Hay
Date
June 26, 2025, 11:12 a.m.

Environment
qemu-arm64

[   18.518028] ==================================================================
[   18.518173] BUG: KFENCE: use-after-free read in rcu_uaf_reclaim+0x48/0x70
[   18.518173] 
[   18.519451] Use-after-free read at 0x000000001a9dec98 (in kfence-#58):
[   18.519529]  rcu_uaf_reclaim+0x48/0x70
[   18.519575]  rcu_core+0x9f4/0x1e20
[   18.519913]  rcu_core_si+0x18/0x30
[   18.519982]  handle_softirqs+0x374/0xb28
[   18.520181]  __do_softirq+0x1c/0x28
[   18.520412]  ____do_softirq+0x18/0x30
[   18.520640]  call_on_irq_stack+0x24/0x30
[   18.520683]  do_softirq_own_stack+0x24/0x38
[   18.520896]  __irq_exit_rcu+0x1fc/0x318
[   18.521232]  irq_exit_rcu+0x1c/0x80
[   18.521433]  el1_interrupt+0x38/0x58
[   18.521665]  el1h_64_irq_handler+0x18/0x28
[   18.521884]  el1h_64_irq+0x6c/0x70
[   18.522149]  arch_local_irq_enable+0x4/0x8
[   18.522333]  do_idle+0x384/0x4e8
[   18.522401]  cpu_startup_entry+0x64/0x80
[   18.522478]  rest_init+0x160/0x188
[   18.522810]  start_kernel+0x308/0x3d0
[   18.523172]  __primary_switched+0x8c/0xa0
[   18.523435] 
[   18.523524] kfence-#58: 0x000000001a9dec98-0x000000001dcc1adb, size=24, cache=kmalloc-32
[   18.523524] 
[   18.523898] allocated by task 200 on cpu 0 at 18.289606s (0.234271s ago):
[   18.524053]  rcu_uaf+0xb0/0x2d8
[   18.524273]  kunit_try_run_case+0x170/0x3f0
[   18.524350]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   18.524397]  kthread+0x328/0x630
[   18.524771]  ret_from_fork+0x10/0x20
[   18.525128] 
[   18.525367] freed by task 0 on cpu 0 at 18.516959s (0.008379s ago):
[   18.525668]  rcu_uaf_reclaim+0x28/0x70
[   18.525752]  rcu_core+0x9f4/0x1e20
[   18.525978]  rcu_core_si+0x18/0x30
[   18.526282]  handle_softirqs+0x374/0xb28
[   18.526586]  __do_softirq+0x1c/0x28
[   18.526716]  ____do_softirq+0x18/0x30
[   18.527104]  call_on_irq_stack+0x24/0x30
[   18.527175]  do_softirq_own_stack+0x24/0x38
[   18.527402]  __irq_exit_rcu+0x1fc/0x318
[   18.527702]  irq_exit_rcu+0x1c/0x80
[   18.527992]  el1_interrupt+0x38/0x58
[   18.528120]  el1h_64_irq_handler+0x18/0x28
[   18.528173]  el1h_64_irq+0x6c/0x70
[   18.528205]  arch_local_irq_enable+0x4/0x8
[   18.528240]  do_idle+0x384/0x4e8
[   18.528309]  cpu_startup_entry+0x64/0x80
[   18.528348]  rest_init+0x160/0x188
[   18.528402]  start_kernel+0x308/0x3d0
[   18.528446]  __primary_switched+0x8c/0xa0
[   18.528485] 
[   18.528536] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G    B            N  6.15.4-rc3 #1 PREEMPT 
[   18.528623] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.528662] Hardware name: linux,dummy-virt (DT)
[   18.528695] ==================================================================