Date
May 26, 2025, 9:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.508494] ================================================================== [ 17.508642] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x150/0x2f8 [ 17.509032] Write of size 2 at addr fff00000c3ef0f77 by task kunit_try_catch/172 [ 17.509151] [ 17.509238] CPU: 0 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7-next-20250526 #1 PREEMPT [ 17.509457] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.509516] Hardware name: linux,dummy-virt (DT) [ 17.509580] Call trace: [ 17.510812] show_stack+0x20/0x38 (C) [ 17.510965] dump_stack_lvl+0x8c/0xd0 [ 17.511065] print_report+0x118/0x608 [ 17.511126] kasan_report+0xdc/0x128 [ 17.511217] kasan_check_range+0x100/0x1a8 [ 17.511377] __asan_memset+0x34/0x78 [ 17.511493] kmalloc_oob_memset_2+0x150/0x2f8 [ 17.511597] kunit_try_run_case+0x170/0x3f0 [ 17.511693] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.512326] kthread+0x328/0x630 [ 17.512481] ret_from_fork+0x10/0x20 [ 17.512605] [ 17.512650] Allocated by task 172: [ 17.512715] kasan_save_stack+0x3c/0x68 [ 17.512807] kasan_save_track+0x20/0x40 [ 17.512888] kasan_save_alloc_info+0x40/0x58 [ 17.512975] __kasan_kmalloc+0xd4/0xd8 [ 17.513434] __kmalloc_cache_noprof+0x15c/0x3c0 [ 17.513642] kmalloc_oob_memset_2+0xb0/0x2f8 [ 17.514205] kunit_try_run_case+0x170/0x3f0 [ 17.514419] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.514618] kthread+0x328/0x630 [ 17.514686] ret_from_fork+0x10/0x20 [ 17.514841] [ 17.514886] The buggy address belongs to the object at fff00000c3ef0f00 [ 17.514886] which belongs to the cache kmalloc-128 of size 128 [ 17.515062] The buggy address is located 119 bytes inside of [ 17.515062] allocated 120-byte region [fff00000c3ef0f00, fff00000c3ef0f78) [ 17.515352] [ 17.515478] The buggy address belongs to the physical page: [ 17.515558] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103ef0 [ 17.515660] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.515760] page_type: f5(slab) [ 17.516199] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 17.516313] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.516569] page dumped because: kasan: bad access detected [ 17.516778] [ 17.516847] Memory state around the buggy address: [ 17.517081] fff00000c3ef0e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.517296] fff00000c3ef0e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.517415] >fff00000c3ef0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.517501] ^ [ 17.517594] fff00000c3ef0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.517911] fff00000c3ef1000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.518062] ==================================================================
[ 11.066374] ================================================================== [ 11.066892] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x166/0x330 [ 11.067325] Write of size 2 at addr ffff888102826077 by task kunit_try_catch/190 [ 11.067652] [ 11.067907] CPU: 0 UID: 0 PID: 190 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc7-next-20250526 #1 PREEMPT(voluntary) [ 11.068015] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.068030] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.068052] Call Trace: [ 11.068064] <TASK> [ 11.068079] dump_stack_lvl+0x73/0xb0 [ 11.068169] print_report+0xd1/0x650 [ 11.068194] ? __virt_addr_valid+0x1db/0x2d0 [ 11.068217] ? kmalloc_oob_memset_2+0x166/0x330 [ 11.068238] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.068260] ? kmalloc_oob_memset_2+0x166/0x330 [ 11.068282] kasan_report+0x141/0x180 [ 11.068304] ? kmalloc_oob_memset_2+0x166/0x330 [ 11.068330] kasan_check_range+0x10c/0x1c0 [ 11.068353] __asan_memset+0x27/0x50 [ 11.068373] kmalloc_oob_memset_2+0x166/0x330 [ 11.068407] ? __pfx_kmalloc_oob_memset_2+0x10/0x10 [ 11.068429] ? __schedule+0x10cc/0x2b60 [ 11.068452] ? __pfx_read_tsc+0x10/0x10 [ 11.068472] ? ktime_get_ts64+0x86/0x230 [ 11.068496] kunit_try_run_case+0x1a5/0x480 [ 11.068516] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.068535] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.068559] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.068583] ? __kthread_parkme+0x82/0x180 [ 11.068603] ? preempt_count_sub+0x50/0x80 [ 11.068626] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.068647] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.068670] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.068694] kthread+0x337/0x6f0 [ 11.068729] ? trace_preempt_on+0x20/0xc0 [ 11.068751] ? __pfx_kthread+0x10/0x10 [ 11.068771] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.068794] ? calculate_sigpending+0x7b/0xa0 [ 11.068817] ? __pfx_kthread+0x10/0x10 [ 11.068838] ret_from_fork+0x116/0x1d0 [ 11.068855] ? __pfx_kthread+0x10/0x10 [ 11.068875] ret_from_fork_asm+0x1a/0x30 [ 11.068905] </TASK> [ 11.068915] [ 11.078014] Allocated by task 190: [ 11.078535] kasan_save_stack+0x45/0x70 [ 11.078909] kasan_save_track+0x18/0x40 [ 11.079304] kasan_save_alloc_info+0x3b/0x50 [ 11.079532] __kasan_kmalloc+0xb7/0xc0 [ 11.079849] __kmalloc_cache_noprof+0x189/0x420 [ 11.080049] kmalloc_oob_memset_2+0xac/0x330 [ 11.080292] kunit_try_run_case+0x1a5/0x480 [ 11.080608] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.080859] kthread+0x337/0x6f0 [ 11.081241] ret_from_fork+0x116/0x1d0 [ 11.081436] ret_from_fork_asm+0x1a/0x30 [ 11.081621] [ 11.081712] The buggy address belongs to the object at ffff888102826000 [ 11.081712] which belongs to the cache kmalloc-128 of size 128 [ 11.082452] The buggy address is located 119 bytes inside of [ 11.082452] allocated 120-byte region [ffff888102826000, ffff888102826078) [ 11.083228] [ 11.083324] The buggy address belongs to the physical page: [ 11.083590] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102826 [ 11.083893] flags: 0x200000000000000(node=0|zone=2) [ 11.084304] page_type: f5(slab) [ 11.084473] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 11.084964] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.085466] page dumped because: kasan: bad access detected [ 11.085759] [ 11.085975] Memory state around the buggy address: [ 11.086390] ffff888102825f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.086668] ffff888102825f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.087091] >ffff888102826000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 11.087434] ^ [ 11.087711] ffff888102826080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.088267] ffff888102826100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.088526] ==================================================================