Date
July 2, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.217881] ================================================================== [ 18.217947] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 18.217999] Read of size 18446744073709551614 at addr fff00000c707ab84 by task kunit_try_catch/180 [ 18.218078] [ 18.218117] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.218340] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.218651] Hardware name: linux,dummy-virt (DT) [ 18.218710] Call trace: [ 18.218959] show_stack+0x20/0x38 (C) [ 18.219111] dump_stack_lvl+0x8c/0xd0 [ 18.219164] print_report+0x118/0x608 [ 18.219209] kasan_report+0xdc/0x128 [ 18.219255] kasan_check_range+0x100/0x1a8 [ 18.219336] __asan_memmove+0x3c/0x98 [ 18.219382] kmalloc_memmove_negative_size+0x154/0x2e0 [ 18.219476] kunit_try_run_case+0x170/0x3f0 [ 18.219744] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.219943] kthread+0x328/0x630 [ 18.220351] ret_from_fork+0x10/0x20 [ 18.220677] [ 18.220752] Allocated by task 180: [ 18.220795] kasan_save_stack+0x3c/0x68 [ 18.220849] kasan_save_track+0x20/0x40 [ 18.220885] kasan_save_alloc_info+0x40/0x58 [ 18.221340] __kasan_kmalloc+0xd4/0xd8 [ 18.221397] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.222605] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 18.222694] kunit_try_run_case+0x170/0x3f0 [ 18.223120] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.223281] kthread+0x328/0x630 [ 18.223342] ret_from_fork+0x10/0x20 [ 18.223410] [ 18.223515] The buggy address belongs to the object at fff00000c707ab80 [ 18.223515] which belongs to the cache kmalloc-64 of size 64 [ 18.223650] The buggy address is located 4 bytes inside of [ 18.223650] 64-byte region [fff00000c707ab80, fff00000c707abc0) [ 18.223711] [ 18.223731] The buggy address belongs to the physical page: [ 18.223774] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10707a [ 18.223834] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.223883] page_type: f5(slab) [ 18.223943] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 18.223999] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 18.224041] page dumped because: kasan: bad access detected [ 18.224074] [ 18.224092] Memory state around the buggy address: [ 18.224132] fff00000c707aa80: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 18.224193] fff00000c707ab00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 18.224235] >fff00000c707ab80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 18.224291] ^ [ 18.224320] fff00000c707ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.224371] fff00000c707ac80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.224424] ==================================================================
[ 11.569511] ================================================================== [ 11.569913] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330 [ 11.570162] Read of size 18446744073709551614 at addr ffff888102c84b04 by task kunit_try_catch/199 [ 11.570471] [ 11.570560] CPU: 1 UID: 0 PID: 199 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.570604] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.570615] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.570636] Call Trace: [ 11.570648] <TASK> [ 11.570665] dump_stack_lvl+0x73/0xb0 [ 11.570693] print_report+0xd1/0x650 [ 11.570715] ? __virt_addr_valid+0x1db/0x2d0 [ 11.570736] ? kmalloc_memmove_negative_size+0x171/0x330 [ 11.570758] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.570778] ? kmalloc_memmove_negative_size+0x171/0x330 [ 11.570817] kasan_report+0x141/0x180 [ 11.570839] ? kmalloc_memmove_negative_size+0x171/0x330 [ 11.570866] kasan_check_range+0x10c/0x1c0 [ 11.570887] __asan_memmove+0x27/0x70 [ 11.570906] kmalloc_memmove_negative_size+0x171/0x330 [ 11.570928] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 11.570952] ? __schedule+0x10cc/0x2b60 [ 11.570973] ? __pfx_read_tsc+0x10/0x10 [ 11.570993] ? ktime_get_ts64+0x86/0x230 [ 11.571016] kunit_try_run_case+0x1a5/0x480 [ 11.571040] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.571060] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.571082] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.571103] ? __kthread_parkme+0x82/0x180 [ 11.571122] ? preempt_count_sub+0x50/0x80 [ 11.571145] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.571167] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.571188] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.571208] kthread+0x337/0x6f0 [ 11.571226] ? trace_preempt_on+0x20/0xc0 [ 11.571249] ? __pfx_kthread+0x10/0x10 [ 11.571268] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.571287] ? calculate_sigpending+0x7b/0xa0 [ 11.571309] ? __pfx_kthread+0x10/0x10 [ 11.571329] ret_from_fork+0x116/0x1d0 [ 11.571346] ? __pfx_kthread+0x10/0x10 [ 11.571364] ret_from_fork_asm+0x1a/0x30 [ 11.571447] </TASK> [ 11.571458] [ 11.586036] Allocated by task 199: [ 11.586350] kasan_save_stack+0x45/0x70 [ 11.586512] kasan_save_track+0x18/0x40 [ 11.586957] kasan_save_alloc_info+0x3b/0x50 [ 11.587356] __kasan_kmalloc+0xb7/0xc0 [ 11.587780] __kmalloc_cache_noprof+0x189/0x420 [ 11.588124] kmalloc_memmove_negative_size+0xac/0x330 [ 11.588297] kunit_try_run_case+0x1a5/0x480 [ 11.588452] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.589013] kthread+0x337/0x6f0 [ 11.589351] ret_from_fork+0x116/0x1d0 [ 11.589799] ret_from_fork_asm+0x1a/0x30 [ 11.590173] [ 11.590336] The buggy address belongs to the object at ffff888102c84b00 [ 11.590336] which belongs to the cache kmalloc-64 of size 64 [ 11.591486] The buggy address is located 4 bytes inside of [ 11.591486] 64-byte region [ffff888102c84b00, ffff888102c84b40) [ 11.592039] [ 11.592117] The buggy address belongs to the physical page: [ 11.592294] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c84 [ 11.593102] flags: 0x200000000000000(node=0|zone=2) [ 11.593576] page_type: f5(slab) [ 11.593964] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 11.594708] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 11.595346] page dumped because: kasan: bad access detected [ 11.595525] [ 11.595603] Memory state around the buggy address: [ 11.595764] ffff888102c84a00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 11.595979] ffff888102c84a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 11.596193] >ffff888102c84b00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 11.596461] ^ [ 11.596751] ffff888102c84b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.597685] ffff888102c84c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.598364] ==================================================================