Date
July 22, 2025, 2:40 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.149862] ================================================================== [ 17.149965] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 17.150018] Read of size 1 at addr fff00000c0923600 by task kunit_try_catch/166 [ 17.150084] [ 17.150155] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.8-rc1 #1 PREEMPT [ 17.150333] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.150392] Hardware name: linux,dummy-virt (DT) [ 17.150440] Call trace: [ 17.150479] show_stack+0x20/0x38 (C) [ 17.150574] dump_stack_lvl+0x8c/0xd0 [ 17.150638] print_report+0x118/0x5d0 [ 17.150696] kasan_report+0xdc/0x128 [ 17.150996] __asan_report_load1_noabort+0x20/0x30 [ 17.151170] krealloc_uaf+0x4c8/0x520 [ 17.151296] kunit_try_run_case+0x170/0x3f0 [ 17.151358] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.151627] kthread+0x328/0x630 [ 17.152140] ret_from_fork+0x10/0x20 [ 17.152467] [ 17.152547] Allocated by task 166: [ 17.152759] kasan_save_stack+0x3c/0x68 [ 17.152901] kasan_save_track+0x20/0x40 [ 17.152999] kasan_save_alloc_info+0x40/0x58 [ 17.153105] __kasan_kmalloc+0xd4/0xd8 [ 17.153169] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.153208] krealloc_uaf+0xc8/0x520 [ 17.153291] kunit_try_run_case+0x170/0x3f0 [ 17.153473] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.153721] kthread+0x328/0x630 [ 17.153778] ret_from_fork+0x10/0x20 [ 17.153941] [ 17.154011] Freed by task 166: [ 17.154243] kasan_save_stack+0x3c/0x68 [ 17.154470] kasan_save_track+0x20/0x40 [ 17.154536] kasan_save_free_info+0x4c/0x78 [ 17.154625] __kasan_slab_free+0x6c/0x98 [ 17.154733] kfree+0x214/0x3c8 [ 17.154803] krealloc_uaf+0x12c/0x520 [ 17.154917] kunit_try_run_case+0x170/0x3f0 [ 17.154989] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.155040] kthread+0x328/0x630 [ 17.155085] ret_from_fork+0x10/0x20 [ 17.155323] [ 17.155523] The buggy address belongs to the object at fff00000c0923600 [ 17.155523] which belongs to the cache kmalloc-256 of size 256 [ 17.155586] The buggy address is located 0 bytes inside of [ 17.155586] freed 256-byte region [fff00000c0923600, fff00000c0923700) [ 17.155947] [ 17.156213] The buggy address belongs to the physical page: [ 17.156300] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100922 [ 17.156401] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.156474] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.156754] page_type: f5(slab) [ 17.156901] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.157108] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.157205] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.157401] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.157493] head: 0bfffe0000000001 ffffc1ffc3024881 00000000ffffffff 00000000ffffffff [ 17.157577] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.157678] page dumped because: kasan: bad access detected [ 17.157726] [ 17.157743] Memory state around the buggy address: [ 17.157799] fff00000c0923500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.158036] fff00000c0923580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.158258] >fff00000c0923600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.158387] ^ [ 17.158464] fff00000c0923680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.158529] fff00000c0923700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.158612] ================================================================== [ 17.142390] ================================================================== [ 17.142771] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 17.142977] Read of size 1 at addr fff00000c0923600 by task kunit_try_catch/166 [ 17.143089] [ 17.143193] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G B N 6.15.8-rc1 #1 PREEMPT [ 17.143276] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.143336] Hardware name: linux,dummy-virt (DT) [ 17.143737] Call trace: [ 17.143798] show_stack+0x20/0x38 (C) [ 17.143945] dump_stack_lvl+0x8c/0xd0 [ 17.144024] print_report+0x118/0x5d0 [ 17.144118] kasan_report+0xdc/0x128 [ 