Hay
Sign in
Date
July 20, 2025, 8:11 p.m.

Environment
qemu-arm64
qemu-x86_64 

[   14.985969] ==================================================================
[   14.986762] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   14.986960] Read of size 1 at addr fff00000c7730000 by task kunit_try_catch/155
[   14.987031] 
[   14.987080] CPU: 1 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT 
[   14.987426] Tainted: [B]=BAD_PAGE, [N]=TEST
[   14.987471] Hardware name: linux,dummy-virt (DT)
[   14.987512] Call trace:
[   14.987535]  show_stack+0x20/0x38 (C)
[   14.987588]  dump_stack_lvl+0x8c/0xd0
[   14.987634]  print_report+0x118/0x5d0
[   14.987680]  kasan_report+0xdc/0x128
[   14.987724]  __asan_report_load1_noabort+0x20/0x30
[   14.988038]  page_alloc_uaf+0x328/0x350
[   14.988410]  kunit_try_run_case+0x170/0x3f0
[   14.988538]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   14.988596]  kthread+0x328/0x630
[   14.988639]  ret_from_fork+0x10/0x20
[   14.988890] 
[   14.988920] The buggy address belongs to the physical page:
[   14.988978] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107730
[   14.989035] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   14.989176] page_type: f0(buddy)
[   14.989228] raw: 0bfffe0000000000 fff00000ff6160a0 fff00000ff6160a0 0000000000000000
[   14.989432] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   14.989617] page dumped because: kasan: bad access detected
[   14.989684] 
[   14.989787] Memory state around the buggy address:
[   14.989856]  fff00000c772ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   14.989919]  fff00000c772ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   14.990291] >fff00000c7730000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   14.990387]                    ^
[   14.990417]  fff00000c7730080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   14.990735]  fff00000c7730100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   14.990849] ==================================================================
Metadata Full log Test run details 

[   12.529912] ==================================================================
[   12.531685] BUG: KASAN: use-after-free in page_alloc_uaf+0x356/0x3d0
[   12.532237] Read of size 1 at addr ffff888103950000 by task kunit_try_catch/172
[   12.532490] 
[   12.532586] CPU: 1 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6 #1 PREEMPT(voluntary) 
[   12.532632] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.532644] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.532666] Call Trace:
[   12.532678]  <TASK>
[   12.532694]  dump_stack_lvl+0x73/0xb0
[   12.532724]  print_report+0xd1/0x610
[   12.532746]  ? __virt_addr_valid+0x1db/0x2d0
[   12.532768]  ? page_alloc_uaf+0x356/0x3d0
[   12.532789]  ? kasan_addr_to_slab+0x11/0xa0
[   12.532809]  ? page_alloc_uaf+0x356/0x3d0
[   12.532831]  kasan_report+0x141/0x180
[   12.532852]  ? page_alloc_uaf+0x356/0x3d0
[   12.532879]  __asan_report_load1_noabort+0x18/0x20
[   12.532903]  page_alloc_uaf+0x356/0x3d0
[   12.532924]  ? __pfx_page_alloc_uaf+0x10/0x10
[   12.532947]  ? __schedule+0x10c6/0x2b60
[   12.532969]  ? __pfx_read_tsc+0x10/0x10
[   12.532991]  ? ktime_get_ts64+0x86/0x230
[   12.533016]  kunit_try_run_case+0x1a5/0x480
[   12.533041]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.533063]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.533087]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.533109]  ? __kthread_parkme+0x82/0x180
[   12.533129]  ? preempt_count_sub+0x50/0x80
[   12.533152]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.533175]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.533211]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.533234]  kthread+0x337/0x6f0
[   12.533253]  ? trace_preempt_on+0x20/0xc0
[   12.533287]  ? __pfx_kthread+0x10/0x10
[   12.533307]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.533328]  ? calculate_sigpending+0x7b/0xa0
[   12.533351]  ? __pfx_kthread+0x10/0x10
[   12.533372]  ret_from_fork+0x116/0x1d0
[   12.533390]  ? __pfx_kthread+0x10/0x10
[   12.533410]  ret_from_fork_asm+0x1a/0x30
[   12.533440]  </TASK>
[   12.533451] 
[   12.541964] The buggy address belongs to the physical page:
[   12.542555] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103950
[   12.542845] flags: 0x200000000000000(node=0|zone=2)
[   12.543019] page_type: f0(buddy)
[   12.543210] raw: 0200000000000000 ffff88817fffb460 ffff88817fffb460 0000000000000000
[   12.543660] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000
[   12.544079] page dumped because: kasan: bad access detected
[   12.544256] 
[   12.544368] Memory state around the buggy address:
[   12.544690]  ffff88810394ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.545093]  ffff88810394ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.545320] >ffff888103950000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.545654]                    ^
[   12.545835]  ffff888103950080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.546270]  ffff888103950100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   12.546496] ==================================================================
Metadata Full log Test run details