Date
June 24, 2025, 12:47 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 23.721642] ================================================================== [ 23.721811] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 23.721929] Read of size 1 at addr fff00000c1921c00 by task kunit_try_catch/166 [ 23.722052] [ 23.722123] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc2 #1 PREEMPT [ 23.722317] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.722399] Hardware name: linux,dummy-virt (DT) [ 23.722471] Call trace: [ 23.722523] show_stack+0x20/0x38 (C) [ 23.722638] dump_stack_lvl+0x8c/0xd0 [ 23.722755] print_report+0x118/0x608 [ 23.722862] kasan_report+0xdc/0x128 [ 23.722968] __kasan_check_byte+0x54/0x70 [ 23.723083] krealloc_noprof+0x44/0x360 [ 23.723196] krealloc_uaf+0x180/0x520 [ 23.723300] kunit_try_run_case+0x170/0x3f0 [ 23.723458] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.723648] kthread+0x328/0x630 [ 23.723789] ret_from_fork+0x10/0x20 [ 23.723927] [ 23.723976] Allocated by task 166: [ 23.724375] kasan_save_stack+0x3c/0x68 [ 23.724557] kasan_save_track+0x20/0x40 [ 23.724710] kasan_save_alloc_info+0x40/0x58 [ 23.724799] __kasan_kmalloc+0xd4/0xd8 [ 23.724907] __kmalloc_cache_noprof+0x16c/0x3c0 [ 23.725161] krealloc_uaf+0xc8/0x520 [ 23.725321] kunit_try_run_case+0x170/0x3f0 [ 23.725525] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.725669] kthread+0x328/0x630 [ 23.725923] ret_from_fork+0x10/0x20 [ 23.726026] [ 23.726139] Freed by task 166: [ 23.726233] kasan_save_stack+0x3c/0x68 [ 23.726333] kasan_save_track+0x20/0x40 [ 23.726600] kasan_save_free_info+0x4c/0x78 [ 23.726699] __kasan_slab_free+0x6c/0x98 [ 23.726838] kfree+0x214/0x3c8 [ 23.727081] krealloc_uaf+0x12c/0x520 [ 23.727180] kunit_try_run_case+0x170/0x3f0 [ 23.727423] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.727804] kthread+0x328/0x630 [ 23.728161] ret_from_fork+0x10/0x20 [ 23.728358] [ 23.728462] The buggy address belongs to the object at fff00000c1921c00 [ 23.728462] which belongs to the cache kmalloc-256 of size 256 [ 23.728871] The buggy address is located 0 bytes inside of [ 23.728871] freed 256-byte region [fff00000c1921c00, fff00000c1921d00) [ 23.729024] [ 23.729113] The buggy address belongs to the physical page: [ 23.729293] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101920 [ 23.729484] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.729912] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 23.730056] page_type: f5(slab) [ 23.730165] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 23.730304] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.730457] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 23.731110] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.731263] head: 0bfffe0000000001 ffffc1ffc3064801 00000000ffffffff 00000000ffffffff [ 23.731407] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 23.731536] page dumped because: kasan: bad access detected [ 23.731616] [ 23.731658] Memory state around the buggy address: [ 23.732508] fff00000c1921b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.733035] fff00000c1921b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.733905] >fff00000c1921c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.734713] ^ [ 23.734841] fff00000c1921c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.734948] fff00000c1921d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.735106] ================================================================== [ 23.736599] ================================================================== [ 23.737254] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 23.738473] Read of size 1 at addr fff00000c1921c00 by task kunit_try_catch/166 [ 23.738589] [ 23.740007] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc2 #1 PREEMPT [ 23.741062] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.741161] Hardware name: linux,dummy-virt (DT) [ 23.741240] Call trace: [ 23.741298] show_stack+0x20/0x38 (C) [ 23.741539] dump_stack_lvl+0x8c/0xd0 [ 23.741782] print_report+0x118/0x608 [ 23.741905] kasan_report+0xdc/0x128 [ 