Date
July 19, 2025, 11:11 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.392510] ================================================================== [ 15.392581] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x154/0x2e0 [ 15.392634] Read of size 64 at addr fff00000c63a8104 by task kunit_try_catch/183 [ 15.392684] [ 15.392715] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.392797] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.392824] Hardware name: linux,dummy-virt (DT) [ 15.392853] Call trace: [ 15.392878] show_stack+0x20/0x38 (C) [ 15.392942] dump_stack_lvl+0x8c/0xd0 [ 15.393011] print_report+0x118/0x5d0 [ 15.393157] kasan_report+0xdc/0x128 [ 15.393334] kasan_check_range+0x100/0x1a8 [ 15.393494] __asan_memmove+0x3c/0x98 [ 15.393549] kmalloc_memmove_invalid_size+0x154/0x2e0 [ 15.393597] kunit_try_run_case+0x170/0x3f0 [ 15.393642] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.393693] kthread+0x328/0x630 [ 15.393733] ret_from_fork+0x10/0x20 [ 15.393786] [ 15.393886] Allocated by task 183: [ 15.393975] kasan_save_stack+0x3c/0x68 [ 15.394640] kasan_save_track+0x20/0x40 [ 15.394848] kasan_save_alloc_info+0x40/0x58 [ 15.394896] __kasan_kmalloc+0xd4/0xd8 [ 15.394932] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.395299] kmalloc_memmove_invalid_size+0xb0/0x2e0 [ 15.395350] kunit_try_run_case+0x170/0x3f0 [ 15.395601] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.395653] kthread+0x328/0x630 [ 15.395685] ret_from_fork+0x10/0x20 [ 15.395733] [ 15.395760] The buggy address belongs to the object at fff00000c63a8100 [ 15.395760] which belongs to the cache kmalloc-64 of size 64 [ 15.395817] The buggy address is located 4 bytes inside of [ 15.395817] allocated 64-byte region [fff00000c63a8100, fff00000c63a8140) [ 15.395877] [ 15.396121] The buggy address belongs to the physical page: [ 15.396179] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1063a8 [ 15.396247] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.396295] page_type: f5(slab) [ 15.396334] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 15.396421] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 15.396526] page dumped because: kasan: bad access detected [ 15.396600] [ 15.396619] Memory state around the buggy address: [ 15.396653] fff00000c63a8000: 00 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc [ 15.396730] fff00000c63a8080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 15.396773] >fff00000c63a8100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 15.398025] ^ [ 15.398067] fff00000c63a8180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.398111] fff00000c63a8200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.398150] ==================================================================
[ 12.299845] ================================================================== [ 12.301649] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x16f/0x330 [ 12.302042] Read of size 64 at addr ffff8881027ea284 by task kunit_try_catch/200 [ 12.302599] [ 12.302849] CPU: 0 UID: 0 PID: 200 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.302897] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.302908] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.302930] Call Trace: [ 12.302943] <TASK> [ 12.302962] dump_stack_lvl+0x73/0xb0 [ 12.302994] print_report+0xd1/0x610 [ 12.303040] ? __virt_addr_valid+0x1db/0x2d0 [ 12.303109] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 12.303133] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.303155] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 12.303179] kasan_report+0x141/0x180 [ 12.303201] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 12.303230] kasan_check_range+0x10c/0x1c0 [ 12.303252] __asan_memmove+0x27/0x70 [ 12.303295] kmalloc_memmove_invalid_size+0x16f/0x330 [ 12.303319] ? __pfx_kmalloc_memmove_invalid_size+0x10/0x10 [ 12.303344] ? __schedule+0x10cc/0x2b60 [ 12.303366] ? __pfx_read_tsc+0x10/0x10 [ 12.303387] ? ktime_get_ts64+0x86/0x230 [ 12.303411] kunit_try_run_case+0x1a5/0x480 [ 12.303436] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.303458] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.303482] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.303516] ? __kthread_parkme+0x82/0x180 [ 12.303556] ? preempt_count_sub+0x50/0x80 [ 12.303580] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.303603] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.303626] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.303649] kthread+0x337/0x6f0 [ 12.303667] ? trace_preempt_on+0x20/0xc0 [ 12.303691] ? __pfx_kthread+0x10/0x10 [ 12.303710] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.303747] ? calculate_sigpending+0x7b/0xa0 [ 12.303771] ? __pfx_kthread+0x10/0x10 [ 12.303791] ret_from_fork+0x116/0x1d0 [ 12.303809] ? __pfx_kthread+0x10/0x10 [ 12.303829] ret_from_fork_asm+0x1a/0x30 [ 12.303859] </TASK> [ 12.303870] [ 12.312290] Allocated by task 200: [ 12.312485] kasan_save_stack+0x45/0x70 [ 12.312701] kasan_save_track+0x18/0x40 [ 12.312836] kasan_save_alloc_info+0x3b/0x50 [ 12.312984] __kasan_kmalloc+0xb7/0xc0 [ 12.313160] __kmalloc_cache_noprof+0x189/0x420 [ 12.313588] kmalloc_memmove_invalid_size+0xac/0x330 [ 12.313838] kunit_try_run_case+0x1a5/0x480 [ 12.314084] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.314394] kthread+0x337/0x6f0 [ 12.314579] ret_from_fork+0x116/0x1d0 [ 12.314722] ret_from_fork_asm+0x1a/0x30 [ 12.314862] [ 12.314932] The buggy address belongs to the object at ffff8881027ea280 [ 12.314932] which belongs to the cache kmalloc-64 of size 64 [ 12.315521] The buggy address is located 4 bytes inside of [ 12.315521] allocated 64-byte region [ffff8881027ea280, ffff8881027ea2c0) [ 12.316225] [ 12.316306] The buggy address belongs to the physical page: [ 12.316685] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1027ea [ 12.317048] flags: 0x200000000000000(node=0|zone=2) [ 12.317329] page_type: f5(slab) [ 12.317527] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 12.317883] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 12.318246] page dumped because: kasan: bad access detected [ 12.318501] [ 12.318594] Memory state around the buggy address: [ 12.318821] ffff8881027ea180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.319104] ffff8881027ea200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.319319] >ffff8881027ea280: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 12.319539] ^ [ 12.319925] ffff8881027ea300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.320593] ffff8881027ea380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.320995] ==================================================================