17.144163] __kasan_check_byte+0x54/0x70 [ 17.144216] krealloc_noprof+0x44/0x360 [ 17.144270] krealloc_uaf+0x180/0x520 [ 17.144326] kunit_try_run_case+0x170/0x3f0 [ 17.144373] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.144421] kthread+0x328/0x630 [ 17.144465] ret_from_fork+0x10/0x20 [ 17.144517] [ 17.144546] Allocated by task 166: [ 17.144583] kasan_save_stack+0x3c/0x68 [ 17.144635] kasan_save_track+0x20/0x40 [ 17.144670] kasan_save_alloc_info+0x40/0x58 [ 17.144715] __kasan_kmalloc+0xd4/0xd8 [ 17.144749] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.144794] krealloc_uaf+0xc8/0x520 [ 17.144853] kunit_try_run_case+0x170/0x3f0 [ 17.144892] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.144931] kthread+0x328/0x630 [ 17.144975] ret_from_fork+0x10/0x20 [ 17.145023] [ 17.145056] Freed by task 166: [ 17.145102] kasan_save_stack+0x3c/0x68 [ 17.145136] kasan_save_track+0x20/0x40 [ 17.145191] kasan_save_free_info+0x4c/0x78 [ 17.145252] __kasan_slab_free+0x6c/0x98 [ 17.145307] kfree+0x214/0x3c8 [ 17.145345] krealloc_uaf+0x12c/0x520 [ 17.145391] kunit_try_run_case+0x170/0x3f0 [ 17.145433] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.145485] kthread+0x328/0x630 [ 17.145529] ret_from_fork+0x10/0x20 [ 17.145572] [ 17.145592] The buggy address belongs to the object at fff00000c0923600 [ 17.145592] which belongs to the cache kmalloc-256 of size 256 [ 17.145762] The buggy address is located 0 bytes inside of [ 17.145762] freed 256-byte region [fff00000c0923600, fff00000c0923700) [ 17.145851] [ 17.145878] The buggy address belongs to the physical page: [ 17.145909] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100922 [ 17.145978] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.146033] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.146093] page_type: f5(slab) [ 17.146131] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.146178] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.146226] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.146317] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.147157] head: 0bfffe0000000001 ffffc1ffc3024881 00000000ffffffff 00000000ffffffff [ 17.147231] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.147306] page dumped because: kasan: bad access detected [ 17.147370] [ 17.147443] Memory state around the buggy address: [ 17.147479] fff00000c0923500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.147538] fff00000c0923580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.147586] >fff00000c0923600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.147771] ^ [ 17.147933] fff00000c0923680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.148000] fff00000c0923700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.148223] ==================================================================
[ 11.009912] ================================================================== [ 11.011560] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.012330] Read of size 1 at addr ffff888100a9cc00 by task kunit_try_catch/184 [ 11.013081] [ 11.013362] CPU: 1 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.8-rc1 #1 PREEMPT(voluntary) [ 11.013431] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.013442] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.013465] Call Trace: [ 11.013478] <TASK> [ 11.013494] dump_stack_lvl+0x73/0xb0 [ 11.013548] print_report+0xd1/0x610 [ 11.013570] ? __virt_addr_valid+0x1db/0x2d0 [ 11.013593] ? krealloc_uaf+0x1b8/0x5e0 [ 11.013635] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.013656] ? krealloc_uaf+0x1b8/0x5e0 [ 11.013674] kasan_report+0x141/0x180 [ 11.013706] ? krealloc_uaf+0x1b8/0x5e0 [ 11.013727] ? krealloc_uaf+0x1b8/0x5e0 [ 11.013744] __kasan_check_byte+0x3d/0x50 [ 11.013782] krealloc_noprof+0x3f/0x340 [ 11.013806] krealloc_uaf+0x1b8/0x5e0 [ 11.013823] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.013840] ? finish_task_switch.isra.0+0x153/0x700 [ 11.013864] ? __switch_to+0x5d9/0xf60 [ 11.013885] ? dequeue_task_fair+0x166/0x4e0 [ 11.013908] ? __schedule+0x10c6/0x2b60 [ 11.013932] ? __pfx_read_tsc+0x10/0x10 [ 