Date
July 2, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.109731] ================================================================== [ 31.109852] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 31.109920] Read of size 4 at addr fff00000c91f2940 by task swapper/0/0 [ 31.109980] [ 31.110018] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT [ 31.110107] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.110135] Hardware name: linux,dummy-virt (DT) [ 31.110167] Call trace: [ 31.110190] show_stack+0x20/0x38 (C) [ 31.110240] dump_stack_lvl+0x8c/0xd0 [ 31.110290] print_report+0x118/0x608 [ 31.110336] kasan_report+0xdc/0x128 [ 31.110383] __asan_report_load4_noabort+0x20/0x30 [ 31.110431] rcu_uaf_reclaim+0x64/0x70 [ 31.110476] rcu_core+0x9f4/0x1e20 [ 31.110525] rcu_core_si+0x18/0x30 [ 31.110571] handle_softirqs+0x374/0xb28 [ 31.110621] __do_softirq+0x1c/0x28 [ 31.110663] ____do_softirq+0x18/0x30 [ 31.110709] call_on_irq_stack+0x24/0x30 [ 31.110754] do_softirq_own_stack+0x24/0x38 [ 31.110799] __irq_exit_rcu+0x1fc/0x318 [ 31.110845] irq_exit_rcu+0x1c/0x80 [ 31.110890] el1_interrupt+0x38/0x58 [ 31.110944] el1h_64_irq_handler+0x18/0x28 [ 31.110990] el1h_64_irq+0x6c/0x70 [ 31.111076] arch_local_irq_enable+0x4/0x8 (P) [ 31.111128] do_idle+0x384/0x4e8 [ 31.111172] cpu_startup_entry+0x64/0x80 [ 31.111218] rest_init+0x160/0x188 [ 31.111263] start_kernel+0x30c/0x3d0 [ 31.111315] __primary_switched+0x8c/0xa0 [ 31.111368] [ 31.111388] Allocated by task 231: [ 31.111416] kasan_save_stack+0x3c/0x68 [ 31.111459] kasan_save_track+0x20/0x40 [ 31.111497] kasan_save_alloc_info+0x40/0x58 [ 31.111535] __kasan_kmalloc+0xd4/0xd8 [ 31.113505] __kmalloc_cache_noprof+0x16c/0x3c0 [ 31.113562] rcu_uaf+0xb0/0x2d8 [ 31.113597] kunit_try_run_case+0x170/0x3f0 [ 31.113639] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.113683] kthread+0x328/0x630 [ 31.113717] ret_from_fork+0x10/0x20 [ 31.113753] [ 31.113774] Freed by task 0: [ 31.113800] kasan_save_stack+0x3c/0x68 [ 31.113839] kasan_save_track+0x20/0x40 [ 31.113877] kasan_save_free_info+0x4c/0x78 [ 31.113914] __kasan_slab_free+0x6c/0x98 [ 31.113963] kfree+0x214/0x3c8 [ 31.113996] rcu_uaf_reclaim+0x28/0x70 [ 31.114030] rcu_core+0x9f4/0x1e20 [ 31.114065] rcu_core_si+0x18/0x30 [ 31.114100] handle_softirqs+0x374/0xb28 [ 31.114136] __do_softirq+0x1c/0x28 [ 31.114169] [ 31.114199] Last potentially related work creation: [ 31.114235] kasan_save_stack+0x3c/0x68 [ 31.114274] kasan_record_aux_stack+0xb4/0xc8 [ 31.114311] __call_rcu_common.constprop.0+0x74/0x8c8 [ 31.114353] call_rcu+0x18/0x30 [ 31.114385] rcu_uaf+0x14c/0x2d8 [ 31.114420] kunit_try_run_case+0x170/0x3f0 [ 31.114460] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.114504] kthread+0x328/0x630 [ 31.114536] ret_from_fork+0x10/0x20 [ 31.114575] [ 31.114602] The buggy address belongs to the object at fff00000c91f2940 [ 31.114602] which belongs to the cache kmalloc-32 of size 32 [ 31.114660] The buggy address is located 0 bytes inside of [ 31.114660] freed 32-byte region [fff00000c91f2940, fff00000c91f2960) [ 31.114722] [ 31.114742] The buggy address belongs to the physical page: [ 31.114774] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1091f2 [ 31.114829] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.114879] page_type: f5(slab) [ 31.114918] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 31.114979] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 31.115020] page dumped because: kasan: bad access detected [ 31.115052] [ 31.115071] Memory state around the buggy address: [ 31.115102] fff00000c91f2800: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 31.115145] fff00000c91f2880: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 31.115189] >fff00000c91f2900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 31.115226] ^ [ 31.115261] fff00000c91f2980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.115305] fff00000c91f2a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.115344] ==================================================================
