Date
July 3, 2025, 10:10 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 47.150133] ================================================================== [ 47.161494] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x174/0x300 [ 47.169365] Read of size 1 at addr ffff000080e02000 by task kunit_try_catch/324 [ 47.176783] [ 47.178327] CPU: 2 UID: 0 PID: 324 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT [ 47.178364] Tainted: [B]=BAD_PAGE, [N]=TEST [ 47.178374] Hardware name: Thundercomm Dragonboard 845c (DT) [ 47.178392] Call trace: [ 47.178401] show_stack+0x20/0x38 (C) [ 47.178424] dump_stack_lvl+0x8c/0xd0 [ 47.178448] print_report+0x118/0x608 [ 47.178473] kasan_report+0xdc/0x128 [ 47.178491] __kasan_check_byte+0x54/0x70 [ 47.178513] kmem_cache_destroy+0x34/0x218 [ 47.178535] kmem_cache_double_destroy+0x174/0x300 [ 47.178555] kunit_try_run_case+0x170/0x3f0 [ 47.178579] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.178603] kthread+0x328/0x630 [ 47.178622] ret_from_fork+0x10/0x20 [ 47.178644] [ 47.248318] Allocated by task 324: [ 47.251789] kasan_save_stack+0x3c/0x68 [ 47.255695] kasan_save_track+0x20/0x40 [ 47.259601] kasan_save_alloc_info+0x40/0x58 [ 47.263945] __kasan_slab_alloc+0xa8/0xb0 [ 47.268025] kmem_cache_alloc_noprof+0x10c/0x398 [ 47.272724] __kmem_cache_create_args+0x178/0x280 [ 47.277504] kmem_cache_double_destroy+0xc0/0x300 [ 47.282283] kunit_try_run_case+0x170/0x3f0 [ 47.286546] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.292116] kthread+0x328/0x630 [ 47.295404] ret_from_fork+0x10/0x20 [ 47.299048] [ 47.300579] Freed by task 324: [ 47.303689] kasan_save_stack+0x3c/0x68 [ 47.307596] kasan_save_track+0x20/0x40 [ 47.311500] kasan_save_free_info+0x4c/0x78 [ 47.315760] __kasan_slab_free+0x6c/0x98 [ 47.319753] kmem_cache_free+0x260/0x468 [ 47.323745] slab_kmem_cache_release+0x38/0x50 [ 47.328266] kmem_cache_release+0x1c/0x30 [ 47.332344] kobject_put+0x17c/0x420 [ 47.335992] sysfs_slab_release+0x1c/0x30 [ 47.340071] kmem_cache_destroy+0x118/0x218 [ 47.344331] kmem_cache_double_destroy+0x128/0x300 [ 47.349196] kunit_try_run_case+0x170/0x3f0 [ 47.353456] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.359025] kthread+0x328/0x630 [ 47.362312] ret_from_fork+0x10/0x20 [ 47.365959] [ 47.367491] The buggy address belongs to the object at ffff000080e02000 [ 47.367491] which belongs to the cache kmem_cache of size 208 [ 47.380073] The buggy address is located 0 bytes inside of [ 47.380073] freed 208-byte region [ffff000080e02000, ffff000080e020d0) [ 47.392296] [ 47.393830] The buggy address belongs to the physical page: [ 47.399479] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100e02 [ 47.407589] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 47.415351] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 47.422417] page_type: f5(slab) [ 47.425625] raw: 0bfffe0000000040 ffff000080002000 dead000000000122 0000000000000000 [ 47.433473] raw: 0000000000000000 0000000080190019 00000000f5000000 0000000000000000 [ 47.441322] head: 0bfffe0000000040 ffff000080002000 dead000000000122 0000000000000000 [ 47.449257] head: 0000000000000000 0000000080190019 00000000f5000000 0000000000000000 [ 47.457190] head: 0bfffe0000000001 fffffdffc2038081 00000000ffffffff 00000000ffffffff [ 47.465124] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 47.473054] page dumped because: kasan: bad access detected [ 47.478700] [ 47.480231] Memory state around the buggy address: [ 47.485095] ffff000080e01f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.492409] ffff000080e01f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.499724] >ffff000080e02000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.507037] ^ [ 47.510322] ffff000080e02080: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 47.517638] ffff000080e02100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.524951] ==================================================================
