Date
June 8, 2025, 11:09 p.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 | |
| rk3399-rock-pi-4b |
[ 22.926445] ================================================================== [ 22.933271] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 22.940817] Write of size 1 at addr ffff0008032a08d0 by task kunit_try_catch/205 [ 22.948195] [ 22.949681] CPU: 5 UID: 0 PID: 205 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 22.949733] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.949750] Hardware name: WinLink E850-96 board (DT) [ 22.949770] Call trace: [ 22.949786] show_stack+0x20/0x38 (C) [ 22.949820] dump_stack_lvl+0x8c/0xd0 [ 22.949858] print_report+0x118/0x608 [ 22.949892] kasan_report+0xdc/0x128 [ 22.949928] __asan_report_store1_noabort+0x20/0x30 [ 22.949960] krealloc_less_oob_helper+0xb9c/0xc50 [ 22.949991] krealloc_less_oob+0x20/0x38 [ 22.950020] kunit_try_run_case+0x170/0x3f0 [ 22.950055] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.950092] kthread+0x328/0x630 [ 22.950121] ret_from_fork+0x10/0x20 [ 22.950156] [ 23.017033] Allocated by task 205: [ 23.020418] kasan_save_stack+0x3c/0x68 [ 23.024235] kasan_save_track+0x20/0x40 [ 23.028055] kasan_save_alloc_info+0x40/0x58 [ 23.032309] __kasan_krealloc+0x118/0x178 [ 23.036302] krealloc_noprof+0x128/0x360 [ 23.040207] krealloc_less_oob_helper+0x168/0xc50 [ 23.044895] krealloc_less_oob+0x20/0x38 [ 23.048801] kunit_try_run_case+0x170/0x3f0 [ 23.052969] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.058438] kthread+0x328/0x630 [ 23.061649] ret_from_fork+0x10/0x20 [ 23.065207] [ 23.066684] The buggy address belongs to the object at ffff0008032a0800 [ 23.066684] which belongs to the cache kmalloc-256 of size 256 [ 23.079185] The buggy address is located 7 bytes to the right of [ 23.079185] allocated 201-byte region [ffff0008032a0800, ffff0008032a08c9) [ 23.092117] [ 23.093596] The buggy address belongs to the physical page: [ 23.099152] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a0 [ 23.107137] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.114774] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 23.121720] page_type: f5(slab) [ 23.124854] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 23.132574] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 23.140301] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 23.148112] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 23.155925] head: 0bfffe0000000002 fffffdffe00ca801 00000000ffffffff 00000000ffffffff [ 23.163737] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 23.171543] page dumped because: kasan: bad access detected [ 23.177098] [ 23.178573] Memory state around the buggy address: [ 23.183353] ffff0008032a0780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.190556] ffff0008032a0800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.197761] >ffff0008032a0880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 23.204962] ^ [ 23.210782] ffff0008032a0900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.217987] ffff0008032a0980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.225187] ================================================================== [ 25.085531] ================================================================== [ 25.092612] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 25.100161] Write of size 1 at addr ffff0008032a60da by task kunit_try_catch/209 [ 25.107537] [ 25.109021] CPU: 5 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.109074] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.109089] Hardware name: WinLink E850-96 board (DT) [ 25.109109] Call trace: [ 25.109123] show_stack+0x20/0x38 (C) [ 25.109157] dump_stack_lvl+0x8c/0xd0 [ 25.109194] print_report+0x118/0x608 [ 25.109228] kasan_report+0xdc/0x128 [ 25.109261] __asan_report_store1_noabort+0x20/0x30 [ 25.109295] krealloc_less_oob_helper+0xa80/0xc50 [ 25.109327] krealloc_large_less_oob+0x20/0x38 [ 25.109359] kunit_try_run_case+0x170/0x3f0 [ 25.109396] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.109433] kthread+0x328/0x630 [ 25.109463] ret_from_fork+0x10/0x20 [ 25.109497] [ 25.176896] The buggy address belongs to the physical page: [ 25.182454] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a4 [ 25.190439] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.198077] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.205019] page_type: f8(unknown) [ 25.208418] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.216137] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.223864] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.231674] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.239488] head: 0bfffe0000000002 fffffdffe00ca901 00000000ffffffff 00000000ffffffff [ 25.247300] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.255105] page dumped because: kasan: bad access detected [ 25.260661] [ 25.262136] Memory state around the buggy address: [ 25.266917] ffff0008032a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.274119] ffff0008032a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.281324] >ffff0008032a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.288525] ^ [ 25.294606] ffff0008032a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.301810] ffff0008032a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.309010] ================================================================== [ 23.846457] ================================================================== [ 23.853485] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 23.861029] Write of size 1 at addr ffff0008032a08eb by task kunit_try_catch/205 [ 23.868408] [ 23.869892] CPU: 5 UID: 0 PID: 205 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 23.869945] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.869961] Hardware name: WinLink E850-96 board (DT) [ 23.869983] Call trace: [ 23.869996] show_stack+0x20/0x38 (C) [ 23.870028] dump_stack_lvl+0x8c/0xd0 [ 23.870063] print_report+0x118/0x608 [ 23.870097] kasan_report+0xdc/0x128 [ 23.870129] __asan_report_store1_noabort+0x20/0x30 [ 23.870161] krealloc_less_oob_helper+0xa58/0xc50 [ 23.870194] krealloc_less_oob+0x20/0x38 [ 23.870224] kunit_try_run_case+0x170/0x3f0 [ 23.870259] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.870295] kthread+0x328/0x630 [ 23.870324] ret_from_fork+0x10/0x20 [ 23.870359] [ 23.937243] Allocated by task 205: [ 23.940631] kasan_save_stack+0x3c/0x68 [ 23.944448] kasan_save_track+0x20/0x40 [ 23.948268] kasan_save_alloc_info+0x40/0x58 [ 23.952522] __kasan_krealloc+0x118/0x178 [ 23.956514] krealloc_noprof+0x128/0x360 [ 23.960419] krealloc_less_oob_helper+0x168/0xc50 [ 23.965107] krealloc_less_oob+0x20/0x38 [ 23.969013] kunit_try_run_case+0x170/0x3f0 [ 23.973181] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.978649] kthread+0x328/0x630 [ 23.981860] ret_from_fork+0x10/0x20 [ 23.985419] [ 23.986896] The buggy address belongs to the object at ffff0008032a0800 [ 23.986896] which belongs to the cache kmalloc-256 of size 256 [ 23.999396] The buggy address is located 34 bytes to the right of [ 23.999396] allocated 201-byte region [ffff0008032a0800, ffff0008032a08c9) [ 24.012415] [ 24.013893] The buggy address belongs to the physical page: [ 24.019451] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a0 [ 24.027434] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.035074] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.042017] page_type: f5(slab) [ 24.045154] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 24.052874] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 24.060599] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 24.068411] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 24.076224] head: 0bfffe0000000002 fffffdffe00ca801 00000000ffffffff 00000000ffffffff [ 24.084036] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.091841] page dumped because: kasan: bad access detected [ 24.097397] [ 24.098872] Memory state around the buggy address: [ 24.103654] ffff0008032a0780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.110855] ffff0008032a0800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.118060] >ffff0008032a0880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 24.125261] ^ [ 24.131862] ffff0008032a0900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.139066] ffff0008032a0980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.146269] ================================================================== [ 25.316294] ================================================================== [ 25.323425] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 25.330972] Write of size 1 at addr ffff0008032a60ea by task kunit_try_catch/209 [ 25.338350] [ 25.339834] CPU: 5 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.339882] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.339895] Hardware name: WinLink E850-96 board (DT) [ 25.339915] Call trace: [ 25.339926] show_stack+0x20/0x38 (C) [ 25.339958] dump_stack_lvl+0x8c/0xd0 [ 25.339992] print_report+0x118/0x608 [ 25.340024] kasan_report+0xdc/0x128 [ 25.340059] __asan_report_store1_noabort+0x20/0x30 [ 25.340089] krealloc_less_oob_helper+0xae4/0xc50 [ 25.340122] krealloc_large_less_oob+0x20/0x38 [ 25.340155] kunit_try_run_case+0x170/0x3f0 [ 25.340191] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.340229] kthread+0x328/0x630 [ 25.340258] ret_from_fork+0x10/0x20 [ 25.340292] [ 25.407707] The buggy address belongs to the physical page: [ 25.413264] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a4 [ 25.421250] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.428889] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.435832] page_type: f8(unknown) [ 25.439226] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.446949] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.454675] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.462487] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.470300] head: 0bfffe0000000002 fffffdffe00ca901 00000000ffffffff 00000000ffffffff [ 25.478112] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.485917] page dumped because: kasan: bad access detected [ 25.491473] [ 25.492949] Memory state around the buggy address: [ 25.497729] ffff0008032a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.504931] ffff0008032a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.512136] >ffff0008032a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.519337] ^ [ 25.525938] ffff0008032a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.533143] ffff0008032a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.540344] ================================================================== [ 25.547658] ================================================================== [ 25.554759] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 25.562307] Write of size 1 at addr ffff0008032a60eb by task kunit_try_catch/209 [ 25.569684] [ 25.571169] CPU: 5 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.571219] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.571235] Hardware name: WinLink E850-96 board (DT) [ 25.571255] Call trace: [ 25.571268] show_stack+0x20/0x38 (C) [ 25.571301] dump_stack_lvl+0x8c/0xd0 [ 25.571335] print_report+0x118/0x608 [ 25.571371] kasan_report+0xdc/0x128 [ 25.571404] __asan_report_store1_noabort+0x20/0x30 [ 25.571435] krealloc_less_oob_helper+0xa58/0xc50 [ 25.571464] krealloc_large_less_oob+0x20/0x38 [ 25.571493] kunit_try_run_case+0x170/0x3f0 [ 25.571525] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.571559] kthread+0x328/0x630 [ 25.571587] ret_from_fork+0x10/0x20 [ 25.571620] [ 25.639042] The buggy address belongs to the physical page: [ 25.644598] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a4 [ 25.652584] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.660221] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.667165] page_type: f8(unknown) [ 25.670562] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.678283] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.686009] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.693820] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.701634] head: 0bfffe0000000002 fffffdffe00ca901 00000000ffffffff 00000000ffffffff [ 25.709445] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.717251] page dumped because: kasan: bad access detected [ 25.722807] [ 25.724282] Memory state around the buggy address: [ 25.729061] ffff0008032a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.736265] ffff0008032a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.743470] >ffff0008032a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.750670] ^ [ 25.757271] ffff0008032a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.764476] ffff0008032a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.771677] ================================================================== [ 22.617770] ================================================================== [ 22.627200] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 22.634748] Write of size 1 at addr ffff0008032a08c9 by task kunit_try_catch/205 [ 22.642125] [ 22.643611] CPU: 5 UID: 0 PID: 205 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 22.643662] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.643678] Hardware name: WinLink E850-96 board (DT) [ 22.643699] Call trace: [ 22.643713] show_stack+0x20/0x38 (C) [ 22.643750] dump_stack_lvl+0x8c/0xd0 [ 22.643786] print_report+0x118/0x608 [ 22.643824] kasan_report+0xdc/0x128 [ 22.643857] __asan_report_store1_noabort+0x20/0x30 [ 22.643889] krealloc_less_oob_helper+0xa48/0xc50 [ 22.643922] krealloc_less_oob+0x20/0x38 [ 22.643950] kunit_try_run_case+0x170/0x3f0 [ 22.643988] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.644026] kthread+0x328/0x630 [ 22.644058] ret_from_fork+0x10/0x20 [ 22.644096] [ 22.710960] Allocated by task 205: [ 22.714347] kasan_save_stack+0x3c/0x68 [ 22.718164] kasan_save_track+0x20/0x40 [ 22.721985] kasan_save_alloc_info+0x40/0x58 [ 22.726237] __kasan_krealloc+0x118/0x178 [ 22.730230] krealloc_noprof+0x128/0x360 [ 22.734136] krealloc_less_oob_helper+0x168/0xc50 [ 22.738824] krealloc_less_oob+0x20/0x38 [ 22.742730] kunit_try_run_case+0x170/0x3f0 [ 22.746896] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.752365] kthread+0x328/0x630 [ 22.755578] ret_from_fork+0x10/0x20 [ 22.759135] [ 22.760614] The buggy address belongs to the object at ffff0008032a0800 [ 22.760614] which belongs to the cache kmalloc-256 of size 256 [ 22.773113] The buggy address is located 0 bytes to the right of [ 22.773113] allocated 201-byte region [ffff0008032a0800, ffff0008032a08c9) [ 22.786046] [ 22.787523] The buggy address belongs to the physical page: [ 22.793081] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a0 [ 22.801065] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.808702] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 22.815648] page_type: f5(slab) [ 22.818784] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 22.826503] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 22.834232] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 22.842042] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 22.849853] head: 0bfffe0000000002 fffffdffe00ca801 00000000ffffffff 00000000ffffffff [ 22.857665] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 22.865471] page dumped because: kasan: bad access detected [ 22.871026] [ 22.872502] Memory state around the buggy address: [ 22.877285] ffff0008032a0780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.884485] ffff0008032a0800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.891689] >ffff0008032a0880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 22.898890] ^ [ 22.904449] ffff0008032a0900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.911654] ffff0008032a0980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.918858] ================================================================== [ 24.855166] ================================================================== [ 24.862060] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 24.869608] Write of size 1 at addr ffff0008032a60d0 by task kunit_try_catch/209 [ 24.876986] [ 24.878470] CPU: 5 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 24.878526] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.878543] Hardware name: WinLink E850-96 board (DT) [ 24.878565] Call trace: [ 24.878578] show_stack+0x20/0x38 (C) [ 24.878612] dump_stack_lvl+0x8c/0xd0 [ 24.878649] print_report+0x118/0x608 [ 24.878682] kasan_report+0xdc/0x128 [ 24.878715] __asan_report_store1_noabort+0x20/0x30 [ 24.878750] krealloc_less_oob_helper+0xb9c/0xc50 [ 24.878783] krealloc_large_less_oob+0x20/0x38 [ 24.878813] kunit_try_run_case+0x170/0x3f0 [ 24.878848] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.878888] kthread+0x328/0x630 [ 24.878918] ret_from_fork+0x10/0x20 [ 24.878952] [ 24.946344] The buggy address belongs to the physical page: [ 24.951900] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a4 [ 24.959887] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.967524] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.974467] page_type: f8(unknown) [ 24.977865] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.985585] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.993311] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.001122] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.008936] head: 0bfffe0000000002 fffffdffe00ca901 00000000ffffffff 00000000ffffffff [ 25.016747] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.024553] page dumped because: kasan: bad access detected [ 25.030108] [ 25.031584] Memory state around the buggy address: [ 25.036365] ffff0008032a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.043567] ffff0008032a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.050772] >ffff0008032a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.057972] ^ [ 25.063792] ffff0008032a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.070997] ffff0008032a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.078198] ================================================================== [ 23.232510] ================================================================== [ 23.239599] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 23.247149] Write of size 1 at addr ffff0008032a08da by task kunit_try_catch/205 [ 23.254529] [ 23.256013] CPU: 5 UID: 0 PID: 205 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 23.256067] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.256083] Hardware name: WinLink E850-96 board (DT) [ 23.256102] Call trace: [ 23.256115] show_stack+0x20/0x38 (C) [ 23.256150] dump_stack_lvl+0x8c/0xd0 [ 23.256185] print_report+0x118/0x608 [ 23.256219] kasan_report+0xdc/0x128 [ 23.256251] __asan_report_store1_noabort+0x20/0x30 [ 23.256283] krealloc_less_oob_helper+0xa80/0xc50 [ 23.256315] krealloc_less_oob+0x20/0x38 [ 23.256344] kunit_try_run_case+0x170/0x3f0 [ 23.256380] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.256419] kthread+0x328/0x630 [ 23.256448] ret_from_fork+0x10/0x20 [ 23.256480] [ 23.323363] Allocated by task 205: [ 23.326750] kasan_save_stack+0x3c/0x68 [ 23.330569] kasan_save_track+0x20/0x40 [ 23.334387] kasan_save_alloc_info+0x40/0x58 [ 23.338641] __kasan_krealloc+0x118/0x178 [ 23.342634] krealloc_noprof+0x128/0x360 [ 23.346540] krealloc_less_oob_helper+0x168/0xc50 [ 23.351227] krealloc_less_oob+0x20/0x38 [ 23.355133] kunit_try_run_case+0x170/0x3f0 [ 23.359302] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.364769] kthread+0x328/0x630 [ 23.367981] ret_from_fork+0x10/0x20 [ 23.371539] [ 23.373017] The buggy address belongs to the object at ffff0008032a0800 [ 23.373017] which belongs to the cache kmalloc-256 of size 256 [ 23.385517] The buggy address is located 17 bytes to the right of [ 23.385517] allocated 201-byte region [ffff0008032a0800, ffff0008032a08c9) [ 23.398535] [ 23.400013] The buggy address belongs to the physical page: [ 23.405573] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a0 [ 23.413556] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.421193] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 23.428137] page_type: f5(slab) [ 23.431272] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 23.438995] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 23.446720] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 23.454531] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 23.462344] head: 0bfffe0000000002 fffffdffe00ca801 00000000ffffffff 00000000ffffffff [ 23.470156] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 23.477962] page dumped because: kasan: bad access detected [ 23.483517] [ 23.484992] Memory state around the buggy address: [ 23.489772] ffff0008032a0780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.496976] ffff0008032a0800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.504180] >ffff0008032a0880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 23.511381] ^ [ 23.517461] ffff0008032a0900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.524666] ffff0008032a0980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.531867] ================================================================== [ 23.539190] ================================================================== [ 23.546280] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 23.553829] Write of size 1 at addr ffff0008032a08ea by task kunit_try_catch/205 [ 23.561207] [ 23.562691] CPU: 5 UID: 0 PID: 205 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 23.562742] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.562756] Hardware name: WinLink E850-96 board (DT) [ 23.562774] Call trace: [ 23.562787] show_stack+0x20/0x38 (C) [ 23.562821] dump_stack_lvl+0x8c/0xd0 [ 23.562856] print_report+0x118/0x608 [ 23.562891] kasan_report+0xdc/0x128 [ 23.562923] __asan_report_store1_noabort+0x20/0x30 [ 23.562952] krealloc_less_oob_helper+0xae4/0xc50 [ 23.562984] krealloc_less_oob+0x20/0x38 [ 23.563013] kunit_try_run_case+0x170/0x3f0 [ 23.563046] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.563081] kthread+0x328/0x630 [ 23.563109] ret_from_fork+0x10/0x20 [ 23.563142] [ 23.630043] Allocated by task 205: [ 23.633428] kasan_save_stack+0x3c/0x68 [ 23.637249] kasan_save_track+0x20/0x40 [ 23.641068] kasan_save_alloc_info+0x40/0x58 [ 23.645320] __kasan_krealloc+0x118/0x178 [ 23.649313] krealloc_noprof+0x128/0x360 [ 23.653219] krealloc_less_oob_helper+0x168/0xc50 [ 23.657907] krealloc_less_oob+0x20/0x38 [ 23.661815] kunit_try_run_case+0x170/0x3f0 [ 23.665981] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 23.671448] kthread+0x328/0x630 [ 23.674660] ret_from_fork+0x10/0x20 [ 23.678219] [ 23.679696] The buggy address belongs to the object at ffff0008032a0800 [ 23.679696] which belongs to the cache kmalloc-256 of size 256 [ 23.692195] The buggy address is located 33 bytes to the