Date
Dec. 5, 2024, 2:07 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 28.989574] ================================================================== [ 28.990386] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x420/0x490 [ 28.991605] Write of size 1 at addr fff00000c62b1e78 by task kunit_try_catch/131 [ 28.992458] [ 28.992859] CPU: 1 UID: 0 PID: 131 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 28.994112] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.994698] Hardware name: linux,dummy-virt (DT) [ 28.995573] Call trace: [ 28.996251] show_stack+0x20/0x38 (C) [ 28.996792] dump_stack_lvl+0x8c/0xd0 [ 28.997462] print_report+0x118/0x5e0 [ 28.998085] kasan_report+0xc8/0x118 [ 28.998586] __asan_report_store1_noabort+0x20/0x30 [ 28.999657] kmalloc_track_caller_oob_right+0x420/0x490 [ 29.000401] kunit_try_run_case+0x14c/0x3d0 [ 29.001050] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.001865] kthread+0x24c/0x2d0 [ 29.002459] ret_from_fork+0x10/0x20 [ 29.003140] [ 29.003668] Allocated by task 131: [ 29.004147] kasan_save_stack+0x3c/0x68 [ 29.004754] kasan_save_track+0x20/0x40 [ 29.005417] kasan_save_alloc_info+0x40/0x58 [ 29.005916] __kasan_kmalloc+0xd4/0xd8 [ 29.006562] __kmalloc_node_track_caller_noprof+0x184/0x4b8 [ 29.007570] kmalloc_track_caller_oob_right+0x184/0x490 [ 29.008436] kunit_try_run_case+0x14c/0x3d0 [ 29.009007] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.009637] kthread+0x24c/0x2d0 [ 29.010256] ret_from_fork+0x10/0x20 [ 29.010732] [ 29.011155] The buggy address belongs to the object at fff00000c62b1e00 [ 29.011155] which belongs to the cache kmalloc-128 of size 128 [ 29.013305] The buggy address is located 0 bytes to the right of [ 29.013305] allocated 120-byte region [fff00000c62b1e00, fff00000c62b1e78) [ 29.014922] [ 29.015520] The buggy address belongs to the physical page: [ 29.016340] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062b1 [ 29.017373] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 29.018255] page_type: f5(slab) [ 29.018902] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 29.020185] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.021056] page dumped because: kasan: bad access detected [ 29.021719] [ 29.022036] Memory state around the buggy address: [ 29.022808] fff00000c62b1d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.023870] fff00000c62b1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.025312] >fff00000c62b1e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 29.026414] ^ [ 29.027605] fff00000c62b1e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.028757] fff00000c62b1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.029648] ================================================================== [ 28.946624] ================================================================== [ 28.948146] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x414/0x490 [ 28.949043] Write of size 1 at addr fff00000c62b1d78 by task kunit_try_catch/131 [ 28.949897] [ 28.950229] CPU: 1 UID: 0 PID: 131 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 28.951409] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.952205] Hardware name: linux,dummy-virt (DT) [ 28.952818] Call trace: [ 28.953301] show_stack+0x20/0x38 (C) [ 28.953836] dump_stack_lvl+0x8c/0xd0 [ 28.954492] print_report+0x118/0x5e0 [ 28.955042] kasan_report+0xc8/0x118 [ 28.955745] __asan_report_store1_noabort+0x20/0x30 [ 28.956376] kmalloc_track_caller_oob_right+0x414/0x490 [ 28.957404] kunit_try_run_case+0x14c/0x3d0 [ 28.958160] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 28.958836] kthread+0x24c/0x2d0 [ 28.959582] ret_from_fork+0x10/0x20 [ 28.960217] [ 28.960544] Allocated by task 131: [ 28.961175] kasan_save_stack+0x3c/0x68 [ 28.961678] kasan_save_track+0x20/0x40 [ 28.962401] kasan_save_alloc_info+0x40/0x58 [ 28.962990] __kasan_kmalloc+0xd4/0xd8 [ 28.963960] __kmalloc_node_track_caller_noprof+0x184/0x4b8 [ 28.964643] kmalloc_track_caller_oob_right+0xa8/0x490 [ 28.965632] kunit_try_run_case+0x14c/0x3d0 [ 28.966215] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 28.966976] kthread+0x24c/0x2d0 [ 28.967640] ret_from_fork+0x10/0x20 [ 28.968851] [ 28.969133] The buggy address belongs to the object at fff00000c62b1d00 [ 28.969133] which belongs to the cache kmalloc-128 of size 128 [ 28.970477] The buggy address is located 0 bytes to the right of [ 28.970477] allocated 120-byte region [fff00000c62b1d00, fff00000c62b1d78) [ 28.972065] [ 28.972424] The buggy address belongs to the physical page: [ 28.973083] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062b1 [ 28.974248] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 28.975067] page_type: f5(slab) [ 28.975783] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 28.976763] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 28.977614] page dumped because: kasan: bad access detected [ 28.978226] [ 28.978579] Memory state around the buggy address: [ 28.979612] fff00000c62b1c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 28.980387] fff00000c62b1c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.981322] >fff00000c62b1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 28.982219] ^ [ 28.983093] fff00000c62b1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.984278] fff00000c62b1e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.985116] ==================================================================
[ 26.499453] ================================================================== [ 26.500572] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4ca/0x530 [ 26.502136] Write of size 1 at addr ffff8881029f9578 by task kunit_try_catch/149 [ 26.503398] [ 26.503640] CPU: 1 UID: 0 PID: 149 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 26.504833] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.505019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.505348] Call Trace: [ 26.505480] <TASK> [ 26.505608] dump_stack_lvl+0x73/0xb0 [ 26.506196] print_report+0xd1/0x640 [ 26.506749] ? __virt_addr_valid+0x1db/0x2d0 [ 26.507597] ? kasan_complete_mode_report_info+0x2a/0x200 [ 26.508307] kasan_report+0x102/0x140 [ 26.508705] ? kmalloc_track_caller_oob_right+0x4ca/0x530 [ 26.509500] ? kmalloc_track_caller_oob_right+0x4ca/0x530 [ 26.510247] __asan_report_store1_noabort+0x1b/0x30 [ 26.510736] kmalloc_track_caller_oob_right+0x4ca/0x530 [ 26.511325] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 26.511964] ? __schedule+0xc70/0x27e0 [ 26.512496] ? __pfx_read_tsc+0x10/0x10 [ 26.513075] ? ktime_get_ts64+0x86/0x230 [ 26.513496] kunit_try_run_case+0x1b3/0x490 [ 26.514161] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.514557] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 26.515223] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.515888] ? __kthread_parkme+0x82/0x160 [ 26.516315] ? preempt_count_sub+0x50/0x80 [ 26.516850] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.517393] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.517976] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.518654] kthread+0x257/0x310 [ 26.519069] ? __pfx_kthread+0x10/0x10 [ 26.519601] ret_from_fork+0x41/0x80 [ 26.520100] ? __pfx_kthread+0x10/0x10 [ 26.520524] ret_from_fork_asm+0x1a/0x30 [ 26.521189] </TASK> [ 26.521641] [ 26.521941] Allocated by task 149: [ 26.522296] kasan_save_stack+0x3d/0x60 [ 26.522799] kasan_save_track+0x18/0x40 [ 26.523237] kasan_save_alloc_info+0x3b/0x50 [ 26.523747] __kasan_kmalloc+0xb7/0xc0 [ 26.524332] __kmalloc_node_track_caller_noprof+0x1c6/0x500 [ 26.524936] kmalloc_track_caller_oob_right+0x9a/0x530 [ 26.525350] kunit_try_run_case+0x1b3/0x490 [ 26.525942] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.526533] kthread+0x257/0x310 [ 26.526980] ret_from_fork+0x41/0x80 [ 26.527277] ret_from_fork_asm+0x1a/0x30 [ 26.527895] [ 26.528152] The buggy address belongs to the object at ffff8881029f9500 [ 26.528152] which belongs to the cache kmalloc-128 of size 128 [ 26.529112] The buggy address is located 0 bytes to the right of [ 26.529112] allocated 120-byte region [ffff8881029f9500, ffff8881029f9578) [ 26.530408] [ 26.530734] The buggy address belongs to the physical page: [ 26.531155] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029f9 [ 26.532236] flags: 0x200000000000000(node=0|zone=2) [ 26.532816] page_type: f5(slab) [ 26.533221] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 26.534064] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.534832] page dumped