Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 22.519765] ================================================================== [ 22.520899] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 22.521940] Read of size 1 at addr fff00000c44c0200 by task kunit_try_catch/153 [ 22.523195] [ 22.523551] CPU: 0 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.14.11-rc1 #1 [ 22.523757] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.523832] Hardware name: linux,dummy-virt (DT) [ 22.523934] Call trace: [ 22.524002] show_stack+0x20/0x38 (C) [ 22.524134] dump_stack_lvl+0x8c/0xd0 [ 22.524211] print_report+0x118/0x608 [ 22.524269] kasan_report+0xdc/0x128 [ 22.524323] __kasan_check_byte+0x54/0x70 [ 22.524378] krealloc_noprof+0x44/0x360 [ 22.524434] krealloc_uaf+0x180/0x520 [ 22.524486] kunit_try_run_case+0x170/0x3f0 [ 22.524540] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.524600] kthread+0x318/0x620 [ 22.524653] ret_from_fork+0x10/0x20 [ 22.524710] [ 22.531830] Allocated by task 153: [ 22.532297] kasan_save_stack+0x3c/0x68 [ 22.532808] kasan_save_track+0x20/0x40 [ 22.533402] kasan_save_alloc_info+0x40/0x58 [ 22.534930] __kasan_kmalloc+0xd4/0xd8 [ 22.535515] __kmalloc_cache_noprof+0x16c/0x3c0 [ 22.536091] krealloc_uaf+0xc8/0x520 [ 22.536620] kunit_try_run_case+0x170/0x3f0 [ 22.537941] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.538496] kthread+0x318/0x620 [ 22.539476] ret_from_fork+0x10/0x20 [ 22.539934] [ 22.540243] Freed by task 153: [ 22.540638] kasan_save_stack+0x3c/0x68 [ 22.541383] kasan_save_track+0x20/0x40 [ 22.541941] kasan_save_free_info+0x4c/0x78 [ 22.542538] __kasan_slab_free+0x6c/0x98 [ 22.543180] kfree+0x214/0x3c8 [ 22.543736] krealloc_uaf+0x12c/0x520 [ 22.544318] kunit_try_run_case+0x170/0x3f0 [ 22.544943] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.545942] kthread+0x318/0x620 [ 22.546428] ret_from_fork+0x10/0x20 [ 22.547015] [ 22.547359] The buggy address belongs to the object at fff00000c44c0200 [ 22.547359] which belongs to the cache kmalloc-256 of size 256 [ 22.548714] The buggy address is located 0 bytes inside of [ 22.548714] freed 256-byte region [fff00000c44c0200, fff00000c44c0300) [ 22.550138] [ 22.550470] The buggy address belongs to the physical page: [ 22.551113] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1044c0 [ 22.551989] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.552375] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 22.552696] page_type: f5(slab) [ 22.552945] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 22.554005] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.554852] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 22.555717] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.556481] head: 0bfffe0000000001 ffffc1ffc3113001 ffffffffffffffff 0000000000000000 [ 22.557520] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 22.559159] page dumped because: kasan: bad access detected [ 22.559749] [ 22.560070] Memory state around the buggy address: [ 22.560654] fff00000c44c0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.561545] fff00000c44c0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.562354] >fff00000c44c0200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.563552] ^ [ 22.564235] fff00000c44c0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.564963] fff00000c44c0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.566302] ================================================================== [ 22.568613] ================================================================== [ 22.569741] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 22.571429] Read of size 1 at addr fff00000c44c0200 by task kunit_try_catch/153 [ 22.572407] [ 22.572811] CPU: 0 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.14.11-rc1 #1 [ 22.573058] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.573135] Hardware name: linux,dummy-virt (DT) [ 22.573241] Call trace: [ 22.573308] show_stack+0x20/0x38 (C) [ 22.573455] dump_stack_lvl+0x8c/0xd0 [ 22.573523] print_report+0x118/0x608 [ 22.573581] kasan_report+0xdc/0x128 [ 