Date
June 24, 2025, 12:47 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 24.205697] ================================================================== [ 24.205825] BUG: KASAN: double-free in kfree_sensitive+0x3c/0xb0 [ 24.205934] Free of addr fff00000c3fab740 by task kunit_try_catch/194 [ 24.206031] [ 24.206094] CPU: 0 UID: 0 PID: 194 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc2 #1 PREEMPT [ 24.206311] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.206402] Hardware name: linux,dummy-virt (DT) [ 24.206481] Call trace: [ 24.206531] show_stack+0x20/0x38 (C) [ 24.206649] dump_stack_lvl+0x8c/0xd0 [ 24.206762] print_report+0x118/0x608 [ 24.206871] kasan_report_invalid_free+0xc0/0xe8 [ 24.207530] check_slab_allocation+0xd4/0x108 [ 24.207696] __kasan_slab_pre_free+0x2c/0x48 [ 24.207833] kfree+0xe8/0x3c8 [ 24.208160] kfree_sensitive+0x3c/0xb0 [ 24.208296] kmalloc_double_kzfree+0x168/0x308 [ 24.208463] kunit_try_run_case+0x170/0x3f0 [ 24.208958] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.209363] kthread+0x328/0x630 [ 24.209548] ret_from_fork+0x10/0x20 [ 24.209670] [ 24.209717] Allocated by task 194: [ 24.209783] kasan_save_stack+0x3c/0x68 [ 24.209879] kasan_save_track+0x20/0x40 [ 24.209969] kasan_save_alloc_info+0x40/0x58 [ 24.210070] __kasan_kmalloc+0xd4/0xd8 [ 24.210356] __kmalloc_cache_noprof+0x16c/0x3c0 [ 24.210605] kmalloc_double_kzfree+0xb8/0x308 [ 24.210741] kunit_try_run_case+0x170/0x3f0 [ 24.211211] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.211747] kthread+0x328/0x630 [ 24.212163] ret_from_fork+0x10/0x20 [ 24.212281] [ 24.212333] Freed by task 194: [ 24.212462] kasan_save_stack+0x3c/0x68 [ 24.212840] kasan_save_track+0x20/0x40 [ 24.212972] kasan_save_free_info+0x4c/0x78 [ 24.213114] __kasan_slab_free+0x6c/0x98 [ 24.213428] kfree+0x214/0x3c8 [ 24.213598] kfree_sensitive+0x80/0xb0 [ 24.213710] kmalloc_double_kzfree+0x11c/0x308 [ 24.214347] kunit_try_run_case+0x170/0x3f0 [ 24.214475] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.215267] kthread+0x328/0x630 [ 24.215444] ret_from_fork+0x10/0x20 [ 24.215553] [ 24.215604] The buggy address belongs to the object at fff00000c3fab740 [ 24.215604] which belongs to the cache kmalloc-16 of size 16 [ 24.215733] The buggy address is located 0 bytes inside of [ 24.215733] 16-byte region [fff00000c3fab740, fff00000c3fab750) [ 24.215876] [ 24.215921] The buggy address belongs to the physical page: [ 24.215993] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103fab [ 24.216604] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 24.217017] page_type: f5(slab) [ 24.217118] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 24.217270] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 24.217894] page dumped because: kasan: bad access detected [ 24.218132] [ 24.218208] Memory state around the buggy address: [ 24.218525] fff00000c3fab600: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc [ 24.218700] fff00000c3fab680: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 24.219317] >fff00000c3fab700: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 24.219477] ^ [ 24.219716] fff00000c3fab780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.220176] fff00000c3fab800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.220280] ==================================================================
