lkft/linux-next-master - next-20250530 - log-parser-boot/kasan-bug-kasan-use-after-free-in-kmalloc_large_uaf

Date

May 30, 2025, 4:14 a.m.

Environment
e850-96
qemu-arm64
qemu-x86_64
x15

[   21.517682] ==================================================================
[   21.527415] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   21.534008] Read of size 1 at addr ffff0008033bc000 by task kunit_try_catch/192
[   21.541299] 
[   21.542787] CPU: 5 UID: 0 PID: 192 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250530 #1 PREEMPT 
[   21.542846] Tainted: [B]=BAD_PAGE, [N]=TEST
[   21.542861] Hardware name: WinLink E850-96 board (DT)
[   21.542880] Call trace:
[   21.542893]  show_stack+0x20/0x38 (C)
[   21.542927]  dump_stack_lvl+0x8c/0xd0
[   21.542964]  print_report+0x118/0x608
[   21.543001]  kasan_report+0xdc/0x128
[   21.543030]  __asan_report_load1_noabort+0x20/0x30
[   21.543063]  kmalloc_large_uaf+0x2cc/0x2f8
[   21.543090]  kunit_try_run_case+0x170/0x3f0
[   21.543124]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   21.543162]  kthread+0x328/0x630
[   21.543188]  ret_from_fork+0x10/0x20
[   21.543223] 
[   21.606405] The buggy address belongs to the physical page:
[   21.611962] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8833bc
[   21.619947] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   21.626466] raw: 0bfffe0000000000 fffffdffe00cf008 ffff00085afc0f40 0000000000000000
[   21.634186] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   21.641905] page dumped because: kasan: bad access detected
[   21.647462] 
[   21.648936] Memory state around the buggy address:
[   21.653717]  ffff0008033bbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   21.660919]  ffff0008033bbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   21.668125] >ffff0008033bc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.675325]                    ^
[   21.678540]  ffff0008033bc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.685745]  ffff0008033bc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   21.692946] ==================================================================

Metadata Full log Test run details

[   24.240326] ==================================================================
[   24.240482] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   24.240618] Read of size 1 at addr fff00000c77b0000 by task kunit_try_catch/149
[   24.240749] 
[   24.240830] CPU: 0 UID: 0 PID: 149 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250530 #1 PREEMPT 
[   24.241025] Tainted: [B]=BAD_PAGE, [N]=TEST
[   24.241085] Hardware name: linux,dummy-virt (DT)
[   24.241154] Call trace:
[   24.241209]  show_stack+0x20/0x38 (C)
[   24.241345]  dump_stack_lvl+0x8c/0xd0
[   24.241462]  print_report+0x118/0x608
[   24.241571]  kasan_report+0xdc/0x128
[   24.241679]  __asan_report_load1_noabort+0x20/0x30
[   24.241814]  kmalloc_large_uaf+0x2cc/0x2f8
[   24.241923]  kunit_try_run_case+0x170/0x3f0
[   24.242039]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   24.242165]  kthread+0x328/0x630
[   24.242273]  ret_from_fork+0x10/0x20
[   24.242384] 
[   24.242432] The buggy address belongs to the physical page:
[   24.242501] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077b0
[   24.242614] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   24.242831] raw: 0bfffe0000000000 ffffc1ffc31ded08 fff00000da448c40 0000000000000000
[   24.242963] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   24.243283] page dumped because: kasan: bad access detected
[   24.243534] 
[   24.245549] Memory state around the buggy address:
[   24.245637]  fff00000c77aff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.245765]  fff00000c77aff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.245863] >fff00000c77b0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.245947]                    ^
[   24.246825]  fff00000c77b0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.246955]  fff00000c77b0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   24.248327] ==================================================================

