Date
July 1, 2025, 12:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.365492] ================================================================== [ 17.365552] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 17.365601] Read of size 1 at addr fff00000c46ffe00 by task kunit_try_catch/164 [ 17.365650] [ 17.365679] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 17.365760] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.365793] Hardware name: linux,dummy-virt (DT) [ 17.365824] Call trace: [ 17.365856] show_stack+0x20/0x38 (C) [ 17.365906] dump_stack_lvl+0x8c/0xd0 [ 17.365963] print_report+0x118/0x608 [ 17.366009] kasan_report+0xdc/0x128 [ 17.366062] __asan_report_load1_noabort+0x20/0x30 [ 17.366113] krealloc_uaf+0x4c8/0x520 [ 17.366170] kunit_try_run_case+0x170/0x3f0 [ 17.366217] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.366268] kthread+0x328/0x630 [ 17.366308] ret_from_fork+0x10/0x20 [ 17.366354] [ 17.366372] Allocated by task 164: [ 17.366406] kasan_save_stack+0x3c/0x68 [ 17.366921] kasan_save_track+0x20/0x40 [ 17.367223] kasan_save_alloc_info+0x40/0x58 [ 17.367319] __kasan_kmalloc+0xd4/0xd8 [ 17.367721] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.368003] krealloc_uaf+0xc8/0x520 [ 17.368133] kunit_try_run_case+0x170/0x3f0 [ 17.368433] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.368892] kthread+0x328/0x630 [ 17.368958] ret_from_fork+0x10/0x20 [ 17.369407] [ 17.369871] Freed by task 164: [ 17.369907] kasan_save_stack+0x3c/0x68 [ 17.370410] kasan_save_track+0x20/0x40 [ 17.370745] kasan_save_free_info+0x4c/0x78 [ 17.371105] __kasan_slab_free+0x6c/0x98 [ 17.371360] kfree+0x214/0x3c8 [ 17.371402] krealloc_uaf+0x12c/0x520 [ 17.371437] kunit_try_run_case+0x170/0x3f0 [ 17.371646] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.371799] kthread+0x328/0x630 [ 17.372085] ret_from_fork+0x10/0x20 [ 17.372281] [ 17.372508] The buggy address belongs to the object at fff00000c46ffe00 [ 17.372508] which belongs to the cache kmalloc-256 of size 256 [ 17.372591] The buggy address is located 0 bytes inside of [ 17.372591] freed 256-byte region [fff00000c46ffe00, fff00000c46fff00) [ 17.372931] [ 17.372971] The buggy address belongs to the physical page: [ 17.373471] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1046fe [ 17.373937] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.374044] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.374465] page_type: f5(slab) [ 17.374513] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.374987] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.375328] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.375399] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.375597] head: 0bfffe0000000001 ffffc1ffc311bf81 00000000ffffffff 00000000ffffffff [ 17.375793] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.376013] page dumped because: kasan: bad access detected [ 17.376499] [ 17.376865] Memory state around the buggy address: [ 17.377100] fff00000c46ffd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.377170] fff00000c46ffd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.377252] >fff00000c46ffe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.377549] ^ [ 17.377807] fff00000c46ffe80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.377927] fff00000c46fff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.378000] ================================================================== [ 17.346430] ================================================================== [ 17.347920] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 17.348030] Read of size 1 at addr fff00000c46ffe00 by task kunit_try_catch/164 [ 17.348529] [ 17.348965] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 17.349243] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.349438] Hardware name: linux,dummy-virt (DT) [ 17.349702] Call trace: [ 17.349864] show_stack+0x20/0x38 (C) [ 17.349945] dump_stack_lvl+0x8c/0xd0 [ 17.350363] print_report+0x118/0x608 [ 17.350996] kasan_report+0xdc/0x128 [ 17.351144] __kasan_check_byte+0x54/0x70 [ 17.351391] krealloc_noprof+0x44/0x360 [ 17.351560] krealloc_uaf+0x180/0x520 [ 17.351745] kunit_try_run_case+0x170/0x3f0 [ 17.351902] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.352259] kthread+0x328/0x630 [ 17.352382] ret_from_fork+0x10/0x20 [ 17.353124] [ 17.353224] Allocated by task 164: [ 17.353363] kasan_save_stack+0x3c/0x68 [ 17.353823] kasan_save_track+0x20/0x40 [ 17.354059] kasan_save_alloc_info+0x40/0x58 [ 17.354266] __kasan_kmalloc+0xd4/0xd8 [ 17.354306] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.354614] krealloc_uaf+0xc8/0x520 [ 17.354710] kunit_try_run_case+0x170/0x3f0 [ 17.354753] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.354988] kthread+0x328/0x630 [ 17.355278] ret_from_fork+0x10/0x20 [ 17.355506] [ 17.355585] Freed by task 164: [ 17.355748] kasan_save_stack+0x3c/0x68 [ 17.356040] kasan_save_track+0x20/0x40 [ 17.356237] kasan_save_free_info+0x4c/0x78 [ 17.356697] __kasan_slab_free+0x6c/0x98 [ 17.356758] kfree+0x214/0x3c8 [ 17.356929] krealloc_uaf+0x12c/0x520 [ 17.357194] kunit_try_run_case+0x170/0x3f0 [ 17.357314] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.357658] kthread+0x328/0x630 [ 17.357714] ret_from_fork+0x10/0x20 [ 17.357750] [ 17.358139] The buggy address belongs to the object at fff00000c46ffe00 [ 17.358139] which belongs to the cache kmalloc-256 of size 256 [ 17.358705] The buggy address is located 0 bytes inside of [ 17.358705] freed 256-byte region [fff00000c46ffe00, fff00000c46fff00) [ 17.359058] [ 17.359094] The buggy address belongs to the physical page: [ 17.359336] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1046fe [ 17.359571] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.359676] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.359763] page_type: f5(slab) [ 17.360124] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.360195] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.360972] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 17.361104] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.361215] head: 0bfffe0000000001 ffffc1ffc311bf81 00000000ffffffff 00000000ffffffff [ 17.361366] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.361432] page dumped because: kasan: bad access detected [ 17.361474] [ 17.361748] Memory state around the buggy address: [ 17.361836] fff00000c46ffd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.362071] fff00000c46ffd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.362164] >fff00000c46ffe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.362271] ^ [ 17.362300] fff00000c46ffe80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.362511] fff00000c46fff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.362706] ==================================================================
[ 11.408007] ================================================================== [ 11.408733] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.409050] Read of size 1 at addr ffff888100a33600 by task kunit_try_catch/181 [ 11.409422] [ 11.409547] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.409588] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.409599] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.409619] Call Trace: [ 11.409629] <TASK> [ 11.409643] dump_stack_lvl+0x73/0xb0 [ 11.409679] print_report+0xd1/0x650 [ 11.409917] ? __virt_addr_valid+0x1db/0x2d0 [ 11.409957] ? krealloc_uaf+0x1b8/0x5e0 [ 11.409978] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.409999] ? krealloc_uaf+0x1b8/0x5e0 [ 11.410019] kasan_report+0x141/0x180 [ 11.410188] ? krealloc_uaf+0x1b8/0x5e0 [ 11.410217] ? krealloc_uaf+0x1b8/0x5e0 [ 11.410238] __kasan_check_byte+0x3d/0x50 [ 11.410259] krealloc_noprof+0x3f/0x340 [ 11.410281] krealloc_uaf+0x1b8/0x5e0 [ 11.410302] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.410334] ? finish_task_switch.isra.0+0x153/0x700 [ 11.410354] ? __switch_to+0x47/0xf50 [ 11.410378] ? __schedule+0x10cc/0x2b60 [ 11.410411] ? __pfx_read_tsc+0x10/0x10 [ 11.410430] ? ktime_get_ts64+0x86/0x230 [ 11.410454] kunit_try_run_case+0x1a5/0x480 [ 11.410477] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.410498] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.410520] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.410541] ? __kthread_parkme+0x82/0x180 [ 11.410560] ? preempt_count_sub+0x50/0x80 [ 11.410581] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.410604] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.410625] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.410647] kthread+0x337/0x6f0 [ 11.410665] ? trace_preempt_on+0x20/0xc0 [ 11.410686] ? __pfx_kthread+0x10/0x10 [ 11.410706] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.410725] ? calculate_sigpending+0x7b/0xa0 [ 11.410748] ? __pfx_kthread+0x10/0x10 [ 11.410768] ret_from_fork+0x116/0x1d0 [ 11.410785] ? __pfx_kthread+0x10/0x10 [ 11.410804] ret_from_fork_asm+0x1a/0x30 [ 11.410832] </TASK> [ 11.410843] [ 11.422574] Allocated by task 181: [ 11.422747] kasan_save_stack+0x45/0x70 [ 11.422936] kasan_save_track+0x18/0x40 [ 11.423534] kasan_save_alloc_info+0x3b/0x50 [ 11.423746] __kasan_kmalloc+0xb7/0xc0 [ 11.423920] __kmalloc_cache_noprof+0x189/0x420 [ 11.424199] krealloc_uaf+0xbb/0x5e0 [ 11.424341] kunit_try_run_case+0x1a5/0x480 [ 11.424575] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.424762] kthread+0x337/0x6f0 [ 11.424931] ret_from_fork+0x116/0x1d0 [ 11.425389] ret_from_fork_asm+0x1a/0x30 [ 11.425574] [ 11.425719] Freed by task 181: [ 11.425893] kasan_save_stack+0x45/0x70 [ 11.426218] kasan_save_track+0x18/0x40 [ 11.426390] kasan_save_free_info+0x3f/0x60 [ 11.426608] __kasan_slab_free+0x56/0x70 [ 11.426805] kfree+0x222/0x3f0 [ 11.426922] krealloc_uaf+0x13d/0x5e0 [ 11.427122] kunit_try_run_case+0x1a5/0x480 [ 11.427331] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.427624] kthread+0x337/0x6f0 [ 11.427816] ret_from_fork+0x116/0x1d0 [ 11.428118] ret_from_fork_asm+0x1a/0x30 [ 11.428323] [ 11.428430] The buggy address belongs to the object at ffff888100a33600 [ 11.428430] which belongs to the cache kmalloc-256 of size 256 [ 11.429014] The buggy address is located 0 bytes inside of [ 11.429014] freed 256-byte region [ffff888100a33600, ffff888100a33700) [ 11.429685] [ 11.429804] The buggy address belongs to the physical page: [ 11.430014] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a32 [ 11.430329] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.430754] flags: 0x200000000000040(head|node=0|zone=2) [ 11.431041] page_type: f5(slab) [ 11.431304] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.431624] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.431983] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.432353] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.432750] head: 0200000000000001 ffffea0004028c81 00000000ffffffff 00000000ffffffff [ 11.433188] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.433744] page dumped because: kasan: bad access detected [ 11.433995] [ 11.434185] Memory state around the buggy address: [ 11.434515] ffff888100a33500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.434827] ffff888100a33580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.435145] >ffff888100a33600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.435398] ^ [ 11.435546] ffff888100a33680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.435885] ffff888100a33700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.436410] ================================================================== [ 11.436952] ================================================================== [ 11.437478] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.437775] Read of size 1 at addr ffff888100a33600 by task kunit_try_catch/181 [ 11.438164] [ 11.438290] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.438331] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.438342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.438361] Call Trace: [ 11.438375] <TASK> [ 11.438389] dump_stack_lvl+0x73/0xb0 [ 11.438415] print_report+0xd1/0x650 [ 11.438437] ? __virt_addr_valid+0x1db/0x2d0 [ 