Date
June 26, 2025, 9:10 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.413365] ================================================================== [ 31.424924] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488 [ 31.433119] Write of size 1 at addr ffff00009462c678 by task kunit_try_catch/228 [ 31.440610] [ 31.442139] CPU: 7 UID: 0 PID: 228 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 31.442170] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.442178] Hardware name: Thundercomm Dragonboard 845c (DT) [ 31.442190] Call trace: [ 31.442196] show_stack+0x20/0x38 (C) [ 31.442214] dump_stack_lvl+0x8c/0xd0 [ 31.442233] print_report+0x118/0x608 [ 31.442251] kasan_report+0xdc/0x128 [ 31.442267] __asan_report_store1_noabort+0x20/0x30 [ 31.442284] kmalloc_track_caller_oob_right+0x40c/0x488 [ 31.442303] kunit_try_run_case+0x170/0x3f0 [ 31.442321] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.442340] kthread+0x328/0x630 [ 31.442353] ret_from_fork+0x10/0x20 [ 31.442372] [ 31.509173] Allocated by task 228: [ 31.512625] kasan_save_stack+0x3c/0x68 [ 31.516531] kasan_save_track+0x20/0x40 [ 31.520433] kasan_save_alloc_info+0x40/0x58 [ 31.524766] __kasan_kmalloc+0xd4/0xd8 [ 31.528579] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 31.534228] kmalloc_track_caller_oob_right+0xa8/0x488 [ 31.539441] kunit_try_run_case+0x170/0x3f0 [ 31.543686] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.549248] kthread+0x328/0x630 [ 31.552527] ret_from_fork+0x10/0x20 [ 31.556165] [ 31.557687] The buggy address belongs to the object at ffff00009462c600 [ 31.557687] which belongs to the cache kmalloc-128 of size 128 [ 31.570336] The buggy address is located 0 bytes to the right of [ 31.570336] allocated 120-byte region [ffff00009462c600, ffff00009462c678) [ 31.583428] [ 31.584958] The buggy address belongs to the physical page: [ 31.590602] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11462c [ 31.598699] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.606447] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.613493] page_type: f5(slab) [ 31.616687] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 31.624525] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 31.632360] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 31.640282] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 31.648206] head: 0bfffe0000000001 fffffdffc2518b01 00000000ffffffff 00000000ffffffff [ 31.656128] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 31.664047] page dumped because: kasan: bad access detected [ 31.669687] [ 31.671208] Memory state around the buggy address: [ 31.676064] ffff00009462c500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.683368] ffff00009462c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.690681] >ffff00009462c600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 31.697992] ^ [ 31.705214] ffff00009462c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.712525] ffff00009462c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.719835] ==================================================================
[ 26.572844] ================================================================== [ 26.572971] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x418/0x488 [ 26.573019] Write of size 1 at addr fff00000c643f378 by task kunit_try_catch/154 [ 26.573077] [ 26.573104] CPU: 0 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.573185] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.573210] Hardware name: linux,dummy-virt (DT) [ 26.573241] Call trace: [ 26.573262] show_stack+0x20/0x38 (C) [ 26.573309] dump_stack_lvl+0x8c/0xd0 [ 26.573354] print_report+0x118/0x608 [ 26.573422] kasan_report+0xdc/0x128 [ 26.573469] __asan_report_store1_noabort+0x20/0x30 [ 26.573516] kmalloc_track_caller_oob_right+0x418/0x488 [ 26.573645] kunit_try_run_case+0x170/0x3f0 [ 26.573713] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.573796] kthread+0x328/0x630 [ 26.573838] ret_from_fork+0x10/0x20 [ 26.573925] [ 26.573943] Allocated by task 154: [ 26.573968] kasan_save_stack+0x3c/0x68 [ 26.574125] kasan_save_track+0x20/0x40 [ 26.574166] kasan_save_alloc_info+0x40/0x58 [ 26.574298] __kasan_kmalloc+0xd4/0xd8 [ 26.574334] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 26.574375] kmalloc_track_caller_oob_right+0x184/0x488 [ 26.574415] kunit_try_run_case+0x170/0x3f0 [ 26.574451] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.574493] kthread+0x328/0x630 [ 26.574537] ret_from_fork+0x10/0x20 [ 26.574571] [ 26.574588] The buggy address belongs to the object at fff00000c643f300 [ 26.574588] which belongs to the cache kmalloc-128 of size 128 [ 26.574667] The buggy address is located 0 bytes to the right of [ 26.574667] allocated 120-byte region [fff00000c643f300, fff00000c643f378) [ 26.574964] [ 26.574982] The buggy address belongs to the physical page: [ 26.575022] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10643f [ 26.575088] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 26.575227] page_type: f5(slab) [ 26.575339] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000100 dead000000000122 [ 26.575464] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.575520] page dumped because: kasan: bad access detected [ 26.575555] [ 26.575648] Memory state around the buggy address: [ 