Date
July 17, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.042947] ================================================================== [ 15.043101] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 15.043264] Read of size 1 at addr fff00000c5d1d000 by task kunit_try_catch/141 [ 15.043317] [ 15.043351] CPU: 0 UID: 0 PID: 141 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.043436] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.043835] Hardware name: linux,dummy-virt (DT) [ 15.043993] Call trace: [ 15.044018] show_stack+0x20/0x38 (C) [ 15.044073] dump_stack_lvl+0x8c/0xd0 [ 15.044139] print_report+0x118/0x5d0 [ 15.044242] kasan_report+0xdc/0x128 [ 15.044456] __asan_report_load1_noabort+0x20/0x30 [ 15.044519] kmalloc_node_oob_right+0x2f4/0x330 [ 15.044565] kunit_try_run_case+0x170/0x3f0 [ 15.044620] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.044990] kthread+0x328/0x630 [ 15.045303] ret_from_fork+0x10/0x20 [ 15.045997] [ 15.046053] Allocated by task 141: [ 15.046117] kasan_save_stack+0x3c/0x68 [ 15.046169] kasan_save_track+0x20/0x40 [ 15.046204] kasan_save_alloc_info+0x40/0x58 [ 15.046488] __kasan_kmalloc+0xd4/0xd8 [ 15.046725] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 15.046992] kmalloc_node_oob_right+0xbc/0x330 [ 15.047089] kunit_try_run_case+0x170/0x3f0 [ 15.047137] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.047342] kthread+0x328/0x630 [ 15.047407] ret_from_fork+0x10/0x20 [ 15.047707] [ 15.047933] The buggy address belongs to the object at fff00000c5d1c000 [ 15.047933] which belongs to the cache kmalloc-4k of size 4096 [ 15.048065] The buggy address is located 0 bytes to the right of [ 15.048065] allocated 4096-byte region [fff00000c5d1c000, fff00000c5d1d000) [ 15.048213] [ 15.048332] The buggy address belongs to the physical page: [ 15.048523] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105d18 [ 15.049315] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.049518] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 15.049859] page_type: f5(slab) [ 15.049944] raw: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 15.050013] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 15.050411] head: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 15.050549] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 15.050906] head: 0bfffe0000000003 ffffc1ffc3174601 00000000ffffffff 00000000ffffffff [ 15.051154] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 15.051407] page dumped because: kasan: bad access detected [ 15.051697] [ 15.051856] Memory state around the buggy address: [ 15.051896] fff00000c5d1cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 15.051956] fff00000c5d1cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 15.052018] >fff00000c5d1d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.052056] ^ [ 15.052083] fff00000c5d1d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.052125] fff00000c5d1d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.052163] ==================================================================
[ 12.395965] ================================================================== [ 12.396609] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x369/0x3c0 [ 12.396944] Read of size 1 at addr ffff8881038c9000 by task kunit_try_catch/157 [ 12.397241] [ 12.397379] CPU: 1 UID: 0 PID: 157 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.397424] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.397436] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.397457] Call Trace: [ 12.397468] <TASK> [ 12.397484] dump_stack_lvl+0x73/0xb0 [ 12.397514] print_report+0xd1/0x610 [ 12.397536] ? __virt_addr_valid+0x1db/0x2d0 [ 12.397573] ? kmalloc_node_oob_right+0x369/0x3c0 [ 12.397597] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.397620] ? kmalloc_node_oob_right+0x369/0x3c0 [ 12.397644] kasan_report+0x141/0x180 [ 12.397665] ? kmalloc_node_oob_right+0x369/0x3c0 [ 12.397694] __asan_report_load1_noabort+0x18/0x20 [ 12.397719] kmalloc_node_oob_right+0x369/0x3c0 [ 12.397743] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 12.397768] ? __schedule+0x10cc/0x2b60 [ 12.397790] ? __pfx_read_tsc+0x10/0x10 [ 12.397812] ? ktime_get_ts64+0x86/0x230 [ 12.397838] kunit_try_run_case+0x1a5/0x480 [ 12.397864] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.397887] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.397911] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.397935] ? __kthread_parkme+0x82/0x180 [ 12.397956] ? preempt_count_sub+0x50/0x80 [ 12.397980] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.398004] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.398028] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.398054] kthread+0x337/0x6f0 [ 12.398072] ? trace_preempt_on+0x20/0xc0 [ 12.398096] ? __pfx_kthread+0x10/0x10 [ 12.398116] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.398137] ? calculate_sigpending+0x7b/0xa0 [ 12.398161] ? __pfx_kthread+0x10/0x10 [ 12.398183] ret_from_fork+0x116/0x1d0 [ 12.398201] ? __pfx_kthread+0x10/0x10 [ 12.398222] ret_from_fork_asm+0x1a/0x30 [ 12.398266] </TASK> [ 12.398276] [ 12.405523] Allocated by task 157: [ 12.405693] kasan_save_stack+0x45/0x70 [ 12.405896] kasan_save_track+0x18/0x40 [ 12.406067] kasan_save_alloc_info+0x3b/0x50 [ 12.408093] __kasan_kmalloc+0xb7/0xc0 [ 12.408363] __kmalloc_cache_node_noprof+0x188/0x420 [ 12.408653] kmalloc_node_oob_right+0xab/0x3c0 [ 12.408877] kunit_try_run_case+0x1a5/0x480 [ 12.409053] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.409323] kthread+0x337/0x6f0 [ 12.409454] ret_from_fork+0x116/0x1d0 [ 12.409621] ret_from_fork_asm+0x1a/0x30 [ 12.409789] [ 12.409885] The buggy address belongs to the object at ffff8881038c8000 [ 12.409885] which belongs to the cache kmalloc-4k of size 4096 [ 12.410395] The buggy address is located 0 bytes to the right of [ 12.410395] allocated 4096-byte region [ffff8881038c8000, ffff8881038c9000) [ 12.410803] [ 12.410892] The buggy address belongs to the physical page: [ 12.411148] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1038c8 [ 12.412084] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.413882] flags: 0x200000000000040(head|node=0|zone=2) [ 12.414329] page_type: f5(slab) [ 12.414545] raw: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 12.414830] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 12.415083] head: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 12.415511] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 12.415871] head: 0200000000000003 ffffea00040e3201 00000000ffffffff 00000000ffffffff [ 12.416175] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 12.416566] page dumped because: kasan: bad access detected [ 12.416826] [ 12.416921] Memory state around the buggy address: [ 12.417081] ffff8881038c8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.418152] ffff8881038c8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.418496] >ffff8881038c9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.418772] ^ [ 12.418921] ffff8881038c9080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.419180] ffff8881038c9100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.419567] ==================================================================