Date
Dec. 9, 2024, 6:35 a.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 |
[ 25.332219] ================================================================== [ 25.333093] BUG: KASAN: double-free in kmem_cache_double_free+0x190/0x3c8 [ 25.333948] Free of addr fff00000c6519000 by task kunit_try_catch/197 [ 25.334744] [ 25.335509] CPU: 1 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc2-next-20241209 #1 [ 25.336979] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.337587] Hardware name: linux,dummy-virt (DT) [ 25.338299] Call trace: [ 25.338660] show_stack+0x20/0x38 (C) [ 25.339395] dump_stack_lvl+0x8c/0xd0 [ 25.340204] print_report+0x118/0x5e0 [ 25.340749] kasan_report_invalid_free+0xb0/0xd8 [ 25.341401] check_slab_allocation+0xd4/0x108 [ 25.342020] __kasan_slab_pre_free+0x2c/0x48 [ 25.342632] kmem_cache_free+0xf0/0x470 [ 25.343227] kmem_cache_double_free+0x190/0x3c8 [ 25.344070] kunit_try_run_case+0x14c/0x3d0 [ 25.344795] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.345544] kthread+0x24c/0x2d0 [ 25.346106] ret_from_fork+0x10/0x20 [ 25.346736] [ 25.347046] Allocated by task 197: [ 25.347543] kasan_save_stack+0x3c/0x68 [ 25.348084] kasan_save_track+0x20/0x40 [ 25.348663] kasan_save_alloc_info+0x40/0x58 [ 25.349489] __kasan_slab_alloc+0xa8/0xb0 [ 25.350116] kmem_cache_alloc_noprof+0x108/0x398 [ 25.350768] kmem_cache_double_free+0x12c/0x3c8 [ 25.351974] kunit_try_run_case+0x14c/0x3d0 [ 25.352591] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.353322] kthread+0x24c/0x2d0 [ 25.353840] ret_from_fork+0x10/0x20 [ 25.354380] [ 25.354770] Freed by task 197: [ 25.355521] kasan_save_stack+0x3c/0x68 [ 25.356063] kasan_save_track+0x20/0x40 [ 25.356737] kasan_save_free_info+0x4c/0x78 [ 25.357296] __kasan_slab_free+0x6c/0x98 [ 25.357960] kmem_cache_free+0x118/0x470 [ 25.358575] kmem_cache_double_free+0x140/0x3c8 [ 25.359469] kunit_try_run_case+0x14c/0x3d0 [ 25.360087] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.360823] kthread+0x24c/0x2d0 [ 25.361350] ret_from_fork+0x10/0x20 [ 25.361933] [ 25.362282] The buggy address belongs to the object at fff00000c6519000 [ 25.362282] which belongs to the cache test_cache of size 200 [ 25.363849] The buggy address is located 0 bytes inside of [ 25.363849] 200-byte region [fff00000c6519000, fff00000c65190c8) [ 25.365050] [ 25.365470] The buggy address belongs to the physical page: [ 25.366148] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106519 [ 25.367184] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 25.368043] page_type: f5(slab) [ 25.368575] raw: 0bfffe0000000000 fff00000c5798280 dead000000000122 0000000000000000 [ 25.369458] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 25.370381] page dumped because: kasan: bad access detected [ 25.371449] [ 25.371857] Memory state around the buggy address: [ 25.372382] fff00000c6518f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.373233] fff00000c6518f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.374045] >fff00000c6519000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.374890] ^ [ 25.375510] fff00000c6519080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 25.376553] fff00000c6519100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.377418] ==================================================================
