Date
July 13, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 15.918973] ================================================================== [ 15.919054] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300 [ 15.919103] Write of size 4 at addr fff00000c5866375 by task kunit_try_catch/175 [ 15.919151] [ 15.919181] CPU: 0 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 15.919274] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.919448] Hardware name: linux,dummy-virt (DT) [ 15.919596] Call trace: [ 15.919788] show_stack+0x20/0x38 (C) [ 15.919947] dump_stack_lvl+0x8c/0xd0 [ 15.920171] print_report+0x118/0x5d0 [ 15.920251] kasan_report+0xdc/0x128 [ 15.920380] kasan_check_range+0x100/0x1a8 [ 15.920429] __asan_memset+0x34/0x78 [ 15.920470] kmalloc_oob_memset_4+0x150/0x300 [ 15.920680] kunit_try_run_case+0x170/0x3f0 [ 15.921031] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.921112] kthread+0x328/0x630 [ 15.921348] ret_from_fork+0x10/0x20 [ 15.921453] [ 15.921473] Allocated by task 175: [ 15.921502] kasan_save_stack+0x3c/0x68 [ 15.921730] kasan_save_track+0x20/0x40 [ 15.921943] kasan_save_alloc_info+0x40/0x58 [ 15.922021] __kasan_kmalloc+0xd4/0xd8 [ 15.922128] __kmalloc_cache_noprof+0x16c/0x3c0 [ 15.922281] kmalloc_oob_memset_4+0xb0/0x300 [ 15.922363] kunit_try_run_case+0x170/0x3f0 [ 15.922427] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 15.922720] kthread+0x328/0x630 [ 15.922843] ret_from_fork+0x10/0x20 [ 15.922955] [ 15.923004] The buggy address belongs to the object at fff00000c5866300 [ 15.923004] which belongs to the cache kmalloc-128 of size 128 [ 15.923127] The buggy address is located 117 bytes inside of [ 15.923127] allocated 120-byte region [fff00000c5866300, fff00000c5866378) [ 15.923230] [ 15.923278] The buggy address belongs to the physical page: [ 15.923352] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105866 [ 15.923416] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 15.923489] page_type: f5(slab) [ 15.923647] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 15.923742] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.923791] page dumped because: kasan: bad access detected [ 15.923822] [ 15.923840] Memory state around the buggy address: [ 15.923872] fff00000c5866200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.923916] fff00000c5866280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.923969] >fff00000c5866300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 15.924020] ^ [ 15.924060] fff00000c5866380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.924101] fff00000c5866400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.924138] ==================================================================
[ 16.705041] ================================================================== [ 16.705101] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300 [ 16.705149] Write of size 4 at addr fff00000c5aae375 by task kunit_try_catch/175 [ 16.705212] [ 16.705263] CPU: 1 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.705344] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.705369] Hardware name: linux,dummy-virt (DT) [ 16.705399] Call trace: [ 16.705421] show_stack+0x20/0x38 (C) [ 16.705474] dump_stack_lvl+0x8c/0xd0 [ 16.705528] print_report+0x118/0x5d0 [ 16.705573] kasan_report+0xdc/0x128 [ 16.705625] kasan_check_range+0x100/0x1a8 [ 16.705673] __asan_memset+0x34/0x78 [ 16.705718] kmalloc_oob_memset_4+0x150/0x300 [ 16.705763] kunit_try_run_case+0x170/0x3f0 [ 16.705817] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.705868] kthread+0x328/0x630 [ 16.705908] ret_from_fork+0x10/0x20 [ 16.705954] [ 16.705977] Allocated by task 175: [ 16.706012] kasan_save_stack+0x3c/0x68 [ 16.706051] kasan_save_track+0x20/0x40 [ 16.706087] kasan_save_alloc_info+0x40/0x58 [ 16.706134] __kasan_kmalloc+0xd4/0xd8 [ 16.706189] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.706227] kmalloc_oob_memset_4+0xb0/0x300 [ 16.706263] kunit_try_run_case+0x170/0x3f0 [ 16.706413] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.706686] kthread+0x328/0x630 [ 16.706731] ret_from_fork+0x10/0x20 [ 16.706767] [ 16.706786] The buggy address belongs to the object at fff00000c5aae300 [ 16.706786] which belongs to the cache kmalloc-128 of size 128 [ 16.706844] The buggy address is located 117 bytes inside of [ 16.706844] allocated 120-byte region [fff00000c5aae300, fff00000c5aae378) [ 16.706905] [ 16.706924] The buggy address belongs to the physical page: [ 16.707003] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105aae [ 16.707296] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.707362] page_type: f5(slab) [ 16.707406] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 16.707471] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.707519] page dumped because: kasan: bad access detected [ 16.707550] [ 16.707567] Memory state around the buggy address: [ 16.707598] fff00000c5aae200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.707858] fff00000c5aae280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.707965] >fff00000c5aae300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.708174] ^ [ 16.708229] fff00000c5aae380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.708271] fff00000c5aae400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.708402] ==================================================================
[ 12.726697] ================================================================== [ 12.727215] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x166/0x330 [ 12.727470] Write of size 4 at addr ffff8881026b2b75 by task kunit_try_catch/191 [ 12.727986] [ 12.728138] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.728186] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.728199] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.728221] Call Trace: [ 12.728234] <TASK> [ 12.728251] dump_stack_lvl+0x73/0xb0 [ 12.728289] print_report+0xd1/0x610 [ 12.728312] ? __virt_addr_valid+0x1db/0x2d0 [ 12.728335] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.728357] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.728380] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.728403] kasan_report+0x141/0x180 [ 12.728424] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.728462] kasan_check_range+0x10c/0x1c0 [ 12.728487] __asan_memset+0x27/0x50 [ 12.728507] kmalloc_oob_memset_4+0x166/0x330 [ 12.728530] ? __pfx_kmalloc_oob_memset_4+0x10/0x10 [ 12.728553] ? __schedule+0x10cc/0x2b60 [ 12.728576] ? __pfx_read_tsc+0x10/0x10 [ 12.728598] ? ktime_get_ts64+0x86/0x230 [ 12.728873] kunit_try_run_case+0x1a5/0x480 [ 12.728904] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.728929] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.728954] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.728979] ? __kthread_parkme+0x82/0x180 [ 12.729001] ? preempt_count_sub+0x50/0x80 [ 12.729025] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.729050] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.729075] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.729101] kthread+0x337/0x6f0 [ 12.729120] ? trace_preempt_on+0x20/0xc0 [ 12.729144] ? __pfx_kthread+0x10/0x10 [ 12.729165] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.729187] ? calculate_sigpending+0x7b/0xa0 [ 12.729212] ? __pfx_kthread+0x10/0x10 [ 12.729234] ret_from_fork+0x116/0x1d0 [ 12.729254] ? __pfx_kthread+0x10/0x10 [ 12.729274] ret_from_fork_asm+0x1a/0x30 [ 12.729305] </TASK> [ 12.729316] [ 12.739222] Allocated by task 191: [ 12.739613] kasan_save_stack+0x45/0x70 [ 12.739819] kasan_save_track+0x18/0x40 [ 12.740002] kasan_save_alloc_info+0x3b/0x50 [ 12.740202] __kasan_kmalloc+0xb7/0xc0 [ 12.740386] __kmalloc_cache_noprof+0x189/0x420 [ 12.740949] kmalloc_oob_memset_4+0xac/0x330 [ 12.741143] kunit_try_run_case+0x1a5/0x480 [ 12.741486] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.741993] kthread+0x337/0x6f0 [ 12.742254] ret_from_fork+0x116/0x1d0 [ 12.742523] ret_from_fork_asm+0x1a/0x30 [ 12.742863] [ 12.743033] The buggy address belongs to the object at ffff8881026b2b00 [ 12.743033] which belongs to the cache kmalloc-128 of size 128 [ 12.743710] The buggy address is located 117 bytes inside of [ 12.743710] allocated 120-byte region [ffff8881026b2b00, ffff8881026b2b78) [ 12.744243] [ 12.744344] The buggy address belongs to the physical page: [ 12.745094] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1026b2 [ 12.746013] flags: 0x200000000000000(node=0|zone=2) [ 12.746647] page_type: f5(slab) [ 12.747218] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.747819] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.748054] page dumped because: kasan: bad access detected [ 12.748227] [ 12.748305] Memory state around the buggy address: [ 12.748548] ffff8881026b2a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.749537] ffff8881026b2a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.750270] >ffff8881026b2b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 12.751082] ^ [ 12.751990] ffff8881026b2b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.752654] ffff8881026b2c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.753107] ==================================================================
