Date
July 20, 2025, 11:12 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.790441] ================================================================== [ 16.790512] BUG: KASAN: double-free in kfree_sensitive+0x3c/0xb0 [ 16.790562] Free of addr fff00000c59ab980 by task kunit_try_catch/192 [ 16.790626] [ 16.790660] CPU: 1 UID: 0 PID: 192 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT [ 16.790752] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.790793] Hardware name: linux,dummy-virt (DT) [ 16.790825] Call trace: [ 16.790855] show_stack+0x20/0x38 (C) [ 16.790916] dump_stack_lvl+0x8c/0xd0 [ 16.790963] print_report+0x118/0x5d0 [ 16.791008] kasan_report_invalid_free+0xc0/0xe8 [ 16.791058] check_slab_allocation+0xd4/0x108 [ 16.791105] __kasan_slab_pre_free+0x2c/0x48 [ 16.791151] kfree+0xe8/0x3c8 [ 16.791194] kfree_sensitive+0x3c/0xb0 [ 16.791239] kmalloc_double_kzfree+0x168/0x308 [ 16.791286] kunit_try_run_case+0x170/0x3f0 [ 16.791331] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.791400] kthread+0x328/0x630 [ 16.791448] ret_from_fork+0x10/0x20 [ 16.791496] [ 16.791514] Allocated by task 192: [ 16.791540] kasan_save_stack+0x3c/0x68 [ 16.791590] kasan_save_track+0x20/0x40 [ 16.791638] kasan_save_alloc_info+0x40/0x58 [ 16.791679] __kasan_kmalloc+0xd4/0xd8 [ 16.791720] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.791771] kmalloc_double_kzfree+0xb8/0x308 [ 16.791812] kunit_try_run_case+0x170/0x3f0 [ 16.791852] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.791907] kthread+0x328/0x630 [ 16.792869] ret_from_fork+0x10/0x20 [ 16.792965] [ 16.792986] Freed by task 192: [ 16.793026] kasan_save_stack+0x3c/0x68 [ 16.793068] kasan_save_track+0x20/0x40 [ 16.793119] kasan_save_free_info+0x4c/0x78 [ 16.793164] __kasan_slab_free+0x6c/0x98 [ 16.793213] kfree+0x214/0x3c8 [ 16.793247] kfree_sensitive+0x80/0xb0 [ 16.793284] kmalloc_double_kzfree+0x11c/0x308 [ 16.793622] kunit_try_run_case+0x170/0x3f0 [ 16.793887] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.794227] kthread+0x328/0x630 [ 16.794374] ret_from_fork+0x10/0x20 [ 16.794471] [ 16.794850] The buggy address belongs to the object at fff00000c59ab980 [ 16.794850] which belongs to the cache kmalloc-16 of size 16 [ 16.794943] The buggy address is located 0 bytes inside of [ 16.794943] 16-byte region [fff00000c59ab980, fff00000c59ab990) [ 16.795153] [ 16.795346] The buggy address belongs to the physical page: [ 16.795434] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059ab [ 16.795938] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.796006] page_type: f5(slab) [ 16.796345] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 16.796427] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 16.796575] page dumped because: kasan: bad access detected [ 16.796609] [ 16.797033] Memory state around the buggy address: [ 16.797125] fff00000c59ab880: fa fb fc fc 00 04 fc fc fa fb fc fc fa fb fc fc [ 16.797201] fff00000c59ab900: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 16.797745] >fff00000c59ab980: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.798037] ^ [ 16.798226] fff00000c59aba00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.798419] fff00000c59aba80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.798542] ==================================================================
