Date
April 20, 2025, 11:09 p.m.
| Environment | |
|---|---|
| x15 | |
| x86 |
[ 54.350830] ================================================================== [ 54.362304] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x1b0/0x35c [ 54.369567] Write of size 2 at addr cc228a77 by task kunit_try_catch/228 [ 54.376312] [ 54.377838] CPU: 1 UID: 0 PID: 228 Comm: kunit_try_catch Tainted: G B W N 6.15.0-rc3 #1 NONE [ 54.377868] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 54.377868] Hardware name: Generic DRA74X (Flattened Device Tree) [ 54.377868] Call trace: [ 54.377899] unwind_backtrace from show_stack+0x18/0x1c [ 54.377899] show_stack from dump_stack_lvl+0x70/0x90 [ 54.377929] dump_stack_lvl from print_report+0x158/0x528 [ 54.377960] print_report from kasan_report+0xdc/0x118 [ 54.377990] kasan_report from kasan_check_range+0x14c/0x198 [ 54.377990] kasan_check_range from __asan_memset+0x20/0x3c [ 54.378021] __asan_memset from kmalloc_oob_memset_2+0x1b0/0x35c [ 54.378051] kmalloc_oob_memset_2 from kunit_try_run_case+0x22c/0x5a8 [ 54.378051] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0xc4/0x128 [ 54.378082] kunit_generic_run_threadfn_adapter from kthread+0x464/0x810 [ 54.378112] kthread from ret_from_fork+0x14/0x20 [ 54.378143] Exception stack(0xf243bfb0 to 0xf243bff8) [ 54.378143] bfa0: 00000000 00000000 00000000 00000000 [ 54.378173] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 54.378173] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 54.378204] [ 54.494934] Allocated by task 228: [ 54.498382] kasan_save_track+0x30/0x5c [ 54.502227] __kasan_kmalloc+0x8c/0x94 [ 54.506011] kmalloc_oob_memset_2+0xcc/0x35c [ 54.510314] kunit_try_run_case+0x22c/0x5a8 [ 54.514556] kunit_generic_run_threadfn_adapter+0xc4/0x128 [ 54.520080] kthread+0x464/0x810 [ 54.523315] ret_from_fork+0x14/0x20 [ 54.526947] [ 54.528442] The buggy address belongs to the object at cc228a00 [ 54.528442] which belongs to the cache kmalloc-128 of size 128 [ 54.540344] The buggy address is located 119 bytes inside of [ 54.540344] allocated 120-byte region [cc228a00, cc228a78) [ 54.551635] [ 54.553131] The buggy address belongs to the physical page: [ 54.558746] page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8c228 [ 54.566009] flags: 0x0(zone=0) [ 54.569091] page_type: f5(slab) [ 54.572265] raw: 00000000 c7001400 00000122 00000000 00000000 80100010 f5000000 00000000 [ 54.580383] raw: 00000000 [ 54.583038] page dumped because: kasan: bad access detected [ 54.588653] [ 54.590148] Memory state around the buggy address: [ 54.594970] cc228900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.601531] cc228980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.608093] >cc228a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 54.614685] ^ [ 54.621154] cc228a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.627716] cc228b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.634307] ==================================================================
[ 24.803587] ================================================================== [ 24.815002] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x166/0x330 [ 24.822223] Write of size 2 at addr ffff888107f05077 by task kunit_try_catch/215 [ 24.829621] [ 24.831122] CPU: 1 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT(voluntary) [ 24.831131] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.831133] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021 [ 24.831136] Call Trace: [ 24.831138] <TASK> [ 24.831140] dump_stack_lvl+0x73/0xb0 [ 24.831144] print_report+0xd1/0x650 [ 24.831148] ? __virt_addr_valid+0x1db/0x2d0 [ 24.831152] ? kmalloc_oob_memset_2+0x166/0x330 [ 24.831156] ? kasan_complete_mode_report_info+0x2a/0x200 [ 24.831160] ? kmalloc_oob_memset_2+0x166/0x330 [ 24.831164] kasan_report+0x141/0x180 [ 24.831168] ? kmalloc_oob_memset_2+0x166/0x330 [ 24.831173] kasan_check_range+0x10c/0x1c0 [ 24.831177] __asan_memset+0x27/0x50 [ 24.831181] kmalloc_oob_memset_2+0x166/0x330 [ 24.831185] ? __pfx_kmalloc_oob_memset_2+0x10/0x10 [ 24.831189] ? __schedule+0x10cc/0x2b30 [ 24.831194] ? ktime_get_ts64+0x83/0x230 [ 24.831198] kunit_try_run_case+0x1a2/0x480 [ 24.831203] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.831207] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.831211] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.831216] ? __kthread_parkme+0x82/0x180 [ 24.831220] ? preempt_count_sub+0x50/0x80 [ 24.831224] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.831228] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 24.831233] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.831237] kthread+0x334/0x6f0 [ 24.831240] ? trace_preempt_on+0x20/0xc0 [ 24.831245] ? __pfx_kthread+0x10/0x10 [ 24.831249] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.831253] ? calculate_sigpending+0x7b/0xa0 [ 24.831257] ? __pfx_kthread+0x10/0x10 [ 24.831261] ret_from_fork+0x3e/0x80 [ 24.831265] ? __pfx_kthread+0x10/0x10 [ 24.831269] ret_from_fork_asm+0x1a/0x30 [ 24.831275] </TASK> [ 24.831276] [ 24.998293] Allocated by task 215: [ 25.001700] kasan_save_stack+0x45/0x70 [ 25.005582] kasan_save_track+0x18/0x40 [ 25.009420] kasan_save_alloc_info+0x3b/0x50 [ 25.013714] __kasan_kmalloc+0xb7/0xc0 [ 25.017499] __kmalloc_cache_noprof+0x189/0x420 [ 25.022030] kmalloc_oob_memset_2+0xac/0x330 [ 25.026304] kunit_try_run_case+0x1a2/0x480 [ 25.030490] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 25.035889] kthread+0x334/0x6f0 [ 25.039121] ret_from_fork+0x3e/0x80 [ 25.042701] ret_from_fork_asm+0x1a/0x30 [ 25.046699] [ 25.048213] The buggy address belongs to the object at ffff888107f05000 [ 25.048213] which belongs to the cache kmalloc-128 of size 128 [ 25.060761] The buggy address is located 119 bytes inside of [ 25.060761] allocated 120-byte region [ffff888107f05000, ffff888107f05078) [ 25.073362] [ 25.074860] The buggy address belongs to the physical page: [ 25.080432] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107f05 [ 25.088434] flags: 0x200000000000000(node=0|zone=2) [ 25.093320] page_type: f5(slab) [ 25.096468] raw: 0200000000000000 ffff888100042a00 dead000000000122 0000000000000000 [ 25.104213] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.111953] page dumped because: kasan: bad access detected [ 25.117525] [ 25.119024] Memory state around the buggy address: [ 25.123817] ffff888107f04f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.131035] ffff888107f04f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.138254] >ffff888107f05000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 25.145473] ^ [ 25.152605] ffff888107f05080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.159827] ffff888107f05100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.167053] ==================================================================