From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f179.google.com (mail-qk1-f179.google.com [209.85.222.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 95AFD12CD8B for ; Mon, 15 Jun 2026 02:27:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781490476; cv=none; b=aY21mQfN+2xLw07m0IUTBoQpR/MnngXZyiwnIW8JU7UhMnpX3JBNs7ft5D4DlY0/oQVj4UjwR57akbZHe3rRRec3YUmm/2l3ejczJHHqYFOwZ5CLVpiZx6dwRCrCt1jaBZGWB1q6jTUgRV+XK6YzSo52pWjTPsHjKDMfzLWUXFo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781490476; c=relaxed/simple; bh=kKSaQO8gNVspzPmkbXnYyZtkl7T31dZR0VUBnwCP27M=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=RwueeJVemax9HqCB4REgMBvnHPFvRnfg28/SH1FlP11B0B/HuXWQzB6quVQL4rHXBZ00KaGsDLn0v3OCDeWqPOPQSFtj8mPtzvMgW1e2/ePoGNHrrIbYXpII2VsoeJDsyhbR8FgIavD3GevBKJ/OBjjnubxR8FYOQPjImPd+PxA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fmWzZAim; arc=none smtp.client-ip=209.85.222.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fmWzZAim" Received: by mail-qk1-f179.google.com with SMTP id af79cd13be357-9156b74006aso168804785a.0 for ; Sun, 14 Jun 2026 19:27:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781490470; x=1782095270; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=aBmRQVmPIG21njKWSCKU8soziCiefwmEo3kQcto0EfE=; b=fmWzZAimHlBWIkcA8a1j36ncrVck2nHIY5eUvi3D7Fq3jHcMXPI3sp01evn1RMMg+H GrQZT3BcHB3xmsB2408FwcEeLHIaV3uIE7cB6S3jTyQqeOYv8gEpdw2/h6wlr+6SLcOh CV2ZLY6HCr8ciN8L4vwPskzIjJnOzlLplCEinbiBqx0IaIUMtRxEK99xDwjIYGNsibjZ VURW4Lpbpv4mrTHBmcGNtPKzPtasgNefEws9AwBaZsQbYzjrKPrO32IvlUcjqXV8Spuj d5d75+B1yGf0NZcHMISwos405amhiD94x1Lm2iNKtLD3fJnH92e3X7TaYlp/oXd6AYNX xVzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781490470; x=1782095270; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=aBmRQVmPIG21njKWSCKU8soziCiefwmEo3kQcto0EfE=; b=fmTrYy/6jc0752M714hhA2dtL6T8vNuSvkJDVp9M9JGwuS/XPObNBUjSIIm7LfLwNA ZNDuamkxl4IlZR8R6XNjWs7TKcja8+7asFSFOu3ry0u+Oo/mGTpvoabDYzp7YCuqMHZK voddKT9qb7U2BNeW4FE30aZEdH//6bEOo3IDjjDVYGv7yavgZPibDdIzTszo6a+TLiKY jqRPi2/WRJMif3frXNPN01XGeEOVKSmcCE+lpoNpB6lHRloybi33SLvLKvPR2Px2cUKw 3FzBA1L9oJgv36lrdGvS6pWODv9+5iUBVkA9hYIDpBfKBW/hfDR3lhrp+0bOo+DAAY6V Ll5Q== X-Forwarded-Encrypted: i=1; AFNElJ+OMxfTZnRMGxhxkD/Qdoezrluv7oUN59O8TTbt5PuVUJNpBd9Zfdjh0+Cs9frOYJLyO8X7VhsVdNDlfb0=@vger.kernel.org X-Gm-Message-State: AOJu0YwjXfkwIUH2ra6OQ31IkG2QGpl2ek9OmH67I609XKZdaUmZCcvm MmwbI8pREzT++1zBZmPodLGlRjW4Ejh9a2dpd8iUn+gBcjcCWQw/2XCn X-Gm-Gg: Acq92OEIYgSxCVt9jJ03shPjrgqlQCYbdAe28laLFhekIqVwMwDI73T31QEIBeO2iey lKq8Uyuzjc26ZkJjy72ZI6dudXm8ayQh6zeUlCNe+Aue1QlsRjnu/E17gfd1kK9xzJiFePsPdaJ 8edh+HP/nDi5APLWKo5hYI2n6xEDav1Z61BvgTpB5Zp16D2e4aUq0OgEJfuTVpWyuT31zm5tLRm UNUl8fn/KPgBut0HzF1G7pD7QKY2t6Be8VyFlId7uFPFbUtSWUCMm17QkGkwHCtkWFC6AMH4pMw aGLTo+wg3OLSCKKXeW7eIsfnL8V9cPL8f3ODMmMN9rTreixNR7xMK4F5BgTQ/GIR6KmMP4qtt+j 8025GkZeFegsoqvmhXqfp21tzQptMTxMZ4PltApxTOt96AmdFZVYpqXp53aKIG0/jgOGReFDrCi GY3tjXEL6kng9gMfLW7uR7Y1JDic+Cd3UnEnj/lLs3tzDenheln7ZxpB2NGMd/Mc1i7JeirA== X-Received: by 2002:a05:620a:2913:b0:915:6437:bbb7 with SMTP id af79cd13be357-9161bbfb66fmr1964105685a.14.1781490470480; Sun, 14 Jun 2026 19:27:50 -0700 (PDT) Received: from localhost.localdomain ([2601:985:4601:5df0:2106:6ce9:6b1:8f70]) by smtp.gmail.com with ESMTPSA id af79cd13be357-91619ed7540sm958696885a.9.2026.06.14.19.27.49 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 14 Jun 2026 19:27:50 -0700 (PDT) From: Shuangpeng Bai To: kashyap.desai@broadcom.com, sumit.saxena@broadcom.com, shivasharan.srikanteshwara@broadcom.com, chandrakanth.patil@broadcom.