Date
June 3, 2025, 7:38 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 | |
| x86 |
[ 18.383567] ================================================================== [ 18.383788] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 18.383846] Read of size 18446744073709551614 at addr fff00000c65b5784 by task kunit_try_catch/180 [ 18.383952] [ 18.383985] CPU: 1 UID: 0 PID: 180 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250603 #1 PREEMPT [ 18.384070] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.384095] Hardware name: linux,dummy-virt (DT) [ 18.384125] Call trace: [ 18.384147] show_stack+0x20/0x38 (C) [ 18.384335] dump_stack_lvl+0x8c/0xd0 [ 18.384400] print_report+0x118/0x608 [ 18.385352] kasan_report+0xdc/0x128 [ 18.385413] kasan_check_range+0x100/0x1a8 [ 18.385475] __asan_memmove+0x3c/0x98 [ 18.385523] kmalloc_memmove_negative_size+0x154/0x2e0 [ 18.385589] kunit_try_run_case+0x170/0x3f0 [ 18.385644] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.385729] kthread+0x328/0x630 [ 18.385775] ret_from_fork+0x10/0x20 [ 18.385825] [ 18.385844] Allocated by task 180: [ 18.385872] kasan_save_stack+0x3c/0x68 [ 18.385927] kasan_save_track+0x20/0x40 [ 18.385966] kasan_save_alloc_info+0x40/0x58 [ 18.386001] __kasan_kmalloc+0xd4/0xd8 [ 18.386038] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.386085] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 18.386125] kunit_try_run_case+0x170/0x3f0 [ 18.386169] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.386213] kthread+0x328/0x630 [ 18.386257] ret_from_fork+0x10/0x20 [ 18.386294] [ 18.386313] The buggy address belongs to the object at fff00000c65b5780 [ 18.386313] which belongs to the cache kmalloc-64 of size 64 [ 18.386371] The buggy address is located 4 bytes inside of [ 18.386371] 64-byte region [fff00000c65b5780, fff00000c65b57c0) [ 18.386827] [ 18.386909] The buggy address belongs to the physical page: [ 18.386984] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065b5 [ 18.387046] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.387298] page_type: f5(slab) [ 18.387344] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 18.387468] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 18.387560] page dumped because: kasan: bad access detected [ 18.387644] [ 18.387682] Memory state around the buggy address: [ 18.387735] fff00000c65b5680: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 18.387834] fff00000c65b5700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 18.387877] >fff00000c65b5780: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 18.387963] ^ [ 18.388073] fff00000c65b5800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.388182] fff00000c65b5880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.388275] ==================================================================
[ 14.757450] ================================================================== [ 14.758588] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330 [ 14.759769] Read of size 18446744073709551614 at addr ffff8881033d4a04 by task kunit_try_catch/197 [ 14.760602] [ 14.760767] CPU: 0 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250603 #1 PREEMPT(voluntary) [ 14.761054] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.761090] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.761132] Call Trace: [ 14.761163] <TASK> [ 14.761202] dump_stack_lvl+0x73/0xb0 [ 14.761260] print_report+0xd1/0x650 [ 14.761289] ? __virt_addr_valid+0x1db/0x2d0 [ 14.761317] ? kmalloc_memmove_negative_size+0x171/0x330 [ 14.761345] ? kasan_complete_mode_report_info+0x2a/0x200 [ 14.761369] ? kmalloc_memmove_negative_size+0x171/0x330 [ 14.761433] kasan_report+0x141/0x180 [ 14.761490] ? kmalloc_memmove_negative_size+0x171/0x330 [ 14.761549] kasan_check_range+0x10c/0x1c0 [ 14.761598] __asan_memmove+0x27/0x70 [ 14.761645] kmalloc_memmove_negative_size+0x171/0x330 [ 14.761698] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 14.761759] ? __schedule+0x10cc/0x2b60 [ 14.761801] ? __pfx_read_tsc+0x10/0x10 [ 14.761840] ? ktime_get_ts64+0x86/0x230 [ 14.761882] kunit_try_run_case+0x1a5/0x480 [ 14.761916] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.761946] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.761984] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.762022] ? __kthread_parkme+0x82/0x180 [ 14.762054] ? preempt_count_sub+0x50/0x80 [ 14.762093] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.762126] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.762164] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.762201] kthread+0x337/0x6f0 [ 14.762232] ? trace_preempt_on+0x20/0xc0 [ 14.762270] ? __pfx_kthread+0x10/0x10 [ 14.762303] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.762340] ? calculate_sigpending+0x7b/0xa0 [ 14.762371] ? __pfx_kthread+0x10/0x10 [ 14.762395] ret_from_fork+0x116/0x1d0 [ 14.762416] ? __pfx_kthread+0x10/0x10 [ 14.762438] ret_from_fork_asm+0x1a/0x30 [ 14.762493] </TASK> [ 14.762507] [ 14.775952] Allocated by task 197: [ 14.776227] kasan_save_stack+0x45/0x70 [ 14.776482] kasan_save_track+0x18/0x40 [ 14.776689] kasan_save_alloc_info+0x3b/0x50 [ 14.776900] __kasan_kmalloc+0xb7/0xc0 [ 14.777093] __kmalloc_cache_noprof+0x189/0x420 [ 14.777484] kmalloc_memmove_negative_size+0xac/0x330 [ 14.777913] kunit_try_run_case+0x1a5/0x480 [ 