Hay
Sign in
Date
July 3, 2025, 6:13 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   16.586355] ==================================================================
[   16.586439] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   16.586570] Read of size 1 at addr fff00000c78b0000 by task kunit_try_catch/154
[   16.586621] 
[   16.586669] CPU: 0 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT 
[   16.586750] Tainted: [B]=BAD_PAGE, [N]=TEST
[   16.586776] Hardware name: linux,dummy-virt (DT)
[   16.586971] Call trace:
[   16.587055]  show_stack+0x20/0x38 (C)
[   16.587201]  dump_stack_lvl+0x8c/0xd0
[   16.587384]  print_report+0x118/0x608
[   16.587507]  kasan_report+0xdc/0x128
[   16.587639]  __asan_report_load1_noabort+0x20/0x30
[   16.587691]  page_alloc_uaf+0x328/0x350
[   16.587898]  kunit_try_run_case+0x170/0x3f0
[   16.587959]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.588259]  kthread+0x328/0x630
[   16.588393]  ret_from_fork+0x10/0x20
[   16.588511] 
[   16.588700] The buggy address belongs to the physical page:
[   16.588737] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078b0
[   16.588888] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   16.589006] page_type: f0(buddy)
[   16.589112] raw: 0bfffe0000000000 fff00000ff6160a0 fff00000ff6160a0 0000000000000000
[   16.589166] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   16.589524] page dumped because: kasan: bad access detected
[   16.589663] 
[   16.589772] Memory state around the buggy address:
[   16.589910]  fff00000c78aff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.589994]  fff00000c78aff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.590133] >fff00000c78b0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.590171]                    ^
[   16.590217]  fff00000c78b0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.590469]  fff00000c78b0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   16.590755] ==================================================================
Metadata Full log Test run details 

[   11.043046] ==================================================================
[   11.044201] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   11.044434] Read of size 1 at addr ffff888103980000 by task kunit_try_catch/172
[   11.044651] 
[   11.044741] CPU: 0 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT(voluntary) 
[   11.044785] Tainted: [B]=BAD_PAGE, [N]=TEST
[   11.044797] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.044817] Call Trace:
[   11.044829]  <TASK>
[   11.044844]  dump_stack_lvl+0x73/0xb0
[   11.044870]  print_report+0xd1/0x650
[   11.044892]  ? __virt_addr_valid+0x1db/0x2d0
[   11.044915]  ? page_alloc_uaf+0x356/0x3d0
[   11.044936]  ? kasan_addr_to_slab+0x11/0xa0
[   11.044955]  ? page_alloc_uaf+0x356/0x3d0
[   11.044976]  kasan_report+0x141/0x180
[   11.044997]  ? page_alloc_uaf+0x356/0x3d0
[   11.045022]  __asan_report_load1_noabort+0x18/0x20
[   11.045045]  page_alloc_uaf+0x356/0x3d0
[   11.045065]  ? __pfx_page_alloc_uaf+0x10/0x10
[   11.045087]  ? __schedule+0x10cc/0x2b60
[   11.045119]  ? __pfx_read_tsc+0x10/0x10
[   11.045140]  ? ktime_get_ts64+0x86/0x230
[   11.045163]  kunit_try_run_case+0x1a5/0x480
[   11.045187]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.045209]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   11.045230]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   11.045251]  ? __kthread_parkme+0x82/0x180
[   11.045270]  ? preempt_count_sub+0x50/0x80
[   11.045292]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.045315]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.045338]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   11.045362]  kthread+0x337/0x6f0
[   11.045380]  ? trace_preempt_on+0x20/0xc0
[   11.045403]  ? __pfx_kthread+0x10/0x10
[   11.045423]  ? _raw_spin_unlock_irq+0x47/0x80
[   11.045442]  ? calculate_sigpending+0x7b/0xa0
[   11.045465]  ? __pfx_kthread+0x10/0x10
[   11.045486]  ret_from_fork+0x116/0x1d0
[   11.045503]  ? __pfx_kthread+0x10/0x10
[   11.045522]  ret_from_fork_asm+0x1a/0x30
[   11.045551]  </TASK>
[   11.045563] 
[   11.061325] The buggy address belongs to the physical page:
[   11.061830] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103980
[   11.062563] flags: 0x200000000000000(node=0|zone=2)
[   11.062735] page_type: f0(buddy)
[   11.062860] raw: 0200000000000000 ffff88817fffb538 ffff88817fffb538 0000000000000000
[   11.063094] raw: 0000000000000000 0000000000000007 00000000f0000000 0000000000000000
[   11.063518] page dumped because: kasan: bad access detected
[   11.063743] 
[   11.063834] Memory state around the buggy address:
[   11.064027]  ffff88810397ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.064437]  ffff88810397ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.064697] >ffff888103980000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.065009]                    ^
[   11.065251]  ffff888103980080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.065573]  ffff888103980100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.065805] ==================================================================
Metadata Full log Test run details