Date
July 2, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.830248] ================================================================== [ 17.830304] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x418/0x488 [ 17.830367] Write of size 1 at addr fff00000c650ea78 by task kunit_try_catch/142 [ 17.830860] [ 17.830898] CPU: 1 UID: 0 PID: 142 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 17.830985] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.831012] Hardware name: linux,dummy-virt (DT) [ 17.831483] Call trace: [ 17.831516] show_stack+0x20/0x38 (C) [ 17.831605] dump_stack_lvl+0x8c/0xd0 [ 17.831794] print_report+0x118/0x608 [ 17.832000] kasan_report+0xdc/0x128 [ 17.832054] __asan_report_store1_noabort+0x20/0x30 [ 17.832477] kmalloc_track_caller_oob_right+0x418/0x488 [ 17.832600] kunit_try_run_case+0x170/0x3f0 [ 17.832750] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.832930] kthread+0x328/0x630 [ 17.832981] ret_from_fork+0x10/0x20 [ 17.833028] [ 17.833046] Allocated by task 142: [ 17.833436] kasan_save_stack+0x3c/0x68 [ 17.833741] kasan_save_track+0x20/0x40 [ 17.833812] kasan_save_alloc_info+0x40/0x58 [ 17.834211] __kasan_kmalloc+0xd4/0xd8 [ 17.834536] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 17.834759] kmalloc_track_caller_oob_right+0x184/0x488 [ 17.835048] kunit_try_run_case+0x170/0x3f0 [ 17.835341] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.835542] kthread+0x328/0x630 [ 17.835823] ret_from_fork+0x10/0x20 [ 17.835862] [ 17.835992] The buggy address belongs to the object at fff00000c650ea00 [ 17.835992] which belongs to the cache kmalloc-128 of size 128 [ 17.836057] The buggy address is located 0 bytes to the right of [ 17.836057] allocated 120-byte region [fff00000c650ea00, fff00000c650ea78) [ 17.836265] [ 17.836284] The buggy address belongs to the physical page: [ 17.836461] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10650e [ 17.836515] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.836929] page_type: f5(slab) [ 17.836985] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.837179] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.837417] page dumped because: kasan: bad access detected [ 17.837452] [ 17.837469] Memory state around the buggy address: [ 17.837817] fff00000c650e900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.837861] fff00000c650e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.837902] >fff00000c650ea00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.838108] ^ [ 17.838174] fff00000c650ea80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.838393] fff00000c650eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.838701] ================================================================== [ 17.820503] ================================================================== [ 17.820558] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488 [ 17.820627] Write of size 1 at addr fff00000c650e978 by task kunit_try_catch/142 [ 17.820675] [ 17.821159] CPU: 1 UID: 0 PID: 142 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 17.822424] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.822633] Hardware name: linux,dummy-virt (DT) [ 17.822667] Call trace: [ 17.822746] show_stack+0x20/0x38 (C) [ 17.822805] dump_stack_lvl+0x8c/0xd0 [ 17.822860] print_report+0x118/0x608 [ 17.822914] kasan_report+0xdc/0x128 [ 17.823067] __asan_report_store1_noabort+0x20/0x30 [ 17.823123] kmalloc_track_caller_oob_right+0x40c/0x488 [ 17.823172] kunit_try_run_case+0x170/0x3f0 [ 17.823402] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.823522] kthread+0x328/0x630 [ 17.823581] ret_from_fork+0x10/0x20 [ 17.823630] [ 17.823793] Allocated by task 142: [ 17.823823] kasan_save_stack+0x3c/0x68 [ 17.824257] kasan_save_track+0x20/0x40 [ 17.824300] kasan_save_alloc_info+0x40/0x58 [ 17.824417] __kasan_kmalloc+0xd4/0xd8 [ 17.824456] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 17.824906] kmalloc_track_caller_oob_right+0xa8/0x488 [ 17.824955] kunit_try_run_case+0x170/0x3f0 [ 17.825003] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.825073] kthread+0x328/0x630 [ 17.825116] ret_from_fork+0x10/0x20 [ 17.825163] [ 17.825447] The buggy address belongs to the object at fff00000c650e900 [ 17.825447] which belongs to the cache kmalloc-128 of size 128 [ 17.825773] The buggy address is located 0 bytes to the right of [ 17.825773] allocated 