Date
June 26, 2025, 9:10 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| juno-r2 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 35.780770] ================================================================== [ 35.792501] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 35.800175] Write of size 1 at addr ffff0000953620c9 by task kunit_try_catch/248 [ 35.807667] [ 35.809206] CPU: 0 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 35.809234] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.809242] Hardware name: Thundercomm Dragonboard 845c (DT) [ 35.809253] Call trace: [ 35.809260] show_stack+0x20/0x38 (C) [ 35.809278] dump_stack_lvl+0x8c/0xd0 [ 35.809297] print_report+0x118/0x608 [ 35.809315] kasan_report+0xdc/0x128 [ 35.809334] __asan_report_store1_noabort+0x20/0x30 [ 35.809352] krealloc_less_oob_helper+0xa48/0xc50 [ 35.809370] krealloc_large_less_oob+0x20/0x38 [ 35.809389] kunit_try_run_case+0x170/0x3f0 [ 35.809409] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.809429] kthread+0x328/0x630 [ 35.809443] ret_from_fork+0x10/0x20 [ 35.809459] [ 35.880274] The buggy address belongs to the physical page: [ 35.885922] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 35.894034] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 35.901788] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 35.908843] page_type: f8(unknown) [ 35.912307] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 35.920151] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 35.927996] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 35.935926] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 35.943856] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 35.951785] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 35.959710] page dumped because: kasan: bad access detected [ 35.965353] [ 35.966883] Memory state around the buggy address: [ 35.971743] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.979055] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.986378] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 35.993697] ^ [ 35.999348] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.006670] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.013990] ================================================================== [ 33.719133] ================================================================== [ 33.730345] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 33.738021] Write of size 1 at addr ffff00008036eec9 by task kunit_try_catch/244 [ 33.745521] [ 33.747053] CPU: 0 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 33.747081] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.747090] Hardware name: Thundercomm Dragonboard 845c (DT) [ 33.747102] Call trace: [ 33.747109] show_stack+0x20/0x38 (C) [ 33.747129] dump_stack_lvl+0x8c/0xd0 [ 33.747147] print_report+0x118/0x608 [ 33.747165] kasan_report+0xdc/0x128 [ 33.747185] __asan_report_store1_noabort+0x20/0x30 [ 33.747203] krealloc_less_oob_helper+0xa48/0xc50 [ 33.747223] krealloc_less_oob+0x20/0x38 [ 33.747240] kunit_try_run_case+0x170/0x3f0 [ 33.747260] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.747283] kthread+0x328/0x630 [ 33.747298] ret_from_fork+0x10/0x20 [ 33.747316] [ 33.817595] Allocated by task 244: [ 33.821053] kasan_save_stack+0x3c/0x68 [ 33.824964] kasan_save_track+0x20/0x40 [ 33.828872] kasan_save_alloc_info+0x40/0x58 [ 33.833210] __kasan_krealloc+0x118/0x178 [ 33.837294] krealloc_noprof+0x128/0x360 [ 33.841290] krealloc_less_oob_helper+0x168/0xc50 [ 33.846073] krealloc_less_oob+0x20/0x38 [ 33.850067] kunit_try_run_case+0x170/0x3f0 [ 33.854319] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.859887] kthread+0x328/0x630 [ 33.863179] ret_from_fork+0x10/0x20 [ 33.866815] [ 33.868351] The buggy address belongs to the object at ffff00008036ee00 [ 33.868351] which belongs to the cache kmalloc-256 of size 256 [ 33.881015] The buggy address is located 0 bytes to the right of [ 33.881015] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 33.894114] [ 33.895643] The buggy address belongs to the physical page: [ 33.901288] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 33.909391] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.917147] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 33.924204] page_type: f5(slab) [ 33.927412] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 33.935257] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.943102] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 33.951033] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.958967] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 33.966898] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 33.974823] page dumped because: kasan: bad access detected [ 33.980475] [ 33.982006] Memory state around the buggy address: [ 33.986868] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.994180] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.001494] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 34.008815] ^ [ 