Date
June 26, 2025, 9:10 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 41.329600] ================================================================== [ 41.344220] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308 [ 41.351721] Read of size 1 at addr ffff000094759bc0 by task kunit_try_catch/278 [ 41.359122] [ 41.360660] CPU: 6 UID: 0 PID: 278 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 41.360691] Tainted: [B]=BAD_PAGE, [N]=TEST [ 41.360699] Hardware name: Thundercomm Dragonboard 845c (DT) [ 41.360711] Call trace: [ 41.360717] show_stack+0x20/0x38 (C) [ 41.360735] dump_stack_lvl+0x8c/0xd0 [ 41.360754] print_report+0x118/0x608 [ 41.360772] kasan_report+0xdc/0x128 [ 41.360791] __kasan_check_byte+0x54/0x70 [ 41.360809] kfree_sensitive+0x30/0xb0 [ 41.360829] kmalloc_double_kzfree+0x168/0x308 [ 41.360846] kunit_try_run_case+0x170/0x3f0 [ 41.360865] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.360885] kthread+0x328/0x630 [ 41.360899] ret_from_fork+0x10/0x20 [ 41.360917] [ 41.429828] Allocated by task 278: [ 41.433281] kasan_save_stack+0x3c/0x68 [ 41.437177] kasan_save_track+0x20/0x40 [ 41.441071] kasan_save_alloc_info+0x40/0x58 [ 41.445406] __kasan_kmalloc+0xd4/0xd8 [ 41.449212] __kmalloc_cache_noprof+0x16c/0x3c0 [ 41.453811] kmalloc_double_kzfree+0xb8/0x308 [ 41.458235] kunit_try_run_case+0x170/0x3f0 [ 41.462485] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.468049] kthread+0x328/0x630 [ 41.471333] ret_from_fork+0x10/0x20 [ 41.474965] [ 41.476495] Freed by task 278: [ 41.479600] kasan_save_stack+0x3c/0x68 [ 41.483493] kasan_save_track+0x20/0x40 [ 41.487388] kasan_save_free_info+0x4c/0x78 [ 41.491635] __kasan_slab_free+0x6c/0x98 [ 41.495616] kfree+0x214/0x3c8 [ 41.498729] kfree_sensitive+0x80/0xb0 [ 41.502534] kmalloc_double_kzfree+0x11c/0x308 [ 41.507046] kunit_try_run_case+0x170/0x3f0 [ 41.511295] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.516858] kthread+0x328/0x630 [ 41.520142] ret_from_fork+0x10/0x20 [ 41.523780] [ 41.525303] The buggy address belongs to the object at ffff000094759bc0 [ 41.525303] which belongs to the cache kmalloc-16 of size 16 [ 41.537785] The buggy address is located 0 bytes inside of [ 41.537785] freed 16-byte region [ffff000094759bc0, ffff000094759bd0) [ 41.549913] [ 41.551444] The buggy address belongs to the physical page: [ 41.557089] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114759 [ 41.565192] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 41.571807] page_type: f5(slab) [ 41.575009] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 41.582853] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 41.590691] page dumped because: kasan: bad access detected [ 41.596332] [ 41.597853] Memory state around the buggy address: [ 41.602706] ffff000094759a80: 00 02 fc fc 00 02 fc fc 00 03 fc fc 00 03 fc fc [ 41.610013] ffff000094759b00: 00 03 fc fc 00 03 fc fc 00 03 fc fc 00 03 fc fc [ 41.617320] >ffff000094759b80: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 41.624626] ^ [ 41.630013] ffff000094759c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.637319] ffff000094759c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.644624] ==================================================================
