Date
Feb. 5, 2025, 2:09 p.m.
Environment | |
---|---|
qemu-x86_64 |
[ 51.703983] ================================================================== [ 51.704680] BUG: KASAN: double-free in kfree+0x7c/0x120 [ 51.705999] Free of addr ffff888101a81400 by task kunit_try_catch/228 [ 51.706523] [ 51.706866] CPU: 0 PID: 228 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 51.707770] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 51.708577] Call Trace: [ 51.708977] <TASK> [ 51.710033] dump_stack_lvl+0x4e/0x90 [ 51.710550] print_report+0xd2/0x660 [ 51.711122] ? __virt_addr_valid+0x156/0x1e0 [ 51.711667] ? kfree+0x7c/0x120 [ 51.712620] ? kasan_complete_mode_report_info+0x64/0x200 [ 51.713769] ? kfree+0x7c/0x120 [ 51.714354] kasan_report_invalid_free+0xcf/0x100 [ 51.715272] ? kfree+0x7c/0x120 [ 51.715730] ? kfree+0x7c/0x120 [ 51.716146] ____kasan_slab_free+0x19c/0x1d0 [ 51.716657] ? kfree_sensitive+0x2e/0x90 [ 51.717631] __kasan_slab_free+0x16/0x20 [ 51.718416] __kmem_cache_free+0x190/0x310 [ 51.719162] kfree+0x7c/0x120 [ 51.719818] kfree_sensitive+0x2e/0x90 [ 51.720487] kmalloc_double_kzfree+0xd4/0x1d0 [ 51.721762] ? __pfx_kmalloc_double_kzfree+0x10/0x10 [ 51.722506] ? __schedule+0x70b/0x1190 [ 51.723123] ? ktime_get_ts64+0x118/0x140 [ 51.723811] kunit_try_run_case+0x126/0x290 [ 51.724399] ? __pfx_kunit_try_run_case+0x10/0x10 [ 51.725068] ? __kasan_check_write+0x18/0x20 [ 51.726137] ? trace_preempt_on+0x20/0xa0 [ 51.726404] ? __kthread_parkme+0x4f/0xd0 [ 51.726649] ? preempt_count_sub+0x50/0x80 [ 51.727458] ? __pfx_kunit_try_run_case+0x10/0x10 [ 51.728134] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 51.729638] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 51.730231] kthread+0x19e/0x1e0 [ 51.730749] ? __pfx_kthread+0x10/0x10 [ 51.731601] ret_from_fork+0x41/0x70 [ 51.732633] ? __pfx_kthread+0x10/0x10 [ 51.733386] ret_from_fork_asm+0x1b/0x30 [ 51.734333] </TASK> [ 51.734582] [ 51.734865] Allocated by task 228: [ 51.735311] kasan_save_stack+0x3c/0x60 [ 51.736135] kasan_set_track+0x29/0x40 [ 51.736540] kasan_save_alloc_info+0x22/0x30 [ 51.737355] __kasan_kmalloc+0xb7/0xc0 [ 51.738244] kmalloc_trace+0x4c/0xb0 [ 51.738776] kmalloc_double_kzfree+0x9d/0x1d0 [ 51.739550] kunit_try_run_case+0x126/0x290 [ 51.740515] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 51.741321] kthread+0x19e/0x1e0 [ 51.742038] ret_from_fork+0x41/0x70 [ 51.742613] ret_from_fork_asm+0x1b/0x30 [ 51.743103] [ 51.743759] Freed by task 228: [ 51.744211] kasan_save_stack+0x3c/0x60 [ 51.744858] kasan_set_track+0x29/0x40 [ 51.745762] kasan_save_free_info+0x2f/0x50 [ 51.746406] ____kasan_slab_free+0x172/0x1d0 [ 51.747657] __kasan_slab_free+0x16/0x20 [ 51.748330] __kmem_cache_free+0x190/0x310 [ 51.749012] kfree+0x7c/0x120 [ 51.749503] kfree_sensitive+0x67/0x90 [ 51.749967] kmalloc_double_kzfree+0xbd/0x1d0 [ 51.750489] kunit_try_run_case+0x126/0x290 [ 51.751167] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 51.751932] kthread+0x19e/0x1e0 [ 51.752337] ret_from_fork+0x41/0x70 [ 51.752948] ret_from_fork_asm+0x1b/0x30 [ 51.753440] [ 51.753633] The buggy address belongs to the object at ffff888101a81400 [ 51.753633] which belongs to the cache kmalloc-16 of size 16 [ 51.754958] The buggy address is located 0 bytes inside of [ 51.754958] 16-byte region [ffff888101a81400, ffff888101a81410) [ 51.755956] [ 51.756264] The buggy address belongs to the physical page: [ 51.757018] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101a81 [ 51.758156] flags: 0x200000000000800(slab|node=0|zone=2) [ 51.758617] page_type: 0xffffffff() [ 51.759185] raw: 0200000000000800 ffff8881000413c0 dead000000000122 0000000000000000 [ 51.760052] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 51.760962] page dumped because: kasan: bad access detected [ 51.761482] [ 51.761667] Memory state around the buggy address: [ 51.762293] ffff888101a81300: 00 02 fc fc 00 02 fc fc fa fb fc fc fa fb fc fc [ 51.763206] ffff888101a81380: fa fb fc fc 00 05 fc fc fa fb fc fc fa fb fc fc [ 51.763898] >ffff888101a81400: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 51.764668] ^ [ 51.765140] ffff888101a81480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 51.765990] ffff888101a81500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 51.766636] ==================================================================