Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 22.390177] ================================================================== [ 22.390440] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 22.390585] Read of size 1 at addr fff00000c57b0e00 by task kunit_try_catch/168 [ 22.391002] [ 22.391221] CPU: 1 UID: 0 PID: 168 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT [ 22.391439] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.391504] Hardware name: linux,dummy-virt (DT) [ 22.391614] Call trace: [ 22.391698] show_stack+0x20/0x38 (C) [ 22.391864] dump_stack_lvl+0x8c/0xd0 [ 22.392029] print_report+0x118/0x608 [ 22.392153] kasan_report+0xdc/0x128 [ 22.392264] __asan_report_load1_noabort+0x20/0x30 [ 22.392396] krealloc_uaf+0x4c8/0x520 [ 22.392525] kunit_try_run_case+0x170/0x3f0 [ 22.392662] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.392854] kthread+0x328/0x630 [ 22.393012] ret_from_fork+0x10/0x20 [ 22.393132] [ 22.393179] Allocated by task 168: [ 22.393251] kasan_save_stack+0x3c/0x68 [ 22.393349] kasan_save_track+0x20/0x40 [ 22.393447] kasan_save_alloc_info+0x40/0x58 [ 22.393535] __kasan_kmalloc+0xd4/0xd8 [ 22.393619] __kmalloc_cache_noprof+0x16c/0x3c0 [ 22.393759] krealloc_uaf+0xc8/0x520 [ 22.393920] kunit_try_run_case+0x170/0x3f0 [ 22.394462] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.394610] kthread+0x328/0x630 [ 22.394753] ret_from_fork+0x10/0x20 [ 22.394947] [ 22.395130] Freed by task 168: [ 22.395224] kasan_save_stack+0x3c/0x68 [ 22.395335] kasan_save_track+0x20/0x40 [ 22.395440] kasan_save_free_info+0x4c/0x78 [ 22.395523] __kasan_slab_free+0x6c/0x98 [ 22.395602] kfree+0x214/0x3c8 [ 22.395831] krealloc_uaf+0x12c/0x520 [ 22.395917] kunit_try_run_case+0x170/0x3f0 [ 22.396032] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.396136] kthread+0x328/0x630 [ 22.396246] ret_from_fork+0x10/0x20 [ 22.396345] [ 22.396395] The buggy address belongs to the object at fff00000c57b0e00 [ 22.396395] which belongs to the cache kmalloc-256 of size 256 [ 22.396558] The buggy address is located 0 bytes inside of [ 22.396558] freed 256-byte region [fff00000c57b0e00, fff00000c57b0f00) [ 22.396715] [ 22.396764] The buggy address belongs to the physical page: [ 22.396844] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1057b0 [ 22.396984] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.397115] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 22.397248] page_type: f5(slab) [ 22.397646] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 22.397839] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.398024] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 22.398190] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.398322] head: 0bfffe0000000001 ffffc1ffc315ec01 00000000ffffffff 00000000ffffffff [ 22.398494] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 22.398592] page dumped because: kasan: bad access detected [ 22.398672] [ 22.398757] Memory state around the buggy address: [ 22.399066] fff00000c57b0d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.399362] fff00000c57b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.399488] >fff00000c57b0e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.399580] ^ [ 22.399639] fff00000c57b0e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.399722] fff00000c57b0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.399789] ================================================================== [ 22.377093] ================================================================== [ 22.377513] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 22.377736] Read of size 1 at addr fff00000c57b0e00 by task kunit_try_catch/168 [ 22.377860] [ 22.377961] CPU: 1 UID: 0 PID: 168 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT [ 22.378225] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.378309] Hardware name: linux,dummy-virt (DT) [ 22.378450] Call trace: [ 22.378514] show_stack+0x20/0x38 (C) [ 22.378623] dump_stack_lvl+0x8c/0xd0 [ 22.378941] print_report+0x118/0x608 [ 22.379133] kasan_report+0xdc/0x128 [ 22.379235] __kasan_check_byte+0x54/0x70 [ 22.379415] krealloc_noprof+0x44/0x360 [ 22.379629] krealloc_uaf+0x180/0x520 [ 22.379830] kunit_try_run_case+0x170/0x3f0 [ 22.380002] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.380650] kthread+0x328/0x630 [ 22.380839] ret_from_fork+0x10/0x20 [ 22.381006] [ 22.381073] Allocated by task 168: [ 22.381187] kasan_save_stack+0x3c/0x68 [ 22.381291] kasan_save_track+0x20/0x40 [ 22.381385] kasan_save_alloc_info+0x40/0x58 [ 22.381501] __kasan_kmalloc+0xd4/0xd8 [ 22.381591] __kmalloc_cache_noprof+0x16c/0x3c0 [ 22.381697] krealloc_uaf+0xc8/0x520 [ 22.381788] kunit_try_run_case+0x170/0x3f0 [ 22.381890] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.382006] kthread+0x328/0x630 [ 22.382094] ret_from_fork+0x10/0x20 [ 22.382183] [ 22.382280] Freed by task 168: [ 22.382444] kasan_save_stack+0x3c/0x68 [ 22.382536] kasan_save_track+0x20/0x40 [ 22.382621] kasan_save_free_info+0x4c/0x78 [ 22.382721] __kasan_slab_free+0x6c/0x98 [ 22.382819] kfree+0x214/0x3c8 [ 22.383113] krealloc_uaf+0x12c/0x520 [ 22.383371] kunit_try_run_case+0x170/0x3f0 [ 22.383797] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.383899] kthread+0x328/0x630 [ 22.383967] ret_from_fork+0x10/0x20 [ 22.384066] [ 22.384307] The buggy address belongs to the object at fff00000c57b0e00 [ 22.384307] which belongs to the cache kmalloc-256 of size 256 [ 22.384610] The buggy address is located 0 bytes inside of [ 22.384610] freed 256-byte region [fff00000c57b0e00, fff00000c57b0f00) [ 22.384816] [ 22.384889] The buggy address belongs to the physical page: [ 22.384999] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1057b0 [ 22.385172] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.385318] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 22.385455] page_type: f5(slab) [ 22.385554] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 22.385920] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.386115] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 22.386246] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.386479] head: 0bfffe0000000001 ffffc1ffc315ec01 00000000ffffffff 00000000ffffffff [ 22.386617] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 22.386709] page dumped because: kasan: bad access detected [ 22.386781] [ 22.386986] Memory state around the buggy address: [ 22.387061] fff00000c57b0d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.387197] fff00000c57b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.387323] >fff00000c57b0e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.387456] ^ [ 22.387533] fff00000c57b0e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.387642] fff00000c57b0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.387736] ==================================================================
[ 13.613897] ================================================================== [ 13.614318] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 13.614954] Read of size 1 at addr ffff888100aaf400 by task kunit_try_catch/184 [ 13.615467] [ 13.615726] CPU: 1 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT(voluntary) [ 13.615855] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.615882] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.615921] Call Trace: [ 13.615967] <TASK> [ 13.616010] dump_stack_lvl+0x73/0xb0 [ 13.616079] print_report+0xd1/0x650 [ 13.616128] ? __virt_addr_valid+0x1db/0x2d0 [ 13.616174] ? krealloc_uaf+0x53c/0x5e0 [ 13.616217] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.616262] ? krealloc_uaf+0x53c/0x5e0 [ 13.616340] kasan_report+0x141/0x180 [ 13.616385] ? krealloc_uaf+0x53c/0x5e0 [ 13.616431] __asan_report_load1_noabort+0x18/0x20 [ 13.616470] krealloc_uaf+0x53c/0x5e0 [ 13.616510] ? __pfx_krealloc_uaf+0x10/0x10 [ 13.616547] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 13.616612] ? __pfx_krealloc_uaf+0x10/0x10 [ 13.616660] kunit_try_run_case+0x1a5/0x480 [ 