Date
July 20, 2025, 8:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.128867] ================================================================== [ 15.129061] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 15.129452] Read of size 1 at addr fff00000c5f4b800 by task kunit_try_catch/165 [ 15.129533] [ 15.129939] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.130078] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.130112] Hardware name: linux,dummy-virt (DT) [ 15.130145] Call trace: [ 15.130427] show_stack+0x20/0x38 (C) [ 15.130517] dump_stack_lvl+0x8c/0xd0 [ 15.130849] print_report+0x118/0x5d0 [ 15.131056] kasan_report+0xdc/0x128 [ 15.131219] __kasan_check_byte+0x54/0x70 [ 15.131314] krealloc_noprof+0x44/0x360 [ 15.131742] krealloc_uaf+0x180/0x520 [ 15.131892] kunit_try_run_case+0x170/0x3f0 [ 15.131995] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.132086] kthread+0x328/0x630 [ 15.132491] ret_from_fork+0x10/0x20 [ 15.132620] [ 15.132688] Allocated by task 165: [ 15.132813] kasan_save_stack+0x3c/0x68 [ 15.133210] kasan_save_track+0x20/0x40 [ 15.133349] kasan_save_alloc_info+0x40/0x58 [ 15.133447] __kasan_kmalloc+0xd4/0xd8 [ 15.133590] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.133676] krealloc_uaf+0xc8/0x520 [ 15.133833] kunit_try_run_case+0x170/0x3f0 [ 15.134094] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.134532] kthread+0x328/0x630 [ 15.134610] ret_from_fork+0x10/0x20 [ 15.134703] [ 15.134820] Freed by task 165: [ 15.134860] kasan_save_stack+0x3c/0x68 [ 15.135050] kasan_save_track+0x20/0x40 [ 15.135278] kasan_save_free_info+0x4c/0x78 [ 15.135349] __kasan_slab_free+0x6c/0x98 [ 15.135436] kfree+0x214/0x3c8 [ 15.135546] krealloc_uaf+0x12c/0x520 [ 15.135636] kunit_try_run_case+0x170/0x3f0 [ 15.135769] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.135858] kthread+0x328/0x630 [ 15.135914] ret_from_fork+0x10/0x20 [ 15.136226] [ 15.136324] The buggy address belongs to the object at fff00000c5f4b800 [ 15.136324] which belongs to the cache kmalloc-256 of size 256 [ 15.136524] The buggy address is located 0 bytes inside of [ 15.136524] freed 256-byte region [fff00000c5f4b800, fff00000c5f4b900) [ 15.136696] [ 15.136826] The buggy address belongs to the physical page: [ 15.136916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f4a [ 15.136973] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.137471] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.137576] page_type: f5(slab) [ 15.137642] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.137772] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.137874] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.138246] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.138436] head: 0bfffe0000000001 ffffc1ffc317d281 00000000ffffffff 00000000ffffffff [ 15.138515] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.138713] page dumped because: kasan: bad access detected [ 15.138912] [ 15.138954] Memory state around the buggy address: [ 15.139050] fff00000c5f4b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.139147] fff00000c5f4b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.139304] >fff00000c5f4b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.139413] ^ [ 15.139443] fff00000c5f4b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.139500] fff00000c5f4b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.139829] ================================================================== [ 15.142452] ================================================================== [ 15.142858] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 15.142933] Read of size 1 at addr fff00000c5f4b800 by task kunit_try_catch/165 [ 15.142991] [ 15.143097] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.143317] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.143367] Hardware name: linux,dummy-virt (DT) [ 15.143414] Call trace: [ 15.143450] show_stack+0x20/0x38 (C) [ 15.143505] dump_stack_lvl+0x8c/0xd0 [ 15.143551] print_report+0x118/0x5d0 [ 15.143597] kasan_report+0xdc/0x128 [ 