22.573637] __asan_report_load1_noabort+0x20/0x30 [ 22.573693] krealloc_uaf+0x4c8/0x520 [ 22.573746] kunit_try_run_case+0x170/0x3f0 [ 22.573802] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.573863] kthread+0x318/0x620 [ 22.573949] ret_from_fork+0x10/0x20 [ 22.574009] [ 22.579951] Allocated by task 153: [ 22.580345] kasan_save_stack+0x3c/0x68 [ 22.580964] kasan_save_track+0x20/0x40 [ 22.581758] kasan_save_alloc_info+0x40/0x58 [ 22.582381] __kasan_kmalloc+0xd4/0xd8 [ 22.582824] __kmalloc_cache_noprof+0x16c/0x3c0 [ 22.583461] krealloc_uaf+0xc8/0x520 [ 22.583963] kunit_try_run_case+0x170/0x3f0 [ 22.584492] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.585382] kthread+0x318/0x620 [ 22.585857] ret_from_fork+0x10/0x20 [ 22.586456] [ 22.586751] Freed by task 153: [ 22.587160] kasan_save_stack+0x3c/0x68 [ 22.587679] kasan_save_track+0x20/0x40 [ 22.588236] kasan_save_free_info+0x4c/0x78 [ 22.588804] __kasan_slab_free+0x6c/0x98 [ 22.590757] kfree+0x214/0x3c8 [ 22.591256] krealloc_uaf+0x12c/0x520 [ 22.591747] kunit_try_run_case+0x170/0x3f0 [ 22.592270] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.592873] kthread+0x318/0x620 [ 22.593671] ret_from_fork+0x10/0x20 [ 22.594271] [ 22.594567] The buggy address belongs to the object at fff00000c44c0200 [ 22.594567] which belongs to the cache kmalloc-256 of size 256 [ 22.595647] The buggy address is located 0 bytes inside of [ 22.595647] freed 256-byte region [fff00000c44c0200, fff00000c44c0300) [ 22.596693] [ 22.597318] The buggy address belongs to the physical page: [ 22.598685] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1044c0 [ 22.599365] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.600074] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 22.600866] page_type: f5(slab) [ 22.601598] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 22.602331] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.603113] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 22.603914] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.604633] head: 0bfffe0000000001 ffffc1ffc3113001 ffffffffffffffff 0000000000000000 [ 22.605489] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 22.606505] page dumped because: kasan: bad access detected [ 22.607156] [ 22.607464] Memory state around the buggy address: [ 22.608020] fff00000c44c0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.608673] fff00000c44c0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.609746] >fff00000c44c0200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.610462] ^ [ 22.610846] fff00000c44c0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.612182] fff00000c44c0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.612693] ==================================================================
[ 17.475293] ================================================================== [ 17.475918] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53e/0x5e0 [ 17.476515] Read of size 1 at addr ffff888100395000 by task kunit_try_catch/172 [ 17.477002] [ 17.477162] CPU: 0 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.14.11-rc1 #1 [ 17.477249] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.477273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.477343] Call Trace: [ 17.477382] <TASK> [ 17.477414] dump_stack_lvl+0x73/0xb0 [ 17.477512] print_report+0xd1/0x650 [ 17.477566] ? __virt_addr_valid+0x1db/0x2d0 [ 17.477619] ? krealloc_uaf+0x53e/0x5e0 [ 17.477670] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.477733] ? krealloc_uaf+0x53e/0x5e0 [ 17.477788] kasan_report+0x140/0x180 [ 17.477839] ? krealloc_uaf+0x53e/0x5e0 [ 17.477911] __asan_report_load1_noabort+0x18/0x20 [ 17.477961] krealloc_uaf+0x53e/0x5e0 [ 17.478005] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.478041] ? finish_task_switch.isra.0+0x153/0x700 [ 17.478086] ? __switch_to+0x5d9/0xf60 [ 17.478136] ? __schedule+0xce8/0x2840 [ 17.478183] ? __pfx_read_tsc+0x10/0x10 [ 17.478228] ? ktime_get_ts64+0x86/0x230 [ 17.478278] kunit_try_run_case+0x1a6/0x480 [ 17.478362] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.478404] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 