Date
July 17, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.530204] ================================================================== [ 15.530301] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308 [ 15.530436] Read of size 1 at addr fff00000c433ec60 by task kunit_try_catch/193 [ 15.530490] [ 15.530625] CPU: 0 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.530714] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.530741] Hardware name: linux,dummy-virt (DT) [ 15.530848] Call trace: [ 15.530909] show_stack+0x20/0x38 (C) [ 15.530962] dump_stack_lvl+0x8c/0xd0 [ 15.531027] print_report+0x118/0x5d0 [ 15.531072] kasan_report+0xdc/0x128 [ 15.531297] __kasan_check_byte+0x54/0x70 [ 15.531461] kfree_sensitive+0x30/0xb0 [ 15.531528] kmalloc_double_kzfree+0x168/0x308 [ 15.531628] kunit_try_run_case+0x170/0x3f0 [ 15.531706] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.531839] kthread+0x328/0x630 [ 15.531904] ret_from_fork+0x10/0x20 [ 15.531977] [ 15.532017] Allocated by task 193: [ 15.532046] kasan_save_stack+0x3c/0x68 [ 15.532089] kasan_save_track+0x20/0x40 [ 15.532127] kasan_save_alloc_info+0x40/0x58 [ 15.532358] __kasan_kmalloc+0xd4/0xd8 [ 15.532493] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.532541] kmalloc_double_kzfree+0xb8/0x308 [ 15.532596] kunit_try_run_case+0x170/0x3f0 [ 15.532679] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.532747] kthread+0x328/0x630 [ 15.532818] ret_from_fork+0x10/0x20 [ 15.532948] [ 15.532993] Freed by task 193: [ 15.533022] kasan_save_stack+0x3c/0x68 [ 15.533274] kasan_save_track+0x20/0x40 [ 15.533448] kasan_save_free_info+0x4c/0x78 [ 15.533646] __kasan_slab_free+0x6c/0x98 [ 15.533690] kfree+0x214/0x3c8 [ 15.533857] kfree_sensitive+0x80/0xb0 [ 15.533929] kmalloc_double_kzfree+0x11c/0x308 [ 15.534008] kunit_try_run_case+0x170/0x3f0 [ 15.534060] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.534121] kthread+0x328/0x630 [ 15.534157] ret_from_fork+0x10/0x20 [ 15.534211] [ 15.534231] The buggy address belongs to the object at fff00000c433ec60 [ 15.534231] which belongs to the cache kmalloc-16 of size 16 [ 15.534291] The buggy address is located 0 bytes inside of [ 15.534291] freed 16-byte region [fff00000c433ec60, fff00000c433ec70) [ 15.534360] [ 15.534398] The buggy address belongs to the physical page: [ 15.534431] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10433e [ 15.534496] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.534545] page_type: f5(slab) [ 15.534582] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 15.534633] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 15.534683] page dumped because: kasan: bad access detected [ 15.534715] [ 15.534732] Memory state around the buggy address: [ 15.534778] fff00000c433eb00: 00 07 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 15.534828] fff00000c433eb80: 00 04 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 15.534871] >fff00000c433ec00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 15.534919] ^ [ 15.534967] fff00000c433ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.535018] fff00000c433ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.535067] ==================================================================
