Date
April 22, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 | |
| rk3399-rock-pi-4b |
[ 17.780879] ================================================================== [ 17.780995] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x150/0x2f8 [ 17.781098] Write of size 16 at addr fff00000c62d4b69 by task kunit_try_catch/180 [ 17.781209] [ 17.781282] CPU: 1 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 17.781479] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.781812] Hardware name: linux,dummy-virt (DT) [ 17.781916] Call trace: [ 17.781966] show_stack+0x20/0x38 (C) [ 17.782082] dump_stack_lvl+0x8c/0xd0 [ 17.782296] print_report+0x118/0x608 [ 17.782398] kasan_report+0xdc/0x128 [ 17.782492] kasan_check_range+0x100/0x1a8 [ 17.782599] __asan_memset+0x34/0x78 [ 17.782693] kmalloc_oob_memset_16+0x150/0x2f8 [ 17.782802] kunit_try_run_case+0x170/0x3f0 [ 17.782910] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.783025] kthread+0x328/0x630 [ 17.783120] ret_from_fork+0x10/0x20 [ 17.783225] [ 17.783265] Allocated by task 180: [ 17.783359] kasan_save_stack+0x3c/0x68 [ 17.783435] kasan_save_track+0x20/0x40 [ 17.783510] kasan_save_alloc_info+0x40/0x58 [ 17.783673] __kasan_kmalloc+0xd4/0xd8 [ 17.783758] __kmalloc_cache_noprof+0x15c/0x3c0 [ 17.783831] kmalloc_oob_memset_16+0xb0/0x2f8 [ 17.783911] kunit_try_run_case+0x170/0x3f0 [ 17.783985] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.784111] kthread+0x328/0x630 [ 17.784198] ret_from_fork+0x10/0x20 [ 17.784268] [ 17.784313] The buggy address belongs to the object at fff00000c62d4b00 [ 17.784313] which belongs to the cache kmalloc-128 of size 128 [ 17.784441] The buggy address is located 105 bytes inside of [ 17.784441] allocated 120-byte region [fff00000c62d4b00, fff00000c62d4b78) [ 17.784620] [ 17.784666] The buggy address belongs to the physical page: [ 17.784761] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062d4 [ 17.784884] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.784987] page_type: f5(slab) [ 17.785055] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.785144] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.785243] page dumped because: kasan: bad access detected [ 17.785309] [ 17.785348] Memory state around the buggy address: [ 17.785460] fff00000c62d4a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.785574] fff00000c62d4a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.785656] >fff00000c62d4b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.785728] ^ [ 17.785799] fff00000c62d4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.785869] fff00000c62d4c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.785946] ==================================================================
[ 18.272340] ================================================================== [ 18.273436] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x166/0x330 [ 18.274312] Write of size 16 at addr ffff888102968e69 by task kunit_try_catch/198 [ 18.275393] [ 18.275971] CPU: 1 UID: 0 PID: 198 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT(voluntary) [ 18.276112] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.276143] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.276196] Call Trace: [ 18.276238] <TASK> [ 18.276285] dump_stack_lvl+0x73/0xb0 [ 18.276364] print_report+0xd1/0x650 [ 18.276451] ? __virt_addr_valid+0x1db/0x2d0 [ 18.276603] ? kmalloc_oob_memset_16+0x166/0x330 [ 18.276638] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.276668] ? kmalloc_oob_memset_16+0x166/0x330 [ 18.276699] kasan_report+0x141/0x180 [ 18.276729] ? kmalloc_oob_memset_16+0x166/0x330 [ 18.276767] kasan_check_range+0x10c/0x1c0 [ 18.276801] __asan_memset+0x27/0x50 [ 18.276827] kmalloc_oob_memset_16+0x166/0x330 [ 18.276858] ? __pfx_kmalloc_oob_memset_16+0x10/0x10 [ 18.276890] ? __schedule+0x10cc/0x2b30 [ 18.276924] ? __pfx_read_tsc+0x10/0x10 [ 18.276951] ? ktime_get_ts64+0x86/0x230 [ 18.276986] kunit_try_run_case+0x1a5/0x480 [ 18.277018] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.277047] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.277079] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.277111] ? __kthread_parkme+0x82/0x180 [ 18.277140] ? preempt_count_sub+0x50/0x80 [ 18.277173] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.277203] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.277233] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.277262] kthread+0x337/0x6f0 [ 18.277292] ? trace_preempt_on+0x20/0xc0 [ 18.277323] ? __pfx_kthread+0x10/0x10 [ 18.277352] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.277381] ? calculate_sigpending+0x7b/0xa0 [ 18.277409] ? __pfx_kthread+0x10/0x10 [ 18.277517] ret_from_fork+0x41/0x80 [ 18.277602] ? __pfx_kthread+0x10/0x10 [ 18.277636] ret_from_fork_asm+0x1a/0x30 [ 18.277681] </TASK> [ 18.277695] [ 18.298186] Allocated by task 198: [ 18.299075] kasan_save_stack+0x45/0x70 [ 18.299910] kasan_save_track+0x18/0x40 [ 18.300702] kasan_save_alloc_info+0x3b/0x50 [ 18.301079] __kasan_kmalloc+0xb7/0xc0 [ 18.301394] __kmalloc_cache_noprof+0x189/0x420 [ 18.302284] kmalloc_oob_memset_16+0xac/0x330 [ 18.302943] kunit_try_run_case+0x1a5/0x480 [ 18.303274] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.304391] kthread+0x337/0x6f0 [ 18.304676] ret_from_fork+0x41/0x80 [ 18.305709] ret_from_fork_asm+0x1a/0x30 [ 18.306314] [ 18.306586] The buggy address belongs to the object at ffff888102968e00 [ 18.306586] which belongs to the cache kmalloc-128 of size 128 [ 18.308241] The buggy address is located 105 bytes inside of [ 18.308241] allocated 120-byte region [ffff888102968e00, ffff888102968e78) [ 18.309478] [ 18.310149] The buggy address belongs to the physical page: [ 18.310593] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102968 [ 18.311831] flags: 0x200000000000000(node=0|zone=2) [ 18.312249] page_type: f5(slab) [ 18.312834] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.313436] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.314137] page dumped because: kasan: bad access detected [ 18.314788] [ 18.314973] Memory state around the buggy address: [ 18.315510] ffff888102968d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.316368] ffff888102968d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.317101] >ffff888102968e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.317900] ^ [ 18.318597] ffff888102968e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.319249] ffff888102968f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.320002] ==================================================================
[ 19.865412] ================================================================== [ 19.866462] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x150/0x2f8 [ 19.867146] Write of size 16 at addr ffff00000e73a369 by task kunit_try_catch/236 [ 19.867826] [ 19.867982] CPU: 2 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 19.868018] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.868030] Hardware name: Radxa ROCK Pi 4B (DT) [ 19.868043] Call trace: [ 19.868052] show_stack+0x20/0x38 (C) [ 19.868076] dump_stack_lvl+0x8c/0xd0 [ 19.868100] print_report+0x118/0x608 [ 19.868121] kasan_report+0xdc/0x128 [ 19.868141] kasan_check_range+0x100/0x1a8 [ 19.868163] __asan_memset+0x34/0x78 [ 19.868184] kmalloc_oob_memset_16+0x150/0x2f8 [ 19.868209] kunit_try_run_case+0x170/0x3f0 [ 19.868235] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.868264] kthread+0x328/0x630 [ 19.868288] ret_from_fork+0x10/0x20 [ 19.868312] [ 19.874129] Allocated by task 236: [ 19.874448] kasan_save_stack+0x3c/0x68 [ 19.874810] kasan_save_track+0x20/0x40 [ 19.875170] kasan_save_alloc_info+0x40/0x58 [ 19.875571] __kasan_kmalloc+0xd4/0xd8 [ 19.875922] __kmalloc_cache_noprof+0x15c/0x3c0 [ 19.876349] kmalloc_oob_memset_16+0xb0/0x2f8 [ 19.876759] kunit_try_run_case+0x170/0x3f0 [ 19.877153] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.877665] kthread+0x328/0x630 [ 19.877976] ret_from_fork+0x10/0x20 [ 19.878314] [ 19.878461] The buggy address belongs to the object at ffff00000e73a300 [ 19.878461] which belongs to the cache kmalloc-128 of size 128 [ 19.879580] The buggy address is located 105 bytes inside of [ 19.879580] allocated 120-byte region [ffff00000e73a300, ffff00000e73a378) [ 19.880709] [ 19.880856] The buggy address belongs to the physical page: [ 19.881363] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe73a [ 19.882074] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff) [ 19.882674] page_type: f5(slab) [ 19.882978] raw: 03fffe0000000000 ffff000000402a00 dead000000000122 0000000000000000 [ 19.883682] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.884378] page dumped because: kasan: bad access detected [ 19.884884] [ 19.885031] Memory state around the buggy address: [ 19.885469] ffff00000e73a200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.886123] ffff00000e73a280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.886778] >ffff00000e73a300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.887429] ^ [ 19.888075] ffff00000e73a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.888729] ffff00000e73a400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.889380] ==================================================================