Date
July 6, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.087943] ================================================================== [ 18.088003] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300 [ 18.088409] Write of size 4 at addr fff00000c1cf4c75 by task kunit_try_catch/174 [ 18.088528] [ 18.088586] CPU: 1 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.088667] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.088692] Hardware name: linux,dummy-virt (DT) [ 18.088722] Call trace: [ 18.088803] show_stack+0x20/0x38 (C) [ 18.088855] dump_stack_lvl+0x8c/0xd0 [ 18.088927] print_report+0x118/0x608 [ 18.089250] kasan_report+0xdc/0x128 [ 18.090117] kasan_check_range+0x100/0x1a8 [ 18.090220] __asan_memset+0x34/0x78 [ 18.090283] kmalloc_oob_memset_4+0x150/0x300 [ 18.090437] kunit_try_run_case+0x170/0x3f0 [ 18.090487] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.090868] kthread+0x328/0x630 [ 18.090989] ret_from_fork+0x10/0x20 [ 18.091507] [ 18.091548] Allocated by task 174: [ 18.091600] kasan_save_stack+0x3c/0x68 [ 18.091646] kasan_save_track+0x20/0x40 [ 18.091972] kasan_save_alloc_info+0x40/0x58 [ 18.092130] __kasan_kmalloc+0xd4/0xd8 [ 18.092295] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.092381] kmalloc_oob_memset_4+0xb0/0x300 [ 18.092520] kunit_try_run_case+0x170/0x3f0 [ 18.092581] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.092863] kthread+0x328/0x630 [ 18.093171] ret_from_fork+0x10/0x20 [ 18.093312] [ 18.093412] The buggy address belongs to the object at fff00000c1cf4c00 [ 18.093412] which belongs to the cache kmalloc-128 of size 128 [ 18.093612] The buggy address is located 117 bytes inside of [ 18.093612] allocated 120-byte region [fff00000c1cf4c00, fff00000c1cf4c78) [ 18.093719] [ 18.093827] The buggy address belongs to the physical page: [ 18.093876] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101cf4 [ 18.094020] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.094080] page_type: f5(slab) [ 18.094119] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 18.094538] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.094601] page dumped because: kasan: bad access detected [ 18.094724] [ 18.094769] Memory state around the buggy address: [ 18.094801] fff00000c1cf4b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.095122] fff00000c1cf4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.095267] >fff00000c1cf4c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.095376] ^ [ 18.095829] fff00000c1cf4c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.096284] fff00000c1cf4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.096366] ==================================================================
[ 11.704430] ================================================================== [ 11.704962] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x166/0x330 [ 11.705257] Write of size 4 at addr ffff888102794275 by task kunit_try_catch/191 [ 11.705580] [ 11.705684] CPU: 1 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.705726] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.705738] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.705759] Call Trace: [ 11.705771] <TASK> [ 11.705788] dump_stack_lvl+0x73/0xb0 [ 11.705814] print_report+0xd1/0x650 [ 11.705836] ? __virt_addr_valid+0x1db/0x2d0 [ 11.705859] ? kmalloc_oob_memset_4+0x166/0x330 [ 11.705880] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.705901] ? kmalloc_oob_memset_4+0x166/0x330 [ 11.705922] kasan_report+0x141/0x180 [ 11.705956] ? kmalloc_oob_memset_4+0x166/0x330 [ 11.705982] kasan_check_range+0x10c/0x1c0 [ 11.706005] __asan_memset+0x27/0x50 [ 11.706025] kmalloc_oob_memset_4+0x166/0x330 [ 11.706046] ? __pfx_kmalloc_oob_memset_4+0x10/0x10 [ 11.706069] ? __schedule+0x10cc/0x2b60 [ 11.706090] ? __pfx_read_tsc+0x10/0x10 [ 11.706111] ? ktime_get_ts64+0x86/0x230 [ 11.706135] kunit_try_run_case+0x1a5/0x480 [ 11.706159] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.706180] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.706202] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.706224] ? __kthread_parkme+0x82/0x180 [ 11.706244] ? preempt_count_sub+0x50/0x80 [ 11.706268] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.706291] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.706313] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.706335] kthread+0x337/0x6f0 [ 11.706354] ? trace_preempt_on+0x20/0xc0 [ 11.706377] ? __pfx_kthread+0x10/0x10 [ 11.706398] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.706418] ? calculate_sigpending+0x7b/0xa0 [ 11.706441] ? __pfx_kthread+0x10/0x10 [ 11.706463] ret_from_fork+0x116/0x1d0 [ 11.706481] ? __pfx_kthread+0x10/0x10 [ 11.706500] ret_from_fork_asm+0x1a/0x30 [ 11.706530] </TASK> [ 11.706541] [ 11.714214] Allocated by task 191: [ 11.714403] kasan_save_stack+0x45/0x70 [ 11.714799] kasan_save_track+0x18/0x40 [ 11.714978] kasan_save_alloc_info+0x3b/0x50 [ 11.715297] __kasan_kmalloc+0xb7/0xc0 [ 11.715434] __kmalloc_cache_noprof+0x189/0x420 [ 11.715658] kmalloc_oob_memset_4+0xac/0x330 [ 11.716093] kunit_try_run_case+0x1a5/0x480 [ 11.716270] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.716520] kthread+0x337/0x6f0 [ 11.716695] ret_from_fork+0x116/0x1d0 [ 11.716829] ret_from_fork_asm+0x1a/0x30 [ 11.717001] [ 11.717098] The buggy address belongs to the object at ffff888102794200 [ 11.717098] which belongs to the cache kmalloc-128 of size 128 [ 11.717831] The buggy address is located 117 bytes inside of [ 11.717831] allocated 120-byte region [ffff888102794200, ffff888102794278) [ 11.718289] [ 11.718390] The buggy address belongs to the physical page: [ 11.718649] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102794 [ 11.719091] flags: 0x200000000000000(node=0|zone=2) [ 11.719311] page_type: f5(slab) [ 11.719434] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 11.720103] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.720409] page dumped because: kasan: bad access detected [ 11.720748] [ 11.720847] Memory state around the buggy address: [ 11.721054] ffff888102794100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.721313] ffff888102794180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.721770] >ffff888102794200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 11.722060] ^ [ 11.722315] ffff888102794280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.722779] ffff888102794300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.723068] ==================================================================