Date
July 9, 2025, 12:11 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.634128] ================================================================== [ 19.634199] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 19.634249] Read of size 1 at addr fff00000c46e0400 by task kunit_try_catch/165 [ 19.634305] [ 19.634338] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.634429] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.634463] Hardware name: linux,dummy-virt (DT) [ 19.634499] Call trace: [ 19.634521] show_stack+0x20/0x38 (C) [ 19.634569] dump_stack_lvl+0x8c/0xd0 [ 19.634620] print_report+0x118/0x608 [ 19.634667] kasan_report+0xdc/0x128 [ 19.634713] __asan_report_load1_noabort+0x20/0x30 [ 19.634772] krealloc_uaf+0x4c8/0x520 [ 19.634829] kunit_try_run_case+0x170/0x3f0 [ 19.634876] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.634930] kthread+0x328/0x630 [ 19.634973] ret_from_fork+0x10/0x20 [ 19.635020] [ 19.635041] Allocated by task 165: [ 19.635079] kasan_save_stack+0x3c/0x68 [ 19.635126] kasan_save_track+0x20/0x40 [ 19.635163] kasan_save_alloc_info+0x40/0x58 [ 19.635202] __kasan_kmalloc+0xd4/0xd8 [ 19.635238] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.635276] krealloc_uaf+0xc8/0x520 [ 19.635310] kunit_try_run_case+0x170/0x3f0 [ 19.635347] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.635392] kthread+0x328/0x630 [ 19.635799] ret_from_fork+0x10/0x20 [ 19.635999] [ 19.636025] Freed by task 165: [ 19.636071] kasan_save_stack+0x3c/0x68 [ 19.636137] kasan_save_track+0x20/0x40 [ 19.636260] kasan_save_free_info+0x4c/0x78 [ 19.636338] __kasan_slab_free+0x6c/0x98 [ 19.636446] kfree+0x214/0x3c8 [ 19.636496] krealloc_uaf+0x12c/0x520 [ 19.636555] kunit_try_run_case+0x170/0x3f0 [ 19.636592] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.636634] kthread+0x328/0x630 [ 19.636666] ret_from_fork+0x10/0x20 [ 19.636738] [ 19.636841] The buggy address belongs to the object at fff00000c46e0400 [ 19.636841] which belongs to the cache kmalloc-256 of size 256 [ 19.636908] The buggy address is located 0 bytes inside of [ 19.636908] freed 256-byte region [fff00000c46e0400, fff00000c46e0500) [ 19.636997] [ 19.637023] The buggy address belongs to the physical page: [ 19.637079] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1046e0 [ 19.637145] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.637220] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.637331] page_type: f5(slab) [ 19.637379] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.637454] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.637515] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.637595] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.637721] head: 0bfffe0000000001 ffffc1ffc311b801 00000000ffffffff 00000000ffffffff [ 19.637802] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.637902] page dumped because: kasan: bad access detected [ 19.637961] [ 19.637991] Memory state around the buggy address: [ 19.638090] fff00000c46e0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.638133] fff00000c46e0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.638184] >fff00000c46e0400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.638228] ^ [ 19.638255] fff00000c46e0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.638295] fff00000c46e0500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.638331] ================================================================== [ 19.622067] ================================================================== [ 19.622170] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 19.622232] Read of size 1 at addr fff00000c46e0400 by task kunit_try_catch/165 [ 19.624105] [ 19.624364] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.626930] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.626957] Hardware name: linux,dummy-virt (DT) [ 19.626996] Call trace: [ 19.627019] show_stack+0x20/0x38 (C) [ 19.628609] dump_stack_lvl+0x8c/0xd0 [ 19.628732] print_report+0x118/0x608 [ 19.628816] kasan_report+0xdc/0x128 [ 19.628924] __kasan_check_byte+0x54/0x70 [ 19.629011] krealloc_noprof+0x44/0x360 [ 19.629125] krealloc_uaf+0x180/0x520 [ 19.629194] kunit_try_run_case+0x170/0x3f0 [ 19.629243] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.629295] kthread+0x328/0x630 [ 19.629337] ret_from_fork+0x10/0x20 [ 19.629750] [ 19.629786] Allocated by task 165: [ 19.629819] kasan_save_stack+0x3c/0x68 [ 19.629886] kasan_save_track+0x20/0x40 [ 19.629966] kasan_save_alloc_info+0x40/0x58 [ 19.630007] __kasan_kmalloc+0xd4/0xd8 [ 19.630075] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.630143] krealloc_uaf+0xc8/0x520 [ 19.630210] kunit_try_run_case+0x170/0x3f0 [ 19.630264] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.630329] kthread+0x328/0x630 [ 19.630362] ret_from_fork+0x10/0x20 [ 19.630407] [ 19.630443] Freed by task 165: [ 19.630681] kasan_save_stack+0x3c/0x68 [ 19.630747] kasan_save_track+0x20/0x40 [ 19.630868] kasan_save_free_info+0x4c/0x78 [ 19.630936] __kasan_slab_free+0x6c/0x98 [ 19.631032] kfree+0x214/0x3c8 [ 19.631090] krealloc_uaf+0x12c/0x520 [ 19.631233] kunit_try_run_case+0x170/0x3f0 [ 19.631303] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.631348] kthread+0x328/0x630 [ 19.631430] ret_from_fork+0x10/0x20 [ 19.631478] [ 19.631715] The buggy address belongs to the object at fff00000c46e0400 [ 19.631715] which belongs to the cache kmalloc-256 of size 256 [ 19.631901] The buggy address is located 0 bytes inside of [ 19.631901] freed 256-byte region [fff00000c46e0400, fff00000c46e0500) [ 19.631968] [ 19.631990] The buggy address belongs to the physical page: [ 19.632021] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1046e0 [ 19.632117] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.632268] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.632336] page_type: f5(slab) [ 19.632424] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.632491] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.632575] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.632636] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.632718] head: 0bfffe0000000001 ffffc1ffc311b801 00000000ffffffff 00000000ffffffff [ 19.632766] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.632805] page dumped because: kasan: bad access detected [ 19.632835] [ 19.632892] Memory state around the buggy address: [ 19.632927] fff00000c46e0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.633077] fff00000c46e0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.633158] >fff00000c46e0400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.633226] ^ [ 19.633314] fff00000c46e0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.633371] fff00000c46e0500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.633471] ==================================================================
[ 12.551497] ================================================================== [ 12.551837] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.552293] Read of size 1 at addr ffff888102328a00 by task kunit_try_catch/181 [ 12.552625] [ 12.552716] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.552758] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.552770] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.552789] Call Trace: [ 12.552807] <TASK> [ 12.552824] dump_stack_lvl+0x73/0xb0 [ 12.552855] print_report+0xd1/0x650 [ 12.552876] ? __virt_addr_valid+0x1db/0x2d0 [ 12.552900] ? krealloc_uaf+0x53c/0x5e0 [ 12.552920] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.553052] ? krealloc_uaf+0x53c/0x5e0 [ 12.553074] kasan_report+0x141/0x180 [ 12.553096] ? krealloc_uaf+0x53c/0x5e0 [ 12.553121] __asan_report_load1_noabort+0x18/0x20 [ 12.553147] krealloc_uaf+0x53c/0x5e0 [ 12.553169] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.553191] ? finish_task_switch.isra.0+0x153/0x700 [ 12.553219] ? __switch_to+0x47/0xf50 [ 12.553245] ? __schedule+0x10cc/0x2b60 [ 12.553268] ? __pfx_read_tsc+0x10/0x10 [ 12.553290] ? ktime_get_ts64+0x86/0x230 [ 12.553333] kunit_try_run_case+0x1a5/0x480 [ 