Date
April 22, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 | |
| rk3399-rock-pi-4b |
[ 17.323588] ================================================================== [ 17.323715] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 17.323780] Write of size 1 at addr fff00000c6bedf00 by task kunit_try_catch/146 [ 17.323828] [ 17.323867] CPU: 1 UID: 0 PID: 146 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 17.323946] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.323971] Hardware name: linux,dummy-virt (DT) [ 17.324001] Call trace: [ 17.324025] show_stack+0x20/0x38 (C) [ 17.324073] dump_stack_lvl+0x8c/0xd0 [ 17.324116] print_report+0x118/0x608 [ 17.324157] kasan_report+0xdc/0x128 [ 17.324197] __asan_report_store1_noabort+0x20/0x30 [ 17.324243] kmalloc_big_oob_right+0x2a4/0x2f0 [ 17.324288] kunit_try_run_case+0x170/0x3f0 [ 17.324332] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.324380] kthread+0x328/0x630 [ 17.324423] ret_from_fork+0x10/0x20 [ 17.324468] [ 17.324486] Allocated by task 146: [ 17.324513] kasan_save_stack+0x3c/0x68 [ 17.324634] kasan_save_track+0x20/0x40 [ 17.324703] kasan_save_alloc_info+0x40/0x58 [ 17.324765] __kasan_kmalloc+0xd4/0xd8 [ 17.324861] __kmalloc_cache_noprof+0x15c/0x3c0 [ 17.324956] kmalloc_big_oob_right+0xb8/0x2f0 [ 17.325035] kunit_try_run_case+0x170/0x3f0 [ 17.325113] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.325296] kthread+0x328/0x630 [ 17.325379] ret_from_fork+0x10/0x20 [ 17.325449] [ 17.325522] The buggy address belongs to the object at fff00000c6bec000 [ 17.325522] which belongs to the cache kmalloc-8k of size 8192 [ 17.325724] The buggy address is located 0 bytes to the right of [ 17.325724] allocated 7936-byte region [fff00000c6bec000, fff00000c6bedf00) [ 17.325867] [ 17.325923] The buggy address belongs to the physical page: [ 17.326011] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106be8 [ 17.326118] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.326218] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.326352] page_type: f5(slab) [ 17.326450] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 17.326572] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 17.326691] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 17.326838] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 17.326969] head: 0bfffe0000000003 ffffc1ffc31afa01 00000000ffffffff 00000000ffffffff [ 17.327093] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 17.327217] page dumped because: kasan: bad access detected [ 17.327297] [ 17.327329] Memory state around the buggy address: [ 17.327393] fff00000c6bede00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.327904] fff00000c6bede80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.328008] >fff00000c6bedf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.328092] ^ [ 17.328152] fff00000c6bedf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.328242] fff00000c6bee000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.328317] ==================================================================
[ 16.897193] ================================================================== [ 16.898158] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 16.899780] Write of size 1 at addr ffff888102db1f00 by task kunit_try_catch/164 [ 16.900680] [ 16.900846] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT(voluntary) [ 16.900914] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.900931] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.900960] Call Trace: [ 16.900982] <TASK> [ 16.901008] dump_stack_lvl+0x73/0xb0 [ 16.901049] print_report+0xd1/0x650 [ 16.901082] ? __virt_addr_valid+0x1db/0x2d0 [ 16.901113] ? kmalloc_big_oob_right+0x316/0x370 [ 16.901143] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.901173] ? kmalloc_big_oob_right+0x316/0x370 [ 16.901204] kasan_report+0x141/0x180 [ 16.901234] ? kmalloc_big_oob_right+0x316/0x370 [ 16.901271] __asan_report_store1_noabort+0x1b/0x30 [ 16.901298] kmalloc_big_oob_right+0x316/0x370 [ 16.901332] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 16.901365] ? __schedule+0x10cc/0x2b30 [ 16.901398] ? __pfx_read_tsc+0x10/0x10 [ 16.901425] ? ktime_get_ts64+0x86/0x230 [ 16.901522] kunit_try_run_case+0x1a5/0x480 [ 16.901620] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.901708] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.901816] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.901894] ? __kthread_parkme+0x82/0x180 [ 16.901972] ? preempt_count_sub+0x50/0x80 [ 16.902038] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.902097] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.902157] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.902213] kthread+0x337/0x6f0 [ 16.902271] ? trace_preempt_on+0x20/0xc0 [ 16.902333] ? __pfx_kthread+0x10/0x10 [ 16.902388] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.902450] ? calculate_sigpending+0x7b/0xa0 [ 16.902535] ? __pfx_kthread+0x10/0x10 [ 16.902610] ret_from_fork+0x41/0x80 [ 16.902680] ? __pfx_kthread+0x10/0x10 [ 16.902776] ret_from_fork_asm+0x1a/0x30 [ 16.902907] </TASK> [ 16.902942] [ 