Hay
Sign in
Date
July 18, 2025, 11:11 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   15.157103] ==================================================================
[   15.157413] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   15.157473] Read of size 1 at addr fff00000c7790000 by task kunit_try_catch/154
[   15.157541] 
[   15.157574] CPU: 1 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT 
[   15.158011] Tainted: [B]=BAD_PAGE, [N]=TEST
[   15.158066] Hardware name: linux,dummy-virt (DT)
[   15.158456] Call trace:
[   15.158551]  show_stack+0x20/0x38 (C)
[   15.159142]  dump_stack_lvl+0x8c/0xd0
[   15.159587]  print_report+0x118/0x5d0
[   15.159969]  kasan_report+0xdc/0x128
[   15.160527]  __asan_report_load1_noabort+0x20/0x30
[   15.160609]  page_alloc_uaf+0x328/0x350
[   15.160982]  kunit_try_run_case+0x170/0x3f0
[   15.161495]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.161685]  kthread+0x328/0x630
[   15.161734]  ret_from_fork+0x10/0x20
[   15.162071] 
[   15.162221] The buggy address belongs to the physical page:
[   15.162537] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107790
[   15.162827] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   15.162888] page_type: f0(buddy)
[   15.162928] raw: 0bfffe0000000000 fff00000ff6160a0 fff00000ff6160a0 0000000000000000
[   15.163181] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   15.163246] page dumped because: kasan: bad access detected
[   15.163278] 
[   15.163296] Memory state around the buggy address:
[   15.163351]  fff00000c778ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.163399]  fff00000c778ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.163458] >fff00000c7790000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.163501]                    ^
[   15.163529]  fff00000c7790080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.163579]  fff00000c7790100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.163616] ==================================================================
Metadata Full log Test run details 

[   11.673140] ==================================================================
[   11.674550] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   11.675384] Read of size 1 at addr ffff888103940000 by task kunit_try_catch/173
[   11.675887] 
[   11.676223] CPU: 1 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT(voluntary) 
[   11.676285] Tainted: [B]=BAD_PAGE, [N]=TEST
[   11.676296] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.676316] Call Trace:
[   11.676330]  <TASK>
[   11.676346]  dump_stack_lvl+0x73/0xb0
[   11.676375]  print_report+0xd1/0x610
[   11.676396]  ? __virt_addr_valid+0x1db/0x2d0
[   11.676419]  ? page_alloc_uaf+0x356/0x3d0
[   11.676439]  ? kasan_addr_to_slab+0x11/0xa0
[   11.676510]  ? page_alloc_uaf+0x356/0x3d0
[   11.676532]  kasan_report+0x141/0x180
[   11.676553]  ? page_alloc_uaf+0x356/0x3d0
[   11.676579]  __asan_report_load1_noabort+0x18/0x20
[   11.676602]  page_alloc_uaf+0x356/0x3d0
[   11.676623]  ? __pfx_page_alloc_uaf+0x10/0x10
[   11.676645]  ? __schedule+0x10cc/0x2b60
[   11.676667]  ? __pfx_read_tsc+0x10/0x10
[   11.676687]  ? ktime_get_ts64+0x86/0x230
[   11.676710]  kunit_try_run_case+0x1a5/0x480
[   11.676734]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.676756]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   11.676779]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   11.676801]  ? __kthread_parkme+0x82/0x180
[   11.676821]  ? preempt_count_sub+0x50/0x80
[   11.676844]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.676867]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.676890]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   11.676913]  kthread+0x337/0x6f0
[   11.676939]  ? trace_preempt_on+0x20/0xc0
[   11.676961]  ? __pfx_kthread+0x10/0x10
[   11.676980]  ? _raw_spin_unlock_irq+0x47/0x80
[   11.677001]  ? calculate_sigpending+0x7b/0xa0
[   11.677071]  ? __pfx_kthread+0x10/0x10
[   11.677091]  ret_from_fork+0x116/0x1d0
[   11.677109]  ? __pfx_kthread+0x10/0x10
[   11.677128]  ret_from_fork_asm+0x1a/0x30
[   11.677158]  </TASK>
[   11.677168] 
[   11.688446] The buggy address belongs to the physical page:
[   11.688633] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103940
[   11.688881] flags: 0x200000000000000(node=0|zone=2)
[   11.689053] page_type: f0(buddy)
[   11.689175] raw: 0200000000000000 ffff88817fffb4f0 ffff88817fffb4f0 0000000000000000
[   11.690313] raw: 0000000000000000 0000000000000006 00000000f0000000 0000000000000000
[   11.691364] page dumped because: kasan: bad access detected
[   11.692196] 
[   11.692553] Memory state around the buggy address:
[   11.693306]  ffff88810393ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.694363]  ffff88810393ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.695451] >ffff888103940000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.695963]                    ^
[   11.696557]  ffff888103940080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.697478]  ffff888103940100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.697971] ==================================================================
Metadata Full log Test run details