Hay
Date
July 1, 2025, 12:10 a.m.

Environment
qemu-arm64
qemu-x86_64

[   17.615672] ==================================================================
[   17.615755] BUG: KASAN: double-free in kfree_sensitive+0x3c/0xb0
[   17.615959] Free of addr fff00000c45518c0 by task kunit_try_catch/192
[   17.616041] 
[   17.616164] CPU: 1 UID: 0 PID: 192 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT 
[   17.616251] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.616285] Hardware name: linux,dummy-virt (DT)
[   17.616314] Call trace:
[   17.616485]  show_stack+0x20/0x38 (C)
[   17.616698]  dump_stack_lvl+0x8c/0xd0
[   17.616758]  print_report+0x118/0x608
[   17.616816]  kasan_report_invalid_free+0xc0/0xe8
[   17.616919]  check_slab_allocation+0xd4/0x108
[   17.616971]  __kasan_slab_pre_free+0x2c/0x48
[   17.617019]  kfree+0xe8/0x3c8
[   17.617060]  kfree_sensitive+0x3c/0xb0
[   17.617103]  kmalloc_double_kzfree+0x168/0x308
[   17.617154]  kunit_try_run_case+0x170/0x3f0
[   17.617199]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.617252]  kthread+0x328/0x630
[   17.617308]  ret_from_fork+0x10/0x20
[   17.617357] 
[   17.617378] Allocated by task 192:
[   17.617405]  kasan_save_stack+0x3c/0x68
[   17.617456]  kasan_save_track+0x20/0x40
[   17.617494]  kasan_save_alloc_info+0x40/0x58
[   17.617544]  __kasan_kmalloc+0xd4/0xd8
[   17.617582]  __kmalloc_cache_noprof+0x16c/0x3c0
[   17.617620]  kmalloc_double_kzfree+0xb8/0x308
[   17.617663]  kunit_try_run_case+0x170/0x3f0
[   17.617702]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.617751]  kthread+0x328/0x630
[   17.617794]  ret_from_fork+0x10/0x20
[   17.617829] 
[   17.617848] Freed by task 192:
[   17.617873]  kasan_save_stack+0x3c/0x68
[   17.617910]  kasan_save_track+0x20/0x40
[   17.617946]  kasan_save_free_info+0x4c/0x78
[   17.617990]  __kasan_slab_free+0x6c/0x98
[   17.618037]  kfree+0x214/0x3c8
[   17.618070]  kfree_sensitive+0x80/0xb0
[   17.618107]  kmalloc_double_kzfree+0x11c/0x308
[   17.618147]  kunit_try_run_case+0x170/0x3f0
[   17.618184]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.618230]  kthread+0x328/0x630
[   17.618261]  ret_from_fork+0x10/0x20
[   17.618296] 
[   17.618314] The buggy address belongs to the object at fff00000c45518c0
[   17.618314]  which belongs to the cache kmalloc-16 of size 16
[   17.618373] The buggy address is located 0 bytes inside of
[   17.618373]  16-byte region [fff00000c45518c0, fff00000c45518d0)
[   17.618436] 
[   17.618692] The buggy address belongs to the physical page:
[   17.618735] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104551
[   17.618789] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.618850] page_type: f5(slab)
[   17.618948] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   17.619025] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   17.619330] page dumped because: kasan: bad access detected
[   17.619362] 
[   17.619381] Memory state around the buggy address:
[   17.619442]  fff00000c4551780: fa fb fc fc fa fb fc fc 00 05 fc fc fa fb fc fc
[   17.619682]  fff00000c4551800: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   17.619944] >fff00000c4551880: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc
[   17.620044]                                            ^
[   17.620218]  fff00000c4551900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.620282]  fff00000c4551980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.620531] ==================================================================

