Date
July 8, 2025, 7:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.240586] ================================================================== [ 19.240799] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 19.240859] Read of size 1 at addr fff00000c1b1ba00 by task kunit_try_catch/164 [ 19.240907] [ 19.240938] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.241025] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.241053] Hardware name: linux,dummy-virt (DT) [ 19.241081] Call trace: [ 19.241109] show_stack+0x20/0x38 (C) [ 19.241155] dump_stack_lvl+0x8c/0xd0 [ 19.241199] print_report+0x118/0x608 [ 19.241243] kasan_report+0xdc/0x128 [ 19.241286] __asan_report_load1_noabort+0x20/0x30 [ 19.241344] krealloc_uaf+0x4c8/0x520 [ 19.241387] kunit_try_run_case+0x170/0x3f0 [ 19.241431] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.241482] kthread+0x328/0x630 [ 19.241521] ret_from_fork+0x10/0x20 [ 19.241567] [ 19.241593] Allocated by task 164: [ 19.241620] kasan_save_stack+0x3c/0x68 [ 19.241659] kasan_save_track+0x20/0x40 [ 19.241694] kasan_save_alloc_info+0x40/0x58 [ 19.241750] __kasan_kmalloc+0xd4/0xd8 [ 19.241791] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.241837] krealloc_uaf+0xc8/0x520 [ 19.241871] kunit_try_run_case+0x170/0x3f0 [ 19.241906] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.241949] kthread+0x328/0x630 [ 19.241980] ret_from_fork+0x10/0x20 [ 19.242014] [ 19.242031] Freed by task 164: [ 19.242055] kasan_save_stack+0x3c/0x68 [ 19.242091] kasan_save_track+0x20/0x40 [ 19.242125] kasan_save_free_info+0x4c/0x78 [ 19.242162] __kasan_slab_free+0x6c/0x98 [ 19.242198] kfree+0x214/0x3c8 [ 19.242228] krealloc_uaf+0x12c/0x520 [ 19.242261] kunit_try_run_case+0x170/0x3f0 [ 19.242297] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.242339] kthread+0x328/0x630 [ 19.242369] ret_from_fork+0x10/0x20 [ 19.242402] [ 19.242425] The buggy address belongs to the object at fff00000c1b1ba00 [ 19.242425] which belongs to the cache kmalloc-256 of size 256 [ 19.242480] The buggy address is located 0 bytes inside of [ 19.242480] freed 256-byte region [fff00000c1b1ba00, fff00000c1b1bb00) [ 19.242545] [ 19.242564] The buggy address belongs to the physical page: [ 19.242593] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101b1a [ 19.242643] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.242688] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.243453] page_type: f5(slab) [ 19.243514] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.243571] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.243633] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.244020] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.244083] head: 0bfffe0000000001 ffffc1ffc306c681 00000000ffffffff 00000000ffffffff [ 19.244299] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.244490] page dumped because: kasan: bad access detected [ 19.244570] [ 19.244608] Memory state around the buggy address: [ 19.244893] fff00000c1b1b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.244983] fff00000c1b1b980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.245050] >fff00000c1b1ba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.245136] ^ [ 19.245247] fff00000c1b1ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.245371] fff00000c1b1bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.245529] ================================================================== [ 19.228669] ================================================================== [ 19.229125] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 19.229245] Read of size 1 at addr fff00000c1b1ba00 by task kunit_try_catch/164 [ 19.229462] [ 19.229597] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.229695] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.229773] Hardware name: linux,dummy-virt (DT) [ 19.229861] Call trace: [ 19.229884] show_stack+0x20/0x38 (C) [ 19.230205] dump_stack_lvl+0x8c/0xd0 [ 19.230356] print_report+0x118/0x608 [ 19.230450] kasan_report+0xdc/0x128 [ 19.230495] __kasan_check_byte+0x54/0x70 [ 19.230689] krealloc_noprof+0x44/0x360 [ 19.230753] krealloc_uaf+0x180/0x520 [ 19.230909] kunit_try_run_case+0x170/0x3f0 [ 19.231014] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.231287] kthread+0x328/0x630 [ 19.231473] ret_from_fork+0x10/0x20 [ 19.231584] [ 19.231703] Allocated by task 164: [ 19.231799] kasan_save_stack+0x3c/0x68 [ 19.231849] kasan_save_track+0x20/0x40 [ 19.231885] kasan_save_alloc_info+0x40/0x58 [ 19.232196] __kasan_kmalloc+0xd4/0xd8 [ 19.232409] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.232755] krealloc_uaf+0xc8/0x520 [ 19.232922] kunit_try_run_case+0x170/0x3f0 [ 19.233036] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.233082] kthread+0x328/0x630 [ 19.233149] ret_from_fork+0x10/0x20 [ 19.233298] [ 19.233562] Freed by task 164: [ 19.233699] kasan_save_stack+0x3c/0x68 [ 19.233797] kasan_save_track+0x20/0x40 [ 19.233937] kasan_save_free_info+0x4c/0x78 [ 19.234361] __kasan_slab_free+0x6c/0x98 [ 19.234426] kfree+0x214/0x3c8 [ 19.234555] krealloc_uaf+0x12c/0x520 [ 19.234716] kunit_try_run_case+0x170/0x3f0 [ 19.234815] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.234940] kthread+0x328/0x630 [ 19.234973] ret_from_fork+0x10/0x20 [ 19.235024] [ 19.235045] The buggy address belongs to the object at fff00000c1b1ba00 [ 19.235045] which belongs to the cache kmalloc-256 of size 256 [ 19.235181] The buggy address is located 0 bytes inside of [ 19.235181] freed 256-byte region [fff00000c1b1ba00, fff00000c1b1bb00) [ 19.235265] [ 19.235295] The buggy address belongs to the physical page: [ 19.235333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101b1a [ 19.235385] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.235439] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.235629] page_type: f5(slab) [ 19.235998] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.236118] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.236213] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 19.236405] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.236500] head: 0bfffe0000000001 ffffc1ffc306c681 00000000ffffffff 00000000ffffffff [ 19.236625] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 19.236666] page dumped because: kasan: bad access detected [ 19.237166] [ 19.237192] Memory state around the buggy address: [ 19.237528] fff00000c1b1b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.237653] fff00000c1b1b980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.237852] >fff00000c1b1ba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.238057] ^ [ 19.238144] fff00000c1b1ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.238327] fff00000c1b1bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.238551] ==================================================================
[ 12.818835] ================================================================== [ 12.819931] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.820836] Read of size 1 at addr ffff888100a2da00 by task kunit_try_catch/181 [ 12.821676] [ 12.821930] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.821994] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.822007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.822072] Call Trace: [ 12.822086] <TASK> [ 12.822104] dump_stack_lvl+0x73/0xb0 [ 12.822137] print_report+0xd1/0x650 [ 12.822158] ? __virt_addr_valid+0x1db/0x2d0 [ 12.822182] ? krealloc_uaf+0x1b8/0x5e0 [ 12.822202] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.822227] ? krealloc_uaf+0x1b8/0x5e0 [ 12.822247] kasan_report+0x141/0x180 [ 12.822268] ? krealloc_uaf+0x1b8/0x5e0 [ 12.822291] ? krealloc_uaf+0x1b8/0x5e0 [ 12.822312] __kasan_check_byte+0x3d/0x50 [ 12.822333] krealloc_noprof+0x3f/0x340 [ 12.822355] krealloc_uaf+0x1b8/0x5e0 [ 12.822375] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.822395] ? finish_task_switch.isra.0+0x153/0x700 [ 12.822417] ? __switch_to+0x47/0xf50 [ 12.822442] ? __schedule+0x10cc/0x2b60 [ 12.822464] ? __pfx_read_tsc+0x10/0x10 [ 12.822483] ? ktime_get_ts64+0x86/0x230 [ 12.822517] kunit_try_run_case+0x1a5/0x480 [ 12.822541] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.822562] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.822585] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.822606] ? __kthread_parkme+0x82/0x180 [ 12.822627] ? preempt_count_sub+0x50/0x80 [ 12.822648] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.822671] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.822692] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.822713] kthread+0x337/0x6f0 [ 12.822732] ? trace_preempt_on+0x20/0xc0 [ 12.822754] ? __pfx_kthread+0x10/0x10 [ 12.822774] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.822794] ? calculate_sigpending+0x7b/0xa0 [ 12.822817] ? __pfx_kthread+0x10/0x10 [ 12.822837] ret_from_fork+0x116/0x1d0 [ 12.822854] ? __pfx_kthread+0x10/0x10 [ 12.822873] ret_from_fork_asm+0x1a/0x30 [ 12.822904] </TASK> [ 12.822917] [ 12.835691] Allocated by task 181: [ 12.836149] kasan_save_stack+0x45/0x70 [ 12.836606] kasan_save_track+0x18/0x40 [ 12.836752] kasan_save_alloc_info+0x3b/0x50 [ 12.836901] __kasan_kmalloc+0xb7/0xc0 [ 12.837032] __kmalloc_cache_noprof+0x189/0x420 [ 12.837268] krealloc_uaf+0xbb/0x5e0 [ 12.837401] kunit_try_run_case+0x1a5/0x480 [ 12.837561] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.837735] kthread+0x337/0x6f0 [ 12.837855] ret_from_fork+0x116/0x1d0 [ 12.837985] ret_from_fork_asm+0x1a/0x30 [ 12.838363] [ 12.838587] Freed by task 181: [ 12.838969] kasan_save_stack+0x45/0x70 [ 12.839364] kasan_save_track+0x18/0x40 [ 12.839781] kasan_save_free_info+0x3f/0x60 [ 12.840191] __kasan_slab_free+0x56/0x70 [ 12.840549] kfree+0x222/0x3f0 [ 12.840853] krealloc_uaf+0x13d/0x5e0 [ 12.841203] kunit_try_run_case+0x1a5/0x480 [ 12.841607] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.842074] kthread+0x337/0x6f0 [ 12.842383] ret_from_fork+0x116/0x1d0 [ 12.842764] ret_from_fork_asm+0x1a/0x30 [ 12.843173] [ 12.843338] The buggy address belongs to the object at ffff888100a2da00 [ 12.843338] which belongs to the cache kmalloc-256 of size 256 [ 12.844368] The buggy address is located 0 bytes inside of [ 12.844368] freed 256-byte region [ffff888100a2da00, ffff888100a2db00) [ 12.845165] [ 12.845327] The buggy address belongs to the physical page: [ 12.845848] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a2c [ 12.846545] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.846779] flags: 0x200000000000040(head|node=0|zone=2) [ 12.846963] page_type: f5(slab) [ 12.847098] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.847328] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.847651] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.848296] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.848955] head: 0200000000000001 ffffea0004028b01 00000000ffffffff 00000000ffffffff [ 12.849644] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.850285] page dumped because: kasan: bad access detected [ 12.850826] [ 12.851013] Memory state around the buggy address: [ 12.851518] ffff888100a2d900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.852137] ffff888100a2d980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.852864] >ffff888100a2da00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.853710] ^ [ 12.854080] ffff888100a2da80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.854492] ffff888100a2db00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.854721] ================================================================== [ 12.855345] ================================================================== [ 12.855647] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.856017] Read of size 1 at addr ffff888100a2da00 by task kunit_try_catch/181 [ 12.856289] [ 12.856416] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.856460] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.856471] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.856491] Call Trace: [ 12.856506] <TASK> [ 12.856522] dump_stack_lvl+0x73/0xb0 [ 12.856548] print_report+0xd1/0x650 [ 12.856569] ? __virt_addr_valid+0x1db/0x2d0 [ 