Date
July 9, 2025, 11:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.730996] ================================================================== [ 16.731065] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x144/0x2d0 [ 16.731761] Write of size 128 at addr fff00000c638b800 by task kunit_try_catch/170 [ 16.731811] [ 16.732043] CPU: 1 UID: 0 PID: 170 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.732153] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.732179] Hardware name: linux,dummy-virt (DT) [ 16.732210] Call trace: [ 16.732233] show_stack+0x20/0x38 (C) [ 16.732380] dump_stack_lvl+0x8c/0xd0 [ 16.732428] print_report+0x118/0x608 [ 16.732524] kasan_report+0xdc/0x128 [ 16.732651] kasan_check_range+0x100/0x1a8 [ 16.732823] __asan_memset+0x34/0x78 [ 16.732865] kmalloc_oob_in_memset+0x144/0x2d0 [ 16.732910] kunit_try_run_case+0x170/0x3f0 [ 16.732957] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.733010] kthread+0x328/0x630 [ 16.733079] ret_from_fork+0x10/0x20 [ 16.733139] [ 16.733158] Allocated by task 170: [ 16.733979] kasan_save_stack+0x3c/0x68 [ 16.734051] kasan_save_track+0x20/0x40 [ 16.734098] kasan_save_alloc_info+0x40/0x58 [ 16.734149] __kasan_kmalloc+0xd4/0xd8 [ 16.734210] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.734502] kmalloc_oob_in_memset+0xb0/0x2d0 [ 16.734575] kunit_try_run_case+0x170/0x3f0 [ 16.734621] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.734663] kthread+0x328/0x630 [ 16.734695] ret_from_fork+0x10/0x20 [ 16.734731] [ 16.734750] The buggy address belongs to the object at fff00000c638b800 [ 16.734750] which belongs to the cache kmalloc-128 of size 128 [ 16.734940] The buggy address is located 0 bytes inside of [ 16.734940] allocated 120-byte region [fff00000c638b800, fff00000c638b878) [ 16.735060] [ 16.735109] The buggy address belongs to the physical page: [ 16.735177] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10638b [ 16.735233] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.735321] page_type: f5(slab) [ 16.735427] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 16.735527] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.735631] page dumped because: kasan: bad access detected [ 16.735717] [ 16.736027] Memory state around the buggy address: [ 16.736604] fff00000c638b700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.736681] fff00000c638b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.736732] >fff00000c638b800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.736769] ^ [ 16.736813] fff00000c638b880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.736853] fff00000c638b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.736895] ==================================================================
[ 12.615580] ================================================================== [ 12.616655] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x15f/0x320 [ 12.617012] Write of size 128 at addr ffff8881031db800 by task kunit_try_catch/187 [ 12.617403] [ 12.617521] CPU: 0 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.617576] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.617588] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.617607] Call Trace: [ 12.617618] <TASK> [ 12.617634] dump_stack_lvl+0x73/0xb0 [ 12.617676] print_report+0xd1/0x650 [ 12.617697] ? __virt_addr_valid+0x1db/0x2d0 [ 12.617730] ? kmalloc_oob_in_memset+0x15f/0x320 [ 12.617751] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.617783] ? kmalloc_oob_in_memset+0x15f/0x320 [ 12.617805] kasan_report+0x141/0x180 [ 12.617826] ? kmalloc_oob_in_memset+0x15f/0x320 [ 12.617863] kasan_check_range+0x10c/0x1c0 [ 12.617886] __asan_memset+0x27/0x50 [ 12.617905] kmalloc_oob_in_memset+0x15f/0x320 [ 12.617927] ? __pfx_kmalloc_oob_in_memset+0x10/0x10 [ 12.617950] ? __schedule+0x10cc/0x2b60 [ 12.617972] ? __pfx_read_tsc+0x10/0x10 [ 12.617993] ? ktime_get_ts64+0x86/0x230 [ 12.618017] kunit_try_run_case+0x1a5/0x480 [ 12.618093] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.618116] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.618165] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.618189] ? __kthread_parkme+0x82/0x180 [ 12.618218] ? preempt_count_sub+0x50/0x80 [ 12.618242] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.618266] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.618300] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.618325] kthread+0x337/0x6f0 [ 12.618343] ? trace_preempt_on+0x20/0xc0 [ 12.618367] ? __pfx_kthread+0x10/0x10 [ 12.618387] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.618408] ? calculate_sigpending+0x7b/0xa0 [ 12.618431] ? __pfx_kthread+0x10/0x10 [ 12.618452] ret_from_fork+0x116/0x1d0 [ 12.618470] ? __pfx_kthread+0x10/0x10 [ 12.618490] ret_from_fork_asm+0x1a/0x30 [ 12.618521] </TASK> [ 12.618531] [ 12.626412] Allocated by task 187: [ 12.626589] kasan_save_stack+0x45/0x70 [ 12.626747] kasan_save_track+0x18/0x40 [ 12.626925] kasan_save_alloc_info+0x3b/0x50 [ 12.627145] __kasan_kmalloc+0xb7/0xc0 [ 12.627358] __kmalloc_cache_noprof+0x189/0x420 [ 12.627575] kmalloc_oob_in_memset+0xac/0x320 [ 12.627755] kunit_try_run_case+0x1a5/0x480 [ 12.627962] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.628289] kthread+0x337/0x6f0 [ 12.628467] ret_from_fork+0x116/0x1d0 [ 12.628641] ret_from_fork_asm+0x1a/0x30 [ 12.628846] [ 12.628948] The buggy address belongs to the object at ffff8881031db800 [ 12.628948] which belongs to the cache kmalloc-128 of size 128 [ 12.629542] The buggy address is located 0 bytes inside of [ 12.629542] allocated 120-byte region [ffff8881031db800, ffff8881031db878) [ 12.629927] [ 12.630000] The buggy address belongs to the physical page: [ 12.630332] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1031db [ 12.630680] flags: 0x200000000000000(node=0|zone=2) [ 12.631066] page_type: f5(slab) [ 12.631213] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.631507] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.631933] page dumped because: kasan: bad access detected [ 12.632431] [ 12.632508] Memory state around the buggy address: [ 12.632664] ffff8881031db700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.632987] ffff8881031db780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.633406] >ffff8881031db800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 12.633728] ^ [ 12.634008] ffff8881031db880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.634342] ffff8881031db900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.634723] ==================================================================