[ 27.006257] ================================================================== [ 27.007276] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308 [ 27.007363] Read of size 1 at addr fff00000c16b9ca0 by task kunit_try_catch/204 [ 27.007415] [ 27.007563] CPU: 0 UID: 0 PID: 204 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 27.008175] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.008221] Hardware name: linux,dummy-virt (DT) [ 27.008252] Call trace: [ 27.008473] show_stack+0x20/0x38 (C) [ 27.008854] dump_stack_lvl+0x8c/0xd0 [ 27.009149] print_report+0x118/0x608 [ 27.009205] kasan_report+0xdc/0x128 [ 27.009604] __kasan_check_byte+0x54/0x70 [ 27.009893] kfree_sensitive+0x30/0xb0 [ 27.010094] kmalloc_double_kzfree+0x168/0x308 [ 27.010602] kunit_try_run_case+0x170/0x3f0 [ 27.011048] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.011146] kthread+0x328/0x630 [ 27.011191] ret_from_fork+0x10/0x20 [ 27.011246] [ 27.011265] Allocated by task 204: [ 27.011295] kasan_save_stack+0x3c/0x68 [ 27.012162] kasan_save_track+0x20/0x40 [ 27.012392] kasan_save_alloc_info+0x40/0x58 [ 27.012452] __kasan_kmalloc+0xd4/0xd8 [ 27.012664] __kmalloc_cache_noprof+0x16c/0x3c0 [ 27.012785] kmalloc_double_kzfree+0xb8/0x308 [ 27.012827] kunit_try_run_case+0x170/0x3f0 [ 27.013097] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.013308] kthread+0x328/0x630 [ 27.013620] ret_from_fork+0x10/0x20 [ 27.013846] [ 27.013866] Freed by task 204: [ 27.013894] kasan_save_stack+0x3c/0x68 [ 27.014346] kasan_save_track+0x20/0x40 [ 27.014431] kasan_save_free_info+0x4c/0x78 [ 27.014700] __kasan_slab_free+0x6c/0x98 [ 27.014741] kfree+0x214/0x3c8 [ 27.014775] kfree_sensitive+0x80/0xb0 [ 27.014810] kmalloc_double_kzfree+0x11c/0x308 [ 27.015437] kunit_try_run_case+0x170/0x3f0 [ 27.015484] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 27.015530] kthread+0x328/0x630 [ 27.015562] ret_from_fork+0x10/0x20 [ 27.015599] [ 27.015618] The buggy address belongs to the object at fff00000c16b9ca0 [ 27.015618] which belongs to the cache kmalloc-16 of size 16 [ 27.015678] The buggy address is located 0 bytes inside of [ 27.015678] freed 16-byte region [fff00000c16b9ca0, fff00000c16b9cb0) [ 27.016524] [ 27.016555] The buggy address belongs to the physical page: [ 27.016599] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c16b9ba0 pfn:0x1016b9 [ 27.016684] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 27.017221] page_type: f5(slab) [ 27.017265] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 27.017315] raw: fff00000c16b9ba0 000000008080007f 00000000f5000000 0000000000000000 [ 27.017824] page dumped because: kasan: bad access detected [ 27.017894] [ 27.017914] Memory state around the buggy address: [ 27.017950] fff00000c16b9b80: fa fb fc fc fa fb fc fc 00 04 fc fc fa fb fc fc [ 27.018393] fff00000c16b9c00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 27.018621] >fff00000c16b9c80: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc [ 27.018665] ^ [ 27.018696] fff00000c16b9d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.018740] fff00000c16b9d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.018779] ==================================================================
[ 22.452512] ================================================================== [ 22.453473] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350 [ 22.453814] Read of size 1 at addr ffff88810278b700 by task kunit_try_catch/221 [ 22.454410] [ 22.454539] CPU: 1 UID: 0 PID: 221 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 22.454593] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.454606] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.454630] Call Trace: [ 22.454646] <TASK> [ 22.454666] dump_stack_lvl+0x73/0xb0 [ 22.454700] print_report+0xd1/0x650 [ 22.454723] ? __virt_addr_valid+0x1db/0x2d0 [ 22.454747] ? kmalloc_double_kzfree+0x19c/0x350 [ 22.454769] ? kasan_complete_mode_report_info+0x64/0x200 [ 22.454843] ? kmalloc_double_kzfree+0x19c/0x350 [ 22.454867] kasan_report+0x141/0x180 [ 