Date
June 24, 2025, 11:37 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 36.305296] ================================================================== [ 36.316074] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x3a0/0x3f8 [ 36.322873] Write of size 16 at addr ffff000080a55140 by task kunit_try_catch/264 [ 36.330463] [ 36.331998] CPU: 2 UID: 0 PID: 264 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 36.332028] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.332037] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.332049] Call trace: [ 36.332058] show_stack+0x20/0x38 (C) [ 36.332076] dump_stack_lvl+0x8c/0xd0 [ 36.332095] print_report+0x118/0x608 [ 36.332115] kasan_report+0xdc/0x128 [ 36.332134] __asan_report_store16_noabort+0x20/0x30 [ 36.332153] kmalloc_oob_16+0x3a0/0x3f8 [ 36.332171] kunit_try_run_case+0x170/0x3f0 [ 36.332190] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.332212] kthread+0x328/0x630 [ 36.332229] ret_from_fork+0x10/0x20 [ 36.332246] [ 36.397775] Allocated by task 264: [ 36.401240] kasan_save_stack+0x3c/0x68 [ 36.405147] kasan_save_track+0x20/0x40 [ 36.409052] kasan_save_alloc_info+0x40/0x58 [ 36.413396] __kasan_kmalloc+0xd4/0xd8 [ 36.417213] __kmalloc_cache_noprof+0x16c/0x3c0 [ 36.421821] kmalloc_oob_16+0xb4/0x3f8 [ 36.425638] kunit_try_run_case+0x170/0x3f0 [ 36.429896] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.435466] kthread+0x328/0x630 [ 36.438752] ret_from_fork+0x10/0x20 [ 36.442396] [ 36.443926] The buggy address belongs to the object at ffff000080a55140 [ 36.443926] which belongs to the cache kmalloc-16 of size 16 [ 36.456415] The buggy address is located 0 bytes inside of [ 36.456415] allocated 13-byte region [ffff000080a55140, ffff000080a5514d) [ 36.468906] [ 36.470435] The buggy address belongs to the physical page: [ 36.476082] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a55 [ 36.484187] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 36.490810] page_type: f5(slab) [ 36.494011] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 36.501859] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 36.509702] page dumped because: kasan: bad access detected [ 36.515347] [ 36.516876] Memory state around the buggy address: [ 36.521735] ffff000080a55000: fa fb fc fc fa fb fc fc 00 04 fc fc fa fb fc fc [ 36.529050] ffff000080a55080: 00 06 fc fc 00 05 fc fc 00 05 fc fc 00 05 fc fc [ 36.536366] >ffff000080a55100: fa fb fc fc fa fb fc fc 00 05 fc fc 00 00 fc fc [ 36.543678] ^ [ 36.549326] ffff000080a55180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.556642] ffff000080a55200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.563956] ==================================================================
[ 32.895631] ================================================================== [ 32.895786] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x3a0/0x3f8 [ 32.895931] Write of size 16 at addr fff00000c5757280 by task kunit_try_catch/177 [ 32.896081] [ 32.896178] CPU: 0 UID: 0 PID: 177 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 32.896530] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.896602] Hardware name: linux,dummy-virt (DT) [ 32.896690] Call trace: [ 32.896820] show_stack+0x20/0x38 (C) [ 32.897040] dump_stack_lvl+0x8c/0xd0 [ 32.897179] print_report+0x118/0x608 [ 32.897321] kasan_report+0xdc/0x128 [ 32.897615] __asan_report_store16_noabort+0x20/0x30 [ 32.897875] kmalloc_oob_16+0x3a0/0x3f8 [ 32.898015] kunit_try_run_case+0x170/0x3f0 [ 32.898150] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.898489] kthread+0x328/0x630 [ 32.898775] ret_from_fork+0x10/0x20 [ 32.898914] [ 32.898967] Allocated by task 177: [ 32.899035] kasan_save_stack+0x3c/0x68 [ 32.899208] kasan_save_track+0x20/0x40 [ 32.899312] kasan_save_alloc_info+0x40/0x58 [ 32.899453] __kasan_kmalloc+0xd4/0xd8 [ 32.899633] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.900147] kmalloc_oob_16+0xb4/0x3f8 [ 32.900366] kunit_try_run_case+0x170/0x3f0 [ 32.900592] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.900695] kthread+0x328/0x630 [ 32.901717] ret_from_fork+0x10/0x20 [ 32.901883] [ 32.901958] The buggy address belongs to the object at fff00000c5757280 [ 32.901958] which belongs to the cache kmalloc-16 of size 16 [ 32.902116] The buggy address is located 0 bytes inside of [ 32.902116] allocated 13-byte region [fff00000c5757280, fff00000c575728d) [ 32.902334] [ 32.902395] The buggy address belongs to the physical page: [ 32.902468] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105757 [ 32.902605] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.902740] page_type: f5(slab) [ 32.902866] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 32.903015] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 32.903139] page dumped because: kasan: bad access detected [ 32.903223] [ 32.903276] Memory state around the buggy address: [ 32.903360] fff00000c5757180: 00 02 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 32.903468] fff00000c5757200: fa fb fc fc fa fb fc fc 00 04 fc fc fa fb fc fc [ 32.903568] >fff00000c5757280: 00 05 fc fc 00 00 fc fc fc fc fc fc fc fc fc fc [ 32.904109] ^ [ 32.904200] fff00000c5757300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.904309] fff00000c5757380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.904722] ==================================================================
[ 28.936212] ================================================================== [ 28.936870] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x452/0x4a0 [ 28.937485] Write of size 16 at addr ffff8881022bd6a0 by task kunit_try_catch/196 [ 28.938166] [ 28.938782] CPU: 1 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT(voluntary) [ 28.939083] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.939119] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 28.939172] Call Trace: [ 28.939205] <TASK> [ 28.939247] dump_stack_lvl+0x73/0xb0 [ 28.939334] print_report+0xd1/0x650 [ 28.939395] ? __virt_addr_valid+0x1db/0x2d0 [ 28.939440] ? kmalloc_oob_16+0x452/0x4a0 [ 28.939470] ? kasan_complete_mode_report_info+0x2a/0x200 [ 28.939503] ? kmalloc_oob_16+0x452/0x4a0 [ 28.939531] kasan_report+0x141/0x180 [ 28.939595] ? kmalloc_oob_16+0x452/0x4a0 [ 28.939651] __asan_report_store16_noabort+0x1b/0x30 [ 28.939741] kmalloc_oob_16+0x452/0x4a0 [ 28.939771] ? __pfx_kmalloc_oob_16+0x10/0x10 [ 28.939801] ? __schedule+0x10cc/0x2b60 [ 28.939847] ? __pfx_read_tsc+0x10/0x10 [ 28.939879] ? ktime_get_ts64+0x86/0x230 [ 28.939912] kunit_try_run_case+0x1a5/0x480 [ 28.939948] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.939977] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 28.940008] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.940040] ? __kthread_parkme+0x82/0x180 [ 28.940068] ? preempt_count_sub+0x50/0x80 [ 28.940123] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.940178] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.940215] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.940247] kthread+0x337/0x6f0 [ 28.940273] ? trace_preempt_on+0x20/0xc0 [ 28.940305] ? __pfx_kthread+0x10/0x10 [ 28.940332] ? _raw_spin_unlock_irq+0x47/0x80 [ 28.940361] ? calculate_sigpending+0x7b/0xa0 [ 28.940392] ? __pfx_kthread+0x10/0x10 [ 28.940419] ret_from_fork+0x116/0x1d0 [ 28.940444] ? __pfx_kthread+0x10/0x10 [ 28.940470] ret_from_fork_asm+0x1a/0x30 [ 28.940510] </TASK> [ 28.940525] [ 28.956264] Allocated by task 196: [ 28.956571] kasan_save_stack+0x45/0x70 [ 28.957166] kasan_save_track+0x18/0x40 [ 28.957622] kasan_save_alloc_info+0x3b/0x50 [ 28.958247] __kasan_kmalloc+0xb7/0xc0 [ 28.958617] __kmalloc_cache_noprof+0x189/0x420 [ 28.959162] kmalloc_oob_16+0xa8/0x4a0 [ 28.959398] kunit_try_run_case+0x1a5/0x480 [ 28.959678] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.960092] kthread+0x337/0x6f0 [ 28.960634] ret_from_fork+0x116/0x1d0 [ 28.961026] ret_from_fork_asm+0x1a/0x30 [ 28.961316] [ 28.961449] The buggy address belongs to the object at ffff8881022bd6a0 [ 28.961449] which belongs to the cache kmalloc-16 of size 16 [ 28.963313] The buggy address is located 0 bytes inside of [ 28.963313] allocated 13-byte region [ffff8881022bd6a0, ffff8881022bd6ad) [ 28.964607] [ 28.964967] The buggy address belongs to the physical page: [ 28.965601] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1022bd [ 28.966299] flags: 0x200000000000000(node=0|zone=2) [ 28.966777] page_type: f5(slab) [ 28.967036] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122 [ 28.967579] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 28.968081] page dumped because: kasan: bad access detected [ 28.968442] [ 28.968774] Memory state around the buggy address: [ 28.969254] ffff8881022bd580: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 28.969916] ffff8881022bd600: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 28.970945] >ffff8881022bd680: fa fb fc fc 00 05 fc fc 00 00 fc fc fc fc fc fc [ 28.971595] ^ [ 28.972249] ffff8881022bd700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.973052] ffff8881022bd780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.973766] ==================================================================