34.014467] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.021780] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.029091] ================================================================== [ 36.021411] ================================================================== [ 36.028733] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 36.036406] Write of size 1 at addr ffff0000953620d0 by task kunit_try_catch/248 [ 36.043907] [ 36.045436] CPU: 0 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.045464] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.045472] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.045484] Call trace: [ 36.045490] show_stack+0x20/0x38 (C) [ 36.045509] dump_stack_lvl+0x8c/0xd0 [ 36.045527] print_report+0x118/0x608 [ 36.045545] kasan_report+0xdc/0x128 [ 36.045563] __asan_report_store1_noabort+0x20/0x30 [ 36.045581] krealloc_less_oob_helper+0xb9c/0xc50 [ 36.045599] krealloc_large_less_oob+0x20/0x38 [ 36.045620] kunit_try_run_case+0x170/0x3f0 [ 36.045639] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.045660] kthread+0x328/0x630 [ 36.045674] ret_from_fork+0x10/0x20 [ 36.045691] [ 36.116497] The buggy address belongs to the physical page: [ 36.122146] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 36.130259] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.138014] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.145069] page_type: f8(unknown) [ 36.148532] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.156375] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.164220] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.172149] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.180078] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 36.188008] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 36.195934] page dumped because: kasan: bad access detected [ 36.201579] [ 36.203107] Memory state around the buggy address: [ 36.207965] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.215280] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.222602] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 36.229922] ^ [ 36.235832] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.243145] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.250465] ================================================================== [ 34.351107] ================================================================== [ 34.358426] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 34.366101] Write of size 1 at addr ffff00008036eeda by task kunit_try_catch/244 [ 34.373595] [ 34.375124] CPU: 6 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 34.375154] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.375162] Hardware name: Thundercomm Dragonboard 845c (DT) [ 34.375172] Call trace: [ 34.375177] show_stack+0x20/0x38 (C) [ 34.375195] dump_stack_lvl+0x8c/0xd0 [ 34.375213] print_report+0x118/0x608 [ 34.375231] kasan_report+0xdc/0x128 [ 34.375247] __asan_report_store1_noabort+0x20/0x30 [ 34.375263] krealloc_less_oob_helper+0xa80/0xc50 [ 34.375280] krealloc_less_oob+0x20/0x38 [ 34.375296] kunit_try_run_case+0x170/0x3f0 [ 34.375312] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.375332] kthread+0x328/0x630 [ 34.375344] ret_from_fork+0x10/0x20 [ 34.375361] [ 34.445554] Allocated by task 244: [ 34.449006] kasan_save_stack+0x3c/0x68 [ 34.452913] kasan_save_track+0x20/0x40 [ 34.456816] kasan_save_alloc_info+0x40/0x58 [ 34.461150] __kasan_krealloc+0x118/0x178 [ 34.465227] krealloc_noprof+0x128/0x360 [ 34.469215] krealloc_less_oob_helper+0x168/0xc50 [ 34.473986] krealloc_less_oob+0x20/0x38 [ 34.477975] kunit_try_run_case+0x170/0x3f0 [ 34.482224] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.487785] kthread+0x328/0x630 [ 34.491071] ret_from_fork+0x10/0x20 [ 34.494702] [ 34.496231] The buggy address belongs to the object at ffff00008036ee00 [ 34.496231] which belongs to the cache kmalloc-256 of size 256 [ 34.508885] The buggy address is located 17 bytes to the right of [ 34.508885] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 34.522063] [ 34.523594] The buggy address belongs to the physical page: [ 34.529235] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 34.537337] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.545090] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.552138] page_type: f5(slab) [ 34.555337] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.563178] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.571017] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.578944] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.586869] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 34.594793] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 34.602716] page dumped because: kasan: bad access detected [ 34.608352] [ 34.609874] Memory state around the buggy address: [ 34.614725] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.622029] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.629333] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 