13.616702] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.616741] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.616781] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.616821] ? __kthread_parkme+0x82/0x180 [ 13.616859] ? preempt_count_sub+0x50/0x80 [ 13.616905] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.616945] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.616985] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.617025] kthread+0x337/0x6f0 [ 13.617058] ? trace_preempt_on+0x20/0xc0 [ 13.617099] ? __pfx_kthread+0x10/0x10 [ 13.617133] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.617169] ? calculate_sigpending+0x7b/0xa0 [ 13.617208] ? __pfx_kthread+0x10/0x10 [ 13.617242] ret_from_fork+0x41/0x80 [ 13.617280] ? __pfx_kthread+0x10/0x10 [ 13.617314] ret_from_fork_asm+0x1a/0x30 [ 13.617371] </TASK> [ 13.617394] [ 13.631311] Allocated by task 184: [ 13.632482] kasan_save_stack+0x45/0x70 [ 13.633026] kasan_save_track+0x18/0x40 [ 13.633378] kasan_save_alloc_info+0x3b/0x50 [ 13.634067] __kasan_kmalloc+0xb7/0xc0 [ 13.634289] __kmalloc_cache_noprof+0x189/0x420 [ 13.635202] krealloc_uaf+0xbb/0x5e0 [ 13.635477] kunit_try_run_case+0x1a5/0x480 [ 13.635676] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.637359] kthread+0x337/0x6f0 [ 13.637740] ret_from_fork+0x41/0x80 [ 13.638382] ret_from_fork_asm+0x1a/0x30 [ 13.638765] [ 13.638943] Freed by task 184: [ 13.640086] kasan_save_stack+0x45/0x70 [ 13.640436] kasan_save_track+0x18/0x40 [ 13.640691] kasan_save_free_info+0x3f/0x60 [ 13.640933] __kasan_slab_free+0x56/0x70 [ 13.641166] kfree+0x222/0x3f0 [ 13.641363] krealloc_uaf+0x13d/0x5e0 [ 13.641590] kunit_try_run_case+0x1a5/0x480 [ 13.641842] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.642133] kthread+0x337/0x6f0 [ 13.642334] ret_from_fork+0x41/0x80 [ 13.643436] ret_from_fork_asm+0x1a/0x30 [ 13.643832] [ 13.643952] The buggy address belongs to the object at ffff888100aaf400 [ 13.643952] which belongs to the cache kmalloc-256 of size 256 [ 13.644899] The buggy address is located 0 bytes inside of [ 13.644899] freed 256-byte region [ffff888100aaf400, ffff888100aaf500) [ 13.645922] [ 13.646120] The buggy address belongs to the physical page: [ 13.646612] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aae [ 13.647035] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.647624] flags: 0x200000000000040(head|node=0|zone=2) [ 13.648044] page_type: f5(slab) [ 13.648333] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.648747] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.649040] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.649553] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.650048] head: 0200000000000001 ffffea000402ab81 00000000ffffffff 00000000ffffffff [ 13.650731] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 13.651152] page dumped because: kasan: bad access detected [ 13.651620] [ 13.651817] Memory state around the buggy address: [ 13.652150] ffff888100aaf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.652611] ffff888100aaf380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.653081] >ffff888100aaf400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.653544] ^ [ 13.653759] ffff888100aaf480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.654272] ffff888100aaf500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.654647] ================================================================== [ 13.563237] ================================================================== [ 13.564268] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 13.564853] Read of size 1 at addr ffff888100aaf400 by task kunit_try_catch/184 [ 13.565395] [ 13.565919] CPU: 1 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT(voluntary) [ 13.565983] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.566001] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.566033] Call Trace: [ 13.566057] <TASK> [ 13.566089] dump_stack_lvl+0x73/0xb0 [ 13.566147] print_report+0xd1/0x650 [ 13.566207] ? __virt_addr_valid+0x1db/0x2d0 [ 