22.454888] ? kmalloc_double_kzfree+0x19c/0x350 [ 22.454912] ? kmalloc_double_kzfree+0x19c/0x350 [ 22.454933] __kasan_check_byte+0x3d/0x50 [ 22.454954] kfree_sensitive+0x22/0x90 [ 22.454981] kmalloc_double_kzfree+0x19c/0x350 [ 22.455003] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 22.455033] ? __pfx_queued_spin_lock_slowpath+0x10/0x10 [ 22.455060] ? __pfx_read_tsc+0x10/0x10 [ 22.455082] ? ktime_get_ts64+0x86/0x230 [ 22.455106] kunit_try_run_case+0x1a5/0x480 [ 22.455131] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.455153] ? _raw_spin_lock_irqsave+0xf9/0x100 [ 22.455176] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.455200] ? __kthread_parkme+0x82/0x180 [ 22.455230] ? preempt_count_sub+0x50/0x80 [ 22.455253] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.455276] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.455299] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.455322] kthread+0x337/0x6f0 [ 22.455341] ? trace_preempt_on+0x20/0xc0 [ 22.455363] ? __pfx_kthread+0x10/0x10 [ 22.455406] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.455429] ? calculate_sigpending+0x7b/0xa0 [ 22.455452] ? __pfx_kthread+0x10/0x10 [ 22.455473] ret_from_fork+0x116/0x1d0 [ 22.455491] ? __pfx_kthread+0x10/0x10 [ 22.455510] ret_from_fork_asm+0x1a/0x30 [ 22.455541] </TASK> [ 22.455553] [ 22.465646] Allocated by task 221: [ 22.466105] kasan_save_stack+0x45/0x70 [ 22.466327] kasan_save_track+0x18/0x40 [ 22.466506] kasan_save_alloc_info+0x3b/0x50 [ 22.466711] __kasan_kmalloc+0xb7/0xc0 [ 22.466886] __kmalloc_cache_noprof+0x189/0x420 [ 22.467431] kmalloc_double_kzfree+0xa9/0x350 [ 22.467623] kunit_try_run_case+0x1a5/0x480 [ 22.467962] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.468265] kthread+0x337/0x6f0 [ 22.468657] ret_from_fork+0x116/0x1d0 [ 22.468848] ret_from_fork_asm+0x1a/0x30 [ 22.469201] [ 22.469297] Freed by task 221: [ 22.469580] kasan_save_stack+0x45/0x70 [ 22.469887] kasan_save_track+0x18/0x40 [ 22.470033] kasan_save_free_info+0x3f/0x60 [ 22.470398] __kasan_slab_free+0x56/0x70 [ 22.470552] kfree+0x222/0x3f0 [ 22.470714] kfree_sensitive+0x67/0x90 [ 22.471090] kmalloc_double_kzfree+0x12b/0x350 [ 22.471325] kunit_try_run_case+0x1a5/0x480 [ 22.471505] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.471739] kthread+0x337/0x6f0 [ 22.471922] ret_from_fork+0x116/0x1d0 [ 22.472409] ret_from_fork_asm+0x1a/0x30 [ 22.472591] [ 22.472686] The buggy address belongs to the object at ffff88810278b700 [ 22.472686] which belongs to the cache kmalloc-16 of size 16 [ 22.473488] The buggy address is located 0 bytes inside of [ 22.473488] freed 16-byte region [ffff88810278b700, ffff88810278b710) [ 22.474128] [ 22.474329] The buggy address belongs to the physical page: [ 22.474700] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10278b [ 22.475171] flags: 0x200000000000000(node=0|zone=2) [ 22.475403] page_type: f5(slab) [ 22.475558] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122 [ 22.476162] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 22.476440] page dumped because: kasan: bad access detected [ 22.476772] [ 22.476911] Memory state around the buggy address: [ 22.477426] ffff88810278b600: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 22.477726] ffff88810278b680: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 22.478146] >ffff88810278b700: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.478437] ^ [ 22.478573] ffff88810278b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.479241] ffff88810278b800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.479531] ==================================================================