Hay
Date
April 20, 2025, 11:09 p.m.

Environment
x15
x86

[   57.059814] ==================================================================
[   57.074340] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x1f4/0x3a8
[   57.081787] Read of size 1 at addr cc22c380 by task kunit_try_catch/248
[   57.088439] 
[   57.089935] CPU: 1 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G    B   W        N  6.15.0-rc3 #1 NONE 
[   57.089965] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   57.089996] Hardware name: Generic DRA74X (Flattened Device Tree)
[   57.089996] Call trace: 
[   57.089996]  unwind_backtrace from show_stack+0x18/0x1c
[   57.090026]  show_stack from dump_stack_lvl+0x70/0x90
[   57.090057]  dump_stack_lvl from print_report+0x158/0x528
[   57.090087]  print_report from kasan_report+0xdc/0x118
[   57.090087]  kasan_report from __kasan_check_byte+0x34/0x3c
[   57.090118]  __kasan_check_byte from kfree_sensitive+0x20/0x6c
[   57.090148]  kfree_sensitive from kmalloc_double_kzfree+0x1f4/0x3a8
[   57.090179]  kmalloc_double_kzfree from kunit_try_run_case+0x22c/0x5a8
[   57.090209]  kunit_try_run_case from kunit_generic_run_threadfn_adapter+0xc4/0x128
[   57.090209]  kunit_generic_run_threadfn_adapter from kthread+0x464/0x810
[   57.090240]  kthread from ret_from_fork+0x14/0x20
[   57.090270] Exception stack(0xf24dbfb0 to 0xf24dbff8)
[   57.090270] bfa0:                                     00000000 00000000 00000000 00000000
[   57.090301] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   57.090332] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[   57.090332] 
[   57.207611] Allocated by task 248:
[   57.211029]  kasan_save_track+0x30/0x5c
[   57.214904]  __kasan_kmalloc+0x8c/0x94
[   57.218688]  kmalloc_double_kzfree+0xcc/0x3a8
[   57.223083]  kunit_try_run_case+0x22c/0x5a8
[   57.227294]  kunit_generic_run_threadfn_adapter+0xc4/0x128
[   57.232818]  kthread+0x464/0x810
[   57.236083]  ret_from_fork+0x14/0x20
[   57.239685] 
[   57.241180] Freed by task 248:
[   57.244262]  kasan_save_track+0x30/0x5c
[   57.248138]  kasan_save_free_info+0x3c/0x48
[   57.252349]  __kasan_slab_free+0x40/0x50
[   57.256317]  kfree+0xe8/0x384
[   57.259307]  kmalloc_double_kzfree+0x174/0x3a8
[   57.263793]  kunit_try_run_case+0x22c/0x5a8
[   57.268005]  kunit_generic_run_threadfn_adapter+0xc4/0x128
[   57.273529]  kthread+0x464/0x810
[   57.276794]  ret_from_fork+0x14/0x20
[   57.280395] 
[   57.281890] The buggy address belongs to the object at cc22c380
[   57.281890]  which belongs to the cache kmalloc-64 of size 64
[   57.293609] The buggy address is located 0 bytes inside of
[   57.293609]  freed 64-byte region [cc22c380, cc22c3c0)
[   57.304290] 
[   57.305786] The buggy address belongs to the physical page:
[   57.311401] page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8c22c
[   57.318664] flags: 0x0(zone=0)
[   57.321746] page_type: f5(slab)
[   57.324920] raw: 00000000 c7001300 00000122 00000000 00000000 80200020 f5000000 00000000
[   57.333068] raw: 00000000
[   57.335693] page dumped because: kasan: bad access detected
[   57.341308] 
[   57.342803] Memory state around the buggy address:
[   57.347625]  cc22c280: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.354217]  cc22c300: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.360778] >cc22c380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   57.367340]            ^
[   57.369903]  cc22c400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.376464]  cc22c480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.383056] ==================================================================

