Date
June 16, 2025, 7:07 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.268115] ================================================================== [ 19.268256] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x150/0x2f8 [ 19.268388] Write of size 2 at addr fff00000c6399e77 by task kunit_try_catch/181 [ 19.269071] [ 19.269613] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT [ 19.270642] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.270818] Hardware name: linux,dummy-virt (DT) [ 19.270981] Call trace: [ 19.271146] show_stack+0x20/0x38 (C) [ 19.271375] dump_stack_lvl+0x8c/0xd0 [ 19.271495] print_report+0x118/0x608 [ 19.271622] kasan_report+0xdc/0x128 [ 19.271974] kasan_check_range+0x100/0x1a8 [ 19.272315] __asan_memset+0x34/0x78 [ 19.272428] kmalloc_oob_memset_2+0x150/0x2f8 [ 19.273233] kunit_try_run_case+0x170/0x3f0 [ 19.273353] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.273469] kthread+0x328/0x630 [ 19.273568] ret_from_fork+0x10/0x20 [ 19.274183] [ 19.274276] Allocated by task 181: [ 19.274362] kasan_save_stack+0x3c/0x68 [ 19.274469] kasan_save_track+0x20/0x40 [ 19.274558] kasan_save_alloc_info+0x40/0x58 [ 19.274641] __kasan_kmalloc+0xd4/0xd8 [ 19.274730] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.274830] kmalloc_oob_memset_2+0xb0/0x2f8 [ 19.274933] kunit_try_run_case+0x170/0x3f0 [ 19.275028] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.276768] kthread+0x328/0x630 [ 19.276889] ret_from_fork+0x10/0x20 [ 19.277967] [ 19.278160] The buggy address belongs to the object at fff00000c6399e00 [ 19.278160] which belongs to the cache kmalloc-128 of size 128 [ 19.278407] The buggy address is located 119 bytes inside of [ 19.278407] allocated 120-byte region [fff00000c6399e00, fff00000c6399e78) [ 19.279101] [ 19.279320] The buggy address belongs to the physical page: [ 19.279460] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106399 [ 19.279711] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.279881] page_type: f5(slab) [ 19.280136] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.280562] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.281009] page dumped because: kasan: bad access detected [ 19.281089] [ 19.281132] Memory state around the buggy address: [ 19.281205] fff00000c6399d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.281304] fff00000c6399d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.281405] >fff00000c6399e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.281501] ^ [ 19.282927] fff00000c6399e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.283158] fff00000c6399f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.283566] ==================================================================
[ 11.503052] ================================================================== [ 11.503686] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x166/0x330 [ 11.504001] Write of size 2 at addr ffff8881028e2377 by task kunit_try_catch/197 [ 11.504296] [ 11.504381] CPU: 1 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT(voluntary) [ 11.504427] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.504438] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.504459] Call Trace: [ 11.504472] <TASK> [ 11.504489] dump_stack_lvl+0x73/0xb0 [ 11.504517] print_report+0xd1/0x650 [ 11.504540] ? __virt_addr_valid+0x1db/0x2d0 [ 11.504562] ? kmalloc_oob_memset_2+0x166/0x330 [ 11.504582] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.504603] ? kmalloc_oob_memset_2+0x166/0x330 [ 11.504624] kasan_report+0x141/0x180 [ 11.504644] ? kmalloc_oob_memset_2+0x166/0x330 [ 11.504669] kasan_check_range+0x10c/0x1c0 [ 11.504691] __asan_memset+0x27/0x50 [ 11.504710] kmalloc_oob_memset_2+0x166/0x330 [ 11.504731] ? __pfx_kmalloc_oob_memset_2+0x10/0x10 [ 11.504753] ? __schedule+0x10cc/0x2b60 [ 11.504774] ? __pfx_read_tsc+0x10/0x10 [ 11.504794] ? ktime_get_ts64+0x86/0x230 [ 11.504819] kunit_try_run_case+0x1a5/0x480 [ 11.504843] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.504864] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.504885] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.504906] ? __kthread_parkme+0x82/0x180 [ 11.504926] ? preempt_count_sub+0x50/0x80 [ 11.504959] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.504982] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.505003] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.505025] kthread+0x337/0x6f0 [ 11.505043] ? trace_preempt_on+0x20/0xc0 [ 11.505067] ? __pfx_kthread+0x10/0x10 [ 11.505086] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.505106] ? calculate_sigpending+0x7b/0xa0 [ 11.505129] ? __pfx_kthread+0x10/0x10 [ 11.505149] ret_from_fork+0x116/0x1d0 [ 11.505167] ? __pfx_kthread+0x10/0x10 [ 11.505186] ret_from_fork_asm+0x1a/0x30 [ 11.505216] </TASK> [ 11.505227] [ 11.515145] Allocated by task 197: [ 11.515643] kasan_save_stack+0x45/0x70 [ 11.516218] kasan_save_track+0x18/0x40 [ 11.516744] kasan_save_alloc_info+0x3b/0x50 [ 11.517419] __kasan_kmalloc+0xb7/0xc0 [ 11.518049] __kmalloc_cache_noprof+0x189/0x420 [ 11.518230] kmalloc_oob_memset_2+0xac/0x330 [ 11.518373] kunit_try_run_case+0x1a5/0x480 [ 11.519001] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.519697] kthread+0x337/0x6f0 [ 11.520135] ret_from_fork+0x116/0x1d0 [ 11.520512] ret_from_fork_asm+0x1a/0x30 [ 11.520669] [ 11.520742] The buggy address belongs to the object at ffff8881028e2300 [ 11.520742] which belongs to the cache kmalloc-128 of size 128 [ 11.521487] The buggy address is located 119 bytes inside of [ 11.521487] allocated 120-byte region [ffff8881028e2300, ffff8881028e2378) [ 11.522663] [ 11.522829] The buggy address belongs to the physical page: [ 11.523303] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1028e2 [ 11.523783] flags: 0x200000000000000(node=0|zone=2) [ 11.523991] page_type: f5(slab) [ 11.524288] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 11.525107] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.525661] page dumped because: kasan: bad access detected [ 11.525841] [ 11.525906] Memory state around the buggy address: [ 11.526066] ffff8881028e2200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.526275] ffff8881028e2280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.526768] >ffff8881028e2300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 11.527372] ^ [ 11.528044] ffff8881028e2380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.528872] ffff8881028e2400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.529619] ==================================================================