[ 32.961526] ================================================================== [ 32.961661] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 32.962677] Read of size 4 at addr fff00000c8db81c0 by task swapper/1/0 [ 32.962811] [ 32.962855] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT [ 32.963600] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.963646] Hardware name: linux,dummy-virt (DT) [ 32.963688] Call trace: [ 32.963979] show_stack+0x20/0x38 (C) [ 32.964878] dump_stack_lvl+0x8c/0xd0 [ 32.965042] print_report+0x118/0x608 [ 32.965525] kasan_report+0xdc/0x128 [ 32.965612] __asan_report_load4_noabort+0x20/0x30 [ 32.965816] rcu_uaf_reclaim+0x64/0x70 [ 32.966212] rcu_core+0x9f4/0x1e20 [ 32.966652] rcu_core_si+0x18/0x30 [ 32.967039] handle_softirqs+0x374/0xb28 [ 32.967102] __do_softirq+0x1c/0x28 [ 32.967477] ____do_softirq+0x18/0x30 [ 32.967565] call_on_irq_stack+0x24/0x30 [ 32.967906] do_softirq_own_stack+0x24/0x38 [ 32.968001] __irq_exit_rcu+0x1fc/0x318 [ 32.968105] irq_exit_rcu+0x1c/0x80 [ 32.968169] el1_interrupt+0x38/0x58 [ 32.968887] el1h_64_irq_handler+0x18/0x28 [ 32.969196] el1h_64_irq+0x6c/0x70 [ 32.969304] arch_local_irq_enable+0x4/0x8 (P) [ 32.969554] do_idle+0x384/0x4e8 [ 32.969609] cpu_startup_entry+0x64/0x80 [ 32.970089] secondary_start_kernel+0x288/0x340 [ 32.970192] __secondary_switched+0xc0/0xc8 [ 32.970526] [ 32.970555] Allocated by task 229: [ 32.971167] kasan_save_stack+0x3c/0x68 [ 32.971516] kasan_save_track+0x20/0x40 [ 32.971669] kasan_save_alloc_info+0x40/0x58 [ 32.971739] __kasan_kmalloc+0xd4/0xd8 [ 32.971780] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.971955] rcu_uaf+0xb0/0x2d8 [ 32.972004] kunit_try_run_case+0x170/0x3f0 [ 32.972430] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.972483] kthread+0x328/0x630 [ 32.972519] ret_from_fork+0x10/0x20 [ 32.972559] [ 32.973293] Freed by task 0: [ 32.973386] kasan_save_stack+0x3c/0x68 [ 32.973742] kasan_save_track+0x20/0x40 [ 32.974025] kasan_save_free_info+0x4c/0x78 [ 32.974436] __kasan_slab_free+0x6c/0x98 [ 32.974482] kfree+0x214/0x3c8 [ 32.974519] rcu_uaf_reclaim+0x28/0x70 [ 32.974557] rcu_core+0x9f4/0x1e20 [ 32.975103] rcu_core_si+0x18/0x30 [ 32.975301] handle_softirqs+0x374/0xb28 [ 32.975398] __do_softirq+0x1c/0x28 [ 32.975437] [ 32.975475] Last potentially related work creation: [ 32.975511] kasan_save_stack+0x3c/0x68 [ 32.975553] kasan_record_aux_stack+0xb4/0xc8 [ 32.975593] __call_rcu_common.constprop.0+0x74/0x8c8 [ 32.975634] call_rcu+0x18/0x30 [ 32.975669] rcu_uaf+0x14c/0x2d8 [ 32.975704] kunit_try_run_case+0x170/0x3f0 [ 32.975744] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.975973] kthread+0x328/0x630 [ 32.976049] ret_from_fork+0x10/0x20 [ 32.976131] [ 32.976549] The buggy address belongs to the object at fff00000c8db81c0 [ 32.976549] which belongs to the cache kmalloc-32 of size 32 [ 32.976701] The buggy address is located 0 bytes inside of [ 32.976701] freed 32-byte region [fff00000c8db81c0, fff00000c8db81e0) [ 32.977025] [ 32.977055] The buggy address belongs to the physical page: [ 32.977328] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108db8 [ 32.977531] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.977886] page_type: f5(slab) [ 32.978069] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000 [ 32.978313] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 32.978636] page dumped because: kasan: bad access detected [ 32.978690] [ 32.979055] Memory state around the buggy address: [ 32.979108] fff00000c8db8080: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 32.979205] fff00000c8db8100: 00 00 00 fc fc fc fc fc 00 00 05 fc fc fc fc fc [ 32.979399] >fff00000c8db8180: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 32.979440] ^ [ 32.979796] fff00000c8db8200: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.979995] fff00000c8db8280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.980110] ==================================================================
