Date
March 19, 2025, 10:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 35.394572] ================================================================== [ 35.394839] BUG: KASAN: double-free in kmem_cache_double_free+0x190/0x3c8 [ 35.395133] Free of addr fff00000c5d9a000 by task kunit_try_catch/211 [ 35.395326] [ 35.395512] CPU: 1 UID: 0 PID: 211 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 35.396041] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.396405] Hardware name: linux,dummy-virt (DT) [ 35.396574] Call trace: [ 35.396665] show_stack+0x20/0x38 (C) [ 35.397704] dump_stack_lvl+0x8c/0xd0 [ 35.397870] print_report+0x118/0x5f0 [ 35.398032] kasan_report_invalid_free+0xb0/0xd8 [ 35.398206] check_slab_allocation+0xd4/0x108 [ 35.398353] __kasan_slab_pre_free+0x2c/0x48 [ 35.398499] kmem_cache_free+0xf0/0x490 [ 35.398649] kmem_cache_double_free+0x190/0x3c8 [ 35.398801] kunit_try_run_case+0x14c/0x3d0 [ 35.398971] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.399510] kthread+0x318/0x618 [ 35.399661] ret_from_fork+0x10/0x20 [ 35.399812] [ 35.399869] Allocated by task 211: [ 35.399962] kasan_save_stack+0x3c/0x68 [ 35.400126] kasan_save_track+0x20/0x40 [ 35.400399] kasan_save_alloc_info+0x40/0x58 [ 35.400771] __kasan_slab_alloc+0xa8/0xb0 [ 35.400915] kmem_cache_alloc_noprof+0x108/0x398 [ 35.401041] kmem_cache_double_free+0x12c/0x3c8 [ 35.401187] kunit_try_run_case+0x14c/0x3d0 [ 35.401313] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.401455] kthread+0x318/0x618 [ 35.401566] ret_from_fork+0x10/0x20 [ 35.401682] [ 35.401739] Freed by task 211: [ 35.401826] kasan_save_stack+0x3c/0x68 [ 35.401936] kasan_save_track+0x20/0x40 [ 35.402073] kasan_save_free_info+0x4c/0x78 [ 35.402201] __kasan_slab_free+0x6c/0x98 [ 35.402304] kmem_cache_free+0x260/0x490 [ 35.402537] kmem_cache_double_free+0x140/0x3c8 [ 35.402741] kunit_try_run_case+0x14c/0x3d0 [ 35.402870] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.403019] kthread+0x318/0x618 [ 35.403257] ret_from_fork+0x10/0x20 [ 35.403390] [ 35.403453] The buggy address belongs to the object at fff00000c5d9a000 [ 35.403453] which belongs to the cache test_cache of size 200 [ 35.403656] The buggy address is located 0 bytes inside of [ 35.403656] 200-byte region [fff00000c5d9a000, fff00000c5d9a0c8) [ 35.404134] [ 35.404927] The buggy address belongs to the physical page: [ 35.405036] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105d9a [ 35.405940] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 35.406239] page_type: f5(slab) [ 35.406383] raw: 0bfffe0000000000 fff00000c10a5dc0 dead000000000122 0000000000000000 [ 35.406774] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 35.409027] page dumped because: kasan: bad access detected [ 35.411164] [ 35.411639] Memory state around the buggy address: [ 35.412142] fff00000c5d99f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.412302] fff00000c5d99f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.412444] >fff00000c5d9a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.412572] ^ [ 35.412654] fff00000c5d9a080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 35.412791] fff00000c5d9a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.412914] ==================================================================
[ 22.997409] ================================================================== [ 22.998070] BUG: KASAN: double-free in kmem_cache_double_free+0x1e5/0x480 [ 22.998733] Free of addr ffff888103226000 by task kunit_try_catch/230 [ 22.999098] [ 22.999429] CPU: 1 UID: 0 PID: 230 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 22.999555] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.999597] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.999673] Call Trace: [ 22.999708] <TASK> [ 22.999749] dump_stack_lvl+0x73/0xb0 [ 22.999834] print_report+0xd1/0x660 [ 22.999896] ? __virt_addr_valid+0x1db/0x2d0 [ 