Hay
Sign in
Date
July 20, 2025, 11:12 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   16.292540] ==================================================================
[   16.292612] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   16.293122] Read of size 1 at addr fff00000c65a0000 by task kunit_try_catch/148
[   16.293584] 
[   16.293716] CPU: 1 UID: 0 PID: 148 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc7 #1 PREEMPT 
[   16.294490] Tainted: [B]=BAD_PAGE, [N]=TEST
[   16.295246] Hardware name: linux,dummy-virt (DT)
[   16.295284] Call trace:
[   16.295308]  show_stack+0x20/0x38 (C)
[   16.295361]  dump_stack_lvl+0x8c/0xd0
[   16.295990]  print_report+0x118/0x5d0
[   16.296650]  kasan_report+0xdc/0x128
[   16.296753]  __asan_report_load1_noabort+0x20/0x30
[   16.297293]  kmalloc_large_uaf+0x2cc/0x2f8
[   16.297578]  kunit_try_run_case+0x170/0x3f0
[   16.297853]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.298113]  kthread+0x328/0x630
[   16.298698]  ret_from_fork+0x10/0x20
[   16.298797] 
[   16.298859] The buggy address belongs to the physical page:
[   16.299020] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065a0
[   16.299584] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   16.300087] raw: 0bfffe0000000000 fff00000da479c40 fff00000da479c40 0000000000000000
[   16.300367] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   16.300672] page dumped because: kasan: bad access detected
[   16.300709] 
[   16.300774] Memory state around the buggy address:
[   16.300840]  fff00000c659ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.301294]  fff00000c659ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.301618] >fff00000c65a0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.301661]                    ^
[   16.302376]  fff00000c65a0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.302428]  fff00000c65a0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.302503] ==================================================================
Metadata Full log Test run details 

[   16.383137] ==================================================================
[   16.383225] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   16.383281] Read of size 1 at addr fff00000c5fd8000 by task kunit_try_catch/148
[   16.383329] 
[   16.383356] CPU: 1 UID: 0 PID: 148 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc7 #1 PREEMPT 
[   16.383436] Tainted: [B]=BAD_PAGE, [N]=TEST
[   16.383461] Hardware name: linux,dummy-virt (DT)
[   16.383491] Call trace:
[   16.383513]  show_stack+0x20/0x38 (C)
[   16.383559]  dump_stack_lvl+0x8c/0xd0
[   16.383605]  print_report+0x118/0x5d0
[   16.383666]  kasan_report+0xdc/0x128
[   16.383744]  __asan_report_load1_noabort+0x20/0x30
[   16.383801]  kmalloc_large_uaf+0x2cc/0x2f8
[   16.383865]  kunit_try_run_case+0x170/0x3f0
[   16.383940]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.384002]  kthread+0x328/0x630
[   16.384044]  ret_from_fork+0x10/0x20
[   16.384090] 
[   16.384109] The buggy address belongs to the physical page:
[   16.384163] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105fd8
[   16.384215] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   16.384399] raw: 0bfffe0000000000 fff00000da479c40 fff00000da479c40 0000000000000000
[   16.384448] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   16.384586] page dumped because: kasan: bad access detected
[   16.384644] 
[   16.384662] Memory state around the buggy address:
[   16.384710]  fff00000c5fd7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.384752]  fff00000c5fd7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.384799] >fff00000c5fd8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.384873]                    ^
[   16.384901]  fff00000c5fd8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.384954]  fff00000c5fd8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.385006] ==================================================================
Metadata Full log Test run details 

