Hay
Date
July 10, 2025, 11:10 p.m.

Environment
qemu-arm64
qemu-x86_64

[   15.639948] ==================================================================
[   15.640029] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320
[   15.640114] Read of size 1 at addr fff00000c5ff797f by task kunit_try_catch/138
[   15.641602] 
[   15.641661] CPU: 1 UID: 0 PID: 138 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT 
[   15.641814] Tainted: [B]=BAD_PAGE, [N]=TEST
[   15.641852] Hardware name: linux,dummy-virt (DT)
[   15.641884] Call trace:
[   15.641907]  show_stack+0x20/0x38 (C)
[   15.641962]  dump_stack_lvl+0x8c/0xd0
[   15.642025]  print_report+0x118/0x608
[   15.642073]  kasan_report+0xdc/0x128
[   15.642131]  __asan_report_load1_noabort+0x20/0x30
[   15.642289]  kmalloc_oob_left+0x2ec/0x320
[   15.642342]  kunit_try_run_case+0x170/0x3f0
[   15.642734]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.642802]  kthread+0x328/0x630
[   15.643173]  ret_from_fork+0x10/0x20
[   15.643418] 
[   15.643446] Allocated by task 24:
[   15.643655]  kasan_save_stack+0x3c/0x68
[   15.643817]  kasan_save_track+0x20/0x40
[   15.643863]  kasan_save_alloc_info+0x40/0x58
[   15.644188]  __kasan_kmalloc+0xd4/0xd8
[   15.644234]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   15.644345]  kvasprintf+0xe0/0x180
[   15.644382]  __kthread_create_on_node+0x16c/0x350
[   15.644604]  kthread_create_on_node+0xe4/0x130
[   15.644652]  create_worker+0x380/0x6b8
[   15.644967]  worker_thread+0x808/0xf38
[   15.645010]  kthread+0x328/0x630
[   15.645041]  ret_from_fork+0x10/0x20
[   15.645089] 
[   15.645485] The buggy address belongs to the object at fff00000c5ff7960
[   15.645485]  which belongs to the cache kmalloc-16 of size 16
[   15.645860] The buggy address is located 19 bytes to the right of
[   15.645860]  allocated 12-byte region [fff00000c5ff7960, fff00000c5ff796c)
[   15.646230] 
[   15.646258] The buggy address belongs to the physical page:
[   15.646311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105ff7
[   15.646376] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   15.646428] page_type: f5(slab)
[   15.646563] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   15.646616] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   15.646942] page dumped because: kasan: bad access detected
[   15.646979] 
[   15.646996] Memory state around the buggy address:
[   15.647358]  fff00000c5ff7800: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 05 fc fc
[   15.647472]  fff00000c5ff7880: fa fb fc fc 00 02 fc fc fa fb fc fc fa fb fc fc
[   15.647516] >fff00000c5ff7900: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc
[   15.647673]                                                                 ^
[   15.647883]  fff00000c5ff7980: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.647931]  fff00000c5ff7a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.648245] ==================================================================

