Date
July 11, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.682070] ================================================================== [ 16.682154] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x150/0x2f8 [ 16.682208] Write of size 2 at addr fff00000c6f3f577 by task kunit_try_catch/173 [ 16.682255] [ 16.682288] CPU: 0 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.682371] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.682397] Hardware name: linux,dummy-virt (DT) [ 16.682584] Call trace: [ 16.682634] show_stack+0x20/0x38 (C) [ 16.682685] dump_stack_lvl+0x8c/0xd0 [ 16.682759] print_report+0x118/0x608 [ 16.682805] kasan_report+0xdc/0x128 [ 16.682860] kasan_check_range+0x100/0x1a8 [ 16.682906] __asan_memset+0x34/0x78 [ 16.682947] kmalloc_oob_memset_2+0x150/0x2f8 [ 16.683126] kunit_try_run_case+0x170/0x3f0 [ 16.683276] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.683427] kthread+0x328/0x630 [ 16.683534] ret_from_fork+0x10/0x20 [ 16.683709] [ 16.683768] Allocated by task 173: [ 16.683795] kasan_save_stack+0x3c/0x68 [ 16.684056] kasan_save_track+0x20/0x40 [ 16.684283] kasan_save_alloc_info+0x40/0x58 [ 16.684372] __kasan_kmalloc+0xd4/0xd8 [ 16.684478] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.684551] kmalloc_oob_memset_2+0xb0/0x2f8 [ 16.684616] kunit_try_run_case+0x170/0x3f0 [ 16.684684] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.685128] kthread+0x328/0x630 [ 16.685261] ret_from_fork+0x10/0x20 [ 16.685326] [ 16.685598] The buggy address belongs to the object at fff00000c6f3f500 [ 16.685598] which belongs to the cache kmalloc-128 of size 128 [ 16.685793] The buggy address is located 119 bytes inside of [ 16.685793] allocated 120-byte region [fff00000c6f3f500, fff00000c6f3f578) [ 16.685922] [ 16.686022] The buggy address belongs to the physical page: [ 16.686058] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106f3f [ 16.686110] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.686457] page_type: f5(slab) [ 16.686609] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 16.686765] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.686890] page dumped because: kasan: bad access detected [ 16.686990] [ 16.687053] Memory state around the buggy address: [ 16.687085] fff00000c6f3f400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.687126] fff00000c6f3f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.687167] >fff00000c6f3f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.687203] ^ [ 16.687386] fff00000c6f3f580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.687445] fff00000c6f3f600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.687671] ==================================================================
[ 12.460456] ================================================================== [ 12.460963] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x166/0x330 [ 12.461371] Write of size 2 at addr ffff8881029f2c77 by task kunit_try_catch/189 [ 12.461657] [ 12.461764] CPU: 1 UID: 0 PID: 189 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.461802] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.461813] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.461832] Call Trace: [ 12.461842] <TASK> [ 12.461855] dump_stack_lvl+0x73/0xb0 [ 12.461883] print_report+0xd1/0x650 [ 12.461904] ? __virt_addr_valid+0x1db/0x2d0 [ 12.461996] ? kmalloc_oob_memset_2+0x166/0x330 [ 12.462019] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.462041] ? kmalloc_oob_memset_2+0x166/0x330 [ 12.462063] kasan_report+0x141/0x180 [ 12.462135] ? kmalloc_oob_memset_2+0x166/0x330 [ 12.462165] kasan_check_range+0x10c/0x1c0 [ 12.462189] __asan_memset+0x27/0x50 [ 12.462208] kmalloc_oob_memset_2+0x166/0x330 [ 12.462233] ? __pfx_kmalloc_oob_memset_2+0x10/0x10 [ 12.462256] ? __schedule+0x10cc/0x2b60 [ 12.462277] ? __pfx_read_tsc+0x10/0x10 [ 12.462299] ? ktime_get_ts64+0x86/0x230 [ 12.462324] kunit_try_run_case+0x1a5/0x480 [ 12.462350] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.462372] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.462395] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.462419] ? __kthread_parkme+0x82/0x180 [ 12.462438] ? preempt_count_sub+0x50/0x80 [ 12.462461] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.462485] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.462513] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.462538] kthread+0x337/0x6f0 [ 12.462556] ? trace_preempt_on+0x20/0xc0 [ 12.462579] ? __pfx_kthread+0x10/0x10 [ 12.462599] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.462620] ? calculate_sigpending+0x7b/0xa0 [ 12.462643] ? __pfx_kthread+0x10/0x10 [ 12.462664] ret_from_fork+0x116/0x1d0 [ 12.462681] ? __pfx_kthread+0x10/0x10 [ 12.462701] ret_from_fork_asm+0x1a/0x30 [ 12.462733] </TASK> [ 12.462742] [ 12.469896] Allocated by task 189: [ 12.470090] kasan_save_stack+0x45/0x70 [ 12.470459] kasan_save_track+0x18/0x40 [ 12.470658] kasan_save_alloc_info+0x3b/0x50 [ 12.470943] __kasan_kmalloc+0xb7/0xc0 [ 12.471177] __kmalloc_cache_noprof+0x189/0x420 [ 12.471389] kmalloc_oob_memset_2+0xac/0x330 [ 12.471561] kunit_try_run_case+0x1a5/0x480 [ 12.471767] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.472016] kthread+0x337/0x6f0 [ 12.472167] ret_from_fork+0x116/0x1d0 [ 12.472426] ret_from_fork_asm+0x1a/0x30 [ 12.472627] [ 12.472709] The buggy address belongs to the object at ffff8881029f2c00 [ 12.472709] which belongs to the cache kmalloc-128 of size 128 [ 12.473349] The buggy address is located 119 bytes inside of [ 12.473349] allocated 120-byte region [ffff8881029f2c00, ffff8881029f2c78) [ 12.473771] [ 12.473867] The buggy address belongs to the physical page: [ 12.474123] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029f2 [ 12.474458] flags: 0x200000000000000(node=0|zone=2) [ 12.474687] page_type: f5(slab) [ 12.474822] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.475060] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.475281] page dumped because: kasan: bad access detected [ 12.475449] [ 12.475592] Memory state around the buggy address: [ 12.475875] ffff8881029f2b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.476223] ffff8881029f2b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.476530] >ffff8881029f2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 12.476740] ^ [ 12.477043] ffff8881029f2c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.477366] ffff8881029f2d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.477688] ==================================================================