17.478478] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.478527] ? __kthread_parkme+0x82/0x160 [ 17.478573] ? preempt_count_sub+0x50/0x80 [ 17.478630] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.478683] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.478746] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.478804] kthread+0x324/0x6e0 [ 17.478851] ? trace_preempt_on+0x20/0xc0 [ 17.478922] ? __pfx_kthread+0x10/0x10 [ 17.478974] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.479029] ? calculate_sigpending+0x7b/0xa0 [ 17.479086] ? __pfx_kthread+0x10/0x10 [ 17.479144] ret_from_fork+0x41/0x80 [ 17.479195] ? __pfx_kthread+0x10/0x10 [ 17.479251] ret_from_fork_asm+0x1a/0x30 [ 17.479361] </TASK> [ 17.479393] [ 17.490192] Allocated by task 172: [ 17.490648] kasan_save_stack+0x45/0x70 [ 17.491103] kasan_save_track+0x18/0x40 [ 17.491502] kasan_save_alloc_info+0x3b/0x50 [ 17.491938] __kasan_kmalloc+0xb7/0xc0 [ 17.492251] __kmalloc_cache_noprof+0x18a/0x420 [ 17.492648] krealloc_uaf+0xbc/0x5e0 [ 17.492901] kunit_try_run_case+0x1a6/0x480 [ 17.493153] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.493652] kthread+0x324/0x6e0 [ 17.494027] ret_from_fork+0x41/0x80 [ 17.495198] ret_from_fork_asm+0x1a/0x30 [ 17.495628] [ 17.495848] Freed by task 172: [ 17.496181] kasan_save_stack+0x45/0x70 [ 17.496536] kasan_save_track+0x18/0x40 [ 17.496838] kasan_save_free_info+0x3f/0x60 [ 17.499307] __kasan_slab_free+0x56/0x70 [ 17.499800] kfree+0x224/0x3f0 [ 17.500146] krealloc_uaf+0x13e/0x5e0 [ 17.500713] kunit_try_run_case+0x1a6/0x480 [ 17.501141] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.501996] kthread+0x324/0x6e0 [ 17.502273] ret_from_fork+0x41/0x80 [ 17.502763] ret_from_fork_asm+0x1a/0x30 [ 17.503150] [ 17.503287] The buggy address belongs to the object at ffff888100395000 [ 17.503287] which belongs to the cache kmalloc-256 of size 256 [ 17.504059] The buggy address is located 0 bytes inside of [ 17.504059] freed 256-byte region [ffff888100395000, ffff888100395100) [ 17.504584] [ 17.504748] The buggy address belongs to the physical page: [ 17.505387] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100394 [ 17.506079] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.506536] flags: 0x200000000000040(head|node=0|zone=2) [ 17.506842] page_type: f5(slab) [ 17.507275] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.508023] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.508923] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.509288] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.510041] head: 0200000000000001 ffffea000400e501 ffffffffffffffff 0000000000000000 [ 17.510471] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 17.511000] page dumped because: kasan: bad access detected [ 17.511575] [ 17.511802] Memory state around the buggy address: [ 17.512109] ffff888100394f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.512940] ffff888100394f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.513515] >ffff888100395000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.514060] ^ [ 17.514349] ffff888100395080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.514879] ffff888100395100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.515493] ================================================================== [ 17.431948] ================================================================== [ 17.432580] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b9/0x5e0 [ 17.433349] Read of size 1 at addr ffff888100395000 by task kunit_try_catch/172 [ 17.434020] [ 17.434371] CPU: 0 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.14.11-rc1 #1 [ 17.434488] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.434521] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.434575] Call Trace: [ 17.434615] <TASK> [ 17.434664] dump_stack_lvl+0x73/0xb0 [ 17.434777] print_report+0xd1/0x650 [ 17.434838] ? __virt_addr_valid+0x1db/0x2d0 [ 17.434915] ? krealloc_uaf+0x1b9/0x5e0 [ 17.434992] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.435055] ? krealloc_uaf+0x1b9/0x5e0 [ 17.435105] kasan_report+0x140/0x180 [ 17.435160] ? krealloc_uaf+0x1b9/0x5e0 [ 17.435222] ? krealloc_uaf+0x1b9/0x5e0 [ 17.435276] __kasan_check_byte+0x3d/0x50 [ 17.435369] krealloc_noprof+0x3f/0x340 [ 17.435421] ? __kasan_slab_free+0x61/0x70 [ 17.435503] krealloc_uaf+0x1b9/0x5e0 [ 17.435559] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.435608] ? finish_task_switch.isra.0+0x153/0x700 [ 17.435703] ? __switch_to+0x5d9/0xf60 [ 17.435767] ? __schedule+0xce8/0x2840 [ 17.435828] ? __pfx_read_tsc+0x10/0x10 [ 17.435926] ? ktime_get_ts64+0x86/0x230 [ 17.436007] kunit_try_run_case+0x1a6/0x480 [ 17.436065] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.436114] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 17.436175] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.436235] ? __kthread_parkme+0x82/0x160 [ 17.436293] ? preempt_count_sub+0x50/0x80 [ 17.436396] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.436455] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.436524] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.436580] kthread+0x324/0x6e0 [ 17.436611] ? trace_preempt_on+0x20/0xc0 [ 17.436645] ? __pfx_kthread+0x10/0x10 [ 17.436674] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.436703] ? calculate_sigpending+0x7b/0xa0 [ 17.436730] ? __pfx_kthread+0x10/0x10 [ 17.436758] ret_from_fork+0x41/0x80 [ 17.436783] ? __pfx_kthread+0x10/0x10 [ 17.436811] ret_from_fork_asm+0x1a/0x30 [ 17.436852] </TASK> [ 17.436890] [ 17.449154] Allocated by task 172: [ 17.449702] kasan_save_stack+0x45/0x70 [ 17.450213] kasan_save_track+0x18/0x40 [ 17.450667] kasan_save_alloc_info+0x3b/0x50 [ 17.451146] __kasan_kmalloc+0xb7/0xc0 [ 17.451583] __kmalloc_cache_noprof+0x18a/0x420 [ 17.452074] krealloc_uaf+0xbc/0x5e0 [ 17.452496] kunit_try_run_case+0x1a6/0x480 [ 17.452953] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.453529] kthread+0x324/0x6e0 [ 17.453932] ret_from_fork+0x41/0x80 [ 17.454391] ret_from_fork_asm+0x1a/0x30 [ 17.454806] [ 17.455056] Freed by task 172: [ 17.455422] kasan_save_stack+0x45/0x70 [ 17.455759] kasan_save_track+0x18/0x40 [ 17.456175] kasan_save_free_info+0x3f/0x60 [ 17.456635] __kasan_slab_free+0x56/0x70 [ 17.457001] kfree+0x224/0x3f0 [ 17.457237] krealloc_uaf+0x13e/0x5e0 [ 17.457580] kunit_try_run_case+0x1a6/0x480 [ 17.457919] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.458454] kthread+0x324/0x6e0 [ 17.458824] ret_from_fork+0x41/0x80 [ 17.459203] ret_from_fork_asm+0x1a/0x30 [ 17.459623] [ 17.459854] The buggy address belongs to the object at ffff888100395000 [ 17.459854] which belongs to the cache kmalloc-256 of size 256 [ 17.461067] The buggy address is located 0 bytes inside of [ 17.461067] freed 256-byte region [ffff888100395000, ffff888100395100) [ 17.461636] [ 17.461792] The buggy address belongs to the physical page: [ 17.462086] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100394 [ 17.462723] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.463419] flags: 0x200000000000040(head|node=0|zone=2) [ 17.463970] page_type: f5(slab) [ 17.464324] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.465916] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.467270] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.467982] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.468489] head: 0200000000000001 ffffea000400e501 ffffffffffffffff 0000000000000000 [ 17.469016] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 17.469551] page dumped because: kasan: bad access detected [ 17.470032] [ 17.470244] Memory state around the buggy address: [ 17.470592] ffff888100394f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.471123] ffff888100394f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.471586] >ffff888100395000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.472193] ^ [ 17.472447] ffff888100395080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.473051] ffff888100395100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.473520] ==================================================================