Date
April 22, 2025, 11:09 a.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 | |
rk3399-rock-pi-4b |
[ 17.765894] ================================================================== [ 17.766062] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x150/0x2f8 [ 17.766208] Write of size 8 at addr fff00000c62d4a71 by task kunit_try_catch/178 [ 17.766335] [ 17.766428] CPU: 1 UID: 0 PID: 178 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 17.766656] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.766711] Hardware name: linux,dummy-virt (DT) [ 17.766771] Call trace: [ 17.766816] show_stack+0x20/0x38 (C) [ 17.766921] dump_stack_lvl+0x8c/0xd0 [ 17.767020] print_report+0x118/0x608 [ 17.767118] kasan_report+0xdc/0x128 [ 17.767247] kasan_check_range+0x100/0x1a8 [ 17.767391] __asan_memset+0x34/0x78 [ 17.767480] kmalloc_oob_memset_8+0x150/0x2f8 [ 17.767673] kunit_try_run_case+0x170/0x3f0 [ 17.767773] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.767910] kthread+0x328/0x630 [ 17.768050] ret_from_fork+0x10/0x20 [ 17.768141] [ 17.768182] Allocated by task 178: [ 17.768313] kasan_save_stack+0x3c/0x68 [ 17.768391] kasan_save_track+0x20/0x40 [ 17.768457] kasan_save_alloc_info+0x40/0x58 [ 17.768527] __kasan_kmalloc+0xd4/0xd8 [ 17.768608] __kmalloc_cache_noprof+0x15c/0x3c0 [ 17.768694] kmalloc_oob_memset_8+0xb0/0x2f8 [ 17.768997] kunit_try_run_case+0x170/0x3f0 [ 17.769090] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.769176] kthread+0x328/0x630 [ 17.769243] ret_from_fork+0x10/0x20 [ 17.769316] [ 17.769679] The buggy address belongs to the object at fff00000c62d4a00 [ 17.769679] which belongs to the cache kmalloc-128 of size 128 [ 17.769882] The buggy address is located 113 bytes inside of [ 17.769882] allocated 120-byte region [fff00000c62d4a00, fff00000c62d4a78) [ 17.770034] [ 17.770098] The buggy address belongs to the physical page: [ 17.770196] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062d4 [ 17.770347] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.770446] page_type: f5(slab) [ 17.770559] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.770708] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.770828] page dumped because: kasan: bad access detected [ 17.770908] [ 17.770946] Memory state around the buggy address: [ 17.771013] fff00000c62d4900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.771107] fff00000c62d4980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.771200] >fff00000c62d4a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.771319] ^ [ 17.771398] fff00000c62d4a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.771486] fff00000c62d4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.771673] ==================================================================
[ 18.221966] ================================================================== [ 18.222851] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x166/0x330 [ 18.224677] Write of size 8 at addr ffff888102968d71 by task kunit_try_catch/196 [ 18.225569] [ 18.226061] CPU: 1 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT(voluntary) [ 18.226233] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.226280] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.226338] Call Trace: [ 18.226382] <TASK> [ 18.226408] dump_stack_lvl+0x73/0xb0 [ 18.226553] print_report+0xd1/0x650 [ 18.226635] ? __virt_addr_valid+0x1db/0x2d0 [ 18.226683] ? kmalloc_oob_memset_8+0x166/0x330 [ 18.226716] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.226747] ? kmalloc_oob_memset_8+0x166/0x330 [ 18.226777] kasan_report+0x141/0x180 [ 18.226809] ? kmalloc_oob_memset_8+0x166/0x330 [ 18.226846] kasan_check_range+0x10c/0x1c0 [ 18.226879] __asan_memset+0x27/0x50 [ 18.226905] kmalloc_oob_memset_8+0x166/0x330 [ 18.226936] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 18.226967] ? __schedule+0x10cc/0x2b30 [ 18.227001] ? __pfx_read_tsc+0x10/0x10 [ 18.227029] ? ktime_get_ts64+0x86/0x230 [ 18.227064] kunit_try_run_case+0x1a5/0x480 [ 18.227097] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.227126] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.227158] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.227190] ? __kthread_parkme+0x82/0x180 [ 18.227219] ? preempt_count_sub+0x50/0x80 [ 18.227252] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.227283] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.227312] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.227342] kthread+0x337/0x6f0 [ 18.227370] ? trace_preempt_on+0x20/0xc0 [ 18.227402] ? __pfx_kthread+0x10/0x10 [ 18.227457] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.227582] ? calculate_sigpending+0x7b/0xa0 [ 18.227624] ? __pfx_kthread+0x10/0x10 [ 18.227655] ret_from_fork+0x41/0x80 [ 18.227684] ? __pfx_kthread+0x10/0x10 [ 18.227714] ret_from_fork_asm+0x1a/0x30 [ 18.227757] </TASK> [ 18.227771] [ 18.246026] Allocated by task 196: [ 18.246806] kasan_save_stack+0x45/0x70 [ 18.247210] kasan_save_track+0x18/0x40 [ 18.247852] kasan_save_alloc_info+0x3b/0x50 [ 18.248404] __kasan_kmalloc+0xb7/0xc0 [ 18.248899] __kmalloc_cache_noprof+0x189/0x420 [ 18.249350] kmalloc_oob_memset_8+0xac/0x330 [ 18.249921] kunit_try_run_case+0x1a5/0x480 [ 18.250583] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.251141] kthread+0x337/0x6f0 [ 18.251850] ret_from_fork+0x41/0x80 [ 18.252325] ret_from_fork_asm+0x1a/0x30 [ 18.253137] [ 18.253320] The buggy address belongs to the object at ffff888102968d00 [ 18.253320] which belongs to the cache kmalloc-128 of size 128 [ 18.255198] The buggy address is located 113 bytes inside of [ 18.255198] allocated 120-byte region [ffff888102968d00, ffff888102968d78) [ 18.256163] [ 18.256686] The buggy address belongs to the physical page: [ 18.257189] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102968 [ 18.257917] flags: 0x200000000000000(node=0|zone=2) [ 18.258695] page_type: f5(slab) [ 18.259137] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.259925] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.260510] page dumped because: kasan: bad access detected [ 18.260990] [ 18.261217] Memory state around the buggy address: [ 18.261938] ffff888102968c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.262456] ffff888102968c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.263157] >ffff888102968d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.263752] ^ [ 18.265021] ffff888102968d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.265847] ffff888102968e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.266355] ==================================================================
[ 19.838417] ================================================================== [ 19.839501] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x150/0x2f8 [ 19.840192] Write of size 8 at addr ffff00000c98e871 by task kunit_try_catch/234 [ 19.840876] [ 19.841041] CPU: 1 UID: 0 PID: 234 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc3 #1 PREEMPT [ 19.841091] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.841105] Hardware name: Radxa ROCK Pi 4B (DT) [ 19.841123] Call trace: [ 19.841135] show_stack+0x20/0x38 (C) [ 19.841168] dump_stack_lvl+0x8c/0xd0 [ 19.841201] print_report+0x118/0x608 [ 19.841230] kasan_report+0xdc/0x128 [ 19.841259] kasan_check_range+0x100/0x1a8 [ 19.841289] __asan_memset+0x34/0x78 [ 19.841319] kmalloc_oob_memset_8+0x150/0x2f8 [ 19.841354] kunit_try_run_case+0x170/0x3f0 [ 19.841390] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.841429] kthread+0x328/0x630 [ 19.841463] ret_from_fork+0x10/0x20 [ 19.841497] [ 19.847354] Allocated by task 234: [ 19.847681] kasan_save_stack+0x3c/0x68 [ 19.848055] kasan_save_track+0x20/0x40 [ 19.848426] kasan_save_alloc_info+0x40/0x58 [ 19.848839] __kasan_kmalloc+0xd4/0xd8 [ 19.849202] __kmalloc_cache_noprof+0x15c/0x3c0 [ 19.849643] kmalloc_oob_memset_8+0xb0/0x2f8 [ 19.850060] kunit_try_run_case+0x170/0x3f0 [ 19.850467] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.850992] kthread+0x328/0x630 [ 19.851315] ret_from_fork+0x10/0x20 [ 19.851665] [ 19.851817] The buggy address belongs to the object at ffff00000c98e800 [ 19.851817] which belongs to the cache kmalloc-128 of size 128 [ 19.852952] The buggy address is located 113 bytes inside of [ 19.852952] allocated 120-byte region [ffff00000c98e800, ffff00000c98e878) [ 19.854096] [ 19.854250] The buggy address belongs to the physical page: [ 19.854766] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xc98e [ 19.855493] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff) [ 19.856104] page_type: f5(slab) [ 19.856417] raw: 03fffe0000000000 ffff000000402a00 dead000000000122 0000000000000000 [ 19.857133] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.857841] page dumped because: kasan: bad access detected [ 19.858357] [ 19.858509] Memory state around the buggy address: [ 19.858958] ffff00000c98e700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.859625] ffff00000c98e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.860292] >ffff00000c98e800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.860954] ^ [ 19.861612] ffff00000c98e880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.862277] ffff00000c98e900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.862940] ==================================================================