Metadata Full log Test run details

arch

arm64

host

x86_64

plan

2xnemi99Hvuh7IMni6GLnPJJmyr

job_id

TEST:linaro@lkft#2xner8G5PGJzTqMMTXexKt9Nkqk

job_url

https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2xner8G5PGJzTqMMTXexKt9Nkqk

artefacts

kernel

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2xnenk2TiaLlh3htnBwxI8n2lS2/Image.gz
sha256sum	54039bd66f1e3df45769ff753620d7b6f2f3dfddb4e37a1b2bb3c1537e2e7b6b

rootfs

url	https://storage.tuxboot.com/debian/20250425/trixie/arm64/rootfs.ext4.xz
sha256sum	1cc8d041751cc9cfe19b957ffa27d6115f076efaeb324bcd0fb145c37c99e1b7

modules

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2xnenk2TiaLlh3htnBwxI8n2lS2/modules.tar.xz
sha256sum	ad1c5e14b41ead63c47b931720e214e3f7689877b529c6a0fb4fa79c978e95f6

durations

tests

boot	0
kunit	302.96

host_arch

amd64

build_name

gcc-13-lkftconfig-kunit

job_status

Complete

qemu_version

1:10.0.0+ds-1

[   17.032844] ==================================================================
[   17.033943] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f1/0x340
[   17.034445] Read of size 1 at addr ffff888102cc0000 by task kunit_try_catch/165
[   17.036592] 
[   17.038191] CPU: 0 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250530 #1 PREEMPT(voluntary) 
[   17.038309] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.038339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   17.038387] Call Trace:
[   17.038417]  <TASK>
[   17.038454]  dump_stack_lvl+0x73/0xb0
[   17.038519]  print_report+0xd1/0x650
[   17.038573]  ? __virt_addr_valid+0x1db/0x2d0
[   17.038628]  ? kmalloc_large_uaf+0x2f1/0x340
[   17.038677]  ? kasan_addr_to_slab+0x11/0xa0
[   17.038726]  ? kmalloc_large_uaf+0x2f1/0x340
[   17.038775]  kasan_report+0x141/0x180
[   17.038827]  ? kmalloc_large_uaf+0x2f1/0x340
[   17.038888]  __asan_report_load1_noabort+0x18/0x20
[   17.038937]  kmalloc_large_uaf+0x2f1/0x340
[   17.038986]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   17.039037]  ? __schedule+0x10cc/0x2b60
[   17.039233]  ? __pfx_read_tsc+0x10/0x10
[   17.039309]  ? ktime_get_ts64+0x86/0x230
[   17.039414]  kunit_try_run_case+0x1a5/0x480
[   17.039473]  ? __pfx_kunit_try_run_case+0x10/0x10
[   17.039518]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   17.039572]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   17.039627]  ? __kthread_parkme+0x82/0x180
[   17.039676]  ? preempt_count_sub+0x50/0x80
[   17.039731]  ? __pfx_kunit_try_run_case+0x10/0x10
[   17.040429]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   17.040514]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   17.040591]  kthread+0x337/0x6f0
[   17.040646]  ? trace_preempt_on+0x20/0xc0
[   17.040714]  ? __pfx_kthread+0x10/0x10
[   17.040810]  ? _raw_spin_unlock_irq+0x47/0x80
[   17.040889]  ? calculate_sigpending+0x7b/0xa0
[   17.040964]  ? __pfx_kthread+0x10/0x10
[   17.041032]  ret_from_fork+0x116/0x1d0
[   17.041113]  ? __pfx_kthread+0x10/0x10
[   17.041518]  ret_from_fork_asm+0x1a/0x30
[   17.041608]  </TASK>
[   17.041640] 
[   17.067145] The buggy address belongs to the physical page:
[   17.067661] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102cc0
[   17.069021] flags: 0x200000000000000(node=0|zone=2)
[   17.069923] raw: 0200000000000000 ffffea00040b3108 ffff88815b039f80 0000000000000000
[   17.071012] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   17.071941] page dumped because: kasan: bad access detected
[   17.072448] 
[   17.072685] Memory state around the buggy address:
[   17.073666]  ffff888102cbff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.074678]  ffff888102cbff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.075448] >ffff888102cc0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.076197]                    ^
[   17.076519]  ffff888102cc0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.077487]  ffff888102cc0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   17.078137] ==================================================================