11.013952] ? ktime_get_ts64+0x86/0x230 [ 11.013978] kunit_try_run_case+0x1a5/0x480 [ 11.013999] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.014017] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.014037] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.014060] ? __kthread_parkme+0x82/0x180 [ 11.014082] ? preempt_count_sub+0x50/0x80 [ 11.014105] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.014124] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.014146] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.014168] kthread+0x337/0x6f0 [ 11.014184] ? trace_preempt_on+0x20/0xc0 [ 11.014208] ? __pfx_kthread+0x10/0x10 [ 11.014234] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.014255] ? calculate_sigpending+0x7b/0xa0 [ 11.014277] ? __pfx_kthread+0x10/0x10 [ 11.014294] ret_from_fork+0x41/0x80 [ 11.014314] ? __pfx_kthread+0x10/0x10 [ 11.014331] ret_from_fork_asm+0x1a/0x30 [ 11.014377] </TASK> [ 11.014387] [ 11.031553] Allocated by task 184: [ 11.032003] kasan_save_stack+0x45/0x70 [ 11.032534] kasan_save_track+0x18/0x40 [ 11.032875] kasan_save_alloc_info+0x3b/0x50 [ 11.033424] __kasan_kmalloc+0xb7/0xc0 [ 11.033634] __kmalloc_cache_noprof+0x189/0x420 [ 11.034138] krealloc_uaf+0xbb/0x5e0 [ 11.034566] kunit_try_run_case+0x1a5/0x480 [ 11.034782] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.034958] kthread+0x337/0x6f0 [ 11.035077] ret_from_fork+0x41/0x80 [ 11.035206] ret_from_fork_asm+0x1a/0x30 [ 11.035386] [ 11.035593] Freed by task 184: [ 11.036039] kasan_save_stack+0x45/0x70 [ 11.036476] kasan_save_track+0x18/0x40 [ 11.036953] kasan_save_free_info+0x3f/0x60 [ 11.037378] __kasan_slab_free+0x56/0x70 [ 11.037888] kfree+0x222/0x3f0 [ 11.038220] krealloc_uaf+0x13d/0x5e0 [ 11.038618] kunit_try_run_case+0x1a5/0x480 [ 11.039139] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.039755] kthread+0x337/0x6f0 [ 11.040091] ret_from_fork+0x41/0x80 [ 11.040233] ret_from_fork_asm+0x1a/0x30 [ 11.040415] [ 11.040625] The buggy address belongs to the object at ffff888100a9cc00 [ 11.040625] which belongs to the cache kmalloc-256 of size 256 [ 11.041966] The buggy address is located 0 bytes inside of [ 11.041966] freed 256-byte region [ffff888100a9cc00, ffff888100a9cd00) [ 11.042548] [ 11.042809] The buggy address belongs to the physical page: [ 11.043349] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a9c [ 11.044124] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.044838] flags: 0x200000000000040(head|node=0|zone=2) [ 11.045171] page_type: f5(slab) [ 11.045311] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.046136] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.046944] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.047454] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.047768] head: 0200000000000001 ffffea000402a701 00000000ffffffff 00000000ffffffff [ 11.048468] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.049206] page dumped because: kasan: bad access detected [ 11.049457] [ 11.049598] Memory state around the buggy address: [ 11.050078] ffff888100a9cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.050679] ffff888100a9cb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.051342] >ffff888100a9cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.051561] ^ [ 11.051728] ffff888100a9cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.052353] ffff888100a9cd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.053075] ================================================================== [ 11.054112] ================================================================== [ 11.054673] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.055049] Read of size 1 at addr ffff888100a9cc00 by task kunit_try_catch/184 [ 11.055279] [ 11.055369] CPU: 1 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.8-rc1 #1 PREEMPT(voluntary) [ 11.055429] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.055440] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.055461] Call Trace: [ 11.055472] <TASK> [ 11.055500] dump_stack_lvl+0x73/0xb0 [ 11.055526] print_report+0xd1/0x610 [ 11.055549] ? __virt_addr_valid+0x1db/0x2d0 [ 11.055570] ? krealloc_uaf+0x53c/0x5e0 [ 11.055587] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.055608] ? krealloc_uaf+0x53c/0x5e0 [ 11.055625] kasan_report+0x141/0x180 [ 11.055647] ? krealloc_uaf+0x53c/0x5e0 [ 11.055669] __asan_report_load1_noabort+0x18/0x20 [ 11.055699] krealloc_uaf+0x53c/0x5e0 [ 11.055717] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.055733] ? finish_task_switch.isra.0+0x153/0x700 [ 11.055756] ? __switch_to+0x5d9/0xf60 [ 11.055786] ? dequeue_task_fair+0x166/0x4e0 [ 11.055809] ? __schedule+0x10c6/0x2b60 [ 11.055832] ? __pfx_read_tsc+0x10/0x10 [ 11.055851] ? ktime_get_ts64+0x86/0x230 [ 11.055876] kunit_try_run_case+0x1a5/0x480 [ 11.055896] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.055914] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.055933] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.055956] ? __kthread_parkme+0x82/0x180 [ 11.055977] ? preempt_count_sub+0x50/0x80 [ 11.056000] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.056019] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.056041] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.056063] kthread+0x337/0x6f0 [ 11.056078] ? trace_preempt_on+0x20/0xc0 [ 11.056101] ? __pfx_kthread+0x10/0x10 [ 11.056118] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.056148] ? calculate_sigpending+0x7b/0xa0 [ 11.056169] ? __pfx_kthread+0x10/0x10 [ 11.056187] ret_from_fork+0x41/0x80 [ 11.056206] ? __pfx_kthread+0x10/0x10 [ 11.056242] ret_from_fork_asm+0x1a/0x30 [ 11.056273] </TASK> [ 11.056282] [ 11.069996] Allocated by task 184: [ 11.070283] kasan_save_stack+0x45/0x70 [ 11.070475] kasan_save_track+0x18/0x40 [ 11.070743] kasan_save_alloc_info+0x3b/0x50 [ 11.070946] __kasan_kmalloc+0xb7/0xc0 [ 11.071100] __kmalloc_cache_noprof+0x189/0x420 [ 11.071329] krealloc_uaf+0xbb/0x5e0 [ 11.071555] kunit_try_run_case+0x1a5/0x480 [ 11.071874] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.072088] kthread+0x337/0x6f0 [ 11.072240] ret_from_fork+0x41/0x80 [ 11.072441] ret_from_fork_asm+0x1a/0x30 [ 11.072599] [ 11.072708] Freed by task 184: [ 11.072880] kasan_save_stack+0x45/0x70 [ 11.073049] kasan_save_track+0x18/0x40 [ 11.073251] kasan_save_free_info+0x3f/0x60 [ 11.073490] __kasan_slab_free+0x56/0x70 [ 11.073682] kfree+0x222/0x3f0 [ 11.073823] krealloc_uaf+0x13d/0x5e0 [ 11.073947] kunit_try_run_case+0x1a5/0x480 [ 11.074082] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.074264] kthread+0x337/0x6f0 [ 11.074421] ret_from_fork+0x41/0x80 [ 11.074647] ret_from_fork_asm+0x1a/0x30 [ 11.074836] [ 11.074927] The buggy address belongs to the object at ffff888100a9cc00 [ 11.074927] which belongs to the cache kmalloc-256 of size 256 [ 11.075440] The buggy address is located 0 bytes inside of [ 11.075440] freed 256-byte region [ffff888100a9cc00, ffff888100a9cd00) [ 11.076190] [ 11.076269] The buggy address belongs to the physical page: [ 11.076628] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a9c [ 11.077034] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.077325] flags: 0x200000000000040(head|node=0|zone=2) [ 11.077609] page_type: f5(slab) [ 11.077774] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.078031] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.078479] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.078948] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.079277] head: 0200000000000001 ffffea000402a701 00000000ffffffff 00000000ffffffff [ 11.079603] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.079925] page dumped because: kasan: bad access detected [ 11.080165] [ 11.080239] Memory state around the buggy address: [ 11.080521] ffff888100a9cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.080848] ffff888100a9cb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.081092] >ffff888100a9cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.081318] ^ [ 11.081496] ffff888100a9cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.081832] ffff888100a9cd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.082071] ==================================================================