Hay
Sign in
Date
July 15, 2025, 11:35 a.m.

Environment
e850-96
qemu-arm64
qemu-x86_64 

[   38.420473] ==================================================================
[   38.430518] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   38.437113] Read of size 1 at addr ffff0008062c4000 by task kunit_try_catch/229
[   38.444403] 
[   38.445889] CPU: 2 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250715 #1 PREEMPT 
[   38.445942] Tainted: [B]=BAD_PAGE, [N]=TEST
[   38.445957] Hardware name: WinLink E850-96 board (DT)
[   38.445977] Call trace:
[   38.445992]  show_stack+0x20/0x38 (C)
[   38.446025]  dump_stack_lvl+0x8c/0xd0
[   38.446059]  print_report+0x118/0x5d0
[   38.446085]  kasan_report+0xdc/0x128
[   38.446111]  __asan_report_load1_noabort+0x20/0x30
[   38.446143]  kmalloc_large_uaf+0x2cc/0x2f8
[   38.446174]  kunit_try_run_case+0x170/0x3f0
[   38.446207]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.446243]  kthread+0x328/0x630
[   38.446270]  ret_from_fork+0x10/0x20
[   38.446302] 
[   38.509857] The buggy address belongs to the physical page:
[   38.515413] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8862c4
[   38.523397] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   38.529919] raw: 0bfffe0000000000 fffffdffe018b208 ffff00085af65fc0 0000000000000000
[   38.537637] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   38.545357] page dumped because: kasan: bad access detected
[   38.550912] 
[   38.552387] Memory state around the buggy address:
[   38.557170]  ffff0008062c3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.564370]  ffff0008062c3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.571576] >ffff0008062c4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   38.578775]                    ^
[   38.581991]  ffff0008062c4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   38.589196]  ffff0008062c4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   38.596398] ==================================================================
Metadata Full log Test run details 

[   30.372065] ==================================================================
[   30.372150] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   30.372946] Read of size 1 at addr fff00000c92fc000 by task kunit_try_catch/180
[   30.373067] 
[   30.373109] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250715 #1 PREEMPT 
[   30.373508] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.373543] Hardware name: linux,dummy-virt (DT)
[   30.373601] Call trace:
[   30.373626]  show_stack+0x20/0x38 (C)
[   30.373965]  dump_stack_lvl+0x8c/0xd0
[   30.374153]  print_report+0x118/0x5d0
[   30.374296]  kasan_report+0xdc/0x128
[   30.374400]  __asan_report_load1_noabort+0x20/0x30
[   30.374473]  kmalloc_large_uaf+0x2cc/0x2f8
[   30.374755]  kunit_try_run_case+0x170/0x3f0
[   30.375291]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.375378]  kthread+0x328/0x630
[   30.375462]  ret_from_fork+0x10/0x20
[   30.375516] 
[   30.375538] The buggy address belongs to the physical page:
[   30.375580] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1092fc
[   30.375643] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.375736] raw: 0bfffe0000000000 fff00000da454d00 fff00000da454d00 0000000000000000
[   30.375784] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   30.375822] page dumped because: kasan: bad access detected
[   30.375853] 
[   30.375879] Memory state around the buggy address:
[   30.375911]  fff00000c92fbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.375961]  fff00000c92fbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.376001] >fff00000c92fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.376037]                    ^
[   30.376065]  fff00000c92fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.376114]  fff00000c92fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.376150] ==================================================================
Metadata Full log Test run details 

[   23.604212] ==================================================================
[   23.604851] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f1/0x340
[   23.605302] Read of size 1 at addr ffff88810493c000 by task kunit_try_catch/196
[   23.606245] 
[   23.606383] CPU: 0 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250715 #1 PREEMPT(voluntary) 
[   23.606615] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.606633] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.606658] Call Trace:
[   23.606673]  <TASK>
[   23.606690]  dump_stack_lvl+0x73/0xb0
[   23.606727]  print_report+0xd1/0x610
[   23.606755]  ? __virt_addr_valid+0x1db/0x2d0
[   23.606783]  ? kmalloc_large_uaf+0x2f1/0x340
[   23.606808]  ? kasan_addr_to_slab+0x11/0xa0
[   23.606834]  ? kmalloc_large_uaf+0x2f1/0x340
[   23.606859]  kasan_report+0x141/0x180
[   23.606886]  ? kmalloc_large_uaf+0x2f1/0x340
[   23.606918]  __asan_report_load1_noabort+0x18/0x20
[   23.606947]  kmalloc_large_uaf+0x2f1/0x340
[   23.606972]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   23.606999]  ? __schedule+0x10cc/0x2b60
[   23.607025]  ? __pfx_read_tsc+0x10/0x10
[   23.607051]  ? ktime_get_ts64+0x86/0x230
[   23.607082]  kunit_try_run_case+0x1a5/0x480
[   23.607111]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.607138]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.607164]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.607191]  ? __kthread_parkme+0x82/0x180
[   23.607216]  ? preempt_count_sub+0x50/0x80
[   23.607245]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.607274]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.607304]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.607335]  kthread+0x337/0x6f0
[   23.607359]  ? trace_preempt_on+0x20/0xc0
[   23.607387]  ? __pfx_kthread+0x10/0x10
[   23.607412]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.607441]  ? calculate_sigpending+0x7b/0xa0
[   23.607470]  ? __pfx_kthread+0x10/0x10
[   23.607497]  ret_from_fork+0x116/0x1d0
[   23.607531]  ? __pfx_kthread+0x10/0x10
[   23.607567]  ret_from_fork_asm+0x1a/0x30
[   23.607609]  </TASK>
[   23.607621] 
[   23.618484] The buggy address belongs to the physical page:
[   23.619227] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10493c
[   23.619741] flags: 0x200000000000000(node=0|zone=2)
[   23.620088] raw: 0200000000000000 ffffea0004125008 ffff88815b039fc0 0000000000000000
[   23.620534] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   23.621097] page dumped because: kasan: bad access detected
[   23.621507] 
[   23.621685] Memory state around the buggy address:
[   23.621866]  ffff88810493bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.622193]  ffff88810493bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.622503] >ffff88810493c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.623177]                    ^
[   23.623467]  ffff88810493c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.623984]  ffff88810493c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.624438] ==================================================================
Metadata Full log Test run details