[ 13.376490] ================================================================== [ 13.377058] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350 [ 13.377441] Read of size 1 at addr ffff888101679d80 by task kunit_try_catch/209 [ 13.377745] [ 13.377863] CPU: 0 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 13.377907] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.377918] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.377938] Call Trace: [ 13.377950] <TASK> [ 13.377965] dump_stack_lvl+0x73/0xb0 [ 13.377995] print_report+0xd1/0x610 [ 13.378017] ? __virt_addr_valid+0x1db/0x2d0 [ 13.378040] ? kmalloc_double_kzfree+0x19c/0x350 [ 13.378063] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.378086] ? kmalloc_double_kzfree+0x19c/0x350 [ 13.378110] kasan_report+0x141/0x180 [ 13.378132] ? kmalloc_double_kzfree+0x19c/0x350 [ 13.378158] ? kmalloc_double_kzfree+0x19c/0x350 [ 13.378182] __kasan_check_byte+0x3d/0x50 [ 13.378204] kfree_sensitive+0x22/0x90 [ 13.378227] kmalloc_double_kzfree+0x19c/0x350 [ 13.378250] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 13.378277] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 13.378306] kunit_try_run_case+0x1a5/0x480 [ 13.378344] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.378367] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.378392] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.378428] ? __kthread_parkme+0x82/0x180 [ 13.378449] ? preempt_count_sub+0x50/0x80 [ 13.378473] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.378497] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.378522] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.378547] kthread+0x337/0x6f0 [ 13.378583] ? trace_preempt_on+0x20/0xc0 [ 13.378607] ? __pfx_kthread+0x10/0x10 [ 13.378627] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.378649] ? calculate_sigpending+0x7b/0xa0 [ 13.378684] ? __pfx_kthread+0x10/0x10 [ 13.378705] ret_from_fork+0x116/0x1d0 [ 13.378724] ? __pfx_kthread+0x10/0x10 [ 13.378745] ret_from_fork_asm+0x1a/0x30 [ 13.378778] </TASK> [ 13.378788] [ 13.386898] Allocated by task 209: [ 13.387083] kasan_save_stack+0x45/0x70 [ 13.387497] kasan_save_track+0x18/0x40 [ 13.387653] kasan_save_alloc_info+0x3b/0x50 [ 13.387836] __kasan_kmalloc+0xb7/0xc0 [ 13.388023] __kmalloc_cache_noprof+0x189/0x420 [ 13.388455] kmalloc_double_kzfree+0xa9/0x350 [ 13.388712] kunit_try_run_case+0x1a5/0x480 [ 13.388921] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.389172] kthread+0x337/0x6f0 [ 13.389489] ret_from_fork+0x116/0x1d0 [ 13.389682] ret_from_fork_asm+0x1a/0x30 [ 13.389867] [ 13.389938] Freed by task 209: [ 13.390054] kasan_save_stack+0x45/0x70 [ 13.390266] kasan_save_track+0x18/0x40 [ 13.390538] kasan_save_free_info+0x3f/0x60 [ 13.390772] __kasan_slab_free+0x56/0x70 [ 13.390956] kfree+0x222/0x3f0 [ 13.391116] kfree_sensitive+0x67/0x90 [ 13.391336] kmalloc_double_kzfree+0x12b/0x350 [ 13.391681] kunit_try_run_case+0x1a5/0x480 [ 13.391893] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.392149] kthread+0x337/0x6f0 [ 13.392518] ret_from_fork+0x116/0x1d0 [ 13.392740] ret_from_fork_asm+0x1a/0x30 [ 13.392939] [ 13.393044] The buggy address belongs to the object at ffff888101679d80 [ 13.393044] which belongs to the cache kmalloc-16 of size 16 [ 13.393425] The buggy address is located 0 bytes inside of [ 13.393425] freed 16-byte region [ffff888101679d80, ffff888101679d90) [ 13.393839] [ 13.394094] The buggy address belongs to the physical page: [ 13.394353] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101679 [ 13.394808] flags: 0x200000000000000(node=0|zone=2) [ 13.394981] page_type: f5(slab) [ 13.395102] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 13.395681] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 13.396058] page dumped because: kasan: bad access detected [ 13.396573] [ 13.396660] Memory state around the buggy address: [ 13.396872] ffff888101679c80: 00 04 fc fc 00 04 fc fc fa fb fc fc 00 05 fc fc [ 13.397148] ffff888101679d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 13.397637] >ffff888101679d80: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.397857] ^ [ 13.397974] ffff888101679e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.398315] ffff888101679e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.398641] ==================================================================