Date
July 3, 2025, 6:13 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.755218] ================================================================== [ 16.755277] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 16.755325] Read of size 1 at addr fff00000c59ab600 by task kunit_try_catch/164 [ 16.755380] [ 16.755592] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 16.755944] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.755995] Hardware name: linux,dummy-virt (DT) [ 16.756040] Call trace: [ 16.756099] show_stack+0x20/0x38 (C) [ 16.756151] dump_stack_lvl+0x8c/0xd0 [ 16.756196] print_report+0x118/0x608 [ 16.756251] kasan_report+0xdc/0x128 [ 16.756295] __asan_report_load1_noabort+0x20/0x30 [ 16.756354] krealloc_uaf+0x4c8/0x520 [ 16.756404] kunit_try_run_case+0x170/0x3f0 [ 16.756454] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.756505] kthread+0x328/0x630 [ 16.756705] ret_from_fork+0x10/0x20 [ 16.756758] [ 16.756984] Allocated by task 164: [ 16.757075] kasan_save_stack+0x3c/0x68 [ 16.757175] kasan_save_track+0x20/0x40 [ 16.757282] kasan_save_alloc_info+0x40/0x58 [ 16.757522] __kasan_kmalloc+0xd4/0xd8 [ 16.757573] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.757758] krealloc_uaf+0xc8/0x520 [ 16.757932] kunit_try_run_case+0x170/0x3f0 [ 16.758000] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.758391] kthread+0x328/0x630 [ 16.758531] ret_from_fork+0x10/0x20 [ 16.758615] [ 16.758756] Freed by task 164: [ 16.758835] kasan_save_stack+0x3c/0x68 [ 16.759003] kasan_save_track+0x20/0x40 [ 16.759089] kasan_save_free_info+0x4c/0x78 [ 16.759295] __kasan_slab_free+0x6c/0x98 [ 16.759510] kfree+0x214/0x3c8 [ 16.759579] krealloc_uaf+0x12c/0x520 [ 16.759670] kunit_try_run_case+0x170/0x3f0 [ 16.759768] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.759876] kthread+0x328/0x630 [ 16.760003] ret_from_fork+0x10/0x20 [ 16.760070] [ 16.760295] The buggy address belongs to the object at fff00000c59ab600 [ 16.760295] which belongs to the cache kmalloc-256 of size 256 [ 16.760529] The buggy address is located 0 bytes inside of [ 16.760529] freed 256-byte region [fff00000c59ab600, fff00000c59ab700) [ 16.760725] [ 16.760812] The buggy address belongs to the physical page: [ 16.760936] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059aa [ 16.760989] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.761049] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.761444] page_type: f5(slab) [ 16.761582] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.761635] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.761857] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.761964] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.762071] head: 0bfffe0000000001 ffffc1ffc3166a81 00000000ffffffff 00000000ffffffff [ 16.762303] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.762368] page dumped because: kasan: bad access detected [ 16.762399] [ 16.762416] Memory state around the buggy address: [ 16.762446] fff00000c59ab500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.762541] fff00000c59ab580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.762582] >fff00000c59ab600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.762620] ^ [ 16.762654] fff00000c59ab680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.762697] fff00000c59ab700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.762734] ================================================================== [ 16.743999] ================================================================== [ 16.744607] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 16.744710] Read of size 1 at addr fff00000c59ab600 by task kunit_try_catch/164 [ 16.745006] [ 16.745055] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 16.745271] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.745350] Hardware name: linux,dummy-virt (DT) [ 16.745453] Call trace: [ 16.745505] show_stack+0x20/0x38 (C) [ 16.745702] dump_stack_lvl+0x8c/0xd0 [ 16.745902] print_report+0x118/0x608 [ 