Date
April 20, 2025, 11:09 p.m.
Environment | |
---|---|
x15 | |
x86 |
[ 57.059814] ================================================================== [ 57.074340] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x1f4/0x3a8 [ 57.081787] Read of size 1 at addr cc22c380 by task kunit_try_catch/248 [ 57.088439] [ 57.089935] CPU: 1 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B W N 6.15.0-rc3 #1 NONE [ 57.089965] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 57.089996] Hardware name: Generic DRA74X (Flattened Device Tree) [ 57.089996] Call trace: [ 57.089996] unwind_backtrace from show_stack+0x18/0x1c [ 57.090026] show_stack from dump_stack_lvl+0x70/0x90 [ 57.090057] dump_stack_lvl from print_report+0x158/0x528 [ 57.090087] print_report from kasan_report+0xdc/0x118 [ 57.090087] kasan_report from __kasan_check_byte+0x34/0x3c [ 57.090118] __kasan_check_byte from kfree_sensitive+0x20/0x6c [ 57.090148] kfree_sensitive from kmalloc_double_kzfree+0x1f4/0x3a8 [ 57.090179] kmalloc_double_kzfree from kunit_try_run_case+0x22c/0x5a8 [ 57.090209] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0xc4/0x128 [ 57.090209] kunit_generic_run_threadfn_adapter from kthread+0x464/0x810 [ 57.090240] kthread from ret_from_fork+0x14/0x20 [ 57.090270] Exception stack(0xf24dbfb0 to 0xf24dbff8) [ 57.090270] bfa0: 00000000 00000000 00000000 00000000 [ 57.090301] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 57.090332] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 57.090332] [ 57.207611] Allocated by task 248: [ 57.211029] kasan_save_track+0x30/0x5c [ 57.214904] __kasan_kmalloc+0x8c/0x94 [ 57.218688] kmalloc_double_kzfree+0xcc/0x3a8 [ 57.223083] kunit_try_run_case+0x22c/0x5a8 [ 57.227294] kunit_generic_run_threadfn_adapter+0xc4/0x128 [ 57.232818] kthread+0x464/0x810 [ 57.236083] ret_from_fork+0x14/0x20 [ 57.239685] [ 57.241180] Freed by task 248: [ 57.244262] kasan_save_track+0x30/0x5c [ 57.248138] kasan_save_free_info+0x3c/0x48 [ 57.252349] __kasan_slab_free+0x40/0x50 [ 57.256317] kfree+0xe8/0x384 [ 57.259307] kmalloc_double_kzfree+0x174/0x3a8 [ 57.263793] kunit_try_run_case+0x22c/0x5a8 [ 57.268005] kunit_generic_run_threadfn_adapter+0xc4/0x128 [ 57.273529] kthread+0x464/0x810 [ 57.276794] ret_from_fork+0x14/0x20 [ 57.280395] [ 57.281890] The buggy address belongs to the object at cc22c380 [ 57.281890] which belongs to the cache kmalloc-64 of size 64 [ 57.293609] The buggy address is located 0 bytes inside of [ 57.293609] freed 64-byte region [cc22c380, cc22c3c0) [ 57.304290] [ 57.305786] The buggy address belongs to the physical page: [ 57.311401] page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8c22c [ 57.318664] flags: 0x0(zone=0) [ 57.321746] page_type: f5(slab) [ 57.324920] raw: 00000000 c7001300 00000122 00000000 00000000 80200020 f5000000 00000000 [ 57.333068] raw: 00000000 [ 57.335693] page dumped because: kasan: bad access detected [ 57.341308] [ 57.342803] Memory state around the buggy address: [ 57.347625] cc22c280: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.354217] cc22c300: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.360778] >cc22c380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 57.367340] ^ [ 57.369903] cc22c400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.376464] cc22c480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.383056] ==================================================================
