Date
June 23, 2025, 1:39 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 24.563355] ================================================================== [ 24.563471] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 24.563577] Read of size 1 at addr fff00000c44aac00 by task kunit_try_catch/166 [ 24.563708] [ 24.563788] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT [ 24.563975] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.564037] Hardware name: linux,dummy-virt (DT) [ 24.564106] Call trace: [ 24.564156] show_stack+0x20/0x38 (C) [ 24.564271] dump_stack_lvl+0x8c/0xd0 [ 24.564535] print_report+0x118/0x608 [ 24.564684] kasan_report+0xdc/0x128 [ 24.564914] __asan_report_load1_noabort+0x20/0x30 [ 24.565054] krealloc_uaf+0x4c8/0x520 [ 24.565251] kunit_try_run_case+0x170/0x3f0 [ 24.565472] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.565716] kthread+0x328/0x630 [ 24.565912] ret_from_fork+0x10/0x20 [ 24.566047] [ 24.566171] Allocated by task 166: [ 24.566358] kasan_save_stack+0x3c/0x68 [ 24.566484] kasan_save_track+0x20/0x40 [ 24.566609] kasan_save_alloc_info+0x40/0x58 [ 24.566720] __kasan_kmalloc+0xd4/0xd8 [ 24.566867] __kmalloc_cache_noprof+0x16c/0x3c0 [ 24.567169] krealloc_uaf+0xc8/0x520 [ 24.567357] kunit_try_run_case+0x170/0x3f0 [ 24.567495] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.568060] kthread+0x328/0x630 [ 24.568544] ret_from_fork+0x10/0x20 [ 24.568664] [ 24.568822] Freed by task 166: [ 24.569004] kasan_save_stack+0x3c/0x68 [ 24.570341] kasan_save_track+0x20/0x40 [ 24.570623] kasan_save_free_info+0x4c/0x78 [ 24.570731] __kasan_slab_free+0x6c/0x98 [ 24.571054] kfree+0x214/0x3c8 [ 24.571657] krealloc_uaf+0x12c/0x520 [ 24.571770] kunit_try_run_case+0x170/0x3f0 [ 24.571877] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.571999] kthread+0x328/0x630 [ 24.572553] ret_from_fork+0x10/0x20 [ 24.572659] [ 24.572758] The buggy address belongs to the object at fff00000c44aac00 [ 24.572758] which belongs to the cache kmalloc-256 of size 256 [ 24.573975] The buggy address is located 0 bytes inside of [ 24.573975] freed 256-byte region [fff00000c44aac00, fff00000c44aad00) [ 24.574902] [ 24.574967] The buggy address belongs to the physical page: [ 24.575047] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1044aa [ 24.575191] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.575571] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.575719] page_type: f5(slab) [ 24.575833] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.575967] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.576200] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.576383] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.576515] head: 0bfffe0000000001 ffffc1ffc3112a81 00000000ffffffff 00000000ffffffff [ 24.577339] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.577638] page dumped because: kasan: bad access detected [ 24.577713] [ 24.578061] Memory state around the buggy address: [ 24.578206] fff00000c44aab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.578450] fff00000c44aab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.578612] >fff00000c44aac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.579104] ^ [ 24.579180] fff00000c44aac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.579340] fff00000c44aad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.579499] ================================================================== [ 24.545528] ================================================================== [ 24.545799] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 24.546328] Read of size 1 at addr fff00000c44aac00 by task kunit_try_catch/166 [ 24.546521] [ 24.546610] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT [ 24.546800] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.546861] Hardware name: linux,dummy-virt (DT) [ 24.546931] Call trace: [ 24.546982] show_stack+0x20/0x38 (C) [ 24.547099] dump_stack_lvl+0x8c/0xd0 [ 24.547209] print_report+0x118/0x608 [ 