Hay
Sign in
Date
July 5, 2025, 5:09 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   18.092385] ==================================================================
[   18.092451] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   18.092498] Read of size 1 at addr fff00000c7840000 by task kunit_try_catch/154
[   18.092603] 
[   18.092715] CPU: 1 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT 
[   18.092793] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.092818] Hardware name: linux,dummy-virt (DT)
[   18.092848] Call trace:
[   18.092880]  show_stack+0x20/0x38 (C)
[   18.092927]  dump_stack_lvl+0x8c/0xd0
[   18.092996]  print_report+0x118/0x608
[   18.093042]  kasan_report+0xdc/0x128
[   18.093125]  __asan_report_load1_noabort+0x20/0x30
[   18.093229]  page_alloc_uaf+0x328/0x350
[   18.093273]  kunit_try_run_case+0x170/0x3f0
[   18.093318]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   18.093407]  kthread+0x328/0x630
[   18.093521]  ret_from_fork+0x10/0x20
[   18.093605] 
[   18.093634] The buggy address belongs to the physical page:
[   18.093744] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107840
[   18.093796] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   18.093841] page_type: f0(buddy)
[   18.093921] raw: 0bfffe0000000000 fff00000ff616170 fff00000ff616170 0000000000000000
[   18.094015] raw: 0000000000000000 0000000000000006 00000000f0000000 0000000000000000
[   18.094105] page dumped because: kasan: bad access detected
[   18.094172] 
[   18.094190] Memory state around the buggy address:
[   18.094237]  fff00000c783ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.094279]  fff00000c783ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.094319] >fff00000c7840000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.094483]                    ^
[   18.094546]  fff00000c7840080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.094692]  fff00000c7840100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   18.094880] ==================================================================
Metadata Full log Test run details 

[   11.163336] ==================================================================
[   11.163949] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   11.164206] Read of size 1 at addr ffff888103980000 by task kunit_try_catch/172
[   11.164581] 
[   11.164687] CPU: 0 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT(voluntary) 
[   11.164730] Tainted: [B]=BAD_PAGE, [N]=TEST
[   11.164743] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.164766] Call Trace:
[   11.164779]  <TASK>
[   11.164795]  dump_stack_lvl+0x73/0xb0
[   11.164833]  print_report+0xd1/0x650
[   11.164855]  ? __virt_addr_valid+0x1db/0x2d0
[   11.164877]  ? page_alloc_uaf+0x356/0x3d0
[   11.164898]  ? kasan_addr_to_slab+0x11/0xa0
[   11.164918]  ? page_alloc_uaf+0x356/0x3d0
[   11.164941]  kasan_report+0x141/0x180
[   11.164962]  ? page_alloc_uaf+0x356/0x3d0
[   11.164988]  __asan_report_load1_noabort+0x18/0x20
[   11.165012]  page_alloc_uaf+0x356/0x3d0
[   11.165033]  ? __pfx_page_alloc_uaf+0x10/0x10
[   11.165055]  ? __schedule+0x10cc/0x2b60
[   11.165076]  ? __pfx_read_tsc+0x10/0x10
[   11.165096]  ? ktime_get_ts64+0x86/0x230
[   11.165119]  kunit_try_run_case+0x1a5/0x480
[   11.165144]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.165165]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   11.165187]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   11.165210]  ? __kthread_parkme+0x82/0x180
[   11.165229]  ? preempt_count_sub+0x50/0x80
[   11.165252]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.165274]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.165296]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   11.165318]  kthread+0x337/0x6f0
[   11.165336]  ? trace_preempt_on+0x20/0xc0
[   11.165359]  ? __pfx_kthread+0x10/0x10
[   11.165385]  ? _raw_spin_unlock_irq+0x47/0x80
[   11.165405]  ? calculate_sigpending+0x7b/0xa0
[   11.165428]  ? __pfx_kthread+0x10/0x10
[   11.165448]  ret_from_fork+0x116/0x1d0
[   11.165489]  ? __pfx_kthread+0x10/0x10
[   11.165509]  ret_from_fork_asm+0x1a/0x30
[   11.165538]  </TASK>
[   11.165549] 
[   11.173560] The buggy address belongs to the physical page:
[   11.173826] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103980
[   11.174187] flags: 0x200000000000000(node=0|zone=2)
[   11.174357] page_type: f0(buddy)
[   11.174492] raw: 0200000000000000 ffff88817fffb538 ffff88817fffb538 0000000000000000
[   11.174770] raw: 0000000000000000 0000000000000007 00000000f0000000 0000000000000000
[   11.175106] page dumped because: kasan: bad access detected
[   11.175370] 
[   11.175480] Memory state around the buggy address:
[   11.175642]  ffff88810397ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.176127]  ffff88810397ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.176521] >ffff888103980000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.176813]                    ^
[   11.176991]  ffff888103980080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.177210]  ffff888103980100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   11.177503] ==================================================================
Metadata Full log Test run details