Date
July 16, 2025, 3:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.644371] ================================================================== [ 16.644419] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 16.644466] Read of size 1 at addr fff00000c638a400 by task kunit_try_catch/164 [ 16.644514] [ 16.644544] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.644621] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.644646] Hardware name: linux,dummy-virt (DT) [ 16.644675] Call trace: [ 16.644695] show_stack+0x20/0x38 (C) [ 16.644757] dump_stack_lvl+0x8c/0xd0 [ 16.644833] print_report+0x118/0x5d0 [ 16.644881] kasan_report+0xdc/0x128 [ 16.644930] __asan_report_load1_noabort+0x20/0x30 [ 16.644980] krealloc_uaf+0x4c8/0x520 [ 16.645023] kunit_try_run_case+0x170/0x3f0 [ 16.645069] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.645120] kthread+0x328/0x630 [ 16.645160] ret_from_fork+0x10/0x20 [ 16.645207] [ 16.645234] Allocated by task 164: [ 16.645261] kasan_save_stack+0x3c/0x68 [ 16.645308] kasan_save_track+0x20/0x40 [ 16.645345] kasan_save_alloc_info+0x40/0x58 [ 16.645393] __kasan_kmalloc+0xd4/0xd8 [ 16.645430] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.645469] krealloc_uaf+0xc8/0x520 [ 16.645503] kunit_try_run_case+0x170/0x3f0 [ 16.645539] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.645581] kthread+0x328/0x630 [ 16.645620] ret_from_fork+0x10/0x20 [ 16.645664] [ 16.645682] Freed by task 164: [ 16.645706] kasan_save_stack+0x3c/0x68 [ 16.645753] kasan_save_track+0x20/0x40 [ 16.645796] kasan_save_free_info+0x4c/0x78 [ 16.645835] __kasan_slab_free+0x6c/0x98 [ 16.645870] kfree+0x214/0x3c8 [ 16.645907] krealloc_uaf+0x12c/0x520 [ 16.645943] kunit_try_run_case+0x170/0x3f0 [ 16.645988] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.646037] kthread+0x328/0x630 [ 16.646068] ret_from_fork+0x10/0x20 [ 16.646102] [ 16.646130] The buggy address belongs to the object at fff00000c638a400 [ 16.646130] which belongs to the cache kmalloc-256 of size 256 [ 16.646196] The buggy address is located 0 bytes inside of [ 16.646196] freed 256-byte region [fff00000c638a400, fff00000c638a500) [ 16.646257] [ 16.646275] The buggy address belongs to the physical page: [ 16.646315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10638a [ 16.646367] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.646412] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.646462] page_type: f5(slab) [ 16.646506] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.646556] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.646610] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.646659] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.646717] head: 0bfffe0000000001 ffffc1ffc318e281 00000000ffffffff 00000000ffffffff [ 16.646765] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.646803] page dumped because: kasan: bad access detected [ 16.646833] [ 16.646850] Memory state around the buggy address: [ 16.646879] fff00000c638a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.646920] fff00000c638a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.646961] >fff00000c638a400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.646998] ^ [ 16.647346] fff00000c638a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.647417] fff00000c638a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.647495] ================================================================== [ 16.637841] ================================================================== [ 16.637977] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 16.638049] Read of size 1 at addr fff00000c638a400 by task kunit_try_catch/164 [ 16.638104] [ 16.638135] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.638282] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.638310] Hardware name: linux,dummy-virt (DT) [ 16.638365] Call trace: [ 16.638504] show_stack+0x20/0x38 (C) [ 16.638562] dump_stack_lvl+0x8c/0xd0 [ 16.638627] print_report+0x118/0x5d0 [ 16.638692] kasan_report+0xdc/0x128 [ 16.638796] __kasan_check_byte+0x54/0x70 [ 16.638849] krealloc_noprof+0x44/0x360 [ 16.638895] krealloc_uaf+0x180/0x520 [ 16.638937] kunit_try_run_case+0x170/0x3f0 [ 16.638983] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.639040] kthread+0x328/0x630 [ 16.639081] ret_from_fork+0x10/0x20 [ 16.639127] [ 16.639145] Allocated by task 164: [ 16.639172] kasan_save_stack+0x3c/0x68 [ 16.639236] kasan_save_track+0x20/0x40 [ 16.639283] kasan_save_alloc_info+0x40/0x58 [ 16.639331] __kasan_kmalloc+0xd4/0xd8 [ 16.639368] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.639406] krealloc_uaf+0xc8/0x520 [ 16.639440] kunit_try_run_case+0x170/0x3f0 [ 16.639477] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.639519] kthread+0x328/0x630 [ 16.639550] ret_from_fork+0x10/0x20 [ 16.639600] [ 16.639633] Freed by task 164: [ 16.639677] kasan_save_stack+0x3c/0x68 [ 16.639972] kasan_save_track+0x20/0x40 [ 16.640199] kasan_save_free_info+0x4c/0x78 [ 16.640315] __kasan_slab_free+0x6c/0x98 [ 16.640433] kfree+0x214/0x3c8 [ 16.640468] krealloc_uaf+0x12c/0x520 [ 16.640503] kunit_try_run_case+0x170/0x3f0 [ 16.640568] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.640610] kthread+0x328/0x630 [ 16.640643] ret_from_fork+0x10/0x20 [ 16.640691] [ 16.640728] The buggy address belongs to the object at fff00000c638a400 [ 16.640728] which belongs to the cache kmalloc-256 of size 256 [ 16.640986] The buggy address is located 0 bytes inside of [ 16.640986] freed 256-byte region [fff00000c638a400, fff00000c638a500) [ 16.641103] [ 16.641132] The buggy address belongs to the physical page: [ 16.641228] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10638a [ 16.641358] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.641476] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.641579] page_type: f5(slab) [ 16.641768] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.641902] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.641953] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 16.642041] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.642441] head: 0bfffe0000000001 ffffc1ffc318e281 00000000ffffffff 00000000ffffffff [ 16.642574] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.642651] page dumped because: kasan: bad access detected [ 16.643251] [ 16.643271] Memory state around the buggy address: [ 16.643303] fff00000c638a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.643345] fff00000c638a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.643387] >fff00000c638a400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.643424] ^ [ 16.643450] fff00000c638a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.643491] fff00000c638a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.643528] ==================================================================
[ 12.501054] ================================================================== [ 12.501347] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.501780] Read of size 1 at addr ffff888100342400 by task kunit_try_catch/181 [ 12.502467] [ 12.502580] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.502622] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.502633] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.502653] Call Trace: [ 12.502664] <TASK> [ 12.502678] dump_stack_lvl+0x73/0xb0 [ 12.502706] print_report+0xd1/0x610 [ 12.502729] ? __virt_addr_valid+0x1db/0x2d0 [ 12.502765] ? krealloc_uaf+0x53c/0x5e0 [ 12.502787] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.502811] ? krealloc_uaf+0x53c/0x5e0 [ 12.502832] kasan_report+0x141/0x180 [ 12.502854] ? krealloc_uaf+0x53c/0x5e0 [ 12.502880] __asan_report_load1_noabort+0x18/0x20 [ 12.502906] krealloc_uaf+0x53c/0x5e0 [ 12.502927] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.502948] ? finish_task_switch.isra.0+0x153/0x700 [ 12.502972] ? __switch_to+0x47/0xf50 [ 12.503047] ? __schedule+0x10cc/0x2b60 [ 12.503070] ? __pfx_read_tsc+0x10/0x10 [ 12.503091] ? ktime_get_ts64+0x86/0x230 [ 12.503116] kunit_try_run_case+0x1a5/0x480 [ 