Date
July 20, 2025, 11:12 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.396885] ================================================================== [ 15.397096] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 15.397151] Read of size 18446744073709551614 at addr fff00000c7010304 by task kunit_try_catch/180 [ 15.397258] [ 15.397306] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.397404] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.397463] Hardware name: linux,dummy-virt (DT) [ 15.397508] Call trace: [ 15.397533] show_stack+0x20/0x38 (C) [ 15.397581] dump_stack_lvl+0x8c/0xd0 [ 15.397626] print_report+0x118/0x5d0 [ 15.397818] kasan_report+0xdc/0x128 [ 15.397871] kasan_check_range+0x100/0x1a8 [ 15.398222] __asan_memmove+0x3c/0x98 [ 15.398312] kmalloc_memmove_negative_size+0x154/0x2e0 [ 15.398363] kunit_try_run_case+0x170/0x3f0 [ 15.398451] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.398514] kthread+0x328/0x630 [ 15.398555] ret_from_fork+0x10/0x20 [ 15.398601] [ 15.398620] Allocated by task 180: [ 15.398646] kasan_save_stack+0x3c/0x68 [ 15.398705] kasan_save_track+0x20/0x40 [ 15.398742] kasan_save_alloc_info+0x40/0x58 [ 15.398780] __kasan_kmalloc+0xd4/0xd8 [ 15.398816] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.398860] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 15.398901] kunit_try_run_case+0x170/0x3f0 [ 15.398937] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.398986] kthread+0x328/0x630 [ 15.399024] ret_from_fork+0x10/0x20 [ 15.399079] [ 15.399101] The buggy address belongs to the object at fff00000c7010300 [ 15.399101] which belongs to the cache kmalloc-64 of size 64 [ 15.399155] The buggy address is located 4 bytes inside of [ 15.399155] 64-byte region [fff00000c7010300, fff00000c7010340) [ 15.399210] [ 15.399341] The buggy address belongs to the physical page: [ 15.399372] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107010 [ 15.399423] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.399468] page_type: f5(slab) [ 15.399505] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 15.400367] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 15.400468] page dumped because: kasan: bad access detected [ 15.400548] [ 15.400605] Memory state around the buggy address: [ 15.400723] fff00000c7010200: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 15.400782] fff00000c7010280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 15.400825] >fff00000c7010300: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 15.401065] ^ [ 15.401304] fff00000c7010380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.401581] fff00000c7010400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.401825] ==================================================================
[ 12.485514] ================================================================== [ 12.486692] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330 [ 12.487770] Read of size 18446744073709551614 at addr ffff888102736004 by task kunit_try_catch/197 [ 12.488244] [ 12.488341] CPU: 1 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.488745] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.488757] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.488778] Call Trace: [ 12.488790] <TASK> [ 12.488807] dump_stack_lvl+0x73/0xb0 [ 12.488847] print_report+0xd1/0x610 [ 12.488868] ? __virt_addr_valid+0x1db/0x2d0 [ 12.488889] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.488920] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.488941] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.488987] kasan_report+0x141/0x180 [ 12.489008] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.489036] kasan_check_range+0x10c/0x1c0 [ 12.489058] __asan_memmove+0x27/0x70 [ 12.489077] kmalloc_memmove_negative_size+0x171/0x330 [ 12.489100] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 12.489124] ? __schedule+0x10cc/0x2b60 [ 12.489145] ? __pfx_read_tsc+0x10/0x10 [ 12.489164] ? ktime_get_ts64+0x86/0x230 [ 12.489187] kunit_try_run_case+0x1a5/0x480 [ 12.489209] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.489230] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.489251] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.489273] ? __kthread_parkme+0x82/0x180 [ 12.489292] ? preempt_count_sub+0x50/0x80 [ 12.489314] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.489336] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.489391] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.489413] kthread+0x337/0x6f0 [ 12.489432] ? trace_preempt_on+0x20/0xc0 [ 12.489454] ? __pfx_kthread+0x10/0x10 [ 12.489473] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.489492] ? calculate_sigpending+0x7b/0xa0 [ 12.489514] ? __pfx_kthread+0x10/0x10 [ 12.489534] ret_from_fork+0x116/0x1d0 [ 12.489551] ? __pfx_kthread+0x10/0x10 [ 12.489570] ret_from_fork_asm+0x1a/0x30 [ 12.489599] </TASK> [ 12.489609] [ 12.503167] Allocated by task 197: [ 12.503489] kasan_save_stack+0x45/0x70 [ 12.504072] kasan_save_track+0x18/0x40 [ 12.504579] kasan_save_alloc_info+0x3b/0x50 [ 12.504760] __kasan_kmalloc+0xb7/0xc0 [ 12.505108] __kmalloc_cache_noprof+0x189/0x420 [ 12.505587] kmalloc_memmove_negative_size+0xac/0x330 [ 12.505948] kunit_try_run_case+0x1a5/0x480 [ 12.506092] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.506259] kthread+0x337/0x6f0 [ 12.506463] ret_from_fork+0x116/0x1d0 [ 12.506836] ret_from_fork_asm+0x1a/0x30 [ 12.507263] [ 12.507442] The buggy address belongs to the object at ffff888102736000 [ 12.507442] which belongs to the cache kmalloc-64 of size 64 [ 12.508659] The buggy address is located 4 bytes inside of [ 12.508659] 64-byte region [ffff888102736000, ffff888102736040) [ 12.509323] [ 12.509573] The buggy address belongs to the physical page: [ 12.510158] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102736 [ 12.510679] flags: 0x200000000000000(node=0|zone=2) [ 12.510847] page_type: f5(slab) [ 12.510980] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 12.511208] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 12.511662] page dumped because: kasan: bad access detected [ 12.512214] [ 12.512426] Memory state around the buggy address: [ 12.512941] ffff888102735f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.513673] ffff888102735f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.514298] >ffff888102736000: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 12.515011] ^ [ 12.515375] ffff888102736080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.516125] ffff888102736100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.516343] ==================================================================