Hay
Date
Dec. 4, 2024, 3:07 p.m.

Environment
qemu-arm64
qemu-x86_64

[   30.576959] ==================================================================
[   30.578833] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320
[   30.579811] Read of size 1 at addr fff00000c5b31cdf by task kunit_try_catch/126
[   30.580939] 
[   30.581375] CPU: 0 UID: 0 PID: 126 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   30.583001] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.583604] Hardware name: linux,dummy-virt (DT)
[   30.584355] Call trace:
[   30.584827]  show_stack+0x20/0x38 (C)
[   30.585430]  dump_stack_lvl+0x8c/0xd0
[   30.586096]  print_report+0x118/0x5e0
[   30.586803]  kasan_report+0xc8/0x118
[   30.587748]  __asan_report_load1_noabort+0x20/0x30
[   30.588413]  kmalloc_oob_left+0x2ec/0x320
[   30.589199]  kunit_try_run_case+0x14c/0x3d0
[   30.590054]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.590611]  kthread+0x24c/0x2d0
[   30.591158]  ret_from_fork+0x10/0x20
[   30.592191] 
[   30.592661] Allocated by task 28:
[   30.593153]  kasan_save_stack+0x3c/0x68
[   30.593817]  kasan_save_track+0x20/0x40
[   30.594586]  kasan_save_alloc_info+0x40/0x58
[   30.595355]  __kasan_kmalloc+0xd4/0xd8
[   30.596015]  __kmalloc_node_track_caller_noprof+0x184/0x4b8
[   30.596802]  kstrdup+0x54/0xc8
[   30.597317]  devtmpfs_work_loop+0x384/0x590
[   30.598034]  devtmpfsd+0x50/0x58
[   30.598596]  kthread+0x24c/0x2d0
[   30.599104]  ret_from_fork+0x10/0x20
[   30.600258] 
[   30.600977] Freed by task 28:
[   30.601525]  kasan_save_stack+0x3c/0x68
[   30.602125]  kasan_save_track+0x20/0x40
[   30.603180]  kasan_save_free_info+0x4c/0x78
[   30.603919]  __kasan_slab_free+0x6c/0x98
[   30.604364]  kfree+0x114/0x3c8
[   30.604784]  devtmpfs_work_loop+0x498/0x590
[   30.605292]  devtmpfsd+0x50/0x58
[   30.606131]  kthread+0x24c/0x2d0
[   30.606988]  ret_from_fork+0x10/0x20
[   30.607925] 
[   30.608369] The buggy address belongs to the object at fff00000c5b31cc0
[   30.608369]  which belongs to the cache kmalloc-16 of size 16
[   30.610132] The buggy address is located 15 bytes to the right of
[   30.610132]  allocated 16-byte region [fff00000c5b31cc0, fff00000c5b31cd0)
[   30.611924] 
[   30.612305] The buggy address belongs to the physical page:
[   30.613107] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b31
[   30.613960] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.615328] page_type: f5(slab)
[   30.615954] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   30.617011] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   30.618128] page dumped because: kasan: bad access detected
[   30.618718] 
[   30.619353] Memory state around the buggy address:
[   30.620188]  fff00000c5b31b80: fa fb fc fc 00 02 fc fc 00 02 fc fc 00 00 fc fc
[   30.620984]  fff00000c5b31c00: 00 06 fc fc 00 06 fc fc fa fb fc fc 00 06 fc fc
[   30.622644] >fff00000c5b31c80: 00 06 fc fc fa fb fc fc fa fb fc fc 00 07 fc fc
[   30.623401]                                                     ^
[   30.624428]  fff00000c5b31d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.625589]  fff00000c5b31d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.626604] ==================================================================

