Hay
Date
June 23, 2025, 7:07 a.m.

Environment
qemu-arm64
qemu-x86_64

[   32.381052] ==================================================================
[   32.381358] BUG: KASAN: invalid-free in kfree+0x270/0x3c8
[   32.382155] Free of addr fff00000c5778001 by task kunit_try_catch/162
[   32.382662] 
[   32.382766] CPU: 1 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250623 #1 PREEMPT 
[   32.383500] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.383568] Hardware name: linux,dummy-virt (DT)
[   32.383651] Call trace:
[   32.383717]  show_stack+0x20/0x38 (C)
[   32.383981]  dump_stack_lvl+0x8c/0xd0
[   32.384124]  print_report+0x118/0x608
[   32.384507]  kasan_report_invalid_free+0xc0/0xe8
[   32.384711]  __kasan_kfree_large+0x5c/0xa8
[   32.385001]  free_large_kmalloc+0x68/0x150
[   32.385135]  kfree+0x270/0x3c8
[   32.385238]  kmalloc_large_invalid_free+0x108/0x270
[   32.385607]  kunit_try_run_case+0x170/0x3f0
[   32.385759]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.385943]  kthread+0x328/0x630
[   32.387137]  ret_from_fork+0x10/0x20
[   32.387489] 
[   32.387561] The buggy address belongs to the physical page:
[   32.387635] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105778
[   32.387756] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   32.387868] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   32.388074] page_type: f8(unknown)
[   32.388264] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   32.388510] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   32.388750] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   32.388862] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   32.388973] head: 0bfffe0000000002 ffffc1ffc315de01 00000000ffffffff 00000000ffffffff
[   32.389754] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   32.389862] page dumped because: kasan: bad access detected
[   32.390188] 
[   32.390234] Memory state around the buggy address:
[   32.390309]  fff00000c5777f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.390414]  fff00000c5777f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.390513] >fff00000c5778000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.390722]                    ^
[   32.391511]  fff00000c5778080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.391634]  fff00000c5778100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.392147] ==================================================================

[   21.224074] ==================================================================
[   21.224886] BUG: KASAN: invalid-free in kfree+0x274/0x3f0
[   21.225339] Free of addr ffff888102990001 by task kunit_try_catch/179
[   21.225577] 
[   21.225758] CPU: 1 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250623 #1 PREEMPT(voluntary) 
[   21.225872] Tainted: [B]=BAD_PAGE, [N]=TEST
[   21.225894] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   21.225925] Call Trace:
[   21.225949]  <TASK>
[   21.225974]  dump_stack_lvl+0x73/0xb0
[   21.226038]  print_report+0xd1/0x650
[   21.226218]  ? __virt_addr_valid+0x1db/0x2d0
[   21.226265]  ? kasan_addr_to_slab+0x11/0xa0
[   21.226296]  ? kfree+0x274/0x3f0
[   21.226356]  kasan_report_invalid_free+0x10a/0x130
[   21.226412]  ? kfree+0x274/0x3f0
[   21.226450]  ? kfree+0x274/0x3f0
[   21.226482]  __kasan_kfree_large+0x86/0xd0
[   21.226512]  free_large_kmalloc+0x52/0x110
[   21.226548]  kfree+0x274/0x3f0
[   21.226591]  kmalloc_large_invalid_free+0x120/0x2b0
[   21.226622]  ? __pfx_kmalloc_large_invalid_free+0x10/0x10
[   21.226643]  ? __schedule+0x10cc/0x2b60
[   21.226661]  ? __pfx_read_tsc+0x10/0x10
[   21.226679]  ? ktime_get_ts64+0x86/0x230
[   21.226699]  kunit_try_run_case+0x1a5/0x480
[   21.226719]  ? __pfx_kunit_try_run_case+0x10/0x10
[   21.226737]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   21.226755]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   21.226773]  ? __kthread_parkme+0x82/0x180
[   21.226790]  ? preempt_count_sub+0x50/0x80
[   21.226809]  ? __pfx_kunit_try_run_case+0x10/0x10
[   21.226873]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   21.226916]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   21.226955]  kthread+0x337/0x6f0
[   21.226975]  ? trace_preempt_on+0x20/0xc0
[   21.226995]  ? __pfx_kthread+0x10/0x10
[   21.227012]  ? _raw_spin_unlock_irq+0x47/0x80
[   21.227029]  ? calculate_sigpending+0x7b/0xa0
[   21.227047]  ? __pfx_kthread+0x10/0x10
[   21.227065]  ret_from_fork+0x116/0x1d0
[   21.227080]  ? __pfx_kthread+0x10/0x10
[   21.227366]  ret_from_fork_asm+0x1a/0x30
[   21.227418]  </TASK>
[   21.227431] 
[   21.239081] The buggy address belongs to the physical page:
[   21.239929] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102990
[   21.240286] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   21.240643] flags: 0x200000000000040(head|node=0|zone=2)
[   21.240886] page_type: f8(unknown)
[   21.241491] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   21.241853] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   21.242328] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   21.242939] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   21.243559] head: 0200000000000002 ffffea00040a6401 00000000ffffffff 00000000ffffffff
[   21.244045] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   21.244750] page dumped because: kasan: bad access detected
[   21.245107] 
[   21.245226] Memory state around the buggy address:
[   21.245540]  ffff88810298ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   21.245858]  ffff88810298ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   21.246212] >ffff888102990000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   21.246556]                    ^
[   21.246789]  ffff888102990080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   21.247145]  ffff888102990100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   21.247758] ==================================================================