Hay
Sign in
Date
June 23, 2025, 7:07 a.m.

Environment
qemu-arm64
qemu-x86_64 

[   32.450041] ==================================================================
[   32.450179] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   32.450319] Read of size 1 at addr fff00000c7720000 by task kunit_try_catch/166
[   32.450431] 
[   32.450509] CPU: 1 UID: 0 PID: 166 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250623 #1 PREEMPT 
[   32.450702] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.450772] Hardware name: linux,dummy-virt (DT)
[   32.450875] Call trace:
[   32.450935]  show_stack+0x20/0x38 (C)
[   32.451112]  dump_stack_lvl+0x8c/0xd0
[   32.451904]  print_report+0x118/0x608
[   32.452624]  kasan_report+0xdc/0x128
[   32.452791]  __asan_report_load1_noabort+0x20/0x30
[   32.452919]  page_alloc_uaf+0x328/0x350
[   32.453063]  kunit_try_run_case+0x170/0x3f0
[   32.453195]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.454614]  kthread+0x328/0x630
[   32.455078]  ret_from_fork+0x10/0x20
[   32.455218] 
[   32.455520] The buggy address belongs to the physical page:
[   32.455878] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107720
[   32.456002] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   32.456783] page_type: f0(buddy)
[   32.457166] raw: 0bfffe0000000000 fff00000ff616108 fff00000ff616108 0000000000000000
[   32.457286] raw: 0000000000000000 0000000000000005 00000000f0000000 0000000000000000
[   32.457846] page dumped because: kasan: bad access detected
[   32.458067] 
[   32.458134] Memory state around the buggy address:
[   32.458583]  fff00000c771ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.458889]  fff00000c771ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.458992] >fff00000c7720000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.459095]                    ^
[   32.459173]  fff00000c7720080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.459520]  fff00000c7720100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   32.461244] ==================================================================
Metadata Full log Test run details 

[   21.257190] ==================================================================
[   21.257695] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   21.258127] Read of size 1 at addr ffff888103a20000 by task kunit_try_catch/183
[   21.258728] 
[   21.259124] CPU: 0 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250623 #1 PREEMPT(voluntary) 
[   21.259212] Tainted: [B]=BAD_PAGE, [N]=TEST
[   21.259234] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   21.259263] Call Trace:
[   21.259284]  <TASK>
[   21.259308]  dump_stack_lvl+0x73/0xb0
[   21.259353]  print_report+0xd1/0x650
[   21.259401]  ? __virt_addr_valid+0x1db/0x2d0
[   21.259424]  ? page_alloc_uaf+0x356/0x3d0
[   21.259443]  ? kasan_addr_to_slab+0x11/0xa0
[   21.259460]  ? page_alloc_uaf+0x356/0x3d0
[   21.259478]  kasan_report+0x141/0x180
[   21.259497]  ? page_alloc_uaf+0x356/0x3d0
[   21.259519]  __asan_report_load1_noabort+0x18/0x20
[   21.259539]  page_alloc_uaf+0x356/0x3d0
[   21.259557]  ? __pfx_page_alloc_uaf+0x10/0x10
[   21.259577]  ? __schedule+0x10cc/0x2b60
[   21.259595]  ? __pfx_read_tsc+0x10/0x10
[   21.259613]  ? ktime_get_ts64+0x86/0x230
[   21.259634]  kunit_try_run_case+0x1a5/0x480
[   21.259655]  ? __pfx_kunit_try_run_case+0x10/0x10
[   21.259675]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   21.259693]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   21.259712]  ? __kthread_parkme+0x82/0x180
[   21.259729]  ? preempt_count_sub+0x50/0x80
[   21.259749]  ? __pfx_kunit_try_run_case+0x10/0x10
[   21.259769]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   21.259789]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   21.259809]  kthread+0x337/0x6f0
[   21.259825]  ? trace_preempt_on+0x20/0xc0
[   21.259855]  ? __pfx_kthread+0x10/0x10
[   21.259872]  ? _raw_spin_unlock_irq+0x47/0x80
[   21.259889]  ? calculate_sigpending+0x7b/0xa0
[   21.259910]  ? __pfx_kthread+0x10/0x10
[   21.259928]  ret_from_fork+0x116/0x1d0
[   21.259943]  ? __pfx_kthread+0x10/0x10
[   21.259961]  ret_from_fork_asm+0x1a/0x30
[   21.259988]  </TASK>
[   21.259998] 
[   21.270777] The buggy address belongs to the physical page:
[   21.271170] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a20
[   21.271426] flags: 0x200000000000000(node=0|zone=2)
[   21.272729] page_type: f0(buddy)
[   21.273080] raw: 0200000000000000 ffff88817fffb4a8 ffff88817fffb4a8 0000000000000000
[   21.273325] raw: 0000000000000000 0000000000000005 00000000f0000000 0000000000000000
[   21.273991] page dumped because: kasan: bad access detected
[   21.274207] 
[   21.274802] Memory state around the buggy address:
[   21.275182]  ffff888103a1ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.275763]  ffff888103a1ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.276440] >ffff888103a20000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.276936]                    ^
[   21.277185]  ffff888103a20080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.277876]  ffff888103a20100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.278551] ==================================================================
Metadata Full log Test run details