23.000028] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.000152] ? kmem_cache_double_free+0x1e5/0x480 [ 23.000217] kasan_report_invalid_free+0xce/0x100 [ 23.000288] ? kmem_cache_double_free+0x1e5/0x480 [ 23.000351] ? kmem_cache_double_free+0x1e5/0x480 [ 23.000410] check_slab_allocation+0x101/0x130 [ 23.000472] __kasan_slab_pre_free+0x28/0x40 [ 23.000525] kmem_cache_free+0xed/0x420 [ 23.000582] ? kmem_cache_alloc_noprof+0x11d/0x3f0 [ 23.000639] ? kmem_cache_double_free+0x1e5/0x480 [ 23.000704] kmem_cache_double_free+0x1e5/0x480 [ 23.000770] ? __pfx_kmem_cache_double_free+0x10/0x10 [ 23.000828] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 23.000930] ? __pfx_kmem_cache_double_free+0x10/0x10 [ 23.001010] kunit_try_run_case+0x1b2/0x490 [ 23.001088] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.001172] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.001236] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.001298] ? __kthread_parkme+0x82/0x160 [ 23.001359] ? preempt_count_sub+0x50/0x80 [ 23.001431] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.001499] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.001567] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.001606] kthread+0x323/0x710 [ 23.001637] ? trace_preempt_on+0x20/0xc0 [ 23.001675] ? __pfx_kthread+0x10/0x10 [ 23.001712] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.001779] ? calculate_sigpending+0x7b/0xa0 [ 23.001813] ? __pfx_kthread+0x10/0x10 [ 23.001845] ret_from_fork+0x41/0x80 [ 23.001878] ? __pfx_kthread+0x10/0x10 [ 23.001910] ret_from_fork_asm+0x1a/0x30 [ 23.001958] </TASK> [ 23.001974] [ 23.014781] Allocated by task 230: [ 23.015170] kasan_save_stack+0x3d/0x60 [ 23.015528] kasan_save_track+0x18/0x40 [ 23.016013] kasan_save_alloc_info+0x3b/0x50 [ 23.016477] __kasan_slab_alloc+0x91/0xa0 [ 23.016890] kmem_cache_alloc_noprof+0x11d/0x3f0 [ 23.017297] kmem_cache_double_free+0x14f/0x480 [ 23.017592] kunit_try_run_case+0x1b2/0x490 [ 23.017870] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.018509] kthread+0x323/0x710 [ 23.018876] ret_from_fork+0x41/0x80 [ 23.019463] ret_from_fork_asm+0x1a/0x30 [ 23.019984] [ 23.020226] Freed by task 230: [ 23.020512] kasan_save_stack+0x3d/0x60 [ 23.020810] kasan_save_track+0x18/0x40 [ 23.021238] kasan_save_free_info+0x3f/0x60 [ 23.021669] __kasan_slab_free+0x56/0x70 [ 23.022019] kmem_cache_free+0x249/0x420 [ 23.022319] kmem_cache_double_free+0x16a/0x480 [ 23.022604] kunit_try_run_case+0x1b2/0x490 [ 23.023084] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.023875] kthread+0x323/0x710 [ 23.024281] ret_from_fork+0x41/0x80 [ 23.024582] ret_from_fork_asm+0x1a/0x30 [ 23.025060] [ 23.025248] The buggy address belongs to the object at ffff888103226000 [ 23.025248] which belongs to the cache test_cache of size 200 [ 23.026008] The buggy address is located 0 bytes inside of [ 23.026008] 200-byte region [ffff888103226000, ffff8881032260c8) [ 23.027011] [ 23.027267] The buggy address belongs to the physical page: [ 23.027799] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103226 [ 23.028283] flags: 0x200000000000000(node=0|zone=2) [ 23.028610] page_type: f5(slab) [ 23.028937] raw: 0200000000000000 ffff8881020e8a00 dead000000000122 0000000000000000 [ 23.029889] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 23.030572] page dumped because: kasan: bad access detected [ 23.030993] [ 23.031177] Memory state around the buggy address: [ 23.031599] ffff888103225f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.032014] ffff888103225f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.034593] >ffff888103226000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.036785] ^ [ 23.037096] ffff888103226080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 23.037551] ffff888103226100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.040628] ==================================================================