Hay
Sign in
Date
June 17, 2025, 6:35 a.m.

Environment
qemu-arm64
qemu-x86_64 

[   16.670957] ==================================================================
[   16.671047] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   16.671123] Read of size 1 at addr fff00000c5280000 by task kunit_try_catch/163
[   16.671299] 
[   16.671338] CPU: 1 UID: 0 PID: 163 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc2-next-20250617 #1 PREEMPT 
[   16.671533] Tainted: [B]=BAD_PAGE, [N]=TEST
[   16.671562] Hardware name: linux,dummy-virt (DT)
[   16.671595] Call trace:
[   16.671617]  show_stack+0x20/0x38 (C)
[   16.671700]  dump_stack_lvl+0x8c/0xd0
[   16.671758]  print_report+0x118/0x608
[   16.671807]  kasan_report+0xdc/0x128
[   16.671853]  __asan_report_load1_noabort+0x20/0x30
[   16.671900]  page_alloc_uaf+0x328/0x350
[   16.671976]  kunit_try_run_case+0x170/0x3f0
[   16.672026]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.672079]  kthread+0x328/0x630
[   16.672139]  ret_from_fork+0x10/0x20
[   16.672198] 
[   16.672218] The buggy address belongs to the physical page:
[   16.672249] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105280
[   16.672381] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   16.672430] page_type: f0(buddy)
[   16.672630] raw: 0bfffe0000000000 fff00000ff616170 ffffc1ffc31a4008 0000000000000000
[   16.672705] raw: 0000000000000000 0000000000000006 00000000f0000000 0000000000000000
[   16.672754] page dumped because: kasan: bad access detected
[   16.672793] 
[   16.672820] Memory state around the buggy address:
[   16.672854]  fff00000c527ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.673021]  fff00000c527ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.673067] >fff00000c5280000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.673105]                    ^
[   16.673242]  fff00000c5280080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.673317]  fff00000c5280100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.673368] ==================================================================
Metadata Full log Test run details 

[   17.087023] ==================================================================
[   17.088193] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   17.088861] Read of size 1 at addr ffff888103a00000 by task kunit_try_catch/181
[   17.090098] 
[   17.090597] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc2-next-20250617 #1 PREEMPT(voluntary) 
[   17.090747] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.090787] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   17.090882] Call Trace:
[   17.090918]  <TASK>
[   17.090941]  dump_stack_lvl+0x73/0xb0
[   17.090987]  print_report+0xd1/0x650
[   17.091018]  ? __virt_addr_valid+0x1db/0x2d0
[   17.091051]  ? page_alloc_uaf+0x356/0x3d0
[   17.091080]  ? kasan_addr_to_slab+0x11/0xa0
[   17.091107]  ? page_alloc_uaf+0x356/0x3d0
[   17.091137]  kasan_report+0x141/0x180
[   17.091165]  ? page_alloc_uaf+0x356/0x3d0
[   17.091200]  __asan_report_load1_noabort+0x18/0x20
[   17.091289]  page_alloc_uaf+0x356/0x3d0
[   17.091364]  ? __pfx_page_alloc_uaf+0x10/0x10
[   17.091439]  ? __schedule+0x10cc/0x2b60
[   17.091508]  ? __pfx_read_tsc+0x10/0x10
[   17.091583]  ? ktime_get_ts64+0x86/0x230
[   17.091664]  kunit_try_run_case+0x1a5/0x480
[   17.091759]  ? __pfx_kunit_try_run_case+0x10/0x10
[   17.091804]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   17.091858]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   17.091900]  ? __kthread_parkme+0x82/0x180
[   17.091929]  ? preempt_count_sub+0x50/0x80
[   17.091962]  ? __pfx_kunit_try_run_case+0x10/0x10
[   17.091994]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   17.092025]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   17.092056]  kthread+0x337/0x6f0
[   17.092083]  ? trace_preempt_on+0x20/0xc0
[   17.092117]  ? __pfx_kthread+0x10/0x10
[   17.092144]  ? _raw_spin_unlock_irq+0x47/0x80
[   17.092176]  ? calculate_sigpending+0x7b/0xa0
[   17.092209]  ? __pfx_kthread+0x10/0x10
[   17.092303]  ret_from_fork+0x116/0x1d0
[   17.092375]  ? __pfx_kthread+0x10/0x10
[   17.092410]  ret_from_fork_asm+0x1a/0x30
[   17.092452]  </TASK>
[   17.092470] 
[   17.108965] The buggy address belongs to the physical page:
[   17.109665] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a00
[   17.110642] flags: 0x200000000000000(node=0|zone=2)
[   17.111138] page_type: f0(buddy)
[   17.111525] raw: 0200000000000000 ffff88817fffb5c8 ffff88817fffb5c8 0000000000000000
[   17.112051] raw: 0000000000000000 0000000000000009 00000000f0000000 0000000000000000
[   17.112663] page dumped because: kasan: bad access detected
[   17.113803] 
[   17.114103] Memory state around the buggy address:
[   17.114714]  ffff8881039fff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.115586]  ffff8881039fff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.116139] >ffff888103a00000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.116784]                    ^
[   17.117060]  ffff888103a00080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.118158]  ffff888103a00100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.119175] ==================================================================
Metadata Full log Test run details