Date
June 5, 2025, 7:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 25.300721] ================================================================== [ 25.301050] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x150/0x2f8 [ 25.301158] Write of size 16 at addr fff00000c6419669 by task kunit_try_catch/178 [ 25.301408] [ 25.301478] CPU: 0 UID: 0 PID: 178 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250605 #1 PREEMPT [ 25.301672] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.301735] Hardware name: linux,dummy-virt (DT) [ 25.301811] Call trace: [ 25.301860] show_stack+0x20/0x38 (C) [ 25.301971] dump_stack_lvl+0x8c/0xd0 [ 25.302085] print_report+0x118/0x608 [ 25.302195] kasan_report+0xdc/0x128 [ 25.302301] kasan_check_range+0x100/0x1a8 [ 25.302458] __asan_memset+0x34/0x78 [ 25.302637] kmalloc_oob_memset_16+0x150/0x2f8 [ 25.303084] kunit_try_run_case+0x170/0x3f0 [ 25.303550] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.303921] kthread+0x328/0x630 [ 25.304543] ret_from_fork+0x10/0x20 [ 25.304804] [ 25.304855] Allocated by task 178: [ 25.305021] kasan_save_stack+0x3c/0x68 [ 25.305191] kasan_save_track+0x20/0x40 [ 25.305357] kasan_save_alloc_info+0x40/0x58 [ 25.305529] __kasan_kmalloc+0xd4/0xd8 [ 25.305758] __kmalloc_cache_noprof+0x16c/0x3c0 [ 25.305870] kmalloc_oob_memset_16+0xb0/0x2f8 [ 25.305975] kunit_try_run_case+0x170/0x3f0 [ 25.306296] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 25.306436] kthread+0x328/0x630 [ 25.306522] ret_from_fork+0x10/0x20 [ 25.306627] [ 25.306745] The buggy address belongs to the object at fff00000c6419600 [ 25.306745] which belongs to the cache kmalloc-128 of size 128 [ 25.306984] The buggy address is located 105 bytes inside of [ 25.306984] allocated 120-byte region [fff00000c6419600, fff00000c6419678) [ 25.307291] [ 25.307363] The buggy address belongs to the physical page: [ 25.307545] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106419 [ 25.307725] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 25.307838] page_type: f5(slab) [ 25.307933] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 25.308053] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.308146] page dumped because: kasan: bad access detected [ 25.308234] [ 25.308291] Memory state around the buggy address: [ 25.308495] fff00000c6419500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.308813] fff00000c6419580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.309118] >fff00000c6419600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 25.309477] ^ [ 25.309639] fff00000c6419680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.309761] fff00000c6419700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.309869] ==================================================================
[ 11.530514] ================================================================== [ 11.531879] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x166/0x330 [ 11.533021] Write of size 16 at addr ffff88810276e669 by task kunit_try_catch/195 [ 11.533995] [ 11.534345] CPU: 1 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250605 #1 PREEMPT(voluntary) [ 11.534394] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.534405] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.534425] Call Trace: [ 11.534437] <TASK> [ 11.534451] dump_stack_lvl+0x73/0xb0 [ 11.534480] print_report+0xd1/0x650 [ 11.534502] ? __virt_addr_valid+0x1db/0x2d0 [ 11.534526] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.534548] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.534573] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.534596] kasan_report+0x141/0x180 [ 11.534778] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.534817] kasan_check_range+0x10c/0x1c0 [ 11.534842] __asan_memset+0x27/0x50 [ 11.534862] kmalloc_oob_memset_16+0x166/0x330 [ 11.534949] ? __pfx_kmalloc_oob_memset_16+0x10/0x10 [ 11.534975] ? __schedule+0x10cc/0x2b60 [ 11.534998] ? __pfx_read_tsc+0x10/0x10 [ 11.535021] ? ktime_get_ts64+0x86/0x230 [ 11.535045] kunit_try_run_case+0x1a5/0x480 [ 11.535067] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.535087] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.535112] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.535137] ? __kthread_parkme+0x82/0x180 [ 11.535158] ? preempt_count_sub+0x50/0x80 [ 11.535182] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.535204] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.535230] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.535256] kthread+0x337/0x6f0 [ 11.535275] ? trace_preempt_on+0x20/0xc0 [ 11.535299] ? __pfx_kthread+0x10/0x10 [ 11.535320] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.535344] ? calculate_sigpending+0x7b/0xa0 [ 11.535369] ? __pfx_kthread+0x10/0x10 [ 11.535390] ret_from_fork+0x116/0x1d0 [ 11.535408] ? __pfx_kthread+0x10/0x10 [ 11.535429] ret_from_fork_asm+0x1a/0x30 [ 11.535459] </TASK> [ 11.535470] [ 11.553550] Allocated by task 195: [ 11.553926] kasan_save_stack+0x45/0x70 [ 11.554541] kasan_save_track+0x18/0x40 [ 11.555032] kasan_save_alloc_info+0x3b/0x50 [ 11.555666] __kasan_kmalloc+0xb7/0xc0 [ 11.556145] __kmalloc_cache_noprof+0x189/0x420 [ 11.556761] kmalloc_oob_memset_16+0xac/0x330 [ 11.557242] kunit_try_run_case+0x1a5/0x480 [ 11.557399] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.557578] kthread+0x337/0x6f0 [ 11.557713] ret_from_fork+0x116/0x1d0 [ 11.558165] ret_from_fork_asm+0x1a/0x30 [ 11.558570] [ 11.558746] The buggy address belongs to the object at ffff88810276e600 [ 11.558746] which belongs to the cache kmalloc-128 of size 128 [ 11.560329] The buggy address is located 105 bytes inside of [ 11.560329] allocated 120-byte region [ffff88810276e600, ffff88810276e678) [ 11.561014] [ 11.561207] The buggy address belongs to the physical page: [ 11.561715] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10276e [ 11.562471] flags: 0x200000000000000(node=0|zone=2) [ 11.562651] page_type: f5(slab) [ 11.562988] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 11.563805] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.564334] page dumped because: kasan: bad access detected [ 11.564611] [ 11.564698] Memory state around the buggy address: [ 11.564854] ffff88810276e500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.565523] ffff88810276e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.566242] >ffff88810276e600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 11.566959] ^ [ 11.567684] ffff88810276e680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.568200] ffff88810276e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.568409] ==================================================================