Date
June 25, 2025, 8:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 26.704273] ================================================================== [ 26.704475] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x150/0x2f8 [ 26.704545] Write of size 16 at addr fff00000c7895169 by task kunit_try_catch/190 [ 26.704594] [ 26.704960] CPU: 1 UID: 0 PID: 190 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT [ 26.705437] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.705536] Hardware name: linux,dummy-virt (DT) [ 26.705776] Call trace: [ 26.705915] show_stack+0x20/0x38 (C) [ 26.706310] dump_stack_lvl+0x8c/0xd0 [ 26.706424] print_report+0x118/0x608 [ 26.706768] kasan_report+0xdc/0x128 [ 26.706899] kasan_check_range+0x100/0x1a8 [ 26.707100] __asan_memset+0x34/0x78 [ 26.707368] kmalloc_oob_memset_16+0x150/0x2f8 [ 26.707629] kunit_try_run_case+0x170/0x3f0 [ 26.707863] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.708095] kthread+0x328/0x630 [ 26.708199] ret_from_fork+0x10/0x20 [ 26.708249] [ 26.708267] Allocated by task 190: [ 26.708780] kasan_save_stack+0x3c/0x68 [ 26.709011] kasan_save_track+0x20/0x40 [ 26.709332] kasan_save_alloc_info+0x40/0x58 [ 26.709556] __kasan_kmalloc+0xd4/0xd8 [ 26.709688] __kmalloc_cache_noprof+0x16c/0x3c0 [ 26.710103] kmalloc_oob_memset_16+0xb0/0x2f8 [ 26.710195] kunit_try_run_case+0x170/0x3f0 [ 26.710464] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.710768] kthread+0x328/0x630 [ 26.710959] ret_from_fork+0x10/0x20 [ 26.711073] [ 26.711267] The buggy address belongs to the object at fff00000c7895100 [ 26.711267] which belongs to the cache kmalloc-128 of size 128 [ 26.711601] The buggy address is located 105 bytes inside of [ 26.711601] allocated 120-byte region [fff00000c7895100, fff00000c7895178) [ 26.711809] [ 26.711948] The buggy address belongs to the physical page: [ 26.712127] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107895 [ 26.712204] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 26.712257] page_type: f5(slab) [ 26.712561] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 26.712787] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.713266] page dumped because: kasan: bad access detected [ 26.713449] [ 26.713597] Memory state around the buggy address: [ 26.713727] fff00000c7895000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.713838] fff00000c7895080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.713881] >fff00000c7895100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 26.714062] ^ [ 26.714425] fff00000c7895180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.715036] fff00000c7895200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.715252] ==================================================================
[ 22.011406] ================================================================== [ 22.011899] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x166/0x330 [ 22.012359] Write of size 16 at addr ffff88810257eb69 by task kunit_try_catch/207 [ 22.013045] [ 22.013213] CPU: 0 UID: 0 PID: 207 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) [ 22.013260] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.013272] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.013355] Call Trace: [ 22.013382] <TASK> [ 22.013397] dump_stack_lvl+0x73/0xb0 [ 22.013436] print_report+0xd1/0x650 [ 22.013456] ? __virt_addr_valid+0x1db/0x2d0 [ 22.013479] ? kmalloc_oob_memset_16+0x166/0x330 [ 22.013498] ? kasan_complete_mode_report_info+0x2a/0x200 [ 22.013522] ? kmalloc_oob_memset_16+0x166/0x330 [ 22.013552] kasan_report+0x141/0x180 [ 22.013571] ? kmalloc_oob_memset_16+0x166/0x330 [ 22.013595] kasan_check_range+0x10c/0x1c0 [ 22.013627] __asan_memset+0x27/0x50 [ 22.013648] kmalloc_oob_memset_16+0x166/0x330 [ 22.013668] ? __pfx_kmalloc_oob_memset_16+0x10/0x10 [ 22.013688] ? __schedule+0x10cc/0x2b60 [ 22.013712] ? __pfx_read_tsc+0x10/0x10 [ 22.013732] ? ktime_get_ts64+0x86/0x230 [ 22.013756] kunit_try_run_case+0x1a5/0x480 [ 22.013781] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.013802] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.013861] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.013885] ? __kthread_parkme+0x82/0x180 [ 22.013904] ? preempt_count_sub+0x50/0x80 [ 22.013924] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.013957] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.013979] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.014001] kthread+0x337/0x6f0 [ 22.014019] ? trace_preempt_on+0x20/0xc0 [ 22.014041] ? __pfx_kthread+0x10/0x10 [ 22.014059] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.014081] ? calculate_sigpending+0x7b/0xa0 [ 22.014102] ? __pfx_kthread+0x10/0x10 [ 22.014123] ret_from_fork+0x116/0x1d0 [ 22.014140] ? __pfx_kthread+0x10/0x10 [ 22.014158] ret_from_fork_asm+0x1a/0x30 [ 22.014187] </TASK> [ 22.014198] [ 22.026375] Allocated by task 207: [ 22.026511] kasan_save_stack+0x45/0x70 [ 22.026649] kasan_save_track+0x18/0x40 [ 22.026774] kasan_save_alloc_info+0x3b/0x50 [ 22.027347] __kasan_kmalloc+0xb7/0xc0 [ 22.027487] __kmalloc_cache_noprof+0x189/0x420 [ 22.027632] kmalloc_oob_memset_16+0xac/0x330 [ 22.027767] kunit_try_run_case+0x1a5/0x480 [ 22.028451] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.029139] kthread+0x337/0x6f0 [ 22.029579] ret_from_fork+0x116/0x1d0 [ 22.030104] ret_from_fork_asm+0x1a/0x30 [ 22.030593] [ 22.030898] The buggy address belongs to the object at ffff88810257eb00 [ 22.030898] which belongs to the cache kmalloc-128 of size 128 [ 22.031737] The buggy address is located 105 bytes inside of [ 22.031737] allocated 120-byte region [ffff88810257eb00, ffff88810257eb78) [ 22.033244] [ 22.033566] The buggy address belongs to the physical page: [ 22.034110] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10257e [ 22.034873] flags: 0x200000000000000(node=0|zone=2) [ 22.035071] page_type: f5(slab) [ 22.035453] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 22.036523] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.037200] page dumped because: kasan: bad access detected [ 22.037793] [ 22.038167] Memory state around the buggy address: [ 22.038383] ffff88810257ea00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.038593] ffff88810257ea80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.038799] >ffff88810257eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 22.039411] ^ [ 22.040146] ffff88810257eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.040865] ffff88810257ec00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.041543] ==================================================================