Date
July 19, 2025, 11:12 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 14.985561] ================================================================== [ 14.985634] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 14.985698] Read of size 1 at addr fff00000c610f000 by task kunit_try_catch/140 [ 14.985784] [ 14.985853] CPU: 1 UID: 0 PID: 140 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 14.985939] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.985966] Hardware name: linux,dummy-virt (DT) [ 14.985995] Call trace: [ 14.986017] show_stack+0x20/0x38 (C) [ 14.986065] dump_stack_lvl+0x8c/0xd0 [ 14.986112] print_report+0x118/0x5d0 [ 14.986158] kasan_report+0xdc/0x128 [ 14.986203] __asan_report_load1_noabort+0x20/0x30 [ 14.986254] kmalloc_node_oob_right+0x2f4/0x330 [ 14.986306] kunit_try_run_case+0x170/0x3f0 [ 14.986363] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 14.986415] kthread+0x328/0x630 [ 14.986457] ret_from_fork+0x10/0x20 [ 14.986504] [ 14.986521] Allocated by task 140: [ 14.986549] kasan_save_stack+0x3c/0x68 [ 14.986587] kasan_save_track+0x20/0x40 [ 14.986634] kasan_save_alloc_info+0x40/0x58 [ 14.986681] __kasan_kmalloc+0xd4/0xd8 [ 14.986867] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 14.986910] kmalloc_node_oob_right+0xbc/0x330 [ 14.987135] kunit_try_run_case+0x170/0x3f0 [ 14.987324] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 14.987456] kthread+0x328/0x630 [ 14.987489] ret_from_fork+0x10/0x20 [ 14.987523] [ 14.987559] The buggy address belongs to the object at fff00000c610e000 [ 14.987559] which belongs to the cache kmalloc-4k of size 4096 [ 14.987644] The buggy address is located 0 bytes to the right of [ 14.987644] allocated 4096-byte region [fff00000c610e000, fff00000c610f000) [ 14.987716] [ 14.987736] The buggy address belongs to the physical page: [ 14.987828] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106108 [ 14.988073] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 14.988127] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 14.988241] page_type: f5(slab) [ 14.988284] raw: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 14.988390] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 14.988586] head: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 14.988635] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 14.988683] head: 0bfffe0000000003 ffffc1ffc3184201 00000000ffffffff 00000000ffffffff [ 14.988744] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 14.988789] page dumped because: kasan: bad access detected [ 14.988819] [ 14.988838] Memory state around the buggy address: [ 14.988868] fff00000c610ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.989037] fff00000c610ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.989112] >fff00000c610f000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.989217] ^ [ 14.989308] fff00000c610f080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.989350] fff00000c610f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.989415] ==================================================================
[ 11.383132] ================================================================== [ 11.384310] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x369/0x3c0 [ 11.385048] Read of size 1 at addr ffff88810290d000 by task kunit_try_catch/157 [ 11.385471] [ 11.385702] CPU: 0 UID: 0 PID: 157 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 11.385765] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.385776] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.385809] Call Trace: [ 11.385821] <TASK> [ 11.385836] dump_stack_lvl+0x73/0xb0 [ 11.385865] print_report+0xd1/0x610 [ 11.385886] ? __virt_addr_valid+0x1db/0x2d0 [ 11.385909] ? kmalloc_node_oob_right+0x369/0x3c0 [ 11.385931] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.385952] ? kmalloc_node_oob_right+0x369/0x3c0 [ 11.385974] kasan_report+0x141/0x180 [ 11.385995] ? kmalloc_node_oob_right+0x369/0x3c0 [ 11.386032] __asan_report_load1_noabort+0x18/0x20 [ 11.386054] kmalloc_node_oob_right+0x369/0x3c0 [ 11.386076] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 11.386099] ? __schedule+0x10cc/0x2b60 [ 11.386121] ? __pfx_read_tsc+0x10/0x10 [ 11.386142] ? ktime_get_ts64+0x86/0x230 [ 11.386166] kunit_try_run_case+0x1a5/0x480 [ 11.386190] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.386211] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.386234] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.386255] ? __kthread_parkme+0x82/0x180 [ 11.386275] ? preempt_count_sub+0x50/0x80 [ 11.386297] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.386319] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.386340] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.386362] kthread+0x337/0x6f0 [ 11.386380] ? trace_preempt_on+0x20/0xc0 [ 11.386402] ? __pfx_kthread+0x10/0x10 [ 11.386619] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.386639] ? calculate_sigpending+0x7b/0xa0 [ 11.386663] ? __pfx_kthread+0x10/0x10 [ 11.386683] ret_from_fork+0x116/0x1d0 [ 11.386700] ? __pfx_kthread+0x10/0x10 [ 11.386719] ret_from_fork_asm+0x1a/0x30 [ 11.386749] </TASK> [ 11.386759] [ 11.399220] Allocated by task 157: [ 11.399353] kasan_save_stack+0x45/0x70 [ 11.399514] kasan_save_track+0x18/0x40 [ 11.399712] kasan_save_alloc_info+0x3b/0x50 [ 11.400175] __kasan_kmalloc+0xb7/0xc0 [ 11.400559] __kmalloc_cache_node_noprof+0x188/0x420 [ 11.401082] kmalloc_node_oob_right+0xab/0x3c0 [ 11.401542] kunit_try_run_case+0x1a5/0x480 [ 11.401839] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.402250] kthread+0x337/0x6f0 [ 11.402580] ret_from_fork+0x116/0x1d0 [ 11.402964] ret_from_fork_asm+0x1a/0x30 [ 11.403320] [ 11.403397] The buggy address belongs to the object at ffff88810290c000 [ 11.403397] which belongs to the cache kmalloc-4k of size 4096 [ 11.403854] The buggy address is located 0 bytes to the right of [ 11.403854] allocated 4096-byte region [ffff88810290c000, ffff88810290d000) [ 11.404597] [ 11.404675] The buggy address belongs to the physical page: [ 11.404934] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102908 [ 11.405381] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.406218] flags: 0x200000000000040(head|node=0|zone=2) [ 11.406828] page_type: f5(slab) [ 11.407128] raw: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 11.407951] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 11.408719] head: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 11.409279] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 11.410038] head: 0200000000000003 ffffea00040a4201 00000000ffffffff 00000000ffffffff [ 11.410450] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 11.411000] page dumped because: kasan: bad access detected [ 11.411545] [ 11.411669] Memory state around the buggy address: [ 11.411865] ffff88810290cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.412090] ffff88810290cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.412304] >ffff88810290d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.412723] ^ [ 11.412932] ffff88810290d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.413202] ffff88810290d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.413425] ==================================================================