Date
July 5, 2025, 11:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.843898] ================================================================== [ 17.844039] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488 [ 17.844093] Write of size 1 at addr fff00000c5a07f78 by task kunit_try_catch/142 [ 17.844361] [ 17.844437] CPU: 0 UID: 0 PID: 142 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 17.844591] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.844661] Hardware name: linux,dummy-virt (DT) [ 17.844722] Call trace: [ 17.844795] show_stack+0x20/0x38 (C) [ 17.844914] dump_stack_lvl+0x8c/0xd0 [ 17.845033] print_report+0x118/0x608 [ 17.845078] kasan_report+0xdc/0x128 [ 17.845143] __asan_report_store1_noabort+0x20/0x30 [ 17.845202] kmalloc_track_caller_oob_right+0x40c/0x488 [ 17.845527] kunit_try_run_case+0x170/0x3f0 [ 17.845621] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.845871] kthread+0x328/0x630 [ 17.846074] ret_from_fork+0x10/0x20 [ 17.846345] [ 17.846482] Allocated by task 142: [ 17.846594] kasan_save_stack+0x3c/0x68 [ 17.846635] kasan_save_track+0x20/0x40 [ 17.846726] kasan_save_alloc_info+0x40/0x58 [ 17.846999] __kasan_kmalloc+0xd4/0xd8 [ 17.847111] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 17.847189] kmalloc_track_caller_oob_right+0xa8/0x488 [ 17.847240] kunit_try_run_case+0x170/0x3f0 [ 17.847276] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.847317] kthread+0x328/0x630 [ 17.847357] ret_from_fork+0x10/0x20 [ 17.847401] [ 17.847426] The buggy address belongs to the object at fff00000c5a07f00 [ 17.847426] which belongs to the cache kmalloc-128 of size 128 [ 17.847481] The buggy address is located 0 bytes to the right of [ 17.847481] allocated 120-byte region [fff00000c5a07f00, fff00000c5a07f78) [ 17.847541] [ 17.847560] The buggy address belongs to the physical page: [ 17.847588] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105a07 [ 17.847640] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.847685] page_type: f5(slab) [ 17.847730] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.847795] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.847833] page dumped because: kasan: bad access detected [ 17.847861] [ 17.847905] Memory state around the buggy address: [ 17.847936] fff00000c5a07e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.847977] fff00000c5a07e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.848017] >fff00000c5a07f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.848052] ^ [ 17.848347] fff00000c5a07f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.848417] fff00000c5a08000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.848543] ================================================================== [ 17.849759] ================================================================== [ 17.849807] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x418/0x488 [ 17.849893] Write of size 1 at addr fff00000c3ec0078 by task kunit_try_catch/142 [ 17.849942] [ 17.849989] CPU: 0 UID: 0 PID: 142 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 17.850066] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.850378] Hardware name: linux,dummy-virt (DT) [ 17.850463] Call trace: [ 17.850501] show_stack+0x20/0x38 (C) [ 17.850582] dump_stack_lvl+0x8c/0xd0 [ 17.850666] print_report+0x118/0x608 [ 17.850721] kasan_report+0xdc/0x128 [ 17.850804] __asan_report_store1_noabort+0x20/0x30 [ 17.850889] kmalloc_track_caller_oob_right+0x418/0x488 [ 17.850939] kunit_try_run_case+0x170/0x3f0 [ 17.851015] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.851066] kthread+0x328/0x630 [ 17.851205] ret_from_fork+0x10/0x20 [ 17.851289] [ 17.851308] Allocated by task 142: [ 17.851334] kasan_save_stack+0x3c/0x68 [ 17.851378] kasan_save_track+0x20/0x40 [ 17.851444] kasan_save_alloc_info+0x40/0x58 [ 17.851689] __kasan_kmalloc+0xd4/0xd8 [ 17.851749] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 17.851793] kmalloc_track_caller_oob_right+0x184/0x488 [ 17.851832] kunit_try_run_case+0x170/0x3f0 [ 17.851891] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.851934] kthread+0x328/0x630 [ 17.852122] ret_from_fork+0x10/0x20 [ 17.852222] [ 17.852275] The buggy address belongs to the object at fff00000c3ec0000 [ 17.852275] which belongs to the cache kmalloc-128 of size 128 [ 17.852332] The buggy address is located 0 bytes to the right of [ 17.852332] allocated 120-byte region [fff00000c3ec0000, fff00000c3ec0078) [ 17.852408] [ 17.852702] The buggy address belongs to the physical page: [ 17.852827] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103ec0 [ 17.852881] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.853210] page_type: f5(slab) [ 17.853351] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.853473] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.853582] page dumped because: kasan: bad access detected [ 17.853692] [ 17.853755] Memory state around the buggy address: [ 17.853784] fff00000c3ebff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.853844] fff00000c3ebff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 17.854205] >fff00000c3ec0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.854349] ^ [ 17.854465] fff00000c3ec0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.854576] fff00000c3ec0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.854646] ==================================================================
[ 12.835502] ================================================================== [ 12.836090] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4c8/0x520 [ 12.836770] Write of size 1 at addr ffff8881029e8d78 by task kunit_try_catch/160 [ 12.837202] [ 12.837669] CPU: 1 UID: 0 PID: 160 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 12.837727] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.837741] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.837766] Call Trace: [ 12.837934] <TASK> [ 12.837966] dump_stack_lvl+0x73/0xb0 [ 12.838006] print_report+0xd1/0x650 [ 12.838033] ? __virt_addr_valid+0x1db/0x2d0 [ 12.838059] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 12.838097] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.838121] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 12.838150] kasan_report+0x141/0x180 [ 12.838175] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 12.838207] __asan_report_store1_noabort+0x1b/0x30 [ 12.838230] kmalloc_track_caller_oob_right+0x4c8/0x520 [ 12.838256] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 12.838284] ? __schedule+0x10cc/0x2b60 [ 12.838308] ? __pfx_read_tsc+0x10/0x10 [ 12.838332] ? ktime_get_ts64+0x86/0x230 [ 12.838359] kunit_try_run_case+0x1a5/0x480 [ 12.838388] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.838412] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.838437] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.838461] ? __kthread_parkme+0x82/0x180 [ 12.838484] ? preempt_count_sub+0x50/0x80 [ 12.838510] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.838536] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.838560] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.838585] kthread+0x337/0x6f0 [ 12.838606] ? trace_preempt_on+0x20/0xc0 [ 12.838632] ? __pfx_kthread+0x10/0x10 [ 12.838654] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.838676] ? calculate_sigpending+0x7b/0xa0 [ 12.838703] ? __pfx_kthread+0x10/0x10 [ 12.838726] ret_from_fork+0x116/0x1d0 [ 12.838746] ? __pfx_kthread+0x10/0x10 [ 12.838768] ret_from_fork_asm+0x1a/0x30 [ 12.838815] </TASK> [ 12.838829] [ 12.849622] Allocated by task 160: [ 12.849797] kasan_save_stack+0x45/0x70 [ 12.849968] kasan_save_track+0x18/0x40 [ 12.850691] kasan_save_alloc_info+0x3b/0x50 [ 12.851683] __kasan_kmalloc+0xb7/0xc0 [ 12.852410] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 12.853300] kmalloc_track_caller_oob_right+0x99/0x520 [ 12.853999] kunit_try_run_case+0x1a5/0x480 [ 12.854675] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.855359] kthread+0x337/0x6f0 [ 12.855506] ret_from_fork+0x116/0x1d0 [ 12.855653] ret_from_fork_asm+0x1a/0x30 [ 12.855818] [ 12.855898] The buggy address belongs to the object at ffff8881029e8d00 [ 12.855898] which belongs to the cache kmalloc-128 of size 128 [ 12.857443] The buggy address is located 0 bytes to the right of [ 12.857443] allocated 120-byte region [ffff8881029e8d00, ffff8881029e8d78) [ 12.857992] [ 12.858419] The buggy address belongs to the physical page: [ 12.858679] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029e8 [ 12.859252] flags: 0x200000000000000(node=0|zone=2) [ 12.859659] page_type: f5(slab) [ 12.859977] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.860541] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.860941] page dumped because: kasan: bad access detected [ 12.861449] [ 12.861533] Memory state around the buggy address: [ 12.861797] ffff8881029e8c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.862668] ffff8881029e8c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.863062] >ffff8881029e8d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 12.863632] ^ [ 12.863987] ffff8881029e8d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.864588] ffff8881029e8e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.865051] ==================================================================