26.575677] fff00000c643f200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.575717] fff00000c643f280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.575819] >fff00000c643f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 26.575855] ^ [ 26.575891] fff00000c643f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.575930] fff00000c643f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.575966] ================================================================== [ 26.569313] ================================================================== [ 26.569367] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488 [ 26.569419] Write of size 1 at addr fff00000c643f278 by task kunit_try_catch/154 [ 26.569466] [ 26.569495] CPU: 0 UID: 0 PID: 154 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.569578] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.569634] Hardware name: linux,dummy-virt (DT) [ 26.569671] Call trace: [ 26.569764] show_stack+0x20/0x38 (C) [ 26.569812] dump_stack_lvl+0x8c/0xd0 [ 26.569859] print_report+0x118/0x608 [ 26.569905] kasan_report+0xdc/0x128 [ 26.569949] __asan_report_store1_noabort+0x20/0x30 [ 26.569996] kmalloc_track_caller_oob_right+0x40c/0x488 [ 26.570045] kunit_try_run_case+0x170/0x3f0 [ 26.570102] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.570166] kthread+0x328/0x630 [ 26.570208] ret_from_fork+0x10/0x20 [ 26.570254] [ 26.570271] Allocated by task 154: [ 26.570297] kasan_save_stack+0x3c/0x68 [ 26.570335] kasan_save_track+0x20/0x40 [ 26.570371] kasan_save_alloc_info+0x40/0x58 [ 26.570405] __kasan_kmalloc+0xd4/0xd8 [ 26.570439] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 26.570553] kmalloc_track_caller_oob_right+0xa8/0x488 [ 26.570684] kunit_try_run_case+0x170/0x3f0 [ 26.570721] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.570762] kthread+0x328/0x630 [ 26.570798] ret_from_fork+0x10/0x20 [ 26.570925] [ 26.570944] The buggy address belongs to the object at fff00000c643f200 [ 26.570944] which belongs to the cache kmalloc-128 of size 128 [ 26.571005] The buggy address is located 0 bytes to the right of [ 26.571005] allocated 120-byte region [fff00000c643f200, fff00000c643f278) [ 26.571112] [ 26.571130] The buggy address belongs to the physical page: [ 26.571160] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10643f [ 26.571253] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 26.571298] page_type: f5(slab) [ 26.571334] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000100 dead000000000122 [ 26.571462] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.571545] page dumped because: kasan: bad access detected [ 26.571581] [ 26.571668] Memory state around the buggy address: [ 26.571800] fff00000c643f100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.571841] fff00000c643f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.571881] >fff00000c643f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 26.571916] ^ [ 26.571953] fff00000c643f280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.571992] fff00000c643f300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.572050] ==================================================================
[ 21.580311] ================================================================== [ 21.581603] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4c8/0x520 [ 21.582418] Write of size 1 at addr ffff8881024c9878 by task kunit_try_catch/171 [ 21.582699] [ 21.582788] CPU: 0 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 21.582847] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.582860] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.582883] Call Trace: [ 21.582898] <TASK> [ 21.582918] dump_stack_lvl+0x73/0xb0 [ 21.582949] print_report+0xd1/0x650 [ 21.582973] ? __virt_addr_valid+0x1db/0x2d0 [ 21.582997] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 21.583021] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.583053] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 21.583077] kasan_report+0x141/0x180 [ 21.583098] ? kmalloc_track_caller_oob_right+0x4c8/0x520 [ 21.583126] __asan_report_store1_noabort+0x1b/0x30 [ 21.583149] kmalloc_track_caller_oob_right+0x4c8/0x520 [ 21.583173] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 21.583197] ? __schedule+0x10cc/0x2b60 [ 21.583232] ? __pfx_read_tsc+0x10/0x10 [ 21.583255] ? ktime_get_ts64+0x86/0x230 [ 21.583279] kunit_try_run_case+0x1a5/0x480 [ 21.583306] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.583327] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.583351] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.583376] ? __kthread_parkme+0x82/0x180 [ 21.583396] ? preempt_count_sub+0x50/0x80 [ 21.583419] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.583442] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.583465] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.583488] kthread+0x337/0x6f0 [ 21.583507] ? trace_preempt_on+0x20/0xc0 [ 21.583530] ? __pfx_kthread+0x10/0x10 [ 21.583550] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.583572] ? calculate_sigpending+0x7b/0xa0 [ 21.583596] ? __pfx_kthread+0x10/0x10 [ 21.583616] ret_from_fork+0x116/0x1d0 [ 21.583635] ? __pfx_kthread+0x10/0x10 [ 21.583655] ret_from_fork_asm+0x1a/0x30 [ 21.583686] </TASK> [ 21.583698] [ 21.596715] Allocated by task 171: [ 21.597028] kasan_save_stack+0x45/0x70 [ 21.597411] kasan_save_track+0x18/0x40 [ 21.597784] kasan_save_alloc_info+0x3b/0x50 [ 21.598325] __kasan_kmalloc+0xb7/0xc0 [ 21.598620] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 