Hay
Sign in
Date
Dec. 9, 2024, 6:35 a.m.

Environment
qemu-arm64
qemu-x86_64 

[   23.390388] ==================================================================
[   23.392097] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   23.392754] Read of size 1 at addr fff00000c64c0000 by task kunit_try_catch/142
[   23.393444] 
[   23.393787] CPU: 1 UID: 0 PID: 142 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc2-next-20241209 #1
[   23.394868] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.395520] Hardware name: linux,dummy-virt (DT)
[   23.397194] Call trace:
[   23.397586]  show_stack+0x20/0x38 (C)
[   23.398137]  dump_stack_lvl+0x8c/0xd0
[   23.398678]  print_report+0x118/0x5e0
[   23.399660]  kasan_report+0xc8/0x118
[   23.400357]  __asan_report_load1_noabort+0x20/0x30
[   23.400995]  page_alloc_uaf+0x328/0x350
[   23.401539]  kunit_try_run_case+0x14c/0x3d0
[   23.402132]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   23.402849]  kthread+0x24c/0x2d0
[   23.403421]  ret_from_fork+0x10/0x20
[   23.404014] 
[   23.404331] The buggy address belongs to the physical page:
[   23.405363] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064c0
[   23.406205] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   23.407053] page_type: f0(buddy)
[   23.407542] raw: 0bfffe0000000000 fff00000ff6151b0 fff00000ff6151b0 0000000000000000
[   23.408338] raw: 0000000000000000 0000000000000006 00000000f0000000 0000000000000000
[   23.409539] page dumped because: kasan: bad access detected
[   23.410190] 
[   23.410521] Memory state around the buggy address:
[   23.411214]  fff00000c64bff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.412387]  fff00000c64bff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.413455] >fff00000c64c0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.414161]                    ^
[   23.414603]  fff00000c64c0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.415769]  fff00000c64c0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.416684] ==================================================================
Metadata Full log Test run details 

[   23.038111] ==================================================================
[   23.039969] BUG: KASAN: use-after-free in page_alloc_uaf+0x358/0x3d0
[   23.041153] Read of size 1 at addr ffff888102ac0000 by task kunit_try_catch/161
[   23.042191] 
[   23.042505] CPU: 1 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc2-next-20241209 #1
[   23.043861] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.044891] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.045942] Call Trace:
[   23.046621]  <TASK>
[   23.046822]  dump_stack_lvl+0x73/0xb0
[   23.048060]  print_report+0xd1/0x640
[   23.048686]  ? __virt_addr_valid+0x1db/0x2d0
[   23.049612]  ? kasan_addr_to_slab+0x11/0xa0
[   23.050500]  kasan_report+0x102/0x140
[   23.051108]  ? page_alloc_uaf+0x358/0x3d0
[   23.051532]  ? page_alloc_uaf+0x358/0x3d0
[   23.052450]  __asan_report_load1_noabort+0x18/0x20
[   23.053611]  page_alloc_uaf+0x358/0x3d0
[   23.053899]  ? __pfx_page_alloc_uaf+0x10/0x10
[   23.054856]  ? __schedule+0xc70/0x27e0
[   23.055320]  ? __pfx_read_tsc+0x10/0x10
[   23.055741]  ? ktime_get_ts64+0x86/0x230
[   23.056987]  kunit_try_run_case+0x1b3/0x490
[   23.057698]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.058414]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   23.058850]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.059721]  ? __kthread_parkme+0x82/0x160
[   23.060614]  ? preempt_count_sub+0x50/0x80
[   23.061806]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.062873]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.063719]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.064732]  kthread+0x257/0x310
[   23.065273]  ? __pfx_kthread+0x10/0x10
[   23.065795]  ret_from_fork+0x41/0x80
[   23.066685]  ? __pfx_kthread+0x10/0x10
[   23.067696]  ret_from_fork_asm+0x1a/0x30
[   23.068073]  </TASK>
[   23.068703] 
[   23.069358] The buggy address belongs to the physical page:
[   23.069746] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ac0
[   23.072128] flags: 0x200000000000000(node=0|zone=2)
[   23.073026] page_type: f0(buddy)
[   23.073314] raw: 0200000000000000 ffff88817fffb530 ffff88817fffb530 0000000000000000
[   23.073895] raw: 0000000000000000 0000000000000006 00000000f0000000 0000000000000000
[   23.075310] page dumped because: kasan: bad access detected
[   23.076132] 
[   23.076345] Memory state around the buggy address:
[   23.077556]  ffff888102abff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.078160]  ffff888102abff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.079109] >ffff888102ac0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.079799]                    ^
[   23.080129]  ffff888102ac0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.081044]  ffff888102ac0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.081844] ==================================================================
Metadata Full log Test run details