[ 12.978490] ================================================================== [ 12.979238] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x166/0x330 [ 12.979563] Write of size 4 at addr ffff888102594475 by task kunit_try_catch/192 [ 12.980014] [ 12.980137] CPU: 0 UID: 0 PID: 192 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.980181] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.980193] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.980212] Call Trace: [ 12.980223] <TASK> [ 12.980237] dump_stack_lvl+0x73/0xb0 [ 12.980302] print_report+0xd1/0x610 [ 12.980326] ? __virt_addr_valid+0x1db/0x2d0 [ 12.980350] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.980374] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.980398] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.980420] kasan_report+0x141/0x180 [ 12.980442] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.980489] kasan_check_range+0x10c/0x1c0 [ 12.980513] __asan_memset+0x27/0x50 [ 12.980533] kmalloc_oob_memset_4+0x166/0x330 [ 12.980556] ? __pfx_kmalloc_oob_memset_4+0x10/0x10 [ 12.980580] ? __schedule+0x10cc/0x2b60 [ 12.980602] ? __pfx_read_tsc+0x10/0x10 [ 12.980624] ? ktime_get_ts64+0x86/0x230 [ 12.980650] kunit_try_run_case+0x1a5/0x480 [ 12.980675] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.980698] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.980722] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.980746] ? __kthread_parkme+0x82/0x180 [ 12.980767] ? preempt_count_sub+0x50/0x80 [ 12.980791] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.980815] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.980840] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.980866] kthread+0x337/0x6f0 [ 12.980885] ? trace_preempt_on+0x20/0xc0 [ 12.980908] ? __pfx_kthread+0x10/0x10 [ 12.980929] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.980951] ? calculate_sigpending+0x7b/0xa0 [ 12.980975] ? __pfx_kthread+0x10/0x10 [ 12.980997] ret_from_fork+0x116/0x1d0 [ 12.981016] ? __pfx_kthread+0x10/0x10 [ 12.981036] ret_from_fork_asm+0x1a/0x30 [ 12.981078] </TASK> [ 12.981088] [ 12.988642] Allocated by task 192: [ 12.988831] kasan_save_stack+0x45/0x70 [ 12.988983] kasan_save_track+0x18/0x40 [ 12.989134] kasan_save_alloc_info+0x3b/0x50 [ 12.989448] __kasan_kmalloc+0xb7/0xc0 [ 12.989660] __kmalloc_cache_noprof+0x189/0x420 [ 12.990015] kmalloc_oob_memset_4+0xac/0x330 [ 12.990282] kunit_try_run_case+0x1a5/0x480 [ 12.990434] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.990613] kthread+0x337/0x6f0 [ 12.990807] ret_from_fork+0x116/0x1d0 [ 12.990994] ret_from_fork_asm+0x1a/0x30 [ 12.991200] [ 12.991284] The buggy address belongs to the object at ffff888102594400 [ 12.991284] which belongs to the cache kmalloc-128 of size 128 [ 12.991639] The buggy address is located 117 bytes inside of [ 12.991639] allocated 120-byte region [ffff888102594400, ffff888102594478) [ 12.992285] [ 12.992403] The buggy address belongs to the physical page: [ 12.992644] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102594 [ 12.992883] flags: 0x200000000000000(node=0|zone=2) [ 12.993122] page_type: f5(slab) [ 12.993339] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.993682] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.994014] page dumped because: kasan: bad access detected [ 12.994345] [ 12.994417] Memory state around the buggy address: [ 12.994571] ffff888102594300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.994891] ffff888102594380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.995256] >ffff888102594400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 12.995562] ^ [ 12.995794] ffff888102594480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.996137] ffff888102594500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.996404] ==================================================================