Date
April 22, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| rk3399-rock-pi-4b |
[ 17.269832] ================================================================== [ 17.269975] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 17.270092] Read of size 1 at addr fff00000c6837000 by task kunit_try_catch/142 [ 17.270207] [ 17.270279] CPU: 1 UID: 0 PID: 142 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 17.270458] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.270519] Hardware name: linux,dummy-virt (DT) [ 17.270645] Call trace: [ 17.270697] show_stack+0x20/0x38 (C) [ 17.270802] dump_stack_lvl+0x8c/0xd0 [ 17.271182] print_report+0x118/0x608 [ 17.271305] kasan_report+0xdc/0x128 [ 17.271497] __asan_report_load1_noabort+0x20/0x30 [ 17.271632] kmalloc_node_oob_right+0x2f4/0x330 [ 17.271912] kunit_try_run_case+0x170/0x3f0 [ 17.272034] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.272240] kthread+0x328/0x630 [ 17.272337] ret_from_fork+0x10/0x20 [ 17.272437] [ 17.272475] Allocated by task 142: [ 17.272560] kasan_save_stack+0x3c/0x68 [ 17.272730] kasan_save_track+0x20/0x40 [ 17.272817] kasan_save_alloc_info+0x40/0x58 [ 17.272894] __kasan_kmalloc+0xd4/0xd8 [ 17.272974] __kmalloc_cache_node_noprof+0x168/0x3d0 [ 17.273061] kmalloc_node_oob_right+0xbc/0x330 [ 17.273153] kunit_try_run_case+0x170/0x3f0 [ 17.273238] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.273353] kthread+0x328/0x630 [ 17.273429] ret_from_fork+0x10/0x20 [ 17.273578] [ 17.273622] The buggy address belongs to the object at fff00000c6836000 [ 17.273622] which belongs to the cache kmalloc-4k of size 4096 [ 17.274112] The buggy address is located 0 bytes to the right of [ 17.274112] allocated 4096-byte region [fff00000c6836000, fff00000c6837000) [ 17.274343] [ 17.274389] The buggy address belongs to the physical page: [ 17.274523] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106830 [ 17.274873] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.274984] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.275160] page_type: f5(slab) [ 17.275263] raw: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 17.275392] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 17.275504] head: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 17.276217] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 17.276556] head: 0bfffe0000000003 ffffc1ffc31a0c01 00000000ffffffff 00000000ffffffff [ 17.277100] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 17.277291] page dumped because: kasan: bad access detected [ 17.277364] [ 17.277407] Memory state around the buggy address: [ 17.277504] fff00000c6836f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.277653] fff00000c6836f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.277758] >fff00000c6837000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.277832] ^ [ 17.277889] fff00000c6837080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.278038] fff00000c6837100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.278137] ==================================================================
[ 19.056743] ================================================================== [ 19.057776] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 19.058478] Read of size 1 at addr ffff00000d213000 by task kunit_try_catch/198 [ 19.059148] [ 19.059309] CPU: 2 UID: 0 PID: 198 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 19.059349] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.059361] Hardware name: Radxa ROCK Pi 4B (DT) [ 19.059376] Call trace: [ 19.059386] show_stack+0x20/0x38 (C) [ 19.059414] dump_stack_lvl+0x8c/0xd0 [ 19.059441] print_report+0x118/0x608 [ 19.059465] kasan_report+0xdc/0x128 [ 19.059489] __asan_report_load1_noabort+0x20/0x30 [ 19.059517] kmalloc_node_oob_right+0x2f4/0x330 [ 19.059547] kunit_try_run_case+0x170/0x3f0 [ 19.059577] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.059610] kthread+0x328/0x630 [ 19.059639] ret_from_fork+0x10/0x20 [ 19.059666] [ 19.065254] Allocated by task 198: [ 19.065575] kasan_save_stack+0x3c/0x68 [ 19.065942] kasan_save_track+0x20/0x40 [ 19.066306] kasan_save_alloc_info+0x40/0x58 [ 19.066713] __kasan_kmalloc+0xd4/0xd8 [ 19.067069] __kmalloc_cache_node_noprof+0x168/0x3d0 [ 19.067535] kmalloc_node_oob_right+0xbc/0x330 [ 19.067960] kunit_try_run_case+0x170/0x3f0 [ 19.068360] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.068875] kthread+0x328/0x630 [ 19.069191] ret_from_fork+0x10/0x20 [ 19.069534] [ 19.069684] The buggy address belongs to the object at ffff00000d212000 [ 19.069684] which belongs to the cache kmalloc-4k of size 4096 [ 19.070810] The buggy address is located 0 bytes to the right of [ 19.070810] allocated 4096-byte region [ffff00000d212000, ffff00000d213000) [ 19.071982] [ 19.072133] The buggy address belongs to the physical page: [ 19.072645] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xd210 [ 19.073362] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.074060] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 19.074705] page_type: f5(slab) [ 19.075012] raw: 03fffe0000000040 ffff000000403040 dead000000000122 0000000000000000 [ 19.075720] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 19.076428] head: 03fffe0000000040 ffff000000403040 dead000000000122 0000000000000000 [ 19.077143] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 19.077859] head: 03fffe0000000003 fffffdffc0348401 00000000ffffffff 00000000ffffffff [ 19.078575] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 19.079283] page dumped because: kasan: bad access detected [ 19.079793] [ 19.079941] Memory state around the buggy address: [ 19.080384] ffff00000d212f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.081044] ffff00000d212f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.081703] >ffff00000d213000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.082357] ^ [ 19.082662] ffff00000d213080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.083321] ffff00000d213100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.083976] ==================================================================