Date
July 15, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.822714] ================================================================== [ 17.822768] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 17.823301] Read of size 1 at addr fff00000c1c50400 by task kunit_try_catch/166 [ 17.823752] [ 17.823857] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT [ 17.823969] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.824066] Hardware name: linux,dummy-virt (DT) [ 17.824104] Call trace: [ 17.824142] show_stack+0x20/0x38 (C) [ 17.824223] dump_stack_lvl+0x8c/0xd0 [ 17.824272] print_report+0x118/0x5d0 [ 17.824608] kasan_report+0xdc/0x128 [ 17.824698] __asan_report_load1_noabort+0x20/0x30 [ 17.824753] krealloc_uaf+0x4c8/0x520 [ 17.824829] kunit_try_run_case+0x170/0x3f0 [ 17.824959] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.825013] kthread+0x328/0x630 [ 17.825057] ret_from_fork+0x10/0x20 [ 17.825103] [ 17.825121] Allocated by task 166: [ 17.825147] kasan_save_stack+0x3c/0x68 [ 17.825185] kasan_save_track+0x20/0x40 [ 17.825383] kasan_save_alloc_info+0x40/0x58 [ 17.825641] __kasan_kmalloc+0xd4/0xd8 [ 17.825795] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.825893] krealloc_uaf+0xc8/0x520 [ 17.826013] kunit_try_run_case+0x170/0x3f0 [ 17.826055] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.826100] kthread+0x328/0x630 [ 17.826141] ret_from_fork+0x10/0x20 [ 17.826314] [ 17.826338] Freed by task 166: [ 17.826517] kasan_save_stack+0x3c/0x68 [ 17.826575] kasan_save_track+0x20/0x40 [ 17.826612] kasan_save_free_info+0x4c/0x78 [ 17.826660] __kasan_slab_free+0x6c/0x98 [ 17.826696] kfree+0x214/0x3c8 [ 17.826741] krealloc_uaf+0x12c/0x520 [ 17.826777] kunit_try_run_case+0x170/0x3f0 [ 17.826815] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.826868] kthread+0x328/0x630 [ 17.826902] ret_from_fork+0x10/0x20 [ 17.826945] [ 17.826964] The buggy address belongs to the object at fff00000c1c50400 [ 17.826964] which belongs to the cache kmalloc-256 of size 256 [ 17.827032] The buggy address is located 0 bytes inside of [ 17.827032] freed 256-byte region [fff00000c1c50400, fff00000c1c50500) [ 17.827102] [ 17.827121] The buggy address belongs to the physical page: [ 17.827152] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c50 [ 17.827236] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.827313] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.827576] page_type: f5(slab) [ 17.827887] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.828097] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.828159] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.828305] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.828410] head: 0bfffe0000000001 ffffc1ffc3071401 00000000ffffffff 00000000ffffffff [ 17.828687] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.828864] page dumped because: kasan: bad access detected [ 17.828962] [ 17.829039] Memory state around the buggy address: [ 17.829109] fff00000c1c50300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.829194] fff00000c1c50380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.829353] >fff00000c1c50400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.829566] ^ [ 17.829665] fff00000c1c50480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.829829] fff00000c1c50500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.829950] ================================================================== [ 17.808940] ================================================================== [ 17.809004] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 17.809057] Read of size 1 at addr fff00000c1c50400 by task kunit_try_catch/166 [ 17.809128] [ 17.809159] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT [ 17.809961] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.810050] Hardware name: linux,dummy-virt (DT) [ 17.810219] Call trace: [ 17.810302] show_stack+0x20/0x38 (C) [ 17.810377] dump_stack_lvl+0x8c/0xd0 [ 17.810700] print_report+0x118/0x5d0 [ 17.810865] kasan_report+0xdc/0x128 [ 17.811019] __kasan_check_byte+0x54/0x70 [ 