Hay
Date
Nov. 22, 2024, 6:35 a.m.

Environment
qemu-arm64
qemu-x86_64

[   35.007310] ==================================================================
[   35.008636] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x33c/0x428
[   35.009553] Read of size 1 at addr fff00000c6af50c8 by task kunit_try_catch/196
[   35.010466] 
[   35.010952] CPU: 0 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241122 #1
[   35.012128] Tainted: [B]=BAD_PAGE, [N]=TEST
[   35.013104] Hardware name: linux,dummy-virt (DT)
[   35.013889] Call trace:
[   35.014684]  show_stack+0x20/0x38 (C)
[   35.015665]  dump_stack_lvl+0x8c/0xd0
[   35.017102]  print_report+0x118/0x5e0
[   35.018074]  kasan_report+0xc8/0x118
[   35.019127]  __asan_report_load1_noabort+0x20/0x30
[   35.019928]  kmem_cache_oob+0x33c/0x428
[   35.020739]  kunit_try_run_case+0x14c/0x3d0
[   35.022319]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   35.023371]  kthread+0x24c/0x2d0
[   35.024118]  ret_from_fork+0x10/0x20
[   35.025582] 
[   35.026070] Allocated by task 196:
[   35.026619]  kasan_save_stack+0x3c/0x68
[   35.027164]  kasan_save_track+0x20/0x40
[   35.027880]  kasan_save_alloc_info+0x40/0x58
[   35.028540]  __kasan_slab_alloc+0xa8/0xb0
[   35.029180]  kmem_cache_alloc_noprof+0x108/0x3a0
[   35.029752]  kmem_cache_oob+0x12c/0x428
[   35.031148]  kunit_try_run_case+0x14c/0x3d0
[   35.031985]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   35.032692]  kthread+0x24c/0x2d0
[   35.033321]  ret_from_fork+0x10/0x20
[   35.034535] 
[   35.034896] The buggy address belongs to the object at fff00000c6af5000
[   35.034896]  which belongs to the cache test_cache of size 200
[   35.036333] The buggy address is located 0 bytes to the right of
[   35.036333]  allocated 200-byte region [fff00000c6af5000, fff00000c6af50c8)
[   35.038795] 
[   35.039234] The buggy address belongs to the physical page:
[   35.040043] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106af5
[   35.041730] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   35.042365] page_type: f5(slab)
[   35.043035] raw: 0bfffe0000000000 fff00000c408c280 dead000000000122 0000000000000000
[   35.044171] raw: 0000000000000000 00000000800f000f 00000001f5000000 0000000000000000
[   35.045558] page dumped because: kasan: bad access detected
[   35.046409] 
[   35.047207] Memory state around the buggy address:
[   35.049279]  fff00000c6af4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.051375]  fff00000c6af5000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   35.053498] >fff00000c6af5080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   35.054768]                                               ^
[   35.055512]  fff00000c6af5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.056845]  fff00000c6af5180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.057695] ==================================================================

[   26.189868] ==================================================================
[   26.191045] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x404/0x530
[   26.192554] Read of size 1 at addr ffff888102a110c8 by task kunit_try_catch/215
[   26.193339] 
[   26.193688] CPU: 1 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241122 #1
[   26.194975] Tainted: [B]=BAD_PAGE, [N]=TEST
[   26.195481] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   26.196378] Call Trace:
[   26.196715]  <TASK>
[   26.197075]  dump_stack_lvl+0x73/0xb0
[   26.197526]  print_report+0xd1/0x640
[   26.197924]  ? __virt_addr_valid+0x1db/0x2d0
[   26.198234]  ? kasan_complete_mode_report_info+0x2a/0x200
[   26.199182]  kasan_report+0x102/0x140
[   26.199675]  ? kmem_cache_oob+0x404/0x530
[   26.200289]  ? kmem_cache_oob+0x404/0x530
[   26.200819]  __asan_report_load1_noabort+0x18/0x20
[   26.201603]  kmem_cache_oob+0x404/0x530
[   26.202211]  ? __pfx_kmem_cache_oob+0x10/0x10
[   26.202695]  ? sysvec_apic_timer_interrupt+0x50/0x90
[   26.203362]  ? __pfx_kmem_cache_oob+0x10/0x10
[   26.204010]  kunit_try_run_case+0x1b3/0x490
[   26.204438]  ? __pfx_kunit_try_run_case+0x10/0x10
[   26.205122]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   26.205577]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   26.206319]  ? __kthread_parkme+0x82/0x160
[   26.206762]  ? preempt_count_sub+0x50/0x80
[   26.207441]  ? __pfx_kunit_try_run_case+0x10/0x10
[   26.207772]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   26.208569]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   26.209345]  kthread+0x257/0x310
[   26.209766]  ? __pfx_kthread+0x10/0x10
[   26.210447]  ret_from_fork+0x41/0x80
[   26.211055]  ? __pfx_kthread+0x10/0x10
[   26.211475]  ret_from_fork_asm+0x1a/0x30
[   26.212118]  </TASK>
[   26.212474] 
[   26.212688] Allocated by task 215:
[   26.213086]  kasan_save_stack+0x3d/0x60
[   26.213440]  kasan_save_track+0x18/0x40
[   26.214192]  kasan_save_alloc_info+0x3b/0x50
[   26.214714]  __kasan_slab_alloc+0x91/0xa0
[   26.215294]  kmem_cache_alloc_noprof+0x11e/0x3f0
[   26.215780]  kmem_cache_oob+0x158/0x530
[   26.216430]  kunit_try_run_case+0x1b3/0x490
[   26.216718]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   26.217453]  kthread+0x257/0x310
[   26.217805]  ret_from_fork+0x41/0x80
[   26.218500]  ret_from_fork_asm+0x1a/0x30
[   26.219029] 
[   26.219324] The buggy address belongs to the object at ffff888102a11000
[   26.219324]  which belongs to the cache test_cache of size 200
[   26.220345] The buggy address is located 0 bytes to the right of
[   26.220345]  allocated 200-byte region [ffff888102a11000, ffff888102a110c8)
[   26.221502] 
[   26.221701] The buggy address belongs to the physical page:
[   26.222033] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a11
[   26.222550] flags: 0x200000000000000(node=0|zone=2)
[   26.223053] page_type: f5(slab)
[   26.223414] raw: 0200000000000000 ffff888102a0e000 dead000000000122 0000000000000000
[   26.224314] raw: 0000000000000000 00000000800f000f 00000001f5000000 0000000000000000
[   26.225036] page dumped because: kasan: bad access detected
[   26.225601] 
[   26.225816] Memory state around the buggy address:
[   26.226509]  ffff888102a10f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.227096]  ffff888102a11000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   26.227798] >ffff888102a11080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   26.228471]                                               ^
[   26.228776]  ffff888102a11100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.229634]  ffff888102a11180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.230428] ==================================================================