Date
March 19, 2025, 10:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.267400] ================================================================== [ 34.267680] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x150/0x2f8 [ 34.267838] Write of size 8 at addr fff00000c6818a71 by task kunit_try_catch/178 [ 34.267994] [ 34.268104] CPU: 1 UID: 0 PID: 178 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 34.268603] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.268935] Hardware name: linux,dummy-virt (DT) [ 34.269399] Call trace: [ 34.269479] show_stack+0x20/0x38 (C) [ 34.269747] dump_stack_lvl+0x8c/0xd0 [ 34.269997] print_report+0x118/0x5f0 [ 34.270522] kasan_report+0xc8/0x118 [ 34.270696] kasan_check_range+0x100/0x1a8 [ 34.270846] __asan_memset+0x34/0x78 [ 34.271204] kmalloc_oob_memset_8+0x150/0x2f8 [ 34.271841] kunit_try_run_case+0x14c/0x3d0 [ 34.272025] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.272649] kthread+0x318/0x618 [ 34.272977] ret_from_fork+0x10/0x20 [ 34.273554] [ 34.273666] Allocated by task 178: [ 34.273756] kasan_save_stack+0x3c/0x68 [ 34.274184] kasan_save_track+0x20/0x40 [ 34.274307] kasan_save_alloc_info+0x40/0x58 [ 34.274439] __kasan_kmalloc+0xd4/0xd8 [ 34.274706] __kmalloc_cache_noprof+0x15c/0x3c0 [ 34.275293] kmalloc_oob_memset_8+0xb0/0x2f8 [ 34.275787] kunit_try_run_case+0x14c/0x3d0 [ 34.275925] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.276085] kthread+0x318/0x618 [ 34.276203] ret_from_fork+0x10/0x20 [ 34.276450] [ 34.276770] The buggy address belongs to the object at fff00000c6818a00 [ 34.276770] which belongs to the cache kmalloc-128 of size 128 [ 34.277421] The buggy address is located 113 bytes inside of [ 34.277421] allocated 120-byte region [fff00000c6818a00, fff00000c6818a78) [ 34.277759] [ 34.277821] The buggy address belongs to the physical page: [ 34.278197] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106818 [ 34.278480] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.278633] page_type: f5(slab) [ 34.278878] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 34.279428] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.279794] page dumped because: kasan: bad access detected [ 34.280025] [ 34.280109] Memory state around the buggy address: [ 34.280553] fff00000c6818900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.280709] fff00000c6818980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.280851] >fff00000c6818a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 34.281335] ^ [ 34.281675] fff00000c6818a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.281963] fff00000c6818b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.282108] ==================================================================
[ 21.946018] ================================================================== [ 21.946863] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x166/0x330 [ 21.947410] Write of size 8 at addr ffff88810305a671 by task kunit_try_catch/197 [ 21.948219] [ 21.948518] CPU: 0 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 21.948647] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.948681] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.948749] Call Trace: [ 21.948782] <TASK> [ 21.948817] dump_stack_lvl+0x73/0xb0 [ 21.948912] print_report+0xd1/0x660 [ 21.949009] ? __virt_addr_valid+0x1db/0x2d0 [ 21.949160] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.949238] kasan_report+0x104/0x140 [ 21.949296] ? kmalloc_oob_memset_8+0x166/0x330 [ 21.949408] ? kmalloc_oob_memset_8+0x166/0x330 [ 21.949496] kasan_check_range+0x10c/0x1c0 [ 21.949567] __asan_memset+0x27/0x50 [ 21.949604] kmalloc_oob_memset_8+0x166/0x330 [ 21.949640] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 21.949679] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 21.949763] kunit_try_run_case+0x1b2/0x490 [ 21.949838] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.949899] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.949978] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.950068] ? __kthread_parkme+0x82/0x160 [ 21.950159] ? preempt_count_sub+0x50/0x80 [ 21.950226] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.950293] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.950358] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.950471] kthread+0x323/0x710 [ 21.950540] ? trace_preempt_on+0x20/0xc0 [ 21.950612] ? __pfx_kthread+0x10/0x10 [ 21.950671] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.950747] ? calculate_sigpending+0x7b/0xa0 [ 21.950813] ? __pfx_kthread+0x10/0x10 [ 21.950849] ret_from_fork+0x41/0x80 [ 21.950885] ? __pfx_kthread+0x10/0x10 [ 21.950918] ret_from_fork_asm+0x1a/0x30 [ 21.950967] </TASK> [ 21.950983] [ 21.963700] Allocated by task 197: [ 21.964159] kasan_save_stack+0x3d/0x60 [ 21.964636] kasan_save_track+0x18/0x40 [ 21.965056] kasan_save_alloc_info+0x3b/0x50 [ 21.965438] __kasan_kmalloc+0xb7/0xc0 [ 21.965714] __kmalloc_cache_noprof+0x183/0x410 [ 21.966006] kmalloc_oob_memset_8+0xac/0x330 [ 21.966513] kunit_try_run_case+0x1b2/0x490 [ 21.967005] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.967646] kthread+0x323/0x710 [ 21.968190] ret_from_fork+0x41/0x80 [ 21.968642] ret_from_fork_asm+0x1a/0x30 [ 21.969090] [ 21.969368] The buggy address belongs to the object at ffff88810305a600 [ 21.969368] which belongs to the cache kmalloc-128 of size 128 [ 21.970495] The buggy address is located 113 bytes inside of [ 21.970495] allocated 120-byte region [ffff88810305a600, ffff88810305a678) [ 21.971315] [ 21.971586] The buggy address belongs to the physical page: [ 21.972376] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10305a [ 21.972849] flags: 0x200000000000000(node=0|zone=2) [ 21.973429] page_type: f5(slab) [ 21.973830] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 21.974677] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.975311] page dumped because: kasan: bad access detected [ 21.975780] [ 21.975992] Memory state around the buggy address: [ 21.976272] ffff88810305a500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.976940] ffff88810305a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.977512] >ffff88810305a600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 21.978147] ^ [ 21.978525] ffff88810305a680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.978907] ffff88810305a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.979548] ==================================================================