because: kasan: bad access detected [ 26.535372] [ 26.535614] Memory state around the buggy address: [ 26.536168] ffff8881029f9400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 26.536991] ffff8881029f9480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.537725] >ffff8881029f9500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 26.538488] ^ [ 26.539237] ffff8881029f9580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.539976] ffff8881029f9600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.540855] ================================================================== [ 26.542657] ================================================================== [ 26.543903] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4b3/0x530 [ 26.544699] Write of size 1 at addr ffff8881029f9678 by task kunit_try_catch/149 [ 26.545329] [ 26.545554] CPU: 1 UID: 0 PID: 149 Comm: kunit_try_catch Tainted: G B N 6.13.0-rc1-next-20241205 #1 [ 26.546574] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.547062] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.547982] Call Trace: [ 26.548290] <TASK> [ 26.548690] dump_stack_lvl+0x73/0xb0 [ 26.549141] print_report+0xd1/0x640 [ 26.549640] ? __virt_addr_valid+0x1db/0x2d0 [ 26.550185] ? kasan_complete_mode_report_info+0x2a/0x200 [ 26.550804] kasan_report+0x102/0x140 [ 26.551268] ? kmalloc_track_caller_oob_right+0x4b3/0x530 [ 26.551909] ? kmalloc_track_caller_oob_right+0x4b3/0x530 [ 26.552385] __asan_report_store1_noabort+0x1b/0x30 [ 26.553100] kmalloc_track_caller_oob_right+0x4b3/0x530 [ 26.553597] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 26.554211] ? __schedule+0xc70/0x27e0 [ 26.554734] ? __pfx_read_tsc+0x10/0x10 [ 26.555179] ? ktime_get_ts64+0x86/0x230 [ 26.555545] kunit_try_run_case+0x1b3/0x490 [ 26.556049] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.556605] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 26.557266] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.557824] ? __kthread_parkme+0x82/0x160 [ 26.558351] ? preempt_count_sub+0x50/0x80 [ 26.558729] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.559290] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.560033] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.560641] kthread+0x257/0x310 [ 26.561100] ? __pfx_kthread+0x10/0x10 [ 26.561571] ret_from_fork+0x41/0x80 [ 26.562040] ? __pfx_kthread+0x10/0x10 [ 26.562458] ret_from_fork_asm+0x1a/0x30 [ 26.563049] </TASK> [ 26.563279] [ 26.563534] Allocated by task 149: [ 26.563871] kasan_save_stack+0x3d/0x60 [ 26.564372] kasan_save_track+0x18/0x40 [ 26.564669] kasan_save_alloc_info+0x3b/0x50 [ 26.565383] __kasan_kmalloc+0xb7/0xc0 [ 26.565717] __kmalloc_node_track_caller_noprof+0x1c6/0x500 [ 26.566352] kmalloc_track_caller_oob_right+0x19b/0x530 [ 26.566969] kunit_try_run_case+0x1b3/0x490 [ 26.567431] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.568042] kthread+0x257/0x310 [ 26.568415] ret_from_fork+0x41/0x80 [ 26.569298] ret_from_fork_asm+0x1a/0x30 [ 26.569647] [ 26.569979] The buggy address belongs to the object at ffff8881029f9600 [ 26.569979] which belongs to the cache kmalloc-128 of size 128 [ 26.571071] The buggy address is located 0 bytes to the right of [ 26.571071] allocated 120-byte region [ffff8881029f9600, ffff8881029f9678) [ 26.572192] [ 26.572509] The buggy address belongs to the physical page: [ 26.573167] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029f9 [ 26.573905] flags: 0x200000000000000(node=0|zone=2) [ 26.574545] page_type: f5(slab) [ 26.574977] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 26.575796] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.576509] page dumped because: kasan: bad access detected [ 26.577129] [ 26.577384] Memory state around the buggy address: [ 26.577824] ffff8881029f9500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.578560] ffff8881029f9580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.579214] >ffff8881029f9600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 26.579942] ^ [ 26.580559] ffff8881029f9680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.581248] ffff8881029f9700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.581976] ==================================================================