While running LTP tracing on arm64 juno with kasan config enabled this kernel BUG triggered. metadata: git branch: linux-4.14.y git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git kernel-config: https://builds.tuxbuild.com/oTHtWrmNsVQa9iuCfXJTQA/kernel.config steps to reproduce: # Boot arm64 juno with trace configs enabled ^. # cd /opt/ltp # ./runltp -f tracing ftrace_buffer_size_kb.sh: line 33: echo: write error: Cannot allocate memory ftrace_buffer_size_kb.sh: line 33: echo: write error: Cannot allocate memory [ 137.218462] ================================================================== [ 137.225924] BUG: KASAN: use-after-free in prepare_ftrace_return+0x88/0x140 [ 137.232999] Read of size 8 at addr ffff80090202e0c8 by task sh/3123 [ 137.239460] [ 137.241144] CPU: 2 PID: 3123 Comm: sh Not tainted 4.14.194 #1 [ 137.247086] Hardware name: ARM Juno development board (r2) (DT) [ 137.253202] Call trace: [ 137.255850] dump_backtrace+0x0/0x230 [ 137.259703] [ 137.261381] Allocated by task 297879680: [ 137.265510] Unable to handle kernel paging request at virtual address ffff20000bf29bc0 [ 137.273626] Mem abort info: [ 137.276609] Exception class = DABT (current EL), IL = 32 bits [ 137.282721] SET = 0, FnV = 0 [ 137.285963] EA = 0, S1PTW = 0 [ 137.289289] Data abort info: [ 137.292357] ISV = 0, ISS = 0x00000007 [ 137.296380] CM = 0, WnR = 0 [ 137.299537] swapper pgtable: 4k pages, 48-bit VAs, pgd = ffff20000afb8000 [ 137.306520] [ffff20000bf29bc0] *pgd=00000009ffffe003, *pud=00000009ffffd003, *pmd=0000000994f00003, *pte=0000000000000000 [ 137.318072] Internal error: Oops: 96000007 [#1] PREEMPT SMP [ 137.323849] Modules linked in: crc32_ce crct10dif_ce fuse [ 137.329831] Process sh (pid: 3123, stack limit = 0xffff800902050000) [ 137.336389] CPU: 2 PID: 3123 Comm: sh Not tainted 4.14.194 #1 [ 137.342328] Hardware name: ARM Juno development board (r2) (DT) [ 137.348444] task: ffff800911c14880 task.stack: ffff800902050000 [ 137.354572] pc : depot_fetch_stack+0x14/0x38 [ 137.359045] lr : print_track.isra.0+0x48/0x74 [ 137.363593] sp : ffff80090202df20 pstate : 200001c5 [ 137.368661] x29: ffff80090202df20 x28: ffff200009e0e090 [ 137.374356] x27: ffff8009096ec200 x26: ffff200009e0e1c4 [ 137.380052] x25: ffff80090202e0ec x24: ffff80090202e0e0 [ 137.385746] x23: ffff8009365b6e00 x22: ffff200009adc7d0 [ 137.391441] x21: 0000000011c14880 x20: ffff200009ac76b0 [ 137.397136] x19: ffff80090202e0e4 x18: 0000000000000000 [ 137.402830] x17: 0000000000000000 x16: 0000000000000000 [ 137.408523] x15: 0000000000000000 x14: 3d3d3d3d3d3d3d3d [ 137.414218] x13: 3d3d3d3d3d3d3d3d x12: 1ffff00120405b89 [ 137.419912] x11: ffff100120405b89 x10: dfff200000000000 [ 137.425606] x9 : ffff100120405b8a x8 : 0000000000000004 [ 137.431301] x7 : 0000000000000001 x6 : 0000000000000003 [ 137.436994] x5 : ffff100120405b89 x4 : 0000000000000000 [ 137.442688] x3 : 00000000001f8009 x2 : ffff20000af69b78 [ 137.448382] x1 : ffff80090202df58 x0 : 0000000000003ff0 [ 137.454079] Call trace: [ 137.456722] Code: f0014322 912de042 d3557800 d37c2400 (f8637842) [ 137.463087] ---[ end trace 81665fb4c270025f ]--- [ 137.467908] note: sh[3123] exited with preempt_count 2 full test log, https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.195-92-g54fa008d06cd/testrun/3149565/suite/linux-log-parser/test/check-kernel-bug-1727638/log -- Linaro LKFT https://lkft.linaro.org
