Date
June 18, 2025, 6:43 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 21.140978] ================================================================== [ 21.141174] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x154/0x2e0 [ 21.141311] Read of size 64 at addr fff00000c7705d84 by task kunit_try_catch/192 [ 21.141415] [ 21.141534] CPU: 0 UID: 0 PID: 192 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc2-next-20250618 #1 PREEMPT [ 21.141746] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 21.141822] Hardware name: linux,dummy-virt (DT) [ 21.141901] Call trace: [ 21.141965] show_stack+0x20/0x38 (C) [ 21.142138] dump_stack_lvl+0x8c/0xd0 [ 21.142240] print_report+0x118/0x608 [ 21.142334] kasan_report+0xdc/0x128 [ 21.142426] kasan_check_range+0x100/0x1a8 [ 21.142551] __asan_memmove+0x3c/0x98 [ 21.142657] kmalloc_memmove_invalid_size+0x154/0x2e0 [ 21.142839] kunit_try_run_case+0x170/0x3f0 [ 21.142967] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.143096] kthread+0x328/0x630 [ 21.143180] ret_from_fork+0x10/0x20 [ 21.143282] [ 21.143328] Allocated by task 192: [ 21.143390] kasan_save_stack+0x3c/0x68 [ 21.143495] kasan_save_track+0x20/0x40 [ 21.143611] kasan_save_alloc_info+0x40/0x58 [ 21.143746] __kasan_kmalloc+0xd4/0xd8 [ 21.143824] __kmalloc_cache_noprof+0x16c/0x3c0 [ 21.143898] kmalloc_memmove_invalid_size+0xb0/0x2e0 [ 21.144011] kunit_try_run_case+0x170/0x3f0 [ 21.144154] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.144252] kthread+0x328/0x630 [ 21.144331] ret_from_fork+0x10/0x20 [ 21.144426] [ 21.144490] The buggy address belongs to the object at fff00000c7705d80 [ 21.144490] which belongs to the cache kmalloc-64 of size 64 [ 21.144700] The buggy address is located 4 bytes inside of [ 21.144700] allocated 64-byte region [fff00000c7705d80, fff00000c7705dc0) [ 21.144993] [ 21.145053] The buggy address belongs to the physical page: [ 21.145143] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107705 [ 21.145298] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.145443] page_type: f5(slab) [ 21.145540] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 21.145672] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 21.145819] page dumped because: kasan: bad access detected [ 21.145900] [ 21.145942] Memory state around the buggy address: [ 21.146722] fff00000c7705c80: 00 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc [ 21.146865] fff00000c7705d00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 21.146966] >fff00000c7705d80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 21.147069] ^ [ 21.147161] fff00000c7705e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.147256] fff00000c7705e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.147347] ==================================================================
[ 11.342884] ================================================================== [ 11.343833] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.344085] Read of size 64 at addr ffff888102620084 by task kunit_try_catch/208 [ 11.344570] [ 11.344745] CPU: 0 UID: 0 PID: 208 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250618 #1 PREEMPT(voluntary) [ 11.344795] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.344806] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.344826] Call Trace: [ 11.344838] <TASK> [ 11.344854] dump_stack_lvl+0x73/0xb0 [ 11.344883] print_report+0xd1/0x650 [ 11.344903] ? __virt_addr_valid+0x1db/0x2d0 [ 11.344924] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.344946] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.344970] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.344993] kasan_report+0x141/0x180 [ 11.345013] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.345039] kasan_check_range+0x10c/0x1c0 [ 11.345061] __asan_memmove+0x27/0x70 [ 11.345082] kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.345105] ? __pfx_kmalloc_memmove_invalid_size+0x10/0x10 [ 11.345128] ? __schedule+0x10cc/0x2b60 [ 11.345149] ? __pfx_read_tsc+0x10/0x10 [ 11.345169] ? ktime_get_ts64+0x86/0x230 [ 11.345194] kunit_try_run_case+0x1a5/0x480 [ 11.345244] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.345265] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.345288] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.345309] ? __kthread_parkme+0x82/0x180 [ 11.345329] ? preempt_count_sub+0x50/0x80 [ 11.345351] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.345373] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.345394] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.345415] kthread+0x337/0x6f0 [ 11.345433] ? trace_preempt_on+0x20/0xc0 [ 11.345456] ? __pfx_kthread+0x10/0x10 [ 11.345475] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.345494] ? calculate_sigpending+0x7b/0xa0 [ 11.345517] ? __pfx_kthread+0x10/0x10 [ 11.345537] ret_from_fork+0x116/0x1d0 [ 11.345554] ? __pfx_kthread+0x10/0x10 [ 11.345573] ret_from_fork_asm+0x1a/0x30 [ 11.345602] </TASK> [ 11.345613] [ 11.358083] Allocated by task 208: [ 11.358713] kasan_save_stack+0x45/0x70 [ 11.359344] kasan_save_track+0x18/0x40 [ 11.359861] kasan_save_alloc_info+0x3b/0x50 [ 11.360521] __kasan_kmalloc+0xb7/0xc0 [ 11.361083] __kmalloc_cache_noprof+0x189/0x420 [ 11.361637] kmalloc_memmove_invalid_size+0xac/0x330 [ 11.361815] kunit_try_run_case+0x1a5/0x480 [ 11.361955] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.362121] kthread+0x337/0x6f0 [ 11.362681] ret_from_fork+0x116/0x1d0 [ 11.363214] ret_from_fork_asm+0x1a/0x30 [ 11.363678] [ 11.363754] The buggy address belongs to the object at ffff888102620080 [ 11.363754] which belongs to the cache kmalloc-64 of size 64 [ 11.364102] The buggy address is located 4 bytes inside of [ 11.364102] allocated 64-byte region [ffff888102620080, ffff8881026200c0) [ 11.365701] [ 11.365887] The buggy address belongs to the physical page: [ 11.366595] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102620 [ 11.367172] flags: 0x200000000000000(node=0|zone=2) [ 11.367351] page_type: f5(slab) [ 11.367470] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 11.367694] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 11.367912] page dumped because: kasan: bad access detected [ 11.368076] [ 11.368137] Memory state around the buggy address: [ 11.368501] ffff88810261ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.369147] ffff888102620000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 11.369786] >ffff888102620080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 11.370412] ^ [ 11.370863] ffff888102620100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.371531] ffff888102620180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.372136] ==================================================================