Hay
Date
May 15, 2025, 10:38 a.m.

Environment
qemu-arm64
qemu-x86_64

[   17.778644] ==================================================================
[   17.778955] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0
[   17.779221] Write of size 1 at addr fff00000c683df00 by task kunit_try_catch/144
[   17.779342] 
[   17.779371] CPU: 1 UID: 0 PID: 144 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc6-next-20250515 #1 PREEMPT 
[   17.779494] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.780076] Hardware name: linux,dummy-virt (DT)
[   17.780153] Call trace:
[   17.780186]  show_stack+0x20/0x38 (C)
[   17.780237]  dump_stack_lvl+0x8c/0xd0
[   17.780735]  print_report+0x118/0x608
[   17.780842]  kasan_report+0xdc/0x128
[   17.780939]  __asan_report_store1_noabort+0x20/0x30
[   17.781192]  kmalloc_big_oob_right+0x2a4/0x2f0
[   17.781291]  kunit_try_run_case+0x170/0x3f0
[   17.781340]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.781391]  kthread+0x328/0x630
[   17.781482]  ret_from_fork+0x10/0x20
[   17.781575] 
[   17.781653] Allocated by task 144:
[   17.781679]  kasan_save_stack+0x3c/0x68
[   17.781719]  kasan_save_track+0x20/0x40
[   17.781798]  kasan_save_alloc_info+0x40/0x58
[   17.781837]  __kasan_kmalloc+0xd4/0xd8
[   17.782364]  __kmalloc_cache_noprof+0x15c/0x3c0
[   17.782422]  kmalloc_big_oob_right+0xb8/0x2f0
[   17.782595]  kunit_try_run_case+0x170/0x3f0
[   17.782636]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.782840]  kthread+0x328/0x630
[   17.782919]  ret_from_fork+0x10/0x20
[   17.782995] 
[   17.783015] The buggy address belongs to the object at fff00000c683c000
[   17.783015]  which belongs to the cache kmalloc-8k of size 8192
[   17.783350] The buggy address is located 0 bytes to the right of
[   17.783350]  allocated 7936-byte region [fff00000c683c000, fff00000c683df00)
[   17.783533] 
[   17.783556] The buggy address belongs to the physical page:
[   17.783586] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106838
[   17.783637] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   17.783863] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   17.783997] page_type: f5(slab)
[   17.784039] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000
[   17.784090] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   17.784138] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000
[   17.784199] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   17.784247] head: 0bfffe0000000003 ffffc1ffc31a0e01 00000000ffffffff 00000000ffffffff
[   17.784293] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   17.784331] page dumped because: kasan: bad access detected
[   17.784953] 
[   17.784976] Memory state around the buggy address:
[   17.785078]  fff00000c683de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.785142]  fff00000c683de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.785192] >fff00000c683df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.785256]                    ^
[   17.785406]  fff00000c683df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.785464]  fff00000c683e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.785581] ==================================================================


[   13.407191] ==================================================================
[   13.407749] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370
[   13.408210] Write of size 1 at addr ffff888101f8df00 by task kunit_try_catch/162
[   13.408620] 
[   13.408780] CPU: 1 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc6-next-20250515 #1 PREEMPT(voluntary) 
[   13.408870] Tainted: [B]=BAD_PAGE, [N]=TEST
[   13.408891] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   13.408928] Call Trace:
[   13.408953]  <TASK>
[   13.408986]  dump_stack_lvl+0x73/0xb0
[   13.409049]  print_report+0xd1/0x650
[   13.409096]  ? __virt_addr_valid+0x1db/0x2d0
[   13.409138]  ? kmalloc_big_oob_right+0x316/0x370
[   13.409175]  ? kasan_complete_mode_report_info+0x2a/0x200
[   13.409214]  ? kmalloc_big_oob_right+0x316/0x370
[   13.409379]  kasan_report+0x141/0x180
[   13.409423]  ? kmalloc_big_oob_right+0x316/0x370
[   13.409468]  __asan_report_store1_noabort+0x1b/0x30
[   13.409605]  kmalloc_big_oob_right+0x316/0x370
[   13.409637]  ? __pfx_kmalloc_big_oob_right+0x10/0x10
[   13.409672]  ? __schedule+0x10cc/0x2b60
[   13.409712]  ? __pfx_read_tsc+0x10/0x10
[   13.409752]  ? ktime_get_ts64+0x86/0x230
[   13.409794]  kunit_try_run_case+0x1a5/0x480
[   13.409839]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.409876]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   13.409916]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   13.409952]  ? __kthread_parkme+0x82/0x180
[   13.409988]  ? preempt_count_sub+0x50/0x80
[   13.410029]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.410070]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.410111]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   13.410152]  kthread+0x337/0x6f0
[   13.410188]  ? trace_preempt_on+0x20/0xc0
[   13.410246]  ? __pfx_kthread+0x10/0x10
[   13.410295]  ? _raw_spin_unlock_irq+0x47/0x80
[   13.410326]  ? calculate_sigpending+0x7b/0xa0
[   13.410375]  ? __pfx_kthread+0x10/0x10
[   13.410441]  ret_from_fork+0x116/0x1d0
[   13.410471]  ? __pfx_kthread+0x10/0x10
[   13.410521]  ret_from_fork_asm+0x1a/0x30
[   13.410573]  </TASK>
[   13.410587] 
[   13.420970] Allocated by task 162:
[   13.421196]  kasan_save_stack+0x45/0x70
[   13.421871]  kasan_save_track+0x18/0x40
[   13.422193]  kasan_save_alloc_info+0x3b/0x50
[   13.422696]  __kasan_kmalloc+0xb7/0xc0
[   13.423023]  __kmalloc_cache_noprof+0x189/0x420
[   13.423404]  kmalloc_big_oob_right+0xa9/0x370
[   13.423856]  kunit_try_run_case+0x1a5/0x480
[   13.424062]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.424248]  kthread+0x337/0x6f0
[   13.424400]  ret_from_fork+0x116/0x1d0
[   13.424832]  ret_from_fork_asm+0x1a/0x30
[   13.425053] 
[   13.425195] The buggy address belongs to the object at ffff888101f8c000
[   13.425195]  which belongs to the cache kmalloc-8k of size 8192
[   13.426193] The buggy address is located 0 bytes to the right of
[   13.426193]  allocated 7936-byte region [ffff888101f8c000, ffff888101f8df00)
[   13.427041] 
[   13.427206] The buggy address belongs to the physical page:
[   13.427716] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101f88
[   13.428099] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   13.428697] flags: 0x200000000000040(head|node=0|zone=2)
[   13.429054] page_type: f5(slab)
[   13.429233] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
[   13.429857] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   13.430248] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
[   13.431206] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   13.431604] head: 0200000000000003 ffffea000407e201 00000000ffffffff 00000000ffffffff
[   13.431869] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   13.432314] page dumped because: kasan: bad access detected
[   13.432773] 
[   13.432930] Memory state around the buggy address:
[   13.433129]  ffff888101f8de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   13.433566]  ffff888101f8de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   13.433884] >ffff888101f8df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   13.434323]                    ^
[   13.434645]  ffff888101f8df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   13.435070]  ffff888101f8e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   13.435942] ==================================================================