120-byte region [fff00000c650e900, fff00000c650e978) [ 17.825842] [ 17.825868] The buggy address belongs to the physical page: [ 17.825954] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10650e [ 17.826242] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.826295] page_type: f5(slab) [ 17.826334] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.826777] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.826955] page dumped because: kasan: bad access detected [ 17.826992] [ 17.827009] Memory state around the buggy address: [ 17.827279] fff00000c650e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.827333] fff00000c650e880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.827377] >fff00000c650e900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.827415] ^ [ 17.828496] fff00000c650e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.828560] fff00000c650ea00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.829008] ==================================================================
[ 10.810323] ================================================================== [ 10.811345] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4c8/0x520 [ 10.811629] Write of size 1 at addr ffff888102c7bd78 by task kunit_try_catch/161 [ 10.811858] [ 10.811947] CPU: 1 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 10.811991] Tainted: [B]=BAD_PAGE, [N]=TEST [ 10.812005] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 10.812024] Call Trace: [ 10.812036] <TASK> [ 10.812052] dump_stack_lvl+0x73/0xb0 [ 10.812079] print_report+0xd1/0x650 [ 10.812101] ? __virt_addr_valid+0x1db/0x2d0 [ 10.812123] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 10.812146] ? kasan_complete_mode_report_info+0x2a/0x200 [ 10.812166] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 10.812189] kasan_report+0x141/0x180 [ 10.812210] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 10.812237] __asan_report_store1_noabort+0x1b/0x30 [ 10.812257] kmalloc_track_caller_oob_right+0x4c8/0x520 [ 10.812280] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 10.812303] ? __schedule+0x10cc/0x2b60 [ 10.812324] ? __pfx_read_tsc+0x10/0x10 [ 10.812344] ? ktime_get_ts64+0x86/0x230 [ 10.812366] kunit_try_run_case+0x1a5/0x480 [ 10.812602] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.812629] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 10.812651] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 10.812800] ? __kthread_parkme+0x82/0x180 [ 10.812827] ? preempt_count_sub+0x50/0x80 [ 10.812946] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.812970] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.812992] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 10.813014] kthread+0x337/0x6f0 [ 10.813033] ? trace_preempt_on+0x20/0xc0 [ 10.813056] ? __pfx_kthread+0x10/0x10 [ 10.813075] ? _raw_spin_unlock_irq+0x47/0x80 [ 10.813095] ? calculate_sigpending+0x7b/0xa0 [ 10.813118] ? __pfx_kthread+0x10/0x10 [ 10.813138] ret_from_fork+0x116/0x1d0 [ 10.813155] ? __pfx_kthread+0x10/0x10 [ 10.813174] ret_from_fork_asm+0x1a/0x30 [ 10.813205] </TASK> [ 10.813215] [ 10.828983] Allocated by task 161: [ 10.829311] kasan_save_stack+0x45/0x70 [ 10.829781] kasan_save_track+0x18/0x40 [ 10.830099] kasan_save_alloc_info+0x3b/0x50 [ 10.830247] __kasan_kmalloc+0xb7/0xc0 [ 10.830388] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 10.830609] kmalloc_track_caller_oob_right+0x99/0x520 [ 10.831055] kunit_try_run_case+0x1a5/0x480 [ 10.831465] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.832261] kthread+0x337/0x6f0 [ 10.832653] ret_from_fork+0x116/0x1d0 [ 10.833050] ret_from_fork_asm+0x1a/0x30 [ 10.833416] [ 10.833574] The buggy address belongs to the object at ffff888102c7bd00 [ 10.833574] which belongs to the cache kmalloc-128 of size 128 [ 10.834151] The buggy address is located 0 bytes to the right of [ 10.834151] allocated 120-byte region [ffff888102c7bd00, ffff888102c7bd78) [ 10.834530] [ 10.834688] The buggy address belongs to the physical page: [ 10.835155] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c7b [ 10.835951] flags: 0x200000000000000(node=0|zone=2) [ 10.836389] page_type: f5(slab) [ 10.836874] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 10.837539] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 10.838344] page dumped because: kasan: bad access detected [ 10.839005] [ 10.839176] Memory state