Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 22.975290] ================================================================== [ 22.975826] BUG: KASAN: double-free in kfree_sensitive+0x3c/0xb0 [ 22.976221] Free of addr fff00000c57223c0 by task kunit_try_catch/196 [ 22.976556] [ 22.976646] CPU: 1 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT [ 22.976869] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.976927] Hardware name: linux,dummy-virt (DT) [ 22.977123] Call trace: [ 22.977189] show_stack+0x20/0x38 (C) [ 22.977534] dump_stack_lvl+0x8c/0xd0 [ 22.977760] print_report+0x118/0x608 [ 22.977925] kasan_report_invalid_free+0xc0/0xe8 [ 22.978451] check_slab_allocation+0xd4/0x108 [ 22.978614] __kasan_slab_pre_free+0x2c/0x48 [ 22.978726] kfree+0xe8/0x3c8 [ 22.978836] kfree_sensitive+0x3c/0xb0 [ 22.978952] kmalloc_double_kzfree+0x168/0x308 [ 22.979078] kunit_try_run_case+0x170/0x3f0 [ 22.979206] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.979344] kthread+0x328/0x630 [ 22.979464] ret_from_fork+0x10/0x20 [ 22.979586] [ 22.979633] Allocated by task 196: [ 22.979703] kasan_save_stack+0x3c/0x68 [ 22.979809] kasan_save_track+0x20/0x40 [ 22.979896] kasan_save_alloc_info+0x40/0x58 [ 22.980551] __kasan_kmalloc+0xd4/0xd8 [ 22.980924] __kmalloc_cache_noprof+0x16c/0x3c0 [ 22.981192] kmalloc_double_kzfree+0xb8/0x308 [ 22.981369] kunit_try_run_case+0x170/0x3f0 [ 22.981491] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.981585] kthread+0x328/0x630 [ 22.981657] ret_from_fork+0x10/0x20 [ 22.981720] [ 22.981763] Freed by task 196: [ 22.981823] kasan_save_stack+0x3c/0x68 [ 22.981900] kasan_save_track+0x20/0x40 [ 22.981982] kasan_save_free_info+0x4c/0x78 [ 22.982068] __kasan_slab_free+0x6c/0x98 [ 22.982157] kfree+0x214/0x3c8 [ 22.982246] kfree_sensitive+0x80/0xb0 [ 22.982346] kmalloc_double_kzfree+0x11c/0x308 [ 22.982459] kunit_try_run_case+0x170/0x3f0 [ 22.982590] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.982686] kthread+0x328/0x630 [ 22.982764] ret_from_fork+0x10/0x20 [ 22.982846] [ 22.982897] The buggy address belongs to the object at fff00000c57223c0 [ 22.982897] which belongs to the cache kmalloc-16 of size 16 [ 22.983025] The buggy address is located 0 bytes inside of [ 22.983025] 16-byte region [fff00000c57223c0, fff00000c57223d0) [ 22.983136] [ 22.983178] The buggy address belongs to the physical page: [ 22.983242] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105722 [ 22.983348] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 22.983496] page_type: f5(slab) [ 22.983581] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 22.983672] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 22.983749] page dumped because: kasan: bad access detected [ 22.983803] [ 22.983841] Memory state around the buggy address: [ 22.983914] fff00000c5722280: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc [ 22.984056] fff00000c5722300: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 22.984172] >fff00000c5722380: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 22.986530] ^ [ 22.986653] fff00000c5722400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.986762] fff00000c5722480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.986860] ==================================================================
[ 14.165422] ================================================================== [ 14.166107] BUG: KASAN: double-free in kfree_sensitive+0x2e/0x90 [ 14.167181] Free of addr ffff888102497620 by task kunit_try_catch/212 [ 14.168362] [ 14.168796] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT(voluntary) [ 14.168918] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.168942] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.168976] Call Trace: [ 14.169005] <TASK> [ 14.169041] dump_stack_lvl+0x73/0xb0 [ 14.169105] print_report+0xd1/0x650 [ 14.169155] ? __virt_addr_valid+0x1db/0x2d0 [ 