Date
July 18, 2025, 11:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.470988] ================================================================== [ 15.471070] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 15.471125] Read of size 18446744073709551614 at addr fff00000c3f54284 by task kunit_try_catch/180 [ 15.471497] [ 15.471551] CPU: 1 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.471687] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.471725] Hardware name: linux,dummy-virt (DT) [ 15.471757] Call trace: [ 15.471801] show_stack+0x20/0x38 (C) [ 15.472146] dump_stack_lvl+0x8c/0xd0 [ 15.472211] print_report+0x118/0x5d0 [ 15.472293] kasan_report+0xdc/0x128 [ 15.472356] kasan_check_range+0x100/0x1a8 [ 15.472404] __asan_memmove+0x3c/0x98 [ 15.472465] kmalloc_memmove_negative_size+0x154/0x2e0 [ 15.472516] kunit_try_run_case+0x170/0x3f0 [ 15.472566] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.472619] kthread+0x328/0x630 [ 15.472672] ret_from_fork+0x10/0x20 [ 15.472730] [ 15.472750] Allocated by task 180: [ 15.472778] kasan_save_stack+0x3c/0x68 [ 15.472831] kasan_save_track+0x20/0x40 [ 15.472869] kasan_save_alloc_info+0x40/0x58 [ 15.472908] __kasan_kmalloc+0xd4/0xd8 [ 15.472950] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.472988] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 15.473028] kunit_try_run_case+0x170/0x3f0 [ 15.473064] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.473107] kthread+0x328/0x630 [ 15.473144] ret_from_fork+0x10/0x20 [ 15.473180] [ 15.473199] The buggy address belongs to the object at fff00000c3f54280 [ 15.473199] which belongs to the cache kmalloc-64 of size 64 [ 15.473256] The buggy address is located 4 bytes inside of [ 15.473256] 64-byte region [fff00000c3f54280, fff00000c3f542c0) [ 15.473625] [ 15.473743] The buggy address belongs to the physical page: [ 15.473777] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103f54 [ 15.473833] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.473881] page_type: f5(slab) [ 15.473922] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 15.474553] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 15.474727] page dumped because: kasan: bad access detected [ 15.474976] [ 15.475107] Memory state around the buggy address: [ 15.475145] fff00000c3f54180: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 15.475571] fff00000c3f54200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 15.475662] >fff00000c3f54280: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 15.475702] ^ [ 15.475995] fff00000c3f54300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.477189] fff00000c3f54380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.477372] ==================================================================
[ 12.366309] ================================================================== [ 12.366945] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330 [ 12.368034] Read of size 18446744073709551614 at addr ffff8881029d4484 by task kunit_try_catch/199 [ 12.369412] [ 12.369663] CPU: 0 UID: 0 PID: 199 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.369712] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.369724] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.369746] Call Trace: [ 12.369759] <TASK> [ 12.369778] dump_stack_lvl+0x73/0xb0 [ 12.369811] print_report+0xd1/0x610 [ 12.369834] ? __virt_addr_valid+0x1db/0x2d0 [ 12.369858] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.369882] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.369904] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.369951] kasan_report+0x141/0x180 [ 12.369972] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.370002] kasan_check_range+0x10c/0x1c0 [ 12.370227] __asan_memmove+0x27/0x70 [ 12.370247] kmalloc_memmove_negative_size+0x171/0x330 [ 12.370273] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 12.370312] ? __schedule+0x10cc/0x2b60 [ 12.370336] ? __pfx_read_tsc+0x10/0x10 [ 12.370357] ? ktime_get_ts64+0x86/0x230 [ 12.370383] kunit_try_run_case+0x1a5/0x480 [ 12.370409] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.370431] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.370454] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.370477] ? __kthread_parkme+0x82/0x180 [ 12.370496] ? preempt_count_sub+0x50/0x80 [ 12.370520] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.370543] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.370566] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.370589] kthread+0x337/0x6f0 [ 12.370607] ? trace_preempt_on+0x20/0xc0 [ 12.370631] ? __pfx_kthread+0x10/0x10 [ 12.370650] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.370671] ? calculate_sigpending+0x7b/0xa0 [ 12.370695] ? __pfx_kthread+0x10/0x10 [ 12.370715] ret_from_fork+0x116/0x1d0 [ 12.370733] ? __pfx_kthread+0x10/0x10 [ 12.370753] ret_from_fork_asm+0x1a/0x30 [ 12.370784] </TASK> [ 12.370794] [ 12.385966] Allocated by task 199: [ 12.386116] kasan_save_stack+0x45/0x70 [ 12.386532] kasan_save_track+0x18/0x40 [ 12.386849] kasan_save_alloc_info+0x3b/0x50 [ 12.387018] __kasan_kmalloc+0xb7/0xc0 [ 12.387657] __kmalloc_cache_noprof+0x189/0x420 [ 12.387887] kmalloc_memmove_negative_size+0xac/0x330 [ 12.388187] kunit_try_run_case+0x1a5/0x480 [ 12.388476] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.388689] kthread+0x337/0x6f0 [ 12.389013] ret_from_fork+0x116/0x1d0 [ 12.389295] ret_from_fork_asm+0x1a/0x30 [ 12.389446] [ 12.389548] The buggy address belongs to the object at ffff8881029d4480 [ 12.389548] which belongs to the cache kmalloc-64 of size 64 [ 12.390009] The buggy address is located 4 bytes inside of [ 12.390009] 64-byte region [ffff8881029d4480, ffff8881029d44c0) [ 12.390903] [ 12.391220] The buggy address belongs to the physical page: [ 12.391498] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029d4 [ 12.391855] flags: 0x200000000000000(node=0|zone=2) [ 12.392268] page_type: f5(slab) [ 12.392439] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 12.392987] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 12.393440] page dumped because: kasan: bad access detected [ 12.393776] [ 12.393861] Memory state around the buggy address: [ 12.394058] ffff8881029d4380: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 12.394433] ffff8881029d4400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.394776] >ffff8881029d4480: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 12.395070] ^ [ 12.395669] ffff8881029d4500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.395975] ffff8881029d4580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.396460] ==================================================================