006699] head: 0200000000000001 ffffea0004026501 ffffffffffffffff 0000000000000000 [ 12.007009] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 12.007617] page dumped because: kasan: bad access detected [ 12.007809] [ 12.007959] Memory state around the buggy address: [ 12.008327] ffff888100994d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.008800] ffff888100994d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.009097] >ffff888100994e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.009569] ^ [ 12.009818] ffff888100994e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.010198] ffff888100994f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.010424] ==================================================================