Date
April 20, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 | |
| rk3399-rock-pi-4b |
[ 22.738582] ================================================================== [ 22.738702] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 22.738811] Write of size 1 at addr fff00000c76e1f00 by task kunit_try_catch/146 [ 22.738923] [ 22.739012] CPU: 0 UID: 0 PID: 146 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 22.739195] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.739255] Hardware name: linux,dummy-virt (DT) [ 22.739325] Call trace: [ 22.739376] show_stack+0x20/0x38 (C) [ 22.739489] dump_stack_lvl+0x8c/0xd0 [ 22.739622] print_report+0x118/0x608 [ 22.740046] kasan_report+0xdc/0x128 [ 22.740622] __asan_report_store1_noabort+0x20/0x30 [ 22.740760] kmalloc_big_oob_right+0x2a4/0x2f0 [ 22.741132] kunit_try_run_case+0x170/0x3f0 [ 22.741357] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.741494] kthread+0x328/0x630 [ 22.741650] ret_from_fork+0x10/0x20 [ 22.741854] [ 22.741914] Allocated by task 146: [ 22.742015] kasan_save_stack+0x3c/0x68 [ 22.742125] kasan_save_track+0x20/0x40 [ 22.742634] kasan_save_alloc_info+0x40/0x58 [ 22.742736] __kasan_kmalloc+0xd4/0xd8 [ 22.742845] __kmalloc_cache_noprof+0x15c/0x3c0 [ 22.743134] kmalloc_big_oob_right+0xb8/0x2f0 [ 22.743239] kunit_try_run_case+0x170/0x3f0 [ 22.743482] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.744068] kthread+0x328/0x630 [ 22.744534] ret_from_fork+0x10/0x20 [ 22.744749] [ 22.744809] The buggy address belongs to the object at fff00000c76e0000 [ 22.744809] which belongs to the cache kmalloc-8k of size 8192 [ 22.745214] The buggy address is located 0 bytes to the right of [ 22.745214] allocated 7936-byte region [fff00000c76e0000, fff00000c76e1f00) [ 22.745915] [ 22.745986] The buggy address belongs to the physical page: [ 22.746060] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076e0 [ 22.746183] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.746289] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 22.746406] page_type: f5(slab) [ 22.746490] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 22.746602] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 22.746714] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 22.746826] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 22.749035] head: 0bfffe0000000003 ffffc1ffc31db801 00000000ffffffff 00000000ffffffff [ 22.749312] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 22.750202] page dumped because: kasan: bad access detected [ 22.750842] [ 22.751587] Memory state around the buggy address: [ 22.751723] fff00000c76e1e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.752193] fff00000c76e1e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.752311] >fff00000c76e1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.752751] ^ [ 22.753204] fff00000c76e1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.753338] fff00000c76e2000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.753429] ==================================================================
[ 11.031260] ================================================================== [ 11.031841] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 11.032078] Write of size 1 at addr ffff888102c1df00 by task kunit_try_catch/164 [ 11.032934] [ 11.033210] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT(voluntary) [ 11.033256] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.033268] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.033287] Call Trace: [ 11.033299] <TASK> [ 11.033315] dump_stack_lvl+0x73/0xb0 [ 11.033353] print_report+0xd1/0x650 [ 11.033376] ? __virt_addr_valid+0x1db/0x2d0 [ 11.033398] ? kmalloc_big_oob_right+0x316/0x370 [ 11.033420] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.033442] ? kmalloc_big_oob_right+0x316/0x370 [ 11.033465] kasan_report+0x141/0x180 [ 11.033487] ? kmalloc_big_oob_right+0x316/0x370 [ 11.033514] __asan_report_store1_noabort+0x1b/0x30 [ 11.033534] kmalloc_big_oob_right+0x316/0x370 [ 11.033557] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 11.033605] ? __schedule+0x10cc/0x2b30 [ 11.033631] ? __pfx_read_tsc+0x10/0x10 [ 11.033652] ? ktime_get_ts64+0x86/0x230 [ 11.033689] kunit_try_run_case+0x1a5/0x480 [ 11.033713] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.033745] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.033772] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.033795] ? __kthread_parkme+0x82/0x180 [ 11.033816] ? preempt_count_sub+0x50/0x80 [ 11.033841] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.033863] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.033885] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.033907] kthread+0x337/0x6f0 [ 11.033927] ? trace_preempt_on+0x20/0xc0 [ 11.033951] ? __pfx_kthread+0x10/0x10 [ 11.033972] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.033994] ? calculate_sigpending+0x7b/0xa0 [ 11.034015] ? __pfx_kthread+0x10/0x10 [ 11.034037] ret_from_fork+0x41/0x80 [ 11.034057] ? __pfx_kthread+0x10/0x10 [ 11.034078] ret_from_fork_asm+0x1a/0x30 [ 11.034125] </TASK> [ 11.034136] [ 