Hay
Sign in
Date
July 5, 2025, 11:11 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   17.909248] ==================================================================
[   17.909305] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   17.909380] Read of size 1 at addr fff00000c7860000 by task kunit_try_catch/154
[   17.909429] 
[   17.909483] CPU: 0 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT 
[   17.909692] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.909726] Hardware name: linux,dummy-virt (DT)
[   17.909801] Call trace:
[   17.909830]  show_stack+0x20/0x38 (C)
[   17.909933]  dump_stack_lvl+0x8c/0xd0
[   17.909988]  print_report+0x118/0x608
[   17.910034]  kasan_report+0xdc/0x128
[   17.910077]  __asan_report_load1_noabort+0x20/0x30
[   17.910127]  page_alloc_uaf+0x328/0x350
[   17.910184]  kunit_try_run_case+0x170/0x3f0
[   17.910306]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.910361]  kthread+0x328/0x630
[   17.910481]  ret_from_fork+0x10/0x20
[   17.910602] 
[   17.910651] The buggy address belongs to the physical page:
[   17.910698] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107860
[   17.910775] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.910832] page_type: f0(buddy)
[   17.910877] raw: 0bfffe0000000000 fff00000ff616108 fff00000ff616108 0000000000000000
[   17.910925] raw: 0000000000000000 0000000000000005 00000000f0000000 0000000000000000
[   17.910963] page dumped because: kasan: bad access detected
[   17.910998] 
[   17.911015] Memory state around the buggy address:
[   17.911195]  fff00000c785ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.911249]  fff00000c785ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.911296] >fff00000c7860000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.911365]                    ^
[   17.911413]  fff00000c7860080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.911453]  fff00000c7860100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.911507] ==================================================================
Metadata Full log Test run details 

[   13.028856] ==================================================================
[   13.029666] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   13.030024] Read of size 1 at addr ffff8881039c0000 by task kunit_try_catch/172
[   13.030651] 
[   13.031026] CPU: 1 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT(voluntary) 
[   13.031186] Tainted: [B]=BAD_PAGE, [N]=TEST
[   13.031202] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   13.031227] Call Trace:
[   13.031243]  <TASK>
[   13.031265]  dump_stack_lvl+0x73/0xb0
[   13.031305]  print_report+0xd1/0x650
[   13.031332]  ? __virt_addr_valid+0x1db/0x2d0
[   13.031360]  ? page_alloc_uaf+0x356/0x3d0
[   13.031386]  ? kasan_addr_to_slab+0x11/0xa0
[   13.031409]  ? page_alloc_uaf+0x356/0x3d0
[   13.031433]  kasan_report+0x141/0x180
[   13.031458]  ? page_alloc_uaf+0x356/0x3d0
[   13.031488]  __asan_report_load1_noabort+0x18/0x20
[   13.031516]  page_alloc_uaf+0x356/0x3d0
[   13.031540]  ? __pfx_page_alloc_uaf+0x10/0x10
[   13.031565]  ? __schedule+0x10cc/0x2b60
[   13.031591]  ? __pfx_read_tsc+0x10/0x10
[   13.031615]  ? ktime_get_ts64+0x86/0x230
[   13.031642]  kunit_try_run_case+0x1a5/0x480
[   13.031671]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.031695]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   13.031722]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   13.031748]  ? __kthread_parkme+0x82/0x180
[   13.031773]  ? preempt_count_sub+0x50/0x80
[   13.031815]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.031841]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.031866]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   13.031892]  kthread+0x337/0x6f0
[   13.031914]  ? trace_preempt_on+0x20/0xc0
[   13.031941]  ? __pfx_kthread+0x10/0x10
[   13.031964]  ? _raw_spin_unlock_irq+0x47/0x80
[   13.031988]  ? calculate_sigpending+0x7b/0xa0
[   13.032016]  ? __pfx_kthread+0x10/0x10
[   13.032040]  ret_from_fork+0x116/0x1d0
[   13.032061]  ? __pfx_kthread+0x10/0x10
[   13.032095]  ret_from_fork_asm+0x1a/0x30
[   13.032131]  </TASK>
[   13.032145] 
[   13.046075] The buggy address belongs to the physical page:
[   13.046726] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039c0
[   13.047812] flags: 0x200000000000000(node=0|zone=2)
[   13.048425] page_type: f0(buddy)
[   13.048577] raw: 0200000000000000 ffff88817fffb4f0 ffff88817fffb4f0 0000000000000000
[   13.048847] raw: 0000000000000000 0000000000000006 00000000f0000000 0000000000000000
[   13.049110] page dumped because: kasan: bad access detected
[   13.049809] 
[   13.050024] Memory state around the buggy address:
[   13.050739]  ffff8881039bff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.051656]  ffff8881039bff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.052702] >ffff8881039c0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.053416]                    ^
[   13.053561]  ffff8881039c0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.053822]  ffff8881039c0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.054068] ==================================================================
Metadata Full log Test run details