Date
March 19, 2025, 10:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 33.487545] ================================================================== [ 33.488256] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 33.488708] Write of size 1 at addr fff00000c68a5f00 by task kunit_try_catch/146 [ 33.488857] [ 33.489169] CPU: 1 UID: 0 PID: 146 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 33.489527] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.489884] Hardware name: linux,dummy-virt (DT) [ 33.490149] Call trace: [ 33.490222] show_stack+0x20/0x38 (C) [ 33.490794] dump_stack_lvl+0x8c/0xd0 [ 33.490981] print_report+0x118/0x5f0 [ 33.491352] kasan_report+0xc8/0x118 [ 33.491899] __asan_report_store1_noabort+0x20/0x30 [ 33.492111] kmalloc_big_oob_right+0x2a4/0x2f0 [ 33.492266] kunit_try_run_case+0x14c/0x3d0 [ 33.492421] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.492593] kthread+0x318/0x618 [ 33.493267] ret_from_fork+0x10/0x20 [ 33.493540] [ 33.493606] Allocated by task 146: [ 33.493692] kasan_save_stack+0x3c/0x68 [ 33.494085] kasan_save_track+0x20/0x40 [ 33.494399] kasan_save_alloc_info+0x40/0x58 [ 33.494639] __kasan_kmalloc+0xd4/0xd8 [ 33.495280] __kmalloc_cache_noprof+0x15c/0x3c0 [ 33.495764] kmalloc_big_oob_right+0xb8/0x2f0 [ 33.496160] kunit_try_run_case+0x14c/0x3d0 [ 33.496292] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.496909] kthread+0x318/0x618 [ 33.497046] ret_from_fork+0x10/0x20 [ 33.497193] [ 33.497542] The buggy address belongs to the object at fff00000c68a4000 [ 33.497542] which belongs to the cache kmalloc-8k of size 8192 [ 33.497747] The buggy address is located 0 bytes to the right of [ 33.497747] allocated 7936-byte region [fff00000c68a4000, fff00000c68a5f00) [ 33.498200] [ 33.498461] The buggy address belongs to the physical page: [ 33.498659] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1068a0 [ 33.498829] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.498984] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 33.499166] page_type: f5(slab) [ 33.499281] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 33.499441] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 33.499602] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 33.499760] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 33.499921] head: 0bfffe0000000003 ffffc1ffc31a2801 00000000ffffffff 00000000ffffffff [ 33.501118] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 33.501274] page dumped because: kasan: bad access detected [ 33.501370] [ 33.501448] Memory state around the buggy address: [ 33.501547] fff00000c68a5e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.501683] fff00000c68a5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.501823] >fff00000c68a5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.502279] ^ [ 33.502397] fff00000c68a5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.502675] fff00000c68a6000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.502804] ==================================================================
[ 20.611050] ================================================================== [ 20.611931] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 20.612607] Write of size 1 at addr ffff8881027e5f00 by task kunit_try_catch/165 [ 20.613027] [ 20.613316] CPU: 1 UID: 0 PID: 165 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 20.613445] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.613475] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 20.613531] Call Trace: [ 20.613564] <TASK> [ 20.613602] dump_stack_lvl+0x73/0xb0 [ 20.613678] print_report+0xd1/0x660 [ 20.613739] ? __virt_addr_valid+0x1db/0x2d0 [ 20.613857] ? kasan_complete_mode_report_info+0x2a/0x200 [ 20.613926] kasan_report+0x104/0x140 [ 20.613978] ? kmalloc_big_oob_right+0x316/0x370 [ 20.614052] ? kmalloc_big_oob_right+0x316/0x370 [ 20.614150] __asan_report_store1_noabort+0x1b/0x30 [ 20.614210] kmalloc_big_oob_right+0x316/0x370 [ 20.614273] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 20.614336] ? __schedule+0xd46/0x29c0 [ 20.614422] ? __pfx_read_tsc+0x10/0x10 [ 20.614504] ? ktime_get_ts64+0x86/0x240 [ 20.614577] kunit_try_run_case+0x1b2/0x490 [ 20.614734] ? __pfx_kunit_try_run_case+0x10/0x10 [ 20.614804] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 20.614864] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 20.614926] ? __kthread_parkme+0x82/0x160 [ 20.614989] ? preempt_count_sub+0x50/0x80 [ 20.615060] ? __pfx_kunit_try_run_case+0x10/0x10 [ 20.615154] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 20.615227] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 20.615293] kthread+0x323/0x710 [ 20.615347] ? trace_preempt_on+0x20/0xc0 [ 20.615412] ? __pfx_kthread+0x10/0x10 [ 20.615471] ? _raw_spin_unlock_irq+0x47/0x80 [ 20.615526] ? calculate_sigpending+0x7b/0xa0 [ 20.615583] ? __pfx_kthread+0x10/0x10 [ 20.615666] ret_from_fork+0x41/0x80 [ 20.615723] ? __pfx_kthread+0x10/0x10 [ 20.615780] ret_from_fork_asm+0x1a/0x30 [ 20.615873] </TASK> [ 20.615901] [ 20.635094] Allocated by task 165: [ 20.635665] kasan_save_stack+0x3d/0x60 [ 20.636319] kasan_save_track+0x18/0x40 [ 20.637248] kasan_save_alloc_info+0x3b/0x50 [ 20.637649] __kasan_kmalloc+0xb7/0xc0 [ 20.638574] __kmalloc_cache_noprof+0x183/0x410 [ 20.639217] kmalloc_big_oob_right+0xa9/0x370 [ 20.639652] kunit_try_run_case+0x1b2/0x490 [ 20.641221] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 20.642134] kthread+0x323/0x710 [ 20.642453] ret_from_fork+0x41/0x80 [ 20.642984] ret_from_fork_asm+0x1a/0x30 [ 20.644067] [ 20.644256] The buggy address belongs to the object at ffff8881027e4000 [ 20.644256] which belongs to the cache kmalloc-8k of size 8192 [ 20.645311] The buggy address is located 0 bytes to the right of [ 20.645311] allocated 7936-byte region [ffff8881027e4000, ffff8881027e5f00) [ 20.646558] [ 20.646843] The buggy address belongs to the physical page: [ 20.648199] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1027e0 [ 20.649165] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.650229] flags: 0x200000000000040(head|node=0|zone=2) [ 20.650660] page_type: f5(slab) [ 20.651351] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 20.652669] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 20.653551] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 20.654670] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 20.656239] head: 0200000000000003 ffffea000409f801 00000000ffffffff 00000000ffffffff [ 20.657668] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 20.658607] page dumped because: kasan: bad access detected [ 20.659249] [ 20.660322] Memory state around the buggy address: [ 20.660591] ffff8881027e5e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.661400] ffff8881027e5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.662261] >ffff8881027e5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.662646] ^ [ 20.663197] ffff8881027e5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.664438] ffff8881027e6000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.665317] ==================================================================