[ 12.152572] ================================================================== [ 12.153242] BUG: KASAN: double-free in kfree_sensitive+0x2e/0x90 [ 12.154004] Free of addr ffff888102662fa0 by task kunit_try_catch/212 [ 12.154346] [ 12.154904] CPU: 1 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc2 #1 PREEMPT(voluntary) [ 12.154971] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.154983] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.155005] Call Trace: [ 12.155029] <TASK> [ 12.155051] dump_stack_lvl+0x73/0xb0 [ 12.155083] print_report+0xd1/0x650 [ 12.155108] ? __virt_addr_valid+0x1db/0x2d0 [ 12.155129] ? kasan_complete_mode_report_info+0x64/0x200 [ 12.155149] ? kfree_sensitive+0x2e/0x90 [ 12.155169] kasan_report_invalid_free+0x10a/0x130 [ 12.155191] ? kfree_sensitive+0x2e/0x90 [ 12.155211] ? kfree_sensitive+0x2e/0x90 [ 12.155229] check_slab_allocation+0x101/0x130 [ 12.155249] __kasan_slab_pre_free+0x28/0x40 [ 12.155267] kfree+0xf0/0x3f0 [ 12.155285] ? kfree_sensitive+0x2e/0x90 [ 12.155305] kfree_sensitive+0x2e/0x90 [ 12.155323] kmalloc_double_kzfree+0x19c/0x350 [ 12.155341] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 12.155359] ? __schedule+0x10cc/0x2b60 [ 12.155380] ? __pfx_read_tsc+0x10/0x10 [ 12.155398] ? ktime_get_ts64+0x86/0x230 [ 12.155421] kunit_try_run_case+0x1a5/0x480 [ 12.155444] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.155463] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.155485] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.155505] ? __kthread_parkme+0x82/0x180 [ 12.155526] ? preempt_count_sub+0x50/0x80 [ 12.155755] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.155825] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.155870] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.155954] kthread+0x337/0x6f0 [ 12.155982] ? trace_preempt_on+0x20/0xc0 [ 12.156023] ? __pfx_kthread+0x10/0x10 [ 12.156056] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.156087] ? calculate_sigpending+0x7b/0xa0 [ 12.156115] ? __pfx_kthread+0x10/0x10 [ 12.156147] ret_from_fork+0x41/0x80 [ 12.156179] ? __pfx_kthread+0x10/0x10 [ 12.156209] ret_from_fork_asm+0x1a/0x30 [ 12.156267] </TASK> [ 12.156287] [ 12.167449] Allocated by task 212: [ 12.167739] kasan_save_stack+0x45/0x70 [ 12.168041] kasan_save_track+0x18/0x40 [ 12.168217] kasan_save_alloc_info+0x3b/0x50 [ 12.168393] __kasan_kmalloc+0xb7/0xc0 [ 12.168875] __kmalloc_cache_noprof+0x189/0x420 [ 12.169216] kmalloc_double_kzfree+0xa9/0x350 [ 12.169721] kunit_try_run_case+0x1a5/0x480 [ 12.170014] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.170231] kthread+0x337/0x6f0 [ 12.171124] ret_from_fork+0x41/0x80 [ 12.171414] ret_from_fork_asm+0x1a/0x30 [ 12.171794] [ 12.171960] Freed by task 212: [ 12.172158] kasan_save_stack+0x45/0x70 [ 12.172660] kasan_save_track+0x18/0x40 [ 12.172973] kasan_save_free_info+0x3f/0x60 [ 12.173199] __kasan_slab_free+0x56/0x70 [ 12.173685] kfree+0x222/0x3f0 [ 12.173887] kfree_sensitive+0x67/0x90 [ 12.174190] kmalloc_double_kzfree+0x12b/0x350 [ 12.174695] kunit_try_run_case+0x1a5/0x480 [ 12.175061] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.176018] kthread+0x337/0x6f0 [ 12.176314] ret_from_fork+0x41/0x80 [ 12.176794] ret_from_fork_asm+0x1a/0x30 [ 12.177036] [ 12.177139] The buggy address belongs to the object at ffff888102662fa0 [ 12.177139] which belongs to the cache kmalloc-16 of size 16 [ 12.177960] The buggy address is located 0 bytes inside of [ 12.177960] 16-byte region [ffff888102662fa0, ffff888102662fb0) [ 12.178740] [ 12.178940] The buggy address belongs to the physical page: [ 12.179216] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102662 [ 12.179843] flags: 0x200000000000000(node=0|zone=2) [ 12.180170] page_type: f5(slab) [ 12.181163] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 12.181805] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 12.182113] page dumped because: kasan: bad access detected [ 12.182688] [ 12.182830] Memory state around the buggy address: [ 12.183172] ffff888102662e80: 00 02 fc fc 00 02 fc fc fa fb fc fc fa fb fc fc [ 12.183752] ffff888102662f00: fa fb fc fc 00 05 fc fc fa fb fc fc fa fb fc fc [ 12.184078] >ffff888102662f80: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc [ 12.184675] ^ [ 12.185011] ffff888102663000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.185568] ffff888102663080: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb [ 12.185915] ==================================================================