Date
July 9, 2025, 2:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.941168] ================================================================== [ 16.941214] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 16.941272] Read of size 1 at addr fff00000c4519e00 by task kunit_try_catch/164 [ 16.941323] [ 16.941577] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.941671] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.941733] Hardware name: linux,dummy-virt (DT) [ 16.941839] Call trace: [ 16.941920] show_stack+0x20/0x38 (C) [ 16.942051] dump_stack_lvl+0x8c/0xd0 [ 16.942112] print_report+0x118/0x608 [ 16.942160] kasan_report+0xdc/0x128 [ 16.942208] __asan_report_load1_noabort+0x20/0x30 [ 16.942386] krealloc_uaf+0x4c8/0x520 [ 16.942434] kunit_try_run_case+0x170/0x3f0 [ 16.942487] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.942604] kthread+0x328/0x630 [ 16.942678] ret_from_fork+0x10/0x20 [ 16.942822] [ 16.942878] Allocated by task 164: [ 16.942988] kasan_save_stack+0x3c/0x68 [ 16.943048] kasan_save_track+0x20/0x40 [ 16.943129] kasan_save_alloc_info+0x40/0x58 [ 16.943252] __kasan_kmalloc+0xd4/0xd8 [ 16.943311] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.943409] krealloc_uaf+0xc8/0x520 [ 16.943466] kunit_try_run_case+0x170/0x3f0 [ 16.943536] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.943597] kthread+0x328/0x630 [ 16.943629] ret_from_fork+0x10/0x20 [ 16.943805] [ 16.943830] Freed by task 164: [ 16.943856] kasan_save_stack+0x3c/0x68 [ 16.943894] kasan_save_track+0x20/0x40 [ 16.943930] kasan_save_free_info+0x4c/0x78 [ 16.943985] __kasan_slab_free+0x6c/0x98 [ 16.944027] kfree+0x214/0x3c8 [ 16.944059] krealloc_uaf+0x12c/0x520 [ 16.944182] kunit_try_run_case+0x170/0x3f0 [ 16.944261] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.944335] kthread+0x328/0x630 [ 16.944415] ret_from_fork+0x10/0x20 [ 16.944464] [ 16.944560] The buggy address belongs to the object at fff00000c4519e00 [ 16.944560] which belongs to the cache kmalloc-256 of size 256 [ 16.944668] The buggy address is located 0 bytes inside of [ 16.944668] freed 256-byte region [fff00000c4519e00, fff00000c4519f00) [ 16.945005] [ 16.945031] The buggy address belongs to the physical page: [ 16.945068] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104518 [ 16.945156] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.945204] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.945267] page_type: f5(slab) [ 16.945310] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.945369] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.945438] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.945499] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.945562] head: 0bfffe0000000001 ffffc1ffc3114601 00000000ffffffff 00000000ffffffff [ 16.945621] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.945662] page dumped because: kasan: bad access detected [ 16.945692] [ 16.945708] Memory state around the buggy address: [ 16.945740] fff00000c4519d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.945857] fff00000c4519d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.945904] >fff00000c4519e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.945948] ^ [ 16.945977] fff00000c4519e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.946022] fff00000c4519f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.946097] ================================================================== [ 16.935256] ================================================================== [ 16.935326] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 16.935398] Read of size 1 at addr fff00000c4519e00 by task kunit_try_catch/164 [ 16.935496] [ 16.935555] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.935648] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.935674] Hardware name: linux,dummy-virt (DT) [ 16.935711] Call trace: [ 16.935752] show_stack+0x20/0x38 (C) [ 16.935820] dump_stack_lvl+0x8c/0xd0 [ 16.935870] print_report+0x118/0x608 [ 16.935916] kasan_report+0xdc/0x128 [ 16.936266] __kasan_check_byte+0x54/0x70 [ 16.936350] krealloc_noprof+0x44/0x360 [ 16.936409] krealloc_uaf+0x180/0x520 [ 16.936493] kunit_try_run_case+0x170/0x3f0 [ 16.936560] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.936613] kthread+0x328/0x630 [ 16.936665] ret_from_fork+0x10/0x20 [ 16.936731] [ 16.936759] Allocated by task 164: [ 16.936825] kasan_save_stack+0x3c/0x68 [ 16.936883] kasan_save_track+0x20/0x40 [ 16.936930] kasan_save_alloc_info+0x40/0x58 [ 16.937010] __kasan_kmalloc+0xd4/0xd8 [ 16.937067] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.937123] krealloc_uaf+0xc8/0x520 [ 16.937196] kunit_try_run_case+0x170/0x3f0 [ 16.937263] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.937307] kthread+0x328/0x630 [ 16.937340] ret_from_fork+0x10/0x20 [ 16.937381] [ 16.937399] Freed by task 164: [ 16.937424] kasan_save_stack+0x3c/0x68 [ 16.937460] kasan_save_track+0x20/0x40 [ 16.938259] kasan_save_free_info+0x4c/0x78 [ 16.938404] __kasan_slab_free+0x6c/0x98 [ 16.938485] kfree+0x214/0x3c8 [ 16.938591] krealloc_uaf+0x12c/0x520 [ 16.938653] kunit_try_run_case+0x170/0x3f0 [ 16.938718] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.938795] kthread+0x328/0x630 [ 16.938828] ret_from_fork+0x10/0x20 [ 16.938864] [ 16.938906] The buggy address belongs to the object at fff00000c4519e00 [ 16.938906] which belongs to the cache kmalloc-256 of size 256 [ 16.939003] The buggy address is located 0 bytes inside of [ 16.939003] freed 256-byte region [fff00000c4519e00, fff00000c4519f00) [ 16.939122] [ 16.939143] The buggy address belongs to the physical page: [ 16.939174] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104518 [ 16.939230] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.939341] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.939448] page_type: f5(slab) [ 16.939547] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.939624] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.939742] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.939829] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.939913] head: 0bfffe0000000001 ffffc1ffc3114601 00000000ffffffff 00000000ffffffff [ 16.940003] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.940079] page dumped because: kasan: bad access detected [ 16.940176] [ 16.940194] Memory state around the buggy address: [ 16.940228] fff00000c4519d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.940273] fff00000c4519d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.940319] >fff00000c4519e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.940358] ^ [ 16.940386] fff00000c4519e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.940430] fff00000c4519f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.940470] ==================================================================
[ 12.723801] ================================================================== [ 12.724099] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.724574] Read of size 1 at addr ffff888100341a00 by task kunit_try_catch/181 [ 12.725803] [ 12.725916] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.725963] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.725973] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.725994] Call Trace: [ 12.726013] <TASK> [ 12.726033] dump_stack_lvl+0x73/0xb0 [ 12.726066] print_report+0xd1/0x650 [ 12.726089] ? __virt_addr_valid+0x1db/0x2d0 [ 12.726113] ? krealloc_uaf+0x53c/0x5e0 [ 12.726132] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.726155] ? krealloc_uaf+0x53c/0x5e0 [ 12.726175] kasan_report+0x141/0x180 [ 12.726196] ? krealloc_uaf+0x53c/0x5e0 [ 12.726221] __asan_report_load1_noabort+0x18/0x20 [ 12.726245] krealloc_uaf+0x53c/0x5e0 [ 12.726266] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.726286] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 12.726316] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.726340] kunit_try_run_case+0x1a5/0x480 [ 12.726365] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.726387] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.726411] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.726434] ? __kthread_parkme+0x82/0x180 [ 12.726455] ? preempt_count_sub+0x50/0x80 [ 12.726480] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.726503] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.726527] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.726551] kthread+0x337/0x6f0 [ 12.726569] ? trace_preempt_on+0x20/0xc0 [ 12.726606] ? __pfx_kthread+0x10/0x10 [ 12.726626] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.726647] ? calculate_sigpending+0x7b/0xa0 [ 12.726671] ? __pfx_kthread+0x10/0x10 [ 12.726692] ret_from_fork+0x116/0x1d0 [ 12.726830] ? __pfx_kthread+0x10/0x10 [ 12.726854] ret_from_fork_asm+0x1a/0x30 [ 12.726885] </TASK> [ 12.726896] [ 12.736741] Allocated by task 181: [ 12.737234] kasan_save_stack+0x45/0x70 [ 12.737396] kasan_save_track+0x18/0x40 [ 12.737585] kasan_save_alloc_info+0x3b/0x50 [ 12.737813] __kasan_kmalloc+0xb7/0xc0 [ 12.738054] __kmalloc_cache_noprof+0x189/0x420 [ 12.738226] krealloc_uaf+0xbb/0x5e0 [ 12.738382] kunit_try_run_case+0x1a5/0x480 [ 12.738603] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.738924] kthread+0x337/0x6f0 [ 12.739073] ret_from_fork+0x116/0x1d0 [ 12.739223] ret_from_fork_asm+0x1a/0x30 [ 12.739414] [ 12.739526] Freed by task 181: [ 12.739671] kasan_save_stack+0x45/0x70 [ 12.739879] kasan_save_track+0x18/0x40 [ 12.740038] kasan_save_free_info+0x3f/0x60 [ 12.740239] __kasan_slab_free+0x56/0x70 [ 12.740392] kfree+0x222/0x3f0 [ 12.740508] krealloc_uaf+0x13d/0x5e0 [ 12.740647] kunit_try_run_case+0x1a5/0x480 [ 12.740852] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.741154] kthread+0x337/0x6f0 [ 12.741322] ret_from_fork+0x116/0x1d0 [ 12.741509] ret_from_fork_asm+0x1a/0x30 [ 12.741693] [ 12.741764] The buggy address belongs to the object at ffff888100341a00 [ 12.741764] which belongs to the cache kmalloc-256 of size 256 [ 12.742400] The buggy address is located 0 bytes inside of [ 12.742400] freed 256-byte region [ffff888100341a00, ffff888100341b00) [ 12.743146] [ 12.743252] The buggy address belongs to the physical page: [ 12.743451] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100340 [ 12.743798] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.744041] flags: 0x200000000000040(head|node=0|zone=2) [ 12.744215] page_type: f5(slab) [ 12.744344] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.744742] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.745068] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.745383] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.745679] head: 0200000000000001 