23.742025] __asan_report_load1_noabort+0x20/0x30 [ 23.742156] krealloc_uaf+0x4c8/0x520 [ 23.742273] kunit_try_run_case+0x170/0x3f0 [ 23.742418] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.742561] kthread+0x328/0x630 [ 23.742695] ret_from_fork+0x10/0x20 [ 23.742831] [ 23.742876] Allocated by task 166: [ 23.742946] kasan_save_stack+0x3c/0x68 [ 23.743045] kasan_save_track+0x20/0x40 [ 23.743136] kasan_save_alloc_info+0x40/0x58 [ 23.743223] __kasan_kmalloc+0xd4/0xd8 [ 23.743316] __kmalloc_cache_noprof+0x16c/0x3c0 [ 23.745889] krealloc_uaf+0xc8/0x520 [ 23.746063] kunit_try_run_case+0x170/0x3f0 [ 23.746216] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.746760] kthread+0x328/0x630 [ 23.746882] ret_from_fork+0x10/0x20 [ 23.746970] [ 23.747012] Freed by task 166: [ 23.747456] kasan_save_stack+0x3c/0x68 [ 23.747651] kasan_save_track+0x20/0x40 [ 23.748142] kasan_save_free_info+0x4c/0x78 [ 23.748361] __kasan_slab_free+0x6c/0x98 [ 23.748650] kfree+0x214/0x3c8 [ 23.748744] krealloc_uaf+0x12c/0x520 [ 23.749129] kunit_try_run_case+0x170/0x3f0 [ 23.749584] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.749950] kthread+0x328/0x630 [ 23.750046] ret_from_fork+0x10/0x20 [ 23.750134] [ 23.751853] The buggy address belongs to the object at fff00000c1921c00 [ 23.751853] which belongs to the cache kmalloc-256 of size 256 [ 23.752156] The buggy address is located 0 bytes inside of [ 23.752156] freed 256-byte region [fff00000c1921c00, fff00000c1921d00) [ 23.752941] [ 23.753508] The buggy address belongs to the physical page: [ 23.753637] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101920 [ 23.753764] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.753875] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 23.753996] page_type: f5(slab) [ 23.754081] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 23.754201] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.754322] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 23.754758] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.754945] head: 0bfffe0000000001 ffffc1ffc3064801 00000000ffffffff 00000000ffffffff [ 23.755826] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 23.755946] page dumped because: kasan: bad access detected [ 23.756022] [ 23.756130] Memory state around the buggy address: [ 23.756219] fff00000c1921b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.756540] fff00000c1921b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.756694] >fff00000c1921c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.756779] ^ [ 23.756843] fff00000c1921c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.756956] fff00000c1921d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.757053] ==================================================================
[ 11.618044] ================================================================== [ 11.618817] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.619214] Read of size 1 at addr ffff888100345600 by task kunit_try_catch/184 [ 11.619760] [ 11.619973] CPU: 0 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc2 #1 PREEMPT(voluntary) [ 11.620070] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.620095] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.620139] Call Trace: [ 11.620168] <TASK> [ 11.620204] dump_stack_lvl+0x73/0xb0 [ 11.620261] print_report+0xd1/0x650 [ 11.620449] ? __virt_addr_valid+0x1db/0x2d0 [ 11.620502] ? krealloc_uaf+0x1b8/0x5e0 [ 11.620535] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.620573] ? krealloc_uaf+0x1b8/0x5e0 [ 11.620608] kasan_report+0x141/0x180 [ 11.620684] ? krealloc_uaf+0x1b8/0x5e0 [ 11.620723] ? krealloc_uaf+0x1b8/0x5e0 [ 11.620754] __kasan_check_byte+0x3d/0x50 [ 11.620797] krealloc_noprof+0x3f/0x340 [ 11.620847] krealloc_uaf+0x1b8/0x5e0 [ 11.620886] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.620918] ? finish_task_switch.isra.0+0x153/0x700 [ 11.620959] ? __switch_to+0x5d9/0xf60 [ 11.620999] ? dequeue_task_fair+0x166/0x4e0 [ 11.621048] ? __schedule+0x10cc/0x2b60 [ 11.621093] ? __pfx_read_tsc+0x10/0x10 [ 11.621127] ? ktime_get_ts64+0x86/0x230 [ 