17.811585] krealloc_noprof+0x44/0x360 [ 17.811870] krealloc_uaf+0x180/0x520 [ 17.812088] kunit_try_run_case+0x170/0x3f0 [ 17.812437] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.813060] kthread+0x328/0x630 [ 17.813434] ret_from_fork+0x10/0x20 [ 17.813533] [ 17.813553] Allocated by task 166: [ 17.813581] kasan_save_stack+0x3c/0x68 [ 17.813621] kasan_save_track+0x20/0x40 [ 17.813666] kasan_save_alloc_info+0x40/0x58 [ 17.814144] __kasan_kmalloc+0xd4/0xd8 [ 17.814377] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.814574] krealloc_uaf+0xc8/0x520 [ 17.814615] kunit_try_run_case+0x170/0x3f0 [ 17.814665] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.814726] kthread+0x328/0x630 [ 17.814763] ret_from_fork+0x10/0x20 [ 17.814813] [ 17.814833] Freed by task 166: [ 17.814872] kasan_save_stack+0x3c/0x68 [ 17.814908] kasan_save_track+0x20/0x40 [ 17.814952] kasan_save_free_info+0x4c/0x78 [ 17.814990] __kasan_slab_free+0x6c/0x98 [ 17.815031] kfree+0x214/0x3c8 [ 17.815062] krealloc_uaf+0x12c/0x520 [ 17.815104] kunit_try_run_case+0x170/0x3f0 [ 17.815152] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.815196] kthread+0x328/0x630 [ 17.815243] ret_from_fork+0x10/0x20 [ 17.815481] [ 17.815915] The buggy address belongs to the object at fff00000c1c50400 [ 17.815915] which belongs to the cache kmalloc-256 of size 256 [ 17.816405] The buggy address is located 0 bytes inside of [ 17.816405] freed 256-byte region [fff00000c1c50400, fff00000c1c50500) [ 17.816808] [ 17.816903] The buggy address belongs to the physical page: [ 17.816981] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c50 [ 17.817037] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.817423] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.817537] page_type: f5(slab) [ 17.817593] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.817769] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.818114] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.818255] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.818309] head: 0bfffe0000000001 ffffc1ffc3071401 00000000ffffffff 00000000ffffffff [ 17.818424] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.818578] page dumped because: kasan: bad access detected [ 17.818820] [ 17.818845] Memory state around the buggy address: [ 17.819014] fff00000c1c50300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.819283] fff00000c1c50380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.819479] >fff00000c1c50400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.819686] ^ [ 17.819740] fff00000c1c50480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.819896] fff00000c1c50500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.820157] ==================================================================
[ 10.936087] ================================================================== [ 10.936564] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 10.936862] Read of size 1 at addr ffff888100353c00 by task kunit_try_catch/183 [ 10.937292] [ 10.937411] CPU: 0 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT(voluntary) [ 10.937455] Tainted: [B]=BAD_PAGE, [N]=TEST [ 10.937466] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 10.937485] Call Trace: [ 10.937497] <TASK> [ 10.937513] dump_stack_lvl+0x73/0xb0 [ 10.937555] print_report+0xd1/0x610 [ 10.937577] ? __virt_addr_valid+0x1db/0x2d0 [ 10.937610] ? krealloc_uaf+0x1b8/0x5e0 [ 10.937635] ? kasan_complete_mode_report_info+0x64/0x200 [ 10.937657] ? krealloc_uaf+0x1b8/0x5e0 [ 10.937674] kasan_report+0x141/0x180 [ 10.937706] ? krealloc_uaf+0x1b8/0x5e0 [ 10.937726] ? krealloc_uaf+0x1b8/0x5e0 [ 10.937743] __kasan_check_byte+0x3d/0x50 [ 10.937818] krealloc_noprof+0x3f/0x340 [ 10.937844] krealloc_uaf+0x1b8/0x5e0 [ 10.937862] ? __pfx_krealloc_uaf+0x10/0x10 [ 10.937889] ? finish_task_switch.isra.0+0x153/0x700 [ 10.937913] ? __switch_to+0x5d9/0xf60 [ 10.937934] ? dequeue_task_fair+0x166/0x4e0 [ 10.937967] ? __schedule+0x10cc/0x2b60 [ 10.937992] ? __pfx_read_tsc+0x10/0x10 [ 10.938011] ? ktime_get_ts64+0x86/0x230 [ 10.938048] kunit_try_run_case+0x1a5/0x480 [ 10.938069] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.938086] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 10.938109] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 10.938132] ? __kthread_parkme+0x82/0x180 [ 10.938161] ? preempt_count_sub+0x50/0x80 [ 10.938184] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.938203] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.938225] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 10.938257] kthread+0x337/0x6f0 [ 10.938273] ? trace_preempt_on+0x20/0xc0 [ 10.938295] ? __pfx_kthread+0x10/0x10 [ 10.938312] ? _raw_spin_unlock_irq+0x47/0x80 [ 10.938332] ? calculate_sigpending+0x7b/0xa0 [ 10.938353] ? __pfx_kthread+0x10/0x10 [ 10.938370] ret_from_fork+0x41/0x80 [ 10.938389] ? __pfx_kthread+0x10/0x10 [ 10.938405] ret_from_fork_asm+0x1a/0x30 [ 10.938435] </TASK> [ 10.938445] [ 10.948577] Allocated by task 183: [ 10.948825] kasan_save_stack+0x45/0x70 [ 10.949094] kasan_save_track+0x18/0x40 [ 10.949294] kasan_save_alloc_info+0x3b/0x50 [ 10.949446] __kasan_kmalloc+0xb7/0xc0 [ 10.949575] __kmalloc_cache_noprof+0x189/0x420 [ 10.949967] krealloc_uaf+0xbb/0x5e0 [ 10.950125] kunit_try_run_case+0x1a5/0x480 [ 10.950266] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.950519] kthread+0x337/0x6f0 [ 10.950745] ret_from_fork+0x41/0x80 [ 10.951053] ret_from_fork_asm+0x1a/0x30 [ 10.951266] [ 10.951370] Freed by task 183: [ 10.951574] kasan_save_stack+0x45/0x70 [ 10.951758] kasan_save_track+0x18/0x40 [ 10.952149] kasan_save_free_info+0x3f/0x60 [ 10.952378] __kasan_slab_free+0x56/0x70 [ 10.952514] kfree+0x222/0x3f0 [ 10.952638] krealloc_uaf+0x13d/0x5e0 [ 10.952811] kunit_try_run_case+0x1a5/0x480 [ 10.953125] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.953402] kthread+0x337/0x6f0 [ 10.953523] ret_from_fork+0x41/0x80 [ 10.953734] ret_from_fork_asm+0x1a/0x30 [ 10.954121] [ 10.954232] The buggy address belongs to the object at ffff888100353c00 [ 10.954232] which belongs to the cache kmalloc-256 of size 256 [ 10.954828] The buggy address is located 0 bytes inside of [ 10.954828] freed 256-byte region [ffff888100353c00, ffff888100353d00) [ 10.955319] [ 10.955433] The buggy address belongs to the physical page: [ 10.955682] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100352 [ 10.955998] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 10.956263] flags: 0x200000000000040(head|node=0|zone=2) [ 10.956543] page_type: f5(slab) [ 10.956847] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 10.957207] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 10.957553] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 10.957972] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 10.958310] head: 0200000000000001 ffffea000400d481 00000000ffffffff 00000000ffffffff [ 10.958636] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 10.959058] page dumped because: kasan: bad access detected [ 10.959284] [ 10.959387] Memory state around the buggy address: [ 10.959605] ffff888100353b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.960032] ffff888100353b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.960336] >ffff888100353c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 10.960639] ^ [ 10.960932] ffff888100353c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 10.961256] ffff888100353d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.961571] ================================================================== [ 10.962530] ================================================================== [ 10.962832] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 10.963305] Read of size 1 at addr ffff888100353c00 by task kunit_try_catch/183 [ 10.963674] [ 10.963835] CPU: 0 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT(voluntary) [ 10.963895] Tainted: [B]=BAD_PAGE, [N]=TEST [ 10.963907] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 10.963925] Call Trace: [ 10.963936] <TASK> [ 10.963949] dump_stack_lvl+0x73/0xb0 [ 10.963973] print_report+0xd1/0x610 [ 10.963994] ? __virt_addr_valid+0x1db/0x2d0 [ 