Hay
Date
Dec. 4, 2024, 3:07 p.m.

Environment
qemu-arm64

[   39.032213] ==================================================================
[   39.033682] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x578/0x5d0
[   39.034698] Read of size 1 at addr ffff80008010b7f3 by task kunit_try_catch/257
[   39.036256] 
[   39.036588] CPU: 0 UID: 0 PID: 257 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   39.037553] Tainted: [B]=BAD_PAGE, [N]=TEST
[   39.038391] Hardware name: linux,dummy-virt (DT)
[   39.039015] Call trace:
[   39.039446]  show_stack+0x20/0x38 (C)
[   39.040167]  dump_stack_lvl+0x8c/0xd0
[   39.040698]  print_report+0x2fc/0x5e0
[   39.041319]  kasan_report+0xc8/0x118
[   39.042184]  __asan_report_load1_noabort+0x20/0x30
[   39.043221]  vmalloc_oob+0x578/0x5d0
[   39.044313]  kunit_try_run_case+0x14c/0x3d0
[   39.045088]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   39.046119]  kthread+0x24c/0x2d0
[   39.047247]  ret_from_fork+0x10/0x20
[   39.048037] 
[   39.048299] The buggy address belongs to the virtual mapping at
[   39.048299]  [ffff80008010b000, ffff80008010d000) created by:
[   39.048299]  vmalloc_oob+0x98/0x5d0
[   39.050296] 
[   39.050712] The buggy address belongs to the physical page:
[   39.052000] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10666d
[   39.053100] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   39.054111] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   39.055563] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   39.056442] page dumped because: kasan: bad access detected
[   39.057274] 
[   39.057707] Memory state around the buggy address:
[   39.058684]  ffff80008010b680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.060002]  ffff80008010b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.060755] >ffff80008010b780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8
[   39.061750]                                                              ^
[   39.063243]  ffff80008010b800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   39.064478]  ffff80008010b880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   39.065240] ==================================================================
[   39.068751] ==================================================================
[   39.070209] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x51c/0x5d0
[   39.071334] Read of size 1 at addr ffff80008010b7f8 by task kunit_try_catch/257
[   39.072591] 
[   39.073022] CPU: 0 UID: 0 PID: 257 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   39.074581] Tainted: [B]=BAD_PAGE, [N]=TEST
[   39.075031] Hardware name: linux,dummy-virt (DT)
[   39.075603] Call trace:
[   39.076022]  show_stack+0x20/0x38 (C)
[   39.076817]  dump_stack_lvl+0x8c/0xd0
[   39.077409]  print_report+0x2fc/0x5e0
[   39.078427]  kasan_report+0xc8/0x118
[   39.079010]  __asan_report_load1_noabort+0x20/0x30
[   39.079935]  vmalloc_oob+0x51c/0x5d0
[   39.080666]  kunit_try_run_case+0x14c/0x3d0
[   39.081319]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   39.082416]  kthread+0x24c/0x2d0
[   39.083267]  ret_from_fork+0x10/0x20
[   39.083886] 
[   39.084182] The buggy address belongs to the virtual mapping at
[   39.084182]  [ffff80008010b000, ffff80008010d000) created by:
[   39.084182]  vmalloc_oob+0x98/0x5d0
[   39.086397] 
[   39.086980] The buggy address belongs to the physical page:
[   39.088391] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10666d
[   39.089566] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   39.090988] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   39.092554] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   39.093928] page dumped because: kasan: bad access detected
[   39.094709] 
[   39.095036] Memory state around the buggy address:
[   39.095954]  ffff80008010b680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.096875]  ffff80008010b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.097996] >ffff80008010b780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8
[   39.099252]                                                                 ^
[   39.100912]  ffff80008010b800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   39.102589]  ffff80008010b880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[   39.104389] ==================================================================