Hay
Sign in
Date
June 19, 2025, 12:07 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   29.939500] ==================================================================
[   29.939946] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   29.940192] Read of size 1 at addr fff00000c7540000 by task kunit_try_catch/159
[   29.940372] 
[   29.940468] CPU: 1 UID: 0 PID: 159 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc2-next-20250619 #1 PREEMPT 
[   29.940992] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.941097] Hardware name: linux,dummy-virt (DT)
[   29.941174] Call trace:
[   29.941244]  show_stack+0x20/0x38 (C)
[   29.941426]  dump_stack_lvl+0x8c/0xd0
[   29.941597]  print_report+0x118/0x608
[   29.941757]  kasan_report+0xdc/0x128
[   29.941884]  __asan_report_load1_noabort+0x20/0x30
[   29.942064]  kmalloc_large_uaf+0x2cc/0x2f8
[   29.942225]  kunit_try_run_case+0x170/0x3f0
[   29.942386]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.942550]  kthread+0x328/0x630
[   29.942670]  ret_from_fork+0x10/0x20
[   29.942837] 
[   29.942941] The buggy address belongs to the physical page:
[   29.943030] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c7546600 pfn:0x107540
[   29.943418] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   29.943914] raw: 0bfffe0000000000 fff00000da492c80 fff00000da492c80 0000000000000000
[   29.944022] raw: fff00000c7546600 0000000000000000 00000000ffffffff 0000000000000000
[   29.944107] page dumped because: kasan: bad access detected
[   29.944180] 
[   29.944217] Memory state around the buggy address:
[   29.944283]  fff00000c753ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.944368]  fff00000c753ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.944464] >fff00000c7540000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.944575]                    ^
[   29.944684]  fff00000c7540080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.944834]  fff00000c7540100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.944975] ==================================================================
Metadata Full log Test run details 

[   26.125573] ==================================================================
[   26.126088] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f1/0x340
[   26.126409] Read of size 1 at addr ffff8881029f8000 by task kunit_try_catch/177
[   26.126671] 
[   26.126815] CPU: 0 UID: 0 PID: 177 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc2-next-20250619 #1 PREEMPT(voluntary) 
[   26.126919] Tainted: [B]=BAD_PAGE, [N]=TEST
[   26.126944] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   26.126990] Call Trace:
[   26.127014]  <TASK>
[   26.127039]  dump_stack_lvl+0x73/0xb0
[   26.127085]  print_report+0xd1/0x650
[   26.127140]  ? __virt_addr_valid+0x1db/0x2d0
[   26.127168]  ? kmalloc_large_uaf+0x2f1/0x340
[   26.127191]  ? kasan_addr_to_slab+0x11/0xa0
[   26.127212]  ? kmalloc_large_uaf+0x2f1/0x340
[   26.127235]  kasan_report+0x141/0x180
[   26.127258]  ? kmalloc_large_uaf+0x2f1/0x340
[   26.127285]  __asan_report_load1_noabort+0x18/0x20
[   26.127311]  kmalloc_large_uaf+0x2f1/0x340
[   26.127333]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   26.127357]  ? __schedule+0x207f/0x2b60
[   26.127382]  ? __pfx_read_tsc+0x10/0x10
[   26.127405]  ? ktime_get_ts64+0x86/0x230
[   26.127432]  kunit_try_run_case+0x1a5/0x480
[   26.127461]  ? __pfx_kunit_try_run_case+0x10/0x10
[   26.127485]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   26.127509]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   26.127534]  ? __kthread_parkme+0x82/0x180
[   26.127557]  ? preempt_count_sub+0x50/0x80
[   26.127583]  ? __pfx_kunit_try_run_case+0x10/0x10
[   26.127608]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   26.127632]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   26.127657]  kthread+0x337/0x6f0
[   26.127680]  ? trace_preempt_on+0x20/0xc0
[   26.127705]  ? __pfx_kthread+0x10/0x10
[   26.127727]  ? _raw_spin_unlock_irq+0x47/0x80
[   26.127750]  ? calculate_sigpending+0x7b/0xa0
[   26.127777]  ? __pfx_kthread+0x10/0x10
[   26.127800]  ret_from_fork+0x116/0x1d0
[   26.127820]  ? __pfx_kthread+0x10/0x10
[   26.127842]  ret_from_fork_asm+0x1a/0x30
[   26.127875]  </TASK>
[   26.127887] 
[   26.144768] The buggy address belongs to the physical page:
[   26.145356] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029f8
[   26.145658] flags: 0x200000000000000(node=0|zone=2)
[   26.145885] raw: 0200000000000000 ffffea00040a7f08 ffff88815b039fc0 0000000000000000
[   26.146179] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   26.146896] page dumped because: kasan: bad access detected
[   26.147560] 
[   26.147711] Memory state around the buggy address:
[   26.148851]  ffff8881029f7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.149498]  ffff8881029f7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.149728] >ffff8881029f8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   26.150691]                    ^
[   26.151148]  ffff8881029f8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   26.151670]  ffff8881029f8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   26.152618] ==================================================================
Metadata Full log Test run details