Date
Nov. 20, 2024, 6:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 35.688146] ================================================================== [ 35.689337] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 35.690548] Write of size 1 at addr fff00000c6729f00 by task kunit_try_catch/133 [ 35.691160] [ 35.691546] CPU: 1 UID: 0 PID: 133 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241120 #1 [ 35.692674] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.693229] Hardware name: linux,dummy-virt (DT) [ 35.693798] Call trace: [ 35.694211] show_stack+0x20/0x38 (C) [ 35.694854] dump_stack_lvl+0x8c/0xd0 [ 35.695423] print_report+0x118/0x5e0 [ 35.695910] kasan_report+0xc8/0x118 [ 35.696518] __asan_report_store1_noabort+0x20/0x30 [ 35.697203] kmalloc_big_oob_right+0x2a4/0x2f0 [ 35.697754] kunit_try_run_case+0x14c/0x3d0 [ 35.698638] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.699293] kthread+0x24c/0x2d0 [ 35.699950] ret_from_fork+0x10/0x20 [ 35.700513] [ 35.700790] Allocated by task 133: [ 35.701641] kasan_save_stack+0x3c/0x68 [ 35.702199] kasan_save_track+0x20/0x40 [ 35.702746] kasan_save_alloc_info+0x40/0x58 [ 35.703304] __kasan_kmalloc+0xd4/0xd8 [ 35.703890] __kmalloc_cache_noprof+0x15c/0x3c8 [ 35.704534] kmalloc_big_oob_right+0xb8/0x2f0 [ 35.705182] kunit_try_run_case+0x14c/0x3d0 [ 35.706217] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.706818] kthread+0x24c/0x2d0 [ 35.707332] ret_from_fork+0x10/0x20 [ 35.707832] [ 35.708142] The buggy address belongs to the object at fff00000c6728000 [ 35.708142] which belongs to the cache kmalloc-8k of size 8192 [ 35.709342] The buggy address is located 0 bytes to the right of [ 35.709342] allocated 7936-byte region [fff00000c6728000, fff00000c6729f00) [ 35.711293] [ 35.711660] The buggy address belongs to the physical page: [ 35.712274] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106728 [ 35.713932] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 35.714591] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 35.715362] page_type: f5(slab) [ 35.716027] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 35.716681] raw: 0000000000000000 0000000080020002 00000001f5000000 0000000000000000 [ 35.717533] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 35.718310] head: 0000000000000000 0000000080020002 00000001f5000000 0000000000000000 [ 35.719104] head: 0bfffe0000000003 ffffc1ffc319ca01 ffffffffffffffff 0000000000000000 [ 35.719918] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 35.720692] page dumped because: kasan: bad access detected [ 35.721315] [ 35.721904] Memory state around the buggy address: [ 35.722469] fff00000c6729e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.723377] fff00000c6729e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.724140] >fff00000c6729f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.724988] ^ [ 35.725662] fff00000c6729f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.726392] fff00000c672a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.727168] ==================================================================
[ 26.900795] ================================================================== [ 26.902701] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x318/0x370 [ 26.903742] Write of size 1 at addr ffff8881020edf00 by task kunit_try_catch/151 [ 26.904774] [ 26.904979] CPU: 0 UID: 0 PID: 151 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241120 #1 [ 26.905943] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.906940] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.908115] Call Trace: [ 26.908633] <TASK> [ 26.909459] dump_stack_lvl+0x73/0xb0 [ 26.910420] print_report+0xd1/0x640 [ 26.911002] ? __virt_addr_valid+0x1db/0x2d0 [ 26.911498] ? kasan_complete_mode_report_info+0x2a/0x200 [ 26.912570] kasan_report+0x102/0x140 [ 26.913382] ? kmalloc_big_oob_right+0x318/0x370 [ 26.914090] ? kmalloc_big_oob_right+0x318/0x370 [ 26.914757] __asan_report_store1_noabort+0x1b/0x30 [ 26.915752] kmalloc_big_oob_right+0x318/0x370 [ 26.916550] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 26.917639] ? __schedule+0xc3e/0x2790 [ 26.918094] ? __pfx_read_tsc+0x10/0x10 [ 26.918824] ? ktime_get_ts64+0x84/0x230 [ 26.919621] kunit_try_run_case+0x1b3/0x490 [ 26.920258] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.921176] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 26.921624] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.922928] ? __kthread_parkme+0x82/0x160 [ 26.923673] ? preempt_count_sub+0x50/0x80 [ 26.924433] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.924876] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.925778] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.926530] kthread+0x257/0x310 [ 26.927652] ? __pfx_kthread+0x10/0x10 [ 26.928058] ret_from_fork+0x41/0x80 [ 26.928877] ? __pfx_kthread+0x10/0x10 [ 26.929884] ret_from_fork_asm+0x1a/0x30 [ 26.930301] </TASK> [ 26.930485] [ 26.930593] Allocated by task 151: [ 26.930794] kasan_save_stack+0x3d/0x60 [ 26.930975] kasan_save_track+0x18/0x40 [ 26.931313] kasan_save_alloc_info+0x3b/0x50 [ 26.932753] __kasan_kmalloc+0xb7/0xc0 [ 26.933576] __kmalloc_cache_noprof+0x184/0x410 [ 26.934928] kmalloc_big_oob_right+0xaa/0x370 [ 26.935542] kunit_try_run_case+0x1b3/0x490 [ 26.936188] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.937057] kthread+0x257/0x310 [ 26.937845] ret_from_fork+0x41/0x80 [ 26.938948] ret_from_fork_asm+0x1a/0x30 [ 26.939634] [ 26.939821] The buggy address belongs to the object at ffff8881020ec000 [ 26.939821] which belongs to the cache kmalloc-8k of size 8192 [ 26.941021] The buggy address is located 0 bytes to the right of [ 26.941021] allocated 7936-byte region [ffff8881020ec000, ffff8881020edf00) [ 26.942543] [ 26.943371] The buggy address belongs to the physical page: [ 26.944112] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1020e8 [ 26.944768] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.945110] flags: 0x200000000000040(head|node=0|zone=2) [ 26.945333] page_type: f5(slab) [ 26.945489] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 26.946345] raw: 0000000000000000 0000000080020002 00000001f5000000 0000000000000000 [ 26.947126] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 26.948169] head: 0000000000000000 0000000080020002 00000001f5000000 0000000000000000 [ 26.949625] head: 0200000000000003 ffffea0004083a01 ffffffffffffffff 0000000000000000 [ 26.950377] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 26.951244] page dumped because: kasan: bad access detected [ 26.951780] [ 26.952024] Memory state around the buggy address: [ 26.952654] ffff8881020ede00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.953336] ffff8881020ede80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.953851] >ffff8881020edf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.955065] ^ [ 26.955722] ffff8881020edf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.956494] ffff8881020ee000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.957252] ==================================================================