Date
March 19, 2025, 10:35 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 35.177567] ================================================================== [ 35.178245] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x33c/0x428 [ 35.178432] Read of size 1 at addr fff00000c5d980c8 by task kunit_try_catch/209 [ 35.178592] [ 35.178730] CPU: 1 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT [ 35.179019] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.179134] Hardware name: linux,dummy-virt (DT) [ 35.179349] Call trace: [ 35.179438] show_stack+0x20/0x38 (C) [ 35.179609] dump_stack_lvl+0x8c/0xd0 [ 35.179758] print_report+0x118/0x5f0 [ 35.179906] kasan_report+0xc8/0x118 [ 35.180046] __asan_report_load1_noabort+0x20/0x30 [ 35.180230] kmem_cache_oob+0x33c/0x428 [ 35.181035] kunit_try_run_case+0x14c/0x3d0 [ 35.182072] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.183319] kthread+0x318/0x618 [ 35.184316] ret_from_fork+0x10/0x20 [ 35.185121] [ 35.185188] Allocated by task 209: [ 35.185274] kasan_save_stack+0x3c/0x68 [ 35.185401] kasan_save_track+0x20/0x40 [ 35.186474] kasan_save_alloc_info+0x40/0x58 [ 35.186741] __kasan_slab_alloc+0xa8/0xb0 [ 35.186877] kmem_cache_alloc_noprof+0x108/0x398 [ 35.187008] kmem_cache_oob+0x12c/0x428 [ 35.187578] kunit_try_run_case+0x14c/0x3d0 [ 35.187745] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.187897] kthread+0x318/0x618 [ 35.188010] ret_from_fork+0x10/0x20 [ 35.188151] [ 35.188218] The buggy address belongs to the object at fff00000c5d98000 [ 35.188218] which belongs to the cache test_cache of size 200 [ 35.188677] The buggy address is located 0 bytes to the right of [ 35.188677] allocated 200-byte region [fff00000c5d98000, fff00000c5d980c8) [ 35.189688] [ 35.189783] The buggy address belongs to the physical page: [ 35.190000] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105d98 [ 35.190316] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 35.190589] page_type: f5(slab) [ 35.190727] raw: 0bfffe0000000000 fff00000c10a5c80 dead000000000122 0000000000000000 [ 35.191196] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 35.191652] page dumped because: kasan: bad access detected [ 35.191789] [ 35.192182] Memory state around the buggy address: [ 35.192629] fff00000c5d97f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.192787] fff00000c5d98000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.192933] >fff00000c5d98080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 35.193418] ^ [ 35.193671] fff00000c5d98100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.194044] fff00000c5d98180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.194212] ==================================================================
[ 22.928861] ================================================================== [ 22.929910] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x402/0x530 [ 22.930498] Read of size 1 at addr ffff8881032250c8 by task kunit_try_catch/228 [ 22.931071] [ 22.931747] CPU: 1 UID: 0 PID: 228 Comm: kunit_try_catch Tainted: G B N 6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) [ 22.931876] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.931912] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.931979] Call Trace: [ 22.932010] <TASK> [ 22.932067] dump_stack_lvl+0x73/0xb0 [ 22.932178] print_report+0xd1/0x660 [ 22.932242] ? __virt_addr_valid+0x1db/0x2d0 [ 22.932364] ? kasan_complete_mode_report_info+0x2a/0x200 [ 22.933043] kasan_report+0x104/0x140 [ 22.933159] ? kmem_cache_oob+0x402/0x530 [ 22.933229] ? kmem_cache_oob+0x402/0x530 [ 22.933303] __asan_report_load1_noabort+0x18/0x20 [ 22.933349] kmem_cache_oob+0x402/0x530 [ 22.933378] ? trace_hardirqs_on+0x37/0xe0 [ 22.933415] ? __pfx_kmem_cache_oob+0x10/0x10 [ 22.933443] ? finish_task_switch.isra.0+0x153/0x730 [ 22.933477] ? __switch_to+0x5d9/0xf70 [ 22.933521] ? __pfx_read_tsc+0x10/0x10 [ 22.933550] ? ktime_get_ts64+0x86/0x240 [ 22.933588] kunit_try_run_case+0x1b2/0x490 [ 22.933624] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.933655] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.933686] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.933753] ? __kthread_parkme+0x82/0x160 [ 22.933785] ? preempt_count_sub+0x50/0x80 [ 22.933820] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.933853] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.933887] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.933919] kthread+0x323/0x710 [ 22.933948] ? trace_preempt_on+0x20/0xc0 [ 22.933981] ? __pfx_kthread+0x10/0x10 [ 22.934012] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.934041] ? calculate_sigpending+0x7b/0xa0 [ 22.934071] ? __pfx_kthread+0x10/0x10 [ 22.934103] ret_from_fork+0x41/0x80 [ 22.934157] ? __pfx_kthread+0x10/0x10 [ 22.934188] ret_from_fork_asm+0x1a/0x30 [ 22.934235] </TASK> [ 22.934251] [ 22.951083] Allocated by task 228: [ 22.951556] kasan_save_stack+0x3d/0x60 [ 22.952158] kasan_save_track+0x18/0x40 [ 22.952675] kasan_save_alloc_info+0x3b/0x50 [ 22.953312] __kasan_slab_alloc+0x91/0xa0 [ 22.953851] kmem_cache_alloc_noprof+0x11d/0x3f0 [ 22.954275] kmem_cache_oob+0x157/0x530 [ 22.954642] kunit_try_run_case+0x1b2/0x490 [ 22.955026] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.955485] kthread+0x323/0x710 [ 22.955768] ret_from_fork+0x41/0x80 [ 22.956255] ret_from_fork_asm+0x1a/0x30 [ 22.956685] [ 22.956948] The buggy address belongs to the object at ffff888103225000 [ 22.956948] which belongs to the cache test_cache of size 200 [ 22.957891] The buggy address is located 0 bytes to the right of [ 22.957891] allocated 200-byte region [ffff888103225000, ffff8881032250c8) [ 22.959342] [ 22.959559] The buggy address belongs to the physical page: [ 22.960918] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103225 [ 22.961668] flags: 0x200000000000000(node=0|zone=2) [ 22.962083] page_type: f5(slab) [ 22.962394] raw: 0200000000000000 ffff8881020e88c0 dead000000000122 0000000000000000 [ 22.962971] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 22.963920] page dumped because: kasan: bad access detected [ 22.964646] [ 22.965256] Memory state around the buggy address: [ 22.966260] ffff888103224f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.966851] ffff888103225000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.967484] >ffff888103225080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 22.968348] ^ [ 22.969028] ffff888103225100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.969794] ffff888103225180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.970539] ==================================================================