Date
June 7, 2025, 10:40 a.m.
Environment | |
---|---|
qemu-x86_64 |
[ 18.180334] ================================================================== [ 18.181769] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19d/0x360 [ 18.182801] Read of size 1 at addr ffff888101f801e0 by task kunit_try_catch/197 [ 18.183580] [ 18.183820] CPU: 1 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 18.183935] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.183969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.184026] Call Trace: [ 18.184062] <TASK> [ 18.184111] dump_stack_lvl+0x73/0xb0 [ 18.184197] print_report+0xd1/0x640 [ 18.184319] ? __virt_addr_valid+0x1db/0x2d0 [ 18.184404] ? kmalloc_double_kzfree+0x19d/0x360 [ 18.184471] ? kasan_complete_mode_report_info+0x64/0x200 [ 18.184544] ? kmalloc_double_kzfree+0x19d/0x360 [ 18.184660] kasan_report+0x140/0x180 [ 18.184721] ? kmalloc_double_kzfree+0x19d/0x360 [ 18.184755] ? kmalloc_double_kzfree+0x19d/0x360 [ 18.184782] __kasan_check_byte+0x3d/0x50 [ 18.184843] kfree_sensitive+0x22/0x90 [ 18.184879] kmalloc_double_kzfree+0x19d/0x360 [ 18.184908] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 18.184937] ? __schedule+0xc49/0x27a0 [ 18.184964] ? __pfx_read_tsc+0x10/0x10 [ 18.184991] ? ktime_get_ts64+0x84/0x230 [ 18.185027] kunit_try_run_case+0x1a6/0x480 [ 18.185059] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.185086] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 18.185113] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.185147] ? __kthread_parkme+0x82/0x160 [ 18.185173] ? preempt_count_sub+0x50/0x80 [ 18.185203] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.185262] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.185301] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.185337] kthread+0x257/0x310 [ 18.185361] ? __pfx_kthread+0x10/0x10 [ 18.185386] ret_from_fork+0x41/0x80 [ 18.185414] ? __pfx_kthread+0x10/0x10 [ 18.185441] ret_from_fork_asm+0x1a/0x30 [ 18.185566] </TASK> [ 18.185586] [ 18.205373] Allocated by task 197: [ 18.205949] kasan_save_stack+0x45/0x70 [ 18.206395] kasan_save_track+0x18/0x40 [ 18.206963] kasan_save_alloc_info+0x3b/0x50 [ 18.207468] __kasan_kmalloc+0xb7/0xc0 [ 18.207960] __kmalloc_cache_noprof+0x168/0x350 [ 18.208642] kmalloc_double_kzfree+0xaa/0x360 [ 18.209192] kunit_try_run_case+0x1a6/0x480 [ 18.209704] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.210085] kthread+0x257/0x310 [ 18.210837] ret_from_fork+0x41/0x80 [ 18.211245] ret_from_fork_asm+0x1a/0x30 [ 18.212083] [ 18.212345] Freed by task 197: [ 18.212645] kasan_save_stack+0x45/0x70 [ 18.213245] kasan_save_track+0x18/0x40 [ 18.213885] kasan_save_free_info+0x3f/0x60 [ 18.214289] __kasan_slab_free+0x56/0x70 [ 18.215025] kfree+0x123/0x3d0 [ 18.215595] kfree_sensitive+0x67/0x90 [ 18.216023] kmalloc_double_kzfree+0x12c/0x360 [ 18.217112] kunit_try_run_case+0x1a6/0x480 [ 18.217530] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.218117] kthread+0x257/0x310 [ 18.218398] ret_from_fork+0x41/0x80 [ 18.219269] ret_from_fork_asm+0x1a/0x30 [ 18.220001] [ 18.220153] The buggy address belongs to the object at ffff888101f801e0 [ 18.220153] which belongs to the cache kmalloc-16 of size 16 [ 18.221502] The buggy address is located 0 bytes inside of [ 18.221502] freed 16-byte region [ffff888101f801e0, ffff888101f801f0) [ 18.222961] [ 18.223142] The buggy address belongs to the physical page: [ 18.223960] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101f80 [ 18.225112] flags: 0x200000000000000(node=0|zone=2) [ 18.225497] page_type: f5(slab) [ 18.226331] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 18.227285] raw: 0000000000000000 0000000080800080 00000001f5000000 0000000000000000 [ 18.228298] page dumped because: kasan: bad access detected [ 18.228866] [ 18.229069] Memory state around the buggy address: [ 18.230004] ffff888101f80080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 18.230983] ffff888101f80100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 18.231886] >ffff888101f80180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 18.232543] ^ [ 18.233384] ffff888101f80200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.234254] ffff888101f80280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.235208] ==================================================================