Date
June 24, 2025, 11:37 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.526229] ================================================================== [ 30.538850] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 30.546259] Write of size 1 at addr ffff0000956ddf00 by task kunit_try_catch/242 [ 30.553754] [ 30.555286] CPU: 3 UID: 0 PID: 242 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 30.555315] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.555325] Hardware name: Thundercomm Dragonboard 845c (DT) [ 30.555337] Call trace: [ 30.555344] show_stack+0x20/0x38 (C) [ 30.555362] dump_stack_lvl+0x8c/0xd0 [ 30.555383] print_report+0x118/0x608 [ 30.555404] kasan_report+0xdc/0x128 [ 30.555423] __asan_report_store1_noabort+0x20/0x30 [ 30.555441] kmalloc_big_oob_right+0x2a4/0x2f0 [ 30.555459] kunit_try_run_case+0x170/0x3f0 [ 30.555478] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.555498] kthread+0x328/0x630 [ 30.555514] ret_from_fork+0x10/0x20 [ 30.555532] [ 30.621591] Allocated by task 242: [ 30.625047] kasan_save_stack+0x3c/0x68 [ 30.628955] kasan_save_track+0x20/0x40 [ 30.632864] kasan_save_alloc_info+0x40/0x58 [ 30.637201] __kasan_kmalloc+0xd4/0xd8 [ 30.641022] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.645632] kmalloc_big_oob_right+0xb8/0x2f0 [ 30.650067] kunit_try_run_case+0x170/0x3f0 [ 30.654318] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.659894] kthread+0x328/0x630 [ 30.663188] ret_from_fork+0x10/0x20 [ 30.666827] [ 30.668359] The buggy address belongs to the object at ffff0000956dc000 [ 30.668359] which belongs to the cache kmalloc-8k of size 8192 [ 30.681017] The buggy address is located 0 bytes to the right of [ 30.681017] allocated 7936-byte region [ffff0000956dc000, ffff0000956ddf00) [ 30.694206] [ 30.695742] The buggy address belongs to the physical page: [ 30.701386] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1156d8 [ 30.709498] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.717251] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.724314] page_type: f5(slab) [ 30.727522] raw: 0bfffe0000000040 ffff000080003180 dead000000000122 0000000000000000 [ 30.735364] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 30.743206] head: 0bfffe0000000040 ffff000080003180 dead000000000122 0000000000000000 [ 30.751143] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 30.759081] head: 0bfffe0000000003 fffffdffc255b601 00000000ffffffff 00000000ffffffff [ 30.767020] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 30.774942] page dumped because: kasan: bad access detected [ 30.780594] [ 30.782123] Memory state around the buggy address: [ 30.786983] ffff0000956dde00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.794304] ffff0000956dde80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.801622] >ffff0000956ddf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.808941] ^ [ 30.812226] ffff0000956ddf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.819540] ffff0000956de000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.826860] ==================================================================
[ 32.427136] ================================================================== [ 32.427421] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 32.427737] Write of size 1 at addr fff00000c640df00 by task kunit_try_catch/155 [ 32.427979] [ 32.428079] CPU: 0 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 32.428538] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.428620] Hardware name: linux,dummy-virt (DT) [ 32.428808] Call trace: [ 32.429072] show_stack+0x20/0x38 (C) [ 32.429354] dump_stack_lvl+0x8c/0xd0 [ 32.429616] print_report+0x118/0x608 [ 32.429751] kasan_report+0xdc/0x128 [ 32.430237] __asan_report_store1_noabort+0x20/0x30 [ 32.430387] kmalloc_big_oob_right+0x2a4/0x2f0 [ 32.430983] kunit_try_run_case+0x170/0x3f0 [ 32.431354] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.431549] kthread+0x328/0x630 [ 32.431772] ret_from_fork+0x10/0x20 [ 32.432132] [ 32.432321] Allocated by task 155: [ 32.432398] kasan_save_stack+0x3c/0x68 [ 32.432520] kasan_save_track+0x20/0x40 [ 32.432623] kasan_save_alloc_info+0x40/0x58 [ 32.433095] __kasan_kmalloc+0xd4/0xd8 [ 32.433472] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.433691] kmalloc_big_oob_right+0xb8/0x2f0 [ 32.433997] kunit_try_run_case+0x170/0x3f0 [ 32.434145] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.434396] kthread+0x328/0x630 [ 32.434488] ret_from_fork+0x10/0x20 [ 32.434844] [ 32.435173] The buggy address belongs to the object at fff00000c640c000 [ 32.435173] which belongs to the cache kmalloc-8k of size 8192 [ 32.435326] The buggy address is located 0 bytes to the right of [ 32.435326] allocated 7936-byte region [fff00000c640c000, fff00000c640df00) [ 32.435586] [ 32.435687] The buggy address belongs to the physical page: [ 32.436033] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106408 [ 32.436173] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.436760] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.437131] page_type: f5(slab) [ 32.437302] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 