Date
June 18, 2025, 6:43 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 21.860426] ================================================================== [ 21.860540] BUG: KASAN: double-free in kmem_cache_double_free+0x190/0x3c8 [ 21.860631] Free of addr fff00000c770e000 by task kunit_try_catch/219 [ 21.860684] [ 21.860729] CPU: 0 UID: 0 PID: 219 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc2-next-20250618 #1 PREEMPT [ 21.860833] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 21.860868] Hardware name: linux,dummy-virt (DT) [ 21.860905] Call trace: [ 21.860933] show_stack+0x20/0x38 (C) [ 21.860994] dump_stack_lvl+0x8c/0xd0 [ 21.861068] print_report+0x118/0x608 [ 21.861124] kasan_report_invalid_free+0xc0/0xe8 [ 21.861181] check_slab_allocation+0xd4/0x108 [ 21.861236] __kasan_slab_pre_free+0x2c/0x48 [ 21.861291] kmem_cache_free+0xf0/0x468 [ 21.861345] kmem_cache_double_free+0x190/0x3c8 [ 21.861399] kunit_try_run_case+0x170/0x3f0 [ 21.861453] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.861510] kthread+0x328/0x630 [ 21.861558] ret_from_fork+0x10/0x20 [ 21.861615] [ 21.861636] Allocated by task 219: [ 21.861670] kasan_save_stack+0x3c/0x68 [ 21.861717] kasan_save_track+0x20/0x40 [ 21.861757] kasan_save_alloc_info+0x40/0x58 [ 21.861801] __kasan_slab_alloc+0xa8/0xb0 [ 21.861841] kmem_cache_alloc_noprof+0x10c/0x398 [ 21.861881] kmem_cache_double_free+0x12c/0x3c8 [ 21.861924] kunit_try_run_case+0x170/0x3f0 [ 21.861962] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.862007] kthread+0x328/0x630 [ 21.862055] ret_from_fork+0x10/0x20 [ 21.862097] [ 21.862118] Freed by task 219: [ 21.862148] kasan_save_stack+0x3c/0x68 [ 21.862189] kasan_save_track+0x20/0x40 [ 21.862228] kasan_save_free_info+0x4c/0x78 [ 21.862271] __kasan_slab_free+0x6c/0x98 [ 21.862310] kmem_cache_free+0x260/0x468 [ 21.862348] kmem_cache_double_free+0x140/0x3c8 [ 21.862389] kunit_try_run_case+0x170/0x3f0 [ 21.862429] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.862503] kthread+0x328/0x630 [ 21.862541] ret_from_fork+0x10/0x20 [ 21.862580] [ 21.862603] The buggy address belongs to the object at fff00000c770e000 [ 21.862603] which belongs to the cache test_cache of size 200 [ 21.862667] The buggy address is located 0 bytes inside of [ 21.862667] 200-byte region [fff00000c770e000, fff00000c770e0c8) [ 21.862730] [ 21.862753] The buggy address belongs to the physical page: [ 21.862789] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10770e [ 21.862849] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.862908] page_type: f5(slab) [ 21.862958] raw: 0bfffe0000000000 fff00000c5bedc80 dead000000000122 0000000000000000 [ 21.863012] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 21.863077] page dumped because: kasan: bad access detected [ 21.863113] [ 21.863132] Memory state around the buggy address: [ 21.863170] fff00000c770df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.863218] fff00000c770df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.863265] >fff00000c770e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.863306] ^ [ 21.863335] fff00000c770e080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 21.863381] fff00000c770e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.863424] ==================================================================
[ 11.825265] ================================================================== [ 11.826054] BUG: KASAN: double-free in kmem_cache_double_free+0x1e5/0x480 [ 11.826342] Free of addr ffff888102624000 by task kunit_try_catch/235 [ 11.826622] [ 11.826817] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250618 #1 PREEMPT(voluntary) [ 11.826864] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.826877] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.826899] Call Trace: [ 11.826911] <TASK> [ 11.826927] dump_stack_lvl+0x73/0xb0 [ 11.826958] print_report+0xd1/0x650 [ 11.826978] ? __virt_addr_valid+0x1db/0x2d0 [ 