Hay
Sign in
Date
June 3, 2025, 7:38 a.m.

Environment
qemu-arm64
qemu-x86_64
x86 

[   18.176704] ==================================================================
[   18.176787] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   18.176923] Read of size 1 at addr fff00000c7900000 by task kunit_try_catch/154
[   18.176989] 
[   18.177060] CPU: 1 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250603 #1 PREEMPT 
[   18.177203] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.177232] Hardware name: linux,dummy-virt (DT)
[   18.177264] Call trace:
[   18.177287]  show_stack+0x20/0x38 (C)
[   18.177338]  dump_stack_lvl+0x8c/0xd0
[   18.177386]  print_report+0x118/0x608
[   18.177446]  kasan_report+0xdc/0x128
[   18.177502]  __asan_report_load1_noabort+0x20/0x30
[   18.177549]  page_alloc_uaf+0x328/0x350
[   18.177594]  kunit_try_run_case+0x170/0x3f0
[   18.177642]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   18.177695]  kthread+0x328/0x630
[   18.177740]  ret_from_fork+0x10/0x20
[   18.177798] 
[   18.177827] The buggy address belongs to the physical page:
[   18.177867] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107900
[   18.177918] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   18.177969] page_type: f0(buddy)
[   18.178018] raw: 0bfffe0000000000 fff00000ff616240 fff00000ff616240 0000000000000000
[   18.178067] raw: 0000000000000000 0000000000000008 00000000f0000000 0000000000000000
[   18.178107] page dumped because: kasan: bad access detected
[   18.178146] 
[   18.178164] Memory state around the buggy address:
[   18.178198]  fff00000c78fff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.178239]  fff00000c78fff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.178285] >fff00000c7900000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.178324]                    ^
[   18.178362]  fff00000c7900080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.178405]  fff00000c7900100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.178463] ==================================================================
Metadata Full log Test run details 

[   13.793476] ==================================================================
[   13.795016] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   13.795520] Read of size 1 at addr ffff888103990000 by task kunit_try_catch/171
[   13.796104] 
[   13.796295] CPU: 0 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250603 #1 PREEMPT(voluntary) 
[   13.796364] Tainted: [B]=BAD_PAGE, [N]=TEST
[   13.796379] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   13.796404] Call Trace:
[   13.796422]  <TASK>
[   13.796447]  dump_stack_lvl+0x73/0xb0
[   13.796505]  print_report+0xd1/0x650
[   13.796532]  ? __virt_addr_valid+0x1db/0x2d0
[   13.796558]  ? page_alloc_uaf+0x356/0x3d0
[   13.796583]  ? kasan_addr_to_slab+0x11/0xa0
[   13.796605]  ? page_alloc_uaf+0x356/0x3d0
[   13.796630]  kasan_report+0x141/0x180
[   13.796654]  ? page_alloc_uaf+0x356/0x3d0
[   13.796683]  __asan_report_load1_noabort+0x18/0x20
[   13.796705]  page_alloc_uaf+0x356/0x3d0
[   13.796729]  ? __pfx_page_alloc_uaf+0x10/0x10
[   13.796755]  ? __schedule+0x10cc/0x2b60
[   13.796781]  ? __pfx_read_tsc+0x10/0x10
[   13.796805]  ? ktime_get_ts64+0x86/0x230
[   13.796833]  kunit_try_run_case+0x1a5/0x480
[   13.796856]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.796877]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   13.796904]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   13.796930]  ? __kthread_parkme+0x82/0x180
[   13.796953]  ? preempt_count_sub+0x50/0x80
[   13.796979]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.797001]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.797028]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   13.797054]  kthread+0x337/0x6f0
[   13.797075]  ? trace_preempt_on+0x20/0xc0
[   13.797101]  ? __pfx_kthread+0x10/0x10
[   13.797123]  ? _raw_spin_unlock_irq+0x47/0x80
[   13.797147]  ? calculate_sigpending+0x7b/0xa0
[   13.797174]  ? __pfx_kthread+0x10/0x10
[   13.797203]  ret_from_fork+0x116/0x1d0
[   13.797264]  ? __pfx_kthread+0x10/0x10
[   13.797306]  ret_from_fork_asm+0x1a/0x30
[   13.797373]  </TASK>
[   13.797397] 
[   13.809204] The buggy address belongs to the physical page:
[   13.809775] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103990
[   13.810528] flags: 0x200000000000000(node=0|zone=2)
[   13.811043] page_type: f0(buddy)
[   13.811510] raw: 0200000000000000 ffff88817fffb460 ffff88817fffb460 0000000000000000
[   13.812168] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   13.812776] page dumped because: kasan: bad access detected
[   13.813106] 
[   13.813257] Memory state around the buggy address:
[   13.813492]  ffff88810398ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.813877]  ffff88810398ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.814222] >ffff888103990000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.814731]                    ^
[   13.814913]  ffff888103990080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.815497]  ffff888103990100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.815965] ==================================================================
Metadata Full log Test run details 