13.566230] ? krealloc_uaf+0x1b8/0x5e0 [ 13.566250] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.566279] ? krealloc_uaf+0x1b8/0x5e0 [ 13.566298] kasan_report+0x141/0x180 [ 13.566318] ? krealloc_uaf+0x1b8/0x5e0 [ 13.566352] ? krealloc_uaf+0x1b8/0x5e0 [ 13.566380] __kasan_check_byte+0x3d/0x50 [ 13.566400] krealloc_noprof+0x3f/0x340 [ 13.566420] krealloc_uaf+0x1b8/0x5e0 [ 13.566439] ? __pfx_krealloc_uaf+0x10/0x10 [ 13.566459] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 13.566484] ? __pfx_krealloc_uaf+0x10/0x10 [ 13.566507] kunit_try_run_case+0x1a5/0x480 [ 13.566529] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.566548] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.566592] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.566624] ? __kthread_parkme+0x82/0x180 [ 13.566659] ? preempt_count_sub+0x50/0x80 [ 13.566706] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.566745] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.566783] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.566804] kthread+0x337/0x6f0 [ 13.566821] ? trace_preempt_on+0x20/0xc0 [ 13.566845] ? __pfx_kthread+0x10/0x10 [ 13.566861] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.566880] ? calculate_sigpending+0x7b/0xa0 [ 13.566900] ? __pfx_kthread+0x10/0x10 [ 13.566916] ret_from_fork+0x41/0x80 [ 13.566936] ? __pfx_kthread+0x10/0x10 [ 13.566953] ret_from_fork_asm+0x1a/0x30 [ 13.566980] </TASK> [ 13.566993] [ 13.585626] Allocated by task 184: [ 13.585990] kasan_save_stack+0x45/0x70 [ 13.586268] kasan_save_track+0x18/0x40 [ 13.586500] kasan_save_alloc_info+0x3b/0x50 [ 13.587481] __kasan_kmalloc+0xb7/0xc0 [ 13.588109] __kmalloc_cache_noprof+0x189/0x420 [ 13.588345] krealloc_uaf+0xbb/0x5e0 [ 13.588531] kunit_try_run_case+0x1a5/0x480 [ 13.589482] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.591948] kthread+0x337/0x6f0 [ 13.592220] ret_from_fork+0x41/0x80 [ 13.592475] ret_from_fork_asm+0x1a/0x30 [ 13.593361] [ 13.593905] Freed by task 184: [ 13.594449] kasan_save_stack+0x45/0x70 [ 13.595112] kasan_save_track+0x18/0x40 [ 13.595792] kasan_save_free_info+0x3f/0x60 [ 13.596294] __kasan_slab_free+0x56/0x70 [ 13.596582] kfree+0x222/0x3f0 [ 13.597737] krealloc_uaf+0x13d/0x5e0 [ 13.597962] kunit_try_run_case+0x1a5/0x480 [ 13.598167] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.598405] kthread+0x337/0x6f0 [ 13.598585] ret_from_fork+0x41/0x80 [ 13.598763] ret_from_fork_asm+0x1a/0x30 [ 13.598995] [ 13.599119] The buggy address belongs to the object at ffff888100aaf400 [ 13.599119] which belongs to the cache kmalloc-256 of size 256 [ 13.599735] The buggy address is located 0 bytes inside of [ 13.599735] freed 256-byte region [ffff888100aaf400, ffff888100aaf500) [ 13.600707] [ 13.600828] The buggy address belongs to the physical page: [ 13.601699] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aae [ 13.602197] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.602626] flags: 0x200000000000040(head|node=0|zone=2) [ 13.603156] page_type: f5(slab) [ 13.603552] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.604994] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.605403] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 13.606470] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.606755] head: 0200000000000001 ffffea000402ab81 00000000ffffffff 00000000ffffffff [ 13.607314] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 13.607600] page dumped because: kasan: bad access detected [ 13.607968] [ 13.608167] Memory state around the buggy address: [ 13.608506] ffff888100aaf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.609129] ffff888100aaf380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.609798] >ffff888100aaf400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.610395] ^ [ 13.610858] ffff888100aaf480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.611238] ffff888100aaf500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.611980] ==================================================================