[ 23.587819] ================================================================== [ 23.588402] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60 [ 23.588765] Read of size 4 at addr ffff888106098840 by task swapper/1/0 [ 23.589029] [ 23.589220] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) [ 23.589274] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.589286] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.589319] Call Trace: [ 23.589349] <IRQ> [ 23.589379] dump_stack_lvl+0x73/0xb0 [ 23.589412] print_report+0xd1/0x650 [ 23.589434] ? __virt_addr_valid+0x1db/0x2d0 [ 23.589471] ? rcu_uaf_reclaim+0x50/0x60 [ 23.589500] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.589525] ? rcu_uaf_reclaim+0x50/0x60 [ 23.589545] kasan_report+0x141/0x180 [ 23.589566] ? rcu_uaf_reclaim+0x50/0x60 [ 23.589600] __asan_report_load4_noabort+0x18/0x20 [ 23.589623] rcu_uaf_reclaim+0x50/0x60 [ 23.589643] rcu_core+0x66f/0x1c40 [ 23.589757] ? __pfx_rcu_core+0x10/0x10 [ 23.589785] ? ktime_get+0x6b/0x150 [ 23.589808] ? handle_softirqs+0x18e/0x730 [ 23.589833] rcu_core_si+0x12/0x20 [ 23.589853] handle_softirqs+0x209/0x730 [ 23.589873] ? hrtimer_interrupt+0x2fe/0x780 [ 23.589900] ? __pfx_handle_softirqs+0x10/0x10 [ 23.589925] __irq_exit_rcu+0xc9/0x110 [ 23.589945] irq_exit_rcu+0x12/0x20 [ 23.589965] sysvec_apic_timer_interrupt+0x81/0x90 [ 23.589989] </IRQ> [ 23.590019] <TASK> [ 23.590030] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 23.590167] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 23.590396] Code: 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d a3 af 19 00 fb f4 <e9> 7c 1d 02 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 23.590478] RSP: 0000:ffff88810087fdc8 EFLAGS: 00010216 [ 23.590566] RAX: ffff8881c6d2d000 RBX: ffff88810085b000 RCX: ffffffff91ef0225 [ 23.590612] RDX: ffffed102b626193 RSI: 0000000000000004 RDI: 000000000001dc0c [ 23.590661] RBP: ffff88810087fdd0 R08: 0000000000000001 R09: ffffed102b626192 [ 23.590871] R10: ffff88815b130c93 R11: 0000000000015000 R12: 0000000000000001 [ 23.590922] R13: ffffed102010b600 R14: ffffffff93be77d0 R15: 0000000000000000 [ 23.590983] ? ct_kernel_exit.constprop.0+0xa5/0xd0 [ 23.591018] ? default_idle+0xd/0x20 [ 23.591039] arch_cpu_idle+0xd/0x20 [ 23.591060] default_idle_call+0x48/0x80 [ 23.591081] do_idle+0x379/0x4f0 [ 23.591107] ? __pfx_do_idle+0x10/0x10 [ 23.591127] ? _raw_spin_unlock_irqrestore+0x49/0x90 [ 23.591150] ? complete+0x15b/0x1d0 [ 23.591175] cpu_startup_entry+0x5c/0x70 [ 23.591198] start_secondary+0x211/0x290 [ 23.591221] ? __pfx_start_secondary+0x10/0x10 [ 23.591247] common_startup_64+0x13e/0x148 [ 23.591278] </TASK> [ 23.591291] [ 23.606114] Allocated by task 246: [ 23.606476] kasan_save_stack+0x45/0x70 [ 23.606673] kasan_save_track+0x18/0x40 [ 23.607181] kasan_save_alloc_info+0x3b/0x50 [ 23.607369] __kasan_kmalloc+0xb7/0xc0 [ 23.607867] __kmalloc_cache_noprof+0x189/0x420 [ 23.608060] rcu_uaf+0xb0/0x330 [ 23.608476] kunit_try_run_case+0x1a5/0x480 [ 23.608790] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.608986] kthread+0x337/0x6f0 [ 23.609330] ret_from_fork+0x116/0x1d0 [ 23.609523] ret_from_fork_asm+0x1a/0x30 [ 23.609869] [ 23.609963] Freed by task 0: [ 23.610285] kasan_save_stack+0x45/0x70 [ 23.610502] kasan_save_track+0x18/0x40 [ 23.610655] kasan_save_free_info+0x3f/0x60 [ 23.611144] __kasan_slab_free+0x56/0x70 [ 