Date
June 16, 2025, 7:07 a.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 |
[ 19.598045] ================================================================== [ 19.598633] BUG: KASAN: double-free in kfree_sensitive+0x3c/0xb0 [ 19.598798] Free of addr fff00000c63971c0 by task kunit_try_catch/201 [ 19.598899] [ 19.599150] CPU: 0 UID: 0 PID: 201 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT [ 19.599416] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.599488] Hardware name: linux,dummy-virt (DT) [ 19.599592] Call trace: [ 19.599653] show_stack+0x20/0x38 (C) [ 19.599799] dump_stack_lvl+0x8c/0xd0 [ 19.599918] print_report+0x118/0x608 [ 19.600024] kasan_report_invalid_free+0xc0/0xe8 [ 19.600136] check_slab_allocation+0xd4/0x108 [ 19.600291] __kasan_slab_pre_free+0x2c/0x48 [ 19.600547] kfree+0xe8/0x3c8 [ 19.600745] kfree_sensitive+0x3c/0xb0 [ 19.600884] kmalloc_double_kzfree+0x168/0x308 [ 19.601030] kunit_try_run_case+0x170/0x3f0 [ 19.601172] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.601307] kthread+0x328/0x630 [ 19.601411] ret_from_fork+0x10/0x20 [ 19.601549] [ 19.601592] Allocated by task 201: [ 19.601660] kasan_save_stack+0x3c/0x68 [ 19.601753] kasan_save_track+0x20/0x40 [ 19.601866] kasan_save_alloc_info+0x40/0x58 [ 19.602229] __kasan_kmalloc+0xd4/0xd8 [ 19.602354] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.602462] kmalloc_double_kzfree+0xb8/0x308 [ 19.602559] kunit_try_run_case+0x170/0x3f0 [ 19.602658] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.602767] kthread+0x328/0x630 [ 19.602870] ret_from_fork+0x10/0x20 [ 19.602969] [ 19.603019] Freed by task 201: [ 19.603086] kasan_save_stack+0x3c/0x68 [ 19.603182] kasan_save_track+0x20/0x40 [ 19.603283] kasan_save_free_info+0x4c/0x78 [ 19.603376] __kasan_slab_free+0x6c/0x98 [ 19.603468] kfree+0x214/0x3c8 [ 19.603562] kfree_sensitive+0x80/0xb0 [ 19.603650] kmalloc_double_kzfree+0x11c/0x308 [ 19.604084] kunit_try_run_case+0x170/0x3f0 [ 19.604230] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.604343] kthread+0x328/0x630 [ 19.604426] ret_from_fork+0x10/0x20 [ 19.604514] [ 19.604565] The buggy address belongs to the object at fff00000c63971c0 [ 19.604565] which belongs to the cache kmalloc-16 of size 16 [ 19.604710] The buggy address is located 0 bytes inside of [ 19.604710] 16-byte region [fff00000c63971c0, fff00000c63971d0) [ 19.605058] [ 19.605121] The buggy address belongs to the physical page: [ 19.605206] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106397 [ 19.605339] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.605446] page_type: f5(slab) [ 19.605527] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 19.605801] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 19.606163] page dumped because: kasan: bad access detected [ 19.606261] [ 19.606341] Memory state around the buggy address: [ 19.606447] fff00000c6397080: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc [ 19.606590] fff00000c6397100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 19.606702] >fff00000c6397180: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 19.606797] ^ [ 19.606893] fff00000c6397200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.607014] fff00000c6397280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.607115] ==================================================================
