Date
July 3, 2025, 3:13 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.513103] ================================================================== [ 15.513151] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 15.513195] Read of size 1 at addr fff00000c4601000 by task kunit_try_catch/167 [ 15.513242] [ 15.513271] CPU: 1 UID: 0 PID: 167 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc1 #1 PREEMPT [ 15.513380] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.513408] Hardware name: linux,dummy-virt (DT) [ 15.513438] Call trace: [ 15.513459] show_stack+0x20/0x38 (C) [ 15.513504] dump_stack_lvl+0x8c/0xd0 [ 15.513551] print_report+0x118/0x608 [ 15.513594] kasan_report+0xdc/0x128 [ 15.513636] __asan_report_load1_noabort+0x20/0x30 [ 15.513698] krealloc_uaf+0x4c8/0x520 [ 15.513740] kunit_try_run_case+0x170/0x3f0 [ 15.513785] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.513836] kthread+0x328/0x630 [ 15.513879] ret_from_fork+0x10/0x20 [ 15.513923] [ 15.513968] Allocated by task 167: [ 15.513997] kasan_save_stack+0x3c/0x68 [ 15.514033] kasan_save_track+0x20/0x40 [ 15.514067] kasan_save_alloc_info+0x40/0x58 [ 15.514102] __kasan_kmalloc+0xd4/0xd8 [ 15.514135] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.515031] krealloc_uaf+0xc8/0x520 [ 15.515112] kunit_try_run_case+0x170/0x3f0 [ 15.515425] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.515577] kthread+0x328/0x630 [ 15.515647] ret_from_fork+0x10/0x20 [ 15.515724] [ 15.515860] Freed by task 167: [ 15.516043] kasan_save_stack+0x3c/0x68 [ 15.516148] kasan_save_track+0x20/0x40 [ 15.516190] kasan_save_free_info+0x4c/0x78 [ 15.516479] __kasan_slab_free+0x6c/0x98 [ 15.516574] kfree+0x214/0x3c8 [ 15.516739] krealloc_uaf+0x12c/0x520 [ 15.516775] kunit_try_run_case+0x170/0x3f0 [ 15.517049] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.517146] kthread+0x328/0x630 [ 15.517319] ret_from_fork+0x10/0x20 [ 15.517421] [ 15.517758] The buggy address belongs to the object at fff00000c4601000 [ 15.517758] which belongs to the cache kmalloc-256 of size 256 [ 15.517821] The buggy address is located 0 bytes inside of [ 15.517821] freed 256-byte region [fff00000c4601000, fff00000c4601100) [ 15.518184] [ 15.518337] The buggy address belongs to the physical page: [ 15.518369] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104600 [ 15.518427] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.518813] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.518934] page_type: f5(slab) [ 15.519059] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.519350] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.519469] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.519585] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.519668] head: 0bfffe0000000001 ffffc1ffc3118001 00000000ffffffff 00000000ffffffff [ 15.520049] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.520371] page dumped because: kasan: bad access detected [ 15.520488] [ 15.520615] Memory state around the buggy address: [ 15.520762] fff00000c4600f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.521016] fff00000c4600f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.521138] >fff00000c4601000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.521284] ^ [ 15.521323] fff00000c4601080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.521725] fff00000c4601100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.521810] ================================================================== [ 15.501789] ================================================================== [ 15.502098] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 15.502288] Read of size 1 at addr fff00000c4601000 by task kunit_try_catch/167 [ 15.502463] [ 15.502538] CPU: 1 UID: 0 PID: 167 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc1 #1 PREEMPT [ 15.502994] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.503080] Hardware name: linux,dummy-virt (DT) [ 15.503255] Call trace: [ 15.503421] show_stack+0x20/0x38 (C) [ 15.503512] dump_stack_lvl+0x8c/0xd0 [ 15.503655] print_report+0x118/0x608 [ 15.503701] kasan_report+0xdc/0x128 [ 15.503767] __kasan_check_byte+0x54/0x70 [ 15.504110] krealloc_noprof+0x44/0x360 [ 15.504224] krealloc_uaf+0x180/0x520 [ 15.504391] kunit_try_run_case+0x170/0x3f0 [ 15.504443] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.504715] kthread+0x328/0x630 [ 15.505126] ret_from_fork+0x10/0x20 [ 15.505259] [ 15.505292] Allocated by task 167: [ 15.505323] kasan_save_stack+0x3c/0x68 [ 15.505416] kasan_save_track+0x20/0x40 [ 15.505462] kasan_save_alloc_info+0x40/0x58 [ 15.505499] __kasan_kmalloc+0xd4/0xd8 [ 15.505541] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.505577] krealloc_uaf+0xc8/0x520 [ 15.505609] kunit_try_run_case+0x170/0x3f0 [ 15.505646] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.505687] kthread+0x328/0x630 [ 15.505728] ret_from_fork+0x10/0x20 [ 15.505763] [ 15.505781] Freed by task 167: [ 15.505812] kasan_save_stack+0x3c/0x68 [ 15.505846] kasan_save_track+0x20/0x40 [ 15.505879] kasan_save_free_info+0x4c/0x78 [ 15.505915] __kasan_slab_free+0x6c/0x98 [ 15.506180] kfree+0x214/0x3c8 [ 15.506447] krealloc_uaf+0x12c/0x520 [ 15.506512] kunit_try_run_case+0x170/0x3f0 [ 15.506573] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.506716] kthread+0x328/0x630 [ 15.506777] ret_from_fork+0x10/0x20 [ 15.507052] [ 15.507099] The buggy address belongs to the object at fff00000c4601000 [ 15.507099] which belongs to the cache kmalloc-256 of size 256 [ 15.507499] The buggy address is located 0 bytes inside of [ 15.507499] freed 256-byte region [fff00000c4601000, fff00000c4601100) [ 15.507697] [ 15.507717] The buggy address belongs to the physical page: [ 15.507966] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104600 [ 15.508176] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.508464] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.508653] page_type: f5(slab) [ 15.508752] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.508934] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.509445] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.509588] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.509694] head: 0bfffe0000000001 ffffc1ffc3118001 00000000ffffffff 00000000ffffffff [ 15.509915] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.510100] page dumped because: kasan: bad access detected [ 15.510131] [ 15.510156] Memory state around the buggy address: [ 15.510565] fff00000c4600f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.510741] fff00000c4600f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.510944] >fff00000c4601000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.511310] ^ [ 15.511376] fff00000c4601080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.512070] fff00000c4601100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.512138] ==================================================================
[ 11.121039] ================================================================== [ 11.122404] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.123090] Read of size 1 at addr ffff888100a2bc00 by task kunit_try_catch/183 [ 11.123823] [ 11.124023] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc1 #1 PREEMPT(voluntary) [ 11.124072] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.124084] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.124118] Call Trace: [ 11.124133] <TASK> [ 11.124153] dump_stack_lvl+0x73/0xb0 [ 11.124194] print_report+0xd1/0x650 [ 11.124226] ? __virt_addr_valid+0x1db/0x2d0 [ 11.124266] ? krealloc_uaf+0x1b8/0x5e0 [ 11.124284] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.124306] ? krealloc_uaf+0x1b8/0x5e0 [ 11.124324] kasan_report+0x141/0x180 [ 11.124367] ? krealloc_uaf+0x1b8/0x5e0 [ 11.124389] ? krealloc_uaf+0x1b8/0x5e0 [ 11.124407] __kasan_check_byte+0x3d/0x50 [ 11.124430] krealloc_noprof+0x3f/0x340 [ 11.124453] krealloc_uaf+0x1b8/0x5e0 [ 11.124472] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.124490] ? finish_task_switch.isra.0+0x153/0x700 [ 11.124514] ? __switch_to+0x5d9/0xf60 [ 11.124536] ? dequeue_task_fair+0x166/0x4e0 [ 11.124560] ? __schedule+0x10cc/0x2b60 [ 11.124583] ? __pfx_read_tsc+0x10/0x10 [ 