Hay
Date
June 7, 2025, 10:40 a.m.

Environment
qemu-x86_64

[   18.237089] ==================================================================
[   18.238399] BUG: KASAN: double-free in kfree_sensitive+0x2e/0x90
[   18.239039] Free of addr ffff888101f801e0 by task kunit_try_catch/197
[   18.239906] 
[   18.240194] CPU: 1 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G    B            N 6.12.33-rc1 #1
[   18.240326] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.240365] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.240422] Call Trace:
[   18.240460]  <TASK>
[   18.240493]  dump_stack_lvl+0x73/0xb0
[   18.240530]  print_report+0xd1/0x640
[   18.240564]  ? __virt_addr_valid+0x1db/0x2d0
[   18.240600]  ? kasan_complete_mode_report_info+0x64/0x200
[   18.240664]  ? kfree_sensitive+0x2e/0x90
[   18.240702]  kasan_report_invalid_free+0xfc/0x120
[   18.240741]  ? kfree_sensitive+0x2e/0x90
[   18.240769]  ? kfree_sensitive+0x2e/0x90
[   18.240793]  check_slab_allocation+0x101/0x130
[   18.240845]  __kasan_slab_pre_free+0x28/0x40
[   18.240887]  kfree+0xf1/0x3d0
[   18.240915]  ? kfree_sensitive+0x2e/0x90
[   18.240943]  kfree_sensitive+0x2e/0x90
[   18.240967]  kmalloc_double_kzfree+0x19d/0x360
[   18.240995]  ? __pfx_kmalloc_double_kzfree+0x10/0x10
[   18.241023]  ? __schedule+0xc49/0x27a0
[   18.241050]  ? __pfx_read_tsc+0x10/0x10
[   18.241076]  ? ktime_get_ts64+0x84/0x230
[   18.241111]  kunit_try_run_case+0x1a6/0x480
[   18.241142]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.241169]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   18.241198]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.241272]  ? __kthread_parkme+0x82/0x160
[   18.241337]  ? preempt_count_sub+0x50/0x80
[   18.241407]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.241476]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.241550]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.241626]  kthread+0x257/0x310
[   18.241683]  ? __pfx_kthread+0x10/0x10
[   18.241749]  ret_from_fork+0x41/0x80
[   18.241783]  ? __pfx_kthread+0x10/0x10
[   18.241819]  ret_from_fork_asm+0x1a/0x30
[   18.241954]  </TASK>
[   18.241991] 
[   18.262209] Allocated by task 197:
[   18.262720]  kasan_save_stack+0x45/0x70
[   18.263490]  kasan_save_track+0x18/0x40
[   18.264304]  kasan_save_alloc_info+0x3b/0x50
[   18.264846]  __kasan_kmalloc+0xb7/0xc0
[   18.266091]  __kmalloc_cache_noprof+0x168/0x350
[   18.266688]  kmalloc_double_kzfree+0xaa/0x360
[   18.267117]  kunit_try_run_case+0x1a6/0x480
[   18.267641]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.268151]  kthread+0x257/0x310
[   18.268805]  ret_from_fork+0x41/0x80
[   18.269157]  ret_from_fork_asm+0x1a/0x30
[   18.269552] 
[   18.269747] Freed by task 197:
[   18.270163]  kasan_save_stack+0x45/0x70
[   18.270700]  kasan_save_track+0x18/0x40
[   18.271247]  kasan_save_free_info+0x3f/0x60
[   18.271666]  __kasan_slab_free+0x56/0x70
[   18.272439]  kfree+0x123/0x3d0
[   18.272870]  kfree_sensitive+0x67/0x90
[   18.273171]  kmalloc_double_kzfree+0x12c/0x360
[   18.273625]  kunit_try_run_case+0x1a6/0x480
[   18.274123]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.274674]  kthread+0x257/0x310
[   18.275331]  ret_from_fork+0x41/0x80
[   18.275784]  ret_from_fork_asm+0x1a/0x30
[   18.276198] 
[   18.276463] The buggy address belongs to the object at ffff888101f801e0
[   18.276463]  which belongs to the cache kmalloc-16 of size 16
[   18.277725] The buggy address is located 0 bytes inside of
[   18.277725]  16-byte region [ffff888101f801e0, ffff888101f801f0)
[   18.278962] 
[   18.279265] The buggy address belongs to the physical page:
[   18.280015] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101f80
[   18.280717] flags: 0x200000000000000(node=0|zone=2)
[   18.281251] page_type: f5(slab)
[   18.281780] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   18.282376] raw: 0000000000000000 0000000080800080 00000001f5000000 0000000000000000
[   18.283374] page dumped because: kasan: bad access detected
[   18.284196] 
[   18.284461] Memory state around the buggy address:
[   18.284892]  ffff888101f80080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   18.285500]  ffff888101f80100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   18.286152] >ffff888101f80180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   18.287270]                                                        ^
[   18.288009]  ffff888101f80200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.288704]  ffff888101f80280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.289280] ==================================================================