Date
June 20, 2025, 12:38 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 33.159259] ================================================================== [ 33.160087] BUG: KASAN: double-free in kmem_cache_double_free+0x190/0x3c8 [ 33.160513] Free of addr fff00000c7685000 by task kunit_try_catch/220 [ 33.160667] [ 33.160782] CPU: 0 UID: 0 PID: 220 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250620 #1 PREEMPT [ 33.161012] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.161094] Hardware name: linux,dummy-virt (DT) [ 33.161173] Call trace: [ 33.161220] show_stack+0x20/0x38 (C) [ 33.161344] dump_stack_lvl+0x8c/0xd0 [ 33.161465] print_report+0x118/0x608 [ 33.161591] kasan_report_invalid_free+0xc0/0xe8 [ 33.161726] check_slab_allocation+0xd4/0x108 [ 33.161892] __kasan_slab_pre_free+0x2c/0x48 [ 33.162062] kmem_cache_free+0xf0/0x468 [ 33.162187] kmem_cache_double_free+0x190/0x3c8 [ 33.162310] kunit_try_run_case+0x170/0x3f0 [ 33.162441] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.162620] kthread+0x328/0x630 [ 33.162719] ret_from_fork+0x10/0x20 [ 33.162834] [ 33.162876] Allocated by task 220: [ 33.163699] kasan_save_stack+0x3c/0x68 [ 33.163836] kasan_save_track+0x20/0x40 [ 33.163927] kasan_save_alloc_info+0x40/0x58 [ 33.164029] __kasan_slab_alloc+0xa8/0xb0 [ 33.164115] kmem_cache_alloc_noprof+0x10c/0x398 [ 33.164212] kmem_cache_double_free+0x12c/0x3c8 [ 33.164327] kunit_try_run_case+0x170/0x3f0 [ 33.164417] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.164520] kthread+0x328/0x630 [ 33.164850] ret_from_fork+0x10/0x20 [ 33.164920] [ 33.164958] Freed by task 220: [ 33.165025] kasan_save_stack+0x3c/0x68 [ 33.165109] kasan_save_track+0x20/0x40 [ 33.165262] kasan_save_free_info+0x4c/0x78 [ 33.165538] __kasan_slab_free+0x6c/0x98 [ 33.165662] kmem_cache_free+0x260/0x468 [ 33.165761] kmem_cache_double_free+0x140/0x3c8 [ 33.165860] kunit_try_run_case+0x170/0x3f0 [ 33.166036] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.166261] kthread+0x328/0x630 [ 33.166342] ret_from_fork+0x10/0x20 [ 33.166710] [ 33.167051] The buggy address belongs to the object at fff00000c7685000 [ 33.167051] which belongs to the cache test_cache of size 200 [ 33.167348] The buggy address is located 0 bytes inside of [ 33.167348] 200-byte region [fff00000c7685000, fff00000c76850c8) [ 33.167843] [ 33.168089] The buggy address belongs to the physical page: [ 33.168186] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107685 [ 33.168577] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.168935] page_type: f5(slab) [ 33.169147] raw: 0bfffe0000000000 fff00000c1b9e8c0 dead000000000122 0000000000000000 [ 33.169295] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 33.169400] page dumped because: kasan: bad access detected [ 33.169459] [ 33.169491] Memory state around the buggy address: [ 33.169554] fff00000c7684f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.169645] fff00000c7684f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.170030] >fff00000c7685000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.170580] ^ [ 33.170705] fff00000c7685080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 33.170831] fff00000c7685100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.170935] ==================================================================
[ 26.404222] ================================================================== [ 26.404842] BUG: KASAN: double-free in kmem_cache_double_free+0x1e5/0x480 [ 26.405335] Free of addr ffff888102ab2000 by task kunit_try_catch/238 [ 26.406469] [ 26.406871] CPU: 1 UID: 0 PID: 238 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250620 #1 PREEMPT(voluntary) [ 26.406944] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.406959] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.406984] Call Trace: [ 26.407005] <TASK> [ 26.407030] dump_stack_lvl+0x73/0xb0 [ 26.407075] print_report+0xd1/0x650 [ 26.407100] ? __virt_addr_valid+0x1db/0x2d0 [ 