23.611614] kfree+0x222/0x3f0 [ 23.611880] rcu_uaf_reclaim+0x1f/0x60 [ 23.612077] rcu_core+0x66f/0x1c40 [ 23.612220] rcu_core_si+0x12/0x20 [ 23.612393] handle_softirqs+0x209/0x730 [ 23.612555] __irq_exit_rcu+0xc9/0x110 [ 23.612723] irq_exit_rcu+0x12/0x20 [ 23.612888] sysvec_apic_timer_interrupt+0x81/0x90 [ 23.613081] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 23.613303] [ 23.613612] Last potentially related work creation: [ 23.613958] kasan_save_stack+0x45/0x70 [ 23.614125] kasan_record_aux_stack+0xb2/0xc0 [ 23.614341] __call_rcu_common.constprop.0+0x7b/0x9e0 [ 23.614503] call_rcu+0x12/0x20 [ 23.614659] rcu_uaf+0x168/0x330 [ 23.614881] kunit_try_run_case+0x1a5/0x480 [ 23.615035] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.615258] kthread+0x337/0x6f0 [ 23.615407] ret_from_fork+0x116/0x1d0 [ 23.615529] ret_from_fork_asm+0x1a/0x30 [ 23.615668] [ 23.615742] The buggy address belongs to the object at ffff888106098840 [ 23.615742] which belongs to the cache kmalloc-32 of size 32 [ 23.616869] The buggy address is located 0 bytes inside of [ 23.616869] freed 32-byte region [ffff888106098840, ffff888106098860) [ 23.617890] [ 23.618000] The buggy address belongs to the physical page: [ 23.618261] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106098 [ 23.618918] flags: 0x200000000000000(node=0|zone=2) [ 23.619124] page_type: f5(slab) [ 23.619455] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 23.620079] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 23.620523] page dumped because: kasan: bad access detected [ 23.620915] [ 23.621017] Memory state around the buggy address: [ 23.621605] ffff888106098700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 23.622184] ffff888106098780: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc [ 23.622754] >ffff888106098800: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 23.623150] ^ [ 23.623477] ffff888106098880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.624025] ffff888106098900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.624433] ==================================================================
[ 23.885324] ================================================================== [ 23.885870] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60 [ 23.886281] Read of size 4 at addr ffff888106057d80 by task swapper/1/0 [ 23.886594] [ 23.886715] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) [ 23.886770] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.886804] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.886828] Call Trace: [ 23.886873] <IRQ> [ 23.886911] dump_stack_lvl+0x73/0xb0 [ 23.886967] print_report+0xd1/0x650 [ 23.886991] ? __virt_addr_valid+0x1db/0x2d0 [ 23.887018] ? rcu_uaf_reclaim+0x50/0x60 [ 23.887038] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.887074] ? rcu_uaf_reclaim+0x50/0x60 [ 23.887094] kasan_report+0x141/0x180 [ 23.887116] ? rcu_uaf_reclaim+0x50/0x60 [ 23.887141] __asan_report_load4_noabort+0x18/0x20 [ 23.887165] rcu_uaf_reclaim+0x50/0x60 [ 23.887206] rcu_core+0x66f/0x1c40 [ 23.887235] ? __pfx_rcu_core+0x10/0x10 [ 23.887257] ? ktime_get+0x6b/0x150 [ 23.887282] ? handle_softirqs+0x18e/0x730 [ 23.887307] rcu_core_si+0x12/0x20 [ 23.887328] handle_softirqs+0x209/0x730 [ 23.887348] ? hrtimer_interrupt+0x2fe/0x780 [ 23.887375] ? __pfx_handle_softirqs+0x10/0x10 [ 23.887400] __irq_exit_rcu+0xc9/0x110 [ 23.887421] irq_exit_rcu+0x12/0x20 [ 23.887441] sysvec_apic_timer_interrupt+0x81/0x90 [ 23.887465] </IRQ> [ 23.887517] <TASK> [ 23.887530] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 23.887647] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 23.887863] Code: 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d a3 af 19 00 fb f4 <e9> 7c 1d 02 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 23.887970] RSP: 