Hay
Sign in
Date
June 17, 2025, 3:40 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   21.300002] ==================================================================
[   21.300199] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   21.300335] Read of size 1 at addr fff00000c79a0000 by task kunit_try_catch/156
[   21.300458] 
[   21.300545] CPU: 0 UID: 0 PID: 156 Comm: kunit_try_catch Tainted: G    B            N  6.15.3-rc1 #1 PREEMPT 
[   21.301390] Tainted: [B]=BAD_PAGE, [N]=TEST
[   21.302443] Hardware name: linux,dummy-virt (DT)
[   21.302560] Call trace:
[   21.302614]  show_stack+0x20/0x38 (C)
[   21.303199]  dump_stack_lvl+0x8c/0xd0
[   21.303447]  print_report+0x118/0x608
[   21.303673]  kasan_report+0xdc/0x128
[   21.303792]  __asan_report_load1_noabort+0x20/0x30
[   21.303916]  page_alloc_uaf+0x328/0x350
[   21.304035]  kunit_try_run_case+0x170/0x3f0
[   21.304417]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   21.304715]  kthread+0x328/0x630
[   21.305040]  ret_from_fork+0x10/0x20
[   21.305305] 
[   21.305440] The buggy address belongs to the physical page:
[   21.305582] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079a0
[   21.305860] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   21.305988] page_type: f0(buddy)
[   21.306088] raw: 0bfffe0000000000 fff00000ff616088 fff00000ff616088 0000000000000000
[   21.306211] raw: 0000000000000000 0000000000000005 00000000f0000000 0000000000000000
[   21.306303] page dumped because: kasan: bad access detected
[   21.306362] 
[   21.306395] Memory state around the buggy address:
[   21.306455]  fff00000c799ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.306541]  fff00000c799ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.306634] >fff00000c79a0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.307074]                    ^
[   21.307212]  fff00000c79a0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.307640]  fff00000c79a0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.307837] ==================================================================
Metadata Full log Test run details 

[   18.159885] ==================================================================
[   18.161602] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   18.163205] Read of size 1 at addr ffff888103980000 by task kunit_try_catch/174
[   18.164469] 
[   18.164970] CPU: 1 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G    B            N  6.15.3-rc1 #1 PREEMPT(voluntary) 
[   18.165283] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.165329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.165362] Call Trace:
[   18.165386]  <TASK>
[   18.165413]  dump_stack_lvl+0x73/0xb0
[   18.165459]  print_report+0xd1/0x650
[   18.165497]  ? __virt_addr_valid+0x1db/0x2d0
[   18.165532]  ? page_alloc_uaf+0x356/0x3d0
[   18.165559]  ? kasan_addr_to_slab+0x11/0xa0
[   18.165590]  ? page_alloc_uaf+0x356/0x3d0
[   18.165618]  kasan_report+0x141/0x180
[   18.165651]  ? page_alloc_uaf+0x356/0x3d0
[   18.165684]  __asan_report_load1_noabort+0x18/0x20
[   18.165717]  page_alloc_uaf+0x356/0x3d0
[   18.165748]  ? __pfx_page_alloc_uaf+0x10/0x10
[   18.165778]  ? __schedule+0x10cc/0x2b60
[   18.165815]  ? __pfx_read_tsc+0x10/0x10
[   18.165846]  ? ktime_get_ts64+0x86/0x230
[   18.165885]  kunit_try_run_case+0x1a5/0x480
[   18.165925]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.166202]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   18.166255]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.166318]  ? __kthread_parkme+0x82/0x180
[   18.166359]  ? preempt_count_sub+0x50/0x80
[   18.166398]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.166437]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.166475]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.166512]  kthread+0x337/0x6f0
[   18.166539]  ? trace_preempt_on+0x20/0xc0
[   18.166577]  ? __pfx_kthread+0x10/0x10
[   18.166606]  ? _raw_spin_unlock_irq+0x47/0x80
[   18.166640]  ? calculate_sigpending+0x7b/0xa0
[   18.166673]  ? __pfx_kthread+0x10/0x10
[   18.166700]  ret_from_fork+0x41/0x80
[   18.166735]  ? __pfx_kthread+0x10/0x10
[   18.166762]  ret_from_fork_asm+0x1a/0x30
[   18.166809]  </TASK>
[   18.166826] 
[   18.187773] The buggy address belongs to the physical page:
[   18.189100] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103980
[   18.190382] flags: 0x200000000000000(node=0|zone=2)
[   18.190771] page_type: f0(buddy)
[   18.191516] raw: 0200000000000000 ffff88817fffb4b8 ffff88817fffb4b8 0000000000000000
[   18.192350] raw: 0000000000000000 0000000000000007 00000000f0000000 0000000000000000
[   18.192906] page dumped because: kasan: bad access detected
[   18.193887] 
[   18.194335] Memory state around the buggy address:
[   18.194717]  ffff88810397ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.195783]  ffff88810397ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.196754] >ffff888103980000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.197709]                    ^
[   18.198236]  ffff888103980080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.198820]  ffff888103980100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.199934] ==================================================================
Metadata Full log Test run details