t! [ 69.915028][ T1] debugfs: File '\_SB_.MB5D' in directory 'domains' already present! [ 70.055740][ T1] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4 [ 70.106050][ T1] gbefb: couldn't reserve mmio region [ 70.111495][ T1] gbefb: probe of gbefb.0 failed with error -16 [ 70.122848][ T2] _warn_unseeded_randomness: 103 callbacks suppressed [ 70.122867][ T2] random: get_random_u64 called from copy_process+0x444/0x2bf0 with crng_init=0 [ 70.161416][ T1] [Firmware Bug]: APEI: Invalid bit width + offset in GAR [0x94110034/64/0/3/0] [ 70.171690][ T1] EDAC DEBUG: edac_mc_alloc: allocating 3332 bytes for mci data (32 dimms, 32 csrows/channels) [ 70.186961][ T1] EDAC DEBUG: ghes_edac_dmidecode: DIMM2: Registered-DDR4 size = 16384 MB(ECC) [ 70.195905][ T1] EDAC DEBUG: ghes_edac_dmidecode: type 26, detail 0x2080, width 72(total 64) [ 70.204856][ T1] EDAC DEBUG: edac_mc_add_mc_with_groups: [ 70.211902][ T1] EDAC DEBUG: edac_create_sysfs_mci_device: device mc0 created [ 70.220567][ T1] EDAC DEBUG: edac_create_dimm_object: device dimm2 created at location memory 2 [ 70.230772][ T1] EDAC DEBUG: edac_create_csrow_object: device csrow2 created [ 70.239012][ T1] EDAC MC0: Giving out device to module ghes_edac.c controller ghes_edac: DEV ghes (INTERRUPT) [ 70.250886][ T1] EDAC DEBUG: edac_mc_del_mc: [ 70.256169][ T1] EDAC DEBUG: edac_remove_sysfs_mci_device: [ 70.264999][ T1] EDAC DEBUG: csrow_attr_release: device csrow2 released [ 70.272080][ T1] EDAC DEBUG: edac_remove_sysfs_mci_device: unregistering device dimm2 [ 70.281573][ T1] EDAC DEBUG: dimm_attr_release: device dimm2 released [ 70.288461][ T1] EDAC MC: Removed device 0 for ghes_edac.c ghes_edac: DEV ghes [ 70.296035][ T1] EDAC DEBUG: edac_mc_free: [ 70.300580][ T1] EDAC DEBUG: edac_unregister_sysfs: unregistering device mc0 [ 70.309379][ T1] EDAC DEBUG: mci_attr_release: device mc0 released [ 70.318165][ T1] ================================================================== [ 70.326165][ T1] BUG: KASAN: use-after-free in ghes_edac_unregister+0x28/0x70 [ 70.333575][ T1] Read of size 8 at addr ffff002323ca9b1c by task swapper/0/1 [ 70.340894][ T1] [ 70.343099][ T1] CPU: 57 PID: 1 Comm: swapper/0 Not tainted 5.4.0-rc3+ #1147 [ 70.350421][ T1] Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019 [ 70.359652][ T1] Call trace: [ 70.362811][ T1] dump_backtrace+0x0/0x298 [ 70.367183][ T1] show_stack+0x20/0x30 [ 70.371209][ T1] dump_stack+0x190/0x21c [ 70.375410][ T1] print_address_description.isra.6+0x80/0x3d0 [ 70.381431][ T1] __kasan_report+0x174/0x23c [ 70.385977][ T1] kasan_report+0xc/0x18 [ 70.390088][ T1] __asan_load8+0xa4/0xb0 [ 70.394286][ T1] ghes_edac_unregister+0x28/0x70 [ 70.399181][ T1] ghes_remove+0x274/0x2a0 [ 70.403468][ T1] platform_drv_remove+0x44/0x78 [ 70.408273][ T1] really_probe+0x404/0x840 [ 70.412644][ T1] driver_probe_device+0x190/0x1f0 [ 70.417623][ T1] device_driver_attach+0x7c/0xb0 [ 70.422515][ T1] __driver_attach+0x1b8/0x1d0 [ 70.427148][ T1] bus_for_each_dev+0xf8/0x190 [ 70.431779][ T1] driver_attach+0x34/0x40 [ 70.436062][ T1] bus_add_driver+0x1d8/0x340 [ 70.440607][ T1] driver_register+0x168/0x1e8 [ 70.445239][ T1] __platform_driver_register+0x80/0x90 [ 70.450656][ T1] ghes_init+0xc4/0x174 [ 70.454680][ T1] do_one_initcall+0x328/0x788 [ 70.459314][ T1] kernel_init_freeable+0x2fc/0x3d4 [ 70.464381][ T1] kernel_init+0x18/0x178 [ 70.468578][ T1] ret_from_fork+0x10/0x18 [ 70.472859][ T1] [ 70.475058][ T1] Allocated by task 1: [ 70.478996][ T1] save_stack+0x28/0xb0 [ 70.483021][ T1] __kasan_kmalloc.isra.9+0xa0/0xc8 [ 70.488087][ T1] kasan_kmalloc+0xc/0x18 [ 70.492284][ T1] __kmalloc+0x2d0/0x338 [ 70.496397][ T1] edac_mc_alloc+0xaa8/0xb18 [ 70.500856][ T1] ghes_edac_register+0x164/0x398 [ 70.505748][ T1] ghes_probe+0x648/0x6d8 [ 70.509946][ T1] platform_drv_probe+0x8c/0x110 [ 70.514751][ T1] really_probe+0x32c/0x840 [ 70.519122][ T1] driver_probe_device+0x190/0x1f0 [ 70.524100][ T1] device_driver_attach+0x7c/0xb0 [ 70.528992][ T1] __driver_attach+0x1b8/0x1d0 [ 70.533624][ T1] bus_for_each_dev+0xf8/0x190 [ 70.538255][ T1] driver_attach+0x34/0x40 [ 70.542539][ T1] bus_add_driver+0x1d8/0x340 [ 70.547083][ T1] driver_register+0x168/0x1e8 [ 70.551715][ T1] __platform_driver_register+0x80/0x90 [ 70.557127][ T1] ghes_init+0xc4/0x174 [ 70.561151][ T1] do_one_initcall+0x328/0x788 [ 70.565784][ T1] kernel_init_freeable+0x2fc/0x3d4 [ 70.570850][ T1] kernel_init+0x18/0x178 [ 70.575047][ T1] ret_from_fork+0x10/0x18 [ 70.579327][ T1] [ 70.581525][ T1] Freed by task 1: [ 70.585115][ T1] save_stack+0x28/0xb0 [ 70.589139][ T1] __kasan_slab_free+0x140/0x170 [ 70.593945][ T1] kasan_slab_free+0x10/0x18 [ 70.598405][ T1] slab_free_freelist_hook+0x19c/0x228 [ 70.603730][ T1] kfree+0x264/0x420 [ 70.607494][ T1] mci_attr_release+0x74/0x80 [ 70.612040][ T1] device_release+0xa4/0x108 [ 70.616499][ T1] kobject_put+0x250/0x2c0 [ 70.620784][ T1] device_unregister+0x88/0x98 [ 70.625415][ T1] edac_unregister_sysfs+0x78/0x88 [ 70.630395][ T1] edac_mc_free+0x78/0x88 [ 70.634592][ T1] ghes_edac_unregister+0x44/0x70 [ 70.639485][ T1] ghes_remove+0x274/0x2a0 [ 70.643769][ T1] platform_drv_remove+0x44/0x78 [ 70.648574][ T1] really_probe+0x404/0x840 [ 70.652944][ T1] driver_probe_device+0x190/0x1f0 [ 70.657924][ T1] device_driver_attach+0x7c/0xb0 [ 70.662815][ T1] __driver_attach+0x1b8/0x1d0 [ 70.667447][ T1] bus_for_each_dev+0xf8/0x190 [ 70.672078][ T1] driver_attach+0x34/0x40 [ 70.676361][ T1] bus_add_driver+0x1d8/0x340 [ 70.680906][ T1] driver_register+0x168/0x1e8 [ 70.685539][ T1] __platform_driver_register+0x80/0x90 [ 70.690951][ T1] ghes_init+0xc4/0x174 [ 70.694975][ T1] do_one_initcall+0x328/0x788 [ 70.699607][ T1] kernel_init_freeable+0x2fc/0x3d4 [ 70.704673][ T1] kernel_init+0x18/0x178 [ 70.708870][ T1] ret_from_fork+0x10/0x18 [ 70.713151][ T1] [ 70.715352][ T1] The buggy address belongs to the object at ffff002323ca9000 [ 70.715352][ T1] which belongs to the cache kmalloc-4k of size 4096 [ 70.729272][ T1] The buggy address is located 2844 bytes inside of [ 70.729272][ T1] 4096-byte region [ffff002323ca9000, ffff002323caa000) [ 70.742582][ T1] The buggy address belongs to the page: [ 70.748083][ T1] page:fffffe008c6f2a00 refcount:1 mapcount:0 mapping:ffff0020bfc17080 index:0x0 compound_mapcount: 0 [ 70.758886][ T1] flags: 0x1ffff00000010200(slab|head) [ 70.764217][ T1] raw: 1ffff00000010200 