around the buggy address: [ 10.839343] ffff888102c7bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 10.839571] ffff888102c7bc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.840287] >ffff888102c7bd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 10.841090] ^ [ 10.841767] ffff888102c7bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.842420] ffff888102c7be00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.842767] ================================================================== [ 10.843833] ================================================================== [ 10.844701] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4b1/0x520 [ 10.845112] Write of size 1 at addr ffff888102c7be78 by task kunit_try_catch/161 [ 10.845339] [ 10.845443] CPU: 1 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 10.845485] Tainted: [B]=BAD_PAGE, [N]=TEST [ 10.845496] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 10.845516] Call Trace: [ 10.845527] <TASK> [ 10.845543] dump_stack_lvl+0x73/0xb0 [ 10.845582] print_report+0xd1/0x650 [ 10.845605] ? __virt_addr_valid+0x1db/0x2d0 [ 10.845626] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 10.845649] ? kasan_complete_mode_report_info+0x2a/0x200 [ 10.845669] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 10.845692] kasan_report+0x141/0x180 [ 10.845713] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 10.845740] __asan_report_store1_noabort+0x1b/0x30 [ 10.845760] kmalloc_track_caller_oob_right+0x4b1/0x520 [ 10.845782] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 10.845807] ? __schedule+0x10cc/0x2b60 [ 10.845828] ? __pfx_read_tsc+0x10/0x10 [ 10.845848] ? ktime_get_ts64+0x86/0x230 [ 10.845870] kunit_try_run_case+0x1a5/0x480 [ 10.845893] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.845913] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 10.845935] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 10.845955] ? __kthread_parkme+0x82/0x180 [ 10.845975] ? preempt_count_sub+0x50/0x80 [ 10.845997] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.846019] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.846039] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 10.846061] kthread+0x337/0x6f0 [ 10.846079] ? trace_preempt_on+0x20/0xc0 [ 10.846101] ? __pfx_kthread+0x10/0x10 [ 10.846121] ? _raw_spin_unlock_irq+0x47/0x80 [ 10.846140] ? calculate_sigpending+0x7b/0xa0 [ 10.846163] ? __pfx_kthread+0x10/0x10 [ 10.846183] ret_from_fork+0x116/0x1d0 [ 10.846200] ? __pfx_kthread+0x10/0x10 [ 10.846219] ret_from_fork_asm+0x1a/0x30 [ 10.846248] </TASK> [ 10.846258] [ 10.856502] Allocated by task 161: [ 10.856686] kasan_save_stack+0x45/0x70 [ 10.857281] kasan_save_track+0x18/0x40 [ 10.857665] kasan_save_alloc_info+0x3b/0x50 [ 10.857901] __kasan_kmalloc+0xb7/0xc0 [ 10.858047] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 10.858290] kmalloc_track_caller_oob_right+0x19a/0x520 [ 10.858531] kunit_try_run_case+0x1a5/0x480 [ 10.859035] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.859260] kthread+0x337/0x6f0 [ 10.859434] ret_from_fork+0x116/0x1d0 [ 10.859612] ret_from_fork_asm+0x1a/0x30 [ 10.860188] [ 10.860299] The buggy address belongs to the object at ffff888102c7be00 [ 10.860299] which belongs to the cache kmalloc-128 of size 128 [ 10.860680] The buggy address is located 0 bytes to the right of [ 10.860680] allocated 120-byte region [ffff888102c7be00, ffff888102c7be78) [ 10.861342] [ 10.861455] The buggy address belongs to the physical page: [ 10.861802] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c7b [ 10.862086] flags: 0x200000000000000(node=0|zone=2) [ 10.862369] page_type: f5(slab) [ 10.862896] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 10.863262] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 10.863771] page dumped because: kasan: bad access detected [ 10.864168] [ 10.864424] Memory state around the buggy address: [ 10.864680] ffff888102c7bd00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 10.865185] ffff888102c7bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.865643] >ffff888102c7be00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 10.866048] ^ [ 10.866475] ffff888102c7be80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.867039] ffff888102c7bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.867406] ==================================================================