21.598887] kmalloc_track_caller_oob_right+0x99/0x520 [ 21.599508] kunit_try_run_case+0x1a5/0x480 [ 21.599995] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.600372] kthread+0x337/0x6f0 [ 21.600491] ret_from_fork+0x116/0x1d0 [ 21.600618] ret_from_fork_asm+0x1a/0x30 [ 21.600752] [ 21.600932] The buggy address belongs to the object at ffff8881024c9800 [ 21.600932] which belongs to the cache kmalloc-128 of size 128 [ 21.602158] The buggy address is located 0 bytes to the right of [ 21.602158] allocated 120-byte region [ffff8881024c9800, ffff8881024c9878) [ 21.603418] [ 21.603495] The buggy address belongs to the physical page: [ 21.603665] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024c9 [ 21.603904] flags: 0x200000000000000(node=0|zone=2) [ 21.604084] page_type: f5(slab) [ 21.604203] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 21.604726] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.605058] page dumped because: kasan: bad access detected [ 21.605346] [ 21.605498] Memory state around the buggy address: [ 21.605651] ffff8881024c9700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.606214] ffff8881024c9780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.606536] >ffff8881024c9800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 21.606806] ^ [ 21.607082] ffff8881024c9880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.607670] ffff8881024c9900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.608071] ================================================================== [ 21.609372] ================================================================== [ 21.609764] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4b1/0x520 [ 21.610460] Write of size 1 at addr ffff8881024c9978 by task kunit_try_catch/171 [ 21.610763] [ 21.610950] CPU: 0 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 21.611016] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.611043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.611065] Call Trace: [ 21.611089] <TASK> [ 21.611107] dump_stack_lvl+0x73/0xb0 [ 21.611137] print_report+0xd1/0x650 [ 21.611159] ? __virt_addr_valid+0x1db/0x2d0 [ 21.611182] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 21.611205] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.611241] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 21.611274] kasan_report+0x141/0x180 [ 21.611295] ? kmalloc_track_caller_oob_right+0x4b1/0x520 [ 21.611333] __asan_report_store1_noabort+0x1b/0x30 [ 21.611357] kmalloc_track_caller_oob_right+0x4b1/0x520 [ 21.611380] ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10 [ 21.611404] ? __schedule+0x10cc/0x2b60 [ 21.611429] ? __pfx_read_tsc+0x10/0x10 [ 21.611451] ? ktime_get_ts64+0x86/0x230 [ 21.611475] kunit_try_run_case+0x1a5/0x480 [ 21.611508] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.611530] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.611564] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.611589] ? __kthread_parkme+0x82/0x180 [ 21.611609] ? preempt_count_sub+0x50/0x80 [ 21.611632] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.611663] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.611686] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.611709] kthread+0x337/0x6f0 [ 21.611738] ? trace_preempt_on+0x20/0xc0 [ 21.611761] ? __pfx_kthread+0x10/0x10 [ 21.611781] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.611847] ? calculate_sigpending+0x7b/0xa0 [ 21.611874] ? __pfx_kthread+0x10/0x10 [ 21.611894] ret_from_fork+0x116/0x1d0 [ 21.611913] ? __pfx_kthread+0x10/0x10 [ 21.611933] ret_from_fork_asm+0x1a/0x30 [ 21.611963] </TASK> [ 21.611975] [ 21.620002] Allocated by task 171: [ 21.620193] kasan_save_stack+0x45/0x70 [ 21.620381] kasan_save_track+0x18/0x40 [ 21.620512] kasan_save_alloc_info+0x3b/0x50 [ 21.620653] __kasan_kmalloc+0xb7/0xc0 [ 21.620900] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 21.621358] kmalloc_track_caller_oob_right+0x19a/0x520 [ 21.621604] kunit_try_run_case+0x1a5/0x480 [ 21.621777] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.622681] kthread+0x337/0x6f0 [ 21.622880] ret_from_fork+0x116/0x1d0 [ 21.623131] ret_from_fork_asm+0x1a/0x30 [ 21.623325] [ 21.623392] The buggy address belongs to the object at ffff8881024c9900 [ 21.623392] which belongs to the cache kmalloc-128 of size 128 [ 21.623913] The buggy address is located 0 bytes to the right of [ 21.623913] allocated 120-byte region [ffff8881024c9900, ffff8881024c9978) [ 21.625358] [ 21.625460] The buggy address belongs to the physical page: [ 21.625905] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024c9 [ 21.626273] flags: 0x200000000000000(node=0|zone=2) [ 21.626484] page_type: f5(slab) [ 21.626630] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 21.627317] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.627764] page dumped because: kasan: bad access detected [ 21.628081] [ 21.628167] Memory state around the buggy address: [ 21.628376] ffff8881024c9800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.628659] ffff8881024c9880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.629433] >ffff8881024c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 21.629780] ^ [ 21.630492] ffff8881024c9980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.630979] ffff8881024c9a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.631631] ==================================================================