Hay
Sign in
Date
July 10, 2025, 11:10 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   15.762280] ==================================================================
[   15.762355] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   15.762423] Read of size 1 at addr fff00000c7840000 by task kunit_try_catch/154
[   15.762471] 
[   15.762508] CPU: 1 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT 
[   15.762591] Tainted: [B]=BAD_PAGE, [N]=TEST
[   15.762616] Hardware name: linux,dummy-virt (DT)
[   15.762647] Call trace:
[   15.763039]  show_stack+0x20/0x38 (C)
[   15.763133]  dump_stack_lvl+0x8c/0xd0
[   15.763276]  print_report+0x118/0x608
[   15.763364]  kasan_report+0xdc/0x128
[   15.763435]  __asan_report_load1_noabort+0x20/0x30
[   15.763540]  page_alloc_uaf+0x328/0x350
[   15.763627]  kunit_try_run_case+0x170/0x3f0
[   15.763691]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.763778]  kthread+0x328/0x630
[   15.763845]  ret_from_fork+0x10/0x20
[   15.763909] 
[   15.763949] The buggy address belongs to the physical page:
[   15.763981] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107840
[   15.764275] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   15.764331] page_type: f0(buddy)
[   15.764384] raw: 0bfffe0000000000 fff00000ff616170 fff00000ff616170 0000000000000000
[   15.764432] raw: 0000000000000000 0000000000000006 00000000f0000000 0000000000000000
[   15.764477] page dumped because: kasan: bad access detected
[   15.764513] 
[   15.764539] Memory state around the buggy address:
[   15.764572]  fff00000c783ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.764614]  fff00000c783ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.764663] >fff00000c7840000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.764699]                    ^
[   15.764726]  fff00000c7840080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.764766]  fff00000c7840100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.764802] ==================================================================
Metadata Full log Test run details 

[   12.323864] ==================================================================
[   12.324578] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   12.324873] Read of size 1 at addr ffff888103910000 by task kunit_try_catch/171
[   12.325195] 
[   12.325312] CPU: 1 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   12.325353] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.325375] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.325394] Call Trace:
[   12.325405]  <TASK>
[   12.325419]  dump_stack_lvl+0x73/0xb0
[   12.325542]  print_report+0xd1/0x650
[   12.325564]  ? __virt_addr_valid+0x1db/0x2d0
[   12.325586]  ? page_alloc_uaf+0x356/0x3d0
[   12.325607]  ? kasan_addr_to_slab+0x11/0xa0
[   12.325627]  ? page_alloc_uaf+0x356/0x3d0
[   12.325797]  kasan_report+0x141/0x180
[   12.325826]  ? page_alloc_uaf+0x356/0x3d0
[   12.325852]  __asan_report_load1_noabort+0x18/0x20
[   12.325876]  page_alloc_uaf+0x356/0x3d0
[   12.325897]  ? __pfx_page_alloc_uaf+0x10/0x10
[   12.325920]  ? __schedule+0x10cc/0x2b60
[   12.325942]  ? __pfx_read_tsc+0x10/0x10
[   12.325962]  ? ktime_get_ts64+0x86/0x230
[   12.325998]  kunit_try_run_case+0x1a5/0x480
[   12.326022]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.326056]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.326080]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.326103]  ? __kthread_parkme+0x82/0x180
[   12.326123]  ? preempt_count_sub+0x50/0x80
[   12.326146]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.326169]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.326193]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.326218]  kthread+0x337/0x6f0
[   12.326236]  ? trace_preempt_on+0x20/0xc0
[   12.326259]  ? __pfx_kthread+0x10/0x10
[   12.326279]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.326300]  ? calculate_sigpending+0x7b/0xa0
[   12.326324]  ? __pfx_kthread+0x10/0x10
[   12.326345]  ret_from_fork+0x116/0x1d0
[   12.326505]  ? __pfx_kthread+0x10/0x10
[   12.326527]  ret_from_fork_asm+0x1a/0x30
[   12.326557]  </TASK>
[   12.326566] 
[   12.334685] The buggy address belongs to the physical page:
[   12.334941] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103910
[   12.335281] flags: 0x200000000000000(node=0|zone=2)
[   12.335559] page_type: f0(buddy)
[   12.335682] raw: 0200000000000000 ffff88817fffc460 ffff88817fffc460 0000000000000000
[   12.336164] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   12.336619] page dumped because: kasan: bad access detected
[   12.336853] 
[   12.336947] Memory state around the buggy address:
[   12.337190]  ffff88810390ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.337593]  ffff88810390ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.337888] >ffff888103910000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.338200]                    ^
[   12.338351]  ffff888103910080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.338870]  ffff888103910100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.339089] ==================================================================
Metadata Full log Test run details