Date
May 13, 2025, 12:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.084050] ================================================================== [ 19.084189] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350 [ 19.084293] Read of size 1 at addr fff00000c7820000 by task kunit_try_catch/154 [ 19.084428] [ 19.084484] CPU: 1 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250513 #1 PREEMPT [ 19.084581] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.084881] Hardware name: linux,dummy-virt (DT) [ 19.084960] Call trace: [ 19.085239] show_stack+0x20/0x38 (C) [ 19.085310] dump_stack_lvl+0x8c/0xd0 [ 19.085364] print_report+0x118/0x608 [ 19.085416] kasan_report+0xdc/0x128 [ 19.085466] __asan_report_load1_noabort+0x20/0x30 [ 19.085522] page_alloc_uaf+0x328/0x350 [ 19.085571] kunit_try_run_case+0x170/0x3f0 [ 19.085623] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.085680] kthread+0x328/0x630 [ 19.085733] ret_from_fork+0x10/0x20 [ 19.085790] [ 19.085836] The buggy address belongs to the physical page: [ 19.085875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107820 [ 19.085937] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.086007] page_type: f0(buddy) [ 19.086061] raw: 0bfffe0000000000 fff00000ff616108 fff00000ff616108 0000000000000000 [ 19.086118] raw: 0000000000000000 0000000000000005 00000000f0000000 0000000000000000 [ 19.086162] page dumped because: kasan: bad access detected [ 19.086196] [ 19.086216] Memory state around the buggy address: [ 19.086264] fff00000c781ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.086371] fff00000c781ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.086419] >fff00000c7820000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.086459] ^ [ 19.086492] fff00000c7820080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.086538] fff00000c7820100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.086578] ==================================================================
[ 10.637230] ================================================================== [ 10.638102] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0 [ 10.638884] Read of size 1 at addr ffff888103930000 by task kunit_try_catch/171 [ 10.639532] [ 10.639634] CPU: 0 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250513 #1 PREEMPT(voluntary) [ 10.639683] Tainted: [B]=BAD_PAGE, [N]=TEST [ 10.639694] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 10.639714] Call Trace: [ 10.639733] <TASK> [ 10.639748] dump_stack_lvl+0x73/0xb0 [ 10.639776] print_report+0xd1/0x650 [ 10.639798] ? __virt_addr_valid+0x1db/0x2d0 [ 10.639820] ? page_alloc_uaf+0x356/0x3d0 [ 10.639841] ? kasan_addr_to_slab+0x11/0xa0 [ 10.639862] ? page_alloc_uaf+0x356/0x3d0 [ 10.639884] kasan_report+0x141/0x180 [ 10.639906] ? page_alloc_uaf+0x356/0x3d0 [ 10.639933] __asan_report_load1_noabort+0x18/0x20 [ 10.639953] page_alloc_uaf+0x356/0x3d0 [ 10.639975] ? __pfx_page_alloc_uaf+0x10/0x10 [ 10.639997] ? __schedule+0x10cc/0x2b60 [ 10.640019] ? __pfx_read_tsc+0x10/0x10 [ 10.640040] ? ktime_get_ts64+0x86/0x230 [ 10.640064] kunit_try_run_case+0x1a5/0x480 [ 10.640088] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.640109] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 10.640131] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 10.640153] ? __kthread_parkme+0x82/0x180 [ 10.640174] ? preempt_count_sub+0x50/0x80 [ 10.640197] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.640220] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.640242] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 10.640264] kthread+0x337/0x6f0 [ 10.640283] ? trace_preempt_on+0x20/0xc0 [ 10.640305] ? __pfx_kthread+0x10/0x10 [ 10.640326] ? _raw_spin_unlock_irq+0x47/0x80 [ 10.640345] ? calculate_sigpending+0x7b/0xa0 [ 10.640368] ? __pfx_kthread+0x10/0x10 [ 10.640390] ret_from_fork+0x116/0x1d0 [ 10.640407] ? __pfx_kthread+0x10/0x10 [ 10.640428] ret_from_fork_asm+0x1a/0x30 [ 10.640460] </TASK> [ 10.640471] [ 10.654905] The buggy address belongs to the physical page: [ 10.655444] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103930 [ 10.656335] flags: 0x200000000000000(node=0|zone=2) [ 10.656869] page_type: f0(buddy) [ 10.657277] raw: 0200000000000000 ffff88817fffd460 ffff88817fffd460 0000000000000000 [ 10.658159] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000 [ 10.658979] page dumped because: kasan: bad access detected [ 10.659418] [ 10.659493] Memory state around the buggy address: [ 10.659959] ffff88810392ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 10.660491] ffff88810392ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 10.660940] >ffff888103930000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 10.661157] ^ [ 10.661470] ffff888103930080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 10.662188] ffff888103930100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 10.663018] ==================================================================