16.745982] kasan_report+0xdc/0x128 [ 16.746107] __kasan_check_byte+0x54/0x70 [ 16.746203] krealloc_noprof+0x44/0x360 [ 16.746404] krealloc_uaf+0x180/0x520 [ 16.746619] kunit_try_run_case+0x170/0x3f0 [ 16.746897] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.747149] kthread+0x328/0x630 [ 16.747278] ret_from_fork+0x10/0x20 [ 16.747336] [ 16.747533] Allocated by task 164: [ 16.747807] kasan_save_stack+0x3c/0x68 [ 16.747904] kasan_save_track+0x20/0x40 [ 16.747942] kasan_save_alloc_info+0x40/0x58 [ 16.748016] __kasan_kmalloc+0xd4/0xd8 [ 16.748076] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.748122] krealloc_uaf+0xc8/0x520 [ 16.748165] kunit_try_run_case+0x170/0x3f0 [ 16.748201] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.748249] kthread+0x328/0x630 [ 16.748288] ret_from_fork+0x10/0x20 [ 16.748322] [ 16.748363] Freed by task 164: [ 16.748420] kasan_save_stack+0x3c/0x68 [ 16.748468] kasan_save_track+0x20/0x40 [ 16.748505] kasan_save_free_info+0x4c/0x78 [ 16.748793] __kasan_slab_free+0x6c/0x98 [ 16.748841] kfree+0x214/0x3c8 [ 16.749154] krealloc_uaf+0x12c/0x520 [ 16.749231] kunit_try_run_case+0x170/0x3f0 [ 16.749298] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.749385] kthread+0x328/0x630 [ 16.749489] ret_from_fork+0x10/0x20 [ 16.749550] [ 16.749740] The buggy address belongs to the object at fff00000c59ab600 [ 16.749740] which belongs to the cache kmalloc-256 of size 256 [ 16.750001] The buggy address is located 0 bytes inside of [ 16.750001] freed 256-byte region [fff00000c59ab600, fff00000c59ab700) [ 16.750286] [ 16.750380] The buggy address belongs to the physical page: [ 16.750459] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059aa [ 16.750557] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.750627] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.750973] page_type: f5(slab) [ 16.751338] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.751442] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.751663] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.751888] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.752074] head: 0bfffe0000000001 ffffc1ffc3166a81 00000000ffffffff 00000000ffffffff [ 16.752160] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.752274] page dumped because: kasan: bad access detected [ 16.752355] [ 16.752464] Memory state around the buggy address: [ 16.752497] fff00000c59ab500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.752546] fff00000c59ab580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.752769] >fff00000c59ab600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.753240] ^ [ 16.753393] fff00000c59ab680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.753478] fff00000c59ab700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.753532] ==================================================================
[ 11.403384] ================================================================== [ 11.403950] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 11.404947] Read of size 1 at addr ffff888100aa8400 by task kunit_try_catch/182 [ 11.405405] [ 11.405628] CPU: 1 UID: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.405672] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.405684] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.405703] Call Trace: [ 11.405714] <TASK> [ 11.405728] dump_stack_lvl+0x73/0xb0 [ 11.405756] print_report+0xd1/0x650 [ 11.405778] ? __virt_addr_valid+0x1db/0x2d0 [ 11.405801] ? krealloc_uaf+0x1b8/0x5e0 [ 11.405822] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.405843] ? krealloc_uaf+0x1b8/0x5e0 [ 11.405863] kasan_report+0x141/0x180 [ 11.405884] ? krealloc_uaf+0x1b8/0x5e0 [ 11.405907] ? krealloc_uaf+0x1b8/0x5e0 [ 11.405927] __kasan_check_byte+0x3d/0x50 [ 11.405947] krealloc_noprof+0x3f/0x340 [ 11.405970] krealloc_uaf+0x1b8/0x5e0 [ 11.405991] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.406011] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 11.406039] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.406063] kunit_try_run_case+0x1a5/0x480 [ 11.406088] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.406122] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.406145] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.406167] ? __kthread_parkme+0x82/0x180 [ 11.406187] ? preempt_count_sub+0x50/0x80 [ 11.406209] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.406232] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.406253] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.406275] kthread+0x337/0x6f0 [ 11.406293] ? trace_preempt_on+0x20/0xc0 [ 11.406316] ? __pfx_kthread+0x10/0x10 [ 11.406488] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.406516] ? calculate_sigpending+0x7b/0xa0 [ 11.406539] ? __pfx_kthread+0x10/0x10 [ 11.406560] ret_from_fork+0x116/0x1d0 [ 11.406578] ? __pfx_kthread+0x10/0x10 [ 11.406598] ret_from_fork_asm+0x1a/0x30 [ 11.406628] </TASK> [ 11.406639] [ 11.416718] Allocated by task 182: [ 11.416941] kasan_save_stack+0x45/0x70 [ 11.417260] kasan_save_track+0x18/0x40 [ 11.417479] kasan_save_alloc_info+0x3b/0x50 [ 11.417634] __kasan_kmalloc+0xb7/0xc0 [ 11.417767] __kmalloc_cache_noprof+0x189/0x420 [ 11.418058] krealloc_uaf+0xbb/0x5e0 [ 11.418260] kunit_try_run_case+0x1a5/0x480 [ 11.418475] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.418732] kthread+0x337/0x6f0 [ 11.419090] ret_from_fork+0x116/0x1d0 [ 11.419354] ret_from_fork_asm+0x1a/0x30 [ 11.419548] [ 11.419686] Freed by task 182: [ 11.419886] kasan_save_stack+0x45/0x70 [ 11.420119] kasan_save_track+0x18/0x40 [ 11.420504] kasan_save_free_info+0x3f/0x60 [ 11.420669] __kasan_slab_free+0x56/0x70 [ 11.420909] kfree+0x222/0x3f0 [ 11.421301] krealloc_uaf+0x13d/0x5e0 [ 11.421442] kunit_try_run_case+0x1a5/0x480 [ 11.421628] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.421880] kthread+0x337/0x6f0 [ 11.422049] ret_from_fork+0x116/0x1d0 [ 11.422505] ret_from_fork_asm+0x1a/0x30 [ 11.422712] [ 11.422814] The buggy address belongs to the object at ffff888100aa8400 [ 11.422814] which belongs to the cache kmalloc-256 of size 256 [ 11.423322] The buggy address is located 0 bytes inside of [ 11.423322] freed 256-byte region [ffff888100aa8400, ffff888100aa8500) [ 11.424680] [ 11.424978] The buggy address belongs to the physical page: [ 11.425563] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa8 [ 11.425938] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.426536] flags: 0x200000000000040(head|node=0|zone=2) [ 11.426766] page_type: f5(slab) [ 11.426941] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.427706] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.428024] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.428615] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.429062] head: 0200000000000001 ffffea000402aa01 00000000ffffffff 00000000ffffffff [ 11.429667] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.430050] page dumped because: kasan: bad access detected [ 11.430665] [ 11.430765] Memory state around the buggy address: [ 11.431119] ffff888100aa8300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.431636] ffff888100aa8380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.432054] >ffff888100aa8400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.432630] ^ [ 11.432789] ffff888100aa8480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.433118] ffff888100aa8500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.433779] ================================================================== [ 11.434877] ================================================================== [ 11.435351] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 11.435673] Read of size 1 at addr ffff888100aa8400 by task kunit_try_catch/182 [ 11.435984] [ 11.436083] CPU: 1 UID: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.436135] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.436146] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.436164] Call Trace: [ 11.436181] <TASK> [ 11.436197] dump_stack_lvl+0x73/0xb0 [ 11.436224] print_report+0xd1/0x650 [ 11.436332] ? __virt_addr_valid+0x1db/0x2d0 [ 11.436387] ? krealloc_uaf+0x53c/0x5e0 [ 11.436432] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.436454] ? krealloc_uaf+0x53c/0x5e0 [ 11.436475] kasan_report+0x141/0x180 [ 11.436496] ? krealloc_uaf+0x53c/0x5e0 [ 11.436520] __asan_report_load1_noabort+0x18/0x20 [ 11.436543] krealloc_uaf+0x53c/0x5e0 [ 11.436564] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.436583] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 11.436611] ? __pfx_krealloc_uaf+0x10/0x10 [ 11.436635] kunit_try_run_case+0x1a5/0x480 [ 11.436659] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.436680] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.436702] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.436723] ? __kthread_parkme+0x82/0x180 [ 11.436742] ? preempt_count_sub+0x50/0x80 [ 11.436764] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.436786] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.436808] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.436829] kthread+0x337/0x6f0 [ 11.436847] ? trace_preempt_on+0x20/0xc0 [ 11.436870] ? __pfx_kthread+0x10/0x10 [ 11.436889] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.436908] ? calculate_sigpending+0x7b/0xa0 [ 11.436930] ? __pfx_kthread+0x10/0x10 [ 11.436950] ret_from_fork+0x116/0x1d0 [ 11.436967] ? __pfx_kthread+0x10/0x10 [ 11.436986] ret_from_fork_asm+0x1a/0x30 [ 11.437015] </TASK> [ 11.437025] [ 11.445363] Allocated by task 182: [ 11.445535] kasan_save_stack+0x45/0x70 [ 11.445823] kasan_save_track+0x18/0x40 [ 11.446082] kasan_save_alloc_info+0x3b/0x50 [ 11.446581] __kasan_kmalloc+0xb7/0xc0 [ 11.446797] __kmalloc_cache_noprof+0x189/0x420 [ 11.447029] krealloc_uaf+0xbb/0x5e0 [ 11.447431] kunit_try_run_case+0x1a5/0x480 [ 11.447661] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.447921] kthread+0x337/0x6f0 [ 11.448087] ret_from_fork+0x116/0x1d0 [ 11.448394] ret_from_fork_asm+0x1a/0x30 [ 11.448637] [ 11.448725] Freed by task 182: [ 11.448903] kasan_save_stack+0x45/0x70 [ 11.449132] kasan_save_track+0x18/0x40 [ 11.449411] kasan_save_free_info+0x3f/0x60 [ 11.449597] __kasan_slab_free+0x56/0x70 [ 11.449829] kfree+0x222/0x3f0 [ 11.450010] krealloc_uaf+0x13d/0x5e0 [ 11.450392] kunit_try_run_case+0x1a5/0x480 [ 11.450594] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.450779] kthread+0x337/0x6f0 [ 11.450949] ret_from_fork+0x116/0x1d0 [ 11.451148] ret_from_fork_asm+0x1a/0x30 [ 11.451655] [ 11.451761] The buggy address belongs to the object at ffff888100aa8400 [ 11.451761] which belongs to the cache kmalloc-256 of size 256 [ 11.452478] The buggy address is located 0 bytes inside of [ 11.452478] freed 256-byte region [ffff888100aa8400, ffff888100aa8500) [ 11.452966] [ 11.453068] The buggy address belongs to the physical page: [ 11.453446] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100aa8 [ 11.453943] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.454343] flags: 0x200000000000040(head|node=0|zone=2) [ 11.454726] page_type: f5(slab) [ 11.454890] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.455135] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.455951] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 11.456576] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.456985] head: 0200000000000001 ffffea000402aa01 00000000ffffffff 00000000ffffffff [ 11.457461] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 11.457701] page dumped because: kasan: bad access detected [ 11.457955] [ 11.458050] Memory state around the buggy address: [ 11.458496] ffff888100aa8300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.458857] ffff888100aa8380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.459207] >ffff888100aa8400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.459647] ^ [ 11.459817] ffff888100aa8480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.460117] ffff888100aa8500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.460674] ==================================================================