34.636637] ^ [ 34.642803] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.650116] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.657418] ================================================================== [ 36.495194] ================================================================== [ 36.502511] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 36.510180] Write of size 1 at addr ffff0000953620ea by task kunit_try_catch/248 [ 36.517673] [ 36.519208] CPU: 5 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.519236] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.519243] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.519252] Call trace: [ 36.519258] show_stack+0x20/0x38 (C) [ 36.519274] dump_stack_lvl+0x8c/0xd0 [ 36.519291] print_report+0x118/0x608 [ 36.519308] kasan_report+0xdc/0x128 [ 36.519325] __asan_report_store1_noabort+0x20/0x30 [ 36.519340] krealloc_less_oob_helper+0xae4/0xc50 [ 36.519357] krealloc_large_less_oob+0x20/0x38 [ 36.519373] kunit_try_run_case+0x170/0x3f0 [ 36.519389] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.519408] kthread+0x328/0x630 [ 36.519420] ret_from_fork+0x10/0x20 [ 36.519436] [ 36.590199] The buggy address belongs to the physical page: [ 36.595846] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 36.603944] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.611691] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.618740] page_type: f8(unknown) [ 36.622195] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.630032] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.637870] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.645793] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.653717] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 36.661640] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 36.669560] page dumped because: kasan: bad access detected [ 36.675200] [ 36.676729] Memory state around the buggy address: [ 36.681580] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.688894] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.696208] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 36.703521] ^ [ 36.710217] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.717530] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.724841] ================================================================== [ 34.664854] ================================================================== [ 34.672174] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 34.679846] Write of size 1 at addr ffff00008036eeea by task kunit_try_catch/244 [ 34.687330] [ 34.688864] CPU: 6 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 34.688892] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.688899] Hardware name: Thundercomm Dragonboard 845c (DT) [ 34.688908] Call trace: [ 34.688913] show_stack+0x20/0x38 (C) [ 34.688929] dump_stack_lvl+0x8c/0xd0 [ 34.688947] print_report+0x118/0x608 [ 34.688965] kasan_report+0xdc/0x128 [ 34.688982] __asan_report_store1_noabort+0x20/0x30 [ 34.688998] krealloc_less_oob_helper+0xae4/0xc50 [ 34.689017] krealloc_less_oob+0x20/0x38 [ 34.689033] kunit_try_run_case+0x170/0x3f0 [ 34.689050] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.689069] kthread+0x328/0x630 [ 34.689082] ret_from_fork+0x10/0x20 [ 34.689097] [ 34.759333] Allocated by task 244: [ 34.762788] kasan_save_stack+0x3c/0x68 [ 34.766693] kasan_save_track+0x20/0x40 [ 34.770596] kasan_save_alloc_info+0x40/0x58 [ 34.774930] __kasan_krealloc+0x118/0x178 [ 34.779008] krealloc_noprof+0x128/0x360 [ 34.782998] krealloc_less_oob_helper+0x168/0xc50 [ 34.787775] krealloc_less_oob+0x20/0x38 [ 34.791764] kunit_try_run_case+0x170/0x3f0 [ 34.796014] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.801580] kthread+0x328/0x630 [ 34.804861] ret_from_fork+0x10/0x20 [ 34.808490] [ 34.810013] The buggy address belongs to the object at ffff00008036ee00 [ 34.810013] which belongs to the cache kmalloc-256 of size 256 [ 34.822666] The buggy address is located 33 bytes to the right of [ 34.822666] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 34.835849] [ 34.837370] The buggy address belongs to the physical page: [ 34.843012] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 34.851113] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.858864] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.865911] page_type: f5(slab) [ 34.869104] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.876943] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.884782] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.892707] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.900632] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 34.908555] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 34.916476] page dumped because: kasan: bad access detected [ 34.922118] [ 34.923647] Memory state around the buggy address: [ 34.928497] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.935811] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.943119] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 