Date
Dec. 5, 2024, 2:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.038862] ================================================================== [ 29.040329] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 29.041554] Write of size 1 at addr fff00000c6489f00 by task kunit_try_catch/133 [ 29.042390] [ 29.042760] CPU: 1 UID: 0 PID: 133 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 29.043959] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.044488] Hardware name: linux,dummy-virt (DT) [ 29.045356] Call trace: [ 29.045838] show_stack+0x20/0x38 (C) [ 29.046487] dump_stack_lvl+0x8c/0xd0 [ 29.047005] print_report+0x118/0x5e0 [ 29.047863] kasan_report+0xc8/0x118 [ 29.048442] __asan_report_store1_noabort+0x20/0x30 [ 29.049198] kmalloc_big_oob_right+0x2a4/0x2f0 [ 29.049936] kunit_try_run_case+0x14c/0x3d0 [ 29.050510] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.051618] kthread+0x24c/0x2d0 [ 29.052126] ret_from_fork+0x10/0x20 [ 29.052682] [ 29.053028] Allocated by task 133: [ 29.053438] kasan_save_stack+0x3c/0x68 [ 29.054200] kasan_save_track+0x20/0x40 [ 29.054779] kasan_save_alloc_info+0x40/0x58 [ 29.055421] __kasan_kmalloc+0xd4/0xd8 [ 29.056242] __kmalloc_cache_noprof+0x15c/0x3c0 [ 29.056849] kmalloc_big_oob_right+0xb8/0x2f0 [ 29.057553] kunit_try_run_case+0x14c/0x3d0 [ 29.058146] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.059071] kthread+0x24c/0x2d0 [ 29.059994] ret_from_fork+0x10/0x20 [ 29.060588] [ 29.060989] The buggy address belongs to the object at fff00000c6488000 [ 29.060989] which belongs to the cache kmalloc-8k of size 8192 [ 29.062119] The buggy address is located 0 bytes to the right of [ 29.062119] allocated 7936-byte region [fff00000c6488000, fff00000c6489f00) [ 29.063534] [ 29.063850] The buggy address belongs to the physical page: [ 29.064480] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106488 [ 29.065470] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.066666] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.067515] page_type: f5(slab) [ 29.068246] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 29.069189] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 29.070094] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 29.070996] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 29.072155] head: 0bfffe0000000003 ffffc1ffc3192201 ffffffffffffffff 0000000000000000 [ 29.073083] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 29.073967] page dumped because: kasan: bad access detected [ 29.074693] [ 29.075028] Memory state around the buggy address: [ 29.075898] fff00000c6489e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.076818] fff00000c6489e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.077754] >fff00000c6489f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.078649] ^ [ 29.079146] fff00000c6489f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.080733] fff00000c648a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.081504] ==================================================================
[ 26.588590] ================================================================== [ 26.589612] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x318/0x370 [ 26.590641] Write of size 1 at addr ffff888102b9df00 by task kunit_try_catch/151 [ 26.592052] [ 26.592469] CPU: 1 UID: 0 PID: 151 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 26.593441] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.594005] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.595128] Call Trace: [ 26.595421] <TASK> [ 26.595743] dump_stack_lvl+0x73/0xb0 [ 26.596279] print_report+0xd1/0x640 [ 26.596564] ? __virt_addr_valid+0x1db/0x2d0 [ 26.597694] ? kasan_complete_mode_report_info+0x2a/0x200 [ 26.598419] kasan_report+0x102/0x140 [ 26.599365] ? kmalloc_big_oob_right+0x318/0x370 [ 26.599860] ? kmalloc_big_oob_right+0x318/0x370 [ 26.600850] __asan_report_store1_noabort+0x1b/0x30 [ 26.601618] kmalloc_big_oob_right+0x318/0x370 [ 26.602302] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 26.603306] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 26.604063] kunit_try_run_case+0x1b3/0x490 [ 26.604778] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.605482] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 26.606531] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.607041] ? __kthread_parkme+0x82/0x160 [ 26.607620] ? preempt_count_sub+0x50/0x80 [ 26.608517] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.609300] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.610191] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.610855] kthread+0x257/0x310 [ 26.611381] ? __pfx_kthread+0x10/0x10 [ 26.612319] ret_from_fork+0x41/0x80 [ 26.612663] ? __pfx_kthread+0x10/0x10 [ 26.613504] ret_from_fork_asm+0x1a/0x30 [ 26.613949] </TASK> [ 26.614508] [ 26.614752] Allocated by task 151: [ 26.615541] kasan_save_stack+0x3d/0x60 [ 26.616253] kasan_save_track+0x18/0x40 [ 26.616647] kasan_save_alloc_info+0x3b/0x50 [ 26.617470] __kasan_kmalloc+0xb7/0xc0 [ 26.618158] __kmalloc_cache_noprof+0x184/0x410 [ 26.618853] kmalloc_big_oob_right+0xaa/0x370 [ 26.619135] kunit_try_run_case+0x1b3/0x490 [ 26.620367] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.620848] kthread+0x257/0x310 [ 26.621292] ret_from_fork+0x41/0x80 [ 26.621655] ret_from_fork_asm+0x1a/0x30 [ 26.622318] [ 26.622484] The buggy address belongs to the object at ffff888102b9c000 [ 26.622484] which belongs to the cache kmalloc-8k of size 8192 [ 26.624040] The buggy address is located 0 bytes to the right of [ 26.624040] allocated 7936-byte region [ffff888102b9c000, ffff888102b9df00) [ 26.626267] [ 26.626729] The buggy address belongs to the physical page: [ 26.627427] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b98 [ 26.628941] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.630199] flags: 0x200000000000040(head|node=0|zone=2) [ 26.630870] page_type: f5(slab) [ 26.631269] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 26.632297] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 26.633316] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 26.634232] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 26.635213] head: 0200000000000003 ffffea00040ae601 ffffffffffffffff 0000000000000000 [ 26.636151] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 26.636949] page dumped because: kasan: bad access detected [ 26.637848] [ 26.638350] Memory state around the buggy address: [ 26.638884] ffff888102b9de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.639624] ffff888102b9de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.640519] >ffff888102b9df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.641576] ^ [ 26.641915] ffff888102b9df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.642716] ffff888102b9e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.643535] ==================================================================