Hay
Date
May 23, 2025, 11:07 p.m.

Environment
qemu-arm64

[   32.305683] ==================================================================
[   32.305831] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x51c/0x5d0
[   32.305982] Read of size 1 at addr ffff80008010b7f8 by task kunit_try_catch/271
[   32.306148] 
[   32.306290] CPU: 0 UID: 0 PID: 271 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc7 #1 PREEMPT 
[   32.306586] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.306670] Hardware name: linux,dummy-virt (DT)
[   32.307028] Call trace:
[   32.307106]  show_stack+0x20/0x38 (C)
[   32.307777]  dump_stack_lvl+0x8c/0xd0
[   32.308356]  print_report+0x310/0x608
[   32.308600]  kasan_report+0xdc/0x128
[   32.308813]  __asan_report_load1_noabort+0x20/0x30
[   32.309030]  vmalloc_oob+0x51c/0x5d0
[   32.309176]  kunit_try_run_case+0x170/0x3f0
[   32.309324]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.309498]  kthread+0x328/0x630
[   32.309630]  ret_from_fork+0x10/0x20
[   32.309783] 
[   32.309859] The buggy address belongs to the virtual mapping at
[   32.309859]  [ffff80008010b000, ffff80008010d000) created by:
[   32.309859]  vmalloc_oob+0x98/0x5d0
[   32.310092] 
[   32.310159] The buggy address belongs to the physical page:
[   32.310268] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078a4
[   32.310797] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   32.310989] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   32.311131] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   32.311261] page dumped because: kasan: bad access detected
[   32.311368] 
[   32.311474] Memory state around the buggy address:
[   32.311697]  ffff80008010b680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.311830]  ffff80008010b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.311973] >ffff80008010b780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8
[   32.312314]                                                                 ^
[   32.312514]  ffff80008010b800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   32.312871]  ffff80008010b880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   32.313025] ==================================================================
[   32.296543] ==================================================================
[   32.296762] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x578/0x5d0
[   32.296944] Read of size 1 at addr ffff80008010b7f3 by task kunit_try_catch/271
[   32.297098] 
[   32.297207] CPU: 0 UID: 0 PID: 271 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc7 #1 PREEMPT 
[   32.297493] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.297569] Hardware name: linux,dummy-virt (DT)
[   32.297757] Call trace:
[   32.297893]  show_stack+0x20/0x38 (C)
[   32.298302]  dump_stack_lvl+0x8c/0xd0
[   32.298461]  print_report+0x310/0x608
[   32.298807]  kasan_report+0xdc/0x128
[   32.298987]  __asan_report_load1_noabort+0x20/0x30
[   32.299160]  vmalloc_oob+0x578/0x5d0
[   32.299338]  kunit_try_run_case+0x170/0x3f0
[   32.299585]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.299821]  kthread+0x328/0x630
[   32.299983]  ret_from_fork+0x10/0x20
[   32.300153] 
[   32.300242] The buggy address belongs to the virtual mapping at
[   32.300242]  [ffff80008010b000, ffff80008010d000) created by:
[   32.300242]  vmalloc_oob+0x98/0x5d0
[   32.300510] 
[   32.300582] The buggy address belongs to the physical page:
[   32.300715] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078a4
[   32.300860] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   32.301034] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   32.301166] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   32.301582] page dumped because: kasan: bad access detected
[   32.301728] 
[   32.301820] Memory state around the buggy address:
[   32.301967]  ffff80008010b680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.302167]  ffff80008010b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   32.302359] >ffff80008010b780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8
[   32.302549]                                                              ^
[   32.302731]  ffff80008010b800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   32.302872]  ffff80008010b880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   32.302995] ==================================================================