Hay
Sign in
Date
May 30, 2025, 4:14 a.m.

Environment
e850-96
qemu-arm64
qemu-x86_64
x15 

[   21.937956] ==================================================================
[   21.952235] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   21.958567] Read of size 1 at addr ffff000806250000 by task kunit_try_catch/198
[   21.965858] 
[   21.967345] CPU: 3 UID: 0 PID: 198 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250530 #1 PREEMPT 
[   21.967400] Tainted: [B]=BAD_PAGE, [N]=TEST
[   21.967417] Hardware name: WinLink E850-96 board (DT)
[   21.967440] Call trace:
[   21.967455]  show_stack+0x20/0x38 (C)
[   21.967491]  dump_stack_lvl+0x8c/0xd0
[   21.967527]  print_report+0x118/0x608
[   21.967561]  kasan_report+0xdc/0x128
[   21.967593]  __asan_report_load1_noabort+0x20/0x30
[   21.967624]  page_alloc_uaf+0x328/0x350
[   21.967654]  kunit_try_run_case+0x170/0x3f0
[   21.967692]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   21.967729]  kthread+0x328/0x630
[   21.967757]  ret_from_fork+0x10/0x20
[   21.967793] 
[   22.030705] The buggy address belongs to the physical page:
[   22.036261] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x886250
[   22.044245] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   22.050755] page_type: f0(buddy)
[   22.053977] raw: 0bfffe0000000000 ffff00087f61bc60 ffff00087f61bc60 0000000000000000
[   22.061697] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   22.069417] page dumped because: kasan: bad access detected
[   22.074973] 
[   22.076447] Memory state around the buggy address:
[   22.081231]  ffff00080624ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.088430]  ffff00080624ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.095636] >ffff000806250000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.102836]                    ^
[   22.106051]  ffff000806250080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.113256]  ffff000806250100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.120457] ==================================================================
Metadata Full log Test run details 

[   24.327026] ==================================================================
[   24.327181] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   24.328027] Read of size 1 at addr fff00000c7800000 by task kunit_try_catch/155
[   24.330723] 
[   24.330881] CPU: 0 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250530 #1 PREEMPT 
[   24.331257] Tainted: [B]=BAD_PAGE, [N]=TEST
[   24.331399] Hardware name: linux,dummy-virt (DT)
[   24.331479] Call trace:
[   24.331536]  show_stack+0x20/0x38 (C)
[   24.331671]  dump_stack_lvl+0x8c/0xd0
[   24.331819]  print_report+0x118/0x608
[   24.331932]  kasan_report+0xdc/0x128
[   24.332054]  __asan_report_load1_noabort+0x20/0x30
[   24.332223]  page_alloc_uaf+0x328/0x350
[   24.333332]  kunit_try_run_case+0x170/0x3f0
[   24.333618]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   24.333949]  kthread+0x328/0x630
[   24.334072]  ret_from_fork+0x10/0x20
[   24.334765] 
[   24.334828] The buggy address belongs to the physical page:
[   24.334910] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107800
[   24.335038] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   24.335278] page_type: f0(buddy)
[   24.336369] raw: 0bfffe0000000000 fff00000ff616310 fff00000ff616310 0000000000000000
[   24.336567] raw: 0000000000000000 000000000000000a 00000000f0000000 0000000000000000
[   24.336660] page dumped because: kasan: bad access detected
[   24.337717] 
[   24.338146] Memory state around the buggy address:
[   24.338299]  fff00000c77fff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.338501]  fff00000c77fff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.338856] >fff00000c7800000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.338960]                    ^
[   24.339213]  fff00000c7800080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.339660]  fff00000c7800100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.340264] ==================================================================
Metadata Full log Test run details 