[ 32.387511] ================================================================== [ 32.387595] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x174/0x300 [ 32.387674] Read of size 1 at addr fff00000c1c3cc80 by task kunit_try_catch/247 [ 32.387726] [ 32.387769] CPU: 0 UID: 0 PID: 247 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT [ 32.387872] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.387900] Hardware name: linux,dummy-virt (DT) [ 32.387933] Call trace: [ 32.387959] show_stack+0x20/0x38 (C) [ 32.388012] dump_stack_lvl+0x8c/0xd0 [ 32.388065] print_report+0x118/0x608 [ 32.388114] kasan_report+0xdc/0x128 [ 32.388160] __kasan_check_byte+0x54/0x70 [ 32.388209] kmem_cache_destroy+0x34/0x218 [ 32.388258] kmem_cache_double_destroy+0x174/0x300 [ 32.388732] kunit_try_run_case+0x170/0x3f0 [ 32.388807] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.388878] kthread+0x328/0x630 [ 32.388923] ret_from_fork+0x10/0x20 [ 32.388973] [ 32.388994] Allocated by task 247: [ 32.389024] kasan_save_stack+0x3c/0x68 [ 32.389069] kasan_save_track+0x20/0x40 [ 32.389108] kasan_save_alloc_info+0x40/0x58 [ 32.389148] __kasan_slab_alloc+0xa8/0xb0 [ 32.389187] kmem_cache_alloc_noprof+0x10c/0x398 [ 32.389231] __kmem_cache_create_args+0x178/0x280 [ 32.389272] kmem_cache_double_destroy+0xc0/0x300 [ 32.389314] kunit_try_run_case+0x170/0x3f0 [ 32.389354] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.389399] kthread+0x328/0x630 [ 32.389433] ret_from_fork+0x10/0x20 [ 32.389469] [ 32.389489] Freed by task 247: [ 32.389515] kasan_save_stack+0x3c/0x68 [ 32.389552] kasan_save_track+0x20/0x40 [ 32.389591] kasan_save_free_info+0x4c/0x78 [ 32.389630] __kasan_slab_free+0x6c/0x98 [ 32.389668] kmem_cache_free+0x260/0x468 [ 32.389706] slab_kmem_cache_release+0x38/0x50 [ 32.389747] kmem_cache_release+0x1c/0x30 [ 32.389787] kobject_put+0x17c/0x420 [ 32.389825] sysfs_slab_release+0x1c/0x30 [ 32.389873] kmem_cache_destroy+0x118/0x218 [ 32.389911] kmem_cache_double_destroy+0x128/0x300 [ 32.389958] kunit_try_run_case+0x170/0x3f0 [ 32.390002] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.390050] kthread+0x328/0x630 [ 32.390084] ret_from_fork+0x10/0x20 [ 32.390122] [ 32.390142] The buggy address belongs to the object at fff00000c1c3cc80 [ 32.390142] which belongs to the cache kmem_cache of size 208 [ 32.390202] The buggy address is located 0 bytes inside of [ 32.390202] freed 208-byte region [fff00000c1c3cc80, fff00000c1c3cd50) [ 32.390265] [ 32.390288] The buggy address belongs to the physical page: [ 32.390323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c3c [ 32.390380] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.390434] page_type: f5(slab) [ 32.390477] raw: 0bfffe0000000000 fff00000c0001000 dead000000000122 0000000000000000 [ 32.390530] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 [ 32.390572] page dumped because: kasan: bad access detected [ 32.390604] [ 32.390622] Memory state around the buggy address: [ 32.390656] fff00000c1c3cb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.390700] fff00000c1c3cc00: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.390744] >fff00000c1c3cc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.390782] ^ [ 32.390809] fff00000c1c3cd00: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 32.390858] fff00000c1c3cd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.390899] ==================================================================
[ 24.023282] ================================================================== [ 24.023731] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x1bf/0x380 [ 24.024098] Read of size 1 at addr ffff888105505140 by task kunit_try_catch/264 [ 24.024381] [ 24.024728] CPU: 1 UID: 0 PID: 264 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT(voluntary) [ 24.024788] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.024802] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.024826] Call Trace: [ 24.024841] <TASK> [ 24.024861] dump_stack_lvl+0x73/0xb0 [ 24.024894] print_report+0xd1/0x650 [ 24.024915] ? __virt_addr_valid+0x1db/0x2d0 [ 24.024941] ? kmem_cache_double_destroy+0x1bf/0x380 [ 