[ 16.759946] ================================================================== [ 16.760032] BUG: KASAN: double-free in kfree_sensitive+0x3c/0xb0 [ 16.760083] Free of addr fff00000c1375ba0 by task kunit_try_catch/192 [ 16.760126] [ 16.760205] CPU: 1 UID: 0 PID: 192 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT [ 16.760307] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.760335] Hardware name: linux,dummy-virt (DT) [ 16.760376] Call trace: [ 16.760409] show_stack+0x20/0x38 (C) [ 16.760510] dump_stack_lvl+0x8c/0xd0 [ 16.760576] print_report+0x118/0x5d0 [ 16.760635] kasan_report_invalid_free+0xc0/0xe8 [ 16.760686] check_slab_allocation+0xd4/0x108 [ 16.760733] __kasan_slab_pre_free+0x2c/0x48 [ 16.760780] kfree+0xe8/0x3c8 [ 16.760988] kfree_sensitive+0x3c/0xb0 [ 16.761115] kmalloc_double_kzfree+0x168/0x308 [ 16.761190] kunit_try_run_case+0x170/0x3f0 [ 16.761286] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.761353] kthread+0x328/0x630 [ 16.761431] ret_from_fork+0x10/0x20 [ 16.761588] [ 16.761678] Allocated by task 192: [ 16.761767] kasan_save_stack+0x3c/0x68 [ 16.761837] kasan_save_track+0x20/0x40 [ 16.761877] kasan_save_alloc_info+0x40/0x58 [ 16.761924] __kasan_kmalloc+0xd4/0xd8 [ 16.761962] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.762000] kmalloc_double_kzfree+0xb8/0x308 [ 16.762060] kunit_try_run_case+0x170/0x3f0 [ 16.762099] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.762143] kthread+0x328/0x630 [ 16.762298] ret_from_fork+0x10/0x20 [ 16.762375] [ 16.762445] Freed by task 192: [ 16.762565] kasan_save_stack+0x3c/0x68 [ 16.762673] kasan_save_track+0x20/0x40 [ 16.762865] kasan_save_free_info+0x4c/0x78 [ 16.762975] __kasan_slab_free+0x6c/0x98 [ 16.763062] kfree+0x214/0x3c8 [ 16.763162] kfree_sensitive+0x80/0xb0 [ 16.763237] kmalloc_double_kzfree+0x11c/0x308 [ 16.763277] kunit_try_run_case+0x170/0x3f0 [ 16.763318] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.763363] kthread+0x328/0x630 [ 16.763395] ret_from_fork+0x10/0x20 [ 16.763999] [ 16.764154] The buggy address belongs to the object at fff00000c1375ba0 [ 16.764154] which belongs to the cache kmalloc-16 of size 16 [ 16.764339] The buggy address is located 0 bytes inside of [ 16.764339] 16-byte region [fff00000c1375ba0, fff00000c1375bb0) [ 16.764478] [ 16.764546] The buggy address belongs to the physical page: [ 16.764646] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101375 [ 16.764723] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.764772] page_type: f5(slab) [ 16.765065] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 16.765146] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 16.765224] page dumped because: kasan: bad access detected [ 16.765327] [ 16.765415] Memory state around the buggy address: [ 16.765732] fff00000c1375a80: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 16.765801] fff00000c1375b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 16.765858] >fff00000c1375b80: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc [ 16.765908] ^ [ 16.765941] fff00000c1375c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.765986] fff00000c1375c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.766048] ==================================================================
[ 13.015150] ================================================================== [ 13.015508] BUG: KASAN: double-free in kfree_sensitive+0x2e/0x90 [ 13.016071] Free of addr ffff8881017e0440 by task kunit_try_catch/210 [ 13.016940] [ 13.017146] CPU: 0 UID: 0 PID: 210 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT(voluntary) [ 13.017206] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.017219] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.017239] Call Trace: [ 13.017388] <TASK> [ 13.017418] dump_stack_lvl+0x73/0xb0 [ 13.017449] print_report+0xd1/0x610 [ 13.017472] ? __virt_addr_valid+0x1db/0x2d0 [ 13.017495] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.017516] ? kfree_sensitive+0x2e/0x90 [ 13.017537] kasan_report_invalid_free+0x10a/0x130 [ 13.017561] ? kfree_sensitive+0x2e/0x90 [ 13.017582] ? kfree_sensitive+0x2e/0x90 [ 13.017613] check_slab_allocation+0x101/0x130 [ 13.017634] __kasan_slab_pre_free+0x28/0x40 [ 13.017654] kfree+0xf0/0x3f0 [ 13.017675] ? kfree_sensitive+0x2e/0x90 [ 13.017697] kfree_sensitive+0x2e/0x90 [ 13.017717] kmalloc_double_kzfree+0x19c/0x350 [ 13.017739] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 13.017763] ? __schedule+0x10c6/0x2b60 [ 13.017785] ? __pfx_read_tsc+0x10/0x10 [ 13.017805] ? ktime_get_ts64+0x86/0x230 [ 13.017831] kunit_try_run_case+0x1a5/0x480 [ 13.017856] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.017878] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.017902] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.017925] ? __kthread_parkme+0x82/0x180 [ 13.017945] ? preempt_count_sub+0x50/0x80 [ 13.017968] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.017992] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.018014] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.018048] kthread+0x337/0x6f0 [ 13.018067] ? trace_preempt_on+0x20/0xc0 [ 13.018089] ? __pfx_kthread+0x10/0x10 [ 13.018109] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.018130] ? calculate_sigpending+0x7b/0xa0 [ 13.018153] ? __pfx_kthread+0x10/0x10 [ 13.018175] ret_from_fork+0x116/0x1d0 [ 13.018192] ? __pfx_kthread+0x10/0x10 [ 13.018212] ret_from_fork_asm+0x1a/0x30 [ 13.018244] </TASK> [ 13.018254] [ 13.031876] Allocated by task 210: [ 13.032176] kasan_save_stack+0x45/0x70 [ 13.032376] kasan_save_track+0x18/0x40 [ 13.032922] kasan_save_alloc_info+0x3b/0x50 [ 13.033515] __kasan_kmalloc+0xb7/0xc0 [ 13.033905] __kmalloc_cache_noprof+0x189/0x420 [ 13.034158] kmalloc_double_kzfree+0xa9/0x350 [ 13.034420] kunit_try_run_case+0x1a5/0x480 [ 13.034961] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.035386] kthread+0x337/0x6f0 [ 13.035575] ret_from_fork+0x116/0x1d0 [ 13.035755] ret_from_fork_asm+0x1a/0x30 [ 13.035956] [ 13.036429] Freed by task 210: [ 13.036916] kasan_save_stack+0x45/0x70 [ 13.037306] kasan_save_track+0x18/0x40 [ 13.037503] kasan_save_free_info+0x3f/0x60 [ 13.037699] __kasan_slab_free+0x56/0x70 [ 13.037998] kfree+0x222/0x3f0 [ 13.038157] kfree_sensitive+0x67/0x90 [ 13.038632] kmalloc_double_kzfree+0x12b/0x350 [ 13.039086] kunit_try_run_case+0x1a5/0x480 [ 13.039591] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.040150] kthread+0x337/0x6f0 [ 13.040745] ret_from_fork+0x116/0x1d0 [ 13.040914] ret_from_fork_asm+0x1a/0x30 [ 13.041232] [ 13.041443] The buggy address belongs to the object at ffff8881017e0440 [ 13.041443] which belongs to the cache kmalloc-16 of size 16 [ 13.042547] The buggy address is located 0 bytes inside of [ 13.042547] 16-byte region [ffff8881017e0440, ffff8881017e0450) [ 13.043281] [ 13.043487] The buggy address belongs to the physical page: [ 13.044072] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1017e0 [ 13.044568] flags: 0x200000000000000(node=0|zone=2) [ 13.045254] page_type: f5(slab) [ 13.045542] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 13.046163] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 13.046554] page dumped because: kasan: bad access detected [ 13.046992] [ 13.047206] Memory state around the buggy address: [ 13.047689] ffff8881017e0300: 00 04 fc fc 00 01 fc fc 00 01 fc fc 00 04 fc fc [ 13.048224] ffff8881017e0380: 00 04 fc fc 00 05 fc fc fa fb fc fc fa fb fc fc [ 13.048643] >ffff8881017e0400: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 13.048871] ^ [ 13.049102] ffff8881017e0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.049858] ffff8881017e0500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.050675] ==================================================================
[ 13.170356] ================================================================== [ 13.171480] BUG: KASAN: double-free in kfree_sensitive+0x2e/0x90 [ 13.171938] Free of addr ffff8881023973c0 by task kunit_try_catch/209 [ 13.172441] [ 13.172549] CPU: 0 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7 #1 PREEMPT(voluntary) [ 13.172595] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.172606] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.172627] Call Trace: [ 13.172640] <TASK> [ 13.172656] dump_stack_lvl+0x73/0xb0 [ 13.172684] print_report+0xd1/0x610 [ 13.172705] ? __virt_addr_valid+0x1db/0x2d0 [ 13.172728] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.172748] ? kfree_sensitive+0x2e/0x90 [ 13.172768] kasan_report_invalid_free+0x10a/0x130 [ 13.172791] ? kfree_sensitive+0x2e/0x90 [ 13.172811] ? kfree_sensitive+0x2e/0x90 [ 13.172830] check_slab_allocation+0x101/0x130 [ 13.172850] __kasan_slab_pre_free+0x28/0x40 [ 13.172870] kfree+0xf0/0x3f0 [ 13.172891] ? kfree_sensitive+0x2e/0x90 [ 13.172911] kfree_sensitive+0x2e/0x90 [ 13.172930] kmalloc_double_kzfree+0x19c/0x350 [ 13.172952] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 13.172975] ? __pfx_queued_spin_lock_slowpath+0x10/0x10 [ 13.173000] ? __pfx_read_tsc+0x10/0x10 [ 13.173020] ? ktime_get_ts64+0x86/0x230 [ 13.173043] kunit_try_run_case+0x1a5/0x480 [ 13.173066] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.173088] ? _raw_spin_lock_irqsave+0xf9/0x100 [ 13.173109] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.173131] ? __kthread_parkme+0x82/0x180 [ 13.173160] ? preempt_count_sub+0x50/0x80 [ 13.173195] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.173218] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.173240] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.173262] kthread+0x337/0x6f0 [ 13.173280] ? trace_preempt_on+0x20/0xc0 [ 13.173303] ? __pfx_kthread+0x10/0x10 [ 13.173332] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.173352] ? calculate_sigpending+0x7b/0xa0 [ 13.173375] ? __pfx_kthread+0x10/0x10 [ 13.173396] ret_from_fork+0x116/0x1d0 [ 13.173413] ? __pfx_kthread+0x10/0x10 [ 13.173433] ret_from_fork_asm+0x1a/0x30 [ 13.173462] </TASK> [ 13.173471] [ 13.185663] Allocated by task 209: [ 13.186296] kasan_save_stack+0x45/0x70 [ 13.186741] kasan_save_track+0x18/0x40 [ 13.187059] kasan_save_alloc_info+0x3b/0x50 [ 13.187332] __kasan_kmalloc+0xb7/0xc0 [ 13.187695] __kmalloc_cache_noprof+0x189/0x420 [ 13.188072] kmalloc_double_kzfree+0xa9/0x350 [ 13.188433] kunit_try_run_case+0x1a5/0x480 [ 13.188585] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.188764] kthread+0x337/0x6f0 [ 13.189015] ret_from_fork+0x116/0x1d0 [ 13.189366] ret_from_fork_asm+0x1a/0x30 [ 13.189749] [ 13.189962] Freed by task 209: [ 13.190257] kasan_save_stack+0x45/0x70 [ 13.190605] kasan_save_track+0x18/0x40 [ 13.191140] kasan_save_free_info+0x3f/0x60 [ 13.191574] __kasan_slab_free+0x56/0x70 [ 13.191952] kfree+0x222/0x3f0 [ 13.192182] kfree_sensitive+0x67/0x90 [ 13.192332] kmalloc_double_kzfree+0x12b/0x350 [ 13.192734] kunit_try_run_case+0x1a5/0x480 [ 13.193177] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.193541] kthread+0x337/0x6f0 [ 13.193671] ret_from_fork+0x116/0x1d0 [ 13.193809] ret_from_fork_asm+0x1a/0x30 [ 13.194079] [ 13.194265] The buggy address belongs to the object at ffff8881023973c0 [ 13.194265] which belongs to the cache kmalloc-16 of size 16 [ 13.195391] The buggy address is located 0 bytes inside of [ 13.195391] 16-byte region [ffff8881023973c0, ffff8881023973d0) [ 13.196459] [ 13.196785] The buggy address belongs to the physical page: [ 13.197169] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102397 [ 13.197431] flags: 0x200000000000000(node=0|zone=2) [ 13.197902] page_type: f5(slab) [ 13.198231] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 13.198886] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 13.199670] page dumped because: kasan: bad access detected [ 13.199881] [ 13.200044] Memory state around the buggy address: [ 13.200495] ffff888102397280: 00 02 fc fc 00 02 fc fc 00 06 fc fc 00 06 fc fc [ 13.201348] ffff888102397300: fa fb fc fc fa fb fc fc fa fb fc fc 00 05 fc fc [ 13.201576] >ffff888102397380: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 13.201791] ^ [ 13.202076] ffff888102397400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.202386] ffff888102397480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.202628] ==================================================================