Hay
Sign in
Date
July 20, 2025, 11:12 a.m.

Environment
qemu-arm64
qemu-x86_64 

[   15.220452] ==================================================================
[   15.220507] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   15.220600] Read of size 1 at addr fff00000c7790000 by task kunit_try_catch/154
[   15.222673] 
[   15.222709] CPU: 0 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT 
[   15.222791] Tainted: [B]=BAD_PAGE, [N]=TEST
[   15.222818] Hardware name: linux,dummy-virt (DT)
[   15.222847] Call trace:
[   15.222869]  show_stack+0x20/0x38 (C)
[   15.222916]  dump_stack_lvl+0x8c/0xd0
[   15.222960]  print_report+0x118/0x5d0
[   15.223013]  kasan_report+0xdc/0x128
[   15.223057]  __asan_report_load1_noabort+0x20/0x30
[   15.223106]  page_alloc_uaf+0x328/0x350
[   15.223149]  kunit_try_run_case+0x170/0x3f0
[   15.223207]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.223258]  kthread+0x328/0x630
[   15.223299]  ret_from_fork+0x10/0x20
[   15.223344] 
[   15.223363] The buggy address belongs to the physical page:
[   15.223392] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107790
[   15.223441] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   15.223487] page_type: f0(buddy)
[   15.223524] raw: 0bfffe0000000000 fff00000ff6160a0 fff00000ff6160a0 0000000000000000
[   15.223571] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   15.223610] page dumped because: kasan: bad access detected
[   15.223639] 
[   15.223655] Memory state around the buggy address:
[   15.223695]  fff00000c778ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.223735]  fff00000c778ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.223776] >fff00000c7790000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.223812]                    ^
[   15.223838]  fff00000c7790080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.223878]  fff00000c7790100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   15.223914] ==================================================================
Metadata Full log Test run details 

[   11.841730] ==================================================================
[   11.842264] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   11.842511] Read of size 1 at addr ffff888103a80000 by task kunit_try_catch/171
[   11.843027] 
[   11.843158] CPU: 0 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT(voluntary) 
[   11.843201] Tainted: [B]=BAD_PAGE, [N]=TEST
[   11.843213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.843234] Call Trace:
[   11.843248]  <TASK>
[   11.843264]  dump_stack_lvl+0x73/0xb0
[   11.843293]  print_report+0xd1/0x610
[   11.843314]  ? __virt_addr_valid+0x1db/0x2d0
[   11.843335]  ? page_alloc_uaf+0x356/0x3d0
[   11.843431]  ? kasan_addr_to_slab+0x11/0xa0
[   11.843471]  ? page_alloc_uaf+0x356/0x3d0
[   11.843493]  kasan_report+0x141/0x180
[   11.843529]  ? page_alloc_uaf+0x356/0x3d0
[   11.843555]  __asan_report_load1_noabort+0x18/0x20
[   11.843577]  page_alloc_uaf+0x356/0x3d0
[   11.843597]  ? __pfx_page_alloc_uaf+0x10/0x10
[   11.843618]  ? __schedule+0x10cc/0x2b60
[   11.843639]  ? __pfx_read_tsc+0x10/0x10
[   11.843659]  ? ktime_get_ts64+0x86/0x230
[   11.843683]  kunit_try_run_case+0x1a5/0x480
[   11.843706]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.843727]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   11.843748]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   11.843770]  ? __kthread_parkme+0x82/0x180
[   11.843788]  ? preempt_count_sub+0x50/0x80
[   11.843811]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.843833]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.843855]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   11.843876]  kthread+0x337/0x6f0
[   11.843895]  ? trace_preempt_on+0x20/0xc0
[   11.843928]  ? __pfx_kthread+0x10/0x10
[   11.843947]  ? _raw_spin_unlock_irq+0x47/0x80
[   11.843967]  ? calculate_sigpending+0x7b/0xa0
[   11.843988]  ? __pfx_kthread+0x10/0x10
[   11.844009]  ret_from_fork+0x116/0x1d0
[   11.844027]  ? __pfx_kthread+0x10/0x10
[   11.844046]  ret_from_fork_asm+0x1a/0x30
[   11.844075]  </TASK>
[   11.844084] 
[   11.852354] The buggy address belongs to the physical page:
[   11.852539] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a80
[   11.852997] flags: 0x200000000000000(node=0|zone=2)
[   11.853231] page_type: f0(buddy)
[   11.853476] raw: 0200000000000000 ffff88817fffb538 ffff88817fffb538 0000000000000000
[   11.853973] raw: 0000000000000000 0000000000000007 00000000f0000000 0000000000000000
[   11.854293] page dumped because: kasan: bad access detected
[   11.854664] 
[   11.854893] Memory state around the buggy address:
[   11.855131]  ffff888103a7ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.855500]  ffff888103a7ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.855838] >ffff888103a80000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.856447]                    ^
[   11.856568]  ffff888103a80080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.857001]  ffff888103a80100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.857288] ==================================================================
Metadata Full log Test run details