12.553358] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.553381] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.553406] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.553430] ? __kthread_parkme+0x82/0x180 [ 12.553451] ? preempt_count_sub+0x50/0x80 [ 12.553474] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.553498] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.553523] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.553547] kthread+0x337/0x6f0 [ 12.553566] ? trace_preempt_on+0x20/0xc0 [ 12.553589] ? __pfx_kthread+0x10/0x10 [ 12.553610] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.553631] ? calculate_sigpending+0x7b/0xa0 [ 12.553655] ? __pfx_kthread+0x10/0x10 [ 12.553676] ret_from_fork+0x116/0x1d0 [ 12.553694] ? __pfx_kthread+0x10/0x10 [ 12.553715] ret_from_fork_asm+0x1a/0x30 [ 12.553745] </TASK> [ 12.553756] [ 12.561421] Allocated by task 181: [ 12.561599] kasan_save_stack+0x45/0x70 [ 12.561801] kasan_save_track+0x18/0x40 [ 12.562069] kasan_save_alloc_info+0x3b/0x50 [ 12.562278] __kasan_kmalloc+0xb7/0xc0 [ 12.562475] __kmalloc_cache_noprof+0x189/0x420 [ 12.562689] krealloc_uaf+0xbb/0x5e0 [ 12.562854] kunit_try_run_case+0x1a5/0x480 [ 12.563133] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.563383] kthread+0x337/0x6f0 [ 12.563506] ret_from_fork+0x116/0x1d0 [ 12.563636] ret_from_fork_asm+0x1a/0x30 [ 12.563824] [ 12.563917] Freed by task 181: [ 12.564262] kasan_save_stack+0x45/0x70 [ 12.564488] kasan_save_track+0x18/0x40 [ 12.564675] kasan_save_free_info+0x3f/0x60 [ 12.564875] __kasan_slab_free+0x56/0x70 [ 12.565138] kfree+0x222/0x3f0 [ 12.565268] krealloc_uaf+0x13d/0x5e0 [ 12.565468] kunit_try_run_case+0x1a5/0x480 [ 12.565677] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.565897] kthread+0x337/0x6f0 [ 12.566138] ret_from_fork+0x116/0x1d0 [ 12.566299] ret_from_fork_asm+0x1a/0x30 [ 12.566498] [ 12.566594] The buggy address belongs to the object at ffff888102328a00 [ 12.566594] which belongs to the cache kmalloc-256 of size 256 [ 12.567137] The buggy address is located 0 bytes inside of [ 12.567137] freed 256-byte region [ffff888102328a00, ffff888102328b00) [ 12.567649] [ 12.567754] The buggy address belongs to the physical page: [ 12.568154] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102328 [ 12.568522] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.568809] flags: 0x200000000000040(head|node=0|zone=2) [ 12.569131] page_type: f5(slab) [ 12.569284] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.569599] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.569902] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.570292] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.570634] head: 0200000000000001 ffffea000408ca01 00000000ffffffff 00000000ffffffff [ 12.570905] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.571212] page dumped because: kasan: bad access detected [ 12.571432] [ 12.571527] Memory state around the buggy address: [ 12.571749] ffff888102328900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.572271] ffff888102328980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.572580] >ffff888102328a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.572790] ^ [ 12.572904] ffff888102328a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.573313] ffff888102328b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.573633] ================================================================== [ 12.527763] ================================================================== [ 12.528612] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.528894] Read of size 1 at addr ffff888102328a00 by task kunit_try_catch/181 [ 12.529453] [ 12.529578] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.529625] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.529637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.529658] Call Trace: [ 12.529670] <TASK> [ 12.529689] dump_stack_lvl+0x73/0xb0 [ 12.529724] print_report+0xd1/0x650 [ 12.529747] ? __virt_addr_valid+0x1db/0x2d0 [ 12.529772] ? krealloc_uaf+0x1b8/0x5e0 [ 