Hay
Sign in
Date
July 8, 2025, 4:38 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   17.689702] ==================================================================
[   17.689759] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   17.689810] Read of size 1 at addr fff00000c7850000 by task kunit_try_catch/156
[   17.689859] 
[   17.689890] CPU: 1 UID: 0 PID: 156 Comm: kunit_try_catch Tainted: G    B            N  6.15.6-rc1 #1 PREEMPT 
[   17.690567] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.690641] Hardware name: linux,dummy-virt (DT)
[   17.690672] Call trace:
[   17.690773]  show_stack+0x20/0x38 (C)
[   17.691024]  dump_stack_lvl+0x8c/0xd0
[   17.691139]  print_report+0x118/0x608
[   17.691183]  kasan_report+0xdc/0x128
[   17.691227]  __asan_report_load1_noabort+0x20/0x30
[   17.691275]  page_alloc_uaf+0x328/0x350
[   17.691325]  kunit_try_run_case+0x170/0x3f0
[   17.691400]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.691893]  kthread+0x328/0x630
[   17.691957]  ret_from_fork+0x10/0x20
[   17.692061] 
[   17.692123] The buggy address belongs to the physical page:
[   17.692175] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107850
[   17.692226] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.692288] page_type: f0(buddy)
[   17.692481] raw: 0bfffe0000000000 fff00000ff616020 fff00000ff616020 0000000000000000
[   17.692617] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   17.692683] page dumped because: kasan: bad access detected
[   17.692824] 
[   17.692843] Memory state around the buggy address:
[   17.692876]  fff00000c784ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.692917]  fff00000c784ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.693013] >fff00000c7850000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.693105]                    ^
[   17.693142]  fff00000c7850080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.693319]  fff00000c7850100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.693507] ==================================================================
Metadata Full log Test run details 

[   10.745622] ==================================================================
[   10.746326] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   10.746800] Read of size 1 at addr ffff888103c40000 by task kunit_try_catch/174
[   10.747304] 
[   10.747404] CPU: 1 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G    B            N  6.15.6-rc1 #1 PREEMPT(voluntary) 
[   10.747450] Tainted: [B]=BAD_PAGE, [N]=TEST
[   10.747462] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   10.747483] Call Trace:
[   10.747496]  <TASK>
[   10.747539]  dump_stack_lvl+0x73/0xb0
[   10.747567]  print_report+0xd1/0x650
[   10.747600]  ? __virt_addr_valid+0x1db/0x2d0
[   10.747622]  ? page_alloc_uaf+0x356/0x3d0
[   10.747641]  ? kasan_addr_to_slab+0x11/0xa0
[   10.747662]  ? page_alloc_uaf+0x356/0x3d0
[   10.747681]  kasan_report+0x141/0x180
[   10.747704]  ? page_alloc_uaf+0x356/0x3d0
[   10.747727]  __asan_report_load1_noabort+0x18/0x20
[   10.747749]  page_alloc_uaf+0x356/0x3d0
[   10.747767]  ? __pfx_page_alloc_uaf+0x10/0x10
[   10.747787]  ? __schedule+0x10cc/0x2b60
[   10.747811]  ? __pfx_read_tsc+0x10/0x10
[   10.747831]  ? ktime_get_ts64+0x86/0x230
[   10.748115]  kunit_try_run_case+0x1a5/0x480
[   10.748141]  ? __pfx_kunit_try_run_case+0x10/0x10
[   10.748161]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   10.748186]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   10.748210]  ? __kthread_parkme+0x82/0x180
[   10.748234]  ? preempt_count_sub+0x50/0x80
[   10.748259]  ? __pfx_kunit_try_run_case+0x10/0x10
[   10.748280]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   10.748303]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   10.748327]  kthread+0x337/0x6f0
[   10.748345]  ? trace_preempt_on+0x20/0xc0
[   10.748368]  ? __pfx_kthread+0x10/0x10
[   10.748386]  ? _raw_spin_unlock_irq+0x47/0x80
[   10.748409]  ? calculate_sigpending+0x7b/0xa0
[   10.748431]  ? __pfx_kthread+0x10/0x10
[   10.748450]  ret_from_fork+0x41/0x80
[   10.748471]  ? __pfx_kthread+0x10/0x10
[   10.748489]  ret_from_fork_asm+0x1a/0x30
[   10.748533]  </TASK>
[   10.748545] 
[   10.759273] The buggy address belongs to the physical page:
[   10.759555] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103c40
[   10.759912] flags: 0x200000000000000(node=0|zone=2)
[   10.760124] page_type: f0(buddy)
[   10.760287] raw: 0200000000000000 ffff88817fffb470 ffff88817fffb470 0000000000000000
[   10.760990] raw: 0000000000000000 0000000000000006 00000000f0000000 0000000000000000
[   10.761289] page dumped because: kasan: bad access detected
[   10.761747] 
[   10.761849] Memory state around the buggy address:
[   10.762330]  ffff888103c3ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   10.762667]  ffff888103c3ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   10.763229] >ffff888103c40000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   10.763523]                    ^
[   10.764039]  ffff888103c40080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   10.764531]  ffff888103c40100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   10.764826] ==================================================================
Metadata Full log Test run details