26.407127] ? kasan_complete_mode_report_info+0x64/0x200 [ 26.407410] ? kmem_cache_double_free+0x1e5/0x480 [ 26.407468] kasan_report_invalid_free+0x10a/0x130 [ 26.407613] ? kmem_cache_double_free+0x1e5/0x480 [ 26.407672] ? kmem_cache_double_free+0x1e5/0x480 [ 26.407714] check_slab_allocation+0x101/0x130 [ 26.407743] __kasan_slab_pre_free+0x28/0x40 [ 26.407764] kmem_cache_free+0xed/0x420 [ 26.407788] ? kmem_cache_alloc_noprof+0x123/0x3f0 [ 26.407809] ? kmem_cache_double_free+0x1e5/0x480 [ 26.407835] kmem_cache_double_free+0x1e5/0x480 [ 26.407859] ? __pfx_kmem_cache_double_free+0x10/0x10 [ 26.407882] ? finish_task_switch.isra.0+0x153/0x700 [ 26.407908] ? __switch_to+0x47/0xf50 [ 26.407938] ? __pfx_read_tsc+0x10/0x10 [ 26.407961] ? ktime_get_ts64+0x86/0x230 [ 26.407990] kunit_try_run_case+0x1a5/0x480 [ 26.408017] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.408039] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.408064] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.408087] ? __kthread_parkme+0x82/0x180 [ 26.408109] ? preempt_count_sub+0x50/0x80 [ 26.408132] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.408166] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.408199] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.408223] kthread+0x337/0x6f0 [ 26.408243] ? trace_preempt_on+0x20/0xc0 [ 26.408269] ? __pfx_kthread+0x10/0x10 [ 26.408291] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.408312] ? calculate_sigpending+0x7b/0xa0 [ 26.408337] ? __pfx_kthread+0x10/0x10 [ 26.408360] ret_from_fork+0x116/0x1d0 [ 26.408379] ? __pfx_kthread+0x10/0x10 [ 26.408400] ret_from_fork_asm+0x1a/0x30 [ 26.408435] </TASK> [ 26.408471] [ 26.421532] Allocated by task 238: [ 26.421971] kasan_save_stack+0x45/0x70 [ 26.422476] kasan_save_track+0x18/0x40 [ 26.422813] kasan_save_alloc_info+0x3b/0x50 [ 26.423058] __kasan_slab_alloc+0x91/0xa0 [ 26.423341] kmem_cache_alloc_noprof+0x123/0x3f0 [ 26.423778] kmem_cache_double_free+0x14f/0x480 [ 26.424247] kunit_try_run_case+0x1a5/0x480 [ 26.424462] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.424862] kthread+0x337/0x6f0 [ 26.425031] ret_from_fork+0x116/0x1d0 [ 26.425520] ret_from_fork_asm+0x1a/0x30 [ 26.425907] [ 26.426018] Freed by task 238: [ 26.426203] kasan_save_stack+0x45/0x70 [ 26.426390] kasan_save_track+0x18/0x40 [ 26.426617] kasan_save_free_info+0x3f/0x60 [ 26.426947] __kasan_slab_free+0x56/0x70 [ 26.427333] kmem_cache_free+0x249/0x420 [ 26.427764] kmem_cache_double_free+0x16a/0x480 [ 26.428126] kunit_try_run_case+0x1a5/0x480 [ 26.428405] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.428577] kthread+0x337/0x6f0 [ 26.428696] ret_from_fork+0x116/0x1d0 [ 26.428818] ret_from_fork_asm+0x1a/0x30 [ 26.429087] [ 26.429332] The buggy address belongs to the object at ffff888102ab2000 [ 26.429332] which belongs to the cache test_cache of size 200 [ 26.430292] The buggy address is located 0 bytes inside of [ 26.430292] 200-byte region [ffff888102ab2000, ffff888102ab20c8) [ 26.431417] [ 26.431686] The buggy address belongs to the physical page: [ 26.432194] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102ab2 [ 26.432765] flags: 0x200000000000000(node=0|zone=2) [ 26.432988] page_type: f5(slab) [ 26.433189] raw: 0200000000000000 ffff888101a683c0 dead000000000122 0000000000000000 [ 26.434171] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 26.434715] page dumped because: kasan: bad access detected [ 26.436808] [ 26.436963] Memory state around the buggy address: [ 26.437148] ffff888102ab1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.437686] ffff888102ab1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.438049] >ffff888102ab2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.438283] ^ [ 26.438600] ffff888102ab2080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 26.439477] ffff888102ab2100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.440425] ==================================================================