Hay
Date
July 10, 2025, 11:10 p.m.

Environment
qemu-arm64
qemu-x86_64

[   16.704314] ==================================================================
[   16.704415] BUG: KASAN: double-free in kmem_cache_double_free+0x190/0x3c8
[   16.704789] Free of addr fff00000c6419000 by task kunit_try_catch/209
[   16.704834] 
[   16.704879] CPU: 1 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT 
[   16.704967] Tainted: [B]=BAD_PAGE, [N]=TEST
[   16.704995] Hardware name: linux,dummy-virt (DT)
[   16.705029] Call trace:
[   16.705053]  show_stack+0x20/0x38 (C)
[   16.705424]  dump_stack_lvl+0x8c/0xd0
[   16.705509]  print_report+0x118/0x608
[   16.705561]  kasan_report_invalid_free+0xc0/0xe8
[   16.705692]  check_slab_allocation+0xd4/0x108
[   16.705755]  __kasan_slab_pre_free+0x2c/0x48
[   16.705881]  kmem_cache_free+0xf0/0x468
[   16.705935]  kmem_cache_double_free+0x190/0x3c8
[   16.706275]  kunit_try_run_case+0x170/0x3f0
[   16.706374]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.706497]  kthread+0x328/0x630
[   16.706576]  ret_from_fork+0x10/0x20
[   16.706727] 
[   16.706802] Allocated by task 209:
[   16.706861]  kasan_save_stack+0x3c/0x68
[   16.707113]  kasan_save_track+0x20/0x40
[   16.707404]  kasan_save_alloc_info+0x40/0x58
[   16.707471]  __kasan_slab_alloc+0xa8/0xb0
[   16.707603]  kmem_cache_alloc_noprof+0x10c/0x398
[   16.707679]  kmem_cache_double_free+0x12c/0x3c8
[   16.707780]  kunit_try_run_case+0x170/0x3f0
[   16.707904]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.707979]  kthread+0x328/0x630
[   16.708054]  ret_from_fork+0x10/0x20
[   16.708271] 
[   16.708440] Freed by task 209:
[   16.708569]  kasan_save_stack+0x3c/0x68
[   16.708627]  kasan_save_track+0x20/0x40
[   16.708759]  kasan_save_free_info+0x4c/0x78
[   16.708827]  __kasan_slab_free+0x6c/0x98
[   16.708866]  kmem_cache_free+0x260/0x468
[   16.708933]  kmem_cache_double_free+0x140/0x3c8
[   16.709160]  kunit_try_run_case+0x170/0x3f0
[   16.709345]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.709411]  kthread+0x328/0x630
[   16.710100]  ret_from_fork+0x10/0x20
[   16.710182] 
[   16.710203] The buggy address belongs to the object at fff00000c6419000
[   16.710203]  which belongs to the cache test_cache of size 200
[   16.710278] The buggy address is located 0 bytes inside of
[   16.710278]  200-byte region [fff00000c6419000, fff00000c64190c8)
[   16.710359] 
[   16.710613] The buggy address belongs to the physical page:
[   16.710699] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106419
[   16.711118] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   16.711185] page_type: f5(slab)
[   16.711228] raw: 0bfffe0000000000 fff00000c56963c0 dead000000000122 0000000000000000
[   16.711801] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000
[   16.711853] page dumped because: kasan: bad access detected
[   16.711968] 
[   16.712483] Memory state around the buggy address:
[   16.712546]  fff00000c6418f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.712602]  fff00000c6418f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.712698] >fff00000c6419000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   16.712776]                    ^
[   16.712864]  fff00000c6419080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[   16.712933]  fff00000c6419100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.713039] ==================================================================

