Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 22.955413] ================================================================== [ 22.955666] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308 [ 22.955844] Read of size 1 at addr fff00000c57223c0 by task kunit_try_catch/196 [ 22.956017] [ 22.956110] CPU: 1 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT [ 22.956336] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.956435] Hardware name: linux,dummy-virt (DT) [ 22.956532] Call trace: [ 22.956611] show_stack+0x20/0x38 (C) [ 22.956759] dump_stack_lvl+0x8c/0xd0 [ 22.956895] print_report+0x118/0x608 [ 22.956997] kasan_report+0xdc/0x128 [ 22.957109] __kasan_check_byte+0x54/0x70 [ 22.957229] kfree_sensitive+0x30/0xb0 [ 22.957351] kmalloc_double_kzfree+0x168/0x308 [ 22.957502] kunit_try_run_case+0x170/0x3f0 [ 22.957638] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.957795] kthread+0x328/0x630 [ 22.958017] ret_from_fork+0x10/0x20 [ 22.958202] [ 22.958269] Allocated by task 196: [ 22.958662] kasan_save_stack+0x3c/0x68 [ 22.958773] kasan_save_track+0x20/0x40 [ 22.958860] kasan_save_alloc_info+0x40/0x58 [ 22.958951] __kasan_kmalloc+0xd4/0xd8 [ 22.959453] __kmalloc_cache_noprof+0x16c/0x3c0 [ 22.959654] kmalloc_double_kzfree+0xb8/0x308 [ 22.959845] kunit_try_run_case+0x170/0x3f0 [ 22.960509] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.961084] kthread+0x328/0x630 [ 22.961506] ret_from_fork+0x10/0x20 [ 22.961621] [ 22.961752] Freed by task 196: [ 22.961838] kasan_save_stack+0x3c/0x68 [ 22.962063] kasan_save_track+0x20/0x40 [ 22.962331] kasan_save_free_info+0x4c/0x78 [ 22.962441] __kasan_slab_free+0x6c/0x98 [ 22.962535] kfree+0x214/0x3c8 [ 22.962614] kfree_sensitive+0x80/0xb0 [ 22.962687] kmalloc_double_kzfree+0x11c/0x308 [ 22.962762] kunit_try_run_case+0x170/0x3f0 [ 22.962850] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.962963] kthread+0x328/0x630 [ 22.963058] ret_from_fork+0x10/0x20 [ 22.963148] [ 22.963201] The buggy address belongs to the object at fff00000c57223c0 [ 22.963201] which belongs to the cache kmalloc-16 of size 16 [ 22.963359] The buggy address is located 0 bytes inside of [ 22.963359] freed 16-byte region [fff00000c57223c0, fff00000c57223d0) [ 22.965537] [ 22.965923] The buggy address belongs to the physical page: [ 22.966051] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105722 [ 22.966434] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 22.966758] page_type: f5(slab) [ 22.966854] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 22.967362] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 22.968238] page dumped because: kasan: bad access detected [ 22.968504] [ 22.968552] Memory state around the buggy address: [ 22.968640] fff00000c5722280: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc [ 22.968749] fff00000c5722300: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 22.968863] >fff00000c5722380: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 22.968959] ^ [ 22.969051] fff00000c5722400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.969158] fff00000c5722480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.969256] ==================================================================
[ 14.127419] ================================================================== [ 14.128153] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350 [ 14.129102] Read of size 1 at addr ffff888102497620 by task kunit_try_catch/212 [ 14.129970] [ 14.130087] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.15.2-rc1 #1 PREEMPT(voluntary) [ 14.130156] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.130171] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.130196] Call Trace: [ 14.130212] <TASK> [ 14.130235] dump_stack_lvl+0x73/0xb0 [ 14.130280] print_report+0xd1/0x650 [ 14.130308] ? __virt_addr_valid+0x1db/0x2d0 [ 14.130333] ? kmalloc_double_kzfree+0x19c/0x350 [ 14.130358] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.130383] ? kmalloc_double_kzfree+0x19c/0x350 [ 14.130408] kasan_report+0x141/0x180 [ 14.130432] ? kmalloc_double_kzfree+0x19c/0x350 [ 14.130461] ? kmalloc_double_kzfree+0x19c/0x350 [ 14.130486] __kasan_check_byte+0x3d/0x50 [ 14.130510] kfree_sensitive+0x22/0x90 [ 14.130537] kmalloc_double_kzfree+0x19c/0x350 [ 14.130589] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 14.130619] ? __schedule+0x10cc/0x2b30 [ 14.130643] ? __pfx_read_tsc+0x10/0x10 [ 14.130666] ? ktime_get_ts64+0x86/0x230 [ 14.130696] kunit_try_run_case+0x1a5/0x480 [ 14.130725] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.130749] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.130776] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.130800] ? __kthread_parkme+0x82/0x180 [ 14.130825] ? preempt_count_sub+0x50/0x80 [ 14.130855] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.130881] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.130905] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.130929] kthread+0x337/0x6f0 [ 14.130948] ? trace_preempt_on+0x20/0xc0 [ 14.130974] ? __pfx_kthread+0x10/0x10 [ 14.130994] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.131016] ? calculate_sigpending+0x7b/0xa0 [ 14.131040] ? __pfx_kthread+0x10/0x10 [ 14.131060] ret_from_fork+0x41/0x80 [ 14.131082] ? __pfx_kthread+0x10/0x10 [ 14.131101] ret_from_fork_asm+0x1a/0x30 [ 14.131145] </TASK> [ 14.131163] [ 14.143859] Allocated by task 212: [ 14.144315] kasan_save_stack+0x45/0x70 [ 14.145068] kasan_save_track+0x18/0x40 [ 14.146063] kasan_save_alloc_info+0x3b/0x50 [ 14.146266] __kasan_kmalloc+0xb7/0xc0 [ 14.146833] __kmalloc_cache_noprof+0x189/0x420 [ 14.147127] kmalloc_double_kzfree+0xa9/0x350 [ 14.147499] kunit_try_run_case+0x1a5/0x480 [ 14.147932] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.148296] kthread+0x337/0x6f0 [ 14.148543] ret_from_fork+0x41/0x80 [ 14.148940] ret_from_fork_asm+0x1a/0x30 [ 14.149277] [ 14.149493] Freed by task 212: [ 14.149880] kasan_save_stack+0x45/0x70 [ 14.150427] kasan_save_track+0x18/0x40 [ 14.150839] kasan_save_free_info+0x3f/0x60 [ 14.151122] __kasan_slab_free+0x56/0x70 [ 14.151607] kfree+0x222/0x3f0 [ 14.151983] kfree_sensitive+0x67/0x90 [ 14.152206] kmalloc_double_kzfree+0x12b/0x350 [ 14.152484] kunit_try_run_case+0x1a5/0x480 [ 14.153002] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.153301] kthread+0x337/0x6f0 [ 14.153822] ret_from_fork+0x41/0x80 [ 14.154185] ret_from_fork_asm+0x1a/0x30 [ 14.154509] [ 14.154863] The buggy address belongs to the object at ffff888102497620 [ 14.154863] which belongs to the cache kmalloc-16 of size 16 [ 14.155580] The buggy address is located 0 bytes inside of [ 14.155580] freed 16-byte region [ffff888102497620, ffff888102497630) [ 14.156378] [ 14.156577] The buggy address belongs to the physical page: [ 14.157020] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102497 [ 14.157932] flags: 0x200000000000000(node=0|zone=2) [ 14.158232] page_type: f5(slab) [ 14.158527] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 14.158939] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 14.159480] page dumped because: kasan: bad access detected [ 14.160214] [ 14.160390] Memory state around the buggy address: [ 14.160825] ffff888102497500: 00 01 fc fc 00 01 fc fc fa fb fc fc fa fb fc fc [ 14.161223] ffff888102497580: 00 05 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 14.161484] >ffff888102497600: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc [ 14.162263] ^ [ 14.162833] ffff888102497680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.163398] ffff888102497700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.164130] ==================================================================