Date
Dec. 3, 2024, 11:38 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.159038] ================================================================== [ 29.160127] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 29.161314] Read of size 1 at addr fff00000c640d000 by task kunit_try_catch/129 [ 29.162270] [ 29.162637] CPU: 1 UID: 0 PID: 129 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 29.164112] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.165266] Hardware name: linux,dummy-virt (DT) [ 29.165921] Call trace: [ 29.166342] show_stack+0x20/0x38 (C) [ 29.167015] dump_stack_lvl+0x8c/0xd0 [ 29.167710] print_report+0x118/0x5e0 [ 29.168261] kasan_report+0xc8/0x118 [ 29.168845] __asan_report_load1_noabort+0x20/0x30 [ 29.169522] kmalloc_node_oob_right+0x2f4/0x330 [ 29.170142] kunit_try_run_case+0x14c/0x3d0 [ 29.170832] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.171541] kthread+0x24c/0x2d0 [ 29.172044] ret_from_fork+0x10/0x20 [ 29.172716] [ 29.173000] Allocated by task 129: [ 29.173814] kasan_save_stack+0x3c/0x68 [ 29.174537] kasan_save_track+0x20/0x40 [ 29.175133] kasan_save_alloc_info+0x40/0x58 [ 29.176111] __kasan_kmalloc+0xd4/0xd8 [ 29.176682] __kmalloc_cache_node_noprof+0x168/0x3d0 [ 29.177465] kmalloc_node_oob_right+0xbc/0x330 [ 29.178154] kunit_try_run_case+0x14c/0x3d0 [ 29.178855] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.179736] kthread+0x24c/0x2d0 [ 29.180239] ret_from_fork+0x10/0x20 [ 29.180814] [ 29.181873] The buggy address belongs to the object at fff00000c640c000 [ 29.181873] which belongs to the cache kmalloc-4k of size 4096 [ 29.183257] The buggy address is located 0 bytes to the right of [ 29.183257] allocated 4096-byte region [fff00000c640c000, fff00000c640d000) [ 29.184654] [ 29.184954] The buggy address belongs to the physical page: [ 29.186136] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106408 [ 29.187589] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.188487] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.189384] page_type: f5(slab) [ 29.189915] raw: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 29.190754] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 29.192070] head: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 29.193097] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 29.194117] head: 0bfffe0000000003 ffffc1ffc3190201 ffffffffffffffff 0000000000000000 [ 29.195053] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 29.195981] page dumped because: kasan: bad access detected [ 29.196796] [ 29.197070] Memory state around the buggy address: [ 29.198101] fff00000c640cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.198948] fff00000c640cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.200828] >fff00000c640d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.201858] ^ [ 29.202426] fff00000c640d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.203515] fff00000c640d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.204482] ==================================================================
[ 24.776172] ================================================================== [ 24.776828] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x36b/0x3d0 [ 24.777600] Read of size 1 at addr ffff88810281b000 by task kunit_try_catch/149 [ 24.778237] [ 24.778616] CPU: 0 UID: 0 PID: 149 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241203 #1 [ 24.779677] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.779983] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.781191] Call Trace: [ 24.781593] <TASK> [ 24.782114] dump_stack_lvl+0x73/0xb0 [ 24.783607] print_report+0xd1/0x640 [ 24.784119] ? __virt_addr_valid+0x1db/0x2d0 [ 24.784887] ? kasan_complete_mode_report_info+0x2a/0x200 [ 24.785396] kasan_report+0x102/0x140 [ 24.785726] ? kmalloc_node_oob_right+0x36b/0x3d0 [ 24.786236] ? kmalloc_node_oob_right+0x36b/0x3d0 [ 24.786717] __asan_report_load1_noabort+0x18/0x20 [ 24.787383] kmalloc_node_oob_right+0x36b/0x3d0 [ 24.788482] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 24.788767] ? __schedule+0xc3e/0x2790 [ 24.789469] ? __pfx_read_tsc+0x10/0x10 [ 24.790002] ? ktime_get_ts64+0x86/0x230 [ 24.790344] kunit_try_run_case+0x1b3/0x490 [ 24.790943] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.791488] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 24.791833] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.792518] ? __kthread_parkme+0x82/0x160 [ 24.793471] ? preempt_count_sub+0x50/0x80 [ 24.793887] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.794206] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.794968] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.795607] kthread+0x257/0x310 [ 24.796091] ? __pfx_kthread+0x10/0x10 [ 24.796488] ret_from_fork+0x41/0x80 [ 24.796935] ? __pfx_kthread+0x10/0x10 [ 24.797516] ret_from_fork_asm+0x1a/0x30 [ 24.798114] </TASK> [ 24.798381] [ 24.798878] Allocated by task 149: [ 24.799377] kasan_save_stack+0x3d/0x60 [ 24.799937] kasan_save_track+0x18/0x40 [ 24.800338] kasan_save_alloc_info+0x3b/0x50 [ 24.800793] __kasan_kmalloc+0xb7/0xc0 [ 24.800998] __kmalloc_cache_node_noprof+0x183/0x410 [ 24.801458] kmalloc_node_oob_right+0xac/0x3d0 [ 24.802401] kunit_try_run_case+0x1b3/0x490 [ 24.803417] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.804261] kthread+0x257/0x310 [ 24.804714] ret_from_fork+0x41/0x80 [ 24.805101] ret_from_fork_asm+0x1a/0x30 [ 24.805959] [ 24.806186] The buggy address belongs to the object at ffff88810281a000 [ 24.806186] which belongs to the cache kmalloc-4k of size 4096 [ 24.807322] The buggy address is located 0 bytes to the right of [ 24.807322] allocated 4096-byte region [ffff88810281a000, ffff88810281b000) [ 24.808376] [ 24.809006] The buggy address belongs to the physical page: [ 24.809669] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102818 [ 24.811217] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.811752] flags: 0x200000000000040(head|node=0|zone=2) [ 24.812357] page_type: f5(slab) [ 24.813439] raw: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 24.814126] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 24.814741] head: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 24.815293] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 24.816200] head: 0200000000000003 ffffea00040a0601 ffffffffffffffff 0000000000000000 [ 24.816842] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 24.817918] page dumped because: kasan: bad access detected [ 24.818179] [ 24.818265] Memory state around the buggy address: [ 24.818424] ffff88810281af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.819423] ffff88810281af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.820249] >ffff88810281b000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.821881] ^ [ 24.822177] ffff88810281b080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.823148] ffff88810281b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.824097] ==================================================================