12.529793] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.529817] ? krealloc_uaf+0x1b8/0x5e0 [ 12.529838] kasan_report+0x141/0x180 [ 12.529859] ? krealloc_uaf+0x1b8/0x5e0 [ 12.529882] ? krealloc_uaf+0x1b8/0x5e0 [ 12.529903] __kasan_check_byte+0x3d/0x50 [ 12.530168] krealloc_noprof+0x3f/0x340 [ 12.530204] krealloc_uaf+0x1b8/0x5e0 [ 12.530226] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.530272] ? finish_task_switch.isra.0+0x153/0x700 [ 12.530297] ? __switch_to+0x47/0xf50 [ 12.530324] ? __schedule+0x10cc/0x2b60 [ 12.530347] ? __pfx_read_tsc+0x10/0x10 [ 12.530369] ? ktime_get_ts64+0x86/0x230 [ 12.530394] kunit_try_run_case+0x1a5/0x480 [ 12.530421] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.530443] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.530468] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.530491] ? __kthread_parkme+0x82/0x180 [ 12.530514] ? preempt_count_sub+0x50/0x80 [ 12.530537] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.530561] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.530585] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.530609] kthread+0x337/0x6f0 [ 12.530628] ? trace_preempt_on+0x20/0xc0 [ 12.530652] ? __pfx_kthread+0x10/0x10 [ 12.530672] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.530693] ? calculate_sigpending+0x7b/0xa0 [ 12.530724] ? __pfx_kthread+0x10/0x10 [ 12.530745] ret_from_fork+0x116/0x1d0 [ 12.530763] ? __pfx_kthread+0x10/0x10 [ 12.530784] ret_from_fork_asm+0x1a/0x30 [ 12.530815] </TASK> [ 12.530826] [ 12.538519] Allocated by task 181: [ 12.538692] kasan_save_stack+0x45/0x70 [ 12.538901] kasan_save_track+0x18/0x40 [ 12.539109] kasan_save_alloc_info+0x3b/0x50 [ 12.539262] __kasan_kmalloc+0xb7/0xc0 [ 12.539466] __kmalloc_cache_noprof+0x189/0x420 [ 12.539687] krealloc_uaf+0xbb/0x5e0 [ 12.539867] kunit_try_run_case+0x1a5/0x480 [ 12.540321] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.540587] kthread+0x337/0x6f0 [ 12.540760] ret_from_fork+0x116/0x1d0 [ 12.540897] ret_from_fork_asm+0x1a/0x30 [ 12.541143] [ 12.541246] Freed by task 181: [ 12.541447] kasan_save_stack+0x45/0x70 [ 12.541641] kasan_save_track+0x18/0x40 [ 12.541827] kasan_save_free_info+0x3f/0x60 [ 12.542111] __kasan_slab_free+0x56/0x70 [ 12.542331] kfree+0x222/0x3f0 [ 12.542479] krealloc_uaf+0x13d/0x5e0 [ 12.542652] kunit_try_run_case+0x1a5/0x480 [ 12.542841] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.543086] kthread+0x337/0x6f0 [ 12.543211] ret_from_fork+0x116/0x1d0 [ 12.543400] ret_from_fork_asm+0x1a/0x30 [ 12.543618] [ 12.543721] The buggy address belongs to the object at ffff888102328a00 [ 12.543721] which belongs to the cache kmalloc-256 of size 256 [ 12.544507] The buggy address is located 0 bytes inside of [ 12.544507] freed 256-byte region [ffff888102328a00, ffff888102328b00) [ 12.545143] [ 12.545251] The buggy address belongs to the physical page: [ 12.545471] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102328 [ 12.545714] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.546093] flags: 0x200000000000040(head|node=0|zone=2) [ 12.546375] page_type: f5(slab) [ 12.546545] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.546882] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.547261] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.547545] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.547805] head: 0200000000000001 ffffea000408ca01 00000000ffffffff 00000000ffffffff [ 12.548314] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.548678] page dumped because: kasan: bad access detected [ 12.548902] [ 12.549088] Memory state around the buggy address: [ 12.549319] ffff888102328900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.549604] ffff888102328980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.549878] >ffff888102328a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.550218] ^ [ 12.550399] ffff888102328a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.550612] ffff888102328b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.550865] ==================================================================