16.921925] Allocated by task 164: [ 16.922259] kasan_save_stack+0x45/0x70 [ 16.923385] kasan_save_track+0x18/0x40 [ 16.924166] kasan_save_alloc_info+0x3b/0x50 [ 16.924838] __kasan_kmalloc+0xb7/0xc0 [ 16.925351] __kmalloc_cache_noprof+0x189/0x420 [ 16.926075] kmalloc_big_oob_right+0xa9/0x370 [ 16.926856] kunit_try_run_case+0x1a5/0x480 [ 16.927144] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.928327] kthread+0x337/0x6f0 [ 16.928714] ret_from_fork+0x41/0x80 [ 16.929199] ret_from_fork_asm+0x1a/0x30 [ 16.929660] [ 16.929887] The buggy address belongs to the object at ffff888102db0000 [ 16.929887] which belongs to the cache kmalloc-8k of size 8192 [ 16.930778] The buggy address is located 0 bytes to the right of [ 16.930778] allocated 7936-byte region [ffff888102db0000, ffff888102db1f00) [ 16.931810] [ 16.932395] The buggy address belongs to the physical page: [ 16.932959] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102db0 [ 16.935121] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.935841] flags: 0x200000000000040(head|node=0|zone=2) [ 16.936716] page_type: f5(slab) [ 16.937038] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 16.938220] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.938949] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 16.939714] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.940880] head: 0200000000000003 ffffea00040b6c01 00000000ffffffff 00000000ffffffff [ 16.941422] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 16.942363] page dumped because: kasan: bad access detected [ 16.943043] [ 16.943257] Memory state around the buggy address: [ 16.943825] ffff888102db1e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.944867] ffff888102db1e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.945746] >ffff888102db1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.946341] ^ [ 16.946826] ffff888102db1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.947406] ffff888102db2000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.948086] ==================================================================
[ 19.133811] ================================================================== [ 19.134994] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 19.135692] Write of size 1 at addr ffff00000eb85f00 by task kunit_try_catch/202 [ 19.136376] [ 19.136542] CPU: 0 UID: 0 PID: 202 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 19.136591] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.136604] Hardware name: Radxa ROCK Pi 4B (DT) [ 19.136621] Call trace: [ 19.136633] show_stack+0x20/0x38 (C) [ 19.136666] dump_stack_lvl+0x8c/0xd0 [ 19.136697] print_report+0x118/0x608 [ 19.136726] kasan_report+0xdc/0x128 [ 19.136754] __asan_report_store1_noabort+0x20/0x30 [ 19.136788] kmalloc_big_oob_right+0x2a4/0x2f0 [ 19.136822] kunit_try_run_case+0x170/0x3f0 [ 19.136857] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.136897] kthread+0x328/0x630 [ 19.136931] ret_from_fork+0x10/0x20 [ 19.136963] [ 19.142599] Allocated by task 202: [ 19.142950] kasan_save_stack+0x3c/0x68 [ 19.143354] kasan_save_track+0x20/0x40 [ 19.143751] kasan_save_alloc_info+0x40/0x58 [ 19.144191] __kasan_kmalloc+0xd4/0xd8 [ 19.144580] __kmalloc_cache_noprof+0x15c/0x3c0 [ 19.145054] kmalloc_big_oob_right+0xb8/0x2f0 [ 19.145507] kunit_try_run_case+0x170/0x3f0 [ 19.145948] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.146505] kthread+0x328/0x630 [ 19.146858] ret_from_fork+0x10/0x20 [ 19.147235] [ 19.147404] The buggy address belongs to the object at ffff00000eb84000 [ 19.147404] which belongs to the cache kmalloc-8k of size 8192 [ 19.148569] The buggy address is located 0 bytes to the right of [ 19.148569] allocated 7936-byte region [ffff00000eb84000, ffff00000eb85f00) [ 19.149786] [ 19.149956] The buggy address belongs to the physical page: [ 19.150493] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xeb80 [ 19.151245] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.151978] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 19.152661] page_type: f5(slab) [ 19.153000] raw: 03fffe0000000040 ffff000000403180 dead000000000122 0000000000000000 [ 19.153747] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 19.154494] head: 03fffe0000000040 ffff000000403180 dead000000000122 0000000000000000 [ 19.155247] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 19.156002] head: 03fffe0000000003 fffffdffc03ae001 00000000ffffffff 00000000ffffffff [ 19.156756] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 19.157494] page dumped because: kasan: bad access detected [ 19.158029] [ 19.158196] Memory state around the buggy address: [ 19.158665] ffff00000eb85e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.159358] ffff00000eb85e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.160051] >ffff00000eb85f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.160736] ^ [ 19.161067] ffff00000eb85f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.161760] ffff00000eb86000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.162445] ==================================================================