24.024965] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.024990] ? kmem_cache_double_destroy+0x1bf/0x380 [ 24.025014] kasan_report+0x141/0x180 [ 24.025035] ? kmem_cache_double_destroy+0x1bf/0x380 [ 24.025062] ? kmem_cache_double_destroy+0x1bf/0x380 [ 24.025120] __kasan_check_byte+0x3d/0x50 [ 24.025141] kmem_cache_destroy+0x25/0x1d0 [ 24.025169] kmem_cache_double_destroy+0x1bf/0x380 [ 24.025193] ? __pfx_kmem_cache_double_destroy+0x10/0x10 [ 24.025247] ? finish_task_switch.isra.0+0x153/0x700 [ 24.025271] ? __switch_to+0x47/0xf50 [ 24.025300] ? __pfx_read_tsc+0x10/0x10 [ 24.025322] ? ktime_get_ts64+0x86/0x230 [ 24.025348] kunit_try_run_case+0x1a5/0x480 [ 24.025375] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.025399] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.025440] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.025488] ? __kthread_parkme+0x82/0x180 [ 24.025510] ? preempt_count_sub+0x50/0x80 [ 24.025533] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.025557] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.025580] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.025605] kthread+0x337/0x6f0 [ 24.025624] ? trace_preempt_on+0x20/0xc0 [ 24.025649] ? __pfx_kthread+0x10/0x10 [ 24.025670] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.025696] ? calculate_sigpending+0x7b/0xa0 [ 24.025721] ? __pfx_kthread+0x10/0x10 [ 24.025743] ret_from_fork+0x116/0x1d0 [ 24.025762] ? __pfx_kthread+0x10/0x10 [ 24.025783] ret_from_fork_asm+0x1a/0x30 [ 24.025814] </TASK> [ 24.025825] [ 24.033882] Allocated by task 264: [ 24.034063] kasan_save_stack+0x45/0x70 [ 24.034547] kasan_save_track+0x18/0x40 [ 24.034760] kasan_save_alloc_info+0x3b/0x50 [ 24.034920] __kasan_slab_alloc+0x91/0xa0 [ 24.035110] kmem_cache_alloc_noprof+0x123/0x3f0 [ 24.035283] __kmem_cache_create_args+0x169/0x240 [ 24.035429] kmem_cache_double_destroy+0xd5/0x380 [ 24.035585] kunit_try_run_case+0x1a5/0x480 [ 24.035719] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.035880] kthread+0x337/0x6f0 [ 24.036151] ret_from_fork+0x116/0x1d0 [ 24.036345] ret_from_fork_asm+0x1a/0x30 [ 24.036729] [ 24.036900] Freed by task 264: [ 24.037105] kasan_save_stack+0x45/0x70 [ 24.037402] kasan_save_track+0x18/0x40 [ 24.037604] kasan_save_free_info+0x3f/0x60 [ 24.037806] __kasan_slab_free+0x56/0x70 [ 24.038029] kmem_cache_free+0x249/0x420 [ 24.038337] slab_kmem_cache_release+0x2e/0x40 [ 24.038537] kmem_cache_release+0x16/0x20 [ 24.038667] kobject_put+0x181/0x450 [ 24.038840] sysfs_slab_release+0x16/0x20 [ 24.039023] kmem_cache_destroy+0xf0/0x1d0 [ 24.039167] kmem_cache_double_destroy+0x14e/0x380 [ 24.039631] kunit_try_run_case+0x1a5/0x480 [ 24.039799] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.040009] kthread+0x337/0x6f0 [ 24.040165] ret_from_fork+0x116/0x1d0 [ 24.040386] ret_from_fork_asm+0x1a/0x30 [ 24.040534] [ 24.040599] The buggy address belongs to the object at ffff888105505140 [ 24.040599] which belongs to the cache kmem_cache of size 208 [ 24.040983] The buggy address is located 0 bytes inside of [ 24.040983] freed 208-byte region [ffff888105505140, ffff888105505210) [ 24.041733] [ 24.041899] The buggy address belongs to the physical page: [ 24.042186] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105505 [ 24.042485] flags: 0x200000000000000(node=0|zone=2) [ 24.042745] page_type: f5(slab) [ 24.042918] raw: 0200000000000000 ffff888100041000 dead000000000122 0000000000000000 [ 24.043496] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 [ 24.043756] page dumped because: kasan: bad access detected [ 24.044023] [ 24.044144] Memory state around the buggy address: [ 24.044467] ffff888105505000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.044805] ffff888105505080: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 24.045137] >ffff888105505100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 24.045524] ^ [ 24.045783] ffff888105505180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.046106] ffff888105505200: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.046403] ==================================================================