Date
June 24, 2025, 11:37 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 38.473791] ================================================================== [ 38.485364] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 38.493043] Read of size 18446744073709551614 at addr ffff000080acfc84 by task kunit_try_catch/278 [ 38.502124] [ 38.503658] CPU: 3 UID: 0 PID: 278 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 38.503688] Tainted: [B]=BAD_PAGE, [N]=TEST [ 38.503698] Hardware name: Thundercomm Dragonboard 845c (DT) [ 38.503710] Call trace: [ 38.503718] show_stack+0x20/0x38 (C) [ 38.503736] dump_stack_lvl+0x8c/0xd0 [ 38.503756] print_report+0x118/0x608 [ 38.503776] kasan_report+0xdc/0x128 [ 38.503795] kasan_check_range+0x100/0x1a8 [ 38.503815] __asan_memmove+0x3c/0x98 [ 38.503832] kmalloc_memmove_negative_size+0x154/0x2e0 [ 38.503852] kunit_try_run_case+0x170/0x3f0 [ 38.503873] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.503896] kthread+0x328/0x630 [ 38.503911] ret_from_fork+0x10/0x20 [ 38.503928] [ 38.573600] Allocated by task 278: [ 38.577066] kasan_save_stack+0x3c/0x68 [ 38.580973] kasan_save_track+0x20/0x40 [ 38.584879] kasan_save_alloc_info+0x40/0x58 [ 38.589225] __kasan_kmalloc+0xd4/0xd8 [ 38.593043] __kmalloc_cache_noprof+0x16c/0x3c0 [ 38.597651] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 38.602787] kunit_try_run_case+0x170/0x3f0 [ 38.607048] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.612618] kthread+0x328/0x630 [ 38.615906] ret_from_fork+0x10/0x20 [ 38.619549] [ 38.621081] The buggy address belongs to the object at ffff000080acfc80 [ 38.621081] which belongs to the cache kmalloc-64 of size 64 [ 38.633570] The buggy address is located 4 bytes inside of [ 38.633570] 64-byte region [ffff000080acfc80, ffff000080acfcc0) [ 38.645187] [ 38.646718] The buggy address belongs to the physical page: [ 38.652365] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100acf [ 38.660470] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 38.667085] page_type: f5(slab) [ 38.670285] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 38.678133] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 38.685976] page dumped because: kasan: bad access detected [ 38.691621] [ 38.693151] Memory state around the buggy address: [ 38.698010] ffff000080acfb80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 38.705325] ffff000080acfc00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 38.712641] >ffff000080acfc80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 38.719953] ^ [ 38.723236] ffff000080acfd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.730552] ffff000080acfd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.737866] ==================================================================
[ 33.116918] ================================================================== [ 33.117291] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 33.117438] Read of size 18446744073709551614 at addr fff00000c7735104 by task kunit_try_catch/191 [ 33.117627] [ 33.117715] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 33.117949] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.118144] Hardware name: linux,dummy-virt (DT) [ 33.118297] Call trace: [ 33.118374] show_stack+0x20/0x38 (C) [ 33.118685] dump_stack_lvl+0x8c/0xd0 [ 33.118915] print_report+0x118/0x608 [ 33.119669] kasan_report+0xdc/0x128 [ 33.120011] kasan_check_range+0x100/0x1a8 [ 33.120230] __asan_memmove+0x3c/0x98 [ 33.120590] kmalloc_memmove_negative_size+0x154/0x2e0 [ 33.120846] kunit_try_run_case+0x170/0x3f0 [ 33.121074] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.121757] kthread+0x328/0x630 [ 33.122053] ret_from_fork+0x10/0x20 [ 33.122400] [ 33.122500] Allocated by task 191: [ 33.122638] kasan_save_stack+0x3c/0x68 [ 33.123014] kasan_save_track+0x20/0x40 [ 33.123316] kasan_save_alloc_info+0x40/0x58 [ 33.123513] __kasan_kmalloc+0xd4/0xd8 [ 33.123817] __kmalloc_cache_noprof+0x16c/0x3c0 [ 33.124215] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 33.125594] kunit_try_run_case+0x170/0x3f0 [ 33.125949] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.126221] kthread+0x328/0x630 [ 33.126377] ret_from_fork+0x10/0x20 [ 33.126482] [ 33.127058] The buggy address belongs to the object at fff00000c7735100 [ 33.127058] which belongs to the cache kmalloc-64 of size 64 [ 33.127314] The buggy address is located 4 bytes inside of [ 33.127314] 64-byte region [fff00000c7735100, fff00000c7735140) [ 33.127827] [ 33.128003] The buggy address belongs to the physical page: [ 33.128190] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107735 [ 33.128316] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.128436] page_type: f5(slab) [ 33.128639] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 33.129168] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.129439] page dumped because: kasan: bad access detected [ 33.129769] [ 33.129966] Memory state around the buggy address: [ 33.130152] fff00000c7735000: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 33.130436] fff00000c7735080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 33.130543] >fff00000c7735100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 33.130640] ^ [ 33.130709] fff00000c7735180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.131658] fff00000c7735200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.131722] ==================================================================
[ 29.241488] ================================================================== [ 29.242837] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330 [ 29.243445] Read of size 18446744073709551614 at addr ffff888102d0b104 by task kunit_try_catch/210 [ 29.244005] [ 29.244386] CPU: 1 UID: 0 PID: 210 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT(voluntary) [ 29.244502] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.244532] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 29.244601] Call Trace: [ 29.244663] <TASK> [ 29.244711] dump_stack_lvl+0x73/0xb0 [ 29.244807] print_report+0xd1/0x650 [ 29.244863] ? __virt_addr_valid+0x1db/0x2d0 [ 29.244922] ? kmalloc_memmove_negative_size+0x171/0x330 [ 29.244981] ? kasan_complete_mode_report_info+0x2a/0x200 [ 29.245209] ? kmalloc_memmove_negative_size+0x171/0x330 [ 29.245342] kasan_report+0x141/0x180 [ 29.245405] ? kmalloc_memmove_negative_size+0x171/0x330 [ 29.245471] kasan_check_range+0x10c/0x1c0 [ 29.245526] __asan_memmove+0x27/0x70 [ 29.245582] kmalloc_memmove_negative_size+0x171/0x330 [ 29.245616] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 29.245664] ? __schedule+0x10cc/0x2b60 [ 29.245698] ? __pfx_read_tsc+0x10/0x10 [ 29.245727] ? ktime_get_ts64+0x86/0x230 [ 29.245758] kunit_try_run_case+0x1a5/0x480 [ 29.245791] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.245820] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 29.245850] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 29.245880] ? __kthread_parkme+0x82/0x180 [ 29.245907] ? preempt_count_sub+0x50/0x80 [ 29.245937] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.245967] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.245997] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 29.246027] kthread+0x337/0x6f0 [ 29.246056] ? trace_preempt_on+0x20/0xc0 [ 29.246134] ? __pfx_kthread+0x10/0x10 [ 29.246181] ? _raw_spin_unlock_irq+0x47/0x80 [ 29.246213] ? calculate_sigpending+0x7b/0xa0 [ 29.246245] ? __pfx_kthread+0x10/0x10 [ 29.246273] ret_from_fork+0x116/0x1d0 [ 29.246299] ? __pfx_kthread+0x10/0x10 [ 29.246326] ret_from_fork_asm+0x1a/0x30 [ 29.246364] </TASK> [ 29.246379] [ 29.262513] Allocated by task 210: [ 29.263272] kasan_save_stack+0x45/0x70 [ 29.263677] kasan_save_track+0x18/0x40 [ 29.264189] kasan_save_alloc_info+0x3b/0x50 [ 29.264690] __kasan_kmalloc+0xb7/0xc0 [ 29.265536] __kmalloc_cache_noprof+0x189/0x420 [ 29.266088] kmalloc_memmove_negative_size+0xac/0x330 [ 29.266584] kunit_try_run_case+0x1a5/0x480 [ 29.267018] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.267728] kthread+0x337/0x6f0 [ 29.267943] ret_from_fork+0x116/0x1d0 [ 29.268466] ret_from_fork_asm+0x1a/0x30 [ 29.268912] [ 29.269444] The buggy address belongs to the object at ffff888102d0b100 [ 29.269444] which belongs to the cache kmalloc-64 of size 64 [ 29.270399] The buggy address is located 4 bytes inside of [ 29.270399] 64-byte region [ffff888102d0b100, ffff888102d0b140) [ 29.271553] [ 29.271820] The buggy address belongs to the physical page: [ 29.272397] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102d0b [ 29.272986] flags: 0x200000000000000(node=0|zone=2) [ 29.273782] page_type: f5(slab) [ 29.274088] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 29.274858] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 29.275597] page dumped because: kasan: bad access detected [ 29.276027] [ 29.276361] Memory state around the buggy address: [ 29.276878] ffff888102d0b000: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 29.277772] ffff888102d0b080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 29.278402] >ffff888102d0b100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 29.279199] ^ [ 29.279403] ffff888102d0b180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.280285] ffff888102d0b200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.280698] ==================================================================