Hay
Date
Nov. 27, 2024, 3:37 a.m.

Environment
qemu-arm64

[   54.573848] ==================================================================
[   54.575018] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x51c/0x5d0
[   54.575880] Read of size 1 at addr ffff80008010b7f8 by task kunit_try_catch/258
[   54.576836] 
[   54.578186] CPU: 1 UID: 0 PID: 258 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241127 #1
[   54.579378] Tainted: [B]=BAD_PAGE, [N]=TEST
[   54.579912] Hardware name: linux,dummy-virt (DT)
[   54.580465] Call trace:
[   54.580951]  show_stack+0x20/0x38 (C)
[   54.581595]  dump_stack_lvl+0x8c/0xd0
[   54.582100]  print_report+0x2fc/0x5e0
[   54.582757]  kasan_report+0xc8/0x118
[   54.583776]  __asan_report_load1_noabort+0x20/0x30
[   54.584393]  vmalloc_oob+0x51c/0x5d0
[   54.585036]  kunit_try_run_case+0x14c/0x3d0
[   54.586131]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.586877]  kthread+0x24c/0x2d0
[   54.587631]  ret_from_fork+0x10/0x20
[   54.588135] 
[   54.588522] The buggy address belongs to the virtual mapping at
[   54.588522]  [ffff80008010b000, ffff80008010d000) created by:
[   54.588522]  vmalloc_oob+0x98/0x5d0
[   54.591127] 
[   54.591456] The buggy address belongs to the physical page:
[   54.592044] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106125
[   54.593183] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   54.594550] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   54.595565] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   54.596417] page dumped because: kasan: bad access detected
[   54.597067] 
[   54.597442] Memory state around the buggy address:
[   54.598167]  ffff80008010b680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   54.599464]  ffff80008010b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   54.600910] >ffff80008010b780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8
[   54.602068]                                                                 ^
[   54.602853]  ffff80008010b800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   54.603621]  ffff80008010b880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   54.604631] ==================================================================
[   54.541649] ==================================================================
[   54.543186] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x578/0x5d0
[   54.544012] Read of size 1 at addr ffff80008010b7f3 by task kunit_try_catch/258
[   54.544716] 
[   54.545958] CPU: 1 UID: 0 PID: 258 Comm: kunit_try_catch Tainted: G    B            N 6.12.0-next-20241127 #1
[   54.547480] Tainted: [B]=BAD_PAGE, [N]=TEST
[   54.548151] Hardware name: linux,dummy-virt (DT)
[   54.549117] Call trace:
[   54.549532]  show_stack+0x20/0x38 (C)
[   54.550104]  dump_stack_lvl+0x8c/0xd0
[   54.550852]  print_report+0x2fc/0x5e0
[   54.551430]  kasan_report+0xc8/0x118
[   54.551984]  __asan_report_load1_noabort+0x20/0x30
[   54.552714]  vmalloc_oob+0x578/0x5d0
[   54.553441]  kunit_try_run_case+0x14c/0x3d0
[   54.554100]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.554828]  kthread+0x24c/0x2d0
[   54.555575]  ret_from_fork+0x10/0x20
[   54.556068] 
[   54.556370] The buggy address belongs to the virtual mapping at
[   54.556370]  [ffff80008010b000, ffff80008010d000) created by:
[   54.556370]  vmalloc_oob+0x98/0x5d0
[   54.558111] 
[   54.558517] The buggy address belongs to the physical page:
[   54.559755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106125
[   54.560934] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   54.562081] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   54.563168] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   54.564064] page dumped because: kasan: bad access detected
[   54.564763] 
[   54.565502] Memory state around the buggy address:
[   54.566148]  ffff80008010b680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   54.567111]  ffff80008010b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   54.567964] >ffff80008010b780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8
[   54.568830]                                                              ^
[   54.570026]  ffff80008010b800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   54.571740]  ffff80008010b880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   54.572543] ==================================================================