Date
July 10, 2025, 6:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.836151] ================================================================== [ 16.836243] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 16.836293] Read of size 1 at addr fff00000c1d25000 by task kunit_try_catch/164 [ 16.836377] [ 16.836441] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.836521] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.836546] Hardware name: linux,dummy-virt (DT) [ 16.836591] Call trace: [ 16.836637] show_stack+0x20/0x38 (C) [ 16.836933] dump_stack_lvl+0x8c/0xd0 [ 16.837046] print_report+0x118/0x608 [ 16.837101] kasan_report+0xdc/0x128 [ 16.837148] __asan_report_load1_noabort+0x20/0x30 [ 16.837200] krealloc_uaf+0x4c8/0x520 [ 16.837331] kunit_try_run_case+0x170/0x3f0 [ 16.837424] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.837569] kthread+0x328/0x630 [ 16.837664] ret_from_fork+0x10/0x20 [ 16.837747] [ 16.837766] Allocated by task 164: [ 16.837792] kasan_save_stack+0x3c/0x68 [ 16.837936] kasan_save_track+0x20/0x40 [ 16.838085] kasan_save_alloc_info+0x40/0x58 [ 16.838198] __kasan_kmalloc+0xd4/0xd8 [ 16.838257] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.838406] krealloc_uaf+0xc8/0x520 [ 16.838444] kunit_try_run_case+0x170/0x3f0 [ 16.838483] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.838526] kthread+0x328/0x630 [ 16.838580] ret_from_fork+0x10/0x20 [ 16.838615] [ 16.838634] Freed by task 164: [ 16.838663] kasan_save_stack+0x3c/0x68 [ 16.838702] kasan_save_track+0x20/0x40 [ 16.838860] kasan_save_free_info+0x4c/0x78 [ 16.838980] __kasan_slab_free+0x6c/0x98 [ 16.839077] kfree+0x214/0x3c8 [ 16.839213] krealloc_uaf+0x12c/0x520 [ 16.839322] kunit_try_run_case+0x170/0x3f0 [ 16.839432] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.839516] kthread+0x328/0x630 [ 16.839834] ret_from_fork+0x10/0x20 [ 16.840016] [ 16.840174] The buggy address belongs to the object at fff00000c1d25000 [ 16.840174] which belongs to the cache kmalloc-256 of size 256 [ 16.840253] The buggy address is located 0 bytes inside of [ 16.840253] freed 256-byte region [fff00000c1d25000, fff00000c1d25100) [ 16.840484] [ 16.840742] The buggy address belongs to the physical page: [ 16.840779] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101d24 [ 16.840901] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.840947] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.841231] page_type: f5(slab) [ 16.841335] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.841430] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.841528] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.841632] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.841680] head: 0bfffe0000000001 ffffc1ffc3074901 00000000ffffffff 00000000ffffffff [ 16.842047] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.842137] page dumped because: kasan: bad access detected [ 16.842255] [ 16.842316] Memory state around the buggy address: [ 16.842419] fff00000c1d24f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.842526] fff00000c1d24f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.842567] >fff00000c1d25000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.842603] ^ [ 16.842629] fff00000c1d25080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.842685] fff00000c1d25100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.842721] ================================================================== [ 16.828096] ================================================================== [ 16.828179] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 16.828238] Read of size 1 at addr fff00000c1d25000 by task kunit_try_catch/164 [ 16.828286] [ 16.828321] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.828416] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.828442] Hardware name: linux,dummy-virt (DT) [ 16.828472] Call trace: [ 16.828752] show_stack+0x20/0x38 (C) [ 16.828818] dump_stack_lvl+0x8c/0xd0 [ 16.828867] print_report+0x118/0x608 [ 16.828913] kasan_report+0xdc/0x128 [ 16.828958] __kasan_check_byte+0x54/0x70 [ 16.829004] krealloc_noprof+0x44/0x360 [ 16.829051] krealloc_uaf+0x180/0x520 [ 16.829530] kunit_try_run_case+0x170/0x3f0 [ 16.829708] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.829771] kthread+0x328/0x630 [ 16.829813] ret_from_fork+0x10/0x20 [ 16.829886] [ 16.829974] Allocated by task 164: [ 16.830037] kasan_save_stack+0x3c/0x68 [ 16.830079] kasan_save_track+0x20/0x40 [ 16.830116] kasan_save_alloc_info+0x40/0x58 [ 16.830155] __kasan_kmalloc+0xd4/0xd8 [ 16.830191] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.830421] krealloc_uaf+0xc8/0x520 [ 16.830693] kunit_try_run_case+0x170/0x3f0 [ 16.830733] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.830913] kthread+0x328/0x630 [ 16.831009] ret_from_fork+0x10/0x20 [ 16.831125] [ 16.831145] Freed by task 164: [ 16.831227] kasan_save_stack+0x3c/0x68 [ 16.831307] kasan_save_track+0x20/0x40 [ 16.831394] kasan_save_free_info+0x4c/0x78 [ 16.831519] __kasan_slab_free+0x6c/0x98 [ 16.831627] kfree+0x214/0x3c8 [ 16.831745] krealloc_uaf+0x12c/0x520 [ 16.831792] kunit_try_run_case+0x170/0x3f0 [ 16.831829] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.831873] kthread+0x328/0x630 [ 16.831905] ret_from_fork+0x10/0x20 [ 16.831940] [ 16.832100] The buggy address belongs to the object at fff00000c1d25000 [ 16.832100] which belongs to the cache kmalloc-256 of size 256 [ 16.832323] The buggy address is located 0 bytes inside of [ 16.832323] freed 256-byte region [fff00000c1d25000, fff00000c1d25100) [ 16.832554] [ 16.832633] The buggy address belongs to the physical page: [ 16.832755] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101d24 [ 16.832822] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.832931] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.833021] page_type: f5(slab) [ 16.833128] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.833240] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.833365] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.833482] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.833612] head: 0bfffe0000000001 ffffc1ffc3074901 00000000ffffffff 00000000ffffffff [ 16.833677] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.833715] page dumped because: kasan: bad access detected [ 16.833744] [ 16.833762] Memory state around the buggy address: [ 16.834035] fff00000c1d24f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.834161] fff00000c1d24f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.834308] >fff00000c1d25000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.834405] ^ [ 16.834433] fff00000c1d25080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.834473] fff00000c1d25100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.834558] ==================================================================
[ 12.469385] ================================================================== [ 12.469900] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.470525] Read of size 1 at addr ffff888100a96600 by task kunit_try_catch/181 [ 12.470895] [ 12.471023] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.471080] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.471091] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.471109] Call Trace: [ 12.471120] <TASK> [ 12.471134] dump_stack_lvl+0x73/0xb0 [ 12.471162] print_report+0xd1/0x650 [ 12.471184] ? __virt_addr_valid+0x1db/0x2d0 [ 12.471205] ? krealloc_uaf+0x1b8/0x5e0 [ 12.471225] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.471248] ? krealloc_uaf+0x1b8/0x5e0 [ 12.471269] kasan_report+0x141/0x180 [ 12.471289] ? krealloc_uaf+0x1b8/0x5e0 [ 12.471313] ? krealloc_uaf+0x1b8/0x5e0 [ 12.471333] __kasan_check_byte+0x3d/0x50 [ 12.471354] krealloc_noprof+0x3f/0x340 [ 12.471377] krealloc_uaf+0x1b8/0x5e0 [ 12.471398] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.471418] ? finish_task_switch.isra.0+0x153/0x700 [ 12.471440] ? __switch_to+0x47/0xf50 [ 12.471464] ? __schedule+0x10cc/0x2b60 [ 12.471485] ? __pfx_read_tsc+0x10/0x10 [ 12.471505] ? ktime_get_ts64+0x86/0x230 [ 12.471530] kunit_try_run_case+0x1a5/0x480 [ 12.471554] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.471576] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.471599] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.471623] ? __kthread_parkme+0x82/0x180 [ 12.471643] ? preempt_count_sub+0x50/0x80 [ 12.471666] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.471690] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.471714] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.471739] kthread+0x337/0x6f0 [ 12.471757] ? trace_preempt_on+0x20/0xc0 [ 12.471779] ? __pfx_kthread+0x10/0x10 [ 12.471798] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.471838] ? calculate_sigpending+0x7b/0xa0 [ 12.471862] ? __pfx_kthread+0x10/0x10 [ 12.471883] ret_from_fork+0x116/0x1d0 [ 12.471901] ? __pfx_kthread+0x10/0x10 [ 12.471921] ret_from_fork_asm+0x1a/0x30 [ 12.471958] </TASK> [ 12.471968] [ 12.479375] Allocated by task 181: [ 12.479530] kasan_save_stack+0x45/0x70 [ 12.479723] kasan_save_track+0x18/0x40 [ 12.479858] kasan_save_alloc_info+0x3b/0x50 [ 12.480162] __kasan_kmalloc+0xb7/0xc0 [ 12.480351] __kmalloc_cache_noprof+0x189/0x420 [ 12.480543] krealloc_uaf+0xbb/0x5e0 [ 12.480672] kunit_try_run_case+0x1a5/0x480 [ 12.480869] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.481134] kthread+0x337/0x6f0 [ 12.481301] ret_from_fork+0x116/0x1d0 [ 12.481437] ret_from_fork_asm+0x1a/0x30 [ 12.481624] [ 12.481718] Freed by task 181: [ 12.481873] kasan_save_stack+0x45/0x70 [ 12.482207] kasan_save_track+0x18/0x40 [ 12.482388] kasan_save_free_info+0x3f/0x60 [ 12.482569] __kasan_slab_free+0x56/0x70 [ 12.482745] kfree+0x222/0x3f0 [ 12.483068] krealloc_uaf+0x13d/0x5e0 [ 12.483242] kunit_try_run_case+0x1a5/0x480 [ 12.483423] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.483644] kthread+0x337/0x6f0 [ 12.483791] ret_from_fork+0x116/0x1d0 [ 12.483977] ret_from_fork_asm+0x1a/0x30 [ 12.484285] [ 12.484375] The buggy address belongs to the object at ffff888100a96600 [ 12.484375] which belongs to the cache kmalloc-256 of size 256 [ 12.484780] The buggy address is located 0 bytes inside of [ 12.484780] freed 256-byte region [ffff888100a96600, ffff888100a96700) [ 12.485141] [ 12.485233] The buggy address belongs to the physical page: [ 12.485478] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a96 [ 12.485826] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.486306] flags: 0x200000000000040(head|node=0|zone=2) [ 12.486559] page_type: f5(slab) [ 12.486690] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.487088] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.487352] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.487585] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.487815] head: 0200000000000001 ffffea000402a581 00000000ffffffff 00000000ffffffff [ 12.488069] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.488409] page dumped because: kasan: bad access detected [ 12.488661] [ 12.488753] Memory state around the buggy address: [ 12.489000] ffff888100a96500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.489330] ffff888100a96580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.489646] >ffff888100a96600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.489971] ^ [ 12.490109] ffff888100a96680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.490382] ffff888100a96700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.490635] ================================================================== [ 12.491165] ================================================================== [ 12.491526] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.492222] Read of size 1 at addr ffff888100a96600 by task kunit_try_catch/181 [ 12.492560] [ 12.492667] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.492706] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.492717] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.492736] Call Trace: [ 12.492749] <TASK> [ 12.492763] dump_stack_lvl+0x73/0xb0 [ 12.492792] print_report+0xd1/0x650 [ 12.492897] ? __virt_addr_valid+0x1db/0x2d0 [ 