Hay
Date
May 26, 2025, 9:10 a.m.

Environment
qemu-arm64
qemu-x86_64

[   17.640910] ==================================================================
[   17.641060] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0
[   17.641186] Read of size 18446744073709551614 at addr fff00000c78c4084 by task kunit_try_catch/180
[   17.641460] 
[   17.641548] CPU: 0 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc7-next-20250526 #1 PREEMPT 
[   17.641749] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.642219] Hardware name: linux,dummy-virt (DT)
[   17.642492] Call trace:
[   17.642645]  show_stack+0x20/0x38 (C)
[   17.642948]  dump_stack_lvl+0x8c/0xd0
[   17.643071]  print_report+0x118/0x608
[   17.643262]  kasan_report+0xdc/0x128
[   17.643425]  kasan_check_range+0x100/0x1a8
[   17.643531]  __asan_memmove+0x3c/0x98
[   17.643613]  kmalloc_memmove_negative_size+0x154/0x2e0
[   17.643696]  kunit_try_run_case+0x170/0x3f0
[   17.643789]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.643897]  kthread+0x328/0x630
[   17.643994]  ret_from_fork+0x10/0x20
[   17.644136] 
[   17.644173] Allocated by task 180:
[   17.644229]  kasan_save_stack+0x3c/0x68
[   17.644348]  kasan_save_track+0x20/0x40
[   17.644421]  kasan_save_alloc_info+0x40/0x58
[   17.644518]  __kasan_kmalloc+0xd4/0xd8
[   17.644597]  __kmalloc_cache_noprof+0x15c/0x3c0
[   17.644696]  kmalloc_memmove_negative_size+0xb0/0x2e0
[   17.644827]  kunit_try_run_case+0x170/0x3f0
[   17.644915]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.645080]  kthread+0x328/0x630
[   17.645175]  ret_from_fork+0x10/0x20
[   17.645255] 
[   17.645301] The buggy address belongs to the object at fff00000c78c4080
[   17.645301]  which belongs to the cache kmalloc-64 of size 64
[   17.645436] The buggy address is located 4 bytes inside of
[   17.645436]  64-byte region [fff00000c78c4080, fff00000c78c40c0)
[   17.645557] 
[   17.645605] The buggy address belongs to the physical page:
[   17.645675] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078c4
[   17.645789] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.645899] page_type: f5(slab)
[   17.645987] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   17.646101] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   17.646194] page dumped because: kasan: bad access detected
[   17.646263] 
[   17.646304] Memory state around the buggy address:
[   17.646408]  fff00000c78c3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.646544]  fff00000c78c4000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   17.646676] >fff00000c78c4080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   17.646818]                    ^
[   17.646871]  fff00000c78c4100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.646960]  fff00000c78c4180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.647082] ==================================================================


[   11.183096] ==================================================================
[   11.183663] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330
[   11.184253] Read of size 18446744073709551614 at addr ffff888102a83c04 by task kunit_try_catch/198
[   11.184983] 
[   11.185131] CPU: 1 UID: 0 PID: 198 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc7-next-20250526 #1 PREEMPT(voluntary) 
[   11.185178] Tainted: [B]=BAD_PAGE, [N]=TEST
[   11.185191] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.185295] Call Trace:
[   11.185310]  <TASK>
[   11.185327]  dump_stack_lvl+0x73/0xb0
[   11.185361]  print_report+0xd1/0x650
[   11.185396]  ? __virt_addr_valid+0x1db/0x2d0
[   11.185420]  ? kmalloc_memmove_negative_size+0x171/0x330
[   11.185444]  ? kasan_complete_mode_report_info+0x2a/0x200
[   11.185466]  ? kmalloc_memmove_negative_size+0x171/0x330
[   11.185513]  kasan_report+0x141/0x180
[   11.185537]  ? kmalloc_memmove_negative_size+0x171/0x330
[   11.185566]  kasan_check_range+0x10c/0x1c0
[   11.185590]  __asan_memmove+0x27/0x70
[   11.185610]  kmalloc_memmove_negative_size+0x171/0x330
[   11.185634]  ? __pfx_kmalloc_memmove_negative_size+0x10/0x10
[   11.185660]  ? __schedule+0x10cc/0x2b60
[   11.185685]  ? __pfx_read_tsc+0x10/0x10
[   11.185706]  ? ktime_get_ts64+0x86/0x230
[   11.185731]  kunit_try_run_case+0x1a5/0x480
[   11.185753]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.185772]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   11.185798]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   11.185823]  ? __kthread_parkme+0x82/0x180
[   11.185843]  ? preempt_count_sub+0x50/0x80
[   11.185865]  ? __pfx_kunit_try_run_case+0x10/0x10
[   11.185886]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.185909]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   11.185932]  kthread+0x337/0x6f0
[   11.185951]  ? trace_preempt_on+0x20/0xc0
[   11.185975]  ? __pfx_kthread+0x10/0x10
[   11.185995]  ? _raw_spin_unlock_irq+0x47/0x80
[   11.186017]  ? calculate_sigpending+0x7b/0xa0
[   11.186148]  ? __pfx_kthread+0x10/0x10
[   11.186172]  ret_from_fork+0x116/0x1d0
[   11.186191]  ? __pfx_kthread+0x10/0x10
[   11.186210]  ret_from_fork_asm+0x1a/0x30
[   11.186241]  </TASK>
[   11.186251] 
[   11.199079] Allocated by task 198:
[   11.199326]  kasan_save_stack+0x45/0x70
[   11.199537]  kasan_save_track+0x18/0x40
[   11.199738]  kasan_save_alloc_info+0x3b/0x50
[   11.199967]  __kasan_kmalloc+0xb7/0xc0
[   11.200133]  __kmalloc_cache_noprof+0x189/0x420
[   11.200416]  kmalloc_memmove_negative_size+0xac/0x330
[   11.200585]  kunit_try_run_case+0x1a5/0x480
[   11.200758]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   11.201010]  kthread+0x337/0x6f0
[   11.201234]  ret_from_fork+0x116/0x1d0
[   11.201399]  ret_from_fork_asm+0x1a/0x30
[   11.201535] 
[   11.201604] The buggy address belongs to the object at ffff888102a83c00
[   11.201604]  which belongs to the cache kmalloc-64 of size 64
[   11.202422] The buggy address is located 4 bytes inside of
[   11.202422]  64-byte region [ffff888102a83c00, ffff888102a83c40)
[   11.202854] 
[   11.202926] The buggy address belongs to the physical page:
[   11.203102] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a83
[   11.203483] flags: 0x200000000000000(node=0|zone=2)
[   11.203644] page_type: f5(slab)
[   11.203854] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   11.204180] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   11.204475] page dumped because: kasan: bad access detected
[   11.204764] 
[   11.204866] Memory state around the buggy address:
[   11.205018]  ffff888102a83b00: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
[   11.205332]  ffff888102a83b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   11.205839] >ffff888102a83c00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   11.206109]                    ^
[   11.206299]  ffff888102a83c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   11.206516]  ffff888102a83d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   11.206843] ==================================================================