[ 11.830215] ================================================================== [ 11.830832] BUG: KASAN: double-free in kfree_sensitive+0x2e/0x90 [ 11.831129] Free of addr ffff888102225de0 by task kunit_try_catch/217 [ 11.831451] [ 11.831570] CPU: 0 UID: 0 PID: 217 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT(voluntary) [ 11.831616] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.831627] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.831707] Call Trace: [ 11.831722] <TASK> [ 11.831807] dump_stack_lvl+0x73/0xb0 [ 11.831851] print_report+0xd1/0x650 [ 11.831872] ? __virt_addr_valid+0x1db/0x2d0 [ 11.831895] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.831916] ? kfree_sensitive+0x2e/0x90 [ 11.831947] kasan_report_invalid_free+0x10a/0x130 [ 11.831970] ? kfree_sensitive+0x2e/0x90 [ 11.831990] ? kfree_sensitive+0x2e/0x90 [ 11.832009] check_slab_allocation+0x101/0x130 [ 11.832029] __kasan_slab_pre_free+0x28/0x40 [ 11.832049] kfree+0xf0/0x3f0 [ 11.832070] ? kfree_sensitive+0x2e/0x90 [ 11.832090] kfree_sensitive+0x2e/0x90 [ 11.832108] kmalloc_double_kzfree+0x19c/0x350 [ 11.832130] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 11.832152] ? __schedule+0x10cc/0x2b60 [ 11.832173] ? __pfx_read_tsc+0x10/0x10 [ 11.832193] ? ktime_get_ts64+0x86/0x230 [ 11.832218] kunit_try_run_case+0x1a5/0x480 [ 11.832240] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.832261] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.832282] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.832303] ? __kthread_parkme+0x82/0x180 [ 11.832324] ? preempt_count_sub+0x50/0x80 [ 11.832346] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.832369] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.832439] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.832463] kthread+0x337/0x6f0 [ 11.832482] ? trace_preempt_on+0x20/0xc0 [ 11.832505] ? __pfx_kthread+0x10/0x10 [ 11.832524] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.832544] ? calculate_sigpending+0x7b/0xa0 [ 11.832566] ? __pfx_kthread+0x10/0x10 [ 11.832587] ret_from_fork+0x116/0x1d0 [ 11.832604] ? __pfx_kthread+0x10/0x10 [ 11.832623] ret_from_fork_asm+0x1a/0x30 [ 11.832652] </TASK> [ 11.832662] [ 11.842016] Allocated by task 217: [ 11.842220] kasan_save_stack+0x45/0x70 [ 11.842422] kasan_save_track+0x18/0x40 [ 11.842546] kasan_save_alloc_info+0x3b/0x50 [ 11.843182] __kasan_kmalloc+0xb7/0xc0 [ 11.843402] __kmalloc_cache_noprof+0x189/0x420 [ 11.843797] kmalloc_double_kzfree+0xa9/0x350 [ 11.843996] kunit_try_run_case+0x1a5/0x480 [ 11.844157] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.844400] kthread+0x337/0x6f0 [ 11.844803] ret_from_fork+0x116/0x1d0 [ 11.845164] ret_from_fork_asm+0x1a/0x30 [ 11.845362] [ 11.845829] Freed by task 217: [ 11.845999] kasan_save_stack+0x45/0x70 [ 11.846163] kasan_save_track+0x18/0x40 [ 11.846336] kasan_save_free_info+0x3f/0x60 [ 11.847059] __kasan_slab_free+0x56/0x70 [ 11.847242] kfree+0x222/0x3f0 [ 11.847627] kfree_sensitive+0x67/0x90 [ 11.847832] kmalloc_double_kzfree+0x12b/0x350 [ 11.848042] kunit_try_run_case+0x1a5/0x480 [ 11.848252] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.848524] kthread+0x337/0x6f0 [ 11.849047] ret_from_fork+0x116/0x1d0 [ 11.849198] ret_from_fork_asm+0x1a/0x30 [ 11.849679] [ 11.849915] The buggy address belongs to the object at ffff888102225de0 [ 11.849915] which belongs to the cache kmalloc-16 of size 16 [ 11.850679] The buggy address is located 0 bytes inside of [ 11.850679] 16-byte region [ffff888102225de0, ffff888102225df0) [ 11.851158] [ 11.851255] The buggy address belongs to the physical page: [ 11.851806] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102225 [ 11.852176] flags: 0x200000000000000(node=0|zone=2) [ 11.852366] page_type: f5(slab) [ 11.852675] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 11.852970] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 11.853263] page dumped because: kasan: bad access detected [ 11.853539] [ 11.853608] Memory state around the buggy address: [ 11.853820] ffff888102225c80: 00 02 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 11.854073] ffff888102225d00: 00 05 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 11.854389] >ffff888102225d80: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 11.854643] ^ [ 11.854851] ffff888102225e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.855176] ffff888102225e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.855532] ==================================================================