15.143788] __asan_report_load1_noabort+0x20/0x30 [ 15.144080] krealloc_uaf+0x4c8/0x520 [ 15.144202] kunit_try_run_case+0x170/0x3f0 [ 15.144254] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.144316] kthread+0x328/0x630 [ 15.144358] ret_from_fork+0x10/0x20 [ 15.144412] [ 15.144431] Allocated by task 165: [ 15.144458] kasan_save_stack+0x3c/0x68 [ 15.144498] kasan_save_track+0x20/0x40 [ 15.144543] kasan_save_alloc_info+0x40/0x58 [ 15.144591] __kasan_kmalloc+0xd4/0xd8 [ 15.144634] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.144672] krealloc_uaf+0xc8/0x520 [ 15.144705] kunit_try_run_case+0x170/0x3f0 [ 15.144741] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.144787] kthread+0x328/0x630 [ 15.144826] ret_from_fork+0x10/0x20 [ 15.144861] [ 15.144908] Freed by task 165: [ 15.145095] kasan_save_stack+0x3c/0x68 [ 15.145392] kasan_save_track+0x20/0x40 [ 15.145469] kasan_save_free_info+0x4c/0x78 [ 15.145510] __kasan_slab_free+0x6c/0x98 [ 15.145865] kfree+0x214/0x3c8 [ 15.145909] krealloc_uaf+0x12c/0x520 [ 15.145944] kunit_try_run_case+0x170/0x3f0 [ 15.145981] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.146023] kthread+0x328/0x630 [ 15.146054] ret_from_fork+0x10/0x20 [ 15.146089] [ 15.146108] The buggy address belongs to the object at fff00000c5f4b800 [ 15.146108] which belongs to the cache kmalloc-256 of size 256 [ 15.146164] The buggy address is located 0 bytes inside of [ 15.146164] freed 256-byte region [fff00000c5f4b800, fff00000c5f4b900) [ 15.146234] [ 15.146253] The buggy address belongs to the physical page: [ 15.146282] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f4a [ 15.146332] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.146376] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.146425] page_type: f5(slab) [ 15.146461] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.146509] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.146558] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 15.146604] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.146651] head: 0bfffe0000000001 ffffc1ffc317d281 00000000ffffffff 00000000ffffffff [ 15.146697] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 15.146736] page dumped because: kasan: bad access detected [ 15.146766] [ 15.146784] Memory state around the buggy address: [ 15.146814] fff00000c5f4b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.146857] fff00000c5f4b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.146897] >fff00000c5f4b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.146933] ^ [ 15.146960] fff00000c5f4b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.147000] fff00000c5f4b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.147037] ==================================================================
[ 12.897592] ================================================================== [ 12.898441] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x53c/0x5e0 [ 12.898964] Read of size 1 at addr ffff888100a9a400 by task kunit_try_catch/182 [ 12.899344] [ 12.899506] CPU: 1 UID: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.899555] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.899567] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.899589] Call Trace: [ 12.900138] <TASK> [ 12.900157] dump_stack_lvl+0x73/0xb0 [ 12.900193] print_report+0xd1/0x610 [ 12.900218] ? __virt_addr_valid+0x1db/0x2d0 [ 12.900241] ? krealloc_uaf+0x53c/0x5e0 [ 12.900263] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.900286] ? krealloc_uaf+0x53c/0x5e0 [ 12.900308] kasan_report+0x141/0x180 [ 12.900330] ? krealloc_uaf+0x53c/0x5e0 [ 12.900357] __asan_report_load1_noabort+0x18/0x20 [ 12.900382] krealloc_uaf+0x53c/0x5e0 [ 12.900403] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.900424] ? finish_task_switch.isra.0+0x153/0x700 [ 12.900447] ? __switch_to+0x47/0xf50 [ 12.900486] ? __schedule+0x10c6/0x2b60 [ 12.900510] ? __pfx_read_tsc+0x10/0x10 [ 12.900531] ? ktime_get_ts64+0x86/0x230 [ 12.900555] kunit_try_run_case+0x1a5/0x480 [ 