fffffe008c6f2408 fffffe008c6f2808 ffff0020bfc17080 [ 70.772671][ T1] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 70.781119][ T1] page dumped because: kasan: bad access detected [ 70.787397][ T1] [ 70.789595][ T1] Memory state around the buggy address: [ 70.795096][ T1] ffff002323ca9a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.803027][ T1] ffff002323ca9a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.810957][ T1] >ffff002323ca9b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.818884][ T1] ^ [ 70.823603][ T1] ffff002323ca9b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.831534][ T1] ffff002323ca9c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.839461][ T1] ================================================================== [ 70.847388][ T1] Disabling lock debugging due to kernel taint [ 70.853571][ T1] EDAC DEBUG: edac_mc_del_mc: [ 70.858302][ T1] EDAC DEBUG: edac_mc_free: [ 70.862829][ T1] ================================================================== [ 70.870751][ T1] BUG: KASAN: double-free or invalid-free in kfree+0x264/0x420 [ 70.878142][ T1] [ 70.880331][ T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B 5.4.0-rc3+ #1147 [ 70.888939][ T1] Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019 [ 70.898154][ T1] Call trace: [ 70.901296][ T1] dump_backtrace+0x0/0x298 [ 70.905651][ T1] show_stack+0x20/0x30 [ 70.909660][ T1] dump_stack+0x190/0x21c [ 70.913844][ T1] print_address_description.isra.6+0x80/0x3d0 [ 70.919850][ T1] kasan_report_invalid_free+0x78/0xa0 [ 70.925161][ T1] __kasan_slab_free+0xbc/0x170 [ 70.929864][ T1] kasan_slab_free+0x10/0x18 [ 70.934306][ T1] slab_free_freelist_hook+0x19c/0x228 [ 70.939616][ T1] kfree+0x264/0x420 [ 70.943365][ T1] _edac_mc_free+0x6c/0x210 [ 70.947721][ T1] edac_mc_free+0x68/0x88 [ 70.951903][ T1] ghes_edac_unregister+0x44/0x70 [ 70.956782][ T1] ghes_remove+0x274/0x2a0 [ 70.961052][ T1] platform_drv_remove+0x44/0x78 [ 70.965841][ T1] really_probe+0x404/0x840 [ 70.970196][ T1] driver_probe_device+0x190/0x1f0 [ 70.975159][ T1] device_driver_attach+0x7c/0xb0 [ 70.980035][ T1] __driver_attach+0x1b8/0x1d0 [ 70.984652][ T1] bus_for_each_dev+0xf8/0x190 [ 70.989267][ T1] driver_attach+0x34/0x40 [ 70.993535][ T1] bus_add_driver+0x1d8/0x340 [ 70.998063][ T1] driver_register+0x168/0x1e8 [ 71.002680][ T1] __platform_driver_register+0x80/0x90 [ 71.008078][ T1] ghes_init+0xc4/0x174 [ 71.012086][ T1] do_one_initcall+0x328/0x788 [ 71.016704][ T1] kernel_init_freeable+0x2fc/0x3d4 [ 71.021754][ T1] kernel_init+0x18/0x178 [ 71.025936][ T1] ret_from_fork+0x10/0x18 [ 71.030202][ T1] [ 71.032385][ T1] Allocated by task 1: [ 71.036308][ T1] save_stack+0x28/0xb0 [ 71.040317][ T1] __kasan_kmalloc.isra.9+0xa0/0xc8 [ 71.045367][ T1] kasan_kmalloc+0xc/0x18 [ 71.049549][ T1] kmem_cache_alloc_trace+0x2a0/0x2e8 [ 71.054773][ T1] edac_mc_alloc+0x7c4/0xb18 [ 71.059216][ T1] ghes_edac_register+0x164/0x398 [ 71.064093][ T1] ghes_probe+0x648/0x6d8 [ 71.068275][ T1] platform_drv_probe+0x8c/0x110 [ 71.073064][ T1] really_probe+0x32c/0x840 [ 71.077419][ T1] driver_probe_device+0x190/0x1f0 [ 71.082381][ T1] device_driver_attach+0x7c/0xb0 [ 71.087257][ T1] __driver_attach+0x1b8/0x1d0 [ 71.091874][ T1] bus_for_each_dev+0xf8/0x190 [ 71.096489][ T1] driver_attach+0x34/0x40 [ 71.100757][ T1] bus_add_driver+0x1d8/0x340 [ 71.105286][ T1] driver_register+0x168/0x1e8 [ 71.109902][ T1] __platform_driver_register+0x80/0x90 [ 71.115299][ T1] ghes_init+0xc4/0x174 [ 71.119307][ T1] do_one_initcall+0x328/0x788 [ 71.123923][ T1] kernel_init_freeable+0x2fc/0x3d4 [ 71.128973][ T1] kernel_init+0x18/0x178 [ 71.133155][ T1] ret_from_fork+0x10/0x18 [ 71.137420][ T1] [ 71.139603][ T1] Freed by task 1: [ 71.143178][ T1] save_stack+0x28/0xb0 [ 71.147186][ T1] __kasan_slab_free+0x140/0x170 [ 71.151976][ T1] kasan_slab_free+0x10/0x18 [ 71.156418][ T1] slab_free_freelist_hook+0x19c/0x228 [ 71.161728][ T1] kfree+0x264/0x420 [ 71.165477][ T1] dimm_attr_release+0x78/0x88 [ 71.170093][ T1] device_release+0xa4/0x108 [ 71.174536][ T1] kobject_put+0x250/0x2c0 [ 71.178805][ T1] device_unregister+0x88/0x98 [ 71.183421][ T1] edac_remove_sysfs_mci_device+0x20c/0x248 [ 71.189166][ T1] edac_mc_del_mc+0xec/0x158 [ 71.193609][ T1] ghes_edac_unregister+0x3c/0x70 [ 71.198486][ T1] ghes_remove+0x274/0x2a0 [ 71.202755][ T1] platform_drv_remove+0x44/0x78 [ 71.207543][ T1] really_probe+0x404/0x840 [ 71.211899][ T1] driver_probe_device+0x190/0x1f0 [ 71.216861][ T1] device_driver_attach+0x7c/0xb0 [ 71.221737][ T1] __driver_attach+0x1b8/0x1d0 [ 71.226354][ T1] bus_for_each_dev+0xf8/0x190 [ 71.230969][ T1] driver_attach+0x34/0x40 [ 71.235237][ T1] bus_add_driver+0x1d8/0x340 [ 71.239766][ T1] driver_register+0x168/0x1e8 [ 71.244382][ T1] __platform_driver_register+0x80/0x90 [ 71.249778][ T1] ghes_init+0xc4/0x174 [ 71.253787][ T1] do_one_initcall+0x328/0x788 [ 71.258403][ T1] kernel_init_freeable+0x2fc/0x3d4 [ 71.263453][ T1] kernel_init+0x18/0x178 [ 71.267635][ T1] ret_from_fork+0x10/0x18 [ 71.271900][ T1] [ 71.274085][ T1] The buggy address belongs to the object at ffff002323ce2000 [ 71.274085][ T1] which belongs to the cache kmalloc-2k of size 2048 [ 71.287989][ T1] The buggy address is located 0 bytes inside of [ 71.287989][ T1] 2048-byte region [ffff002323ce2000, ffff002323ce2800) [ 71.301022][ T1] The buggy address belongs to the page: [ 71.306508][ T1] page:fffffe008c6f3800 refcount:1 mapcount:0 mapping:ffff0020bfc10c80 index:0x0 compound_mapcount: 0 [ 71.317291][ T1] flags: 0x1ffff00000010200(slab|head) [ 71.322606][ T1] raw: 1ffff00000010200 fffffe008c6f3608 fffffe008c6f3a08 ffff0020bfc10c80 [ 71.331044][ T1] raw: 0000000000000000 0000000000050005 00000001ffffffff 0000000000000000 [ 71.339477][ T1] page dumped because: kasan: bad access detected [ 71.345738][ T1] [ 71.347920][ T1] Memory state around the buggy address: [ 71.353405][ T1] ffff002323ce1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.361319][ T1] ffff002323ce1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.369234][ T1] >ffff002323ce2000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.377145][ T1] ^ [ 71.381066][ T1] ffff002323ce2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.388981][ T1] ffff002323ce2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.396892][ T1] ==================================================================