Date
July 4, 2025, 11:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.721993] ================================================================== [ 17.722057] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 17.722111] Read of size 1 at addr fff00000c6407000 by task kunit_try_catch/140 [ 17.722159] [ 17.722192] CPU: 0 UID: 0 PID: 140 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 17.722269] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.722296] Hardware name: linux,dummy-virt (DT) [ 17.722326] Call trace: [ 17.722348] show_stack+0x20/0x38 (C) [ 17.722394] dump_stack_lvl+0x8c/0xd0 [ 17.722445] print_report+0x118/0x608 [ 17.722494] kasan_report+0xdc/0x128 [ 17.722538] __asan_report_load1_noabort+0x20/0x30 [ 17.722598] kmalloc_node_oob_right+0x2f4/0x330 [ 17.722645] kunit_try_run_case+0x170/0x3f0 [ 17.722691] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.722742] kthread+0x328/0x630 [ 17.722793] ret_from_fork+0x10/0x20 [ 17.723551] [ 17.723574] Allocated by task 140: [ 17.724547] kasan_save_stack+0x3c/0x68 [ 17.724763] kasan_save_track+0x20/0x40 [ 17.724932] kasan_save_alloc_info+0x40/0x58 [ 17.724975] __kasan_kmalloc+0xd4/0xd8 [ 17.725195] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 17.725383] kmalloc_node_oob_right+0xbc/0x330 [ 17.725432] kunit_try_run_case+0x170/0x3f0 [ 17.725826] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.725923] kthread+0x328/0x630 [ 17.726163] ret_from_fork+0x10/0x20 [ 17.726218] [ 17.726311] The buggy address belongs to the object at fff00000c6406000 [ 17.726311] which belongs to the cache kmalloc-4k of size 4096 [ 17.726668] The buggy address is located 0 bytes to the right of [ 17.726668] allocated 4096-byte region [fff00000c6406000, fff00000c6407000) [ 17.726786] [ 17.726965] The buggy address belongs to the physical page: [ 17.727411] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106400 [ 17.728420] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.728594] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.729293] page_type: f5(slab) [ 17.729456] raw: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 17.729649] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 17.729723] head: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 17.730184] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 17.730302] head: 0bfffe0000000003 ffffc1ffc3190001 00000000ffffffff 00000000ffffffff [ 17.730469] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 17.730662] page dumped because: kasan: bad access detected [ 17.730695] [ 17.730772] Memory state around the buggy address: [ 17.731311] fff00000c6406f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.731465] fff00000c6406f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.731521] >fff00000c6407000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.731570] ^ [ 17.731730] fff00000c6407080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.731790] fff00000c6407100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.731839] ==================================================================
[ 11.215963] ================================================================== [ 11.216946] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x369/0x3c0 [ 11.217479] Read of size 1 at addr ffff8881026cf000 by task kunit_try_catch/157 [ 11.218056] [ 11.218194] CPU: 1 UID: 0 PID: 157 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.218255] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.218267] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.218290] Call Trace: [ 11.218306] <TASK> [ 11.218325] dump_stack_lvl+0x73/0xb0 [ 11.218358] print_report+0xd1/0x650 [ 11.218381] ? __virt_addr_valid+0x1db/0x2d0 [ 11.218404] ? kmalloc_node_oob_right+0x369/0x3c0 [ 11.218426] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.218446] ? kmalloc_node_oob_right+0x369/0x3c0 [ 11.218468] kasan_report+0x141/0x180 [ 11.218489] ? kmalloc_node_oob_right+0x369/0x3c0 [ 11.218515] __asan_report_load1_noabort+0x18/0x20 [ 11.218537] kmalloc_node_oob_right+0x369/0x3c0 [ 11.218560] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 11.218582] ? __schedule+0x10cc/0x2b60 [ 11.218603] ? __pfx_read_tsc+0x10/0x10 [ 11.218623] ? ktime_get_ts64+0x86/0x230 [ 11.218647] kunit_try_run_case+0x1a5/0x480 [ 11.218672] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.218693] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.218714] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.218736] ? __kthread_parkme+0x82/0x180 [ 11.218755] ? preempt_count_sub+0x50/0x80 [ 11.218777] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.218799] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.218819] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.218840] kthread+0x337/0x6f0 [ 11.218858] ? trace_preempt_on+0x20/0xc0 [ 11.218880] ? __pfx_kthread+0x10/0x10 [ 11.218899] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.218919] ? calculate_sigpending+0x7b/0xa0 [ 11.218941] ? __pfx_kthread+0x10/0x10 [ 11.218961] ret_from_fork+0x116/0x1d0 [ 11.218977] ? __pfx_kthread+0x10/0x10 [ 11.218996] ret_from_fork_asm+0x1a/0x30 [ 11.219025] </TASK> [ 11.219036] [ 11.229299] Allocated by task 157: [ 11.229504] kasan_save_stack+0x45/0x70 [ 11.229669] kasan_save_track+0x18/0x40 [ 11.229864] kasan_save_alloc_info+0x3b/0x50 [ 11.230079] __kasan_kmalloc+0xb7/0xc0 [ 11.230439] __kmalloc_cache_node_noprof+0x188/0x420 [ 11.230655] kmalloc_node_oob_right+0xab/0x3c0 [ 11.230810] kunit_try_run_case+0x1a5/0x480 [ 11.231022] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.231283] kthread+0x337/0x6f0 [ 11.231734] ret_from_fork+0x116/0x1d0 [ 11.231935] ret_from_fork_asm+0x1a/0x30 [ 11.232135] [ 11.232248] The buggy address belongs to the object at ffff8881026ce000 [ 11.232248] which belongs to the cache kmalloc-4k of size 4096 [ 11.232951] The buggy address is located 0 bytes to the right of [ 11.232951] allocated 4096-byte region [ffff8881026ce000, ffff8881026cf000) [ 11.233339] [ 11.233441] The buggy address belongs to the physical page: [ 11.233795] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1026c8 [ 11.234680] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.235079] flags: 0x200000000000040(head|node=0|zone=2) [ 11.235844] page_type: f5(slab) [ 11.235984] raw: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 11.236532] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 11.236979] head: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 11.237430] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 11.237750] head: 0200000000000003 ffffea000409b201 00000000ffffffff 00000000ffffffff [ 11.238056] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 11.238547] page dumped because: kasan: bad access detected [ 11.238797] [ 11.238879] Memory state around the buggy address: [ 11.239086] ffff8881026cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.239827] ffff8881026cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.240108] >ffff8881026cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.240339] ^ [ 11.240475] ffff8881026cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.240806] ffff8881026cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.241129] ==================================================================