11.124603] ? ktime_get_ts64+0x86/0x230 [ 11.124629] kunit_try_run_case+0x1a5/0x480 [ 11.124670] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.124692] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.124716] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.124739] ? __kthread_parkme+0x82/0x180 [ 11.124761] ? preempt_count_sub+0x50/0x80 [ 11.124785] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.124808] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.124831] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.124854] kthread+0x337/0x6f0 [ 11.124871] ? trace_preempt_on+0x20/0xc0 [ 11.124895] ? __pfx_kthread+0x10/0x10 [ 11.124912] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.124934] ? calculate_sigpending+0x7b/0xa0 [ 11.124955] ? __pfx_kthread+0x10/0x10 [ 11.124975] ret_from_fork+0x41/0x80 [ 11.124995] ? __pfx_kthread+0x10/0x10 [ 11.125013] ret_from_fork_asm+0x1a/0x30 [ 11.125044] </TASK> [ 11.125055] [ 11.140410] Allocated by task 183: [ 11.140857] kasan_save_stack+0x45/0x70 [ 11.141149] kasan_save_track+0x18/0x40 [ 11.141546] kasan_save_alloc_info+0x3b/0x50 [ 11.141817] __kasan_kmalloc+0xb7/0xc0 [ 11.142185] __kmalloc_cache_noprof+0x189/0x420 [ 11.142680] krealloc_uaf+0xbb/0x5e0 [ 11.142816] kunit_try_run_case+0x1a5/0x480 [ 11.142962] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.143136] kthread+0x337/0x6f0 [ 11.143268] ret_from_fork+0x41/0x80 [ 11.143508] ret_from_fork_asm+0x1a/0x30 [ 11.143720] [ 11.143837] Freed by task 183: [ 11.144132] kasan_save_stack+0x45/0x70 [ 11.144537] kasan_save_track+0x18/0x40 [ 11.144738] kasan_save_free_info+0x3f/0x60 [ 11.144949] __kasan_slab_free+0x56/0x70 [ 11.145176] kfree+0x222/0x3f0 [ 11.145350] krealloc_uaf+0x13d/0x5e0 [ 11.145595] kunit_try_run_case+0x1a5/0x480 [ 11.145803] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.146049] kthread+0x337/0x6f0 [ 11.146465] ret_from_fork+0x41/0x80 [ 11.146732] ret_from_fork_asm+0x1a/0x30 [ 11.146939] [ 11.147038] The buggy address belongs to the object at ffff888100a2bc00 [ 11.147038] which belongs to the cache kmalloc-256 of size 256 [ 11.148526] The buggy address is located 0 bytes inside of [ 11.148526] freed 256-byte region [ffff888100a2bc00, ffff888100a2bd00) [ 11.149101] [ 11.149201] The buggy address belongs to the physical page: [ 11.149938] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a2a [ 11.150731] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.151050] flags: 0x200000000000040(head|node=0|zone=2) [ 11.151635] page_type: f5(slab) [ 11.151819] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.152135] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.152840] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.153590] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.154036] head: 0200000000000001 ffffea0004028a81 00000000ffffffff 00000000ffffffff [ 11.154448] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.154895] page dumped because: kasan: bad access detected [ 11.155127] [ 11.155215] Memory state around the buggy address: [ 11.155389] ffff888100a2bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.155784] ffff888100a2bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.156138] >ffff888100a2bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.156537] ^ [ 11.156764] ffff888100a2bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.157017] ffff888100a2bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.157399] ================================================================== [ 11.158265] ================================================================== [ 11.158973] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.159198] Read of size 1 at addr ffff888100a2bc00 by task kunit_try_catch/183 [ 11.159653] [ 11.159774] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.5-rc1 #1 PREEMPT(voluntary) [ 11.159820] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.159843] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.159865] Call Trace: [ 11.159884] <TASK> [ 11.159917] dump_stack_lvl+0x73/0xb0 [ 11.159943] print_report+0xd1/0x650 [ 11.159967] ? __virt_addr_valid+0x1db/0x2d0 [ 11.159989] ? krealloc_uaf+0x53c/0x5e0 [ 11.160007] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.160030] ? krealloc_uaf+0x53c/0x5e0 [ 11.160048] kasan_report+0x141/0x180 [ 11.160071] ? krealloc_uaf+0x53c/0x5e0 [ 11.160093] __asan_report_load1_noabort+0x18/0x20 [ 11.160114] krealloc_uaf+0x53c/0x5e0 [ 11.160132] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.160149] ? finish_task_switch.isra.0+0x153/0x700 [ 11.160276] ? __switch_to+0x5d9/0xf60 [ 11.160298] ? dequeue_task_fair+0x166/0x4e0 [ 11.160414] ? __schedule+0x10cc/0x2b60 [ 11.160443] ? __pfx_read_tsc+0x10/0x10 [ 11.160463] ? ktime_get_ts64+0x86/0x230 [ 11.160489] kunit_try_run_case+0x1a5/0x480 [ 11.160515] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.160537] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.160562] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.160585] ? __kthread_parkme+0x82/0x180 [ 11.160608] ? preempt_count_sub+0x50/0x80 [ 11.160793] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.160817] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.160841] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.160876] kthread+0x337/0x6f0 [ 11.160893] ? trace_preempt_on+0x20/0xc0 [ 11.160917] ? __pfx_kthread+0x10/0x10 [ 11.160947] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.160969] ? calculate_sigpending+0x7b/0xa0 [ 11.160991] ? __pfx_kthread+0x10/0x10 [ 11.161010] ret_from_fork+0x41/0x80 [ 11.161030] ? __pfx_kthread+0x10/0x10 [ 11.161048] ret_from_fork_asm+0x1a/0x30 [ 11.161079] </TASK> [ 11.161090] [ 11.174399] Allocated by task 183: [ 11.174767] kasan_save_stack+0x45/0x70 [ 11.174931] kasan_save_track+0x18/0x40 [ 11.175066] kasan_save_alloc_info+0x3b/0x50 [ 11.175208] __kasan_kmalloc+0xb7/0xc0 [ 11.175355] __kmalloc_cache_noprof+0x189/0x420 [ 11.175575] krealloc_uaf+0xbb/0x5e0 [ 11.175874] kunit_try_run_case+0x1a5/0x480 [ 11.176084] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.176308] kthread+0x337/0x6f0 [ 11.176479] ret_from_fork+0x41/0x80 [ 11.176664] ret_from_fork_asm+0x1a/0x30 [ 11.177037] [ 11.177115] Freed by task 183: [ 11.177280] kasan_save_stack+0x45/0x70 [ 11.177766] kasan_save_track+0x18/0x40 [ 11.177952] kasan_save_free_info+0x3f/0x60 [ 11.178128] __kasan_slab_free+0x56/0x70 [ 11.178305] kfree+0x222/0x3f0 [ 11.178471] krealloc_uaf+0x13d/0x5e0 [ 11.178784] kunit_try_run_case+0x1a5/0x480 [ 11.178947] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.179165] kthread+0x337/0x6f0 [ 11.179344] ret_from_fork+0x41/0x80 [ 11.179477] ret_from_fork_asm+0x1a/0x30 [ 11.179809] [ 11.179889] The buggy address belongs to the object at ffff888100a2bc00 [ 11.179889] which belongs to the cache kmalloc-256 of size 256 [ 11.180621] The buggy address is located 0 bytes inside of [ 11.180621] freed 256-byte region [ffff888100a2bc00, ffff888100a2bd00) [ 11.181133] [ 11.181209] The buggy address belongs to the physical page: [ 11.181398] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a2a [ 11.182124] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.182719] flags: 0x200000000000040(head|node=0|zone=2) [ 11.183056] page_type: f5(slab) [ 11.183266] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.183517] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.184111] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.184734] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.185084] head: 0200000000000001 ffffea0004028a81 00000000ffffffff 00000000ffffffff [ 11.185659] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.185999] page dumped because: kasan: bad access detected [ 11.186233] [ 11.186399] Memory state around the buggy address: [ 11.186744] ffff888100a2bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.187048] ffff888100a2bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.187372] >ffff888100a2bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.187654] ^ [ 11.187946] ffff888100a2bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.188257] ffff888100a2bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.188706] ==================================================================