14.778279] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.778854] kthread+0x337/0x6f0 [ 14.779367] ret_from_fork+0x116/0x1d0 [ 14.779861] ret_from_fork_asm+0x1a/0x30 [ 14.780135] [ 14.780341] The buggy address belongs to the object at ffff8881033d4a00 [ 14.780341] which belongs to the cache kmalloc-64 of size 64 [ 14.781348] The buggy address is located 4 bytes inside of [ 14.781348] 64-byte region [ffff8881033d4a00, ffff8881033d4a40) [ 14.783651] [ 14.783923] The buggy address belongs to the physical page: [ 14.784143] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1033d4 [ 14.784787] flags: 0x200000000000000(node=0|zone=2) [ 14.785081] page_type: f5(slab) [ 14.785281] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 14.785957] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 14.786427] page dumped because: kasan: bad access detected [ 14.786889] [ 14.787119] Memory state around the buggy address: [ 14.787403] ffff8881033d4900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 14.788049] ffff8881033d4980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 14.788701] >ffff8881033d4a00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 14.789256] ^ [ 14.789576] ffff8881033d4a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.789962] ffff8881033d4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.790150] ==================================================================
[ 29.671902] ================================================================== [ 29.683334] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330 [ 29.690932] Read of size 18446744073709551614 at addr ffff88810478de84 by task kunit_try_catch/220 [ 29.699887] [ 29.701386] CPU: 2 UID: 0 PID: 220 Comm: kunit_try_catch Tainted: G S B N 6.15.0-next-20250603 #1 PREEMPT(voluntary) [ 29.701407] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST [ 29.701410] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021 [ 29.701413] Call Trace: [ 29.701415] <TASK> [ 29.701417] dump_stack_lvl+0x73/0xb0 [ 29.701421] print_report+0xd1/0x650 [ 29.701425] ? __virt_addr_valid+0x1db/0x2d0 [ 29.701429] ? kmalloc_memmove_negative_size+0x171/0x330 [ 29.701434] ? kasan_complete_mode_report_info+0x2a/0x200 [ 29.701438] ? kmalloc_memmove_negative_size+0x171/0x330 [ 29.701442] kasan_report+0x141/0x180 [ 29.701446] ? kmalloc_memmove_negative_size+0x171/0x330 [ 29.701452] kasan_check_range+0x10c/0x1c0 [ 29.701457] __asan_memmove+0x27/0x70 [ 29.701460] kmalloc_memmove_negative_size+0x171/0x330 [ 29.701465] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 29.701470] ? __schedule+0x10cc/0x2b60 [ 29.701474] ? ktime_get_ts64+0x83/0x230 [ 29.701479] kunit_try_run_case+0x1a2/0x480 [ 29.701482] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.701486] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 29.701490] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 29.701495] ? __kthread_parkme+0x82/0x180 [ 29.701498] ? preempt_count_sub+0x50/0x80 [ 29.701502] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.701506] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 29.701511] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 29.701515] kthread+0x334/0x6f0 [ 29.701519] ? trace_preempt_on+0x20/0xc0 [ 29.701523] ? __pfx_kthread+0x10/0x10 [ 29.701526] ? _raw_spin_unlock_irq+0x47/0x80 [ 29.701530] ? calculate_sigpending+0x7b/0xa0 [ 29.701535] ? __pfx_kthread+0x10/0x10 [ 29.701539] ret_from_fork+0x113/0x1d0 [ 29.701542] ? __pfx_kthread+0x10/0x10 [ 29.701545] ret_from_fork_asm+0x1a/0x30 [ 29.701551] </TASK> [ 29.701553] [ 29.875383] Allocated by task 220: [ 29.878814] kasan_save_stack+0x45/0x70 [ 29.882654] kasan_save_track+0x18/0x40 [ 29.886493] kasan_save_alloc_info+0x3b/0x50 [ 29.890766] __kasan_kmalloc+0xb7/0xc0 [ 29.894517] __kmalloc_cache_noprof+0x189/0x420 [ 29.899050] kmalloc_memmove_negative_size+0xac/0x330 [ 29.904104] kunit_try_run_case+0x1a2/0x480 [ 29.908288] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 29.913687] kthread+0x334/0x6f0 [ 29.916920] ret_from_fork+0x113/0x1d0 [ 29.920674] ret_from_fork_asm+0x1a/0x30 [ 29.924600] [ 29.926099] The buggy address belongs to the object at ffff88810478de80 [ 29.926099] which belongs to the cache kmalloc-64 of size 64 [ 29.938441] The buggy address is located 4 bytes inside of [ 29.938441] 64-byte region [ffff88810478de80, ffff88810478dec0) [ 29.949915] [ 29.951429] The buggy address belongs to the physical page: [ 29.957004] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10478d [ 29.965002] flags: 0x200000000000000(node=0|zone=2) [ 29.969881] page_type: f5(slab) [ 29.973031] raw: 0200000000000000 ffff8881000428c0 dead000000000122 0000000000000000 [ 29.980778] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 29.988524] page dumped because: kasan: bad access detected [ 29.994095] [ 29.995588] Memory state around the buggy address: [ 30.000426] ffff88810478dd80: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 30.007651] ffff88810478de00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 30.014871] >ffff88810478de80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 30.022089] ^ [ 30.025324] ffff88810478df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.032541] ffff88810478df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.039762] ==================================================================