24.547317] kasan_report+0xdc/0x128 [ 24.547444] __kasan_check_byte+0x54/0x70 [ 24.547554] krealloc_noprof+0x44/0x360 [ 24.547681] krealloc_uaf+0x180/0x520 [ 24.547790] kunit_try_run_case+0x170/0x3f0 [ 24.547903] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.548024] kthread+0x328/0x630 [ 24.548133] ret_from_fork+0x10/0x20 [ 24.548244] [ 24.548288] Allocated by task 166: [ 24.548353] kasan_save_stack+0x3c/0x68 [ 24.549491] kasan_save_track+0x20/0x40 [ 24.549795] kasan_save_alloc_info+0x40/0x58 [ 24.550282] __kasan_kmalloc+0xd4/0xd8 [ 24.550485] __kmalloc_cache_noprof+0x16c/0x3c0 [ 24.550606] krealloc_uaf+0xc8/0x520 [ 24.550731] kunit_try_run_case+0x170/0x3f0 [ 24.550822] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.551004] kthread+0x328/0x630 [ 24.551347] ret_from_fork+0x10/0x20 [ 24.551565] [ 24.551634] Freed by task 166: [ 24.551983] kasan_save_stack+0x3c/0x68 [ 24.552554] kasan_save_track+0x20/0x40 [ 24.552647] kasan_save_free_info+0x4c/0x78 [ 24.553012] __kasan_slab_free+0x6c/0x98 [ 24.553943] kfree+0x214/0x3c8 [ 24.554370] krealloc_uaf+0x12c/0x520 [ 24.554507] kunit_try_run_case+0x170/0x3f0 [ 24.554739] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.555288] kthread+0x328/0x630 [ 24.555702] ret_from_fork+0x10/0x20 [ 24.555974] [ 24.556162] The buggy address belongs to the object at fff00000c44aac00 [ 24.556162] which belongs to the cache kmalloc-256 of size 256 [ 24.556481] The buggy address is located 0 bytes inside of [ 24.556481] freed 256-byte region [fff00000c44aac00, fff00000c44aad00) [ 24.557023] [ 24.557200] The buggy address belongs to the physical page: [ 24.557316] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1044aa [ 24.557632] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.558004] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.558180] page_type: f5(slab) [ 24.558365] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.558499] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.558624] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.558786] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.558988] head: 0bfffe0000000001 ffffc1ffc3112a81 00000000ffffffff 00000000ffffffff [ 24.559334] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.559515] page dumped because: kasan: bad access detected [ 24.559593] [ 24.559641] Memory state around the buggy address: [ 24.559925] fff00000c44aab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.560090] fff00000c44aab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.560217] >fff00000c44aac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.560350] ^ [ 24.560492] fff00000c44aac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.560679] fff00000c44aad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.560829] ==================================================================
[ 16.999022] ================================================================== [ 17.000088] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 17.000772] Read of size 1 at addr ffff888100a10200 by task kunit_try_catch/185 [ 17.001910] [ 17.002328] CPU: 1 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 17.002454] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.002508] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.002589] Call Trace: [ 17.002650] <TASK> [ 17.002696] dump_stack_lvl+0x73/0xb0 [ 17.002746] print_report+0xd1/0x650 [ 17.002783] ? __virt_addr_valid+0x1db/0x2d0 [ 17.002815] ? krealloc_uaf+0x1b8/0x5e0 [ 17.002841] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.002875] ? krealloc_uaf+0x1b8/0x5e0 [ 17.002903] kasan_report+0x141/0x180 [ 17.002937] ? krealloc_uaf+0x1b8/0x5e0 [ 17.002966] ? krealloc_uaf+0x1b8/0x5e0 [ 17.002992] __kasan_check_byte+0x3d/0x50 [ 17.003025] krealloc_noprof+0x3f/0x340 [ 17.003060] krealloc_uaf+0x1b8/0x5e0 [ 17.003086] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.003110] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 17.003155] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.003186] kunit_try_run_case+0x1a5/0x480 [ 17.003271] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.003309] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.003345] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.003380] ? __kthread_parkme+0x82/0x180 [ 17.003413] ? preempt_count_sub+0x50/0x80 [ 17.003451] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.003486] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.003520] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.003555] kthread+0x337/0x6f0 [ 17.003578] ? trace_preempt_on+0x20/0xc0 [ 17.003636] ? __pfx_kthread+0x10/0x10 [ 17.003663] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.003695] ? calculate_sigpending+0x7b/0xa0 [ 17.003727] ? __pfx_kthread+0x10/0x10 [ 17.003752] ret_from_fork+0x41/0x80 [ 17.003785] ? __pfx_kthread+0x10/0x10 [ 17.003810] ret_from_fork_asm+0x1a/0x30 [ 17.003852] </TASK> [ 17.003867] [ 17.020291] Allocated by task 185: [ 17.021252] kasan_save_stack+0x45/0x70 [ 17.021872] kasan_save_track+0x18/0x40 [ 17.022494] kasan_save_alloc_info+0x3b/0x50 [ 17.022893] __kasan_kmalloc+0xb7/0xc0 [ 17.023235] __kmalloc_cache_noprof+0x189/0x420 [ 17.024093] krealloc_uaf+0xbb/0x5e0 [ 17.024773] kunit_try_run_case+0x1a5/0x480 [ 17.025427] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.025907] kthread+0x337/0x6f0 [ 17.026232] ret_from_fork+0x41/0x80 [ 17.026590] ret_from_fork_asm+0x1a/0x30 [ 17.027018] [ 17.027282] Freed by task 185: [ 17.027600] kasan_save_stack+0x45/0x70 [ 17.028062] kasan_save_track+0x18/0x40 [ 17.028550] kasan_save_free_info+0x3f/0x60 [ 17.028968] __kasan_slab_free+0x56/0x70 [ 17.029441] kfree+0x222/0x3f0 [ 17.029852] krealloc_uaf+0x13d/0x5e0 [ 17.030266] kunit_try_run_case+0x1a5/0x480 [ 17.030764] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.031258] kthread+0x337/0x6f0 [ 17.031695] ret_from_fork+0x41/0x80 [ 17.032088] ret_from_fork_asm+0x1a/0x30 [ 17.032559] [ 17.032824] The buggy address belongs to the object at ffff888100a10200 [ 17.032824] which belongs to the cache kmalloc-256 of size 256 [ 17.033989] The buggy address is located 0 bytes inside of [ 17.033989] freed 256-byte region [ffff888100a10200, ffff888100a10300) [ 17.034974] [ 17.035275] The buggy address belongs to the physical page: [ 17.035769] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a10 [ 17.036360] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.037078] flags: 0x200000000000040(head|node=0|zone=2) [ 17.037620] page_type: f5(slab) [ 17.037966] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.038769] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.039474] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.040146] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.040887] head: 0200000000000001 ffffea0004028401 00000000ffffffff 00000000ffffffff [ 17.041565] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.042133] page dumped because: kasan: bad access detected [ 17.042667] [ 17.042918] Memory state around the buggy address: [ 17.043377] ffff888100a10100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.043971] ffff888100a10180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.044653] >ffff888100a10200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.045295] ^ [ 17.045625] ffff888100a10280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.046272] ffff888100a10300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.046913] ================================================================== [ 17.048342] ================================================================== [ 17.048968] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 17.049534] Read of size 1 at addr ffff888100a10200 by task kunit_try_catch/185 [ 17.050439] [ 17.050705] CPU: 1 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 17.050819] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.050852] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.050901] Call Trace: [ 17.050945] <TASK> [ 17.050984] dump_stack_lvl+0x73/0xb0 [ 17.051052] print_report+0xd1/0x650 [ 17.051122] ? __virt_addr_valid+0x1db/0x2d0 [ 17.051190] ? krealloc_uaf+0x53c/0x5e0 [ 17.051305] ? kasan_complete_mode_report_info+0x64/0x200 [ 17.051402] ? krealloc_uaf+0x53c/0x5e0 [ 17.051499] kasan_report+0x141/0x180 [ 17.051576] ? krealloc_uaf+0x53c/0x5e0 [ 17.051671] __asan_report_load1_noabort+0x18/0x20 [ 17.051739] krealloc_uaf+0x53c/0x5e0 [ 17.051808] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.051858] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 17.051958] ? __pfx_krealloc_uaf+0x10/0x10 [ 17.052062] kunit_try_run_case+0x1a5/0x480 [ 17.052143] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.052249] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.052330] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.052407] ? __kthread_parkme+0x82/0x180 [ 17.052496] ? preempt_count_sub+0x50/0x80 [ 17.052620] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.052720] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.052824] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.052896] kthread+0x337/0x6f0 [ 17.052959] ? trace_preempt_on+0x20/0xc0 [ 17.053017] ? __pfx_kthread+0x10/0x10 [ 17.053044] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.053076] ? calculate_sigpending+0x7b/0xa0 [ 17.053105] ? __pfx_kthread+0x10/0x10 [ 17.053130] ret_from_fork+0x41/0x80 [ 17.053162] ? __pfx_kthread+0x10/0x10 [ 17.053187] ret_from_fork_asm+0x1a/0x30 [ 17.053278] </TASK> [ 17.053298] [ 17.067453] Allocated by task 185: [ 17.067850] kasan_save_stack+0x45/0x70 [ 17.068261] kasan_save_track+0x18/0x40 [ 17.068690] kasan_save_alloc_info+0x3b/0x50 [ 17.069127] __kasan_kmalloc+0xb7/0xc0 [ 17.070118] __kmalloc_cache_noprof+0x189/0x420 [ 17.072460] krealloc_uaf+0xbb/0x5e0 [ 17.073104] kunit_try_run_case+0x1a5/0x480 [ 17.073762] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.074127] kthread+0x337/0x6f0 [ 17.074407] ret_from_fork+0x41/0x80 [ 17.075279] ret_from_fork_asm+0x1a/0x30 [ 17.075963] [ 17.076186] Freed by task 185: [ 17.077151] kasan_save_stack+0x45/0x70 [ 17.077886] kasan_save_track+0x18/0x40 [ 17.078659] kasan_save_free_info+0x3f/0x60 [ 17.079352] __kasan_slab_free+0x56/0x70 [ 17.079804] kfree+0x222/0x3f0 [ 17.080141] krealloc_uaf+0x13d/0x5e0 [ 17.080624] kunit_try_run_case+0x1a5/0x480 [ 17.081108] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.081600] kthread+0x337/0x6f0 [ 17.082003] ret_from_fork+0x41/0x80 [ 17.082467] ret_from_fork_asm+0x1a/0x30 [ 17.082916] [ 17.083185] The buggy address belongs to the object at ffff888100a10200 [ 17.083185] which belongs to the cache kmalloc-256 of size 256 [ 17.084157] The buggy address is located 0 bytes inside of [ 17.084157] freed 256-byte region [ffff888100a10200, ffff888100a10300) [ 17.085043] [ 17.085296] The buggy address belongs to the physical page: [ 17.085884] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a10 [ 17.086647] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.087308] flags: 0x200000000000040(head|node=0|zone=2) [ 17.087788] page_type: f5(slab) [ 17.088129] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.088801] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.089326] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.090079] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.090770] head: 0200000000000001 ffffea0004028401 00000000ffffffff 00000000ffffffff [ 17.091487] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.092090] page dumped because: kasan: bad access detected [ 17.092633] [ 17.092910] Memory state around the buggy address: [ 17.093407] ffff888100a10100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.094054] ffff888100a10180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.094680] >ffff888100a10200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.095301] ^ [ 17.095704] ffff888100a10280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.096297] ffff888100a10300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.096874] ==================================================================