14.169192] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.169216] ? kfree_sensitive+0x2e/0x90 [ 14.169241] kasan_report_invalid_free+0x10a/0x130 [ 14.169266] ? kfree_sensitive+0x2e/0x90 [ 14.169288] ? kfree_sensitive+0x2e/0x90 [ 14.169309] check_slab_allocation+0x101/0x130 [ 14.169332] __kasan_slab_pre_free+0x28/0x40 [ 14.169353] kfree+0xf0/0x3f0 [ 14.169374] ? kfree_sensitive+0x2e/0x90 [ 14.169397] kfree_sensitive+0x2e/0x90 [ 14.169418] kmalloc_double_kzfree+0x19c/0x350 [ 14.169442] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 14.169467] ? __schedule+0x10cc/0x2b30 [ 14.169489] ? __pfx_read_tsc+0x10/0x10 [ 14.169510] ? ktime_get_ts64+0x86/0x230 [ 14.169536] kunit_try_run_case+0x1a5/0x480 [ 14.169585] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.169620] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.169657] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.169691] ? __kthread_parkme+0x82/0x180 [ 14.169725] ? preempt_count_sub+0x50/0x80 [ 14.169764] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.169801] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.169836] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.169869] kthread+0x337/0x6f0 [ 14.169896] ? trace_preempt_on+0x20/0xc0 [ 14.169929] ? __pfx_kthread+0x10/0x10 [ 14.169956] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.169987] ? calculate_sigpending+0x7b/0xa0 [ 14.170020] ? __pfx_kthread+0x10/0x10 [ 14.170047] ret_from_fork+0x41/0x80 [ 14.170079] ? __pfx_kthread+0x10/0x10 [ 14.170106] ret_from_fork_asm+0x1a/0x30 [ 14.170140] </TASK> [ 14.170153] [ 14.183035] Allocated by task 212: [ 14.183821] kasan_save_stack+0x45/0x70 [ 14.184186] kasan_save_track+0x18/0x40 [ 14.184368] kasan_save_alloc_info+0x3b/0x50 [ 14.184706] __kasan_kmalloc+0xb7/0xc0 [ 14.185309] __kmalloc_cache_noprof+0x189/0x420 [ 14.186011] kmalloc_double_kzfree+0xa9/0x350 [ 14.186320] kunit_try_run_case+0x1a5/0x480 [ 14.186517] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.186984] kthread+0x337/0x6f0 [ 14.187278] ret_from_fork+0x41/0x80 [ 14.187812] ret_from_fork_asm+0x1a/0x30 [ 14.188026] [ 14.188374] Freed by task 212: [ 14.188697] kasan_save_stack+0x45/0x70 [ 14.189020] kasan_save_track+0x18/0x40 [ 14.189438] kasan_save_free_info+0x3f/0x60 [ 14.189686] __kasan_slab_free+0x56/0x70 [ 14.189953] kfree+0x222/0x3f0 [ 14.190613] kfree_sensitive+0x67/0x90 [ 14.190994] kmalloc_double_kzfree+0x12b/0x350 [ 14.191618] kunit_try_run_case+0x1a5/0x480 [ 14.192085] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.192443] kthread+0x337/0x6f0 [ 14.192969] ret_from_fork+0x41/0x80 [ 14.193263] ret_from_fork_asm+0x1a/0x30 [ 14.193597] [ 14.193780] The buggy address belongs to the object at ffff888102497620 [ 14.193780] which belongs to the cache kmalloc-16 of size 16 [ 14.195181] The buggy address is located 0 bytes inside of [ 14.195181] 16-byte region [ffff888102497620, ffff888102497630) [ 14.195687] [ 14.196014] The buggy address belongs to the physical page: [ 14.196434] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102497 [ 14.197019] flags: 0x200000000000000(node=0|zone=2) [ 14.197354] page_type: f5(slab) [ 14.197532] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 14.197977] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 14.198631] page dumped because: kasan: bad access detected [ 14.199060] [ 14.199244] Memory state around the buggy address: [ 14.199941] ffff888102497500: 00 01 fc fc 00 01 fc fc fa fb fc fc fa fb fc fc [ 14.200507] ffff888102497580: 00 05 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 14.200772] >ffff888102497600: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc [ 14.201272] ^ [ 14.201585] ffff888102497680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.202502] ffff888102497700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.202928] ==================================================================