[   28.278017] ==================================================================
[   28.292463] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350
[   28.299865] Read of size 1 at addr ffff888105b98560 by task kunit_try_catch/235
[   28.307178] 
[   28.308716] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc3 #1 PREEMPT(voluntary) 
[   28.308724] Tainted: [B]=BAD_PAGE, [N]=TEST
[   28.308739] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021
[   28.308742] Call Trace:
[   28.308744]  <TASK>
[   28.308746]  dump_stack_lvl+0x73/0xb0
[   28.308750]  print_report+0xd1/0x650
[   28.308754]  ? __virt_addr_valid+0x1db/0x2d0
[   28.308758]  ? kmalloc_double_kzfree+0x19c/0x350
[   28.308762]  ? kasan_complete_mode_report_info+0x64/0x200
[   28.308766]  ? kmalloc_double_kzfree+0x19c/0x350
[   28.308770]  kasan_report+0x141/0x180
[   28.308775]  ? kmalloc_double_kzfree+0x19c/0x350
[   28.308780]  ? kmalloc_double_kzfree+0x19c/0x350
[   28.308784]  __kasan_check_byte+0x3d/0x50
[   28.308788]  kfree_sensitive+0x22/0x90
[   28.308792]  kmalloc_double_kzfree+0x19c/0x350
[   28.308797]  ? __pfx_kmalloc_double_kzfree+0x10/0x10
[   28.308801]  ? __schedule+0x10cc/0x2b30
[   28.308806]  ? ktime_get_ts64+0x83/0x230
[   28.308810]  kunit_try_run_case+0x1a2/0x480
[   28.308815]  ? __pfx_kunit_try_run_case+0x10/0x10
[   28.308819]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   28.308823]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   28.308828]  ? __kthread_parkme+0x82/0x180
[   28.308832]  ? preempt_count_sub+0x50/0x80
[   28.308836]  ? __pfx_kunit_try_run_case+0x10/0x10
[   28.308840]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   28.308844]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   28.308848]  kthread+0x334/0x6f0
[   28.308852]  ? trace_preempt_on+0x20/0xc0
[   28.308857]  ? __pfx_kthread+0x10/0x10
[   28.308861]  ? _raw_spin_unlock_irq+0x47/0x80
[   28.308865]  ? calculate_sigpending+0x7b/0xa0
[   28.308869]  ? __pfx_kthread+0x10/0x10
[   28.308873]  ret_from_fork+0x3e/0x80
[   28.308877]  ? __pfx_kthread+0x10/0x10
[   28.308881]  ret_from_fork_asm+0x1a/0x30
[   28.308887]  </TASK>
[   28.308888] 
[   28.480912] Allocated by task 235:
[   28.484317]  kasan_save_stack+0x45/0x70
[   28.488156]  kasan_save_track+0x18/0x40
[   28.491994]  kasan_save_alloc_info+0x3b/0x50
[   28.496267]  __kasan_kmalloc+0xb7/0xc0
[   28.500021]  __kmalloc_cache_noprof+0x189/0x420
[   28.504551]  kmalloc_double_kzfree+0xa9/0x350
[   28.508913]  kunit_try_run_case+0x1a2/0x480
[   28.513105]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   28.518504]  kthread+0x334/0x6f0
[   28.521762]  ret_from_fork+0x3e/0x80
[   28.525342]  ret_from_fork_asm+0x1a/0x30
[   28.529270] 
[   28.530766] Freed by task 235:
[   28.533827]  kasan_save_stack+0x45/0x70
[   28.537686]  kasan_save_track+0x18/0x40
[   28.541532]  kasan_save_free_info+0x3f/0x60
[   28.545760]  __kasan_slab_free+0x56/0x70
[   28.549699]  kfree+0x222/0x3f0
[   28.552807]  kfree_sensitive+0x67/0x90
[   28.556560]  kmalloc_double_kzfree+0x12b/0x350
[   28.561013]  kunit_try_run_case+0x1a2/0x480
[   28.565199]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   28.570599]  kthread+0x334/0x6f0
[   28.573832]  ret_from_fork+0x3e/0x80
[   28.577420]  ret_from_fork_asm+0x1a/0x30
[   28.581344] 
[   28.582843] The buggy address belongs to the object at ffff888105b98560
[   28.582843]  which belongs to the cache kmalloc-16 of size 16
[   28.595185] The buggy address is located 0 bytes inside of
[   28.595185]  freed 16-byte region [ffff888105b98560, ffff888105b98570)
[   28.607188] 
[   28.608699] The buggy address belongs to the physical page:
[   28.614311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b98
[   28.622319] flags: 0x200000000000000(node=0|zone=2)
[   28.627196] page_type: f5(slab)
[   28.630346] raw: 0200000000000000 ffff888100042640 dead000000000122 0000000000000000
[   28.638093] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   28.645840] page dumped because: kasan: bad access detected
[   28.651412] 
[   28.652911] Memory state around the buggy address:
[   28.657703]  ffff888105b98400: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   28.664949]  ffff888105b98480: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 06 fc fc
[   28.672167] >ffff888105b98500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   28.679385]                                                        ^
[   28.685764]  ffff888105b98580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   28.692984]  ffff888105b98600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   28.700201] ==================================================================