11.049288] Allocated by task 164: [ 11.050237] kasan_save_stack+0x45/0x70 [ 11.050788] kasan_save_track+0x18/0x40 [ 11.051300] kasan_save_alloc_info+0x3b/0x50 [ 11.052030] __kasan_kmalloc+0xb7/0xc0 [ 11.052624] __kmalloc_cache_noprof+0x189/0x420 [ 11.053025] kmalloc_big_oob_right+0xa9/0x370 [ 11.053387] kunit_try_run_case+0x1a5/0x480 [ 11.053946] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.054692] kthread+0x337/0x6f0 [ 11.055286] ret_from_fork+0x41/0x80 [ 11.055664] ret_from_fork_asm+0x1a/0x30 [ 11.055816] [ 11.055889] The buggy address belongs to the object at ffff888102c1c000 [ 11.055889] which belongs to the cache kmalloc-8k of size 8192 [ 11.056636] The buggy address is located 0 bytes to the right of [ 11.056636] allocated 7936-byte region [ffff888102c1c000, ffff888102c1df00) [ 11.057892] [ 11.058065] The buggy address belongs to the physical page: [ 11.058637] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c18 [ 11.058905] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.059138] flags: 0x200000000000040(head|node=0|zone=2) [ 11.059687] page_type: f5(slab) [ 11.059992] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.060919] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.061541] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.061792] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.062021] head: 0200000000000003 ffffea00040b0601 00000000ffffffff 00000000ffffffff [ 11.062268] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 11.062604] page dumped because: kasan: bad access detected [ 11.063084] [ 11.063238] Memory state around the buggy address: [ 11.063779] ffff888102c1de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.064497] ffff888102c1de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.064746] >ffff888102c1df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.064954] ^ [ 11.065069] ffff888102c1df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.065676] ffff888102c1e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.066309] ==================================================================
[ 20.824272] ================================================================== [ 20.825454] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 20.826152] Write of size 1 at addr ffff00000d77df00 by task kunit_try_catch/198 [ 20.826837] [ 20.827002] CPU: 0 UID: 0 PID: 198 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 20.827051] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.827065] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.827082] Call trace: [ 20.827094] show_stack+0x20/0x38 (C) [ 20.827128] dump_stack_lvl+0x8c/0xd0 [ 20.827159] print_report+0x118/0x608 [ 20.827189] kasan_report+0xdc/0x128 [ 20.827217] __asan_report_store1_noabort+0x20/0x30 [ 20.827251] kmalloc_big_oob_right+0x2a4/0x2f0 [ 20.827285] kunit_try_run_case+0x170/0x3f0 [ 20.827320] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.827358] kthread+0x328/0x630 [ 20.827392] ret_from_fork+0x10/0x20 [ 20.827425] [ 20.833036] Allocated by task 198: [ 20.833362] kasan_save_stack+0x3c/0x68 [ 20.833735] kasan_save_track+0x20/0x40 [ 20.834107] kasan_save_alloc_info+0x40/0x58 [ 20.834519] __kasan_kmalloc+0xd4/0xd8 [ 20.834882] __kmalloc_cache_noprof+0x15c/0x3c0 [ 20.835323] kmalloc_big_oob_right+0xb8/0x2f0 [ 20.835745] kunit_try_run_case+0x170/0x3f0 [ 20.836151] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.836674] kthread+0x328/0x630 [ 20.836997] ret_from_fork+0x10/0x20 [ 20.837347] [ 20.837500] The buggy address belongs to the object at ffff00000d77c000 [ 20.837500] which belongs to the cache kmalloc-8k of size 8192 [ 20.838632] The buggy address is located 0 bytes to the right of [ 20.838632] allocated 7936-byte region [ffff00000d77c000, ffff00000d77df00) [ 20.839812] [ 20.839966] The buggy address belongs to the physical page: [ 20.840482] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xd778 [ 20.841205] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.841910] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.842562] page_type: f5(slab) [ 20.842876] raw: 03fffe0000000040 ffff000000403180 dead000000000122 0000000000000000 [ 20.843591] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 20.844306] head: 03fffe0000000040 ffff000000403180 dead000000000122 0000000000000000 [ 20.845029] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 20.845752] head: 03fffe0000000003 fffffdffc035de01 00000000ffffffff 00000000ffffffff [ 20.846474] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 20.847189] page dumped because: kasan: bad access detected [ 20.847703] [ 20.847855] Memory state around the buggy address: [ 20.848302] ffff00000d77de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.848968] ffff00000d77de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.849633] >ffff00000d77df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.850294] ^ [ 20.850605] ffff00000d77df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.851270] ffff00000d77e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.851931] ==================================================================