12.900580] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.900603] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.900627] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.900651] ? __kthread_parkme+0x82/0x180 [ 12.900672] ? preempt_count_sub+0x50/0x80 [ 12.900695] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.900719] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.900743] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.900774] kthread+0x337/0x6f0 [ 12.900794] ? trace_preempt_on+0x20/0xc0 [ 12.900817] ? __pfx_kthread+0x10/0x10 [ 12.900838] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.900860] ? calculate_sigpending+0x7b/0xa0 [ 12.900884] ? __pfx_kthread+0x10/0x10 [ 12.900906] ret_from_fork+0x116/0x1d0 [ 12.900925] ? __pfx_kthread+0x10/0x10 [ 12.900945] ret_from_fork_asm+0x1a/0x30 [ 12.900976] </TASK> [ 12.900986] [ 12.910628] Allocated by task 182: [ 12.910900] kasan_save_stack+0x45/0x70 [ 12.911123] kasan_save_track+0x18/0x40 [ 12.911371] kasan_save_alloc_info+0x3b/0x50 [ 12.911598] __kasan_kmalloc+0xb7/0xc0 [ 12.911806] __kmalloc_cache_noprof+0x189/0x420 [ 12.912028] krealloc_uaf+0xbb/0x5e0 [ 12.912300] kunit_try_run_case+0x1a5/0x480 [ 12.912567] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.912800] kthread+0x337/0x6f0 [ 12.913003] ret_from_fork+0x116/0x1d0 [ 12.913369] ret_from_fork_asm+0x1a/0x30 [ 12.913671] [ 12.913796] Freed by task 182: [ 12.913985] kasan_save_stack+0x45/0x70 [ 12.914199] kasan_save_track+0x18/0x40 [ 12.914430] kasan_save_free_info+0x3f/0x60 [ 12.914657] __kasan_slab_free+0x56/0x70 [ 12.914958] kfree+0x222/0x3f0 [ 12.915230] krealloc_uaf+0x13d/0x5e0 [ 12.915402] kunit_try_run_case+0x1a5/0x480 [ 12.915609] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.915923] kthread+0x337/0x6f0 [ 12.916185] ret_from_fork+0x116/0x1d0 [ 12.916379] ret_from_fork_asm+0x1a/0x30 [ 12.916600] [ 12.916697] The buggy address belongs to the object at ffff888100a9a400 [ 12.916697] which belongs to the cache kmalloc-256 of size 256 [ 12.917258] The buggy address is located 0 bytes inside of [ 12.917258] freed 256-byte region [ffff888100a9a400, ffff888100a9a500) [ 12.917852] [ 12.918017] The buggy address belongs to the physical page: [ 12.918287] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a9a [ 12.918652] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.918889] flags: 0x200000000000040(head|node=0|zone=2) [ 12.919069] page_type: f5(slab) [ 12.919195] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.920186] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.920601] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.921225] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.921483] head: 0200000000000001 ffffea000402a681 00000000ffffffff 00000000ffffffff [ 12.921917] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.922432] page dumped because: kasan: bad access detected [ 12.922710] [ 12.922829] Memory state around the buggy address: [ 12.923057] ffff888100a9a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.923330] ffff888100a9a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.923632] >ffff888100a9a400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.923989] ^ [ 12.924406] ffff888100a9a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.924739] ffff888100a9a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.925263] ================================================================== [ 12.870216] ================================================================== [ 12.870826] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x1b8/0x5e0 [ 12.871195] Read of size 1 at addr ffff888100a9a400 by task kunit_try_catch/182 [ 12.871563] [ 12.871687] CPU: 1 UID: 0 PID: 182 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.871757] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.871769] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.871793] Call Trace: [ 12.871822] <TASK> [ 12.871839] dump_stack_lvl+0x73/0xb0 [ 12.871890] print_report+0xd1/0x610 [ 12.871914] ? __virt_addr_valid+0x1db/0x2d0 [ 12.871939] ? krealloc_uaf+0x1b8/0x5e0 [ 12.871960] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.871983] ? krealloc_uaf+0x1b8/0x5e0 [ 12.872004] kasan_report+0x141/0x180 [ 12.872026] ? krealloc_uaf+0x1b8/0x5e0 [ 12.872051] ? krealloc_uaf+0x1b8/0x5e0 [ 12.872072] __kasan_check_byte+0x3d/0x50 [ 12.872094] krealloc_noprof+0x3f/0x340 [ 12.872114] ? stack_depot_save_flags+0x48b/0x840 [ 12.872141] krealloc_uaf+0x1b8/0x5e0 [ 12.872175] ? __pfx_krealloc_uaf+0x10/0x10 [ 12.872196] ? finish_task_switch.isra.0+0x153/0x700 [ 12.872220] ? __switch_to+0x47/0xf50 [ 12.872246] ? __schedule+0x10c6/0x2b60 [ 12.872341] ? __pfx_read_tsc+0x10/0x10 [ 12.872386] ? ktime_get_ts64+0x86/0x230 [ 12.872413] kunit_try_run_case+0x1a5/0x480 [ 12.872440] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.872463] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.872499] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.872523] ? __kthread_parkme+0x82/0x180 [ 12.872546] ? preempt_count_sub+0x50/0x80 [ 12.872569] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.872595] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.872620] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.872644] kthread+0x337/0x6f0 [ 12.872664] ? trace_preempt_on+0x20/0xc0 [ 12.872688] ? __pfx_kthread+0x10/0x10 [ 12.872709] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.872732] ? calculate_sigpending+0x7b/0xa0 [ 12.872756] ? __pfx_kthread+0x10/0x10 [ 12.872778] ret_from_fork+0x116/0x1d0 [ 12.872799] ? __pfx_kthread+0x10/0x10 [ 12.872820] ret_from_fork_asm+0x1a/0x30 [ 12.872852] </TASK> [ 12.872862] [ 12.881978] Allocated by task 182: [ 12.882131] kasan_save_stack+0x45/0x70 [ 12.882282] kasan_save_track+0x18/0x40 [ 12.882520] kasan_save_alloc_info+0x3b/0x50 [ 12.882772] __kasan_kmalloc+0xb7/0xc0 [ 12.882990] __kmalloc_cache_noprof+0x189/0x420 [ 12.883357] krealloc_uaf+0xbb/0x5e0 [ 12.883595] kunit_try_run_case+0x1a5/0x480 [ 12.883837] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.884236] kthread+0x337/0x6f0 [ 12.884417] ret_from_fork+0x116/0x1d0 [ 12.884590] ret_from_fork_asm+0x1a/0x30 [ 12.884735] [ 12.884909] Freed by task 182: [ 12.885153] kasan_save_stack+0x45/0x70 [ 12.885696] kasan_save_track+0x18/0x40 [ 12.885983] kasan_save_free_info+0x3f/0x60 [ 12.886265] __kasan_slab_free+0x56/0x70 [ 12.886505] kfree+0x222/0x3f0 [ 12.886678] krealloc_uaf+0x13d/0x5e0 [ 12.886870] kunit_try_run_case+0x1a5/0x480 [ 12.887080] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.887286] kthread+0x337/0x6f0 [ 12.887411] ret_from_fork+0x116/0x1d0 [ 12.887672] ret_from_fork_asm+0x1a/0x30 [ 12.888093] [ 12.888232] The buggy address belongs to the object at ffff888100a9a400 [ 12.888232] which belongs to the cache kmalloc-256 of size 256 [ 12.888901] The buggy address is located 0 bytes inside of [ 12.888901] freed 256-byte region [ffff888100a9a400, ffff888100a9a500) [ 12.889344] [ 12.889501] The buggy address belongs to the physical page: [ 12.889814] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a9a [ 12.890309] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.890642] flags: 0x200000000000040(head|node=0|zone=2) [ 12.890890] page_type: f5(slab) [ 12.891017] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.891256] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.891694] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 12.892524] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.892897] head: 0200000000000001 ffffea000402a681 00000000ffffffff 00000000ffffffff [ 12.893515] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 12.893900] page dumped because: kasan: bad access detected [ 12.894293] [ 12.894370] Memory state around the buggy address: [ 12.894547] ffff888100a9a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.894837] ffff888100a9a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.895357] >ffff888100a9a400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.895725] ^ [ 12.895852] ffff888100a9a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.896336] ffff888100a9a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.896823] ==================================================================