right of [ 23.692195] allocated 201-byte region [ffff0008032a0800, ffff0008032a08c9) [ 23.705215] [ 23.706693] The buggy address belongs to the physical page: [ 23.712248] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a0 [ 23.720234] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.727874] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 23.734817] page_type: f5(slab) [ 23.737951] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 23.745673] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 23.753399] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 23.761211] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 23.769024] head: 0bfffe0000000002 fffffdffe00ca801 00000000ffffffff 00000000ffffffff [ 23.776835] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 23.784641] page dumped because: kasan: bad access detected [ 23.790196] [ 23.791672] Memory state around the buggy address: [ 23.796451] ffff0008032a0780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.803655] ffff0008032a0800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.810860] >ffff0008032a0880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 23.818061] ^ [ 23.824661] ffff0008032a0900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.831866] ffff0008032a0980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.839067] ================================================================== [ 24.621849] ================================================================== [ 24.631768] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 24.639317] Write of size 1 at addr ffff0008032a60c9 by task kunit_try_catch/209 [ 24.646696] [ 24.648179] CPU: 5 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 24.648234] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.648250] Hardware name: WinLink E850-96 board (DT) [ 24.648269] Call trace: [ 24.648283] show_stack+0x20/0x38 (C) [ 24.648320] dump_stack_lvl+0x8c/0xd0 [ 24.648356] print_report+0x118/0x608 [ 24.648393] kasan_report+0xdc/0x128 [ 24.648428] __asan_report_store1_noabort+0x20/0x30 [ 24.648459] krealloc_less_oob_helper+0xa48/0xc50 [ 24.648495] krealloc_large_less_oob+0x20/0x38 [ 24.648527] kunit_try_run_case+0x170/0x3f0 [ 24.648563] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.648600] kthread+0x328/0x630 [ 24.648631] ret_from_fork+0x10/0x20 [ 24.648665] [ 24.716054] The buggy address belongs to the physical page: [ 24.721609] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8832a4 [ 24.729595] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.737234] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.744176] page_type: f8(unknown) [ 24.747572] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.755294] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.763019] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.770831] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.778644] head: 0bfffe0000000002 fffffdffe00ca901 00000000ffffffff 00000000ffffffff [ 24.786456] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.794261] page dumped because: kasan: bad access detected [ 24.799817] [ 24.801292] Memory state around the buggy address: [ 24.806077] ffff0008032a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.813275] ffff0008032a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.820480] >ffff0008032a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 24.827680] ^ [ 24.833240] ffff0008032a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.840445] ffff0008032a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.847647] ==================================================================
[ 25.062020] ================================================================== [ 25.062113] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 25.062216] Write of size 1 at addr fff00000c64be0d0 by task kunit_try_catch/162 [ 25.062329] [ 25.062391] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.062575] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.062637] Hardware name: linux,dummy-virt (DT) [ 25.062709] Call trace: [ 25.062768] show_stack+0x20/0x38 (C) [ 25.063022] dump_stack_lvl+0x8c/0xd0 [ 25.063161] print_report+0x118/0x608 [ 25.063322] kasan_report+0xdc/0x128 [ 25.063463] __asan_report_store1_noabort+0x20/0x30 [ 25.063605] krealloc_less_oob_helper+0xb9c/0xc50 [ 25.063736] krealloc_large_less_oob+0x20/0x38 [ 25.064103] kunit_try_run_case+0x170/0x3f0 [ 25.064241] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.064379] kthread+0x328/0x630 [ 25.064503] ret_from_fork+0x10/0x20 [ 25.064719] [ 25.064768] The buggy address belongs to the physical page: [ 25.064889] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064bc [ 25.065040] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.065172] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.065311] page_type: f8(unknown) [ 25.065420] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.065676] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.065810] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.065927] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.066058] head: 0bfffe0000000002 ffffc1ffc3192f01 00000000ffffffff 00000000ffffffff [ 25.066175] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.066341] page dumped because: kasan: bad access detected [ 25.066452] [ 25.066541] Memory state around the buggy address: [ 25.066712] fff00000c64bdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.066818] fff00000c64be000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.066951] >fff00000c64be080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.067155] ^ [ 25.067344] fff00000c64be100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.067522] fff00000c64be180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.067753] ================================================================== [ 24.952291] ================================================================== [ 24.952388] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 24.952493] Write of size 1 at addr fff00000c178bcda by task kunit_try_catch/158 [ 24.952606] [ 24.952669] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 24.952851] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.952916] Hardware name: linux,dummy-virt (DT) [ 24.953520] Call trace: [ 24.953581] show_stack+0x20/0x38 (C) [ 24.953962] dump_stack_lvl+0x8c/0xd0 [ 24.954888] print_report+0x118/0x608 [ 24.955778] kasan_report+0xdc/0x128 [ 24.955915] __asan_report_store1_noabort+0x20/0x30 [ 24.956958] krealloc_less_oob_helper+0xa80/0xc50 [ 24.957778] krealloc_less_oob+0x20/0x38 [ 24.958116] kunit_try_run_case+0x170/0x3f0 [ 24.958961] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.959136] kthread+0x328/0x630 [ 24.959270] ret_from_fork+0x10/0x20 [ 24.959395] [ 24.959441] Allocated by task 158: [ 24.959578] kasan_save_stack+0x3c/0x68 [ 24.959818] kasan_save_track+0x20/0x40 [ 24.960684] kasan_save_alloc_info+0x40/0x58 [ 24.960828] __kasan_krealloc+0x118/0x178 [ 24.960925] krealloc_noprof+0x128/0x360 [ 24.961399] krealloc_less_oob_helper+0x168/0xc50 [ 24.961920] krealloc_less_oob+0x20/0x38 [ 24.962302] kunit_try_run_case+0x170/0x3f0 [ 24.962612] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.963092] kthread+0x328/0x630 [ 24.963206] ret_from_fork+0x10/0x20 [ 24.963311] [ 24.963363] The buggy address belongs to the object at fff00000c178bc00 [ 24.963363] which belongs to the cache kmalloc-256 of size 256 [ 24.963507] The buggy address is located 17 bytes to the right of [ 24.963507] allocated 201-byte region [fff00000c178bc00, fff00000c178bcc9) [ 24.963797] [ 24.964980] The buggy address belongs to the physical page: [ 24.965066] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10178a [ 24.965199] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.965375] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.965500] page_type: f5(slab) [ 24.965588] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.965705] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.965891] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.966047] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.966306] head: 0bfffe0000000001 ffffc1ffc305e281 00000000ffffffff 00000000ffffffff [ 24.966576] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.966675] page dumped because: kasan: bad access detected [ 24.966748] [ 24.966825] Memory state around the buggy address: [ 24.966993] fff00000c178bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.967113] fff00000c178bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.967250] >fff00000c178bc80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 24.967359] ^ [ 24.967461] fff00000c178bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.967579] fff00000c178bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.967750] ================================================================== [ 25.069635] ================================================================== [ 25.069731] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 25.069838] Write of size 1 at addr fff00000c64be0da by task kunit_try_catch/162 [ 25.070172] [ 25.070260] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.070469] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.070542] Hardware name: linux,dummy-virt (DT) [ 25.070730] Call trace: [ 25.070792] show_stack+0x20/0x38 (C) [ 25.070965] dump_stack_lvl+0x8c/0xd0 [ 25.071111] print_report+0x118/0x608 [ 25.071353] kasan_report+0xdc/0x128 [ 25.071600] __asan_report_store1_noabort+0x20/0x30 [ 25.071744] krealloc_less_oob_helper+0xa80/0xc50 [ 25.072215] krealloc_large_less_oob+0x20/0x38 [ 25.072699] kunit_try_run_case+0x170/0x3f0 [ 25.073430] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.073711] kthread+0x328/0x630 [ 25.074223] ret_from_fork+0x10/0x20 [ 25.074675] [ 25.074845] The buggy address belongs to the physical page: [ 25.075024] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064bc [ 25.075385] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.075517] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.075646] page_type: f8(unknown) [ 25.075738] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.075865] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.077244] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.077397] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.077790] head: 0bfffe0000000002 ffffc1ffc3192f01 00000000ffffffff 00000000ffffffff [ 25.078623] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.078727] page dumped because: kasan: bad access detected [ 25.079147] [ 25.079345] Memory state around the buggy address: [ 25.079422] fff00000c64bdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.080156] fff00000c64be000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.080276] >fff00000c64be080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.080377] ^ [ 25.080476] fff00000c64be100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.080590] fff00000c64be180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.081413] ================================================================== [ 24.969130] ================================================================== [ 24.969293] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 24.969530] Write of size 1 at addr fff00000c178bcea by task kunit_try_catch/158 [ 24.969734] [ 24.969821] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 24.970039] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.970283] Hardware name: linux,dummy-virt (DT) [ 24.970377] Call trace: [ 24.970580] show_stack+0x20/0x38 (C) [ 24.970769] dump_stack_lvl+0x8c/0xd0 [ 24.970909] print_report+0x118/0x608 [ 24.971055] kasan_report+0xdc/0x128 [ 24.971351] __asan_report_store1_noabort+0x20/0x30 [ 24.971515] krealloc_less_oob_helper+0xae4/0xc50 [ 24.971647] krealloc_less_oob+0x20/0x38 [ 24.971972] kunit_try_run_case+0x170/0x3f0 [ 24.972136] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.972367] kthread+0x328/0x630 [ 24.972551] ret_from_fork+0x10/0x20 [ 24.972829] [ 24.973114] Allocated by task 158: [ 24.973190] kasan_save_stack+0x3c/0x68 [ 24.973287] kasan_save_track+0x20/0x40 [ 24.974034] kasan_save_alloc_info+0x40/0x58 [ 24.974167] __kasan_krealloc+0x118/0x178 [ 24.974283] krealloc_noprof+0x128/0x360 [ 24.974389] krealloc_less_oob_helper+0x168/0xc50 [ 24.974919] krealloc_less_oob+0x20/0x38 [ 24.975140] kunit_try_run_case+0x170/0x3f0 [ 24.975252] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.975767] kthread+0x328/0x630 [ 24.975886] ret_from_fork+0x10/0x20 [ 24.976006] [ 24.976053] The buggy address belongs to the object at fff00000c178bc00 [ 24.976053] which belongs to the cache kmalloc-256 of size 256 [ 24.976515] The buggy address is located 33 bytes to the right of [ 24.976515] allocated 201-byte region [fff00000c178bc00, fff00000c178bcc9) [ 24.976670] [ 24.976716] The buggy address belongs to the physical page: [ 24.976784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10178a [ 24.976907] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.977285] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.977831] page_type: f5(slab) [ 24.977965] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.978106] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.978955] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.979256] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.979608] head: 0bfffe0000000001 ffffc1ffc305e281 00000000ffffffff 00000000ffffffff [ 24.979928] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.980218] page dumped because: kasan: bad access detected [ 24.980295] [ 24.980896] Memory state around the buggy address: [ 24.981051] fff00000c178bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.981251] fff00000c178bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.981593] >fff00000c178bc80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 24.981689] ^ [ 24.982059] fff00000c178bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.982320] fff00000c178bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.982611] ================================================================== [ 24.984804] ================================================================== [ 24.984903] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 24.985027] Write of size 1 at addr fff00000c178bceb by task kunit_try_catch/158 [ 24.985142] [ 24.985208] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 24.985393] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.985454] Hardware name: linux,dummy-virt (DT) [ 24.986234] Call trace: [ 24.986305] show_stack+0x20/0x38 (C) [ 24.986535] dump_stack_lvl+0x8c/0xd0 [ 24.986787] print_report+0x118/0x608 [ 24.987558] kasan_report+0xdc/0x128 [ 24.987774] __asan_report_store1_noabort+0x20/0x30 [ 24.988636] krealloc_less_oob_helper+0xa58/0xc50 [ 24.988820] krealloc_less_oob+0x20/0x38 [ 24.989387] kunit_try_run_case+0x170/0x3f0 [ 24.989621] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.990020] kthread+0x328/0x630 [ 24.990641] ret_from_fork+0x10/0x20 [ 24.991090] [ 24.991285] Allocated by task 158: [ 24.991362] kasan_save_stack+0x3c/0x68 [ 24.991664] kasan_save_track+0x20/0x40 [ 24.991800] kasan_save_alloc_info+0x40/0x58 [ 24.992097] __kasan_krealloc+0x118/0x178 [ 24.992231] krealloc_noprof+0x128/0x360 [ 24.992330] krealloc_less_oob_helper+0x168/0xc50 [ 24.992426] krealloc_less_oob+0x20/0x38 [ 24.992513] kunit_try_run_case+0x170/0x3f0 [ 24.992606] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.992712] kthread+0x328/0x630 [ 24.992792] ret_from_fork+0x10/0x20 [ 24.992877] [ 24.992922] The buggy address belongs to the object at fff00000c178bc00 [ 24.992922] which belongs to the cache kmalloc-256 of size 256 [ 24.993269] The buggy address is located 34 bytes to the right of [ 24.993269] allocated 201-byte region [fff00000c178bc00, fff00000c178bcc9) [ 24.993423] [ 24.993527] The buggy address belongs to the physical page: [ 24.993719] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10178a [ 24.993990] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.994121] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.994296] page_type: f5(slab) [ 24.994407] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.994544] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.994697] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.994916] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.995095] head: 0bfffe0000000001 ffffc1ffc305e281 00000000ffffffff 00000000ffffffff [ 24.995258] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.995668] page dumped because: kasan: bad access detected [ 24.995795] [ 24.996092] Memory state around the buggy address: [ 24.996651] fff00000c178bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.997283] fff00000c178bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.997744] >fff00000c178bc80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 24.997862] ^ [ 24.997972] fff00000c178bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.998074] fff00000c178bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.998164] ================================================================== [ 25.096187] ================================================================== [ 25.096913] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 25.097071] Write of size 1 at addr fff00000c64be0eb by task kunit_try_catch/162 [ 25.097366] [ 25.097448] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.097634] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.097696] Hardware name: linux,dummy-virt (DT) [ 25.097763] Call trace: [ 25.097810] show_stack+0x20/0x38 (C) [ 25.097948] dump_stack_lvl+0x8c/0xd0 [ 25.098070] print_report+0x118/0x608 [ 25.098190] kasan_report+0xdc/0x128 [ 25.098307] __asan_report_store1_noabort+0x20/0x30 [ 25.098424] krealloc_less_oob_helper+0xa58/0xc50 [ 25.098540] krealloc_large_less_oob+0x20/0x38 [ 25.098654] kunit_try_run_case+0x170/0x3f0 [ 25.098770] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.099959] kthread+0x328/0x630 [ 25.100094] ret_from_fork+0x10/0x20 [ 25.100222] [ 25.100276] The buggy address belongs to the physical page: [ 25.100351] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064bc [ 25.100478] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.100593] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.100709] page_type: f8(unknown) [ 25.100797] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.100913] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.101063] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.101198] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.101333] head: 0bfffe0000000002 ffffc1ffc3192f01 00000000ffffffff 00000000ffffffff [ 25.101461] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.101553] page dumped because: kasan: bad access detected [ 25.101624] [ 25.101667] Memory state around the buggy address: [ 25.101735] fff00000c64bdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.101838] fff00000c64be000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.101969] >fff00000c64be080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.102064] ^ [ 25.102157] fff00000c64be100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.102254] fff00000c64be180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.107203] ================================================================== [ 25.086124] ================================================================== [ 25.086325] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 25.086452] Write of size 1 at addr fff00000c64be0ea by task kunit_try_catch/162 [ 25.086583] [ 25.086650] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.087448] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.087658] Hardware name: linux,dummy-virt (DT) [ 25.087717] Call trace: [ 25.087744] show_stack+0x20/0x38 (C) [ 25.087814] dump_stack_lvl+0x8c/0xd0 [ 25.087878] print_report+0x118/0x608 [ 25.087972] kasan_report+0xdc/0x128 [ 25.088109] __asan_report_store1_noabort+0x20/0x30 [ 25.088200] krealloc_less_oob_helper+0xae4/0xc50 [ 25.088264] krealloc_large_less_oob+0x20/0x38 [ 25.088382] kunit_try_run_case+0x170/0x3f0 [ 25.088516] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.088659] kthread+0x328/0x630 [ 25.088860] ret_from_fork+0x10/0x20 [ 25.089147] [ 25.089202] The buggy address belongs to the physical page: [ 25.089330] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064bc [ 25.089568] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.089905] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.090106] page_type: f8(unknown) [ 25.090217] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.090510] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.090705] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.091009] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.091314] head: 0bfffe0000000002 ffffc1ffc3192f01 00000000ffffffff 00000000ffffffff [ 25.091474] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.091584] page dumped because: kasan: bad access detected [ 25.092005] [ 25.092051] Memory state around the buggy address: [ 25.092497] fff00000c64bdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.092656] fff00000c64be000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.092967] >fff00000c64be080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.093421] ^ [ 25.093576] fff00000c64be100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.094048] fff00000c64be180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.094169] ================================================================== [ 24.931803] ================================================================== [ 24.932533] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 24.933272] Write of size 1 at addr fff00000c178bcd0 by task kunit_try_catch/158 [ 24.933674] [ 24.933899] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 24.934797] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.935051] Hardware name: linux,dummy-virt (DT) [ 24.935127] Call trace: [ 24.935423] show_stack+0x20/0x38 (C) [ 24.935923] dump_stack_lvl+0x8c/0xd0 [ 24.936068] print_report+0x118/0x608 [ 24.936513] kasan_report+0xdc/0x128 [ 24.936921] __asan_report_store1_noabort+0x20/0x30 [ 24.937687] krealloc_less_oob_helper+0xb9c/0xc50 [ 24.938586] krealloc_less_oob+0x20/0x38 [ 24.939229] kunit_try_run_case+0x170/0x3f0 [ 24.939371] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.939512] kthread+0x328/0x630 [ 24.939784] ret_from_fork+0x10/0x20 [ 24.940101] [ 24.940236] Allocated by task 158: [ 24.940315] kasan_save_stack+0x3c/0x68 [ 24.940415] kasan_save_track+0x20/0x40 [ 24.940503] kasan_save_alloc_info+0x40/0x58 [ 24.940597] __kasan_krealloc+0x118/0x178 [ 24.940686] krealloc_noprof+0x128/0x360 [ 24.940860] krealloc_less_oob_helper+0x168/0xc50 [ 24.941154] krealloc_less_oob+0x20/0x38 [ 24.941270] kunit_try_run_case+0x170/0x3f0 [ 24.941922] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.942109] kthread+0x328/0x630 [ 24.942653] ret_from_fork+0x10/0x20 [ 24.942765] [ 24.942838] The buggy address belongs to the object at fff00000c178bc00 [ 24.942838] which belongs to the cache kmalloc-256 of size 256 [ 24.943003] The buggy address is located 7 bytes to the right of [ 24.943003] allocated 201-byte region [fff00000c178bc00, fff00000c178bcc9) [ 24.943646] [ 24.943699] The buggy address belongs to the physical page: [ 24.944009] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10178a [ 24.944167] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.944389] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.944965] page_type: f5(slab) [ 24.945062] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.945640] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.945797] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.946340] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.946759] head: 0bfffe0000000001 ffffc1ffc305e281 00000000ffffffff 00000000ffffffff [ 24.946980] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.947102] page dumped because: kasan: bad access detected [ 24.947713] [ 24.947769] Memory state around the buggy address: [ 24.947854] fff00000c178bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.948443] fff00000c178bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.949018] >fff00000c178bc80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 24.949246] ^ [ 24.949339] fff00000c178bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.950060] fff00000c178bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.950156] ================================================================== [ 25.053106] ================================================================== [ 25.053956] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 25.054214] Write of size 1 at addr fff00000c64be0c9 by task kunit_try_catch/162 [ 25.054772] [ 25.054879] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.055187] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.055300] Hardware name: linux,dummy-virt (DT) [ 25.055503] Call trace: [ 25.055735] show_stack+0x20/0x38 (C) [ 25.055896] dump_stack_lvl+0x8c/0xd0 [ 25.056044] print_report+0x118/0x608 [ 25.056174] kasan_report+0xdc/0x128 [ 25.056299] __asan_report_store1_noabort+0x20/0x30 [ 25.056473] krealloc_less_oob_helper+0xa48/0xc50 [ 25.056645] krealloc_large_less_oob+0x20/0x38 [ 25.056830] kunit_try_run_case+0x170/0x3f0 [ 25.057203] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.057381] kthread+0x328/0x630 [ 25.057653] ret_from_fork+0x10/0x20 [ 25.057806] [ 25.057922] The buggy address belongs to the physical page: [ 25.058020] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064bc [ 25.058166] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.058300] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.058445] page_type: f8(unknown) [ 25.058562] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.058698] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.058847] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.059177] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.059301] head: 0bfffe0000000002 ffffc1ffc3192f01 00000000ffffffff 00000000ffffffff [ 25.059420] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.059516] page dumped because: kasan: bad access detected [ 25.059592] [ 25.059642] Memory state around the buggy address: [ 25.059724] fff00000c64bdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.059832] fff00000c64be000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.059970] >fff00000c64be080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.060082] ^ [ 25.060182] fff00000c64be100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.060300] fff00000c64be180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.060470] ================================================================== [ 24.913397] ================================================================== [ 24.913516] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 24.913658] Write of size 1 at addr fff00000c178bcc9 by task kunit_try_catch/158 [ 24.913782] [ 24.913866] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 24.914078] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.914147] Hardware name: linux,dummy-virt (DT) [ 24.914228] Call trace: [ 24.914290] show_stack+0x20/0x38 (C) [ 24.914625] dump_stack_lvl+0x8c/0xd0 [ 24.914758] print_report+0x118/0x608 [ 24.914896] kasan_report+0xdc/0x128 [ 24.915037] __asan_report_store1_noabort+0x20/0x30 [ 24.915191] krealloc_less_oob_helper+0xa48/0xc50 [ 24.915444] krealloc_less_oob+0x20/0x38 [ 24.915589] kunit_try_run_case+0x170/0x3f0 [ 24.915724] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.915865] kthread+0x328/0x630 [ 24.916537] ret_from_fork+0x10/0x20 [ 24.917583] [ 24.917631] Allocated by task 158: [ 24.917702] kasan_save_stack+0x3c/0x68 [ 24.918610] kasan_save_track+0x20/0x40 [ 24.919091] kasan_save_alloc_info+0x40/0x58 [ 24.919356] __kasan_krealloc+0x118/0x178 [ 24.919672] krealloc_noprof+0x128/0x360 [ 24.919803] krealloc_less_oob_helper+0x168/0xc50 [ 24.919918] krealloc_less_oob+0x20/0x38 [ 24.920526] kunit_try_run_case+0x170/0x3f0 [ 24.921006] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.921150] kthread+0x328/0x630 [ 24.921276] ret_from_fork+0x10/0x20 [ 24.921372] [ 24.921811] The buggy address belongs to the object at fff00000c178bc00 [ 24.921811] which belongs to the cache kmalloc-256 of size 256 [ 24.921995] The buggy address is located 0 bytes to the right of [ 24.921995] allocated 201-byte region [fff00000c178bc00, fff00000c178bcc9) [ 24.922147] [ 24.922199] The buggy address belongs to the physical page: [ 24.922652] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10178a [ 24.923141] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.923552] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.923713] page_type: f5(slab) [ 24.923812] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.924392] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.924700] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 24.924839] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.925552] head: 0bfffe0000000001 ffffc1ffc305e281 00000000ffffffff 00000000ffffffff [ 24.925704] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 24.926038] page dumped because: kasan: bad access detected [ 24.926117] [ 24.926162] Memory state around the buggy address: [ 24.926234] fff00000c178bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.926745] fff00000c178bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.926884] >fff00000c178bc80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 24.927395] ^ [ 24.927776] fff00000c178bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.928267] fff00000c178bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.928629] ==================================================================
[ 25.188474] ================================================================== [ 25.188642] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 25.188783] Write of size 1 at addr fff00000c17ed4da by task kunit_try_catch/158 [ 25.188919] [ 25.188994] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.189243] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.189316] Hardware name: linux,dummy-virt (DT) [ 25.189431] Call trace: [ 25.189616] show_stack+0x20/0x38 (C) [ 25.189929] dump_stack_lvl+0x8c/0xd0 [ 25.190094] print_report+0x118/0x608 [ 25.190424] kasan_report+0xdc/0x128 [ 25.190623] __asan_report_store1_noabort+0x20/0x30 [ 25.190751] krealloc_less_oob_helper+0xa80/0xc50 [ 25.190948] krealloc_less_oob+0x20/0x38 [ 25.191289] kunit_try_run_case+0x170/0x3f0 [ 25.191412] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.191550] kthread+0x328/0x630 [ 25.191828] ret_from_fork+0x10/0x20 [ 25.192127] [ 25.192180] Allocated by task 158: [ 25.192259] kasan_save_stack+0x3c/0x68 [ 25.192372] kasan_save_track+0x20/0x40 [ 25.192472] kasan_save_alloc_info+0x40/0x58 [ 25.192573] __kasan_krealloc+0x118/0x178 [ 25.192667] krealloc_noprof+0x128/0x360 [ 25.192781] krealloc_less_oob_helper+0x168/0xc50 [ 25.192922] krealloc_less_oob+0x20/0x38 [ 25.193135] kunit_try_run_case+0x170/0x3f0 [ 25.193324] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.193446] kthread+0x328/0x630 [ 25.193604] ret_from_fork+0x10/0x20 [ 25.193815] [ 25.193879] The buggy address belongs to the object at fff00000c17ed400 [ 25.193879] which belongs to the cache kmalloc-256 of size 256 [ 25.194070] The buggy address is located 17 bytes to the right of [ 25.194070] allocated 201-byte region [fff00000c17ed400, fff00000c17ed4c9) [ 25.194273] [ 25.194326] The buggy address belongs to the physical page: [ 25.194397] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1017ec [ 25.194535] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.194740] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.195184] page_type: f5(slab) [ 25.195475] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.195925] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.196658] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.196868] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.197312] head: 0bfffe0000000001 ffffc1ffc305fb01 00000000ffffffff 00000000ffffffff [ 25.197442] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.197606] page dumped because: kasan: bad access detected [ 25.197686] [ 25.197728] Memory state around the buggy address: [ 25.197799] fff00000c17ed380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.197921] fff00000c17ed400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.198022] >fff00000c17ed480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 25.198140] ^ [ 25.198231] fff00000c17ed500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.198331] fff00000c17ed580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.198489] ================================================================== [ 25.155177] ================================================================== [ 25.155302] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 25.155427] Write of size 1 at addr fff00000c17ed4c9 by task kunit_try_catch/158 [ 25.155542] [ 25.157517] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.157855] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.158063] Hardware name: linux,dummy-virt (DT) [ 25.158177] Call trace: [ 25.158230] show_stack+0x20/0x38 (C) [ 25.158451] dump_stack_lvl+0x8c/0xd0 [ 25.158611] print_report+0x118/0x608 [ 25.158749] kasan_report+0xdc/0x128 [ 25.158947] __asan_report_store1_noabort+0x20/0x30 [ 25.159080] krealloc_less_oob_helper+0xa48/0xc50 [ 25.159207] krealloc_less_oob+0x20/0x38 [ 25.159333] kunit_try_run_case+0x170/0x3f0 [ 25.159534] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.159816] kthread+0x328/0x630 [ 25.160043] ret_from_fork+0x10/0x20 [ 25.160173] [ 25.160305] Allocated by task 158: [ 25.160377] kasan_save_stack+0x3c/0x68 [ 25.160471] kasan_save_track+0x20/0x40 [ 25.160601] kasan_save_alloc_info+0x40/0x58 [ 25.160701] __kasan_krealloc+0x118/0x178 [ 25.160973] krealloc_noprof+0x128/0x360 [ 25.161173] krealloc_less_oob_helper+0x168/0xc50 [ 25.161276] krealloc_less_oob+0x20/0x38 [ 25.161416] kunit_try_run_case+0x170/0x3f0 [ 25.161528] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.161647] kthread+0x328/0x630 [ 25.161788] ret_from_fork+0x10/0x20 [ 25.161990] [ 25.162078] The buggy address belongs to the object at fff00000c17ed400 [ 25.162078] which belongs to the cache kmalloc-256 of size 256 [ 25.162343] The buggy address is located 0 bytes to the right of [ 25.162343] allocated 201-byte region [fff00000c17ed400, fff00000c17ed4c9) [ 25.162635] [ 25.162690] The buggy address belongs to the physical page: [ 25.162796] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1017ec [ 25.162957] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.163287] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.163449] page_type: f5(slab) [ 25.163554] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.163673] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.163817] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.163973] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.164146] head: 0bfffe0000000001 ffffc1ffc305fb01 00000000ffffffff 00000000ffffffff [ 25.164312] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.164415] page dumped because: kasan: bad access detected [ 25.164496] [ 25.164584] Memory state around the buggy address: [ 25.164702] fff00000c17ed380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.164892] fff00000c17ed400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.165011] >fff00000c17ed480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 25.165157] ^ [ 25.165251] fff00000c17ed500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.165366] fff00000c17ed580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.165466] ================================================================== [ 25.314353] ================================================================== [ 25.314446] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 25.314571] Write of size 1 at addr fff00000c65020ea by task kunit_try_catch/162 [ 25.314688] [ 25.315137] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.315360] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.315424] Hardware name: linux,dummy-virt (DT) [ 25.315493] Call trace: [ 25.315540] show_stack+0x20/0x38 (C) [ 25.315655] dump_stack_lvl+0x8c/0xd0 [ 25.315771] print_report+0x118/0x608 [ 25.315918] kasan_report+0xdc/0x128 [ 25.316031] __asan_report_store1_noabort+0x20/0x30 [ 25.316147] krealloc_less_oob_helper+0xae4/0xc50 [ 25.316264] krealloc_large_less_oob+0x20/0x38 [ 25.316442] kunit_try_run_case+0x170/0x3f0 [ 25.316564] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.316692] kthread+0x328/0x630 [ 25.316799] ret_from_fork+0x10/0x20 [ 25.317264] [ 25.317425] The buggy address belongs to the physical page: [ 25.317507] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106500 [ 25.318818] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.318977] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.319113] page_type: f8(unknown) [ 25.319747] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.319895] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.320436] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.320806] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.321160] head: 0bfffe0000000002 ffffc1ffc3194001 00000000ffffffff 00000000ffffffff [ 25.321298] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.321399] page dumped because: kasan: bad access detected [ 25.321771] [ 25.321826] Memory state around the buggy address: [ 25.321928] fff00000c6501f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.322057] fff00000c6502000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.322250] >fff00000c6502080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.322750] ^ [ 25.323241] fff00000c6502100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.323377] fff00000c6502180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.323496] ================================================================== [ 25.294335] ================================================================== [ 25.294428] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 25.294543] Write of size 1 at addr fff00000c65020d0 by task kunit_try_catch/162 [ 25.294656] [ 25.294722] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.294923] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.294984] Hardware name: linux,dummy-virt (DT) [ 25.295049] Call trace: [ 25.295094] show_stack+0x20/0x38 (C) [ 25.295211] dump_stack_lvl+0x8c/0xd0 [ 25.295323] print_report+0x118/0x608 [ 25.295438] kasan_report+0xdc/0x128 [ 25.295556] __asan_report_store1_noabort+0x20/0x30 [ 25.295685] krealloc_less_oob_helper+0xb9c/0xc50 [ 25.299002] krealloc_large_less_oob+0x20/0x38 [ 25.299134] kunit_try_run_case+0x170/0x3f0 [ 25.299248] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.299372] kthread+0x328/0x630 [ 25.299472] ret_from_fork+0x10/0x20 [ 25.299581] [ 25.299625] The buggy address belongs to the physical page: [ 25.299695] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106500 [ 25.299828] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.299958] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.300089] page_type: f8(unknown) [ 25.300191] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.300314] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.300442] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.300563] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.300686] head: 0bfffe0000000002 ffffc1ffc3194001 00000000ffffffff 00000000ffffffff [ 25.300805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.303229] page dumped because: kasan: bad access detected [ 25.303320] [ 25.303385] Memory state around the buggy address: [ 25.303469] fff00000c6501f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.303682] fff00000c6502000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.303932] >fff00000c6502080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.304163] ^ [ 25.304353] fff00000c6502100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.304518] fff00000c6502180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.304611] ================================================================== [ 25.305745] ================================================================== [ 25.305876] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 25.306158] Write of size 1 at addr fff00000c65020da by task kunit_try_catch/162 [ 25.306278] [ 25.306341] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.306531] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.306624] Hardware name: linux,dummy-virt (DT) [ 25.306739] Call trace: [ 25.306801] show_stack+0x20/0x38 (C) [ 25.306974] dump_stack_lvl+0x8c/0xd0 [ 25.307107] print_report+0x118/0x608 [ 25.307242] kasan_report+0xdc/0x128 [ 25.307364] __asan_report_store1_noabort+0x20/0x30 [ 25.307659] krealloc_less_oob_helper+0xa80/0xc50 [ 25.307963] krealloc_large_less_oob+0x20/0x38 [ 25.308099] kunit_try_run_case+0x170/0x3f0 [ 25.308222] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.308349] kthread+0x328/0x630 [ 25.308466] ret_from_fork+0x10/0x20 [ 25.308679] [ 25.308766] The buggy address belongs to the physical page: [ 25.308934] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106500 [ 25.309076] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.309198] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.309332] page_type: f8(unknown) [ 25.309436] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.309569] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.309694] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.309810] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.310358] head: 0bfffe0000000002 ffffc1ffc3194001 00000000ffffffff 00000000ffffffff [ 25.311050] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.311175] page dumped because: kasan: bad access detected [ 25.311294] [ 25.311342] Memory state around the buggy address: [ 25.311417] fff00000c6501f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.311547] fff00000c6502000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.311679] >fff00000c6502080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.311879] ^ [ 25.311986] fff00000c6502100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.312104] fff00000c6502180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.312193] ================================================================== [ 25.214527] ================================================================== [ 25.214619] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 25.214735] Write of size 1 at addr fff00000c17ed4eb by task kunit_try_catch/158 [ 25.215135] [ 25.215313] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.215563] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.215625] Hardware name: linux,dummy-virt (DT) [ 25.215695] Call trace: [ 25.215753] show_stack+0x20/0x38 (C) [ 25.216530] dump_stack_lvl+0x8c/0xd0 [ 25.217236] print_report+0x118/0x608 [ 25.217450] kasan_report+0xdc/0x128 [ 25.217595] __asan_report_store1_noabort+0x20/0x30 [ 25.217770] krealloc_less_oob_helper+0xa58/0xc50 [ 25.217982] krealloc_less_oob+0x20/0x38 [ 25.218177] kunit_try_run_case+0x170/0x3f0 [ 25.218637] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.218797] kthread+0x328/0x630 [ 25.218951] ret_from_fork+0x10/0x20 [ 25.219090] [ 25.219144] Allocated by task 158: [ 25.219222] kasan_save_stack+0x3c/0x68 [ 25.220138] kasan_save_track+0x20/0x40 [ 25.220256] kasan_save_alloc_info+0x40/0x58 [ 25.220366] __kasan_krealloc+0x118/0x178 [ 25.220513] krealloc_noprof+0x128/0x360 [ 25.220774] krealloc_less_oob_helper+0x168/0xc50 [ 25.221353] krealloc_less_oob+0x20/0x38 [ 25.221467] kunit_try_run_case+0x170/0x3f0 [ 25.221720] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.221830] kthread+0x328/0x630 [ 25.222238] ret_from_fork+0x10/0x20 [ 25.222381] [ 25.222517] The buggy address belongs to the object at fff00000c17ed400 [ 25.222517] which belongs to the cache kmalloc-256 of size 256 [ 25.223129] The buggy address is located 34 bytes to the right of [ 25.223129] allocated 201-byte region [fff00000c17ed400, fff00000c17ed4c9) [ 25.223286] [ 25.223335] The buggy address belongs to the physical page: [ 25.223407] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1017ec [ 25.224398] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.224892] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.225393] page_type: f5(slab) [ 25.225496] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.225876] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.226938] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.227066] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.227186] head: 0bfffe0000000001 ffffc1ffc305fb01 00000000ffffffff 00000000ffffffff [ 25.228221] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.228357] page dumped because: kasan: bad access detected [ 25.228722] [ 25.228801] Memory state around the buggy address: [ 25.228894] fff00000c17ed380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.228997] fff00000c17ed400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.229115] >fff00000c17ed480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 25.229981] ^ [ 25.230123] fff00000c17ed500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.230242] fff00000c17ed580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.230411] ================================================================== [ 25.283273] ================================================================== [ 25.283383] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 25.283492] Write of size 1 at addr fff00000c65020c9 by task kunit_try_catch/162 [ 25.283608] [ 