[   13.394868] ==================================================================
[   13.395630] BUG: KASAN: double-free in kmem_cache_double_free+0x1e5/0x480
[   13.395865] Free of addr ffff888102d74000 by task kunit_try_catch/226
[   13.396063] 
[   13.396153] CPU: 1 UID: 0 PID: 226 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   13.396200] Tainted: [B]=BAD_PAGE, [N]=TEST
[   13.396212] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   13.396231] Call Trace:
[   13.396242]  <TASK>
[   13.396257]  dump_stack_lvl+0x73/0xb0
[   13.396287]  print_report+0xd1/0x650
[   13.396309]  ? __virt_addr_valid+0x1db/0x2d0
[   13.396333]  ? kasan_complete_mode_report_info+0x64/0x200
[   13.396355]  ? kmem_cache_double_free+0x1e5/0x480
[   13.396445]  kasan_report_invalid_free+0x10a/0x130
[   13.396487]  ? kmem_cache_double_free+0x1e5/0x480
[   13.396515]  ? kmem_cache_double_free+0x1e5/0x480
[   13.396540]  check_slab_allocation+0x101/0x130
[   13.396562]  __kasan_slab_pre_free+0x28/0x40
[   13.396726]  kmem_cache_free+0xed/0x420
[   13.396747]  ? kmem_cache_alloc_noprof+0x123/0x3f0
[   13.396803]  ? kmem_cache_double_free+0x1e5/0x480
[   13.396831]  kmem_cache_double_free+0x1e5/0x480
[   13.396867]  ? __pfx_kmem_cache_double_free+0x10/0x10
[   13.396892]  ? finish_task_switch.isra.0+0x153/0x700
[   13.396915]  ? __switch_to+0x47/0xf50
[   13.396942]  ? __pfx_read_tsc+0x10/0x10
[   13.396963]  ? ktime_get_ts64+0x86/0x230
[   13.396986]  kunit_try_run_case+0x1a5/0x480
[   13.397010]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.397032]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   13.397057]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   13.397080]  ? __kthread_parkme+0x82/0x180
[   13.397101]  ? preempt_count_sub+0x50/0x80
[   13.397123]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.397147]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.397202]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   13.397227]  kthread+0x337/0x6f0
[   13.397246]  ? trace_preempt_on+0x20/0xc0
[   13.397305]  ? __pfx_kthread+0x10/0x10
[   13.397326]  ? _raw_spin_unlock_irq+0x47/0x80
[   13.397440]  ? calculate_sigpending+0x7b/0xa0
[   13.397465]  ? __pfx_kthread+0x10/0x10
[   13.397486]  ret_from_fork+0x116/0x1d0
[   13.397505]  ? __pfx_kthread+0x10/0x10
[   13.397525]  ret_from_fork_asm+0x1a/0x30
[   13.397556]  </TASK>
[   13.397566] 
[   13.406258] Allocated by task 226:
[   13.406510]  kasan_save_stack+0x45/0x70
[   13.406770]  kasan_save_track+0x18/0x40
[   13.406969]  kasan_save_alloc_info+0x3b/0x50
[   13.407181]  __kasan_slab_alloc+0x91/0xa0
[   13.407489]  kmem_cache_alloc_noprof+0x123/0x3f0
[   13.407767]  kmem_cache_double_free+0x14f/0x480
[   13.407994]  kunit_try_run_case+0x1a5/0x480
[   13.408250]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.408601]  kthread+0x337/0x6f0
[   13.408730]  ret_from_fork+0x116/0x1d0
[   13.408863]  ret_from_fork_asm+0x1a/0x30
[   13.409063] 
[   13.409158] Freed by task 226:
[   13.409450]  kasan_save_stack+0x45/0x70
[   13.409672]  kasan_save_track+0x18/0x40
[   13.409938]  kasan_save_free_info+0x3f/0x60
[   13.410161]  __kasan_slab_free+0x56/0x70
[   13.410412]  kmem_cache_free+0x249/0x420
[   13.410599]  kmem_cache_double_free+0x16a/0x480
[   13.410827]  kunit_try_run_case+0x1a5/0x480
[   13.411035]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.411296]  kthread+0x337/0x6f0
[   13.411484]  ret_from_fork+0x116/0x1d0
[   13.411665]  ret_from_fork_asm+0x1a/0x30
[   13.411840] 
[   13.411935] The buggy address belongs to the object at ffff888102d74000
[   13.411935]  which belongs to the cache test_cache of size 200
[   13.412581] The buggy address is located 0 bytes inside of
[   13.412581]  200-byte region [ffff888102d74000, ffff888102d740c8)
[   13.413060] 
[   13.413159] The buggy address belongs to the physical page:
[   13.413530] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102d74
[   13.413791] flags: 0x200000000000000(node=0|zone=2)
[   13.414078] page_type: f5(slab)
[   13.414251] raw: 0200000000000000 ffff888100ff4b40 dead000000000122 0000000000000000
[   13.414765] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000
[   13.415128] page dumped because: kasan: bad access detected
[   13.415501] 
[   13.415596] Memory state around the buggy address:
[   13.415873]  ffff888102d73f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   13.416227]  ffff888102d73f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   13.416568] >ffff888102d74000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   13.416945]                    ^
[   13.417114]  ffff888102d74080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[   13.417553]  ffff888102d74100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   13.417864] ==================================================================