Date
July 17, 2025, 11:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.351252] ================================================================== [ 16.351630] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.351911] Write of size 1 at addr fff00000c7901f00 by task kunit_try_catch/144 [ 16.352010] [ 16.352168] CPU: 1 UID: 0 PID: 144 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.352422] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.352544] Hardware name: linux,dummy-virt (DT) [ 16.352624] Call trace: [ 16.352669] show_stack+0x20/0x38 (C) [ 16.352975] dump_stack_lvl+0x8c/0xd0 [ 16.353205] print_report+0x118/0x5d0 [ 16.353441] kasan_report+0xdc/0x128 [ 16.353634] __asan_report_store1_noabort+0x20/0x30 [ 16.353838] kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.353905] kunit_try_run_case+0x170/0x3f0 [ 16.354204] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.354436] kthread+0x328/0x630 [ 16.354509] ret_from_fork+0x10/0x20 [ 16.354714] [ 16.354817] Allocated by task 144: [ 16.354871] kasan_save_stack+0x3c/0x68 [ 16.355140] kasan_save_track+0x20/0x40 [ 16.355296] kasan_save_alloc_info+0x40/0x58 [ 16.355712] __kasan_kmalloc+0xd4/0xd8 [ 16.355760] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.355896] kmalloc_big_oob_right+0xb8/0x2f0 [ 16.356097] kunit_try_run_case+0x170/0x3f0 [ 16.356153] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.356249] kthread+0x328/0x630 [ 16.356396] ret_from_fork+0x10/0x20 [ 16.356528] [ 16.356578] The buggy address belongs to the object at fff00000c7900000 [ 16.356578] which belongs to the cache kmalloc-8k of size 8192 [ 16.356656] The buggy address is located 0 bytes to the right of [ 16.356656] allocated 7936-byte region [fff00000c7900000, fff00000c7901f00) [ 16.356892] [ 16.357115] The buggy address belongs to the physical page: [ 16.357287] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107900 [ 16.357576] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.357830] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.357913] page_type: f5(slab) [ 16.358063] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.358231] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.358651] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.358922] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.359104] head: 0bfffe0000000003 ffffc1ffc31e4001 00000000ffffffff 00000000ffffffff [ 16.359172] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 16.359255] page dumped because: kasan: bad access detected [ 16.359321] [ 16.359380] Memory state around the buggy address: [ 16.359415] fff00000c7901e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.359490] fff00000c7901e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.359544] >fff00000c7901f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.359725] ^ [ 16.359778] fff00000c7901f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.359819] fff00000c7902000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.359891] ==================================================================
[ 11.697349] ================================================================== [ 11.697786] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 11.698036] Write of size 1 at addr ffff8881039f9f00 by task kunit_try_catch/161 [ 11.698766] [ 11.698875] CPU: 1 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 11.699230] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.699244] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.699267] Call Trace: [ 11.699281] <TASK> [ 11.699299] dump_stack_lvl+0x73/0xb0 [ 11.699342] print_report+0xd1/0x610 [ 11.699364] ? __virt_addr_valid+0x1db/0x2d0 [ 11.699388] ? kmalloc_big_oob_right+0x316/0x370 [ 11.699409] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.699431] ? kmalloc_big_oob_right+0x316/0x370 [ 11.699453] kasan_report+0x141/0x180 [ 11.699474] ? kmalloc_big_oob_right+0x316/0x370 [ 11.699502] __asan_report_store1_noabort+0x1b/0x30 [ 11.699525] kmalloc_big_oob_right+0x316/0x370 [ 11.699547] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 11.699570] ? __schedule+0x10cc/0x2b60 [ 11.699626] ? __pfx_read_tsc+0x10/0x10 [ 11.699648] ? ktime_get_ts64+0x86/0x230 [ 11.699674] kunit_try_run_case+0x1a5/0x480 [ 11.699700] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.699721] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.699746] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.699768] ? __kthread_parkme+0x82/0x180 [ 11.699789] ? preempt_count_sub+0x50/0x80 [ 11.699836] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.699859] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.699882] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.699905] kthread+0x337/0x6f0 [ 11.699923] ? trace_preempt_on+0x20/0xc0 [ 11.699947] ? __pfx_kthread+0x10/0x10 [ 11.699967] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.699988] ? calculate_sigpending+0x7b/0xa0 [ 11.700012] ? __pfx_kthread+0x10/0x10 [ 11.700033] ret_from_fork+0x116/0x1d0 [ 11.700061] ? __pfx_kthread+0x10/0x10 [ 11.700081] ret_from_fork_asm+0x1a/0x30 [ 11.700114] </TASK> [ 11.700124] [ 11.712580] Allocated by task 161: [ 11.713018] kasan_save_stack+0x45/0x70 [ 11.713406] kasan_save_track+0x18/0x40 [ 11.713781] kasan_save_alloc_info+0x3b/0x50 [ 11.714228] __kasan_kmalloc+0xb7/0xc0 [ 11.714656] __kmalloc_cache_noprof+0x189/0x420 [ 11.715148] kmalloc_big_oob_right+0xa9/0x370 [ 11.715542] kunit_try_run_case+0x1a5/0x480 [ 11.716155] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.716653] kthread+0x337/0x6f0 [ 11.716934] ret_from_fork+0x116/0x1d0 [ 11.717291] ret_from_fork_asm+0x1a/0x30 [ 11.717612] [ 11.717769] The buggy address belongs to the object at ffff8881039f8000 [ 11.717769] which belongs to the cache kmalloc-8k of size 8192 [ 11.718490] The buggy address is located 0 bytes to the right of [ 11.718490] allocated 7936-byte region [ffff8881039f8000, ffff8881039f9f00) [ 11.719372] [ 11.719533] The buggy address belongs to the physical page: [ 11.720243] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039f8 [ 11.721035] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.721287] flags: 0x200000000000040(head|node=0|zone=2) [ 11.721469] page_type: f5(slab) [ 11.721591] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.721875] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.722274] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.722603] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.722913] head: 0200000000000003 ffffea00040e7e01 00000000ffffffff 00000000ffffffff [ 11.723303] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 11.723600] page dumped because: kasan: bad access detected [ 11.723795] [ 11.723899] Memory state around the buggy address: [ 11.724139] ffff8881039f9e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.724411] ffff8881039f9e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.724896] >ffff8881039f9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.725334] ^ [ 11.725477] ffff8881039f9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.725755] ffff8881039fa000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.726144] ==================================================================