11.827002] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.827025] ? kmem_cache_double_free+0x1e5/0x480 [ 11.827048] kasan_report_invalid_free+0x10a/0x130 [ 11.827070] ? kmem_cache_double_free+0x1e5/0x480 [ 11.827094] ? kmem_cache_double_free+0x1e5/0x480 [ 11.827116] check_slab_allocation+0x101/0x130 [ 11.827136] __kasan_slab_pre_free+0x28/0x40 [ 11.827155] kmem_cache_free+0xed/0x420 [ 11.827174] ? kmem_cache_alloc_noprof+0x123/0x3f0 [ 11.827193] ? kmem_cache_double_free+0x1e5/0x480 [ 11.827233] kmem_cache_double_free+0x1e5/0x480 [ 11.827255] ? __pfx_kmem_cache_double_free+0x10/0x10 [ 11.827277] ? finish_task_switch.isra.0+0x153/0x700 [ 11.827298] ? __switch_to+0x47/0xf50 [ 11.827325] ? __pfx_read_tsc+0x10/0x10 [ 11.827346] ? ktime_get_ts64+0x86/0x230 [ 11.827371] kunit_try_run_case+0x1a5/0x480 [ 11.827395] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.827415] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.827437] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.827458] ? __kthread_parkme+0x82/0x180 [ 11.827478] ? preempt_count_sub+0x50/0x80 [ 11.827499] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.827520] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.827541] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.827563] kthread+0x337/0x6f0 [ 11.827581] ? trace_preempt_on+0x20/0xc0 [ 11.827604] ? __pfx_kthread+0x10/0x10 [ 11.827623] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.827642] ? calculate_sigpending+0x7b/0xa0 [ 11.827665] ? __pfx_kthread+0x10/0x10 [ 11.827685] ret_from_fork+0x116/0x1d0 [ 11.827702] ? __pfx_kthread+0x10/0x10 [ 11.827721] ret_from_fork_asm+0x1a/0x30 [ 11.827749] </TASK> [ 11.827760] [ 11.839972] Allocated by task 235: [ 11.840288] kasan_save_stack+0x45/0x70 [ 11.840679] kasan_save_track+0x18/0x40 [ 11.841064] kasan_save_alloc_info+0x3b/0x50 [ 11.841678] __kasan_slab_alloc+0x91/0xa0 [ 11.842073] kmem_cache_alloc_noprof+0x123/0x3f0 [ 11.842291] kmem_cache_double_free+0x14f/0x480 [ 11.842499] kunit_try_run_case+0x1a5/0x480 [ 11.842867] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.843379] kthread+0x337/0x6f0 [ 11.843737] ret_from_fork+0x116/0x1d0 [ 11.843933] ret_from_fork_asm+0x1a/0x30 [ 11.844065] [ 11.844129] Freed by task 235: [ 11.844262] kasan_save_stack+0x45/0x70 [ 11.844390] kasan_save_track+0x18/0x40 [ 11.844545] kasan_save_free_info+0x3f/0x60 [ 11.844685] __kasan_slab_free+0x56/0x70 [ 11.845146] kmem_cache_free+0x249/0x420 [ 11.845367] kmem_cache_double_free+0x16a/0x480 [ 11.845516] kunit_try_run_case+0x1a5/0x480 [ 11.845714] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.845950] kthread+0x337/0x6f0 [ 11.846077] ret_from_fork+0x116/0x1d0 [ 11.846262] ret_from_fork_asm+0x1a/0x30 [ 11.846415] [ 11.846480] The buggy address belongs to the object at ffff888102624000 [ 11.846480] which belongs to the cache test_cache of size 200 [ 11.846999] The buggy address is located 0 bytes inside of [ 11.846999] 200-byte region [ffff888102624000, ffff8881026240c8) [ 11.847534] [ 11.847602] The buggy address belongs to the physical page: [ 11.848015] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102624 [ 11.848526] flags: 0x200000000000000(node=0|zone=2) [ 11.848700] page_type: f5(slab) [ 11.849598] raw: 0200000000000000 ffff88810167fc80 dead000000000122 0000000000000000 [ 11.849985] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 11.850223] page dumped because: kasan: bad access detected [ 11.851704] [ 11.851983] Memory state around the buggy address: [ 11.852153] ffff888102623f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.852386] ffff888102623f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.852596] >ffff888102624000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.852813] ^ [ 11.852923] ffff888102624080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 11.853131] ffff888102624100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.854831] ==================================================================