[   12.200444] ==================================================================
[   12.201509] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f1/0x340
[   12.201815] Read of size 1 at addr ffff88810389c000 by task kunit_try_catch/166
[   12.202278] 
[   12.202382] CPU: 0 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc7 #1 PREEMPT(voluntary) 
[   12.202441] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.202453] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.202473] Call Trace:
[   12.202488]  <TASK>
[   12.202505]  dump_stack_lvl+0x73/0xb0
[   12.202536]  print_report+0xd1/0x610
[   12.202560]  ? __virt_addr_valid+0x1db/0x2d0
[   12.202582]  ? kmalloc_large_uaf+0x2f1/0x340
[   12.202603]  ? kasan_addr_to_slab+0x11/0xa0
[   12.202623]  ? kmalloc_large_uaf+0x2f1/0x340
[   12.202644]  kasan_report+0x141/0x180
[   12.202666]  ? kmalloc_large_uaf+0x2f1/0x340
[   12.202693]  __asan_report_load1_noabort+0x18/0x20
[   12.202716]  kmalloc_large_uaf+0x2f1/0x340
[   12.202737]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   12.202758]  ? __schedule+0x10c6/0x2b60
[   12.202781]  ? __pfx_read_tsc+0x10/0x10
[   12.202803]  ? ktime_get_ts64+0x86/0x230
[   12.202828]  kunit_try_run_case+0x1a5/0x480
[   12.202853]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.202875]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.202898]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.202921]  ? __kthread_parkme+0x82/0x180
[   12.202942]  ? preempt_count_sub+0x50/0x80
[   12.202967]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.202991]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.203014]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.203097]  kthread+0x337/0x6f0
[   12.203117]  ? trace_preempt_on+0x20/0xc0
[   12.203142]  ? __pfx_kthread+0x10/0x10
[   12.203162]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.203184]  ? calculate_sigpending+0x7b/0xa0
[   12.203207]  ? __pfx_kthread+0x10/0x10
[   12.203230]  ret_from_fork+0x116/0x1d0
[   12.203248]  ? __pfx_kthread+0x10/0x10
[   12.203268]  ret_from_fork_asm+0x1a/0x30
[   12.203301]  </TASK>
[   12.203312] 
[   12.210955] The buggy address belongs to the physical page:
[   12.211370] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10389c
[   12.211948] flags: 0x200000000000000(node=0|zone=2)
[   12.212131] raw: 0200000000000000 ffffea00040e2808 ffff88815b039f80 0000000000000000
[   12.212457] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   12.213213] page dumped because: kasan: bad access detected
[   12.213462] 
[   12.213535] Memory state around the buggy address:
[   12.213694]  ffff88810389bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.214124]  ffff88810389bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.214503] >ffff88810389c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.214752]                    ^
[   12.214871]  ffff88810389c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.215099]  ffff88810389c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.216430] ==================================================================
Metadata Full log Test run details 

[   12.295206] ==================================================================
[   12.295718] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f1/0x340
[   12.296622] Read of size 1 at addr ffff8881028d8000 by task kunit_try_catch/165
[   12.297546] 
[   12.297928] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc7 #1 PREEMPT(voluntary) 
[   12.297980] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.297992] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.298014] Call Trace:
[   12.298027]  <TASK>
[   12.298045]  dump_stack_lvl+0x73/0xb0
[   12.298076]  print_report+0xd1/0x610
[   12.298130]  ? __virt_addr_valid+0x1db/0x2d0
[   12.298166]  ? kmalloc_large_uaf+0x2f1/0x340
[   12.298185]  ? kasan_addr_to_slab+0x11/0xa0
[   12.298205]  ? kmalloc_large_uaf+0x2f1/0x340
[   12.298225]  kasan_report+0x141/0x180
[   12.298247]  ? kmalloc_large_uaf+0x2f1/0x340
[   12.298271]  __asan_report_load1_noabort+0x18/0x20
[   12.298294]  kmalloc_large_uaf+0x2f1/0x340
[   12.298325]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   12.298346]  ? __schedule+0x10c6/0x2b60
[   12.298368]  ? __pfx_read_tsc+0x10/0x10
[   12.298388]  ? ktime_get_ts64+0x86/0x230
[   12.298412]  kunit_try_run_case+0x1a5/0x480
[   12.298436]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.298458]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.298480]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.298502]  ? __kthread_parkme+0x82/0x180
[   12.298522]  ? preempt_count_sub+0x50/0x80
[   12.298546]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.298568]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.298590]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.298612]  kthread+0x337/0x6f0
[   12.298631]  ? trace_preempt_on+0x20/0xc0
[   12.298653]  ? __pfx_kthread+0x10/0x10
[   12.298673]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.298693]  ? calculate_sigpending+0x7b/0xa0
[   12.298716]  ? __pfx_kthread+0x10/0x10
[   12.298736]  ret_from_fork+0x116/0x1d0
[   12.298753]  ? __pfx_kthread+0x10/0x10
[   12.298773]  ret_from_fork_asm+0x1a/0x30
[   12.298802]  </TASK>
[   12.298812] 
[   12.312340] The buggy address belongs to the physical page:
[   12.312642] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1028d8
[   12.313137] flags: 0x200000000000000(node=0|zone=2)
[   12.313416] raw: 0200000000000000 ffff88815b139f80 ffff88815b139f80 0000000000000000
[   12.313824] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   12.314380] page dumped because: kasan: bad access detected
[   12.314645] 
[   12.314746] Memory state around the buggy address:
[   12.314974]  ffff8881028d7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   12.315347]  ffff8881028d7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   12.315691] >ffff8881028d8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.316220]                    ^
[   12.316540]  ffff8881028d8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.316853]  ffff8881028d8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.317201] ==================================================================
Metadata Full log Test run details