11.621154] kunit_try_run_case+0x1a5/0x480 [ 11.621182] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.621204] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.621228] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.621251] ? __kthread_parkme+0x82/0x180 [ 11.621273] ? preempt_count_sub+0x50/0x80 [ 11.621329] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.621366] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.621398] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.621430] kthread+0x337/0x6f0 [ 11.621447] ? trace_preempt_on+0x20/0xc0 [ 11.621472] ? __pfx_kthread+0x10/0x10 [ 11.621489] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.621509] ? calculate_sigpending+0x7b/0xa0 [ 11.621531] ? __pfx_kthread+0x10/0x10 [ 11.621562] ret_from_fork+0x41/0x80 [ 11.621583] ? __pfx_kthread+0x10/0x10 [ 11.621601] ret_from_fork_asm+0x1a/0x30 [ 11.621646] </TASK> [ 11.621661] [ 11.633525] Allocated by task 184: [ 11.633899] kasan_save_stack+0x45/0x70 [ 11.634265] kasan_save_track+0x18/0x40 [ 11.634471] kasan_save_alloc_info+0x3b/0x50 [ 11.634781] __kasan_kmalloc+0xb7/0xc0 [ 11.634942] __kmalloc_cache_noprof+0x189/0x420 [ 11.635121] krealloc_uaf+0xbb/0x5e0 [ 11.635275] kunit_try_run_case+0x1a5/0x480 [ 11.635574] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.636225] kthread+0x337/0x6f0 [ 11.636697] ret_from_fork+0x41/0x80 [ 11.637001] ret_from_fork_asm+0x1a/0x30 [ 11.637512] [ 11.637797] Freed by task 184: [ 11.638135] kasan_save_stack+0x45/0x70 [ 11.638641] kasan_save_track+0x18/0x40 [ 11.638956] kasan_save_free_info+0x3f/0x60 [ 11.639131] __kasan_slab_free+0x56/0x70 [ 11.639300] kfree+0x222/0x3f0 [ 11.639443] krealloc_uaf+0x13d/0x5e0 [ 11.639600] kunit_try_run_case+0x1a5/0x480 [ 11.639944] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.640363] kthread+0x337/0x6f0 [ 11.640815] ret_from_fork+0x41/0x80 [ 11.641330] ret_from_fork_asm+0x1a/0x30 [ 11.642042] [ 11.642277] The buggy address belongs to the object at ffff888100345600 [ 11.642277] which belongs to the cache kmalloc-256 of size 256 [ 11.643453] The buggy address is located 0 bytes inside of [ 11.643453] freed 256-byte region [ffff888100345600, ffff888100345700) [ 11.643928] [ 11.644046] The buggy address belongs to the physical page: [ 11.644248] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100344 [ 11.644510] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.644898] flags: 0x200000000000040(head|node=0|zone=2) [ 11.645325] page_type: f5(slab) [ 11.645642] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.646545] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.647185] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.647876] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.648145] head: 0200000000000001 ffffea000400d101 00000000ffffffff 00000000ffffffff [ 11.648392] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.649611] page dumped because: kasan: bad access detected [ 11.649815] [ 11.649992] Memory state around the buggy address: [ 11.650474] ffff888100345500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.651323] ffff888100345580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.651541] >ffff888100345600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.652427] ^ [ 11.652805] ffff888100345680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.653033] ffff888100345700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.653668] ================================================================== [ 11.655193] ================================================================== [ 11.655634] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.656255] Read of size 1 at addr ffff888100345600 by task kunit_try_catch/184 [ 11.657024] [ 11.657293] CPU: 0 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc2 #1 PREEMPT(voluntary) [ 11.657382] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.657402] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.657433] Call Trace: [ 11.657469] <TASK> [ 11.657501] dump_stack_lvl+0x73/0xb0 [ 11.657565] print_report+0xd1/0x650 [ 11.657599] ? __virt_addr_valid+0x1db/0x2d0 [ 