lkft/linux-next-master - next-20250714 - log-parser-boot/kasan-bug-kasan-use-after-free-in-kmalloc_large_uaf

Date

July 14, 2025, 10:38 a.m.

Environment
e850-96
qemu-arm64
qemu-x86_64

[   38.480358] ==================================================================
[   38.490393] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   38.496987] Read of size 1 at addr ffff000806cc8000 by task kunit_try_catch/232
[   38.504277] 
[   38.505762] CPU: 2 UID: 0 PID: 232 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250714 #1 PREEMPT 
[   38.505813] Tainted: [B]=BAD_PAGE, [N]=TEST
[   38.505830] Hardware name: WinLink E850-96 board (DT)
[   38.505851] Call trace:
[   38.505867]  show_stack+0x20/0x38 (C)
[   38.505902]  dump_stack_lvl+0x8c/0xd0
[   38.505935]  print_report+0x118/0x5d0
[   38.505962]  kasan_report+0xdc/0x128
[   38.505989]  __asan_report_load1_noabort+0x20/0x30
[   38.506022]  kmalloc_large_uaf+0x2cc/0x2f8
[   38.506052]  kunit_try_run_case+0x170/0x3f0
[   38.506090]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.506124]  kthread+0x328/0x630
[   38.506153]  ret_from_fork+0x10/0x20
[   38.506188] 
[   38.569729] The buggy address belongs to the physical page:
[   38.575287] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x886cc8
[   38.583272] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   38.589793] raw: 0bfffe0000000000 fffffdffe01b3308 ffff00085af67fc0 0000000000000000
[   38.597511] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   38.605230] page dumped because: kasan: bad access detected
[   38.610785] 
[   38.612262] Memory state around the buggy address:
[   38.617041]  ffff000806cc7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   38.624244]  ffff000806cc7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   38.631450] >ffff000806cc8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   38.638650]                    ^
[   38.641865]  ffff000806cc8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   38.649070]  ffff000806cc8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   38.656272] ==================================================================

Metadata Full log Test run details

[   29.361332] ==================================================================
[   29.361400] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   29.361458] Read of size 1 at addr fff00000c9b00000 by task kunit_try_catch/179
[   29.361506] 
[   29.361544] CPU: 0 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250714 #1 PREEMPT 
[   29.361637] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.361663] Hardware name: linux,dummy-virt (DT)
[   29.361693] Call trace:
[   29.361716]  show_stack+0x20/0x38 (C)
[   29.361901]  dump_stack_lvl+0x8c/0xd0
[   29.362114]  print_report+0x118/0x5d0
[   29.362275]  kasan_report+0xdc/0x128
[   29.362373]  __asan_report_load1_noabort+0x20/0x30
[   29.362511]  kmalloc_large_uaf+0x2cc/0x2f8
[   29.362596]  kunit_try_run_case+0x170/0x3f0
[   29.362644]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.362965]  kthread+0x328/0x630
[   29.363016]  ret_from_fork+0x10/0x20
[   29.363374] 
[   29.363449] The buggy address belongs to the physical page:
[   29.363566] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b00
[   29.363681] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   29.363845] raw: 0bfffe0000000000 ffffc1ffc326c108 fff00000da456d00 0000000000000000
[   29.363895] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   29.363964] page dumped because: kasan: bad access detected
[   29.364242] 
[   29.364306] Memory state around the buggy address:
[   29.364413]  fff00000c9afff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.364576]  fff00000c9afff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.364661] >fff00000c9b00000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.364709]                    ^
[   29.364744]  fff00000c9b00080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.364881]  fff00000c9b00100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   29.364937] ==================================================================

Metadata Full log Test run details

arch

arm64

host

x86_64

plan

2zrVzYzOpEW4XHiYds9jEwikFK7

job_id

TEST:linaro@lkft#2zrW4gkgpPvPvyu1JhrLI5SfZ9n

job_url

https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2zrW4gkgpPvPvyu1JhrLI5SfZ9n

artefacts

kernel

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2zrW17i5CHwMjQFrMEumC4tgHQD/Image.gz
sha256sum	f1b1de68ab66795221ea7af2c885166039edc905709ae2b868dbc429ffb32d0d

rootfs

url	https://storage.tuxboot.com/debian/20250617/trixie/arm64/rootfs.ext4.xz
sha256sum	1eaaae772692e22cefec5345d642e254407cec1431dd51a20007af2a1819b610