[   17.127525] ==================================================================
[   17.128831] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   17.129769] Read of size 1 at addr ffff888103b80000 by task kunit_try_catch/171
[   17.130360] 
[   17.131296] CPU: 1 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250530 #1 PREEMPT(voluntary) 
[   17.131557] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.131577] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   17.131606] Call Trace:
[   17.131625]  <TASK>
[   17.131646]  dump_stack_lvl+0x73/0xb0
[   17.131724]  print_report+0xd1/0x650
[   17.131800]  ? __virt_addr_valid+0x1db/0x2d0
[   17.131879]  ? page_alloc_uaf+0x356/0x3d0
[   17.131949]  ? kasan_addr_to_slab+0x11/0xa0
[   17.132018]  ? page_alloc_uaf+0x356/0x3d0
[   17.132097]  kasan_report+0x141/0x180
[   17.132134]  ? page_alloc_uaf+0x356/0x3d0
[   17.132187]  __asan_report_load1_noabort+0x18/0x20
[   17.132262]  page_alloc_uaf+0x356/0x3d0
[   17.132316]  ? __pfx_page_alloc_uaf+0x10/0x10
[   17.132351]  ? __schedule+0x10cc/0x2b60
[   17.132387]  ? __pfx_read_tsc+0x10/0x10
[   17.132417]  ? ktime_get_ts64+0x86/0x230
[   17.132450]  kunit_try_run_case+0x1a5/0x480
[   17.132479]  ? __pfx_kunit_try_run_case+0x10/0x10
[   17.132505]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   17.132540]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   17.132576]  ? __kthread_parkme+0x82/0x180
[   17.132605]  ? preempt_count_sub+0x50/0x80
[   17.132636]  ? __pfx_kunit_try_run_case+0x10/0x10
[   17.132664]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   17.132698]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   17.132731]  kthread+0x337/0x6f0
[   17.132758]  ? trace_preempt_on+0x20/0xc0
[   17.132837]  ? __pfx_kthread+0x10/0x10
[   17.132870]  ? _raw_spin_unlock_irq+0x47/0x80
[   17.132904]  ? calculate_sigpending+0x7b/0xa0
[   17.132940]  ? __pfx_kthread+0x10/0x10
[   17.132969]  ret_from_fork+0x116/0x1d0
[   17.132994]  ? __pfx_kthread+0x10/0x10
[   17.133022]  ret_from_fork_asm+0x1a/0x30
[   17.133085]  </TASK>
[   17.133101] 
[   17.154213] The buggy address belongs to the physical page:
[   17.155284] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103b80
[   17.156342] flags: 0x200000000000000(node=0|zone=2)
[   17.157190] page_type: f0(buddy)
[   17.157689] raw: 0200000000000000 ffff88817fffc538 ffff88817fffc538 0000000000000000
[   17.158683] raw: 0000000000000000 0000000000000007 00000000f0000000 0000000000000000
[   17.159636] page dumped because: kasan: bad access detected
[   17.160700] 
[   17.160888] Memory state around the buggy address:
[   17.162074]  ffff888103b7ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.162992]  ffff888103b7ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.163761] >ffff888103b80000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.164708]                    ^
[   17.165499]  ffff888103b80080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.166043]  ffff888103b80100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.166496] ==================================================================
Metadata Full log Test run details 

[   48.378814] ==================================================================
[   48.393951] BUG: KASAN: use-after-free in page_alloc_uaf+0x368/0x39c
[   48.400360] Read of size 1 at addr cc830000 by task kunit_try_catch/206
[   48.407012] 
[   48.408508] CPU: 0 UID: 0 PID: 206 Comm: kunit_try_catch Tainted: G    B   W        N  6.15.0-next-20250530 #1 NONE 
[   48.408538] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   48.408569] Hardware name: Generic DRA74X (Flattened Device Tree)
[   48.408569] Call trace: 
[   48.408569]  unwind_backtrace from show_stack+0x18/0x1c
[   48.408599]  show_stack from dump_stack_lvl+0x70/0x90
[   48.408630]  dump_stack_lvl from print_report+0x158/0x528
[   48.408660]  print_report from kasan_report+0xdc/0x118
[   48.408660]  kasan_report from page_alloc_uaf+0x368/0x39c
[   48.408691]  page_alloc_uaf from kunit_try_run_case+0x22c/0x5a8
[   48.408721]  kunit_try_run_case from kunit_generic_run_threadfn_adapter+0xc4/0x128
[   48.408752]  kunit_generic_run_threadfn_adapter from kthread+0x464/0x810
[   48.408782]  kthread from ret_from_fork+0x14/0x20
[   48.408782] Exception stack(0xf220bfb0 to 0xf220bff8)
[   48.408813] bfa0:                                     00000000 00000000 00000000 00000000
[   48.408813] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   48.408843] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[   48.408843] 
[   48.514068] The buggy address belongs to the physical page:
[   48.519683] page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8c830
[   48.526947] flags: 0x0(zone=0)
[   48.530029] page_type: f0(buddy)
[   48.533294] raw: 00000000 c69c5750 c69c5750 00000000 00000000 00000004 f0000000 00000000
[   48.541412] raw: 00000000
[   48.544067] page dumped because: kasan: bad access detected
[   48.549652] 
[   48.551177] Memory state around the buggy address:
[   48.555999]  cc82ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   48.562561]  cc82ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   48.569122] >cc830000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   48.575714]            ^
[   48.578247]  cc830080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   48.584838]  cc830100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   48.591400] ==================================================================
Metadata Full log Test run details