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, megaraidlinux.pdl@broadcom.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [BUG] KASAN: slab-use-after-free in is_free_buddy_page from megaraid_sas Date: Sun, 14 Jun 2026 22:27:48 -0400 Message-ID: <178144969601.60470.12499376837330329541@gmail.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <178144969601.60470.16745418177798279969@gmail.com> References: <178144969601.60470.16745418177798279969@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, I hit another KASAN report that may be related to this megaraid_sas management ioctl lifetime issue. I have not confirmed that it has the same root cause, but this report trips earlier in megasas_mgmt_ioctl_fw(), while accessing instance->requestorId after megasas_lookup_instance(). The issue was reproduced by racing MEGASAS_IOC_FIRMWARE ioctls against unbind/bind of the megaraid_sas PCI device. KASAN: use-after-free in megasas_mgmt_ioctl_fw I reproduced this on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) To help trigger the bug more reliably, we applied a minimal diagnostic patch that only adds a delay. The reproducer and .config files are here. https://gist.github.com/shuangpengbai/72dca59b156aed25639db779bafdf7e4 I'm happy to test debug patches or provide additional information. Reported-by: Shuangpeng Bai [ 1445.240069][ T8341] BUG: KASAN: use-after-free in megasas_mgmt_ioctl_fw (drivers/scsi/megaraid/megaraid_sas_base.c:8546) [ 1445.242466][ T8341] Read of size 1 at addr ffff888115b7d909 by task repro_megasas_l/8341 [ 1445.244862][ T8341] [ 1445.245578][ T8341] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1445.245586][ T8341] Call Trace: [ 1445.245595][ T8341] [ 1445.245601][ T8341] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 1445.245617][ T8341] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) [ 1445.245670][ T8341] kasan_report (mm/kasan/report.c:595) [ 1445.245697][ T8341] megasas_mgmt_ioctl_fw (drivers/scsi/megaraid/megaraid_sas_base.c:8546) [ 1445.245721][ T8341] megasas_mgmt_ioctl (drivers/scsi/megaraid/megaraid_sas_base.c:8630) [ 1445.245731][ T8341] __se_sys_ioctl (fs/ioctl.c:51 fs/ioctl.c:597 fs/ioctl.c:583) [ 1445.245741][ T8341] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 1445.245772][ T8341] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 1445.245783][ T8341] RIP: 0033:0x7f11ae510237 [ 1445.245794][ T8341] Code: 00 00 00 48 8b 05 59 cc 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 29 cc 0d 00 f7 d8 64 89 01 48 [ 1445.245804][ T8341] RSP: 002b:00007f11ae41ad38 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [ 1445.245819][ T8341] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f11ae510237 [ 1445.245827][ T8341] RDX: 00007f11ae41ad40 RSI: 00000000c1944d01 RDI: 0000000000000003 [ 1445.245834][ T8341] RBP: 00007f11ae41ad40 R08: 0000000000000000 R09: 00007f11ae41b700 [ 1445.245840][ T8341] R10: fffffffffffff7ee R11: 0000000000000202 R12: 0000000000000003 [ 1445.245846][ T8341] R13: 00007ffe50e3399f R14: 00007f11ae41afc0 R15: 0000000000802000 [ 1445.245859][ T8341] [ 1445.245863][ T8341] Best, Shuangpeng