25.284212] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.284625] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.284704] Hardware name: linux,dummy-virt (DT) [ 25.284910] Call trace: [ 25.285050] show_stack+0x20/0x38 (C) [ 25.285185] dump_stack_lvl+0x8c/0xd0 [ 25.285303] print_report+0x118/0x608 [ 25.285416] kasan_report+0xdc/0x128 [ 25.285526] __asan_report_store1_noabort+0x20/0x30 [ 25.285643] krealloc_less_oob_helper+0xa48/0xc50 [ 25.285764] krealloc_large_less_oob+0x20/0x38 [ 25.285906] kunit_try_run_case+0x170/0x3f0 [ 25.286427] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.286588] kthread+0x328/0x630 [ 25.287263] ret_from_fork+0x10/0x20 [ 25.287859] [ 25.288150] The buggy address belongs to the physical page: [ 25.288275] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106500 [ 25.288530] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.288814] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.289013] page_type: f8(unknown) [ 25.289115] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.289234] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.289353] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.289485] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.289613] head: 0bfffe0000000002 ffffc1ffc3194001 00000000ffffffff 00000000ffffffff [ 25.289732] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.289827] page dumped because: kasan: bad access detected [ 25.289926] [ 25.289970] Memory state around the buggy address: [ 25.290043] fff00000c6501f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.290144] fff00000c6502000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.290251] >fff00000c6502080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.290349] ^ [ 25.290440] fff00000c6502100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.290548] fff00000c6502180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.290643] ================================================================== [ 25.166739] ================================================================== [ 25.166829] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 25.166984] Write of size 1 at addr fff00000c17ed4d0 by task kunit_try_catch/158 [ 25.167157] [ 25.167234] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.167445] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.167557] Hardware name: linux,dummy-virt (DT) [ 25.167673] Call trace: [ 25.167737] show_stack+0x20/0x38 (C) [ 25.167900] dump_stack_lvl+0x8c/0xd0 [ 25.168091] print_report+0x118/0x608 [ 25.168362] kasan_report+0xdc/0x128 [ 25.168645] __asan_report_store1_noabort+0x20/0x30 [ 25.168792] krealloc_less_oob_helper+0xb9c/0xc50 [ 25.168934] krealloc_less_oob+0x20/0x38 [ 25.171156] kunit_try_run_case+0x170/0x3f0 [ 25.171314] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.171691] kthread+0x328/0x630 [ 25.172229] ret_from_fork+0x10/0x20 [ 25.172348] [ 25.172392] Allocated by task 158: [ 25.172465] kasan_save_stack+0x3c/0x68 [ 25.172568] kasan_save_track+0x20/0x40 [ 25.174522] kasan_save_alloc_info+0x40/0x58 [ 25.174664] __kasan_krealloc+0x118/0x178 [ 25.175411] krealloc_noprof+0x128/0x360 [ 25.175989] krealloc_less_oob_helper+0x168/0xc50 [ 25.176538] krealloc_less_oob+0x20/0x38 [ 25.177522] kunit_try_run_case+0x170/0x3f0 [ 25.177661] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.177872] kthread+0x328/0x630 [ 25.178458] ret_from_fork+0x10/0x20 [ 25.178588] [ 25.178730] The buggy address belongs to the object at fff00000c17ed400 [ 25.178730] which belongs to the cache kmalloc-256 of size 256 [ 25.178961] The buggy address is located 7 bytes to the right of [ 25.178961] allocated 201-byte region [fff00000c17ed400, fff00000c17ed4c9) [ 25.179349] [ 25.179774] The buggy address belongs to the physical page: [ 25.180040] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1017ec [ 25.180279] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.180700] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.181378] page_type: f5(slab) [ 25.181491] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.181758] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.182255] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.182412] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.183292] head: 0bfffe0000000001 ffffc1ffc305fb01 00000000ffffffff 00000000ffffffff [ 25.183756] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.183960] page dumped because: kasan: bad access detected [ 25.184035] [ 25.184078] Memory state around the buggy address: [ 25.184647] fff00000c17ed380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.184753] fff00000c17ed400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.185278] >fff00000c17ed480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 25.185454] ^ [ 25.185559] fff00000c17ed500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.185675] fff00000c17ed580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.185866] ================================================================== [ 25.326452] ================================================================== [ 25.326562] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 25.326677] Write of size 1 at addr fff00000c65020eb by task kunit_try_catch/162 [ 25.326780] [ 25.326860] CPU: 0 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.327706] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.327791] Hardware name: linux,dummy-virt (DT) [ 25.327892] Call trace: [ 25.328215] show_stack+0x20/0x38 (C) [ 25.328469] dump_stack_lvl+0x8c/0xd0 [ 25.329053] print_report+0x118/0x608 [ 25.329889] kasan_report+0xdc/0x128 [ 25.330053] __asan_report_store1_noabort+0x20/0x30 [ 25.330709] krealloc_less_oob_helper+0xa58/0xc50 [ 25.331278] krealloc_large_less_oob+0x20/0x38 [ 25.331390] kunit_try_run_case+0x170/0x3f0 [ 25.331920] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.332442] kthread+0x328/0x630 [ 25.332590] ret_from_fork+0x10/0x20 [ 25.332707] [ 25.332754] The buggy address belongs to the physical page: [ 25.332825] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106500 [ 25.332967] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.333089] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.334144] page_type: f8(unknown) [ 25.334280] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.334422] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.334560] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.334693] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 25.334906] head: 0bfffe0000000002 ffffc1ffc3194001 00000000ffffffff 00000000ffffffff [ 25.335414] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.335581] page dumped because: kasan: bad access detected [ 25.336150] [ 25.336432] Memory state around the buggy address: [ 25.336562] fff00000c6501f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.336665] fff00000c6502000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.337237] >fff00000c6502080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 25.337347] ^ [ 25.337544] fff00000c6502100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.337718] fff00000c6502180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 25.338259] ================================================================== [ 25.199541] ================================================================== [ 25.199638] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 25.199740] Write of size 1 at addr fff00000c17ed4ea by task kunit_try_catch/158 [ 25.199892] [ 25.199954] CPU: 0 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 25.200573] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.200660] Hardware name: linux,dummy-virt (DT) [ 25.200742] Call trace: [ 25.200802] show_stack+0x20/0x38 (C) [ 25.200954] dump_stack_lvl+0x8c/0xd0 [ 25.201174] print_report+0x118/0x608 [ 25.201859] kasan_report+0xdc/0x128 [ 25.201989] __asan_report_store1_noabort+0x20/0x30 [ 25.202132] krealloc_less_oob_helper+0xae4/0xc50 [ 25.202351] krealloc_less_oob+0x20/0x38 [ 25.202519] kunit_try_run_case+0x170/0x3f0 [ 25.202654] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.203147] kthread+0x328/0x630 [ 25.203365] ret_from_fork+0x10/0x20 [ 25.203489] [ 25.204094] Allocated by task 158: [ 25.204457] kasan_save_stack+0x3c/0x68 [ 25.204558] kasan_save_track+0x20/0x40 [ 25.204653] kasan_save_alloc_info+0x40/0x58 [ 25.204747] __kasan_krealloc+0x118/0x178 [ 25.205433] krealloc_noprof+0x128/0x360 [ 25.205825] krealloc_less_oob_helper+0x168/0xc50 [ 25.206060] krealloc_less_oob+0x20/0x38 [ 25.206178] kunit_try_run_case+0x170/0x3f0 [ 25.206272] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.206886] kthread+0x328/0x630 [ 25.206992] ret_from_fork+0x10/0x20 [ 25.207096] [ 25.207147] The buggy address belongs to the object at fff00000c17ed400 [ 25.207147] which belongs to the cache kmalloc-256 of size 256 [ 25.207786] The buggy address is located 33 bytes to the right of [ 25.207786] allocated 201-byte region [fff00000c17ed400, fff00000c17ed4c9) [ 25.208160] [ 25.208392] The buggy address belongs to the physical page: [ 25.208752] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1017ec [ 25.208892] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.209459] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 25.209673] page_type: f5(slab) [ 25.210046] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.210497] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.210640] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 25.210767] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.211185] head: 0bfffe0000000001 ffffc1ffc305fb01 00000000ffffffff 00000000ffffffff [ 25.211310] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 25.211421] page dumped because: kasan: bad access detected [ 25.211494] [ 25.211537] Memory state around the buggy address: [ 25.211607] fff00000c17ed380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.211707] fff00000c17ed400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.211816] >fff00000c17ed480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 25.211926] ^ [ 25.212084] fff00000c17ed500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.212189] fff00000c17ed580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.212310] ==================================================================
[ 18.516404] ================================================================== [ 18.517112] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe90/0x11d0 [ 18.518065] Write of size 1 at addr ffff888102a0a0ea by task kunit_try_catch/180 [ 18.518830] [ 18.519118] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.519282] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.519324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.519382] Call Trace: [ 18.519430] <TASK> [ 18.519482] dump_stack_lvl+0x73/0xb0 [ 18.519747] print_report+0xd1/0x650 [ 18.519829] ? __virt_addr_valid+0x1db/0x2d0 [ 18.519904] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 18.519980] ? kasan_addr_to_slab+0x11/0xa0 [ 18.520051] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 18.520126] kasan_report+0x141/0x180 [ 18.520201] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 18.520287] __asan_report_store1_noabort+0x1b/0x30 [ 18.520419] krealloc_less_oob_helper+0xe90/0x11d0 [ 18.520522] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.520736] ? finish_task_switch.isra.0+0x153/0x700 [ 18.520785] ? __switch_to+0x47/0xf50 [ 18.520824] ? __schedule+0x10cc/0x2b60 [ 18.520858] ? __pfx_read_tsc+0x10/0x10 [ 18.520892] krealloc_large_less_oob+0x1c/0x30 [ 18.520927] kunit_try_run_case+0x1a5/0x480 [ 18.520964] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.520997] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.521030] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.521062] ? __kthread_parkme+0x82/0x180 [ 18.521088] ? preempt_count_sub+0x50/0x80 [ 18.521119] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.521152] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.521184] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.521218] kthread+0x337/0x6f0 [ 18.521244] ? trace_preempt_on+0x20/0xc0 [ 18.521277] ? __pfx_kthread+0x10/0x10 [ 18.521328] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.521395] ? calculate_sigpending+0x7b/0xa0 [ 18.521430] ? __pfx_kthread+0x10/0x10 [ 18.521460] ret_from_fork+0x116/0x1d0 [ 18.521485] ? __pfx_kthread+0x10/0x10 [ 18.521553] ret_from_fork_asm+0x1a/0x30 [ 18.521689] </TASK> [ 18.521720] [ 18.542728] The buggy address belongs to the physical page: [ 18.544393] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a08 [ 18.545808] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.546913] flags: 0x200000000000040(head|node=0|zone=2) [ 18.547330] page_type: f8(unknown) [ 18.547722] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.549190] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.549887] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.550544] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.551074] head: 0200000000000002 ffffea00040a8201 00000000ffffffff 00000000ffffffff [ 18.552661] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.553438] page dumped because: kasan: bad access detected [ 18.555046] [ 18.555216] Memory state around the buggy address: [ 18.555599] ffff888102a09f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.556106] ffff888102a0a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.556910] >ffff888102a0a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 18.557385] ^ [ 18.558254] ffff888102a0a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.559351] ffff888102a0a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.559758] ================================================================== [ 18.023309] ================================================================== [ 18.024468] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe23/0x11d0 [ 18.025935] Write of size 1 at addr ffff8881003494d0 by task kunit_try_catch/176 [ 18.027260] [ 18.027834] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.027967] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.028006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.028066] Call Trace: [ 18.028571] <TASK> [ 18.028633] dump_stack_lvl+0x73/0xb0 [ 18.028751] print_report+0xd1/0x650 [ 18.028805] ? __virt_addr_valid+0x1db/0x2d0 [ 18.028846] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 18.028887] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.028922] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 18.028961] kasan_report+0x141/0x180 [ 18.028995] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 18.029040] __asan_report_store1_noabort+0x1b/0x30 [ 18.029080] krealloc_less_oob_helper+0xe23/0x11d0 [ 18.029120] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.029157] ? irqentry_exit+0x2a/0x60 [ 18.029192] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 18.029249] ? __pfx_krealloc_less_oob+0x10/0x10 [ 18.029327] krealloc_less_oob+0x1c/0x30 [ 18.029427] kunit_try_run_case+0x1a5/0x480 [ 18.029520] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.029582] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.029662] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.029722] ? __kthread_parkme+0x82/0x180 [ 18.029774] ? preempt_count_sub+0x50/0x80 [ 18.029831] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.029891] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.029952] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.030011] kthread+0x337/0x6f0 [ 18.030059] ? trace_preempt_on+0x20/0xc0 [ 18.030118] ? __pfx_kthread+0x10/0x10 [ 18.030168] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.030224] ? calculate_sigpending+0x7b/0xa0 [ 18.030284] ? __pfx_kthread+0x10/0x10 [ 18.030337] ret_from_fork+0x116/0x1d0 [ 18.030385] ? __pfx_kthread+0x10/0x10 [ 18.030438] ret_from_fork_asm+0x1a/0x30 [ 18.030529] </TASK> [ 18.030559] [ 18.056135] Allocated by task 176: [ 18.056749] kasan_save_stack+0x45/0x70 [ 18.057174] kasan_save_track+0x18/0x40 [ 18.057614] kasan_save_alloc_info+0x3b/0x50 [ 18.058049] __kasan_krealloc+0x190/0x1f0 [ 18.058370] krealloc_noprof+0xf3/0x340 [ 18.058791] krealloc_less_oob_helper+0x1aa/0x11d0 [ 18.059397] krealloc_less_oob+0x1c/0x30 [ 18.060620] kunit_try_run_case+0x1a5/0x480 [ 18.060970] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.062093] kthread+0x337/0x6f0 [ 18.063104] ret_from_fork+0x116/0x1d0 [ 18.063671] ret_from_fork_asm+0x1a/0x30 [ 18.064525] [ 18.064789] The buggy address belongs to the object at ffff888100349400 [ 18.064789] which belongs to the cache kmalloc-256 of size 256 [ 18.066410] The buggy address is located 7 bytes to the right of [ 18.066410] allocated 201-byte region [ffff888100349400, ffff8881003494c9) [ 18.070201] [ 18.070779] The buggy address belongs to the physical page: [ 18.072266] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100348 [ 18.073475] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.074064] flags: 0x200000000000040(head|node=0|zone=2) [ 18.074656] page_type: f5(slab) [ 18.075210] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.075856] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.076790] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.078929] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.079823] head: 0200000000000001 ffffea000400d201 00000000ffffffff 00000000ffffffff [ 18.081614] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.082368] page dumped because: kasan: bad access detected [ 18.083664] [ 18.084684] Memory state around the buggy address: [ 18.085489] ffff888100349380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.087217] ffff888100349400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.088374] >ffff888100349480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 18.089485] ^ [ 18.091266] ffff888100349500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.092825] ffff888100349580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.094282] ================================================================== [ 18.471494] ================================================================== [ 18.472310] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xec6/0x11d0 [ 18.474696] Write of size 1 at addr ffff888102a0a0da by task kunit_try_catch/180 [ 18.475558] [ 18.475922] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.476048] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.476087] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.476145] Call Trace: [ 18.476194] <TASK> [ 18.476305] dump_stack_lvl+0x73/0xb0 [ 18.476450] print_report+0xd1/0x650 [ 18.476592] ? __virt_addr_valid+0x1db/0x2d0 [ 18.476678] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 18.476720] ? kasan_addr_to_slab+0x11/0xa0 [ 18.476750] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 18.476784] kasan_report+0x141/0x180 [ 18.476816] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 18.476856] __asan_report_store1_noabort+0x1b/0x30 [ 18.476891] krealloc_less_oob_helper+0xec6/0x11d0 [ 18.476927] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.476961] ? finish_task_switch.isra.0+0x153/0x700 [ 18.476992] ? __switch_to+0x47/0xf50 [ 18.477027] ? __schedule+0x10cc/0x2b60 [ 18.477059] ? __pfx_read_tsc+0x10/0x10 [ 18.477092] krealloc_large_less_oob+0x1c/0x30 [ 18.477123] kunit_try_run_case+0x1a5/0x480 [ 18.477160] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.477193] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.477250] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.477301] ? __kthread_parkme+0x82/0x180 [ 18.477330] ? preempt_count_sub+0x50/0x80 [ 18.477368] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.477419] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.477454] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.477488] kthread+0x337/0x6f0 [ 18.477555] ? trace_preempt_on+0x20/0xc0 [ 18.477641] ? __pfx_kthread+0x10/0x10 [ 18.477702] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.477758] ? calculate_sigpending+0x7b/0xa0 [ 18.477814] ? __pfx_kthread+0x10/0x10 [ 18.477866] ret_from_fork+0x116/0x1d0 [ 18.477916] ? __pfx_kthread+0x10/0x10 [ 18.478006] ret_from_fork_asm+0x1a/0x30 [ 18.478106] </TASK> [ 18.478160] [ 18.497139] The buggy address belongs to the physical page: [ 18.497640] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a08 [ 18.499557] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.500280] flags: 0x200000000000040(head|node=0|zone=2) [ 18.501123] page_type: f8(unknown) [ 18.501435] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.502081] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.502953] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.504409] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.505474] head: 0200000000000002 ffffea00040a8201 00000000ffffffff 00000000ffffffff [ 18.506401] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.507280] page dumped because: kasan: bad access detected [ 18.508124] [ 18.508416] Memory state around the buggy address: [ 18.508872] ffff888102a09f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.510151] ffff888102a0a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.512031] >ffff888102a0a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 18.512781] ^ [ 18.513304] ffff888102a0a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.513879] ffff888102a0a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.514492] ================================================================== [ 17.965183] ================================================================== [ 17.966019] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd70/0x11d0 [ 17.967520] Write of size 1 at addr ffff8881003494c9 by task kunit_try_catch/176 [ 17.968231] [ 17.969154] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.969284] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.969580] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.969740] Call Trace: [ 17.969798] <TASK> [ 17.969854] dump_stack_lvl+0x73/0xb0 [ 17.969969] print_report+0xd1/0x650 [ 17.970011] ? __virt_addr_valid+0x1db/0x2d0 [ 17.970049] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.970087] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.970122] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.970160] kasan_report+0x141/0x180 [ 17.970193] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.970247] __asan_report_store1_noabort+0x1b/0x30 [ 17.970311] krealloc_less_oob_helper+0xd70/0x11d0 [ 17.970355] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.970392] ? irqentry_exit+0x2a/0x60 [ 17.970431] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 17.970474] ? __pfx_krealloc_less_oob+0x10/0x10 [ 17.970546] krealloc_less_oob+0x1c/0x30 [ 17.970651] kunit_try_run_case+0x1a5/0x480 [ 17.970722] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.970763] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.970802] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.970839] ? __kthread_parkme+0x82/0x180 [ 17.970871] ? preempt_count_sub+0x50/0x80 [ 17.970906] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.970943] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.970980] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.971018] kthread+0x337/0x6f0 [ 17.971048] ? trace_preempt_on+0x20/0xc0 [ 17.971086] ? __pfx_kthread+0x10/0x10 [ 17.971117] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.971151] ? calculate_sigpending+0x7b/0xa0 [ 17.971189] ? __pfx_kthread+0x10/0x10 [ 17.971221] ret_from_fork+0x116/0x1d0 [ 17.971277] ? __pfx_kthread+0x10/0x10 [ 17.971312] ret_from_fork_asm+0x1a/0x30 [ 17.971359] </TASK> [ 17.971377] [ 17.989230] Allocated by task 176: [ 17.989959] kasan_save_stack+0x45/0x70 [ 17.990463] kasan_save_track+0x18/0x40 [ 17.991043] kasan_save_alloc_info+0x3b/0x50 [ 17.991679] __kasan_krealloc+0x190/0x1f0 [ 17.992115] krealloc_noprof+0xf3/0x340 [ 17.992771] krealloc_less_oob_helper+0x1aa/0x11d0 [ 17.995598] krealloc_less_oob+0x1c/0x30 [ 17.996117] kunit_try_run_case+0x1a5/0x480 [ 17.996678] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.997702] kthread+0x337/0x6f0 [ 17.998165] ret_from_fork+0x116/0x1d0 [ 17.998819] ret_from_fork_asm+0x1a/0x30 [ 17.999348] [ 17.999780] The buggy address belongs to the object at ffff888100349400 [ 17.999780] which belongs to the cache kmalloc-256 of size 256 [ 18.001739] The buggy address is located 0 bytes to the right of [ 18.001739] allocated 201-byte region [ffff888100349400, ffff8881003494c9) [ 18.002703] [ 18.002965] The buggy address belongs to the physical page: [ 18.004044] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100348 [ 18.004929] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.005523] flags: 0x200000000000040(head|node=0|zone=2) [ 18.006207] page_type: f5(slab) [ 18.006898] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.008456] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.009145] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.010059] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.010937] head: 0200000000000001 ffffea000400d201 00000000ffffffff 00000000ffffffff [ 18.011687] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.012521] page dumped because: kasan: bad access detected [ 18.013483] [ 18.014060] Memory state around the buggy address: [ 18.015316] ffff888100349380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.015790] ffff888100349400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.017203] >ffff888100349480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 18.018579] ^ [ 18.019728] ffff888100349500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.021165] ffff888100349580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.022201] ================================================================== [ 18.416455] ================================================================== [ 18.417862] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe23/0x11d0 [ 18.418746] Write of size 1 at addr ffff888102a0a0d0 by task kunit_try_catch/180 [ 18.419815] [ 18.420811] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.420935] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.420967] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.421021] Call Trace: [ 18.421065] <TASK> [ 18.421106] dump_stack_lvl+0x73/0xb0 [ 18.421202] print_report+0xd1/0x650 [ 18.421274] ? __virt_addr_valid+0x1db/0x2d0 [ 18.421329] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 18.421366] ? kasan_addr_to_slab+0x11/0xa0 [ 18.421395] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 18.421431] kasan_report+0x141/0x180 [ 18.421463] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 18.421529] __asan_report_store1_noabort+0x1b/0x30 [ 18.421609] krealloc_less_oob_helper+0xe23/0x11d0 [ 18.421711] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.421787] ? finish_task_switch.isra.0+0x153/0x700 [ 18.421856] ? __switch_to+0x47/0xf50 [ 18.421943] ? __schedule+0x10cc/0x2b60 [ 18.422015] ? __pfx_read_tsc+0x10/0x10 [ 18.422090] krealloc_large_less_oob+0x1c/0x30 [ 18.422133] kunit_try_run_case+0x1a5/0x480 [ 18.422174] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.422211] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.422285] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.422323] ? __kthread_parkme+0x82/0x180 [ 18.422352] ? preempt_count_sub+0x50/0x80 [ 18.422383] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.422419] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.422452] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.422487] kthread+0x337/0x6f0 [ 18.422556] ? trace_preempt_on+0x20/0xc0 [ 18.422635] ? __pfx_kthread+0x10/0x10 [ 18.422693] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.422727] ? calculate_sigpending+0x7b/0xa0 [ 18.422761] ? __pfx_kthread+0x10/0x10 [ 18.422790] ret_from_fork+0x116/0x1d0 [ 18.422817] ? __pfx_kthread+0x10/0x10 [ 18.422846] ret_from_fork_asm+0x1a/0x30 [ 18.422886] </TASK> [ 18.422902] [ 18.452033] The buggy address belongs to the physical page: [ 18.453047] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a08 [ 18.454735] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.455637] flags: 0x200000000000040(head|node=0|zone=2) [ 18.456201] page_type: f8(unknown) [ 18.456782] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.457273] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.458135] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.458999] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.460210] head: 0200000000000002 ffffea00040a8201 00000000ffffffff 00000000ffffffff [ 18.461369] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.462362] page dumped because: kasan: bad access detected [ 18.462987] [ 18.463688] Memory state around the buggy address: [ 18.464746] ffff888102a09f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.466175] ffff888102a0a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.467050] >ffff888102a0a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 18.467731] ^ [ 18.468250] ffff888102a0a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.468904] ffff888102a0a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.469399] ================================================================== [ 18.096316] ================================================================== [ 18.098319] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xec6/0x11d0 [ 18.099826] Write of size 1 at addr ffff8881003494da by task kunit_try_catch/176 [ 18.100495] [ 18.101030] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.101165] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.101205] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.101263] Call Trace: [ 18.101313] <TASK> [ 18.101378] dump_stack_lvl+0x73/0xb0 [ 18.101460] print_report+0xd1/0x650 [ 18.101525] ? __virt_addr_valid+0x1db/0x2d0 [ 18.101615] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 18.101702] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.101767] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 18.101828] kasan_report+0x141/0x180 [ 18.101885] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 18.101957] __asan_report_store1_noabort+0x1b/0x30 [ 18.102022] krealloc_less_oob_helper+0xec6/0x11d0 [ 18.102090] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.102152] ? irqentry_exit+0x2a/0x60 [ 18.102215] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 18.102294] ? __pfx_krealloc_less_oob+0x10/0x10 [ 18.102366] krealloc_less_oob+0x1c/0x30 [ 18.102431] kunit_try_run_case+0x1a5/0x480 [ 18.102522] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.102600] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.102674] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.102716] ? __kthread_parkme+0x82/0x180 [ 18.102750] ? preempt_count_sub+0x50/0x80 [ 18.102784] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.102823] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.102861] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.102900] kthread+0x337/0x6f0 [ 18.102928] ? trace_preempt_on+0x20/0xc0 [ 18.102964] ? __pfx_kthread+0x10/0x10 [ 18.102994] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.103027] ? calculate_sigpending+0x7b/0xa0 [ 18.103063] ? __pfx_kthread+0x10/0x10 [ 18.103094] ret_from_fork+0x116/0x1d0 [ 18.103122] ? __pfx_kthread+0x10/0x10 [ 18.103157] ret_from_fork_asm+0x1a/0x30 [ 18.103206] </TASK> [ 18.103225] [ 18.121703] Allocated by task 176: [ 18.122447] kasan_save_stack+0x45/0x70 [ 18.123989] kasan_save_track+0x18/0x40 [ 18.124899] kasan_save_alloc_info+0x3b/0x50 [ 18.125248] __kasan_krealloc+0x190/0x1f0 [ 18.125677] krealloc_noprof+0xf3/0x340 [ 18.126371] krealloc_less_oob_helper+0x1aa/0x11d0 [ 18.127169] krealloc_less_oob+0x1c/0x30 [ 18.127657] kunit_try_run_case+0x1a5/0x480 [ 18.128768] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.129217] kthread+0x337/0x6f0 [ 18.129910] ret_from_fork+0x116/0x1d0 [ 18.130830] ret_from_fork_asm+0x1a/0x30 [ 18.131229] [ 18.132110] The buggy address belongs to the object at ffff888100349400 [ 18.132110] which belongs to the cache kmalloc-256 of size 256 [ 18.134372] The buggy address is located 17 bytes to the right of [ 18.134372] allocated 201-byte region [ffff888100349400, ffff8881003494c9) [ 18.135777] [ 18.136043] The buggy address belongs to the physical page: [ 18.136564] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100348 [ 18.137442] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.138359] flags: 0x200000000000040(head|node=0|zone=2) [ 18.138937] page_type: f5(slab) [ 18.139349] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.139987] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.141604] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.142650] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.143760] head: 0200000000000001 ffffea000400d201 00000000ffffffff 00000000ffffffff [ 18.144390] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.145658] page dumped because: kasan: bad access detected [ 18.146260] [ 18.146488] Memory state around the buggy address: [ 18.146974] ffff888100349380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.147776] ffff888100349400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.148276] >ffff888100349480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 18.149242] ^ [ 18.150020] ffff888100349500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.150903] ffff888100349580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.152113] ================================================================== [ 18.154156] ================================================================== [ 18.155972] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe90/0x11d0 [ 18.156918] Write of size 1 at addr ffff8881003494ea by task kunit_try_catch/176 [ 18.157559] [ 18.157858] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.158030] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.158072] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.158132] Call Trace: [ 18.158183] <TASK> [ 18.158281] dump_stack_lvl+0x73/0xb0 [ 18.158401] print_report+0xd1/0x650 [ 18.158484] ? __virt_addr_valid+0x1db/0x2d0 [ 18.158666] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 18.158744] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.158827] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 18.158905] kasan_report+0x141/0x180 [ 18.158983] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 18.159145] __asan_report_store1_noabort+0x1b/0x30 [ 18.159261] krealloc_less_oob_helper+0xe90/0x11d0 [ 18.159394] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.159464] ? irqentry_exit+0x2a/0x60 [ 18.159545] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 18.159616] ? __pfx_krealloc_less_oob+0x10/0x10 [ 18.159682] krealloc_less_oob+0x1c/0x30 [ 18.159742] kunit_try_run_case+0x1a5/0x480 [ 18.159807] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.159891] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.159957] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.160021] ? __kthread_parkme+0x82/0x180 [ 18.160079] ? preempt_count_sub+0x50/0x80 [ 18.160143] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.160210] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.160324] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.160395] kthread+0x337/0x6f0 [ 18.160450] ? trace_preempt_on+0x20/0xc0 [ 18.160570] ? __pfx_kthread+0x10/0x10 [ 18.160638] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.160702] ? calculate_sigpending+0x7b/0xa0 [ 18.160773] ? __pfx_kthread+0x10/0x10 [ 18.160836] ret_from_fork+0x116/0x1d0 [ 18.160896] ? __pfx_kthread+0x10/0x10 [ 18.160954] ret_from_fork_asm+0x1a/0x30 [ 18.161036] </TASK> [ 18.161067] [ 18.184117] Allocated by task 176: [ 18.184567] kasan_save_stack+0x45/0x70 [ 18.184988] kasan_save_track+0x18/0x40 [ 18.185413] kasan_save_alloc_info+0x3b/0x50 [ 18.185913] __kasan_krealloc+0x190/0x1f0 [ 18.186237] krealloc_noprof+0xf3/0x340 [ 18.186665] krealloc_less_oob_helper+0x1aa/0x11d0 [ 18.187405] krealloc_less_oob+0x1c/0x30 [ 18.187947] kunit_try_run_case+0x1a5/0x480 [ 18.188531] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.189268] kthread+0x337/0x6f0 [ 18.189753] ret_from_fork+0x116/0x1d0 [ 18.190177] ret_from_fork_asm+0x1a/0x30 [ 18.190699] [ 18.190945] The buggy address belongs to the object at ffff888100349400 [ 18.190945] which belongs to the cache kmalloc-256 of size 256 [ 18.192137] The buggy address is located 33 bytes to the right of [ 18.192137] allocated 201-byte region [ffff888100349400, ffff8881003494c9) [ 18.193052] [ 18.193296] The buggy address belongs to the physical page: [ 18.194076] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100348 [ 18.195048] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.195890] flags: 0x200000000000040(head|node=0|zone=2) [ 18.196450] page_type: f5(slab) [ 18.197644] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.198298] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.198893] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.199467] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.200118] head: 0200000000000001 ffffea000400d201 00000000ffffffff 00000000ffffffff [ 18.200880] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.201697] page dumped because: kasan: bad access detected [ 18.202179] [ 18.202464] Memory state around the buggy address: [ 18.203119] ffff888100349380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.203903] ffff888100349400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.204547] >ffff888100349480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 18.205206] ^ [ 18.205831] ffff888100349500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.206651] ffff888100349580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.207374] ================================================================== [ 18.209110] ================================================================== [ 18.210855] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd47/0x11d0 [ 18.211684] Write of size 1 at addr ffff8881003494eb by task kunit_try_catch/176 [ 18.212213] [ 18.212568] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.212971] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.213012] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.213069] Call Trace: [ 18.213114] <TASK> [ 18.213165] dump_stack_lvl+0x73/0xb0 [ 18.213266] print_report+0xd1/0x650 [ 18.213347] ? __virt_addr_valid+0x1db/0x2d0 [ 18.213477] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 18.213578] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.213689] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 18.213760] kasan_report+0x141/0x180 [ 18.213821] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 18.213895] __asan_report_store1_noabort+0x1b/0x30 [ 18.213964] krealloc_less_oob_helper+0xd47/0x11d0 [ 18.214035] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.214100] ? irqentry_exit+0x2a/0x60 [ 18.214163] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 18.214244] ? __pfx_krealloc_less_oob+0x10/0x10 [ 18.214319] krealloc_less_oob+0x1c/0x30 [ 18.214387] kunit_try_run_case+0x1a5/0x480 [ 18.214466] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.214552] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.214594] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.214631] ? __kthread_parkme+0x82/0x180 [ 18.214663] ? preempt_count_sub+0x50/0x80 [ 18.214696] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.214734] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.214771] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.214809] kthread+0x337/0x6f0 [ 18.214837] ? trace_preempt_on+0x20/0xc0 [ 18.214872] ? __pfx_kthread+0x10/0x10 [ 18.214903] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.214937] ? calculate_sigpending+0x7b/0xa0 [ 18.214973] ? __pfx_kthread+0x10/0x10 [ 18.215004] ret_from_fork+0x116/0x1d0 [ 18.215032] ? __pfx_kthread+0x10/0x10 [ 18.215062] ret_from_fork_asm+0x1a/0x30 [ 18.215107] </TASK> [ 18.215123] [ 18.231350] Allocated by task 176: [ 18.231768] kasan_save_stack+0x45/0x70 [ 18.232141] kasan_save_track+0x18/0x40 [ 18.232715] kasan_save_alloc_info+0x3b/0x50 [ 18.233382] __kasan_krealloc+0x190/0x1f0 [ 18.233849] krealloc_noprof+0xf3/0x340 [ 18.234236] krealloc_less_oob_helper+0x1aa/0x11d0 [ 18.234782] krealloc_less_oob+0x1c/0x30 [ 18.235106] kunit_try_run_case+0x1a5/0x480 [ 18.235445] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.236206] kthread+0x337/0x6f0 [ 18.236676] ret_from_fork+0x116/0x1d0 [ 18.237386] ret_from_fork_asm+0x1a/0x30 [ 18.237900] [ 18.238108] The buggy address belongs to the object at ffff888100349400 [ 18.238108] which belongs to the cache kmalloc-256 of size 256 [ 18.238948] The buggy address is located 34 bytes to the right of [ 18.238948] allocated 201-byte region [ffff888100349400, ffff8881003494c9) [ 18.240131] [ 18.240518] The buggy address belongs to the physical page: [ 18.240918] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100348 [ 18.241480] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.242341] flags: 0x200000000000040(head|node=0|zone=2) [ 18.243434] page_type: f5(slab) [ 18.244661] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.246584] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.247922] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 18.248193] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.248714] head: 0200000000000001 ffffea000400d201 00000000ffffffff 00000000ffffffff [ 18.250034] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 18.250889] page dumped because: kasan: bad access detected [ 18.251620] [ 18.251856] Memory state around the buggy address: [ 18.252828] ffff888100349380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.253591] ffff888100349400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.254353] >ffff888100349480: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 18.255066] ^ [ 18.255724] ffff888100349500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.255980] ffff888100349580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.256217] ================================================================== [ 18.366218] ================================================================== [ 18.367290] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd70/0x11d0 [ 18.368339] Write of size 1 at addr ffff888102a0a0c9 by task kunit_try_catch/180 [ 18.369059] [ 18.369434] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.369580] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.369642] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.369705] Call Trace: [ 18.369755] <TASK> [ 18.369807] dump_stack_lvl+0x73/0xb0 [ 18.370210] print_report+0xd1/0x650 [ 18.370462] ? __virt_addr_valid+0x1db/0x2d0 [ 18.370578] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 18.371039] ? kasan_addr_to_slab+0x11/0xa0 [ 18.371105] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 18.371166] kasan_report+0x141/0x180 [ 18.371226] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 18.371298] __asan_report_store1_noabort+0x1b/0x30 [ 18.371363] krealloc_less_oob_helper+0xd70/0x11d0 [ 18.371429] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.371493] ? finish_task_switch.isra.0+0x153/0x700 [ 18.371579] ? __switch_to+0x47/0xf50 [ 18.371837] ? __schedule+0x10cc/0x2b60 [ 18.371874] ? __pfx_read_tsc+0x10/0x10 [ 18.371911] krealloc_large_less_oob+0x1c/0x30 [ 18.371944] kunit_try_run_case+0x1a5/0x480 [ 18.371983] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.372016] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.372050] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.372083] ? __kthread_parkme+0x82/0x180 [ 18.372111] ? preempt_count_sub+0x50/0x80 [ 18.372142] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.372176] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.372209] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.372301] kthread+0x337/0x6f0 [ 18.372333] ? trace_preempt_on+0x20/0xc0 [ 18.372367] ? __pfx_kthread+0x10/0x10 [ 18.372396] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.372427] ? calculate_sigpending+0x7b/0xa0 [ 18.372461] ? __pfx_kthread+0x10/0x10 [ 18.372490] ret_from_fork+0x116/0x1d0 [ 18.372556] ? __pfx_kthread+0x10/0x10 [ 18.372625] ret_from_fork_asm+0x1a/0x30 [ 18.372704] </TASK> [ 18.372722] [ 18.395786] The buggy address belongs to the physical page: [ 18.396656] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a08 [ 18.398226] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.399458] flags: 0x200000000000040(head|node=0|zone=2) [ 18.400182] page_type: f8(unknown) [ 18.401191] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.401805] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.402608] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.403006] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.404866] head: 0200000000000002 ffffea00040a8201 00000000ffffffff 00000000ffffffff [ 18.406295] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.407247] page dumped because: kasan: bad access detected [ 18.408185] [ 18.408443] Memory state around the buggy address: [ 18.409213] ffff888102a09f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.410552] ffff888102a0a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.411585] >ffff888102a0a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 18.412345] ^ [ 18.413261] ffff888102a0a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.413853] ffff888102a0a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.414380] ================================================================== [ 18.560450] ================================================================== [ 18.560829] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd47/0x11d0 [ 18.561236] Write of size 1 at addr ffff888102a0a0eb by task kunit_try_catch/180 [ 18.563754] [ 18.563969] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 18.564091] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.564130] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.564188] Call Trace: [ 18.564360] <TASK> [ 18.564422] dump_stack_lvl+0x73/0xb0 [ 18.564677] print_report+0xd1/0x650 [ 18.564765] ? __virt_addr_valid+0x1db/0x2d0 [ 18.564862] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 18.564941] ? kasan_addr_to_slab+0x11/0xa0 [ 18.565014] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 18.565091] kasan_report+0x141/0x180 [ 18.565167] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 18.565252] __asan_report_store1_noabort+0x1b/0x30 [ 18.565332] krealloc_less_oob_helper+0xd47/0x11d0 [ 18.565413] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 18.565487] ? finish_task_switch.isra.0+0x153/0x700 [ 18.565723] ? __switch_to+0x47/0xf50 [ 18.565812] ? __schedule+0x10cc/0x2b60 [ 18.565887] ? __pfx_read_tsc+0x10/0x10 [ 18.565964] krealloc_large_less_oob+0x1c/0x30 [ 18.566037] kunit_try_run_case+0x1a5/0x480 [ 18.566116] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.566188] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.566296] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.566339] ? __kthread_parkme+0x82/0x180 [ 18.566370] ? preempt_count_sub+0x50/0x80 [ 18.566401] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.566437] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.566472] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.566534] kthread+0x337/0x6f0 [ 18.566630] ? trace_preempt_on+0x20/0xc0 [ 18.566703] ? __pfx_kthread+0x10/0x10 [ 18.566766] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.566826] ? calculate_sigpending+0x7b/0xa0 [ 18.566883] ? __pfx_kthread+0x10/0x10 [ 18.566938] ret_from_fork+0x116/0x1d0 [ 18.566995] ? __pfx_kthread+0x10/0x10 [ 18.567051] ret_from_fork_asm+0x1a/0x30 [ 18.567121] </TASK> [ 18.567150] [ 18.590584] The buggy address belongs to the physical page: [ 18.591159] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a08 [ 18.594311] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.595039] flags: 0x200000000000040(head|node=0|zone=2) [ 18.595805] page_type: f8(unknown) [ 18.596178] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.596786] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.597165] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.597596] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.597981] head: 0200000000000002 ffffea00040a8201 00000000ffffffff 00000000ffffffff [ 18.598456] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.599070] page dumped because: kasan: bad access detected [ 18.599722] [ 18.600098] Memory state around the buggy address: [ 18.601542] ffff888102a09f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.602731] ffff888102a0a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.603650] >ffff888102a0a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 18.604273] ^ [ 18.605518] ffff888102a0a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.606415] ffff888102a0a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 18.607112] ==================================================================