12.492922] ? krealloc_uaf+0x53c/0x5e0 [ 12.492943] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.492966] ? krealloc_uaf+0x53c/0x5e0 [ 12.492987] kasan_report+0x141/0x180 [ 12.493008] ? krealloc_uaf+0x53c/0x5e0 [ 12.493048] __asan_report_load1_noabort+0x18/0x20 [ 12.493073] krealloc_uaf+0x53c/0x5e0 [ 12.493093] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.493114] ? finish_task_switch.isra.0+0x153/0x700 [ 12.493136] ? __switch_to+0x47/0xf50 [ 12.493159] ? __schedule+0x10cc/0x2b60 [ 12.493181] ? __pfx_read_tsc+0x10/0x10 [ 12.493201] ? ktime_get_ts64+0x86/0x230 [ 12.493224] kunit_try_run_case+0x1a5/0x480 [ 12.493248] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.493270] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.493293] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.493317] ? __kthread_parkme+0x82/0x180 [ 12.493336] ? preempt_count_sub+0x50/0x80 [ 12.493358] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.493382] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.493406] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.493430] kthread+0x337/0x6f0 [ 12.493448] ? trace_preempt_on+0x20/0xc0 [ 12.493470] ? __pfx_kthread+0x10/0x10 [ 12.493491] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.493511] ? calculate_sigpending+0x7b/0xa0 [ 12.493535] ? __pfx_kthread+0x10/0x10 [ 12.493556] ret_from_fork+0x116/0x1d0 [ 12.493573] ? __pfx_kthread+0x10/0x10 [ 12.493593] ret_from_fork_asm+0x1a/0x30 [ 12.493623] </TASK> [ 12.493632] [ 12.504639] Allocated by task 181: [ 12.504777] kasan_save_stack+0x45/0x70 [ 12.504924] kasan_save_track+0x18/0x40 [ 12.505076] kasan_save_alloc_info+0x3b/0x50 [ 12.505266] __kasan_kmalloc+0xb7/0xc0 [ 12.505449] __kmalloc_cache_noprof+0x189/0x420 [ 12.505669] krealloc_uaf+0xbb/0x5e0 [ 12.505866] kunit_try_run_case+0x1a5/0x480 [ 12.506015] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.506299] kthread+0x337/0x6f0 [ 12.506477] ret_from_fork+0x116/0x1d0 [ 12.506663] ret_from_fork_asm+0x1a/0x30 [ 12.507643] [ 12.507723] Freed by task 181: [ 12.507841] kasan_save_stack+0x45/0x70 [ 12.508058] kasan_save_track+0x18/0x40 [ 12.508244] kasan_save_free_info+0x3f/0x60 [ 12.508429] __kasan_slab_free+0x56/0x70 [ 12.508564] kfree+0x222/0x3f0 [ 12.508678] krealloc_uaf+0x13d/0x5e0 [ 12.509246] kunit_try_run_case+0x1a5/0x480 [ 12.509470] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.509724] kthread+0x337/0x6f0 [ 12.509912] ret_from_fork+0x116/0x1d0 [ 12.510108] ret_from_fork_asm+0x1a/0x30 [ 12.510246] [ 12.510318] The buggy address belongs to the object at ffff888100a96600 [ 12.510318] which belongs to the cache kmalloc-256 of size 256 [ 12.510831] The buggy address is located 0 bytes inside of [ 12.510831] freed 256-byte region [ffff888100a96600, ffff888100a96700) [ 12.511402] [ 12.511479] The buggy address belongs to the physical page: [ 12.511679] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a96 [ 12.512341] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.512639] flags: 0x200000000000040(head|node=0|zone=2) [ 12.513101] page_type: f5(slab) [ 12.513244] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.513583] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.513951] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.514306] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.514575] head: 0200000000000001 ffffea000402a581 00000000ffffffff 00000000ffffffff [ 12.514902] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.515356] page dumped because: kasan: bad access detected [ 12.515596] [ 12.515690] Memory state around the buggy address: [ 12.515890] ffff888100a96500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.516218] ffff888100a96580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.516461] >ffff888100a96600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.516750] ^ [ 12.516864] ffff888100a96680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.517088] ffff888100a96700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.517377] ==================================================================