ffffea000400d001 00000000ffffffff 00000000ffffffff [ 12.746283] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.746561] page dumped because: kasan: bad access detected [ 12.746770] [ 12.746987] Memory state around the buggy address: [ 12.747197] ffff888100341900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.747461] ffff888100341980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.747753] >ffff888100341a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.748288] ^ [ 12.748453] ffff888100341a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.748757] ffff888100341b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.749102] ================================================================== [ 12.689127] ================================================================== [ 12.689681] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.690339] Read of size 1 at addr ffff888100341a00 by task kunit_try_catch/181 [ 12.690572] [ 12.690718] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.690777] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.690788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.690808] Call Trace: [ 12.690820] <TASK> [ 12.690843] dump_stack_lvl+0x73/0xb0 [ 12.690875] print_report+0xd1/0x650 [ 12.690898] ? __virt_addr_valid+0x1db/0x2d0 [ 12.690923] ? krealloc_uaf+0x1b8/0x5e0 [ 12.690943] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.690965] ? krealloc_uaf+0x1b8/0x5e0 [ 12.691010] kasan_report+0x141/0x180 [ 12.691031] ? krealloc_uaf+0x1b8/0x5e0 [ 12.691065] ? krealloc_uaf+0x1b8/0x5e0 [ 12.691103] __kasan_check_byte+0x3d/0x50 [ 12.691125] krealloc_noprof+0x3f/0x340 [ 12.691148] krealloc_uaf+0x1b8/0x5e0 [ 12.691178] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.691198] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 12.691239] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.691264] kunit_try_run_case+0x1a5/0x480 [ 12.691289] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.691311] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.691337] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.691360] ? __kthread_parkme+0x82/0x180 [ 12.691382] ? preempt_count_sub+0x50/0x80 [ 12.691407] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.691430] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.691454] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.691478] kthread+0x337/0x6f0 [ 12.691496] ? trace_preempt_on+0x20/0xc0 [ 12.691520] ? __pfx_kthread+0x10/0x10 [ 12.691539] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.691561] ? calculate_sigpending+0x7b/0xa0 [ 12.691585] ? __pfx_kthread+0x10/0x10 [ 12.691616] ret_from_fork+0x116/0x1d0 [ 12.691636] ? __pfx_kthread+0x10/0x10 [ 12.691656] ret_from_fork_asm+0x1a/0x30 [ 12.691687] </TASK> [ 12.691697] [ 12.699654] Allocated by task 181: [ 12.700171] kasan_save_stack+0x45/0x70 [ 12.700364] kasan_save_track+0x18/0x40 [ 12.700542] kasan_save_alloc_info+0x3b/0x50 [ 12.700750] __kasan_kmalloc+0xb7/0xc0 [ 12.701704] __kmalloc_cache_noprof+0x189/0x420 [ 12.702001] krealloc_uaf+0xbb/0x5e0 [ 12.702173] kunit_try_run_case+0x1a5/0x480 [ 12.702365] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.702609] kthread+0x337/0x6f0 [ 12.702766] ret_from_fork+0x116/0x1d0 [ 12.703352] ret_from_fork_asm+0x1a/0x30 [ 12.703707] [ 12.704022] Freed by task 181: [ 12.704367] kasan_save_stack+0x45/0x70 [ 12.704553] kasan_save_track+0x18/0x40 [ 12.704742] kasan_save_free_info+0x3f/0x60 [ 12.705314] __kasan_slab_free+0x56/0x70 [ 12.705696] kfree+0x222/0x3f0 [ 12.706168] krealloc_uaf+0x13d/0x5e0 [ 12.706451] kunit_try_run_case+0x1a5/0x480 [ 12.706888] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.707092] kthread+0x337/0x6f0 [ 12.707410] ret_from_fork+0x116/0x1d0 [ 12.707903] ret_from_fork_asm+0x1a/0x30 [ 12.708437] [ 12.708803] The buggy address belongs to the object at ffff888100341a00 [ 12.708803] which belongs to the cache kmalloc-256 of size 256 [ 12.709881] The buggy address is located 0 bytes inside of [ 12.709881] freed 256-byte region [ffff888100341a00, ffff888100341b00) [ 12.710914] [ 12.711210] The buggy address belongs to the physical page: [ 12.711965] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100340 [ 12.712532] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.712784] flags: 0x200000000000040(head|node=0|zone=2) [ 12.713543] page_type: f5(slab) [ 12.714001] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.715038] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.715553] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.715839] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.716735] head: 0200000000000001 ffffea000400d001 00000000ffffffff 00000000ffffffff [ 12.717543] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.718294] page dumped because: kasan: bad access detected [ 12.718882] [ 12.719172] Memory state around the buggy address: [ 12.719343] ffff888100341900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.719569] ffff888100341980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.720242] >ffff888100341a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.721035] ^ [ 12.721426] ffff888100341a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.722205] ffff888100341b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.723167] ==================================================================