[   20.457624] ==================================================================
[   20.472670] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   20.479025] Read of size 1 at addr ffff888107a20000 by task kunit_try_catch/194
[   20.486337] 
[   20.487838] CPU: 3 UID: 0 PID: 194 Comm: kunit_try_catch Tainted: G S  B            N  6.15.0-next-20250603 #1 PREEMPT(voluntary) 
[   20.487847] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST
[   20.487850] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021
[   20.487853] Call Trace:
[   20.487855]  <TASK>
[   20.487857]  dump_stack_lvl+0x73/0xb0
[   20.487861]  print_report+0xd1/0x650
[   20.487865]  ? __virt_addr_valid+0x1db/0x2d0
[   20.487869]  ? page_alloc_uaf+0x356/0x3d0
[   20.487873]  ? kasan_addr_to_slab+0x11/0xa0
[   20.487877]  ? page_alloc_uaf+0x356/0x3d0
[   20.487881]  kasan_report+0x141/0x180
[   20.487885]  ? page_alloc_uaf+0x356/0x3d0
[   20.487890]  __asan_report_load1_noabort+0x18/0x20
[   20.487894]  page_alloc_uaf+0x356/0x3d0
[   20.487898]  ? __pfx_page_alloc_uaf+0x10/0x10
[   20.487902]  ? __schedule+0x10cc/0x2b60
[   20.487907]  ? ktime_get_ts64+0x83/0x230
[   20.487911]  kunit_try_run_case+0x1a2/0x480
[   20.487915]  ? __pfx_kunit_try_run_case+0x10/0x10
[   20.487918]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   20.487923]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   20.487927]  ? __kthread_parkme+0x82/0x180
[   20.487930]  ? preempt_count_sub+0x50/0x80
[   20.487934]  ? __pfx_kunit_try_run_case+0x10/0x10
[   20.487938]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   20.487943]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   20.487947]  kthread+0x334/0x6f0
[   20.487950]  ? trace_preempt_on+0x20/0xc0
[   20.487955]  ? __pfx_kthread+0x10/0x10
[   20.487958]  ? _raw_spin_unlock_irq+0x47/0x80
[   20.487962]  ? calculate_sigpending+0x7b/0xa0
[   20.487967]  ? __pfx_kthread+0x10/0x10
[   20.487971]  ret_from_fork+0x113/0x1d0
[   20.487974]  ? __pfx_kthread+0x10/0x10
[   20.487977]  ret_from_fork_asm+0x1a/0x30
[   20.487983]  </TASK>
[   20.487985] 
[   20.651260] The buggy address belongs to the physical page:
[   20.656836] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107a20
[   20.664841] flags: 0x200000000000000(node=0|zone=2)
[   20.669722] page_type: f0(buddy)
[   20.672954] raw: 0200000000000000 ffff888277bfb4a8 ffff888277bfb4a8 0000000000000000
[   20.680695] raw: 0000000000000000 0000000000000005 00000000f0000000 0000000000000000
[   20.688440] page dumped because: kasan: bad access detected
[   20.694013] 
[   20.695512] Memory state around the buggy address:
[   20.700305]  ffff888107a1ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   20.707525]  ffff888107a1ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   20.714744] >ffff888107a20000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   20.721962]                    ^
[   20.725197]  ffff888107a20080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   20.732440]  ffff888107a20100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   20.739659] ==================================================================
Metadata Full log Test run details