Hay
Sign in
Date
July 22, 2025, 5:13 a.m.

Environment
qemu-arm64
qemu-x86_64 

[   30.120260] ==================================================================
[   30.120365] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   30.120625] Read of size 1 at addr fff00000c9b30000 by task kunit_try_catch/185
[   30.120684] 
[   30.120718] CPU: 1 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G    B   W        N  6.16.0-rc7-next-20250722 #1 PREEMPT 
[   30.120824] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   30.121293] Hardware name: linux,dummy-virt (DT)
[   30.121332] Call trace:
[   30.121355]  show_stack+0x20/0x38 (C)
[   30.121661]  dump_stack_lvl+0x8c/0xd0
[   30.121880]  print_report+0x118/0x5e8
[   30.122028]  kasan_report+0xdc/0x128
[   30.122138]  __asan_report_load1_noabort+0x20/0x30
[   30.122306]  page_alloc_uaf+0x328/0x350
[   30.122357]  kunit_try_run_case+0x170/0x3f0
[   30.122731]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.123093]  kthread+0x328/0x630
[   30.123204]  ret_from_fork+0x10/0x20
[   30.123330] 
[   30.123358] The buggy address belongs to the physical page:
[   30.123793] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b30
[   30.124023] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.124086] page_type: f0(buddy)
[   30.124127] raw: 0bfffe0000000000 fff00000ff6160e0 fff00000ff6160e0 0000000000000000
[   30.124453] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   30.124612] page dumped because: kasan: bad access detected
[   30.124654] 
[   30.124673] Memory state around the buggy address:
[   30.124750]  fff00000c9b2ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.124914]  fff00000c9b2ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.125218] >fff00000c9b30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.125261]                    ^
[   30.125623]  fff00000c9b30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.125712]  fff00000c9b30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   30.125784] ==================================================================
Metadata Full log Test run details 

[   24.701904] ==================================================================
[   24.702545] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   24.702953] Read of size 1 at addr ffff888106270000 by task kunit_try_catch/202
[   24.703297] 
[   24.703381] CPU: 1 UID: 0 PID: 202 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc7-next-20250722 #1 PREEMPT(voluntary) 
[   24.703428] Tainted: [B]=BAD_PAGE, [N]=TEST
[   24.703440] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   24.703461] Call Trace:
[   24.703522]  <TASK>
[   24.703536]  dump_stack_lvl+0x73/0xb0
[   24.703565]  print_report+0xd1/0x640
[   24.703587]  ? __virt_addr_valid+0x1db/0x2d0
[   24.703610]  ? page_alloc_uaf+0x356/0x3d0
[   24.703632]  ? kasan_addr_to_slab+0x11/0xa0
[   24.703652]  ? page_alloc_uaf+0x356/0x3d0
[   24.703674]  kasan_report+0x141/0x180
[   24.703696]  ? page_alloc_uaf+0x356/0x3d0
[   24.703722]  __asan_report_load1_noabort+0x18/0x20
[   24.703746]  page_alloc_uaf+0x356/0x3d0
[   24.703769]  ? __pfx_page_alloc_uaf+0x10/0x10
[   24.703792]  ? __schedule+0x10da/0x2b60
[   24.703817]  ? __pfx_read_tsc+0x10/0x10
[   24.703852]  ? ktime_get_ts64+0x86/0x230
[   24.703878]  kunit_try_run_case+0x1a5/0x480
[   24.703905]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.703928]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   24.703954]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   24.703979]  ? __kthread_parkme+0x82/0x180
[   24.704000]  ? preempt_count_sub+0x50/0x80
[   24.704023]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.704046]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.704070]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   24.704093]  kthread+0x337/0x6f0
[   24.704113]  ? trace_preempt_on+0x20/0xc0
[   24.704137]  ? __pfx_kthread+0x10/0x10
[   24.704157]  ? _raw_spin_unlock_irq+0x47/0x80
[   24.704192]  ? calculate_sigpending+0x7b/0xa0
[   24.704215]  ? __pfx_kthread+0x10/0x10
[   24.704236]  ret_from_fork+0x116/0x1d0
[   24.704256]  ? __pfx_kthread+0x10/0x10
[   24.704277]  ret_from_fork_asm+0x1a/0x30
[   24.704307]  </TASK>
[   24.704318] 
[   24.713485] The buggy address belongs to the physical page:
[   24.713751] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106270
[   24.714134] flags: 0x200000000000000(node=0|zone=2)
[   24.714359] page_type: f0(buddy)
[   24.714540] raw: 0200000000000000 ffff88817fffb460 ffff88817fffb460 0000000000000000
[   24.714885] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   24.715261] page dumped because: kasan: bad access detected
[   24.715538] 
[   24.715622] Memory state around the buggy address:
[   24.715816]  ffff88810626ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.716099]  ffff88810626ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.716419] >ffff888106270000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.716808]                    ^
[   24.716975]  ffff888106270080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.717322]  ffff888106270100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.717563] ==================================================================
Metadata Full log Test run details