12.503140] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.503164] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.503193] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.503217] ? __kthread_parkme+0x82/0x180 [ 12.503238] ? preempt_count_sub+0x50/0x80 [ 12.503262] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.503287] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.503312] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.503338] kthread+0x337/0x6f0 [ 12.503357] ? trace_preempt_on+0x20/0xc0 [ 12.503381] ? __pfx_kthread+0x10/0x10 [ 12.503401] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.503423] ? calculate_sigpending+0x7b/0xa0 [ 12.503448] ? __pfx_kthread+0x10/0x10 [ 12.503469] ret_from_fork+0x116/0x1d0 [ 12.503488] ? __pfx_kthread+0x10/0x10 [ 12.503508] ret_from_fork_asm+0x1a/0x30 [ 12.503539] </TASK> [ 12.503548] [ 12.511424] Allocated by task 181: [ 12.511598] kasan_save_stack+0x45/0x70 [ 12.511799] kasan_save_track+0x18/0x40 [ 12.511940] kasan_save_alloc_info+0x3b/0x50 [ 12.512142] __kasan_kmalloc+0xb7/0xc0 [ 12.512344] __kmalloc_cache_noprof+0x189/0x420 [ 12.512566] krealloc_uaf+0xbb/0x5e0 [ 12.512750] kunit_try_run_case+0x1a5/0x480 [ 12.513133] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.513320] kthread+0x337/0x6f0 [ 12.513444] ret_from_fork+0x116/0x1d0 [ 12.513633] ret_from_fork_asm+0x1a/0x30 [ 12.513845] [ 12.514129] Freed by task 181: [ 12.514307] kasan_save_stack+0x45/0x70 [ 12.514521] kasan_save_track+0x18/0x40 [ 12.514678] kasan_save_free_info+0x3f/0x60 [ 12.514880] __kasan_slab_free+0x56/0x70 [ 12.515024] kfree+0x222/0x3f0 [ 12.515147] krealloc_uaf+0x13d/0x5e0 [ 12.515304] kunit_try_run_case+0x1a5/0x480 [ 12.515514] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.515964] kthread+0x337/0x6f0 [ 12.516089] ret_from_fork+0x116/0x1d0 [ 12.516225] ret_from_fork_asm+0x1a/0x30 [ 12.516427] [ 12.516582] The buggy address belongs to the object at ffff888100342400 [ 12.516582] which belongs to the cache kmalloc-256 of size 256 [ 12.517212] The buggy address is located 0 bytes inside of [ 12.517212] freed 256-byte region [ffff888100342400, ffff888100342500) [ 12.517764] [ 12.517863] The buggy address belongs to the physical page: [ 12.518291] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100342 [ 12.518655] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.518981] flags: 0x200000000000040(head|node=0|zone=2) [ 12.519199] page_type: f5(slab) [ 12.519325] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.519563] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.519908] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.520414] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.520770] head: 0200000000000001 ffffea000400d081 00000000ffffffff 00000000ffffffff [ 12.521101] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.521446] page dumped because: kasan: bad access detected [ 12.521703] [ 12.521792] Memory state around the buggy address: [ 12.521952] ffff888100342300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.522374] ffff888100342380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.522855] >ffff888100342400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.523155] ^ [ 12.523300] ffff888100342480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.523636] ffff888100342500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.523874] ================================================================== [ 12.476607] ================================================================== [ 12.477120] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.477535] Read of size 1 at addr ffff888100342400 by task kunit_try_catch/181 [ 12.477834] [ 12.477944] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.477999] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.478011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.478031] Call Trace: [ 12.478043] <TASK> [ 12.478058] dump_stack_lvl+0x73/0xb0 [ 12.478089] print_report+0xd1/0x610 [ 12.478113] ? __virt_addr_valid+0x1db/0x2d0 [ 12.478136] ? krealloc_uaf+0x1b8/0x5e0 [ 