10.964014] ? krealloc_uaf+0x53c/0x5e0 [ 10.964030] ? kasan_complete_mode_report_info+0x64/0x200 [ 10.964062] ? krealloc_uaf+0x53c/0x5e0 [ 10.964079] kasan_report+0x141/0x180 [ 10.964101] ? krealloc_uaf+0x53c/0x5e0 [ 10.964133] __asan_report_load1_noabort+0x18/0x20 [ 10.964152] krealloc_uaf+0x53c/0x5e0 [ 10.964169] ? __pfx_krealloc_uaf+0x10/0x10 [ 10.964185] ? finish_task_switch.isra.0+0x153/0x700 [ 10.964206] ? __switch_to+0x5d9/0xf60 [ 10.964224] ? dequeue_task_fair+0x166/0x4e0 [ 10.964247] ? __schedule+0x10cc/0x2b60 [ 10.964269] ? __pfx_read_tsc+0x10/0x10 [ 10.964286] ? ktime_get_ts64+0x86/0x230 [ 10.964309] kunit_try_run_case+0x1a5/0x480 [ 10.964338] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.964355] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 10.964377] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 10.964410] ? __kthread_parkme+0x82/0x180 [ 10.964430] ? preempt_count_sub+0x50/0x80 [ 10.964453] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.964473] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.964494] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 10.964516] kthread+0x337/0x6f0 [ 10.964531] ? trace_preempt_on+0x20/0xc0 [ 10.964553] ? __pfx_kthread+0x10/0x10 [ 10.964569] ? _raw_spin_unlock_irq+0x47/0x80 [ 10.964590] ? calculate_sigpending+0x7b/0xa0 [ 10.964610] ? __pfx_kthread+0x10/0x10 [ 10.964626] ret_from_fork+0x41/0x80 [ 10.964645] ? __pfx_kthread+0x10/0x10 [ 10.964662] ret_from_fork_asm+0x1a/0x30 [ 10.964741] </TASK> [ 10.964752] [ 10.972772] Allocated by task 183: [ 10.973003] kasan_save_stack+0x45/0x70 [ 10.973207] kasan_save_track+0x18/0x40 [ 10.973389] kasan_save_alloc_info+0x3b/0x50 [ 10.973598] __kasan_kmalloc+0xb7/0xc0 [ 10.973968] __kmalloc_cache_noprof+0x189/0x420 [ 10.974186] krealloc_uaf+0xbb/0x5e0 [ 10.974375] kunit_try_run_case+0x1a5/0x480 [ 10.974569] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.974951] kthread+0x337/0x6f0 [ 10.975123] ret_from_fork+0x41/0x80 [ 10.975290] ret_from_fork_asm+0x1a/0x30 [ 10.975427] [ 10.975495] Freed by task 183: [ 10.975601] kasan_save_stack+0x45/0x70 [ 10.975732] kasan_save_track+0x18/0x40 [ 10.975863] kasan_save_free_info+0x3f/0x60 [ 10.976196] __kasan_slab_free+0x56/0x70 [ 10.976454] kfree+0x222/0x3f0 [ 10.976620] krealloc_uaf+0x13d/0x5e0 [ 10.976981] kunit_try_run_case+0x1a5/0x480 [ 10.977196] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.977462] kthread+0x337/0x6f0 [ 10.977627] ret_from_fork+0x41/0x80 [ 10.977901] ret_from_fork_asm+0x1a/0x30 [ 10.978117] [ 10.978186] The buggy address belongs to the object at ffff888100353c00 [ 10.978186] which belongs to the cache kmalloc-256 of size 256 [ 10.978535] The buggy address is located 0 bytes inside of [ 10.978535] freed 256-byte region [ffff888100353c00, ffff888100353d00) [ 10.978993] [ 10.979091] The buggy address belongs to the physical page: [ 10.979373] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100352 [ 10.979775] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 10.980364] flags: 0x200000000000040(head|node=0|zone=2) [ 10.981093] page_type: f5(slab) [ 10.981623] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 10.982145] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 10.983028] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 10.983458] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 10.983962] head: 0200000000000001 ffffea000400d481 00000000ffffffff 00000000ffffffff [ 10.984368] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 10.985050] page dumped because: kasan: bad access detected [ 10.985409] [ 10.985488] Memory state around the buggy address: [ 10.985847] ffff888100353b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.986333] ffff888100353b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.986836] >ffff888100353c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 10.987153] ^ [ 10.987396] ffff888100353c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 10.987704] ffff888100353d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.988239] ==================================================================