32.437582] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 32.437721] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 32.437840] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 32.437970] head: 0bfffe0000000003 ffffc1ffc3190201 00000000ffffffff 00000000ffffffff [ 32.438189] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 32.438294] page dumped because: kasan: bad access detected [ 32.438397] [ 32.438469] Memory state around the buggy address: [ 32.438545] fff00000c640de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.438650] fff00000c640de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.438750] >fff00000c640df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.438837] ^ [ 32.439123] fff00000c640df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.439601] fff00000c640e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.439959] ==================================================================
[ 28.056589] ================================================================== [ 28.057262] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 28.058452] Write of size 1 at addr ffff888102c69f00 by task kunit_try_catch/174 [ 28.058823] [ 28.058992] CPU: 1 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT(voluntary) [ 28.059097] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.059122] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 28.059164] Call Trace: [ 28.059192] <TASK> [ 28.059229] dump_stack_lvl+0x73/0xb0 [ 28.059301] print_report+0xd1/0x650 [ 28.059357] ? __virt_addr_valid+0x1db/0x2d0 [ 28.059416] ? kmalloc_big_oob_right+0x316/0x370 [ 28.059471] ? kasan_complete_mode_report_info+0x2a/0x200 [ 28.059531] ? kmalloc_big_oob_right+0x316/0x370 [ 28.059603] kasan_report+0x141/0x180 [ 28.059651] ? kmalloc_big_oob_right+0x316/0x370 [ 28.059707] __asan_report_store1_noabort+0x1b/0x30 [ 28.059761] kmalloc_big_oob_right+0x316/0x370 [ 28.059810] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 28.059873] ? __schedule+0x10cc/0x2b60 [ 28.059930] ? __pfx_read_tsc+0x10/0x10 [ 28.059988] ? ktime_get_ts64+0x86/0x230 [ 28.060050] kunit_try_run_case+0x1a5/0x480 [ 28.060106] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.060149] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 28.060202] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.060253] ? __kthread_parkme+0x82/0x180 [ 28.060301] ? preempt_count_sub+0x50/0x80 [ 28.060351] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.060403] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.060453] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.060505] kthread+0x337/0x6f0 [ 28.061088] ? trace_preempt_on+0x20/0xc0 [ 28.061244] ? __pfx_kthread+0x10/0x10 [ 28.061307] ? _raw_spin_unlock_irq+0x47/0x80 [ 28.061362] ? calculate_sigpending+0x7b/0xa0 [ 28.061419] ? __pfx_kthread+0x10/0x10 [ 28.061468] ret_from_fork+0x116/0x1d0 [ 28.061515] ? __pfx_kthread+0x10/0x10 [ 28.061585] ret_from_fork_asm+0x1a/0x30 [ 28.061783] </TASK> [ 28.061842] [ 28.078861] Allocated by task 174: [ 28.079377] kasan_save_stack+0x45/0x70 [ 28.079879] kasan_save_track+0x18/0x40 [ 28.080687] kasan_save_alloc_info+0x3b/0x50 [ 28.080998] __kasan_kmalloc+0xb7/0xc0 [ 28.081280] __kmalloc_cache_noprof+0x189/0x420 [ 28.081913] kmalloc_big_oob_right+0xa9/0x370 [ 28.082396] kunit_try_run_case+0x1a5/0x480 [ 28.082816] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.083420] kthread+0x337/0x6f0 [ 28.083818] ret_from_fork+0x116/0x1d0 [ 28.084497] ret_from_fork_asm+0x1a/0x30 [ 28.084963] [ 28.085303] The buggy address belongs to the object at ffff888102c68000 [ 28.085303] which belongs to the cache kmalloc-8k of size 8192 [ 28.086298] The buggy address is located 0 bytes to the right of [ 28.086298] allocated 7936-byte region [ffff888102c68000, ffff888102c69f00) [ 28.087189] [ 28.087391] The buggy address belongs to the physical page: [ 28.087948] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c68 [ 28.088932] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 28.089526] flags: 0x200000000000040(head|node=0|zone=2) [ 28.090169] page_type: f5(slab) [ 28.090525] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 28.091225] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 28.091788] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 28.092423] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 28.092898] head: 0200000000000003 ffffea00040b1a01 00000000ffffffff 00000000ffffffff [ 28.093472] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 28.094467] page dumped because: kasan: bad access detected [ 28.094906] [ 28.095111] Memory state around the buggy address: [ 28.095602] ffff888102c69e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.096320] ffff888102c69e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.096932] >ffff888102c69f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.097801] ^ [ 28.098268] ffff888102c69f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.098792] ffff888102c6a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.099478] ==================================================================