[ 17.558525] ================================================================== [ 17.559118] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xec6/0x11d0 [ 17.559822] Write of size 1 at addr ffff88810397a0da by task kunit_try_catch/180 [ 17.560445] [ 17.561038] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.561187] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.561225] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.561278] Call Trace: [ 17.561314] <TASK> [ 17.561353] dump_stack_lvl+0x73/0xb0 [ 17.561438] print_report+0xd1/0x650 [ 17.561514] ? __virt_addr_valid+0x1db/0x2d0 [ 17.561702] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 17.561821] ? kasan_addr_to_slab+0x11/0xa0 [ 17.561915] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 17.561995] kasan_report+0x141/0x180 [ 17.562073] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 17.562208] __asan_report_store1_noabort+0x1b/0x30 [ 17.562303] krealloc_less_oob_helper+0xec6/0x11d0 [ 17.562390] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.562505] ? finish_task_switch.isra.0+0x153/0x700 [ 17.562696] ? __switch_to+0x47/0xf50 [ 17.562782] ? __schedule+0x10cc/0x2b60 [ 17.562860] ? __pfx_read_tsc+0x10/0x10 [ 17.562996] krealloc_large_less_oob+0x1c/0x30 [ 17.563078] kunit_try_run_case+0x1a5/0x480 [ 17.563160] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.563235] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.563285] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.563321] ? __kthread_parkme+0x82/0x180 [ 17.563349] ? preempt_count_sub+0x50/0x80 [ 17.563380] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.563414] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.563447] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.563482] kthread+0x337/0x6f0 [ 17.563514] ? trace_preempt_on+0x20/0xc0 [ 17.563634] ? __pfx_kthread+0x10/0x10 [ 17.563672] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.563704] ? calculate_sigpending+0x7b/0xa0 [ 17.563738] ? __pfx_kthread+0x10/0x10 [ 17.563767] ret_from_fork+0x116/0x1d0 [ 17.563792] ? __pfx_kthread+0x10/0x10 [ 17.563820] ret_from_fork_asm+0x1a/0x30 [ 17.563860] </TASK> [ 17.563874] [ 17.586075] The buggy address belongs to the physical page: [ 17.586663] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103978 [ 17.587314] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.587947] flags: 0x200000000000040(head|node=0|zone=2) [ 17.588375] page_type: f8(unknown) [ 17.588772] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.589427] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.590311] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.591240] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.592101] head: 0200000000000002 ffffea00040e5e01 00000000ffffffff 00000000ffffffff [ 17.592744] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 17.593532] page dumped because: kasan: bad access detected [ 17.594380] [ 17.594586] Memory state around the buggy address: [ 17.595040] ffff888103979f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.595704] ffff88810397a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.596347] >ffff88810397a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 17.597008] ^ [ 17.597460] ffff88810397a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.598418] ffff88810397a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.599155] ================================================================== [ 17.193561] ================================================================== [ 17.194674] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xec6/0x11d0 [ 17.195259] Write of size 1 at addr ffff8881003518da by task kunit_try_catch/176 [ 17.196322] [ 17.196558] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.196662] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.196681] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.196710] Call Trace: [ 17.196723] <TASK> [ 17.196738] dump_stack_lvl+0x73/0xb0 [ 17.196796] print_report+0xd1/0x650 [ 17.196856] ? __virt_addr_valid+0x1db/0x2d0 [ 17.196929] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 17.197011] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.197083] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 17.197159] kasan_report+0x141/0x180 [ 17.197230] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 17.197318] __asan_report_store1_noabort+0x1b/0x30 [ 17.197396] krealloc_less_oob_helper+0xec6/0x11d0 [ 17.197455] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.197492] ? finish_task_switch.isra.0+0x153/0x700 [ 17.197525] ? __switch_to+0x47/0xf50 [ 17.197559] ? __schedule+0x10cc/0x2b60 [ 17.197590] ? __pfx_read_tsc+0x10/0x10 [ 17.197623] krealloc_less_oob+0x1c/0x30 [ 17.197652] kunit_try_run_case+0x1a5/0x480 [ 17.197686] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.197718] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.197750] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.197782] ? __kthread_parkme+0x82/0x180 [ 17.197808] ? preempt_count_sub+0x50/0x80 [ 17.197837] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.197871] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.197958] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.198018] kthread+0x337/0x6f0 [ 17.198056] ? trace_preempt_on+0x20/0xc0 [ 17.198088] ? __pfx_kthread+0x10/0x10 [ 17.198154] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.198187] ? calculate_sigpending+0x7b/0xa0 [ 17.198221] ? __pfx_kthread+0x10/0x10 [ 17.198250] ret_from_fork+0x116/0x1d0 [ 17.198289] ? __pfx_kthread+0x10/0x10 [ 17.198318] ret_from_fork_asm+0x1a/0x30 [ 17.198358] </TASK> [ 17.198373] [ 17.216018] Allocated by task 176: [ 17.216350] kasan_save_stack+0x45/0x70 [ 17.216672] kasan_save_track+0x18/0x40 [ 17.217189] kasan_save_alloc_info+0x3b/0x50 [ 17.217673] __kasan_krealloc+0x190/0x1f0 [ 17.218127] krealloc_noprof+0xf3/0x340 [ 17.218545] krealloc_less_oob_helper+0x1aa/0x11d0 [ 17.219147] krealloc_less_oob+0x1c/0x30 [ 17.219553] kunit_try_run_case+0x1a5/0x480 [ 17.220008] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.220581] kthread+0x337/0x6f0 [ 17.220867] ret_from_fork+0x116/0x1d0 [ 17.221248] ret_from_fork_asm+0x1a/0x30 [ 17.221698] [ 17.221978] The buggy address belongs to the object at ffff888100351800 [ 17.221978] which belongs to the cache kmalloc-256 of size 256 [ 17.223146] The buggy address is located 17 bytes to the right of [ 17.223146] allocated 201-byte region [ffff888100351800, ffff8881003518c9) [ 17.224012] [ 17.224335] The buggy address belongs to the physical page: [ 17.224832] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100350 [ 17.225547] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.226154] flags: 0x200000000000040(head|node=0|zone=2) [ 17.226649] page_type: f5(slab) [ 17.227068] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.227804] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.228561] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.229202] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.229755] head: 0200000000000001 ffffea000400d401 00000000ffffffff 00000000ffffffff [ 17.230493] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.231191] page dumped because: kasan: bad access detected [ 17.231654] [ 17.231838] Memory state around the buggy address: [ 17.232232] ffff888100351780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.232873] ffff888100351800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.233549] >ffff888100351880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 17.234283] ^ [ 17.234844] ffff888100351900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.235517] ffff888100351980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.236020] ================================================================== [ 17.289302] ================================================================== [ 17.290010] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd47/0x11d0 [ 17.291585] Write of size 1 at addr ffff8881003518eb by task kunit_try_catch/176 [ 17.292962] [ 17.293277] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.293376] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.293403] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.293449] Call Trace: [ 17.293481] <TASK> [ 17.293512] dump_stack_lvl+0x73/0xb0 [ 17.293576] print_report+0xd1/0x650 [ 17.293626] ? __virt_addr_valid+0x1db/0x2d0 [ 17.293681] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 17.293734] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.293789] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 17.293846] kasan_report+0x141/0x180 [ 17.293916] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 17.293986] __asan_report_store1_noabort+0x1b/0x30 [ 17.294041] krealloc_less_oob_helper+0xd47/0x11d0 [ 17.294100] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.294154] ? finish_task_switch.isra.0+0x153/0x700 [ 17.294203] ? __switch_to+0x47/0xf50 [ 17.294267] ? __schedule+0x10cc/0x2b60 [ 17.294323] ? __pfx_read_tsc+0x10/0x10 [ 17.294376] krealloc_less_oob+0x1c/0x30 [ 17.294425] kunit_try_run_case+0x1a5/0x480 [ 17.294483] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.294533] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.294587] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.294640] ? __kthread_parkme+0x82/0x180 [ 17.294684] ? preempt_count_sub+0x50/0x80 [ 17.294737] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.294790] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.294844] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.294919] kthread+0x337/0x6f0 [ 17.294990] ? trace_preempt_on+0x20/0xc0 [ 17.295067] ? __pfx_kthread+0x10/0x10 [ 17.295186] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.295284] ? calculate_sigpending+0x7b/0xa0 [ 17.295364] ? __pfx_kthread+0x10/0x10 [ 17.295485] ret_from_fork+0x116/0x1d0 [ 17.295541] ? __pfx_kthread+0x10/0x10 [ 17.295589] ret_from_fork_asm+0x1a/0x30 [ 17.295656] </TASK> [ 17.295681] [ 17.326452] Allocated by task 176: [ 17.326801] kasan_save_stack+0x45/0x70 [ 17.327331] kasan_save_track+0x18/0x40 [ 17.327908] kasan_save_alloc_info+0x3b/0x50 [ 17.329683] __kasan_krealloc+0x190/0x1f0 [ 17.330214] krealloc_noprof+0xf3/0x340 [ 17.331734] krealloc_less_oob_helper+0x1aa/0x11d0 [ 17.332139] krealloc_less_oob+0x1c/0x30 [ 17.332936] kunit_try_run_case+0x1a5/0x480 [ 17.334373] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.334926] kthread+0x337/0x6f0 [ 17.336410] ret_from_fork+0x116/0x1d0 [ 17.337648] ret_from_fork_asm+0x1a/0x30 [ 17.338246] [ 17.338524] The buggy address belongs to the object at ffff888100351800 [ 17.338524] which belongs to the cache kmalloc-256 of size 256 [ 17.340824] The buggy address is located 34 bytes to the right of [ 17.340824] allocated 201-byte region [ffff888100351800, ffff8881003518c9) [ 17.342810] [ 17.343066] The buggy address belongs to the physical page: [ 17.344654] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100350 [ 17.345341] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.346460] flags: 0x200000000000040(head|node=0|zone=2) [ 17.347314] page_type: f5(slab) [ 17.347674] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.349321] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.350432] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.351397] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.352203] head: 0200000000000001 ffffea000400d401 00000000ffffffff 00000000ffffffff [ 17.352835] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.354020] page dumped because: kasan: bad access detected [ 17.354539] [ 17.355375] Memory state around the buggy address: [ 17.356643] ffff888100351780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.357124] ffff888100351800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.357654] >ffff888100351880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 17.362747] ^ [ 17.365191] ffff888100351900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.369368] ffff888100351980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.370535] ================================================================== [ 17.600122] ================================================================== [ 17.600579] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe90/0x11d0 [ 17.601217] Write of size 1 at addr ffff88810397a0ea by task kunit_try_catch/180 [ 17.602282] [ 17.602490] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.602602] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.602637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.602689] Call Trace: [ 17.602727] <TASK> [ 17.602765] dump_stack_lvl+0x73/0xb0 [ 17.602851] print_report+0xd1/0x650 [ 17.602946] ? __virt_addr_valid+0x1db/0x2d0 [ 17.603021] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 17.603095] ? kasan_addr_to_slab+0x11/0xa0 [ 17.603169] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 17.603247] kasan_report+0x141/0x180 [ 17.603327] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 17.603416] __asan_report_store1_noabort+0x1b/0x30 [ 17.603499] krealloc_less_oob_helper+0xe90/0x11d0 [ 17.603589] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.603671] ? finish_task_switch.isra.0+0x153/0x700 [ 17.603746] ? __switch_to+0x47/0xf50 [ 17.603827] ? __schedule+0x10cc/0x2b60 [ 17.604014] ? __pfx_read_tsc+0x10/0x10 [ 17.604101] krealloc_large_less_oob+0x1c/0x30 [ 17.604181] kunit_try_run_case+0x1a5/0x480 [ 17.604259] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.604336] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.604412] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.604487] ? __kthread_parkme+0x82/0x180 [ 17.604660] ? preempt_count_sub+0x50/0x80 [ 17.604717] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.604756] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.604791] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.604825] kthread+0x337/0x6f0 [ 17.604852] ? trace_preempt_on+0x20/0xc0 [ 17.604910] ? __pfx_kthread+0x10/0x10 [ 17.604946] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.604979] ? calculate_sigpending+0x7b/0xa0 [ 17.605013] ? __pfx_kthread+0x10/0x10 [ 17.605042] ret_from_fork+0x116/0x1d0 [ 17.605068] ? __pfx_kthread+0x10/0x10 [ 17.605097] ret_from_fork_asm+0x1a/0x30 [ 17.605170] </TASK> [ 17.605185] [ 17.630076] The buggy address belongs to the physical page: [ 17.631896] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103978 [ 17.632366] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.632779] flags: 0x200000000000040(head|node=0|zone=2) [ 17.634482] page_type: f8(unknown) [ 17.635203] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.636225] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.637072] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.637821] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.638529] head: 0200000000000002 ffffea00040e5e01 00000000ffffffff 00000000ffffffff [ 17.639187] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 17.640480] page dumped because: kasan: bad access detected [ 17.640928] [ 17.641145] Memory state around the buggy address: [ 17.641516] ffff888103979f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.642203] ffff88810397a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.643135] >ffff88810397a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 17.643935] ^ [ 17.644665] ffff88810397a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.645311] ffff88810397a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.646080] ================================================================== [ 17.236907] ================================================================== [ 17.237381] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe90/0x11d0 [ 17.238035] Write of size 1 at addr ffff8881003518ea by task kunit_try_catch/176 [ 17.238560] [ 17.238810] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.239560] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.239599] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.239989] Call Trace: [ 17.240035] <TASK> [ 17.240076] dump_stack_lvl+0x73/0xb0 [ 17.240203] print_report+0xd1/0x650 [ 17.240277] ? __virt_addr_valid+0x1db/0x2d0 [ 17.240349] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 17.240424] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.240497] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 17.240576] kasan_report+0x141/0x180 [ 17.240652] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 17.240737] __asan_report_store1_noabort+0x1b/0x30 [ 17.240782] krealloc_less_oob_helper+0xe90/0x11d0 [ 17.240821] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.240857] ? finish_task_switch.isra.0+0x153/0x700 [ 17.240919] ? __switch_to+0x47/0xf50 [ 17.240957] ? __schedule+0x10cc/0x2b60 [ 17.240988] ? __pfx_read_tsc+0x10/0x10 [ 17.241020] krealloc_less_oob+0x1c/0x30 [ 17.241050] kunit_try_run_case+0x1a5/0x480 [ 17.241085] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.241165] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.241202] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.241236] ? __kthread_parkme+0x82/0x180 [ 17.241262] ? preempt_count_sub+0x50/0x80 [ 17.241294] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.241328] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.241361] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.241394] kthread+0x337/0x6f0 [ 17.241420] ? trace_preempt_on+0x20/0xc0 [ 17.241450] ? __pfx_kthread+0x10/0x10 [ 17.241478] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.241508] ? calculate_sigpending+0x7b/0xa0 [ 17.241540] ? __pfx_kthread+0x10/0x10 [ 17.241569] ret_from_fork+0x116/0x1d0 [ 17.241593] ? __pfx_kthread+0x10/0x10 [ 17.241621] ret_from_fork_asm+0x1a/0x30 [ 17.241660] </TASK> [ 17.241673] [ 17.261455] Allocated by task 176: [ 17.261823] kasan_save_stack+0x45/0x70 [ 17.262695] kasan_save_track+0x18/0x40 [ 17.263035] kasan_save_alloc_info+0x3b/0x50 [ 17.263750] __kasan_krealloc+0x190/0x1f0 [ 17.264661] krealloc_noprof+0xf3/0x340 [ 17.265033] krealloc_less_oob_helper+0x1aa/0x11d0 [ 17.265572] krealloc_less_oob+0x1c/0x30 [ 17.265913] kunit_try_run_case+0x1a5/0x480 [ 17.266359] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.266765] kthread+0x337/0x6f0 [ 17.268140] ret_from_fork+0x116/0x1d0 [ 17.268503] ret_from_fork_asm+0x1a/0x30 [ 17.269122] [ 17.269661] The buggy address belongs to the object at ffff888100351800 [ 17.269661] which belongs to the cache kmalloc-256 of size 256 [ 17.271045] The buggy address is located 33 bytes to the right of [ 17.271045] allocated 201-byte region [ffff888100351800, ffff8881003518c9) [ 17.271942] [ 17.272364] The buggy address belongs to the physical page: [ 17.272813] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100350 [ 17.273799] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.274294] flags: 0x200000000000040(head|node=0|zone=2) [ 17.275125] page_type: f5(slab) [ 17.275487] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.276493] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.277047] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.278431] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.279176] head: 0200000000000001 ffffea000400d401 00000000ffffffff 00000000ffffffff [ 17.280017] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.280870] page dumped because: kasan: bad access detected [ 17.281497] [ 17.281723] Memory state around the buggy address: [ 17.282599] ffff888100351780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.283259] ffff888100351800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.283770] >ffff888100351880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 17.284317] ^ [ 