12.478158] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.478182] ? krealloc_uaf+0x1b8/0x5e0 [ 12.478203] kasan_report+0x141/0x180 [ 12.478225] ? krealloc_uaf+0x1b8/0x5e0 [ 12.478250] ? krealloc_uaf+0x1b8/0x5e0 [ 12.478271] __kasan_check_byte+0x3d/0x50 [ 12.478293] krealloc_noprof+0x3f/0x340 [ 12.478317] krealloc_uaf+0x1b8/0x5e0 [ 12.478338] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.478360] ? finish_task_switch.isra.0+0x153/0x700 [ 12.478384] ? __switch_to+0x47/0xf50 [ 12.478410] ? __schedule+0x10cc/0x2b60 [ 12.478482] ? __pfx_read_tsc+0x10/0x10 [ 12.478507] ? ktime_get_ts64+0x86/0x230 [ 12.478532] kunit_try_run_case+0x1a5/0x480 [ 12.478559] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.478583] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.478607] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.478632] ? __kthread_parkme+0x82/0x180 [ 12.478654] ? preempt_count_sub+0x50/0x80 [ 12.478677] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.478702] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.478727] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.478762] kthread+0x337/0x6f0 [ 12.478782] ? trace_preempt_on+0x20/0xc0 [ 12.478806] ? __pfx_kthread+0x10/0x10 [ 12.478827] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.478848] ? calculate_sigpending+0x7b/0xa0 [ 12.478873] ? __pfx_kthread+0x10/0x10 [ 12.478895] ret_from_fork+0x116/0x1d0 [ 12.478914] ? __pfx_kthread+0x10/0x10 [ 12.478934] ret_from_fork_asm+0x1a/0x30 [ 12.478965] </TASK> [ 12.479100] [ 12.487362] Allocated by task 181: [ 12.487543] kasan_save_stack+0x45/0x70 [ 12.487763] kasan_save_track+0x18/0x40 [ 12.487965] kasan_save_alloc_info+0x3b/0x50 [ 12.488329] __kasan_kmalloc+0xb7/0xc0 [ 12.488741] __kmalloc_cache_noprof+0x189/0x420 [ 12.488934] krealloc_uaf+0xbb/0x5e0 [ 12.489299] kunit_try_run_case+0x1a5/0x480 [ 12.489479] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.489662] kthread+0x337/0x6f0 [ 12.489800] ret_from_fork+0x116/0x1d0 [ 12.490106] ret_from_fork_asm+0x1a/0x30 [ 12.490321] [ 12.490451] Freed by task 181: [ 12.490629] kasan_save_stack+0x45/0x70 [ 12.490896] kasan_save_track+0x18/0x40 [ 12.491174] kasan_save_free_info+0x3f/0x60 [ 12.491378] __kasan_slab_free+0x56/0x70 [ 12.491595] kfree+0x222/0x3f0 [ 12.491765] krealloc_uaf+0x13d/0x5e0 [ 12.491941] kunit_try_run_case+0x1a5/0x480 [ 12.492125] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.492358] kthread+0x337/0x6f0 [ 12.492570] ret_from_fork+0x116/0x1d0 [ 12.492708] ret_from_fork_asm+0x1a/0x30 [ 12.492925] [ 12.493031] The buggy address belongs to the object at ffff888100342400 [ 12.493031] which belongs to the cache kmalloc-256 of size 256 [ 12.493611] The buggy address is located 0 bytes inside of [ 12.493611] freed 256-byte region [ffff888100342400, ffff888100342500) [ 12.494020] [ 12.494105] The buggy address belongs to the physical page: [ 12.494352] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100342 [ 12.494786] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.495124] flags: 0x200000000000040(head|node=0|zone=2) [ 12.495315] page_type: f5(slab) [ 12.495466] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.495831] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.496467] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.496815] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.497167] head: 0200000000000001 ffffea000400d081 00000000ffffffff 00000000ffffffff [ 12.497421] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.497774] page dumped because: kasan: bad access detected [ 12.498006] [ 12.498080] Memory state around the buggy address: [ 12.498239] ffff888100342300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.498584] ffff888100342380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.499147] >ffff888100342400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.499390] ^ [ 12.499706] ffff888100342480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.500027] ffff888100342500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.500530] ==================================================================