[ 28.278017] ================================================================== [ 28.292463] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350 [ 28.299865] Read of size 1 at addr ffff888105b98560 by task kunit_try_catch/235 [ 28.307178] [ 28.308716] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT(voluntary) [ 28.308724] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.308739] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021 [ 28.308742] Call Trace: [ 28.308744] <TASK> [ 28.308746] dump_stack_lvl+0x73/0xb0 [ 28.308750] print_report+0xd1/0x650 [ 28.308754] ? __virt_addr_valid+0x1db/0x2d0 [ 28.308758] ? kmalloc_double_kzfree+0x19c/0x350 [ 28.308762] ? kasan_complete_mode_report_info+0x64/0x200 [ 28.308766] ? kmalloc_double_kzfree+0x19c/0x350 [ 28.308770] kasan_report+0x141/0x180 [ 28.308775] ? kmalloc_double_kzfree+0x19c/0x350 [ 28.308780] ? kmalloc_double_kzfree+0x19c/0x350 [ 28.308784] __kasan_check_byte+0x3d/0x50 [ 28.308788] kfree_sensitive+0x22/0x90 [ 28.308792] kmalloc_double_kzfree+0x19c/0x350 [ 28.308797] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 28.308801] ? __schedule+0x10cc/0x2b30 [ 28.308806] ? ktime_get_ts64+0x83/0x230 [ 28.308810] kunit_try_run_case+0x1a2/0x480 [ 28.308815] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.308819] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 28.308823] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.308828] ? __kthread_parkme+0x82/0x180 [ 28.308832] ? preempt_count_sub+0x50/0x80 [ 28.308836] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.308840] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 28.308844] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.308848] kthread+0x334/0x6f0 [ 28.308852] ? trace_preempt_on+0x20/0xc0 [ 28.308857] ? __pfx_kthread+0x10/0x10 [ 28.308861] ? _raw_spin_unlock_irq+0x47/0x80 [ 28.308865] ? calculate_sigpending+0x7b/0xa0 [ 28.308869] ? __pfx_kthread+0x10/0x10 [ 28.308873] ret_from_fork+0x3e/0x80 [ 28.308877] ? __pfx_kthread+0x10/0x10 [ 28.308881] ret_from_fork_asm+0x1a/0x30 [ 28.308887] </TASK> [ 28.308888] [ 28.480912] Allocated by task 235: [ 28.484317] kasan_save_stack+0x45/0x70 [ 28.488156] kasan_save_track+0x18/0x40 [ 28.491994] kasan_save_alloc_info+0x3b/0x50 [ 28.496267] __kasan_kmalloc+0xb7/0xc0 [ 28.500021] __kmalloc_cache_noprof+0x189/0x420 [ 28.504551] kmalloc_double_kzfree+0xa9/0x350 [ 28.508913] kunit_try_run_case+0x1a2/0x480 [ 28.513105] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 28.518504] kthread+0x334/0x6f0 [ 28.521762] ret_from_fork+0x3e/0x80 [ 28.525342] ret_from_fork_asm+0x1a/0x30 [ 28.529270] [ 28.530766] Freed by task 235: [ 28.533827] kasan_save_stack+0x45/0x70 [ 28.537686] kasan_save_track+0x18/0x40 [ 28.541532] kasan_save_free_info+0x3f/0x60 [ 28.545760] __kasan_slab_free+0x56/0x70 [ 28.549699] kfree+0x222/0x3f0 [ 28.552807] kfree_sensitive+0x67/0x90 [ 28.556560] kmalloc_double_kzfree+0x12b/0x350 [ 28.561013] kunit_try_run_case+0x1a2/0x480 [ 28.565199] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 28.570599] kthread+0x334/0x6f0 [ 28.573832] ret_from_fork+0x3e/0x80 [ 28.577420] ret_from_fork_asm+0x1a/0x30 [ 28.581344] [ 28.582843] The buggy address belongs to the object at ffff888105b98560 [ 28.582843] which belongs to the cache kmalloc-16 of size 16 [ 28.595185] The buggy address is located 0 bytes inside of [ 28.595185] freed 16-byte region [ffff888105b98560, ffff888105b98570) [ 28.607188] [ 28.608699] The buggy address belongs to the physical page: [ 28.614311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b98 [ 28.622319] flags: 0x200000000000000(node=0|zone=2) [ 28.627196] page_type: f5(slab) [ 28.630346] raw: 0200000000000000 ffff888100042640 dead000000000122 0000000000000000 [ 28.638093] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 28.645840] page dumped because: kasan: bad access detected [ 28.651412] [ 28.652911] Memory state around the buggy address: [ 28.657703] ffff888105b98400: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 28.664949] ffff888105b98480: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 06 fc fc [ 28.672167] >ffff888105b98500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 28.679385] ^ [ 28.685764] ffff888105b98580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.692984] ffff888105b98600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.700201] ==================================================================