34.950421] ^ [ 34.957114] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.964418] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.971733] ================================================================== [ 36.258667] ================================================================== [ 36.265994] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 36.273664] Write of size 1 at addr ffff0000953620da by task kunit_try_catch/248 [ 36.281157] [ 36.282685] CPU: 5 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.282714] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.282723] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.282734] Call trace: [ 36.282741] show_stack+0x20/0x38 (C) [ 36.282758] dump_stack_lvl+0x8c/0xd0 [ 36.282775] print_report+0x118/0x608 [ 36.282793] kasan_report+0xdc/0x128 [ 36.282809] __asan_report_store1_noabort+0x20/0x30 [ 36.282826] krealloc_less_oob_helper+0xa80/0xc50 [ 36.282844] krealloc_large_less_oob+0x20/0x38 [ 36.282861] kunit_try_run_case+0x170/0x3f0 [ 36.282877] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.282896] kthread+0x328/0x630 [ 36.282908] ret_from_fork+0x10/0x20 [ 36.282924] [ 36.353703] The buggy address belongs to the physical page: [ 36.359351] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 36.367449] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.375197] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.382251] page_type: f8(unknown) [ 36.385712] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.393547] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.401383] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.409305] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.417228] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 36.425150] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 36.433069] page dumped because: kasan: bad access detected [ 36.438714] [ 36.440236] Memory state around the buggy address: [ 36.445090] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.452402] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.459715] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 36.467025] ^ [ 36.473196] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.480508] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.487818] ================================================================== [ 36.732248] ================================================================== [ 36.739564] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 36.747234] Write of size 1 at addr ffff0000953620eb by task kunit_try_catch/248 [ 36.754727] [ 36.756260] CPU: 5 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.756287] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.756294] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.756303] Call trace: [ 36.756308] show_stack+0x20/0x38 (C) [ 36.756324] dump_stack_lvl+0x8c/0xd0 [ 36.756341] print_report+0x118/0x608 [ 36.756360] kasan_report+0xdc/0x128 [ 36.756377] __asan_report_store1_noabort+0x20/0x30 [ 36.756392] krealloc_less_oob_helper+0xa58/0xc50 [ 36.756408] krealloc_large_less_oob+0x20/0x38 [ 36.756425] kunit_try_run_case+0x170/0x3f0 [ 36.756441] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.756461] kthread+0x328/0x630 [ 36.756473] ret_from_fork+0x10/0x20 [ 36.756490] [ 36.827249] The buggy address belongs to the physical page: [ 36.832888] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 36.840986] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.848734] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.855779] page_type: f8(unknown) [ 36.859237] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.867076] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.874912] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.882835] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.890758] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 36.898681] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 36.906601] page dumped because: kasan: bad access detected [ 36.912238] [ 36.913760] Memory state around the buggy address: [ 36.918609] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.925923] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.933238] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 36.940549] ^ [ 36.947245] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.954550] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.961861] ================================================================== [ 34.979515] ================================================================== [ 34.986832] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 34.994505] Write of size 1 at addr ffff00008036eeeb by task kunit_try_catch/244 [ 35.001999] [ 35.003535] CPU: 4 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 35.003566] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.003574] Hardware name: Thundercomm Dragonboard 845c (DT) [ 35.003585] Call trace: [ 35.003590] show_stack+0x20/0x38 (C) [ 