[ 25.456686] ================================================================== [ 25.457632] BUG: KASAN: double-free in kmem_cache_double_free+0x1e6/0x490 [ 25.458712] Free of addr ffff88810240d000 by task kunit_try_catch/216 [ 25.460115] [ 25.460747] CPU: 1 UID: 0 PID: 216 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc2-next-20241209 #1 [ 25.461785] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.462164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.462903] Call Trace: [ 25.463193] <TASK> [ 25.463787] dump_stack_lvl+0x73/0xb0 [ 25.464159] print_report+0xd1/0x640 [ 25.464912] ? __virt_addr_valid+0x1db/0x2d0 [ 25.465326] ? kmem_cache_double_free+0x1e6/0x490 [ 25.465779] ? kasan_complete_mode_report_info+0x64/0x200 [ 25.467087] ? kmem_cache_double_free+0x1e6/0x490 [ 25.468143] kasan_report_invalid_free+0xc0/0xf0 [ 25.468812] ? kmem_cache_double_free+0x1e6/0x490 [ 25.469666] ? kmem_cache_double_free+0x1e6/0x490 [ 25.470541] check_slab_allocation+0x101/0x130 [ 25.471259] __kasan_slab_pre_free+0x28/0x40 [ 25.472134] kmem_cache_free+0xee/0x420 [ 25.472492] ? kmem_cache_alloc_noprof+0x11e/0x3e0 [ 25.473499] ? kmem_cache_double_free+0x1e6/0x490 [ 25.474018] kmem_cache_double_free+0x1e6/0x490 [ 25.474784] ? __pfx_kmem_cache_double_free+0x10/0x10 [ 25.475311] ? finish_task_switch.isra.0+0x153/0x700 [ 25.476061] ? __switch_to+0x5d9/0xf60 [ 25.476926] ? __pfx_read_tsc+0x10/0x10 [ 25.477327] ? ktime_get_ts64+0x86/0x230 [ 25.478572] kunit_try_run_case+0x1b3/0x490 [ 25.479475] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.480429] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 25.480763] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.482289] ? __kthread_parkme+0x82/0x160 [ 25.482767] ? preempt_count_sub+0x50/0x80 [ 25.483228] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.483548] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.484752] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.485174] kthread+0x257/0x310 [ 25.486375] ? __pfx_kthread+0x10/0x10 [ 25.486879] ret_from_fork+0x41/0x80 [ 25.487246] ? __pfx_kthread+0x10/0x10 [ 25.488134] ret_from_fork_asm+0x1a/0x30 [ 25.488956] </TASK> [ 25.489586] [ 25.489767] Allocated by task 216: [ 25.490743] kasan_save_stack+0x3d/0x60 [ 25.491168] kasan_save_track+0x18/0x40 [ 25.491837] kasan_save_alloc_info+0x3b/0x50 [ 25.492349] __kasan_slab_alloc+0x91/0xa0 [ 25.492727] kmem_cache_alloc_noprof+0x11e/0x3e0 [ 25.493795] kmem_cache_double_free+0x150/0x490 [ 25.494096] kunit_try_run_case+0x1b3/0x490 [ 25.494892] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.495451] kthread+0x257/0x310 [ 25.495792] ret_from_fork+0x41/0x80 [ 25.496765] ret_from_fork_asm+0x1a/0x30 [ 25.497251] [ 25.498065] Freed by task 216: [ 25.498358] kasan_save_stack+0x3d/0x60 [ 25.499517] kasan_save_track+0x18/0x40 [ 25.500136] kasan_save_free_info+0x3f/0x60 [ 25.501013] __kasan_slab_free+0x56/0x70 [ 25.501480] kmem_cache_free+0x120/0x420 [ 25.502487] kmem_cache_double_free+0x16b/0x490 [ 25.502733] kunit_try_run_case+0x1b3/0x490 [ 25.502936] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.503163] kthread+0x257/0x310 [ 25.503357] ret_from_fork+0x41/0x80 [ 25.504515] ret_from_fork_asm+0x1a/0x30 [ 25.505492] [ 25.506162] The buggy address belongs to the object at ffff88810240d000 [ 25.506162] which belongs to the cache test_cache of size 200 [ 25.507648] The buggy address is located 0 bytes inside of [ 25.507648] 200-byte region [ffff88810240d000, ffff88810240d0c8) [ 25.509137] [ 25.509247] The buggy address belongs to the physical page: [ 25.509560] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10240d [ 25.510037] flags: 0x200000000000000(node=0|zone=2) [ 25.512084] page_type: f5(slab) [ 25.513400] raw: 0200000000000000 ffff888101012a00 dead000000000122 0000000000000000 [ 25.514814] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 25.515666] page dumped because: kasan: bad access detected [ 25.516235] [ 25.516860] Memory state around the buggy address: [ 25.517897] ffff88810240cf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.519129] ffff88810240cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.520894] >ffff88810240d000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.522403] ^ [ 25.522833] ffff88810240d080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 25.523456] ffff88810240d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.524611] ==================================================================