[   12.134816] ==================================================================
[   12.136380] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x361/0x3c0
[   12.137222] Read of size 1 at addr ffff88810266b21f by task kunit_try_catch/155
[   12.137547] 
[   12.137907] CPU: 1 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   12.137957] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.137969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.137990] Call Trace:
[   12.138003]  <TASK>
[   12.138020]  dump_stack_lvl+0x73/0xb0
[   12.138052]  print_report+0xd1/0x650
[   12.138074]  ? __virt_addr_valid+0x1db/0x2d0
[   12.138098]  ? kmalloc_oob_left+0x361/0x3c0
[   12.138118]  ? kasan_complete_mode_report_info+0x64/0x200
[   12.138140]  ? kmalloc_oob_left+0x361/0x3c0
[   12.138161]  kasan_report+0x141/0x180
[   12.138182]  ? kmalloc_oob_left+0x361/0x3c0
[   12.138209]  __asan_report_load1_noabort+0x18/0x20
[   12.138234]  kmalloc_oob_left+0x361/0x3c0
[   12.138255]  ? __pfx_kmalloc_oob_left+0x10/0x10
[   12.138277]  ? __schedule+0x10cc/0x2b60
[   12.138299]  ? __pfx_read_tsc+0x10/0x10
[   12.138320]  ? ktime_get_ts64+0x86/0x230
[   12.138346]  kunit_try_run_case+0x1a5/0x480
[   12.138385]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.138408]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.138602]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.138633]  ? __kthread_parkme+0x82/0x180
[   12.138655]  ? preempt_count_sub+0x50/0x80
[   12.138679]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.138704]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.138728]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.138753]  kthread+0x337/0x6f0
[   12.138771]  ? trace_preempt_on+0x20/0xc0
[   12.138794]  ? __pfx_kthread+0x10/0x10
[   12.138814]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.138835]  ? calculate_sigpending+0x7b/0xa0
[   12.138859]  ? __pfx_kthread+0x10/0x10
[   12.138880]  ret_from_fork+0x116/0x1d0
[   12.138897]  ? __pfx_kthread+0x10/0x10
[   12.138917]  ret_from_fork_asm+0x1a/0x30
[   12.138948]  </TASK>
[   12.138959] 
[   12.154577] Allocated by task 1:
[   12.154992]  kasan_save_stack+0x45/0x70
[   12.155276]  kasan_save_track+0x18/0x40
[   12.155459]  kasan_save_alloc_info+0x3b/0x50
[   12.155812]  __kasan_kmalloc+0xb7/0xc0
[   12.155946]  __kmalloc_node_track_caller_noprof+0x1cb/0x500
[   12.156124]  kvasprintf+0xc5/0x150
[   12.156253]  __kthread_create_on_node+0x18b/0x3a0
[   12.156431]  kthread_create_on_node+0xab/0xe0
[   12.156708]  cryptomgr_notify+0x704/0x9f0
[   12.156909]  notifier_call_chain+0xcb/0x250
[   12.157179]  blocking_notifier_call_chain+0x64/0x90
[   12.157508]  crypto_alg_mod_lookup+0x21f/0x440
[   12.157722]  crypto_alloc_tfm_node+0xc5/0x1f0
[   12.157992]  crypto_alloc_sig+0x23/0x30
[   12.158225]  public_key_verify_signature+0x208/0x9f0
[   12.158571]  x509_check_for_self_signed+0x2cb/0x480
[   12.158898]  x509_cert_parse+0x59c/0x830
[   12.159131]  x509_key_preparse+0x68/0x8a0
[   12.159351]  asymmetric_key_preparse+0xb1/0x160
[   12.159637]  __key_create_or_update+0x43d/0xcc0
[   12.160029]  key_create_or_update+0x17/0x20
[   12.160253]  x509_load_certificate_list+0x174/0x200
[   12.160592]  regulatory_init_db+0xee/0x3a0
[   12.161163]  do_one_initcall+0xd8/0x370
[   12.161514]  kernel_init_freeable+0x420/0x6f0
[   12.161918]  kernel_init+0x23/0x1e0
[   12.162045]  ret_from_fork+0x116/0x1d0
[   12.162173]  ret_from_fork_asm+0x1a/0x30
[   12.162307] 
[   12.162497] Freed by task 0:
[   12.162903]  kasan_save_stack+0x45/0x70
[   12.163304]  kasan_save_track+0x18/0x40
[   12.163849]  kasan_save_free_info+0x3f/0x60
[   12.164269]  __kasan_slab_free+0x56/0x70
[   12.164776]  kfree+0x222/0x3f0
[   12.165110]  free_kthread_struct+0xeb/0x150
[   12.165633]  free_task+0xf3/0x130
[   12.165899]  __put_task_struct+0x1c8/0x480
[   12.166114]  delayed_put_task_struct+0x10a/0x150
[   12.166270]  rcu_core+0x66f/0x1c40
[   12.166433]  rcu_core_si+0x12/0x20
[   12.166796]  handle_softirqs+0x209/0x730
[   12.167234]  __irq_exit_rcu+0xc9/0x110
[   12.167723]  irq_exit_rcu+0x12/0x20
[   12.168063]  sysvec_apic_timer_interrupt+0x81/0x90
[   12.168478]  asm_sysvec_apic_timer_interrupt+0x1f/0x30
[   12.168781] 
[   12.168860] The buggy address belongs to the object at ffff88810266b200
[   12.168860]  which belongs to the cache kmalloc-16 of size 16
[   12.169203] The buggy address is located 15 bytes to the right of
[   12.169203]  allocated 16-byte region [ffff88810266b200, ffff88810266b210)
[   12.170009] 
[   12.170087] The buggy address belongs to the physical page:
[   12.170256] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10266b
[   12.170933] flags: 0x200000000000000(node=0|zone=2)
[   12.171472] page_type: f5(slab)
[   12.171869] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   12.172668] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   12.173190] page dumped because: kasan: bad access detected
[   12.173386] 
[   12.173521] Memory state around the buggy address:
[   12.173970]  ffff88810266b100: 00 02 fc fc 00 05 fc fc 00 02 fc fc 00 02 fc fc
[   12.174638]  ffff88810266b180: 00 02 fc fc 00 02 fc fc fa fb fc fc fa fb fc fc
[   12.175043] >ffff88810266b200: fa fb fc fc 00 07 fc fc fc fc fc fc fc fc fc fc
[   12.175250]                             ^
[   12.175390]  ffff88810266b280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.175709]  ffff88810266b300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.176054] ==================================================================