[   11.810534] ==================================================================
[   11.810899] BUG: KASAN: double-free in kfree_sensitive+0x2e/0x90
[   11.811271] Free of addr ffff8881027a10e0 by task kunit_try_catch/209
[   11.811517] 
[   11.811650] CPU: 0 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT(voluntary) 
[   11.811705] Tainted: [B]=BAD_PAGE, [N]=TEST
[   11.811716] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.811749] Call Trace:
[   11.811759]  <TASK>
[   11.811774]  dump_stack_lvl+0x73/0xb0
[   11.811800]  print_report+0xd1/0x650
[   11.811821]  ? __virt_addr_valid+0x1db/0x2d0
[   11.811843]  ? kasan_complete_mode_report_info+0x64/0x200
[   11.811863]  ? kfree_sensitive+0x2e/0x90
[   11.811883]  kasan_report_invalid_free+0x10a/0x130
[   11.811905]  ? kfree_sensitive+0x2e/0x90
[   11.811926]  ? kfree_sensitive+0x2e/0x90
[   11.811944]  check_slab_allocation+0x101/0x130
[   11.811964]  __kasan_slab_pre_free+0x28/0x40
[   11.811984]  kfree+0xf0/0x3f0
[   11.812004]  ? kfree_sensitive+0x2e/0x90
[   11.812116]  kfree_sensitive+0x2e/0x90
[   11.812143]  kmalloc_double_kzfree+0x19c/0x350
[   11.812165]  ? __pfx_kmalloc_double_kzfree+0x10/0x10
[   11.812187]  ? __schedule+0x10cc/0x2b60
[   11.812225]  ? __pfx_read_tsc+0x10/0x10
[   11.812245]  ? ktime_get_ts64+0x86/0x230
[   11.812285]  kunit_try_run_case+0x1a5/0x480
[   11.812309]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.812329]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   11.812351]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   11.812372]  ? __kthread_parkme+0x82/0x180
[   11.812390]  ? preempt_count_sub+0x50/0x80
[   11.812412]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.812434]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.812455]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   11.812476]  kthread+0x337/0x6f0
[   11.812494]  ? trace_preempt_on+0x20/0xc0
[   11.812516]  ? __pfx_kthread+0x10/0x10
[   11.812535]  ? _raw_spin_unlock_irq+0x47/0x80
[   11.812554]  ? calculate_sigpending+0x7b/0xa0
[   11.812576]  ? __pfx_kthread+0x10/0x10
[   11.812596]  ret_from_fork+0x116/0x1d0
[   11.812613]  ? __pfx_kthread+0x10/0x10
[   11.812632]  ret_from_fork_asm+0x1a/0x30
[   11.812660]  </TASK>
[   11.812670] 
[   11.821547] Allocated by task 209:
[   11.821751]  kasan_save_stack+0x45/0x70
[   11.821986]  kasan_save_track+0x18/0x40
[   11.822335]  kasan_save_alloc_info+0x3b/0x50
[   11.822526]  __kasan_kmalloc+0xb7/0xc0
[   11.822729]  __kmalloc_cache_noprof+0x189/0x420
[   11.822973]  kmalloc_double_kzfree+0xa9/0x350
[   11.823345]  kunit_try_run_case+0x1a5/0x480
[   11.823556]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.823730]  kthread+0x337/0x6f0
[   11.823861]  ret_from_fork+0x116/0x1d0
[   11.824060]  ret_from_fork_asm+0x1a/0x30
[   11.824257] 
[   11.824350] Freed by task 209:
[   11.824501]  kasan_save_stack+0x45/0x70
[   11.824651]  kasan_save_track+0x18/0x40
[   11.824842]  kasan_save_free_info+0x3f/0x60
[   11.825164]  __kasan_slab_free+0x56/0x70
[   11.825338]  kfree+0x222/0x3f0
[   11.825478]  kfree_sensitive+0x67/0x90
[   11.825629]  kmalloc_double_kzfree+0x12b/0x350
[   11.825833]  kunit_try_run_case+0x1a5/0x480
[   11.826124]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.826463]  kthread+0x337/0x6f0
[   11.826673]  ret_from_fork+0x116/0x1d0
[   11.826941]  ret_from_fork_asm+0x1a/0x30
[   11.827402] 
[   11.827482] The buggy address belongs to the object at ffff8881027a10e0
[   11.827482]  which belongs to the cache kmalloc-16 of size 16
[   11.827935] The buggy address is located 0 bytes inside of
[   11.827935]  16-byte region [ffff8881027a10e0, ffff8881027a10f0)
[   11.828519] 
[   11.828659] The buggy address belongs to the physical page:
[   11.828911] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1027a1
[   11.829376] flags: 0x200000000000000(node=0|zone=2)
[   11.829626] page_type: f5(slab)
[   11.829842] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   11.830317] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   11.830699] page dumped because: kasan: bad access detected
[   11.830963] 
[   11.831179] Memory state around the buggy address:
[   11.831415]  ffff8881027a0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   11.831735]  ffff8881027a1000: fa fb fc fc fa fb fc fc 00 05 fc fc fa fb fc fc
[   11.832274] >ffff8881027a1080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   11.832599]                                                        ^
[   11.832902]  ffff8881027a1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   11.833328]  ffff8881027a1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   11.833614] ==================================================================