11.438459] ? krealloc_uaf+0x53c/0x5e0 [ 11.438479] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.438499] ? krealloc_uaf+0x53c/0x5e0 [ 11.438520] kasan_report+0x141/0x180 [ 11.438540] ? krealloc_uaf+0x53c/0x5e0 [ 11.438566] __asan_report_load1_noabort+0x18/0x20 [ 11.438589] krealloc_uaf+0x53c/0x5e0 [ 11.438609] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.438629] ? finish_task_switch.isra.0+0x153/0x700 [ 11.438649] ? __switch_to+0x47/0xf50 [ 11.438673] ? __schedule+0x10cc/0x2b60 [ 11.438693] ? __pfx_read_tsc+0x10/0x10 [ 11.438712] ? ktime_get_ts64+0x86/0x230 [ 11.438735] kunit_try_run_case+0x1a5/0x480 [ 11.438758] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.438778] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.438799] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.438821] ? __kthread_parkme+0x82/0x180 [ 11.438839] ? preempt_count_sub+0x50/0x80 [ 11.438860] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.438882] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.438904] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.438925] kthread+0x337/0x6f0 [ 11.438943] ? trace_preempt_on+0x20/0xc0 [ 11.438965] ? __pfx_kthread+0x10/0x10 [ 11.438985] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.439004] ? calculate_sigpending+0x7b/0xa0 [ 11.439042] ? __pfx_kthread+0x10/0x10 [ 11.439124] ret_from_fork+0x116/0x1d0 [ 11.439144] ? __pfx_kthread+0x10/0x10 [ 11.439164] ret_from_fork_asm+0x1a/0x30 [ 11.439205] </TASK> [ 11.439216] [ 11.447452] Allocated by task 181: [ 11.447594] kasan_save_stack+0x45/0x70 [ 11.447823] kasan_save_track+0x18/0x40 [ 11.448013] kasan_save_alloc_info+0x3b/0x50 [ 11.448232] __kasan_kmalloc+0xb7/0xc0 [ 11.448405] __kmalloc_cache_noprof+0x189/0x420 [ 11.448561] krealloc_uaf+0xbb/0x5e0 [ 11.448833] kunit_try_run_case+0x1a5/0x480 [ 11.449180] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.449515] kthread+0x337/0x6f0 [ 11.449702] ret_from_fork+0x116/0x1d0 [ 11.449897] ret_from_fork_asm+0x1a/0x30 [ 11.450184] [ 11.450274] Freed by task 181: [ 11.450423] kasan_save_stack+0x45/0x70 [ 11.450607] kasan_save_track+0x18/0x40 [ 11.450741] kasan_save_free_info+0x3f/0x60 [ 11.450884] __kasan_slab_free+0x56/0x70 [ 11.451021] kfree+0x222/0x3f0 [ 11.451444] krealloc_uaf+0x13d/0x5e0 [ 11.451636] kunit_try_run_case+0x1a5/0x480 [ 11.451845] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.452238] kthread+0x337/0x6f0 [ 11.452417] ret_from_fork+0x116/0x1d0 [ 11.452608] ret_from_fork_asm+0x1a/0x30 [ 11.452747] [ 11.452821] The buggy address belongs to the object at ffff888100a33600 [ 11.452821] which belongs to the cache kmalloc-256 of size 256 [ 11.453652] The buggy address is located 0 bytes inside of [ 11.453652] freed 256-byte region [ffff888100a33600, ffff888100a33700) [ 11.454369] [ 11.454502] The buggy address belongs to the physical page: [ 11.454768] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a32 [ 11.455253] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.455549] flags: 0x200000000000040(head|node=0|zone=2) [ 11.455723] page_type: f5(slab) [ 11.455876] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.456227] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.456650] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.456879] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.457508] head: 0200000000000001 ffffea0004028c81 00000000ffffffff 00000000ffffffff [ 11.457983] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.458384] page dumped because: kasan: bad access detected [ 11.458714] [ 11.458803] Memory state around the buggy address: [ 11.459044] ffff888100a33500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.459425] ffff888100a33580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.459729] >ffff888100a33600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.460043] ^ [ 11.460273] ffff888100a33680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.460574] ffff888100a33700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.460827] ==================================================================