modules

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2zrW17i5CHwMjQFrMEumC4tgHQD/modules.tar.xz
sha256sum	94a5b5b8edfcc1ec8f65ff9d692207a782ba849df77dd9baa05c20bf5972d8f6

durations

tests

boot	0
kunit	174.68

host_arch

amd64

build_name

gcc-13-lkftconfig-kunit

job_status

Complete

qemu_version

1:10.0.0+ds-1

[   23.750203] ==================================================================
[   23.750671] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2f1/0x340
[   23.751381] Read of size 1 at addr ffff888105978000 by task kunit_try_catch/197
[   23.752032] 
[   23.752207] CPU: 0 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G    B   W        N  6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary) 
[   23.752302] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   23.752316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.752361] Call Trace:
[   23.752378]  <TASK>
[   23.752398]  dump_stack_lvl+0x73/0xb0
[   23.752434]  print_report+0xd1/0x610
[   23.752457]  ? __virt_addr_valid+0x1db/0x2d0
[   23.752482]  ? kmalloc_large_uaf+0x2f1/0x340
[   23.752501]  ? kasan_addr_to_slab+0x11/0xa0
[   23.752521]  ? kmalloc_large_uaf+0x2f1/0x340
[   23.752550]  kasan_report+0x141/0x180
[   23.752571]  ? kmalloc_large_uaf+0x2f1/0x340
[   23.752595]  __asan_report_load1_noabort+0x18/0x20
[   23.752629]  kmalloc_large_uaf+0x2f1/0x340
[   23.752649]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   23.752680]  ? __pfx_kmalloc_large_uaf+0x10/0x10
[   23.752704]  kunit_try_run_case+0x1a5/0x480
[   23.752744]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.752765]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.752790]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.752813]  ? __kthread_parkme+0x82/0x180
[   23.752835]  ? preempt_count_sub+0x50/0x80
[   23.752858]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.752879]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.752910]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.752956]  kthread+0x337/0x6f0
[   23.752976]  ? trace_preempt_on+0x20/0xc0
[   23.753001]  ? __pfx_kthread+0x10/0x10
[   23.753021]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.753042]  ? calculate_sigpending+0x7b/0xa0
[   23.753065]  ? __pfx_kthread+0x10/0x10
[   23.753086]  ret_from_fork+0x116/0x1d0
[   23.753106]  ? __pfx_kthread+0x10/0x10
[   23.753126]  ret_from_fork_asm+0x1a/0x30
[   23.753158]  </TASK>
[   23.753171] 
[   23.760858] The buggy address belongs to the physical page:
[   23.761166] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105978
[   23.761523] flags: 0x200000000000000(node=0|zone=2)
[   23.761822] raw: 0200000000000000 ffffea0004165f08 ffff888154639fc0 0000000000000000
[   23.762168] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   23.762502] page dumped because: kasan: bad access detected
[   23.762720] 
[   23.762821] Memory state around the buggy address:
[   23.763123]  ffff888105977f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.763332]  ffff888105977f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.763532] >ffff888105978000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.764086]                    ^
[   23.764252]  ffff888105978080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.764652]  ffff888105978100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   23.765158] ==================================================================

Metadata Full log Test run details

arch

x86_64

host

x86_64

plan

2zrVzYzOpEW4XHiYds9jEwikFK7

job_id

TEST:linaro@lkft#2zrW5XeyUzOSFr9BpBP7b7OYkHS

job_url

https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2zrW5XeyUzOSFr9BpBP7b7OYkHS

artefacts

kernel

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2zrW2SH9xrBCbgawOpHg8puHqCe/bzImage
sha256sum	4565f21e261caec61f0904b87ff9eab2fa750b37970854db3ef378370e96c96a

rootfs

url	https://storage.tuxboot.com/debian/20250617/trixie/amd64/rootfs.ext4.xz
sha256sum	a7dcdb286e1265c85a4d6cd5429adc51604a3ebde1d9a3c934aef78862d5fee4

modules

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2zrW2SH9xrBCbgawOpHg8puHqCe/modules.tar.xz
sha256sum	25191cedf68988510c88d39b245d9f83740d3133c412cf5e2b129a6de7adb415

durations

tests

boot	0
kunit	230.83

host_arch

amd64

build_name

gcc-13-lkftconfig-kunit

job_status

Complete

qemu_version

1:10.0.0+ds-1

Metadata

Failure - e850-96 - gcc-13-lkftconfig-kunit

Failure - qemu-arm64 - gcc-13-lkftconfig-kunit

Failure - qemu-x86_64 - gcc-13-lkftconfig-kunit