Date
June 24, 2025, 11:37 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.042783] ================================================================== [ 30.054353] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488 [ 30.062554] Write of size 1 at addr ffff0000822c2478 by task kunit_try_catch/240 [ 30.070048] [ 30.071591] CPU: 3 UID: 0 PID: 240 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 30.071621] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.071629] Hardware name: Thundercomm Dragonboard 845c (DT) [ 30.071639] Call trace: [ 30.071645] show_stack+0x20/0x38 (C) [ 30.071663] dump_stack_lvl+0x8c/0xd0 [ 30.071683] print_report+0x118/0x608 [ 30.071702] kasan_report+0xdc/0x128 [ 30.071720] __asan_report_store1_noabort+0x20/0x30 [ 30.071737] kmalloc_track_caller_oob_right+0x40c/0x488 [ 30.071756] kunit_try_run_case+0x170/0x3f0 [ 30.071775] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.071796] kthread+0x328/0x630 [ 30.071810] ret_from_fork+0x10/0x20 [ 30.071828] [ 30.138667] Allocated by task 240: [ 30.142126] kasan_save_stack+0x3c/0x68 [ 30.146036] kasan_save_track+0x20/0x40 [ 30.149945] kasan_save_alloc_info+0x40/0x58 [ 30.154283] __kasan_kmalloc+0xd4/0xd8 [ 30.158103] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 30.163760] kmalloc_track_caller_oob_right+0xa8/0x488 [ 30.168983] kunit_try_run_case+0x170/0x3f0 [ 30.173236] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.178809] kthread+0x328/0x630 [ 30.182094] ret_from_fork+0x10/0x20 [ 30.185731] [ 30.187260] The buggy address belongs to the object at ffff0000822c2400 [ 30.187260] which belongs to the cache kmalloc-128 of size 128 [ 30.199916] The buggy address is located 0 bytes to the right of [ 30.199916] allocated 120-byte region [ffff0000822c2400, ffff0000822c2478) [ 30.213019] [ 30.214549] The buggy address belongs to the physical page: [ 30.220202] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1022c2 [ 30.228316] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.236071] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.243132] page_type: f5(slab) [ 30.246334] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 30.254178] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 30.262021] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 30.269959] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 30.277889] head: 0bfffe0000000001 fffffdffc208b081 00000000ffffffff 00000000ffffffff [ 30.285828] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.293752] page dumped because: kasan: bad access detected [ 30.299400] [ 30.300933] Memory state around the buggy address: [ 30.305795] ffff0000822c2300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.313116] ffff0000822c2380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.320437] >ffff0000822c2400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 30.327751] ^ [ 30.334977] ffff0000822c2480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.342299] ffff0000822c2500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.349619] ==================================================================
[ 32.387008] ================================================================== [ 32.387254] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488 [ 32.387400] Write of size 1 at addr fff00000c56d3f78 by task kunit_try_catch/153 [ 32.388241] [ 32.388336] CPU: 0 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 32.388484] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.388518] Hardware name: linux,dummy-virt (DT) [ 32.388554] Call trace: [ 32.388579] show_stack+0x20/0x38 (C) [ 32.388644] dump_stack_lvl+0x8c/0xd0 [ 32.388703] print_report+0x118/0x608 [ 32.388758] kasan_report+0xdc/0x128 [ 32.388811] __asan_report_store1_noabort+0x20/0x30 [ 32.388867] kmalloc_track_caller_oob_right+0x40c/0x488 [ 32.389000] kunit_try_run_case+0x170/0x3f0 [ 32.389234] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.389376] kthread+0x328/0x630 [ 32.389497] ret_from_fork+0x10/0x20 [ 32.389801] [ 32.389925] Allocated by task 153: [ 32.390004] kasan_save_stack+0x3c/0x68 [ 32.390256] kasan_save_track+0x20/0x40 [ 32.390384] kasan_save_alloc_info+0x40/0x58 [ 32.390473] __kasan_kmalloc+0xd4/0xd8 [ 32.390560] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 32.390661] kmalloc_track_caller_oob_right+0xa8/0x488 [ 32.390759] kunit_try_run_case+0x170/0x3f0 [ 32.390855] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.390985] kthread+0x328/0x630 [ 32.391068] ret_from_fork+0x10/0x20 [ 32.391221] [ 32.391276] The buggy address belongs to the object at fff00000c56d3f00 [ 32.391276] which belongs to the cache kmalloc-128 of size 128 [ 32.391787] The buggy address is located 0 bytes to the right of [ 32.391787] allocated 120-byte region [fff00000c56d3f00, fff00000c56d3f78) [ 32.391963] [ 32.392021] The buggy address belongs to the physical page: [ 32.392103] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c56d3800 pfn:0x1056d3 [ 32.392243] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.393916] page_type: f5(slab) [ 32.394023] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.394138] raw: fff00000c56d3800 000000008010000f 00000000f5000000 0000000000000000 [ 32.394263] page dumped because: kasan: bad access detected [ 32.394406] [ 32.394452] Memory state around the buggy address: [ 32.394639] fff00000c56d3e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.394910] fff00000c56d3e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.395026] >fff00000c56d3f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 