35.003608] dump_stack_lvl+0x8c/0xd0 [ 35.003625] print_report+0x118/0x608 [ 35.003643] kasan_report+0xdc/0x128 [ 35.003660] __asan_report_store1_noabort+0x20/0x30 [ 35.003677] krealloc_less_oob_helper+0xa58/0xc50 [ 35.003695] krealloc_less_oob+0x20/0x38 [ 35.003710] kunit_try_run_case+0x170/0x3f0 [ 35.003727] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.003747] kthread+0x328/0x630 [ 35.003759] ret_from_fork+0x10/0x20 [ 35.003775] [ 35.073982] Allocated by task 244: [ 35.077437] kasan_save_stack+0x3c/0x68 [ 35.081332] kasan_save_track+0x20/0x40 [ 35.085238] kasan_save_alloc_info+0x40/0x58 [ 35.089574] __kasan_krealloc+0x118/0x178 [ 35.093652] krealloc_noprof+0x128/0x360 [ 35.097642] krealloc_less_oob_helper+0x168/0xc50 [ 35.102413] krealloc_less_oob+0x20/0x38 [ 35.106404] kunit_try_run_case+0x170/0x3f0 [ 35.110655] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.116217] kthread+0x328/0x630 [ 35.119499] ret_from_fork+0x10/0x20 [ 35.123132] [ 35.124662] The buggy address belongs to the object at ffff00008036ee00 [ 35.124662] which belongs to the cache kmalloc-256 of size 256 [ 35.137318] The buggy address is located 34 bytes to the right of [ 35.137318] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 35.150498] [ 35.152029] The buggy address belongs to the physical page: [ 35.157673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 35.165775] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 35.173527] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 35.180576] page_type: f5(slab) [ 35.183773] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 35.191614] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 35.199455] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 35.207382] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 35.215309] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 35.223235] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 35.231155] page dumped because: kasan: bad access detected [ 35.236795] [ 35.238316] Memory state around the buggy address: [ 35.243167] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.250474] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.257782] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 35.265086] ^ [ 35.271781] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.279089] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.286393] ================================================================== [ 34.036575] ================================================================== [ 34.043891] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 34.051568] Write of size 1 at addr ffff00008036eed0 by task kunit_try_catch/244 [ 34.059068] [ 34.060604] CPU: 0 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 34.060632] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.060641] Hardware name: Thundercomm Dragonboard 845c (DT) [ 34.060652] Call trace: [ 34.060660] show_stack+0x20/0x38 (C) [ 34.060678] dump_stack_lvl+0x8c/0xd0 [ 34.060697] print_report+0x118/0x608 [ 34.060716] kasan_report+0xdc/0x128 [ 34.060733] __asan_report_store1_noabort+0x20/0x30 [ 34.060752] krealloc_less_oob_helper+0xb9c/0xc50 [ 34.060770] krealloc_less_oob+0x20/0x38 [ 34.060788] kunit_try_run_case+0x170/0x3f0 [ 34.060808] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.060830] kthread+0x328/0x630 [ 34.060844] ret_from_fork+0x10/0x20 [ 34.060863] [ 34.131151] Allocated by task 244: [ 34.134612] kasan_save_stack+0x3c/0x68 [ 34.138522] kasan_save_track+0x20/0x40 [ 34.142431] kasan_save_alloc_info+0x40/0x58 [ 34.146771] __kasan_krealloc+0x118/0x178 [ 34.150854] krealloc_noprof+0x128/0x360 [ 34.154851] krealloc_less_oob_helper+0x168/0xc50 [ 34.159633] krealloc_less_oob+0x20/0x38 [ 34.163628] kunit_try_run_case+0x170/0x3f0 [ 34.167879] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.173448] kthread+0x328/0x630 [ 34.176740] ret_from_fork+0x10/0x20 [ 34.180379] [ 34.181908] The buggy address belongs to the object at ffff00008036ee00 [ 34.181908] which belongs to the cache kmalloc-256 of size 256 [ 34.194571] The buggy address is located 7 bytes to the right of [ 34.194571] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 34.207667] [ 34.209204] The buggy address belongs to the physical page: [ 34.214853] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 34.222965] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.230719] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.237775] page_type: f5(slab) [ 34.240979] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.248824] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.256669] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.264599] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.272529] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 34.280460] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 34.288386] page dumped because: kasan: bad access detected [ 34.294037] [ 34.295564] Memory state around the buggy address: [ 34.300421] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.307738] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.315053] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 34.322362] ^ [ 34.328278] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.335595] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.342907] ==================================================================