0000:ffff88810087fdc8 EFLAGS: 00010216 [ 23.888073] RAX: ffff8881b832d000 RBX: ffff88810085b000 RCX: ffffffffa08f0225 [ 23.888121] RDX: ffffed102b626193 RSI: 0000000000000004 RDI: 0000000000025b7c [ 23.888165] RBP: ffff88810087fdd0 R08: 0000000000000001 R09: ffffed102b626192 [ 23.888246] R10: ffff88815b130c93 R11: 0000000000013800 R12: 0000000000000001 [ 23.888291] R13: ffffed102010b600 R14: ffffffffa25e77d0 R15: 0000000000000000 [ 23.888352] ? ct_kernel_exit.constprop.0+0xa5/0xd0 [ 23.888407] ? default_idle+0xd/0x20 [ 23.888429] arch_cpu_idle+0xd/0x20 [ 23.888450] default_idle_call+0x48/0x80 [ 23.888472] do_idle+0x379/0x4f0 [ 23.888499] ? __pfx_do_idle+0x10/0x10 [ 23.888520] ? _raw_spin_unlock_irqrestore+0x49/0x90 [ 23.888543] ? complete+0x15b/0x1d0 [ 23.888569] cpu_startup_entry+0x5c/0x70 [ 23.888593] start_secondary+0x211/0x290 [ 23.888616] ? __pfx_start_secondary+0x10/0x10 [ 23.888642] common_startup_64+0x13e/0x148 [ 23.888674] </TASK> [ 23.888687] [ 23.899530] Allocated by task 247: [ 23.899688] kasan_save_stack+0x45/0x70 [ 23.899933] kasan_save_track+0x18/0x40 [ 23.900130] kasan_save_alloc_info+0x3b/0x50 [ 23.900409] __kasan_kmalloc+0xb7/0xc0 [ 23.900596] __kmalloc_cache_noprof+0x189/0x420 [ 23.900824] rcu_uaf+0xb0/0x330 [ 23.901042] kunit_try_run_case+0x1a5/0x480 [ 23.901335] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.901558] kthread+0x337/0x6f0 [ 23.901759] ret_from_fork+0x116/0x1d0 [ 23.901979] ret_from_fork_asm+0x1a/0x30 [ 23.902239] [ 23.902318] Freed by task 0: [ 23.902462] kasan_save_stack+0x45/0x70 [ 23.902702] kasan_save_track+0x18/0x40 [ 23.902906] kasan_save_free_info+0x3f/0x60 [ 23.903132] __kasan_slab_free+0x56/0x70 [ 23.903415] kfree+0x222/0x3f0 [ 23.903590] rcu_uaf_reclaim+0x1f/0x60 [ 23.903888] rcu_core+0x66f/0x1c40 [ 23.904120] rcu_core_si+0x12/0x20 [ 23.904359] handle_softirqs+0x209/0x730 [ 23.904589] __irq_exit_rcu+0xc9/0x110 [ 23.904833] irq_exit_rcu+0x12/0x20 [ 23.905068] sysvec_apic_timer_interrupt+0x81/0x90 [ 23.905275] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 23.905645] [ 23.905760] Last potentially related work creation: [ 23.906022] kasan_save_stack+0x45/0x70 [ 23.906330] kasan_record_aux_stack+0xb2/0xc0 [ 23.906541] __call_rcu_common.constprop.0+0x7b/0x9e0 [ 23.906784] call_rcu+0x12/0x20 [ 23.906988] rcu_uaf+0x168/0x330 [ 23.907194] kunit_try_run_case+0x1a5/0x480 [ 23.907361] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.907589] kthread+0x337/0x6f0 [ 23.907786] ret_from_fork+0x116/0x1d0 [ 23.908002] ret_from_fork_asm+0x1a/0x30 [ 23.908233] [ 23.908403] The buggy address belongs to the object at ffff888106057d80 [ 23.908403] which belongs to the cache kmalloc-32 of size 32 [ 23.908886] The buggy address is located 0 bytes inside of [ 23.908886] freed 32-byte region [ffff888106057d80, ffff888106057da0) [ 23.909668] [ 23.909742] The buggy address belongs to the physical page: [ 23.910012] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106057 [ 23.910454] flags: 0x200000000000000(node=0|zone=2) [ 23.910736] page_type: f5(slab) [ 23.910855] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000 [ 23.911241] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 23.911480] page dumped because: kasan: bad access detected [ 23.911727] [ 23.911815] Memory state around the buggy address: [ 23.912034] ffff888106057c80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 23.912316] ffff888106057d00: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 23.912595] >ffff888106057d80: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 23.912870] ^ [ 23.913003] ffff888106057e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.913353] ffff888106057e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.913566] ==================================================================