11.657645] ? krealloc_uaf+0x53c/0x5e0 [ 11.657673] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.657703] ? krealloc_uaf+0x53c/0x5e0 [ 11.657727] kasan_report+0x141/0x180 [ 11.657758] ? krealloc_uaf+0x53c/0x5e0 [ 11.657788] __asan_report_load1_noabort+0x18/0x20 [ 11.657815] krealloc_uaf+0x53c/0x5e0 [ 11.657841] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.657864] ? finish_task_switch.isra.0+0x153/0x700 [ 11.657898] ? __switch_to+0x5d9/0xf60 [ 11.657933] ? dequeue_task_fair+0x166/0x4e0 [ 11.657989] ? __schedule+0x10cc/0x2b60 [ 11.658028] ? __pfx_read_tsc+0x10/0x10 [ 11.658064] ? ktime_get_ts64+0x86/0x230 [ 11.658110] kunit_try_run_case+0x1a5/0x480 [ 11.658156] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.658198] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.658244] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.658276] ? __kthread_parkme+0x82/0x180 [ 11.658299] ? preempt_count_sub+0x50/0x80 [ 11.658323] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.658346] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.658369] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.658391] kthread+0x337/0x6f0 [ 11.658418] ? trace_preempt_on+0x20/0xc0 [ 11.658498] ? __pfx_kthread+0x10/0x10 [ 11.658529] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.658576] ? calculate_sigpending+0x7b/0xa0 [ 11.658606] ? __pfx_kthread+0x10/0x10 [ 11.658647] ret_from_fork+0x41/0x80 [ 11.658680] ? __pfx_kthread+0x10/0x10 [ 11.658708] ret_from_fork_asm+0x1a/0x30 [ 11.658761] </TASK> [ 11.658780] [ 11.671538] Allocated by task 184: [ 11.671743] kasan_save_stack+0x45/0x70 [ 11.672544] kasan_save_track+0x18/0x40 [ 11.673160] kasan_save_alloc_info+0x3b/0x50 [ 11.673592] __kasan_kmalloc+0xb7/0xc0 [ 11.673917] __kmalloc_cache_noprof+0x189/0x420 [ 11.674228] krealloc_uaf+0xbb/0x5e0 [ 11.674535] kunit_try_run_case+0x1a5/0x480 [ 11.674781] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.675174] kthread+0x337/0x6f0 [ 11.675373] ret_from_fork+0x41/0x80 [ 11.675501] ret_from_fork_asm+0x1a/0x30 [ 11.675634] [ 11.675708] Freed by task 184: [ 11.675815] kasan_save_stack+0x45/0x70 [ 11.676088] kasan_save_track+0x18/0x40 [ 11.676967] kasan_save_free_info+0x3f/0x60 [ 11.677496] __kasan_slab_free+0x56/0x70 [ 11.677856] kfree+0x222/0x3f0 [ 11.678143] krealloc_uaf+0x13d/0x5e0 [ 11.678600] kunit_try_run_case+0x1a5/0x480 [ 11.678839] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.679095] kthread+0x337/0x6f0 [ 11.679923] ret_from_fork+0x41/0x80 [ 11.680222] ret_from_fork_asm+0x1a/0x30 [ 11.680662] [ 11.680756] The buggy address belongs to the object at ffff888100345600 [ 11.680756] which belongs to the cache kmalloc-256 of size 256 [ 11.681394] The buggy address is located 0 bytes inside of [ 11.681394] freed 256-byte region [ffff888100345600, ffff888100345700) [ 11.682064] [ 11.682243] The buggy address belongs to the physical page: [ 11.682784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100344 [ 11.683081] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.684189] flags: 0x200000000000040(head|node=0|zone=2) [ 11.684645] page_type: f5(slab) [ 11.684872] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.685239] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.685814] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.686195] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.686837] head: 0200000000000001 ffffea000400d101 00000000ffffffff 00000000ffffffff [ 11.687159] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.688236] page dumped because: kasan: bad access detected [ 11.688564] [ 11.688670] Memory state around the buggy address: [ 11.688840] ffff888100345500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.689302] ffff888100345580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.689684] >ffff888100345600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.690152] ^ [ 11.690733] ffff888100345680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.691086] ffff888100345700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.691886] ==================================================================