17.285336] ffff888100351900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.285821] ffff888100351980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.286597] ================================================================== [ 17.144790] ================================================================== [ 17.145546] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe23/0x11d0 [ 17.146201] Write of size 1 at addr ffff8881003518d0 by task kunit_try_catch/176 [ 17.146743] [ 17.146997] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.147379] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.147420] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.147480] Call Trace: [ 17.147514] <TASK> [ 17.147555] dump_stack_lvl+0x73/0xb0 [ 17.147641] print_report+0xd1/0x650 [ 17.147717] ? __virt_addr_valid+0x1db/0x2d0 [ 17.147792] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 17.147868] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.147964] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 17.148043] kasan_report+0x141/0x180 [ 17.148226] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 17.148315] __asan_report_store1_noabort+0x1b/0x30 [ 17.148392] krealloc_less_oob_helper+0xe23/0x11d0 [ 17.148472] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.148548] ? finish_task_switch.isra.0+0x153/0x700 [ 17.148600] ? __switch_to+0x47/0xf50 [ 17.148637] ? __schedule+0x10cc/0x2b60 [ 17.148669] ? __pfx_read_tsc+0x10/0x10 [ 17.148702] krealloc_less_oob+0x1c/0x30 [ 17.148733] kunit_try_run_case+0x1a5/0x480 [ 17.148769] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.148802] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.148833] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.148865] ? __kthread_parkme+0x82/0x180 [ 17.148920] ? preempt_count_sub+0x50/0x80 [ 17.148954] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.148989] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.149021] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.149054] kthread+0x337/0x6f0 [ 17.149081] ? trace_preempt_on+0x20/0xc0 [ 17.149160] ? __pfx_kthread+0x10/0x10 [ 17.149194] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.149226] ? calculate_sigpending+0x7b/0xa0 [ 17.149260] ? __pfx_kthread+0x10/0x10 [ 17.149289] ret_from_fork+0x116/0x1d0 [ 17.149313] ? __pfx_kthread+0x10/0x10 [ 17.149341] ret_from_fork_asm+0x1a/0x30 [ 17.149380] </TASK> [ 17.149393] [ 17.167964] Allocated by task 176: [ 17.168538] kasan_save_stack+0x45/0x70 [ 17.168856] kasan_save_track+0x18/0x40 [ 17.169490] kasan_save_alloc_info+0x3b/0x50 [ 17.169957] __kasan_krealloc+0x190/0x1f0 [ 17.170737] krealloc_noprof+0xf3/0x340 [ 17.171214] krealloc_less_oob_helper+0x1aa/0x11d0 [ 17.171642] krealloc_less_oob+0x1c/0x30 [ 17.172218] kunit_try_run_case+0x1a5/0x480 [ 17.172722] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.173491] kthread+0x337/0x6f0 [ 17.174100] ret_from_fork+0x116/0x1d0 [ 17.174570] ret_from_fork_asm+0x1a/0x30 [ 17.174948] [ 17.175192] The buggy address belongs to the object at ffff888100351800 [ 17.175192] which belongs to the cache kmalloc-256 of size 256 [ 17.176686] The buggy address is located 7 bytes to the right of [ 17.176686] allocated 201-byte region [ffff888100351800, ffff8881003518c9) [ 17.177810] [ 17.178353] The buggy address belongs to the physical page: [ 17.178837] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100350 [ 17.179949] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.180893] flags: 0x200000000000040(head|node=0|zone=2) [ 17.181381] page_type: f5(slab) [ 17.181915] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.182680] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.183318] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.184014] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.184614] head: 0200000000000001 ffffea000400d401 00000000ffffffff 00000000ffffffff [ 17.185204] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.185831] page dumped because: kasan: bad access detected [ 17.186588] [ 17.186803] Memory state around the buggy address: [ 17.187476] ffff888100351780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.187984] ffff888100351800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.188769] >ffff888100351880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 17.189606] ^ [ 17.190110] ffff888100351900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.191333] ffff888100351980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.191823] ================================================================== [ 17.088854] ================================================================== [ 17.090166] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd70/0x11d0 [ 17.091293] Write of size 1 at addr ffff8881003518c9 by task kunit_try_catch/176 [ 17.092396] [ 17.093235] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.093469] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.093529] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.093591] Call Trace: [ 17.093626] <TASK> [ 17.093671] dump_stack_lvl+0x73/0xb0 [ 17.093755] print_report+0xd1/0x650 [ 17.093821] ? __virt_addr_valid+0x1db/0x2d0 [ 17.093900] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.093964] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.094023] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.094083] kasan_report+0x141/0x180 [ 17.094163] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.094239] __asan_report_store1_noabort+0x1b/0x30 [ 17.094312] krealloc_less_oob_helper+0xd70/0x11d0 [ 17.094375] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.094441] ? finish_task_switch.isra.0+0x153/0x700 [ 17.094498] ? __switch_to+0x47/0xf50 [ 17.094565] ? __schedule+0x10cc/0x2b60 [ 17.094633] ? __pfx_read_tsc+0x10/0x10 [ 17.094703] krealloc_less_oob+0x1c/0x30 [ 17.094767] kunit_try_run_case+0x1a5/0x480 [ 17.094844] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.094943] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.095010] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.095071] ? __kthread_parkme+0x82/0x180 [ 17.095135] ? preempt_count_sub+0x50/0x80 [ 17.095216] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.095276] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.095340] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.095397] kthread+0x337/0x6f0 [ 17.095446] ? trace_preempt_on+0x20/0xc0 [ 17.095502] ? __pfx_kthread+0x10/0x10 [ 17.095550] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.095600] ? calculate_sigpending+0x7b/0xa0 [ 17.095655] ? __pfx_kthread+0x10/0x10 [ 17.095704] ret_from_fork+0x116/0x1d0 [ 17.095748] ? __pfx_kthread+0x10/0x10 [ 17.095795] ret_from_fork_asm+0x1a/0x30 [ 17.095866] </TASK> [ 17.095911] [ 17.120475] Allocated by task 176: [ 17.120770] kasan_save_stack+0x45/0x70 [ 17.121120] kasan_save_track+0x18/0x40 [ 17.121437] kasan_save_alloc_info+0x3b/0x50 [ 17.122901] __kasan_krealloc+0x190/0x1f0 [ 17.123467] krealloc_noprof+0xf3/0x340 [ 17.123642] krealloc_less_oob_helper+0x1aa/0x11d0 [ 17.123828] krealloc_less_oob+0x1c/0x30 [ 17.124133] kunit_try_run_case+0x1a5/0x480 [ 17.125089] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.125739] kthread+0x337/0x6f0 [ 17.126249] ret_from_fork+0x116/0x1d0 [ 17.126763] ret_from_fork_asm+0x1a/0x30 [ 17.127485] [ 17.127653] The buggy address belongs to the object at ffff888100351800 [ 17.127653] which belongs to the cache kmalloc-256 of size 256 [ 17.129183] The buggy address is located 0 bytes to the right of [ 17.129183] allocated 201-byte region [ffff888100351800, ffff8881003518c9) [ 17.130113] [ 17.130359] The buggy address belongs to the physical page: [ 17.130737] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100350 [ 17.131570] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.132236] flags: 0x200000000000040(head|node=0|zone=2) [ 17.132726] page_type: f5(slab) [ 17.133204] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.133869] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.134600] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 17.135240] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.135921] head: 0200000000000001 ffffea000400d401 00000000ffffffff 00000000ffffffff [ 17.136636] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 17.137339] page dumped because: kasan: bad access detected [ 17.137814] [ 17.138074] Memory state around the buggy address: [ 17.138575] ffff888100351780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.139275] ffff888100351800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.139827] >ffff888100351880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 17.140504] ^ [ 17.141016] ffff888100351900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.141641] ffff888100351980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.142336] ================================================================== [ 17.466128] ================================================================== [ 17.467087] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd70/0x11d0 [ 17.467711] Write of size 1 at addr ffff88810397a0c9 by task kunit_try_catch/180 [ 17.469084] [ 17.469385] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.469958] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.469995] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.470050] Call Trace: [ 17.470083] <TASK> [ 17.470170] dump_stack_lvl+0x73/0xb0 [ 17.470276] print_report+0xd1/0x650 [ 17.470368] ? __virt_addr_valid+0x1db/0x2d0 [ 17.470408] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.470444] ? kasan_addr_to_slab+0x11/0xa0 [ 17.470475] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.470524] kasan_report+0x141/0x180 [ 17.470604] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 17.470666] __asan_report_store1_noabort+0x1b/0x30 [ 17.470705] krealloc_less_oob_helper+0xd70/0x11d0 [ 17.470743] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.470778] ? finish_task_switch.isra.0+0x153/0x700 [ 17.470809] ? __switch_to+0x47/0xf50 [ 17.470845] ? __schedule+0x10cc/0x2b60 [ 17.470897] ? __pfx_read_tsc+0x10/0x10 [ 17.470936] krealloc_large_less_oob+0x1c/0x30 [ 17.470970] kunit_try_run_case+0x1a5/0x480 [ 17.471007] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.471041] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.471075] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.471124] ? __kthread_parkme+0x82/0x180 [ 17.471167] ? preempt_count_sub+0x50/0x80 [ 17.471200] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.471235] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.471268] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.471302] kthread+0x337/0x6f0 [ 17.471329] ? trace_preempt_on+0x20/0xc0 [ 17.471362] ? __pfx_kthread+0x10/0x10 [ 17.471390] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.471421] ? calculate_sigpending+0x7b/0xa0 [ 17.471456] ? __pfx_kthread+0x10/0x10 [ 17.471485] ret_from_fork+0x116/0x1d0 [ 17.471518] ? __pfx_kthread+0x10/0x10 [ 17.471608] ret_from_fork_asm+0x1a/0x30 [ 17.471672] </TASK> [ 17.471688] [ 17.494551] The buggy address belongs to the physical page: [ 17.495381] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103978 [ 17.496759] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.497622] flags: 0x200000000000040(head|node=0|zone=2) [ 17.498374] page_type: f8(unknown) [ 17.499051] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.500212] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.500982] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.501796] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.503025] head: 0200000000000002 ffffea00040e5e01 00000000ffffffff 00000000ffffffff [ 17.504010] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 17.504990] page dumped because: kasan: bad access detected [ 17.505452] [ 17.506141] Memory state around the buggy address: [ 17.506514] ffff888103979f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.507714] ffff88810397a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.508252] >ffff88810397a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 17.509101] ^ [ 17.509948] ffff88810397a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.510985] ffff88810397a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.512289] ================================================================== [ 17.647285] ================================================================== [ 17.648156] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd47/0x11d0 [ 17.649012] Write of size 1 at addr ffff88810397a0eb by task kunit_try_catch/180 [ 17.649712] [ 17.649942] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.650061] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.650321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.650381] Call Trace: [ 17.650421] <TASK> [ 17.650461] dump_stack_lvl+0x73/0xb0 [ 17.650872] print_report+0xd1/0x650 [ 17.650971] ? __virt_addr_valid+0x1db/0x2d0 [ 17.651083] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 17.651201] ? kasan_addr_to_slab+0x11/0xa0 [ 17.651275] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 17.651351] kasan_report+0x141/0x180 [ 17.651427] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 17.651671] __asan_report_store1_noabort+0x1b/0x30 [ 17.651759] krealloc_less_oob_helper+0xd47/0x11d0 [ 17.651807] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.651844] ? finish_task_switch.isra.0+0x153/0x700 [ 17.651898] ? __switch_to+0x47/0xf50 [ 17.651941] ? __schedule+0x10cc/0x2b60 [ 17.651974] ? __pfx_read_tsc+0x10/0x10 [ 17.652007] krealloc_large_less_oob+0x1c/0x30 [ 17.652040] kunit_try_run_case+0x1a5/0x480 [ 17.652075] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.652140] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.652181] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.652215] ? __kthread_parkme+0x82/0x180 [ 17.652243] ? preempt_count_sub+0x50/0x80 [ 17.652274] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.652310] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.652344] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.652379] kthread+0x337/0x6f0 [ 17.652405] ? trace_preempt_on+0x20/0xc0 [ 17.652436] ? __pfx_kthread+0x10/0x10 [ 17.652464] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.652494] ? calculate_sigpending+0x7b/0xa0 [ 17.652584] ? __pfx_kthread+0x10/0x10 [ 17.652657] ret_from_fork+0x116/0x1d0 [ 17.652686] ? __pfx_kthread+0x10/0x10 [ 17.652718] ret_from_fork_asm+0x1a/0x30 [ 17.652759] </TASK> [ 17.652772] [ 17.673008] The buggy address belongs to the physical page: [ 17.673981] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103978 [ 17.674970] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.675863] flags: 0x200000000000040(head|node=0|zone=2) [ 17.676472] page_type: f8(unknown) [ 17.676976] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.677932] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.678589] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.679202] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.679774] head: 0200000000000002 ffffea00040e5e01 00000000ffffffff 00000000ffffffff [ 17.680339] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 17.681212] page dumped because: kasan: bad access detected [ 17.682282] [ 17.682634] Memory state around the buggy address: [ 17.683169] ffff888103979f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.683927] ffff88810397a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.684732] >ffff88810397a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 17.685416] ^ [ 17.686286] ffff88810397a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.686998] ffff88810397a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.687781] ================================================================== [ 17.513187] ================================================================== [ 17.513662] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe23/0x11d0 [ 17.515228] Write of size 1 at addr ffff88810397a0d0 by task kunit_try_catch/180 [ 17.516258] [ 17.516522] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT(voluntary) [ 17.516860] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.516916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.516963] Call Trace: [ 17.516998] <TASK> [ 17.517029] dump_stack_lvl+0x73/0xb0 [ 17.517105] print_report+0xd1/0x650 [ 17.517311] ? __virt_addr_valid+0x1db/0x2d0 [ 17.517350] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 17.517385] ? kasan_addr_to_slab+0x11/0xa0 [ 17.517413] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 17.517447] kasan_report+0x141/0x180 [ 17.517480] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 17.517534] __asan_report_store1_noabort+0x1b/0x30 [ 17.517631] krealloc_less_oob_helper+0xe23/0x11d0 [ 17.517679] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 17.517717] ? finish_task_switch.isra.0+0x153/0x700 [ 17.517749] ? __switch_to+0x47/0xf50 [ 17.517785] ? __schedule+0x10cc/0x2b60 [ 17.517816] ? __pfx_read_tsc+0x10/0x10 [ 17.517850] krealloc_large_less_oob+0x1c/0x30 [ 17.517908] kunit_try_run_case+0x1a5/0x480 [ 17.517948] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.517982] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.518016] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.518049] ? __kthread_parkme+0x82/0x180 [ 17.518076] ? preempt_count_sub+0x50/0x80 [ 17.518120] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.518172] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.518207] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.518241] kthread+0x337/0x6f0 [ 17.518283] ? trace_preempt_on+0x20/0xc0 [ 17.518317] ? __pfx_kthread+0x10/0x10 [ 17.518345] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.518376] ? calculate_sigpending+0x7b/0xa0 [ 17.518409] ? __pfx_kthread+0x10/0x10 [ 17.518439] ret_from_fork+0x116/0x1d0 [ 17.518464] ? __pfx_kthread+0x10/0x10 [ 17.518492] ret_from_fork_asm+0x1a/0x30 [ 17.518583] </TASK> [ 17.518624] [ 17.542674] The buggy address belongs to the physical page: [ 17.543366] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103978 [ 17.544168] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.545185] flags: 0x200000000000040(head|node=0|zone=2) [ 17.545978] page_type: f8(unknown) [ 17.546459] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.547460] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.548283] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 17.549116] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 17.549934] head: 0200000000000002 ffffea00040e5e01 00000000ffffffff 00000000ffffffff [ 17.550746] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 17.551464] page dumped because: kasan: bad access detected [ 17.552102] [ 17.552341] Memory state around the buggy address: [ 17.553107] ffff888103979f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.553721] ffff88810397a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.554652] >ffff88810397a080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 17.555320] ^ [ 17.555792] ffff88810397a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.556846] ffff88810397a180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 17.557358] ==================================================================
[ 20.181325] ================================================================== [ 20.181978] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 20.182666] Write of size 1 at addr ffff000001b868eb by task kunit_try_catch/211 [ 20.183334] [ 20.183483] CPU: 4 UID: 0 PID: 211 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.183514] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.183522] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.183532] Call trace: [ 20.183538] show_stack+0x20/0x38 (C) [ 20.183558] dump_stack_lvl+0x8c/0xd0 [ 20.183579] print_report+0x118/0x608 [ 20.183600] kasan_report+0xdc/0x128 [ 20.183621] __asan_report_store1_noabort+0x20/0x30 [ 20.183639] krealloc_less_oob_helper+0xa58/0xc50 [ 20.183659] krealloc_less_oob+0x20/0x38 [ 20.183678] kunit_try_run_case+0x170/0x3f0 [ 20.183698] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.183722] kthread+0x328/0x630 [ 20.183737] ret_from_fork+0x10/0x20 [ 20.183756] [ 20.189683] Allocated by task 211: [ 20.189996] kasan_save_stack+0x3c/0x68 [ 20.190357] kasan_save_track+0x20/0x40 [ 20.190718] kasan_save_alloc_info+0x40/0x58 [ 20.191120] __kasan_krealloc+0x118/0x178 [ 20.191496] krealloc_noprof+0x128/0x360 [ 20.191864] krealloc_less_oob_helper+0x168/0xc50 [ 20.192300] krealloc_less_oob+0x20/0x38 [ 20.192666] kunit_try_run_case+0x170/0x3f0 [ 20.193056] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.193563] kthread+0x328/0x630 [ 20.193866] ret_from_fork+0x10/0x20 [ 20.194203] [ 20.194348] The buggy address belongs to the object at ffff000001b86800 [ 20.194348] which belongs to the cache kmalloc-256 of size 256 [ 20.195461] The buggy address is located 34 bytes to the right of [ 20.195461] allocated 201-byte region [ffff000001b86800, ffff000001b868c9) [ 20.196624] [ 20.196770] The buggy address belongs to the physical page: [ 20.197273] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b86 [ 20.197978] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.198668] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.199299] page_type: f5(slab) [ 20.199595] raw: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.200294] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.200992] head: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.201699] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.202405] head: 03fffe0000000001 fffffdffc006e181 00000000ffffffff 00000000ffffffff [ 20.203111] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 20.203812] page dumped because: kasan: bad access detected [ 20.204315] [ 20.204460] Memory state around the buggy address: [ 20.204894] ffff000001b86780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.205545] ffff000001b86800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.206196] >ffff000001b86880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 20.206843] ^ [ 20.207439] ffff000001b86900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.208091] ffff000001b86980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.208739] ================================================================== [ 20.124823] ================================================================== [ 20.125498] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 20.126197] Write of size 1 at addr ffff000001b868da by task kunit_try_catch/211 [ 20.126867] [ 20.127021] CPU: 4 UID: 0 PID: 211 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.127057] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.127066] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.127077] Call trace: [ 20.127086] show_stack+0x20/0x38 (C) [ 20.127110] dump_stack_lvl+0x8c/0xd0 [ 20.127133] print_report+0x118/0x608 [ 20.127155] kasan_report+0xdc/0x128 [ 20.127176] __asan_report_store1_noabort+0x20/0x30 [ 20.127195] krealloc_less_oob_helper+0xa80/0xc50 [ 20.127215] krealloc_less_oob+0x20/0x38 [ 20.127234] kunit_try_run_case+0x170/0x3f0 [ 20.127256] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.127280] kthread+0x328/0x630 [ 20.127297] ret_from_fork+0x10/0x20 [ 20.127317] [ 20.133246] Allocated by task 211: [ 20.133562] kasan_save_stack+0x3c/0x68 [ 20.133926] kasan_save_track+0x20/0x40 [ 20.134287] kasan_save_alloc_info+0x40/0x58 [ 20.134689] __kasan_krealloc+0x118/0x178 [ 20.135066] krealloc_noprof+0x128/0x360 [ 20.135435] krealloc_less_oob_helper+0x168/0xc50 [ 20.135870] krealloc_less_oob+0x20/0x38 [ 20.136237] kunit_try_run_case+0x170/0x3f0 [ 20.136627] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.137135] kthread+0x328/0x630 [ 20.137437] ret_from_fork+0x10/0x20 [ 20.137773] [ 20.137919] The buggy address belongs to the object at ffff000001b86800 [ 20.137919] which belongs to the cache kmalloc-256 of size 256 [ 20.139034] The buggy address is located 17 bytes to the right of [ 20.139034] allocated 201-byte region [ffff000001b86800, ffff000001b868c9) [ 20.140198] [ 20.140344] The buggy address belongs to the physical page: [ 20.140848] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b86 [ 20.141557] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.142248] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.142884] page_type: f5(slab) [ 20.143182] raw: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.143882] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.144581] head: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.145286] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.145992] head: 03fffe0000000001 fffffdffc006e181 00000000ffffffff 00000000ffffffff [ 20.146698] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 20.147399] page dumped because: kasan: bad access detected [ 20.147902] [ 20.148047] Memory state around the buggy address: [ 20.148484] ffff000001b86780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.149137] ffff000001b86800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.149788] >ffff000001b86880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 20.150436] ^ [ 20.150988] ffff000001b86900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.151639] ffff000001b86980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.152288] ================================================================== [ 20.306902] ================================================================== [ 20.307592] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 20.308311] Write of size 1 at addr ffff00000dafa0da by task kunit_try_catch/215 [ 20.308983] [ 20.309140] CPU: 1 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.309176] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.309186] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.309199] Call trace: [ 20.309207] show_stack+0x20/0x38 (C) [ 20.309232] dump_stack_lvl+0x8c/0xd0 [ 20.309258] print_report+0x118/0x608 [ 20.309282] kasan_report+0xdc/0x128 [ 20.309304] __asan_report_store1_noabort+0x20/0x30 [ 20.309326] krealloc_less_oob_helper+0xa80/0xc50 [ 20.309349] krealloc_large_less_oob+0x20/0x38 [ 20.309370] kunit_try_run_case+0x170/0x3f0 [ 20.309395] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.309421] kthread+0x328/0x630 [ 20.309441] ret_from_fork+0x10/0x20 [ 20.309463] [ 20.315447] The buggy address belongs to the physical page: [ 20.315952] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xdaf8 [ 20.316662] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.317354] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.317992] page_type: f8(unknown) [ 20.318316] raw: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.319017] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.319719] head: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.320428] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.321137] head: 03fffe0000000002 fffffdffc036be01 00000000ffffffff 00000000ffffffff [ 20.321845] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.322549] page dumped because: kasan: bad access detected [ 20.323053] [ 20.323198] Memory state around the buggy address: [ 20.323636] ffff00000daf9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.324289] ffff00000dafa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.324943] >ffff00000dafa080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 20.325594] ^ [ 20.326147] ffff00000dafa100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.326800] ffff00000dafa180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.327451] ================================================================== [ 20.067308] ================================================================== [ 20.068340] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 20.069046] Write of size 1 at addr ffff000001b868c9 by task kunit_try_catch/211 [ 20.069718] [ 20.069873] CPU: 2 UID: 0 PID: 211 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.069909] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.069919] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.069932] Call trace: [ 20.069940] show_stack+0x20/0x38 (C) [ 20.069965] dump_stack_lvl+0x8c/0xd0 [ 20.069991] print_report+0x118/0x608 [ 20.070016] kasan_report+0xdc/0x128 [ 20.070038] __asan_report_store1_noabort+0x20/0x30 [ 20.070059] krealloc_less_oob_helper+0xa48/0xc50 [ 20.070082] krealloc_less_oob+0x20/0x38 [ 20.070103] kunit_try_run_case+0x170/0x3f0 [ 20.070128] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.070155] kthread+0x328/0x630 [ 20.070174] ret_from_fork+0x10/0x20 [ 20.070197] [ 20.076131] Allocated by task 211: [ 20.076448] kasan_save_stack+0x3c/0x68 [ 20.076811] kasan_save_track+0x20/0x40 [ 20.077173] kasan_save_alloc_info+0x40/0x58 [ 20.077576] __kasan_krealloc+0x118/0x178 [ 20.077954] krealloc_noprof+0x128/0x360 [ 20.078325] krealloc_less_oob_helper+0x168/0xc50 [ 20.078763] krealloc_less_oob+0x20/0x38 [ 20.079131] kunit_try_run_case+0x170/0x3f0 [ 20.079523] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.080032] kthread+0x328/0x630 [ 20.080337] ret_from_fork+0x10/0x20 [ 20.080676] [ 20.080822] The buggy address belongs to the object at ffff000001b86800 [ 20.080822] which belongs to the cache kmalloc-256 of size 256 [ 20.081940] The buggy address is located 0 bytes to the right of [ 20.081940] allocated 201-byte region [ffff000001b86800, ffff000001b868c9) [ 20.083097] [ 20.083245] The buggy address belongs to the physical page: [ 20.083750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b86 [ 20.084461] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.085153] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.085791] page_type: f5(slab) [ 20.086093] raw: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.086795] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.087497] head: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.088206] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.088916] head: 03fffe0000000001 fffffdffc006e181 00000000ffffffff 00000000ffffffff [ 20.089625] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 20.090328] page dumped because: kasan: bad access detected [ 20.090832] [ 20.090976] Memory state around the buggy address: [ 20.091415] ffff000001b86780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.092069] ffff000001b86800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.092722] >ffff000001b86880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 20.093373] ^ [ 20.093879] ffff000001b86900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.094533] ffff000001b86980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.095183] ================================================================== [ 20.153124] ================================================================== [ 20.153779] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 20.154465] Write of size 1 at addr ffff000001b868ea by task kunit_try_catch/211 [ 20.155133] [ 20.155282] CPU: 4 UID: 0 PID: 211 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.155313] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.155322] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.155332] Call trace: [ 20.155338] show_stack+0x20/0x38 (C) [ 20.155359] dump_stack_lvl+0x8c/0xd0 [ 20.155380] print_report+0x118/0x608 [ 20.155401] kasan_report+0xdc/0x128 [ 20.155422] __asan_report_store1_noabort+0x20/0x30 [ 20.155440] krealloc_less_oob_helper+0xae4/0xc50 [ 20.155460] krealloc_less_oob+0x20/0x38 [ 20.155479] kunit_try_run_case+0x170/0x3f0 [ 20.155499] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.155523] kthread+0x328/0x630 [ 20.155538] ret_from_fork+0x10/0x20 [ 20.155557] [ 20.161485] Allocated by task 211: [ 20.161799] kasan_save_stack+0x3c/0x68 [ 20.162159] kasan_save_track+0x20/0x40 [ 20.162520] kasan_save_alloc_info+0x40/0x58 [ 20.162920] __kasan_krealloc+0x118/0x178 [ 20.163297] krealloc_noprof+0x128/0x360 [ 20.163664] krealloc_less_oob_helper+0x168/0xc50 [ 20.164099] krealloc_less_oob+0x20/0x38 [ 20.164465] kunit_try_run_case+0x170/0x3f0 [ 20.164856] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.165363] kthread+0x328/0x630 [ 20.165667] ret_from_fork+0x10/0x20 [ 20.166003] [ 20.166147] The buggy address belongs to the object at ffff000001b86800 [ 20.166147] which belongs to the cache kmalloc-256 of size 256 [ 20.167261] The buggy address is located 33 bytes to the right of [ 20.167261] allocated 201-byte region [ffff000001b86800, ffff000001b868c9) [ 20.168423] [ 20.168568] The buggy address belongs to the physical page: [ 20.169072] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b86 [ 20.169778] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.170467] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.171098] page_type: f5(slab) [ 20.171394] raw: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.172092] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.172790] head: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.173497] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.174203] head: 03fffe0000000001 fffffdffc006e181 00000000ffffffff 00000000ffffffff [ 20.174909] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 20.175609] page dumped because: kasan: bad access detected [ 20.176112] [ 20.176256] Memory state around the buggy address: [ 20.176693] ffff000001b86780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.177344] ffff000001b86800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.177994] >ffff000001b86880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 20.178643] ^ [ 20.179239] ffff000001b86900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.179889] ffff000001b86980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.180538] ================================================================== [ 20.261344] ================================================================== [ 20.262484] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 20.263234] Write of size 1 at addr ffff00000dafa0c9 by task kunit_try_catch/215 [ 20.263947] [ 20.264130] CPU: 1 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.264208] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.264230] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.264257] Call trace: [ 20.264274] show_stack+0x20/0x38 (C) [ 20.264330] dump_stack_lvl+0x8c/0xd0 [ 20.264386] print_report+0x118/0x608 [ 20.264442] kasan_report+0xdc/0x128 [ 20.264494] __asan_report_store1_noabort+0x20/0x30 [ 20.264544] krealloc_less_oob_helper+0xa48/0xc50 [ 20.264596] krealloc_large_less_oob+0x20/0x38 [ 20.264647] kunit_try_run_case+0x170/0x3f0 [ 20.264703] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.264764] kthread+0x328/0x630 [ 20.264807] ret_from_fork+0x10/0x20 [ 20.264858] [ 20.270993] The buggy address belongs to the physical page: [ 20.271528] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xdaf8 [ 20.272281] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.273013] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.273694] page_type: f8(unknown) [ 20.274055] raw: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.274800] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.275545] head: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.276297] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.277050] head: 03fffe0000000002 fffffdffc036be01 00000000ffffffff 00000000ffffffff [ 20.277803] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.278542] page dumped because: kasan: bad access detected [ 20.279076] [ 20.279243] Memory state around the buggy address: [ 20.279711] ffff00000daf9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.280404] ffff00000dafa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.281095] >ffff00000dafa080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 20.281778] ^ [ 20.282318] ffff00000dafa100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.283009] ffff00000dafa180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.283693] ================================================================== [ 20.284821] ================================================================== [ 20.285521] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 20.286251] Write of size 1 at addr ffff00000dafa0d0 by task kunit_try_catch/215 [ 20.286935] [ 20.287098] CPU: 1 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.287146] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.287160] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.287176] Call trace: [ 20.287187] show_stack+0x20/0x38 (C) [ 20.287220] dump_stack_lvl+0x8c/0xd0 [ 20.287255] print_report+0x118/0x608 [ 20.287288] kasan_report+0xdc/0x128 [ 20.287319] __asan_report_store1_noabort+0x20/0x30 [ 20.287348] krealloc_less_oob_helper+0xb9c/0xc50 [ 20.287380] krealloc_large_less_oob+0x20/0x38 [ 20.287411] kunit_try_run_case+0x170/0x3f0 [ 20.287444] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.287481] kthread+0x328/0x630 [ 20.287507] ret_from_fork+0x10/0x20 [ 20.287538] [ 20.293565] The buggy address belongs to the physical page: [ 20.294080] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xdaf8 [ 20.294801] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.295506] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.296156] page_type: f8(unknown) [ 20.296490] raw: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.297204] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.297919] head: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.298640] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.299362] head: 03fffe0000000002 fffffdffc036be01 00000000ffffffff 00000000ffffffff [ 20.300083] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.300797] page dumped because: kasan: bad access detected [ 20.301311] [ 20.301463] Memory state around the buggy address: [ 20.301910] ffff00000daf9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.302574] ffff00000dafa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.303238] >ffff00000dafa080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 20.303898] ^ [ 20.304439] ffff00000dafa100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.305103] ffff00000dafa180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.305763] ================================================================== [ 20.328197] ================================================================== [ 20.328853] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 20.329545] Write of size 1 at addr ffff00000dafa0ea by task kunit_try_catch/215 [ 20.330215] [ 20.330370] CPU: 1 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.330403] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.330413] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.330424] Call trace: [ 20.330432] show_stack+0x20/0x38 (C) [ 20.330455] dump_stack_lvl+0x8c/0xd0 [ 20.330480] print_report+0x118/0x608 [ 20.330503] kasan_report+0xdc/0x128 [ 20.330525] __asan_report_store1_noabort+0x20/0x30 [ 20.330546] krealloc_less_oob_helper+0xae4/0xc50 [ 20.330568] krealloc_large_less_oob+0x20/0x38 [ 20.330590] kunit_try_run_case+0x170/0x3f0 [ 20.330613] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.330640] kthread+0x328/0x630 [ 20.330658] ret_from_fork+0x10/0x20 [ 20.330680] [ 20.336662] The buggy address belongs to the physical page: [ 20.337166] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xdaf8 [ 20.337876] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.338567] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.339202] page_type: f8(unknown) [ 20.339524] raw: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.340226] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.340928] head: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.341636] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.342345] head: 03fffe0000000002 fffffdffc036be01 00000000ffffffff 00000000ffffffff [ 20.343054] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.343757] page dumped because: kasan: bad access detected [ 20.344261] [ 20.344406] Memory state around the buggy address: [ 20.344843] ffff00000daf9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.345497] ffff00000dafa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.346150] >ffff00000dafa080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 20.346800] ^ [ 20.347399] ffff00000dafa100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.348052] ffff00000dafa180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.348702] ================================================================== [ 20.095991] ================================================================== [ 20.096651] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 20.097365] Write of size 1 at addr ffff000001b868d0 by task kunit_try_catch/211 [ 20.098038] [ 20.098194] CPU: 2 UID: 0 PID: 211 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.098231] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.098241] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.098253] Call trace: [ 20.098261] show_stack+0x20/0x38 (C) [ 20.098285] dump_stack_lvl+0x8c/0xd0 [ 20.098311] print_report+0x118/0x608 [ 20.098335] kasan_report+0xdc/0x128 [ 20.098358] __asan_report_store1_noabort+0x20/0x30 [ 20.098379] krealloc_less_oob_helper+0xb9c/0xc50 [ 20.098401] krealloc_less_oob+0x20/0x38 [ 20.098422] kunit_try_run_case+0x170/0x3f0 [ 20.098447] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.098473] kthread+0x328/0x630 [ 20.098492] ret_from_fork+0x10/0x20 [ 20.098515] [ 20.104453] Allocated by task 211: [ 20.104771] kasan_save_stack+0x3c/0x68 [ 20.105137] kasan_save_track+0x20/0x40 [ 20.105500] kasan_save_alloc_info+0x40/0x58 [ 20.105902] __kasan_krealloc+0x118/0x178 [ 20.106280] krealloc_noprof+0x128/0x360 [ 20.106652] krealloc_less_oob_helper+0x168/0xc50 [ 20.107090] krealloc_less_oob+0x20/0x38 [ 20.107459] kunit_try_run_case+0x170/0x3f0 [ 20.107851] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.108360] kthread+0x328/0x630 [ 20.108666] ret_from_fork+0x10/0x20 [ 20.109006] [ 20.109153] The buggy address belongs to the object at ffff000001b86800 [ 20.109153] which belongs to the cache kmalloc-256 of size 256 [ 20.110271] The buggy address is located 7 bytes to the right of [ 20.110271] allocated 201-byte region [ffff000001b86800, ffff000001b868c9) [ 20.111429] [ 20.111576] The buggy address belongs to the physical page: [ 20.112082] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b86 [ 20.112792] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.113484] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.114121] page_type: f5(slab) [ 20.114423] raw: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.115124] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.115826] head: 03fffe0000000040 ffff000000402b40 dead000000000122 0000000000000000 [ 20.116535] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.117245] head: 03fffe0000000001 fffffdffc006e181 00000000ffffffff 00000000ffffffff [ 20.117955] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 20.118658] page dumped because: kasan: bad access detected [ 20.119163] [ 20.119310] Memory state around the buggy address: [ 20.119748] ffff000001b86780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.120402] ffff000001b86800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.121056] >ffff000001b86880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 20.121705] ^ [ 20.122235] ffff000001b86900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.122888] ffff000001b86980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.123538] ================================================================== [ 20.350025] ================================================================== [ 20.350700] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 20.351398] Write of size 1 at addr ffff00000dafa0eb by task kunit_try_catch/215 [ 20.352070] [ 20.352223] CPU: 4 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc1 #1 PREEMPT [ 20.352258] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.352268] Hardware name: Radxa ROCK Pi 4B (DT) [ 20.352279] Call trace: [ 20.352287] show_stack+0x20/0x38 (C) [ 20.352312] dump_stack_lvl+0x8c/0xd0 [ 20.352335] print_report+0x118/0x608 [ 20.352357] kasan_report+0xdc/0x128 [ 20.352378] __asan_report_store1_noabort+0x20/0x30 [ 20.352396] krealloc_less_oob_helper+0xa58/0xc50 [ 20.352417] krealloc_large_less_oob+0x20/0x38 [ 20.352436] kunit_try_run_case+0x170/0x3f0 [ 20.352459] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.352483] kthread+0x328/0x630 [ 20.352500] ret_from_fork+0x10/0x20 [ 20.352520] [ 20.358496] The buggy address belongs to the physical page: [ 20.359000] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xdaf8 [ 20.359709] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.360400] flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) [ 20.361035] page_type: f8(unknown) [ 20.361357] raw: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.362056] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.362756] head: 03fffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.363462] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.364169] head: 03fffe0000000002 fffffdffc036be01 00000000ffffffff 00000000ffffffff [ 20.364874] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.365576] page dumped because: kasan: bad access detected [ 20.366078] [ 20.366222] Memory state around the buggy address: [ 20.366659] ffff00000daf9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.367311] ffff00000dafa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.367961] >ffff00000dafa080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 20.368610] ^ [ 20.369207] ffff00000dafa100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.369858] ffff00000dafa180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 20.370506] ==================================================================