Hay
Sign in
Date
April 20, 2025, 11:09 p.m.

Environment
qemu-arm64
qemu-x86_64
rk3399-rock-pi-4b 

[   22.793489] ==================================================================
[   22.793850] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   22.794697] Read of size 1 at addr fff00000c76c8000 by task kunit_try_catch/150
[   22.794904] 
[   22.795201] CPU: 0 UID: 0 PID: 150 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc3 #1 PREEMPT 
[   22.795948] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.796192] Hardware name: linux,dummy-virt (DT)
[   22.796240] Call trace:
[   22.796269]  show_stack+0x20/0x38 (C)
[   22.796347]  dump_stack_lvl+0x8c/0xd0
[   22.796469]  print_report+0x118/0x608
[   22.796790]  kasan_report+0xdc/0x128
[   22.796910]  __asan_report_load1_noabort+0x20/0x30
[   22.797050]  kmalloc_large_uaf+0x2cc/0x2f8
[   22.797211]  kunit_try_run_case+0x170/0x3f0
[   22.797381]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   22.797560]  kthread+0x328/0x630
[   22.797670]  ret_from_fork+0x10/0x20
[   22.797778] 
[   22.797825] The buggy address belongs to the physical page:
[   22.797892] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c8
[   22.798036] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   22.798292] raw: 0bfffe0000000000 ffffc1ffc31db308 fff00000da459d80 0000000000000000
[   22.798426] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   22.798698] page dumped because: kasan: bad access detected
[   22.798785] 
[   22.798838] Memory state around the buggy address:
[   22.798954]  fff00000c76c7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.799268]  fff00000c76c7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.799585] >fff00000c76c8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.799725]                    ^
[   22.799803]  fff00000c76c8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.800038]  fff00000c76c8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.800162] ==================================================================
Metadata Full log Test run details 

[   11.091585] ==================================================================
[   11.092886] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f1/0x340
[   11.093385] Read of size 1 at addr ffff888102c54000 by task kunit_try_catch/168
[   11.093659] 
[   11.093986] CPU: 1 UID: 0 PID: 168 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc3 #1 PREEMPT(voluntary) 
[   11.094033] Tainted: [B]=BAD_PAGE, [N]=TEST
[   11.094118] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.094154] Call Trace:
[   11.094167]  <TASK>
[   11.094181]  dump_stack_lvl+0x73/0xb0
[   11.094206]  print_report+0xd1/0x650
[   11.094228]  ? __virt_addr_valid+0x1db/0x2d0
[   11.094250]  ? kmalloc_large_uaf+0x2f1/0x340
[   11.094270]  ? kasan_addr_to_slab+0x11/0xa0
[   11.094291]  ? kmalloc_large_uaf+0x2f1/0x340
[   11.094312]  kasan_report+0x141/0x180
[   11.094345]  ? kmalloc_large_uaf+0x2f1/0x340
[   11.094371]  __asan_report_load1_noabort+0x18/0x20
[   11.094568]  kmalloc_large_uaf+0x2f1/0x340
[   11.094595]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   11.094617]  ? __schedule+0x10cc/0x2b30
[   11.094641]  ? __pfx_read_tsc+0x10/0x10
[   11.094660]  ? ktime_get_ts64+0x86/0x230
[   11.094685]  kunit_try_run_case+0x1a5/0x480
[   11.094708]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.094728]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   11.094751]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   11.094774]  ? __kthread_parkme+0x82/0x180
[   11.094795]  ? preempt_count_sub+0x50/0x80
[   11.094819]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.094841]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.094863]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   11.094885]  kthread+0x337/0x6f0
[   11.094905]  ? trace_preempt_on+0x20/0xc0
[   11.094929]  ? __pfx_kthread+0x10/0x10
[   11.094951]  ? _raw_spin_unlock_irq+0x47/0x80
[   11.094973]  ? calculate_sigpending+0x7b/0xa0
[   11.094994]  ? __pfx_kthread+0x10/0x10
[   11.095016]  ret_from_fork+0x41/0x80
[   11.095036]  ? __pfx_kthread+0x10/0x10
[   11.095057]  ret_from_fork_asm+0x1a/0x30
[   11.095088]  </TASK>
[   11.095099] 
[   11.103119] The buggy address belongs to the physical page:
[   11.103391] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c54
[   11.103871] flags: 0x200000000000000(node=0|zone=2)
[   11.104141] raw: 0200000000000000 ffffea00040b1608 ffff88815b139a80 0000000000000000
[   11.104510] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   11.104736] page dumped because: kasan: bad access detected
[   11.104983] 
[   11.105075] Memory state around the buggy address:
[   11.105514]  ffff888102c53f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   11.105802]  ffff888102c53f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   11.106142] >ffff888102c54000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.106554]                    ^
[   11.106720]  ffff888102c54080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.107023]  ffff888102c54100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.107386] ==================================================================
Metadata Full log Test run details 

[   20.879493] ==================================================================
[   20.880569] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   20.881191] Read of size 1 at addr ffff00000def4000 by task kunit_try_catch/202
[   20.881855] 
[   20.882014] CPU: 2 UID: 0 PID: 202 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc3 #1 PREEMPT 
[   20.882052] Tainted: [B]=BAD_PAGE, [N]=TEST
[   20.882062] Hardware name: Radxa ROCK Pi 4B (DT)
[   20.882075] Call trace:
[   20.882084]  show_stack+0x20/0x38 (C)
[   20.882110]  dump_stack_lvl+0x8c/0xd0
[   20.882132]  print_report+0x118/0x608
[   20.882153]  kasan_report+0xdc/0x128
[   20.882173]  __asan_report_load1_noabort+0x20/0x30
[   20.882197]  kmalloc_large_uaf+0x2cc/0x2f8
[   20.882221]  kunit_try_run_case+0x170/0x3f0
[   20.882246]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.882274]  kthread+0x328/0x630
[   20.882299]  ret_from_fork+0x10/0x20
[   20.882323] 
[   20.887860] The buggy address belongs to the physical page:
[   20.888366] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xdef4
[   20.889077] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff)
[   20.889685] raw: 03fffe0000000000 fffffdffc037be08 ffff0000d171c740 0000000000000000
[   20.890389] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   20.891086] page dumped because: kasan: bad access detected
[   20.891591] 
[   20.891737] Memory state around the buggy address:
[   20.892176]  ffff00000def3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.892831]  ffff00000def3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.893485] >ffff00000def4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   20.894136]                    ^
[   20.894438]  ffff00000def4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   20.895091]  ffff00000def4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   20.895743] ==================================================================
Metadata Full log Test run details