Date
May 12, 2025, 6:12 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.733067] ================================================================== [ 19.733744] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x17c/0x2f8 [ 19.734160] Read of size 1 at addr fff00000c656d500 by task kunit_try_catch/204 [ 19.734481] [ 19.734938] CPU: 0 UID: 0 PID: 204 Comm: kunit_try_catch Tainted: G B N 6.14.7-rc1 #1 [ 19.735348] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.735397] Hardware name: linux,dummy-virt (DT) [ 19.735438] Call trace: [ 19.735467] show_stack+0x20/0x38 (C) [ 19.735547] dump_stack_lvl+0x8c/0xd0 [ 19.735606] print_report+0x118/0x608 [ 19.735661] kasan_report+0xdc/0x128 [ 19.735711] __kasan_check_byte+0x54/0x70 [ 19.735778] kmem_cache_destroy+0x34/0x218 [ 19.735835] kmem_cache_double_destroy+0x17c/0x2f8 [ 19.735890] kunit_try_run_case+0x170/0x3f0 [ 19.735944] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.736000] kthread+0x318/0x620 [ 19.736051] ret_from_fork+0x10/0x20 [ 19.736106] [ 19.738671] Allocated by task 204: [ 19.738995] kasan_save_stack+0x3c/0x68 [ 19.739416] kasan_save_track+0x20/0x40 [ 19.739858] kasan_save_alloc_info+0x40/0x58 [ 19.740465] __kasan_slab_alloc+0xa8/0xb0 [ 19.740821] kmem_cache_alloc_noprof+0x10c/0x3a0 [ 19.741191] __kmem_cache_create_args+0x18c/0x2b0 [ 19.741435] kmem_cache_double_destroy+0xc8/0x2f8 [ 19.741677] kunit_try_run_case+0x170/0x3f0 [ 19.742058] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.742350] kthread+0x318/0x620 [ 19.743087] ret_from_fork+0x10/0x20 [ 19.743397] [ 19.743601] Freed by task 204: [ 19.743855] kasan_save_stack+0x3c/0x68 [ 19.744062] kasan_save_track+0x20/0x40 [ 19.744293] kasan_save_free_info+0x4c/0x78 [ 19.744544] __kasan_slab_free+0x6c/0x98 [ 19.744813] kmem_cache_free+0x260/0x470 [ 19.745110] slab_kmem_cache_release+0x38/0x50 [ 19.745439] kmem_cache_release+0x1c/0x30 [ 19.745663] kobject_put+0x17c/0x430 [ 19.745866] sysfs_slab_release+0x1c/0x30 [ 19.746147] kmem_cache_destroy+0x118/0x218 [ 19.746405] kmem_cache_double_destroy+0x130/0x2f8 [ 19.746751] kunit_try_run_case+0x170/0x3f0 [ 19.747036] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.747336] kthread+0x318/0x620 [ 19.747598] ret_from_fork+0x10/0x20 [ 19.747888] [ 19.748023] The buggy address belongs to the object at fff00000c656d500 [ 19.748023] which belongs to the cache kmem_cache of size 208 [ 19.748665] The buggy address is located 0 bytes inside of [ 19.748665] freed 208-byte region [fff00000c656d500, fff00000c656d5d0) [ 19.749530] [ 19.749729] The buggy address belongs to the physical page: [ 19.750017] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10656d [ 19.750463] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.751038] page_type: f5(slab) [ 19.751312] raw: 0bfffe0000000000 fff00000c0001000 dead000000000122 0000000000000000 [ 19.751705] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 [ 19.752072] page dumped because: kasan: bad access detected [ 19.752313] [ 19.752489] Memory state around the buggy address: [ 19.752727] fff00000c656d400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.753084] fff00000c656d480: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.753457] >fff00000c656d500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.753722] ^ [ 19.753936] fff00000c656d580: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 19.754297] fff00000c656d600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.754946] ==================================================================
[ 13.273562] ================================================================== [ 13.274086] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x1bd/0x380 [ 13.274474] Read of size 1 at addr ffff888101ab2b40 by task kunit_try_catch/223 [ 13.275145] [ 13.275566] CPU: 1 UID: 0 PID: 223 Comm: kunit_try_catch Tainted: G B N 6.14.7-rc1 #1 [ 13.275624] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.275637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.275660] Call Trace: [ 13.275676] <TASK> [ 13.275698] dump_stack_lvl+0x73/0xb0 [ 13.275732] print_report+0xd1/0x650 [ 13.275756] ? __virt_addr_valid+0x1db/0x2d0 [ 13.275779] ? kmem_cache_double_destroy+0x1bd/0x380 [ 13.275803] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.275829] ? kmem_cache_double_destroy+0x1bd/0x380 [ 13.275867] kasan_report+0x140/0x180 [ 13.275889] ? kmem_cache_double_destroy+0x1bd/0x380 [ 13.275915] ? kmem_cache_double_destroy+0x1bd/0x380 [ 13.275938] __kasan_check_byte+0x3d/0x50 [ 13.275960] kmem_cache_destroy+0x25/0x1d0 [ 13.275984] kmem_cache_double_destroy+0x1bd/0x380 [ 13.276007] ? __pfx_kmem_cache_double_destroy+0x10/0x10 [ 13.276244] ? finish_task_switch.isra.0+0x153/0x700 [ 13.276272] ? __switch_to+0x5d9/0xf60 [ 13.276301] ? __pfx_empty_cache_ctor+0x10/0x10 [ 13.276323] ? __pfx_read_tsc+0x10/0x10 [ 13.276368] ? ktime_get_ts64+0x86/0x230 [ 13.276394] kunit_try_run_case+0x1a6/0x480 [ 13.276419] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.276440] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 13.276465] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.276490] ? __kthread_parkme+0x82/0x160 [ 13.276513] ? preempt_count_sub+0x50/0x80 [ 13.276537] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.276559] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.276585] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.276611] kthread+0x324/0x6e0 [ 13.276632] ? trace_preempt_on+0x20/0xc0 [ 13.276657] ? __pfx_kthread+0x10/0x10 [ 13.276678] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.276705] ? calculate_sigpending+0x7b/0xa0 [ 13.276727] ? __pfx_kthread+0x10/0x10 [ 13.276750] ret_from_fork+0x41/0x80 [ 13.276769] ? __pfx_kthread+0x10/0x10 [ 13.276792] ret_from_fork_asm+0x1a/0x30 [ 13.276825] </TASK> [ 13.276851] [ 13.286993] Allocated by task 223: [ 13.287290] kasan_save_stack+0x45/0x70 [ 13.287522] kasan_save_track+0x18/0x40 [ 13.287687] kasan_save_alloc_info+0x3b/0x50 [ 13.287904] __kasan_slab_alloc+0x91/0xa0 [ 13.288505] kmem_cache_alloc_noprof+0x124/0x400 [ 13.288694] __kmem_cache_create_args+0x177/0x250 [ 13.289013] kmem_cache_double_destroy+0xd3/0x380 [ 13.289328] kunit_try_run_case+0x1a6/0x480 [ 13.289516] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.289748] kthread+0x324/0x6e0 [ 13.289927] ret_from_fork+0x41/0x80 [ 13.290509] ret_from_fork_asm+0x1a/0x30 [ 13.290687] [ 13.290784] Freed by task 223: [ 13.290950] kasan_save_stack+0x45/0x70 [ 13.291108] kasan_save_track+0x18/0x40 [ 13.291271] kasan_save_free_info+0x3f/0x60 [ 13.291604] __kasan_slab_free+0x56/0x70 [ 13.291774] kmem_cache_free+0x24b/0x420 [ 13.291990] slab_kmem_cache_release+0x2e/0x40 [ 13.292279] kmem_cache_release+0x16/0x20 [ 13.292460] kobject_put+0x181/0x450 [ 13.292647] sysfs_slab_release+0x16/0x20 [ 13.292820] kmem_cache_destroy+0xf0/0x1d0 [ 13.293046] kmem_cache_double_destroy+0x14c/0x380 [ 13.293293] kunit_try_run_case+0x1a6/0x480 [ 13.293500] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.293724] kthread+0x324/0x6e0 [ 13.293904] ret_from_fork+0x41/0x80 [ 13.294381] ret_from_fork_asm+0x1a/0x30 [ 13.294562] [ 13.294658] The buggy address belongs to the object at ffff888101ab2b40 [ 13.294658] which belongs to the cache kmem_cache of size 208 [ 13.295093] The buggy address is located 0 bytes inside of [ 13.295093] freed 208-byte region [ffff888101ab2b40, ffff888101ab2c10) [ 13.295711] [ 13.295794] The buggy address belongs to the physical page: [ 13.296165] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101ab2 [ 13.296536] flags: 0x200000000000000(node=0|zone=2) [ 13.296753] page_type: f5(slab) [ 13.296921] raw: 0200000000000000 ffff888100041000 dead000000000122 0000000000000000 [ 13.297282] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 [ 13.297563] page dumped because: kasan: bad access detected [ 13.297821] [ 13.297930] Memory state around the buggy address: [ 13.298216] ffff888101ab2a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.298436] ffff888101ab2a80: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 13.298737] >ffff888101ab2b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 13.299083] ^ [ 13.299284] ffff888101ab2b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.299574] ffff888101ab2c00: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.299885] ==================================================================