[   21.251853] ==================================================================
[   21.252922] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x363/0x3c0
[   21.253885] Read of size 1 at addr ffff8881027952ff by task kunit_try_catch/146
[   21.254907] 
[   21.255084] CPU: 1 UID: 0 PID: 146 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   21.256918] Tainted: [B]=BAD_PAGE, [N]=TEST
[   21.257398] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   21.259196] Call Trace:
[   21.260094]  <TASK>
[   21.260311]  dump_stack_lvl+0x73/0xb0
[   21.260993]  print_report+0xd1/0x640
[   21.261437]  ? __virt_addr_valid+0x1db/0x2d0
[   21.262243]  ? kasan_complete_mode_report_info+0x64/0x200
[   21.262878]  kasan_report+0x102/0x140
[   21.263871]  ? kmalloc_oob_left+0x363/0x3c0
[   21.264649]  ? kmalloc_oob_left+0x363/0x3c0
[   21.265147]  __asan_report_load1_noabort+0x18/0x20
[   21.265978]  kmalloc_oob_left+0x363/0x3c0
[   21.267149]  ? __pfx_kmalloc_oob_left+0x10/0x10
[   21.267844]  ? __schedule+0xc3e/0x2790
[   21.268218]  ? __pfx_read_tsc+0x10/0x10
[   21.268868]  ? ktime_get_ts64+0x86/0x230
[   21.269196]  kunit_try_run_case+0x1b3/0x490
[   21.269696]  ? __pfx_kunit_try_run_case+0x10/0x10
[   21.271153]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   21.272079]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   21.272918]  ? __kthread_parkme+0x82/0x160
[   21.273488]  ? preempt_count_sub+0x50/0x80
[   21.274009]  ? __pfx_kunit_try_run_case+0x10/0x10
[   21.274907]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   21.275885]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   21.276374]  kthread+0x257/0x310
[   21.276720]  ? __pfx_kthread+0x10/0x10
[   21.277094]  ret_from_fork+0x41/0x80
[   21.277446]  ? __pfx_kthread+0x10/0x10
[   21.278032]  ret_from_fork_asm+0x1a/0x30
[   21.279003]  </TASK>
[   21.280073] 
[   21.280454] Allocated by task 1:
[   21.280822]  kasan_save_stack+0x3d/0x60
[   21.281897]  kasan_save_track+0x18/0x40
[   21.282303]  kasan_save_alloc_info+0x3b/0x50
[   21.282777]  __kasan_kmalloc+0xb7/0xc0
[   21.283142]  __kmalloc_node_track_caller_noprof+0x1c6/0x500
[   21.283617]  kvasprintf+0xc6/0x150
[   21.284522]  __kthread_create_on_node+0x18c/0x3a0
[   21.285439]  kthread_create_on_node+0xa8/0xe0
[   21.286080]  cryptomgr_notify+0x704/0x9f0
[   21.286788]  notifier_call_chain+0xcb/0x250
[   21.287205]  blocking_notifier_call_chain+0x64/0x90
[   21.287909]  crypto_alg_mod_lookup+0x214/0x420
[   21.288876]  crypto_alloc_tfm_node+0xc5/0x1f0
[   21.290004]  crypto_alloc_sig+0x23/0x30
[   21.290523]  public_key_verify_signature+0x1b1/0x990
[   21.291258]  x509_check_for_self_signed+0x2cb/0x480
[   21.291938]  x509_cert_parse+0x59c/0x830
[   21.292588]  x509_key_preparse+0x68/0x8a0
[   21.293026]  asymmetric_key_preparse+0xb1/0x160
[   21.293791]  __key_create_or_update+0x407/0xc90
[   21.294291]  key_create_or_update+0x17/0x20
[   21.294801]  x509_load_certificate_list+0x174/0x200
[   21.296228]  regulatory_init_db+0xee/0x3a0
[   21.296793]  do_one_initcall+0xb5/0x370
[   21.297372]  kernel_init_freeable+0x425/0x6f0
[   21.297859]  kernel_init+0x23/0x1e0
[   21.298426]  ret_from_fork+0x41/0x80
[   21.298895]  ret_from_fork_asm+0x1a/0x30
[   21.299209] 
[   21.299545] Freed by task 0:
[   21.300076]  kasan_save_stack+0x3d/0x60
[   21.301146]  kasan_save_track+0x18/0x40
[   21.301826]  kasan_save_free_info+0x3f/0x60
[   21.302256]  __kasan_slab_free+0x56/0x70
[   21.302528]  kfree+0x123/0x3f0
[   21.303169]  free_kthread_struct+0xeb/0x150
[   21.303664]  free_task+0xf3/0x130
[   21.304021]  __put_task_struct+0x1c8/0x480
[   21.305703]  delayed_put_task_struct+0x10a/0x150
[   21.306092]  rcu_core+0x680/0x1d70
[   21.306550]  rcu_core_si+0x12/0x20
[   21.307188]  handle_softirqs+0x209/0x720
[   21.307581]  __irq_exit_rcu+0xc9/0x110
[   21.308154]  irq_exit_rcu+0x12/0x20
[   21.308512]  sysvec_apic_timer_interrupt+0x81/0x90
[   21.309688]  asm_sysvec_apic_timer_interrupt+0x1f/0x30
[   21.310505] 
[   21.310846] The buggy address belongs to the object at ffff8881027952e0
[   21.310846]  which belongs to the cache kmalloc-16 of size 16
[   21.311886] The buggy address is located 15 bytes to the right of
[   21.311886]  allocated 16-byte region [ffff8881027952e0, ffff8881027952f0)
[   21.313399] 
[   21.313630] The buggy address belongs to the physical page:
[   21.314140] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102795
[   21.315363] flags: 0x200000000000000(node=0|zone=2)
[   21.315910] page_type: f5(slab)
[   21.316663] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   21.317504] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   21.318508] page dumped because: kasan: bad access detected
[   21.318976] 
[   21.319590] Memory state around the buggy address:
[   21.320351]  ffff888102795180: 00 02 fc fc 00 03 fc fc fa fb fc fc 00 02 fc fc
[   21.321114]  ffff888102795200: 00 05 fc fc 00 02 fc fc 00 02 fc fc 00 02 fc fc
[   21.321956] >ffff888102795280: 00 02 fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   21.322910]                                                                 ^
[   21.323610]  ffff888102795300: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   21.325310]  ffff888102795380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   21.325662] ==================================================================