Date
June 25, 2025, 8:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 26.651293] ================================================================== [ 26.651370] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300 [ 26.651878] Write of size 4 at addr fff00000c3fadf75 by task kunit_try_catch/186 [ 26.652797] [ 26.652931] CPU: 1 UID: 0 PID: 186 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT [ 26.653026] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.653364] Hardware name: linux,dummy-virt (DT) [ 26.653417] Call trace: [ 26.653490] show_stack+0x20/0x38 (C) [ 26.653665] dump_stack_lvl+0x8c/0xd0 [ 26.653885] print_report+0x118/0x608 [ 26.654282] kasan_report+0xdc/0x128 [ 26.654361] kasan_check_range+0x100/0x1a8 [ 26.654608] __asan_memset+0x34/0x78 [ 26.654852] kmalloc_oob_memset_4+0x150/0x300 [ 26.654902] kunit_try_run_case+0x170/0x3f0 [ 26.655305] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.655514] kthread+0x328/0x630 [ 26.655571] ret_from_fork+0x10/0x20 [ 26.655773] [ 26.655799] Allocated by task 186: [ 26.656009] kasan_save_stack+0x3c/0x68 [ 26.656079] kasan_save_track+0x20/0x40 [ 26.656430] kasan_save_alloc_info+0x40/0x58 [ 26.656477] __kasan_kmalloc+0xd4/0xd8 [ 26.656595] __kmalloc_cache_noprof+0x16c/0x3c0 [ 26.657034] kmalloc_oob_memset_4+0xb0/0x300 [ 26.657238] kunit_try_run_case+0x170/0x3f0 [ 26.657487] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.657662] kthread+0x328/0x630 [ 26.657893] ret_from_fork+0x10/0x20 [ 26.657949] [ 26.658140] The buggy address belongs to the object at fff00000c3fadf00 [ 26.658140] which belongs to the cache kmalloc-128 of size 128 [ 26.658376] The buggy address is located 117 bytes inside of [ 26.658376] allocated 120-byte region [fff00000c3fadf00, fff00000c3fadf78) [ 26.658594] [ 26.658685] The buggy address belongs to the physical page: [ 26.658896] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103fad [ 26.659035] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 26.659248] page_type: f5(slab) [ 26.659323] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000100 dead000000000122 [ 26.659553] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.659738] page dumped because: kasan: bad access detected [ 26.659897] [ 26.659979] Memory state around the buggy address: [ 26.660139] fff00000c3fade00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.660361] fff00000c3fade80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.660602] >fff00000c3fadf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 26.660679] ^ [ 26.660720] fff00000c3fadf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.660765] fff00000c3fae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.660802] ==================================================================
[ 21.961990] ================================================================== [ 21.963220] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x166/0x330 [ 21.963456] Write of size 4 at addr ffff88810257ea75 by task kunit_try_catch/203 [ 21.963670] [ 21.963749] CPU: 0 UID: 0 PID: 203 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) [ 21.963795] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.963818] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.963839] Call Trace: [ 21.963852] <TASK> [ 21.963869] dump_stack_lvl+0x73/0xb0 [ 21.963894] print_report+0xd1/0x650 [ 21.963913] ? __virt_addr_valid+0x1db/0x2d0 [ 21.963936] ? kmalloc_oob_memset_4+0x166/0x330 [ 21.963967] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.963990] ? kmalloc_oob_memset_4+0x166/0x330 [ 21.964010] kasan_report+0x141/0x180 [ 21.964030] ? kmalloc_oob_memset_4+0x166/0x330 [ 21.964053] kasan_check_range+0x10c/0x1c0 [ 21.964074] __asan_memset+0x27/0x50 [ 21.964095] kmalloc_oob_memset_4+0x166/0x330 [ 21.964115] ? __pfx_kmalloc_oob_memset_4+0x10/0x10 [ 21.964137] ? __pfx_kmalloc_oob_memset_4+0x10/0x10 [ 21.964161] kunit_try_run_case+0x1a5/0x480 [ 21.964185] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.964258] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.964279] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.964303] ? __kthread_parkme+0x82/0x180 [ 21.964322] ? preempt_count_sub+0x50/0x80 [ 21.964352] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.964374] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.964397] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.964418] kthread+0x337/0x6f0 [ 21.964437] ? trace_preempt_on+0x20/0xc0 [ 21.964459] ? __pfx_kthread+0x10/0x10 [ 21.964478] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.964499] ? calculate_sigpending+0x7b/0xa0 [ 21.964521] ? __pfx_kthread+0x10/0x10 [ 21.964540] ret_from_fork+0x116/0x1d0 [ 21.964559] ? __pfx_kthread+0x10/0x10 [ 21.964577] ret_from_fork_asm+0x1a/0x30 [ 21.964606] </TASK> [ 21.964616] [ 21.974456] Allocated by task 203: [ 21.974630] kasan_save_stack+0x45/0x70 [ 21.974800] kasan_save_track+0x18/0x40 [ 21.975019] kasan_save_alloc_info+0x3b/0x50 [ 21.975163] __kasan_kmalloc+0xb7/0xc0 [ 21.975431] __kmalloc_cache_noprof+0x189/0x420 [ 21.975647] kmalloc_oob_memset_4+0xac/0x330 [ 21.975833] kunit_try_run_case+0x1a5/0x480 [ 21.975982] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.976148] kthread+0x337/0x6f0 [ 21.976302] ret_from_fork+0x116/0x1d0 [ 21.976501] ret_from_fork_asm+0x1a/0x30 [ 21.976689] [ 21.976775] The buggy address belongs to the object at ffff88810257ea00 [ 21.976775] which belongs to the cache kmalloc-128 of size 128 [ 21.977180] The buggy address is located 117 bytes inside of [ 21.977180] allocated 120-byte region [ffff88810257ea00, ffff88810257ea78) [ 21.977996] [ 21.978089] The buggy address belongs to the physical page: [ 21.978256] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10257e [ 21.978543] flags: 0x200000000000000(node=0|zone=2) [ 21.978913] page_type: f5(slab) [ 21.979135] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 21.979371] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.979593] page dumped because: kasan: bad access detected [ 21.979870] [ 21.979966] Memory state around the buggy address: [ 21.980265] ffff88810257e900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.980586] ffff88810257e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.980839] >ffff88810257ea00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 21.981061] ^ [ 21.981551] ffff88810257ea80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.981751] ffff88810257eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.981958] ==================================================================