12.856589] ? krealloc_uaf+0x53c/0x5e0 [ 12.856609] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.856633] ? krealloc_uaf+0x53c/0x5e0 [ 12.856653] kasan_report+0x141/0x180 [ 12.856673] ? krealloc_uaf+0x53c/0x5e0 [ 12.856698] __asan_report_load1_noabort+0x18/0x20 [ 12.856720] krealloc_uaf+0x53c/0x5e0 [ 12.856740] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.856761] ? finish_task_switch.isra.0+0x153/0x700 [ 12.856782] ? __switch_to+0x47/0xf50 [ 12.856807] ? __schedule+0x10cc/0x2b60 [ 12.856828] ? __pfx_read_tsc+0x10/0x10 [ 12.856848] ? ktime_get_ts64+0x86/0x230 [ 12.856870] kunit_try_run_case+0x1a5/0x480 [ 12.856893] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.856914] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.856935] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.856956] ? __kthread_parkme+0x82/0x180 [ 12.856975] ? preempt_count_sub+0x50/0x80 [ 12.856996] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.857018] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.857051] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.857072] kthread+0x337/0x6f0 [ 12.857091] ? trace_preempt_on+0x20/0xc0 [ 12.857112] ? __pfx_kthread+0x10/0x10 [ 12.857131] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.857150] ? calculate_sigpending+0x7b/0xa0 [ 12.857172] ? __pfx_kthread+0x10/0x10 [ 12.857192] ret_from_fork+0x116/0x1d0 [ 12.857209] ? __pfx_kthread+0x10/0x10 [ 12.857228] ret_from_fork_asm+0x1a/0x30 [ 12.857257] </TASK> [ 12.857268] [ 12.864127] Allocated by task 181: [ 12.864302] kasan_save_stack+0x45/0x70 [ 12.864494] kasan_save_track+0x18/0x40 [ 12.864666] kasan_save_alloc_info+0x3b/0x50 [ 12.864814] __kasan_kmalloc+0xb7/0xc0 [ 12.864945] __kmalloc_cache_noprof+0x189/0x420 [ 12.865140] krealloc_uaf+0xbb/0x5e0 [ 12.865319] kunit_try_run_case+0x1a5/0x480 [ 12.865532] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.865795] kthread+0x337/0x6f0 [ 12.865933] ret_from_fork+0x116/0x1d0 [ 12.866076] ret_from_fork_asm+0x1a/0x30 [ 12.866214] [ 12.866308] Freed by task 181: [ 12.866469] kasan_save_stack+0x45/0x70 [ 12.866842] kasan_save_track+0x18/0x40 [ 12.867021] kasan_save_free_info+0x3f/0x60 [ 12.867202] __kasan_slab_free+0x56/0x70 [ 12.867376] kfree+0x222/0x3f0 [ 12.867555] krealloc_uaf+0x13d/0x5e0 [ 12.867712] kunit_try_run_case+0x1a5/0x480 [ 12.867907] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.868139] kthread+0x337/0x6f0 [ 12.868300] ret_from_fork+0x116/0x1d0 [ 12.868482] ret_from_fork_asm+0x1a/0x30 [ 12.868644] [ 12.868725] The buggy address belongs to the object at ffff888100a2da00 [ 12.868725] which belongs to the cache kmalloc-256 of size 256 [ 12.869237] The buggy address is located 0 bytes inside of [ 12.869237] freed 256-byte region [ffff888100a2da00, ffff888100a2db00) [ 12.869702] [ 12.869800] The buggy address belongs to the physical page: [ 12.869974] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a2c [ 12.870224] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.870449] flags: 0x200000000000040(head|node=0|zone=2) [ 12.870689] page_type: f5(slab) [ 12.870854] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.871390] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.871662] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.871891] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.872128] head: 0200000000000001 ffffea0004028b01 00000000ffffffff 00000000ffffffff [ 12.872356] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.872988] page dumped because: kasan: bad access detected [ 12.873258] [ 12.873351] Memory state around the buggy address: [ 12.873645] ffff888100a2d900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.873971] ffff888100a2d980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.874225] >ffff888100a2da00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.874553] ^ [ 12.874675] ffff888100a2da80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.874888] ffff888100a2db00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.875175] ==================================================================