Hay
Date
May 23, 2025, 11:07 p.m.

Environment
qemu-arm64

[   29.557879] ==================================================================
[   29.558134] BUG: KFENCE: use-after-free read in kmem_cache_destroy+0x50/0x218
[   29.558134] 
[   29.558365] Use-after-free read at 0x0000000081c36094 (in kfence-#124):
[   29.562242]  kmem_cache_destroy+0x50/0x218
[   29.562509]  kmem_cache_double_destroy+0x174/0x300
[   29.562667]  kunit_try_run_case+0x170/0x3f0
[   29.562825]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.562994]  kthread+0x328/0x630
[   29.563136]  ret_from_fork+0x10/0x20
[   29.563283] 
[   29.563362] kfence-#124: 0x000000007e2f2ffa-0x0000000077174264, size=208, cache=kmem_cache
[   29.563362] 
[   29.564189] allocated by task 217 on cpu 0 at 29.526895s (0.037149s ago):
[   29.565392]  __kmem_cache_create_args+0x178/0x280
[   29.566303]  kmem_cache_double_destroy+0xc0/0x300
[   29.566928]  kunit_try_run_case+0x170/0x3f0
[   29.567113]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.567284]  kthread+0x328/0x630
[   29.567442]  ret_from_fork+0x10/0x20
[   29.567605] 
[   29.567712] freed by task 217 on cpu 0 at 29.551974s (0.015700s ago):
[   29.569199]  slab_kmem_cache_release+0x38/0x50
[   29.569592]  kmem_cache_release+0x1c/0x30
[   29.570033]  kobject_put+0x17c/0x430
[   29.570286]  sysfs_slab_release+0x1c/0x30
[   29.570419]  kmem_cache_destroy+0x118/0x218
[   29.570653]  kmem_cache_double_destroy+0x128/0x300
[   29.570777]  kunit_try_run_case+0x170/0x3f0
[   29.570895]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.571027]  kthread+0x328/0x630
[   29.571655]  ret_from_fork+0x10/0x20
[   29.572314] 
[   29.572468] CPU: 0 UID: 0 PID: 217 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc7 #1 PREEMPT 
[   29.572987] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.573180] Hardware name: linux,dummy-virt (DT)
[   29.573298] ==================================================================