Metadata Full log Test run details

arch

x86_64

host

x86_64

plan

2xnemi99Hvuh7IMni6GLnPJJmyr

job_id

TEST:linaro@lkft#2xnerzD7c8zvUUJ0cIJLNaZoXbe

job_url

https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2xnerzD7c8zvUUJ0cIJLNaZoXbe

artefacts

kernel

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2xneodXjiC3GEwcZ9W0tAuggieI/bzImage
sha256sum	0239b9405f6caf05c6cb66487dfcbd91a08bb67af2cc091383be2bb288ae84ab

rootfs

url	https://storage.tuxboot.com/debian/20250425/trixie/amd64/rootfs.ext4.xz
sha256sum	3e64c22b7a85dd4a60fd0a31f22599e711e865f841aed0d517fae37e9c171158

modules

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2xneodXjiC3GEwcZ9W0tAuggieI/modules.tar.xz
sha256sum	a4e701489e98e3501a2b8de33e92dc78764a7120dcce30460eade35c60420cd9

durations

tests

boot	0
kunit	361.88

host_arch

amd64

build_name

gcc-13-lkftconfig-kunit

job_status

Complete

qemu_version

1:10.0.0+ds-1

[   47.903015] ==================================================================
[   47.914581] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x358/0x388
[   47.921234] Read of size 1 at addr cc74c000 by task kunit_try_catch/200
[   47.927886] 
[   47.929412] CPU: 0 UID: 0 PID: 200 Comm: kunit_try_catch Tainted: G    B   W        N  6.15.0-next-20250530 #1 NONE 
[   47.929412] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   47.929443] Hardware name: Generic DRA74X (Flattened Device Tree)
[   47.929443] Call trace: 
[   47.929443]  unwind_backtrace from show_stack+0x18/0x1c
[   47.929473]  show_stack from dump_stack_lvl+0x70/0x90
[   47.929504]  dump_stack_lvl from print_report+0x158/0x528
[   47.929534]  print_report from kasan_report+0xdc/0x118
[   47.929534]  kasan_report from kmalloc_large_uaf+0x358/0x388
[   47.929565]  kmalloc_large_uaf from kunit_try_run_case+0x22c/0x5a8
[   47.929595]  kunit_try_run_case from kunit_generic_run_threadfn_adapter+0xc4/0x128
[   47.929626]  kunit_generic_run_threadfn_adapter from kthread+0x464/0x810
[   47.929656]  kthread from ret_from_fork+0x14/0x20
[   47.929656] Exception stack(0xf21e3fb0 to 0xf21e3ff8)
[   47.929687] 3fa0:                                     00000000 00000000 00000000 00000000
[   47.929687] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   47.929718] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[   47.929718] 
[   48.035461] The buggy address belongs to the physical page:
[   48.041076] page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8c74c
[   48.048339] flags: 0x0(zone=0)
[   48.051422] raw: 00000000 eebbf744 e8a3ac4c 00000000 00000000 00000000 ffffffff 00000000
[   48.059570] raw: 00000000
[   48.062194] page dumped because: kasan: bad access detected
[   48.067810] 
[   48.069305] Memory state around the buggy address:
[   48.074127]  cc74bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   48.080718]  cc74bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   48.087280] >cc74c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   48.093841]            ^
[   48.096405]  cc74c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   48.102966]  cc74c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   48.109527] ==================================================================

Metadata Full log Test run details

Metadata

Failure - e850-96 - gcc-13-lkftconfig-kunit

Failure - qemu-arm64 - gcc-13-lkftconfig-kunit

Failure - qemu-x86_64 - gcc-13-lkftconfig-kunit

Failure - x15 - gcc-13-lkftconfig-kunit