Hay
Date
May 29, 2025, 7:10 a.m.

Environment
qemu-arm64
qemu-x86_64

[   23.477808] ==================================================================
[   23.478071] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x174/0x300
[   23.478294] Read of size 1 at addr fff00000c1764b40 by task kunit_try_catch/215
[   23.478508] 
[   23.478593] CPU: 0 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250529 #1 PREEMPT 
[   23.478808] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.478909] Hardware name: linux,dummy-virt (DT)
[   23.479005] Call trace:
[   23.479077]  show_stack+0x20/0x38 (C)
[   23.479205]  dump_stack_lvl+0x8c/0xd0
[   23.479341]  print_report+0x118/0x608
[   23.479531]  kasan_report+0xdc/0x128
[   23.479655]  __kasan_check_byte+0x54/0x70
[   23.479811]  kmem_cache_destroy+0x34/0x218
[   23.479964]  kmem_cache_double_destroy+0x174/0x300
[   23.480093]  kunit_try_run_case+0x170/0x3f0
[   23.480223]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   23.480353]  kthread+0x328/0x630
[   23.480479]  ret_from_fork+0x10/0x20
[   23.480604] 
[   23.480651] Allocated by task 215:
[   23.480728]  kasan_save_stack+0x3c/0x68
[   23.480832]  kasan_save_track+0x20/0x40
[   23.480930]  kasan_save_alloc_info+0x40/0x58
[   23.481025]  __kasan_slab_alloc+0xa8/0xb0
[   23.481124]  kmem_cache_alloc_noprof+0x10c/0x3a0
[   23.481222]  __kmem_cache_create_args+0x178/0x280
[   23.481323]  kmem_cache_double_destroy+0xc0/0x300
[   23.481428]  kunit_try_run_case+0x170/0x3f0
[   23.481519]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   23.481625]  kthread+0x328/0x630
[   23.481713]  ret_from_fork+0x10/0x20
[   23.481810] 
[   23.481864] Freed by task 215:
[   23.481931]  kasan_save_stack+0x3c/0x68
[   23.482120]  kasan_save_track+0x20/0x40
[   23.482220]  kasan_save_free_info+0x4c/0x78
[   23.482307]  __kasan_slab_free+0x6c/0x98
[   23.482480]  kmem_cache_free+0x260/0x470
[   23.482584]  slab_kmem_cache_release+0x38/0x50
[   23.482685]  kmem_cache_release+0x1c/0x30
[   23.482765]  kobject_put+0x17c/0x430
[   23.482913]  sysfs_slab_release+0x1c/0x30
[   23.482999]  kmem_cache_destroy+0x118/0x218
[   23.483090]  kmem_cache_double_destroy+0x128/0x300
[   23.483214]  kunit_try_run_case+0x170/0x3f0
[   23.483334]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   23.483442]  kthread+0x328/0x630
[   23.483509]  ret_from_fork+0x10/0x20
[   23.483575] 
[   23.483654] The buggy address belongs to the object at fff00000c1764b40
[   23.483654]  which belongs to the cache kmem_cache of size 208
[   23.483814] The buggy address is located 0 bytes inside of
[   23.483814]  freed 208-byte region [fff00000c1764b40, fff00000c1764c10)
[   23.483965] 
[   23.484021] The buggy address belongs to the physical page:
[   23.484133] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101764
[   23.484298] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   23.484507] page_type: f5(slab)
[   23.484635] raw: 0bfffe0000000000 fff00000c0001000 dead000000000122 0000000000000000
[   23.484798] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[   23.484892] page dumped because: kasan: bad access detected
[   23.484970] 
[   23.485058] Memory state around the buggy address:
[   23.485190]  fff00000c1764a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   23.485350]  fff00000c1764a80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
[   23.485480] >fff00000c1764b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[   23.485607]                                            ^
[   23.485698]  fff00000c1764b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   23.485848]  fff00000c1764c00: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.486016] ==================================================================