32.395170] ^ [ 32.395329] fff00000c56d3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.395478] fff00000c56d4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.395577] ================================================================== [ 32.398833] ================================================================== [ 32.398952] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x418/0x488 [ 32.399060] Write of size 1 at addr fff00000c56d3878 by task kunit_try_catch/153 [ 32.399361] [ 32.399453] CPU: 0 UID: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT [ 32.399839] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.399922] Hardware name: linux,dummy-virt (DT) [ 32.399997] Call trace: [ 32.400075] show_stack+0x20/0x38 (C) [ 32.400191] dump_stack_lvl+0x8c/0xd0 [ 32.400313] print_report+0x118/0x608 [ 32.400434] kasan_report+0xdc/0x128 [ 32.400548] __asan_report_store1_noabort+0x20/0x30 [ 32.400665] kmalloc_track_caller_oob_right+0x418/0x488 [ 32.400815] kunit_try_run_case+0x170/0x3f0 [ 32.400982] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.401113] kthread+0x328/0x630 [ 32.401217] ret_from_fork+0x10/0x20 [ 32.401331] [ 32.401375] Allocated by task 153: [ 32.401438] kasan_save_stack+0x3c/0x68 [ 32.401564] kasan_save_track+0x20/0x40 [ 32.401661] kasan_save_alloc_info+0x40/0x58 [ 32.401751] __kasan_kmalloc+0xd4/0xd8 [ 32.401848] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 32.401978] kmalloc_track_caller_oob_right+0x184/0x488 [ 32.402096] kunit_try_run_case+0x170/0x3f0 [ 32.402206] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.402449] kthread+0x328/0x630 [ 32.402937] ret_from_fork+0x10/0x20 [ 32.403057] [ 32.403201] The buggy address belongs to the object at fff00000c56d3800 [ 32.403201] which belongs to the cache kmalloc-128 of size 128 [ 32.403418] The buggy address is located 0 bytes to the right of [ 32.403418] allocated 120-byte region [fff00000c56d3800, fff00000c56d3878) [ 32.403651] [ 32.403706] The buggy address belongs to the physical page: [ 32.403780] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1056d3 [ 32.403930] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.404128] page_type: f5(slab) [ 32.404225] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.404345] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.404436] page dumped because: kasan: bad access detected [ 32.404506] [ 32.404547] Memory state around the buggy address: [ 32.404615] fff00000c56d3700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.404714] fff00000c56d3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.404813] >fff00000c56d3800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 32.405356] ^ [ 32.405491] fff00000c56d3880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.405656] fff00000c56d3900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.405792] ==================================================================
[ 28.016875] ================================================================== [ 28.017425] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4b1/0x520 [ 28.018245] Write of size 1 at addr ffff888102dcf878 by task kunit_try_catch/172 [ 28.018705] [ 28.018880] CPU: 0 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT(voluntary) [ 28.018993] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.019023] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 28.019057] Call Trace: [ 28.019074] <TASK> [ 28.019096] dump_stack_lvl+0x73/0xb0 [ 28.019137] print_report+0xd1/0x650 [ 28.019167] ? __virt_addr_valid+0x1db/0x2d0 [ 28.019214] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 28.019269] ? kasan_complete_mode_report_info+0x2a/0x200 [ 28.019327] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 28.019390] kasan_report+0x141/0x180 [ 28.019452] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 28.019528] __asan_report_store1_noabort+0x1b/0x30 [ 28.019608] kmalloc_track_caller_oob_right+0x4b1/0x520 [ 28.019671] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 28.019739] ? __schedule+0x10cc/0x2b60 [ 28.019807] ? __pfx_read_tsc+0x10/0x10 [ 28.019877] ? ktime_get_ts64+0x86/0x230 [ 28.019937] kunit_try_run_case+0x1a5/0x480 [ 28.020001] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.020048] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 28.020083] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 28.020116] ? __kthread_parkme+0x82/0x180 [ 28.020144] ? preempt_count_sub+0x50/0x80 [ 28.020174] ? __pfx_kunit_try_run_case+0x10/0x10 [ 28.020205] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.020236] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 28.020266] kthread+0x337/0x6f0 [ 28.020292] ? trace_preempt_on+0x20/0xc0 [ 28.020323] ? __pfx_kthread+0x10/0x10 [ 28.020351] ? _raw_spin_unlock_irq+0x47/0x80 [ 28.020382] ? calculate_sigpending+0x7b/0xa0 [ 28.020412] ? __pfx_kthread+0x10/0x10 [ 28.020439] ret_from_fork+0x116/0x1d0 [ 28.020464] ? __pfx_kthread+0x10/0x10 [ 28.020491] ret_from_fork_asm+0x1a/0x30 [ 28.020529] </TASK> [ 28.020562] [ 28.033182] Allocated by task 172: [ 28.033615] kasan_save_stack+0x45/0x70 [ 28.034294] kasan_save_track+0x18/0x40 [ 28.034756] kasan_save_alloc_info+0x3b/0x50 [ 28.035275] __kasan_kmalloc+0xb7/0xc0 [ 28.035776] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 28.036422] kmalloc_track_caller_oob_right+0x19a/0x520 [ 28.036779] kunit_try_run_case+0x1a5/0x480 [ 28.037040] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.037333] kthread+0x337/0x6f0 [ 28.037722] ret_from_fork+0x116/0x1d0 [ 28.038394] ret_from_fork_asm+0x1a/0x30 [ 28.038907] [ 28.039112] The buggy address belongs to the object at ffff888102dcf800 [ 28.039112] which belongs to the cache kmalloc-128 of size 128 [ 28.040597] The buggy address is located 0 bytes to the right of [ 28.040597] allocated 120-byte region [ffff888102dcf800, ffff888102dcf878) [ 28.041853] [ 28.042068] The buggy address belongs to the physical page: [ 28.042712] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102dcf [ 28.043471] flags: 0x200000000000000(node=0|zone=2) [ 28.043982] page_type: f5(slab) [ 28.044341] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 28.045048] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 28.045663] page dumped because: kasan: bad access detected [ 28.046030] [ 28.046167] Memory state around the buggy address: [ 28.046661] ffff888102dcf700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.047331] ffff888102dcf780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.047893] >ffff888102dcf800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 28.048364] ^ [ 28.048917] ffff888102dcf880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.049466] ffff888102dcf900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.050044] ================================================================== [ 27.978706] ================================================================== [ 27.979222] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4c8/0x520 [ 27.980658] Write of size 1 at addr ffff888102dcf778 by task kunit_try_catch/172 [ 27.981162] [ 27.981340] CPU: 0 UID: 0 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250624 #1 PREEMPT(voluntary) [ 27.981446] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.981477] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.981524] Call Trace: [ 27.981575] <TASK> [ 27.981613] dump_stack_lvl+0x73/0xb0 [ 27.981690] print_report+0xd1/0x650 [ 27.981743] ? __virt_addr_valid+0x1db/0x2d0 [ 27.981798] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 27.981854] ? kasan_complete_mode_report_info+0x2a/0x200 [ 27.981919] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 27.981986] kasan_report+0x141/0x180 [ 27.982046] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 27.982112] __asan_report_store1_noabort+0x1b/0x30 [ 27.982171] kmalloc_track_caller_oob_right+0x4c8/0x520 [ 27.982234] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 27.982302] ? __schedule+0x10cc/0x2b60 [ 27.982351] ? __pfx_read_tsc+0x10/0x10 [ 27.982383] ? ktime_get_ts64+0x86/0x230 [ 27.982415] kunit_try_run_case+0x1a5/0x480 [ 27.982449] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.982480] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.982511] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.982564] ? __kthread_parkme+0x82/0x180 [ 27.982596] ? preempt_count_sub+0x50/0x80 [ 27.982628] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.982675] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.982707] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.982738] kthread+0x337/0x6f0 [ 27.982764] ? trace_preempt_on+0x20/0xc0 [ 27.982795] ? __pfx_kthread+0x10/0x10 [ 27.982821] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.982851] ? calculate_sigpending+0x7b/0xa0 [ 27.982884] ? __pfx_kthread+0x10/0x10 [ 27.982911] ret_from_fork+0x116/0x1d0 [ 27.982937] ? __pfx_kthread+0x10/0x10 [ 27.982963] ret_from_fork_asm+0x1a/0x30 [ 27.983002] </TASK> [ 27.983015] [ 27.997139] Allocated by task 172: [ 27.997508] kasan_save_stack+0x45/0x70 [ 27.998185] kasan_save_track+0x18/0x40 [ 27.998438] kasan_save_alloc_info+0x3b/0x50 [ 27.998820] __kasan_kmalloc+0xb7/0xc0 [ 27.999342] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 27.999919] kmalloc_track_caller_oob_right+0x99/0x520 [ 28.000426] kunit_try_run_case+0x1a5/0x480 [ 28.000784] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 28.001462] kthread+0x337/0x6f0 [ 28.001862] ret_from_fork+0x116/0x1d0 [ 28.002377] ret_from_fork_asm+0x1a/0x30 [ 28.002681] [ 28.002853] The buggy address belongs to the object at ffff888102dcf700 [ 28.002853] which belongs to the cache kmalloc-128 of size 128 [ 28.004010] The buggy address is located 0 bytes to the right of [ 28.004010] allocated 120-byte region [ffff888102dcf700, ffff888102dcf778) [ 28.004907] [ 28.005232] The buggy address belongs to the physical page: [ 28.005755] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102dcf [ 28.006418] flags: 0x200000000000000(node=0|zone=2) [ 28.006904] page_type: f5(slab) [ 28.007233] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 28.007904] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 28.008611] page dumped because: kasan: bad access detected [ 28.009306] [ 28.009463] Memory state around the buggy address: [ 28.009919] ffff888102dcf600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.010587] ffff888102dcf680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.011221] >ffff888102dcf700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 28.011921] ^ [ 28.012602] ffff888102dcf780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.013418] ffff888102dcf800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.013985] ==================================================================