Date
June 3, 2025, 7:38 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 | |
| x86 |
[ 18.365000] ================================================================== [ 18.365076] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x150/0x2f8 [ 18.365128] Write of size 8 at addr fff00000c65b1371 by task kunit_try_catch/176 [ 18.365240] [ 18.365299] CPU: 1 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250603 #1 PREEMPT [ 18.365407] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.365492] Hardware name: linux,dummy-virt (DT) [ 18.365527] Call trace: [ 18.365567] show_stack+0x20/0x38 (C) [ 18.365633] dump_stack_lvl+0x8c/0xd0 [ 18.365685] print_report+0x118/0x608 [ 18.365731] kasan_report+0xdc/0x128 [ 18.365775] kasan_check_range+0x100/0x1a8 [ 18.365822] __asan_memset+0x34/0x78 [ 18.365863] kmalloc_oob_memset_8+0x150/0x2f8 [ 18.366181] kunit_try_run_case+0x170/0x3f0 [ 18.366254] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.366323] kthread+0x328/0x630 [ 18.366396] ret_from_fork+0x10/0x20 [ 18.366513] [ 18.366552] Allocated by task 176: [ 18.366600] kasan_save_stack+0x3c/0x68 [ 18.366646] kasan_save_track+0x20/0x40 [ 18.366747] kasan_save_alloc_info+0x40/0x58 [ 18.366783] __kasan_kmalloc+0xd4/0xd8 [ 18.366819] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.366856] kmalloc_oob_memset_8+0xb0/0x2f8 [ 18.366911] kunit_try_run_case+0x170/0x3f0 [ 18.366988] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.367030] kthread+0x328/0x630 [ 18.367061] ret_from_fork+0x10/0x20 [ 18.367115] [ 18.367151] The buggy address belongs to the object at fff00000c65b1300 [ 18.367151] which belongs to the cache kmalloc-128 of size 128 [ 18.367299] The buggy address is located 113 bytes inside of [ 18.367299] allocated 120-byte region [fff00000c65b1300, fff00000c65b1378) [ 18.367746] [ 18.367780] The buggy address belongs to the physical page: [ 18.367840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065b1 [ 18.368066] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.368145] page_type: f5(slab) [ 18.368186] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 18.368244] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.368283] page dumped because: kasan: bad access detected [ 18.368334] [ 18.368362] Memory state around the buggy address: [ 18.368402] fff00000c65b1200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.368454] fff00000c65b1280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.368495] >fff00000c65b1300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.368540] ^ [ 18.368607] fff00000c65b1380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.368656] fff00000c65b1400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.368694] ==================================================================
[ 14.666135] ================================================================== [ 14.666820] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x166/0x330 [ 14.667809] Write of size 8 at addr ffff8881033dc071 by task kunit_try_catch/193 [ 14.668817] [ 14.669146] CPU: 0 UID: 0 PID: 193 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250603 #1 PREEMPT(voluntary) [ 14.669317] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.669364] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.669414] Call Trace: [ 14.669445] <TASK> [ 14.669500] dump_stack_lvl+0x73/0xb0 [ 14.669603] print_report+0xd1/0x650 [ 14.669672] ? __virt_addr_valid+0x1db/0x2d0 [ 14.669831] ? kmalloc_oob_memset_8+0x166/0x330 [ 14.669873] ? kasan_complete_mode_report_info+0x2a/0x200 [ 14.669907] ? kmalloc_oob_memset_8+0x166/0x330 [ 14.669932] kasan_report+0x141/0x180 [ 14.669959] ? kmalloc_oob_memset_8+0x166/0x330 [ 14.669988] kasan_check_range+0x10c/0x1c0 [ 14.670014] __asan_memset+0x27/0x50 [ 14.670037] kmalloc_oob_memset_8+0x166/0x330 [ 14.670062] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 14.670089] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 14.670118] kunit_try_run_case+0x1a5/0x480 [ 14.670144] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.670165] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.670194] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.670235] ? __kthread_parkme+0x82/0x180 [ 14.670259] ? preempt_count_sub+0x50/0x80 [ 14.670286] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.670309] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.670336] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.670362] kthread+0x337/0x6f0 [ 14.670384] ? trace_preempt_on+0x20/0xc0 [ 14.670412] ? __pfx_kthread+0x10/0x10 [ 14.670434] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.670479] ? calculate_sigpending+0x7b/0xa0 [ 14.670510] ? __pfx_kthread+0x10/0x10 [ 14.670534] ret_from_fork+0x116/0x1d0 [ 14.670557] ? __pfx_kthread+0x10/0x10 [ 14.670579] ret_from_fork_asm+0x1a/0x30 [ 14.670614] </TASK> [ 14.670628] [ 14.684522] Allocated by task 193: [ 14.685088] kasan_save_stack+0x45/0x70 [ 14.685727] kasan_save_track+0x18/0x40 [ 14.685967] kasan_save_alloc_info+0x3b/0x50 [ 14.686191] __kasan_kmalloc+0xb7/0xc0 [ 14.686480] __kmalloc_cache_noprof+0x189/0x420 [ 14.686762] kmalloc_oob_memset_8+0xac/0x330 [ 14.687355] kunit_try_run_case+0x1a5/0x480 [ 14.688753] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.689009] kthread+0x337/0x6f0 [ 14.689623] ret_from_fork+0x116/0x1d0 [ 14.689970] ret_from_fork_asm+0x1a/0x30 [ 14.690554] [ 14.690896] The buggy address belongs to the object at ffff8881033dc000 [ 14.690896] which belongs to the cache kmalloc-128 of size 128 [ 14.692065] The buggy address is located 113 bytes inside of [ 14.692065] allocated 120-byte region [ffff8881033dc000, ffff8881033dc078) [ 14.692947] [ 14.693436] The buggy address belongs to the physical page: [ 14.694152] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1033dc [ 14.694595] flags: 0x200000000000000(node=0|zone=2) [ 14.694887] page_type: f5(slab) [ 14.695201] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.695586] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 14.695953] page dumped because: kasan: bad access detected [ 14.696232] [ 14.696412] Memory state around the buggy address: [ 14.697908] ffff8881033dbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.698298] ffff8881033dbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.698794] >ffff8881033dc000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 14.699200] ^ [ 14.700314] ffff8881033dc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.700634] ffff8881033dc100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.701573] ==================================================================
[ 28.923646] ================================================================== [ 28.934980] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x166/0x330 [ 28.942207] Write of size 8 at addr ffff888106106c71 by task kunit_try_catch/216 [ 28.949608] [ 28.951108] CPU: 0 UID: 0 PID: 216 Comm: kunit_try_catch Tainted: G S B N 6.15.0-next-20250603 #1 PREEMPT(voluntary) [ 28.951117] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST [ 28.951120] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021 [ 28.951124] Call Trace: [ 28.951125] <TASK> [ 28.951127] dump_stack_lvl+0x73/0xb0 [ 28.951131] print_report+0xd1/0x650 [ 28.951135] ? __virt_addr_valid+0x1db/0x2d0 [ 28.951139] ? kmalloc_oob_memset_8+0x166/0x330 [ 28.951143] ? kasan_complete_mode_report_info+0x2a/0x200 [ 28.951147] ? kmalloc_oob_memset_8+0x166/0x330 [ 28.951151] kasan_report+0x141/0x180 [ 28.951155] ? kmalloc_oob_memset_8+0x166/0x330 [ 28.951160] kasan_check_range+0x10c/0x1c0 [ 28.951165] __asan_memset+0x27/0x50 [ 28.951168] kmalloc_oob_memset_8+0x166/0x330 [ 28.951172] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 28.951177] ? __schedule+0x10cc/0x2b60 [ 28.951181] ? ktime_get_ts64+0x83/0x230 [ 28.951185] kunit_try_run_case+0x1a2/0x480 [ 28.951189] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.951192] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 28.951197] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.951201] ? __kthread_parkme+0x82/0x180 [ 28.951205] ? preempt_count_sub+0x50/0x80 [ 28.951209] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.951212] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 28.951217] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.951222] kthread+0x334/0x6f0 [ 28.951225] ? trace_preempt_on+0x20/0xc0 [ 28.951229] ? __pfx_kthread+0x10/0x10 [ 28.951233] ? _raw_spin_unlock_irq+0x47/0x80 [ 28.951237] ? calculate_sigpending+0x7b/0xa0 [ 28.951241] ? __pfx_kthread+0x10/0x10 [ 28.951245] ret_from_fork+0x113/0x1d0 [ 28.951248] ? __pfx_kthread+0x10/0x10 [ 28.951252] ret_from_fork_asm+0x1a/0x30 [ 28.951258] </TASK> [ 28.951259] [ 29.121100] Allocated by task 216: [ 29.124506] kasan_save_stack+0x45/0x70 [ 29.128347] kasan_save_track+0x18/0x40 [ 29.132237] kasan_save_alloc_info+0x3b/0x50 [ 29.136510] __kasan_kmalloc+0xb7/0xc0 [ 29.140262] __kmalloc_cache_noprof+0x189/0x420 [ 29.144794] kmalloc_oob_memset_8+0xac/0x330 [ 29.149067] kunit_try_run_case+0x1a2/0x480 [ 29.153252] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 29.158654] kthread+0x334/0x6f0 [ 29.161887] ret_from_fork+0x113/0x1d0 [ 29.165638] ret_from_fork_asm+0x1a/0x30 [ 29.169563] [ 29.171062] The buggy address belongs to the object at ffff888106106c00 [ 29.171062] which belongs to the cache kmalloc-128 of size 128 [ 29.183569] The buggy address is located 113 bytes inside of [ 29.183569] allocated 120-byte region [ffff888106106c00, ffff888106106c78) [ 29.196171] [ 29.197668] The buggy address belongs to the physical page: [ 29.203243] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106106 [ 29.211249] flags: 0x200000000000000(node=0|zone=2) [ 29.216129] page_type: f5(slab) [ 29.219276] raw: 0200000000000000 ffff888100042a00 dead000000000122 0000000000000000 [ 29.227014] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.234754] page dumped because: kasan: bad access detected [ 29.240326] [ 29.241826] Memory state around the buggy address: [ 29.246619] ffff888106106b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.253839] ffff888106106b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.261058] >ffff888106106c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 29.268284] ^ [ 29.275424] ffff888106106c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.282645] ffff888106106d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.289864] ==================================================================