[   11.694872] ==================================================================
[   11.695288] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x1bf/0x380
[   11.695550] Read of size 1 at addr ffff8881011dab40 by task kunit_try_catch/232
[   11.696190] 
[   11.696297] CPU: 0 UID: 0 PID: 232 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-next-20250529 #1 PREEMPT(voluntary) 
[   11.696349] Tainted: [B]=BAD_PAGE, [N]=TEST
[   11.696361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.696384] Call Trace:
[   11.696397]  <TASK>
[   11.696415]  dump_stack_lvl+0x73/0xb0
[   11.696444]  print_report+0xd1/0x650
[   11.696468]  ? __virt_addr_valid+0x1db/0x2d0
[   11.696492]  ? kmem_cache_double_destroy+0x1bf/0x380
[   11.696546]  ? kasan_complete_mode_report_info+0x64/0x200
[   11.696571]  ? kmem_cache_double_destroy+0x1bf/0x380
[   11.696593]  kasan_report+0x141/0x180
[   11.696627]  ? kmem_cache_double_destroy+0x1bf/0x380
[   11.696651]  ? kmem_cache_double_destroy+0x1bf/0x380
[   11.696673]  __kasan_check_byte+0x3d/0x50
[   11.696716]  kmem_cache_destroy+0x25/0x1d0
[   11.696740]  kmem_cache_double_destroy+0x1bf/0x380
[   11.696762]  ? __pfx_kmem_cache_double_destroy+0x10/0x10
[   11.696783]  ? finish_task_switch.isra.0+0x153/0x700
[   11.696805]  ? __switch_to+0x47/0xf50
[   11.696835]  ? __pfx_read_tsc+0x10/0x10
[   11.696856]  ? ktime_get_ts64+0x86/0x230
[   11.696882]  kunit_try_run_case+0x1a5/0x480
[   11.696907]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.696927]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   11.696953]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   11.696978]  ? __kthread_parkme+0x82/0x180
[   11.697031]  ? preempt_count_sub+0x50/0x80
[   11.697054]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.697076]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.697100]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   11.697125]  kthread+0x337/0x6f0
[   11.697145]  ? trace_preempt_on+0x20/0xc0
[   11.697169]  ? __pfx_kthread+0x10/0x10
[   11.697190]  ? _raw_spin_unlock_irq+0x47/0x80
[   11.697213]  ? calculate_sigpending+0x7b/0xa0
[   11.697237]  ? __pfx_kthread+0x10/0x10
[   11.697259]  ret_from_fork+0x116/0x1d0
[   11.697278]  ? __pfx_kthread+0x10/0x10
[   11.697299]  ret_from_fork_asm+0x1a/0x30
[   11.697330]  </TASK>
[   11.697342] 
[   11.711428] Allocated by task 232:
[   11.712107]  kasan_save_stack+0x45/0x70
[   11.712665]  kasan_save_track+0x18/0x40
[   11.713212]  kasan_save_alloc_info+0x3b/0x50
[   11.713379]  __kasan_slab_alloc+0x91/0xa0
[   11.713522]  kmem_cache_alloc_noprof+0x123/0x3f0
[   11.713698]  __kmem_cache_create_args+0x169/0x240
[   11.713861]  kmem_cache_double_destroy+0xd5/0x380
[   11.714301]  kunit_try_run_case+0x1a5/0x480
[   11.714464]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.714720]  kthread+0x337/0x6f0
[   11.714961]  ret_from_fork+0x116/0x1d0
[   11.715182]  ret_from_fork_asm+0x1a/0x30
[   11.715361] 
[   11.715458] Freed by task 232:
[   11.715650]  kasan_save_stack+0x45/0x70
[   11.716011]  kasan_save_track+0x18/0x40
[   11.716251]  kasan_save_free_info+0x3f/0x60
[   11.716461]  __kasan_slab_free+0x56/0x70
[   11.716675]  kmem_cache_free+0x249/0x420
[   11.716899]  slab_kmem_cache_release+0x2e/0x40
[   11.717048]  kmem_cache_release+0x16/0x20
[   11.717563]  kobject_put+0x181/0x450
[   11.717769]  sysfs_slab_release+0x16/0x20
[   11.718342]  kmem_cache_destroy+0xf0/0x1d0
[   11.718566]  kmem_cache_double_destroy+0x14e/0x380
[   11.718968]  kunit_try_run_case+0x1a5/0x480
[   11.719249]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.719483]  kthread+0x337/0x6f0
[   11.719644]  ret_from_fork+0x116/0x1d0
[   11.720035]  ret_from_fork_asm+0x1a/0x30
[   11.720356] 
[   11.720593] The buggy address belongs to the object at ffff8881011dab40
[   11.720593]  which belongs to the cache kmem_cache of size 208
[   11.721332] The buggy address is located 0 bytes inside of
[   11.721332]  freed 208-byte region [ffff8881011dab40, ffff8881011dac10)
[   11.722302] 
[   11.722413] The buggy address belongs to the physical page:
[   11.722929] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1011da
[   11.723281] flags: 0x200000000000000(node=0|zone=2)
[   11.723504] page_type: f5(slab)
[   11.723671] raw: 0200000000000000 ffff888100041000 dead000000000122 0000000000000000
[   11.724538] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[   11.725360] page dumped because: kasan: bad access detected
[   11.725636] 
[   11.725731] Memory state around the buggy address:
[   11.726271]  ffff8881011daa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   11.726733]  ffff8881011daa80: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
[   11.727242] >ffff8881011dab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[   11.727513]                                            ^
[   11.727725]  ffff8881011dab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   11.728243]  ffff8881011dac00: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   11.728557] ==================================================================