[ 1523.222402] ================================================================== [ 1523.222430] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 1523.222466] Write of size 1 at addr ffff000800d210c9 by task kunit_try_catch/229 [ 1523.222499] [ 1523.222513] CPU: 5 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 1523.222571] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 1523.222589] Hardware name: ARM Juno development board (r2) (DT) [ 1523.222610] Call trace: [ 1523.222621] show_stack+0x20/0x38 (C) [ 1523.222657] dump_stack_lvl+0x8c/0xd0 [ 1523.222695] print_report+0x118/0x608 [ 1523.222734] kasan_report+0xdc/0x128 [ 1523.222773] __asan_report_store1_noabort+0x20/0x30 [ 1523.222809] krealloc_less_oob_helper+0xa48/0xc50 [ 1523.222848] krealloc_less_oob+0x20/0x38 [ 1523.222884] kunit_try_run_case+0x170/0x3f0 [ 1523.222921] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 1523.222965] kthread+0x328/0x630 [ 1523.222995] ret_from_fork+0x10/0x20 [ 1523.223031] [ 1523.223040] Allocated by task 229: [ 1523.223056] kasan_save_stack+0x3c/0x68 [ 1523.223088] kasan_save_track+0x20/0x40 [ 1523.223120] kasan_save_alloc_info+0x40/0x58 [ 1523.223146] __kasan_krealloc+0x118/0x178 [ 1523.223178] krealloc_noprof+0x128/0x360 [ 1523.223209] krealloc_less_oob_helper+0x168/0xc50 [ 1523.223242] krealloc_less_oob+0x20/0x38 [ 1523.223271] kunit_try_run_case+0x170/0x3f0 [ 1523.223302] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 1523.223339] kthread+0x328/0x630 [ 1523.223362] ret_from_fork+0x10/0x20 [ 1523.223390] [ 1523.223400] The buggy address belongs to the object at ffff000800d21000 [ 1523.223400] which belongs to the cache kmalloc-256 of size 256 [ 1523.223437] The buggy address is located 0 bytes to the right of [ 1523.223437] allocated 201-byte region [ffff000800d21000, ffff000800d210c9) [ 1523.223480] [ 1523.223489] The buggy address belongs to the physical page: [ 1523.223506] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880d20 [ 1523.223539] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1523.223569] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 1523.223601] page_type: f5(slab) [ 1523.223627] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 1523.223661] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 1523.223697] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 1523.223731] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 1523.223766] head: 0bfffe0000000001 fffffdffe0034801 00000000ffffffff 00000000ffffffff [ 1523.223800] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 1523.223825] page dumped because: kasan: bad access detected [ 1523.223843] [ 1523.223852] Memory state around the buggy address: [ 1523.223871] ffff000800d20f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1523.223900] ffff000800d21000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1523.223929] >ffff000800d21080: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 1523.223952] ^ [ 1523.223974] ffff000800d21100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1523.224003] ffff000800d21180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1523.224027] ================================================================== [ 1523.224083] ================================================================== [ 1523.224106] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 1523.224141] Write of size 1 at addr ffff000800d210d0 by task kunit_try_catch/229 [ 1523.224173] [ 1523.224187] CPU: 5 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 1523.224245] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 1523.224263] Hardware name: ARM Juno development board (r2) (DT) [ 1523.224283] Call trace: [ 1523.224295] show_stack+0x20/0x38 (C) [ 1523.224330] dump_stack_lvl+0x8c/0xd0 [ 1523.224368] print_report+0x118/0x608 [ 1523.224407] kasan_report+0xdc/0x128 [ 1523.224445] __asan_report_store1_noabort+0x20/0x30 [ 1523.224481] krealloc_less_oob_helper+0xb9c/0xc50 [ 1523.224520] krealloc_less_oob+0x20/0x38 [ 1523.224557] kunit_try_run_case+0x170/0x3f0 [ 1523.224594] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 1523.224639] kthread+0x328/0x630 [ 1523.224669] ret_from_fork+0x10/0x20 [ 1523.224704] [ 1523.224713] Allocated by task 229: [ 1523.224729] kasan_save_stack+0x3c/0x68 [ 1523.224762] kasan_save_track+0x20/0x40 [ 1523.224793] kasan_save_alloc_info+0x40/0x58 [ 1523.224820] __kasan_krealloc+0x118/0x178 [ 1523.224852] krealloc_noprof+0x128/0x360 [ 1523.224883] krealloc_less_oob_helper+0x168/0xc50 [ 1523.224915] krealloc_less_oob+0x20/0x38 [ 1523.224945] kunit_try_run_case+0x170/0x3f0 [ 1523.224975] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 1523.225012] kthread+0x328/0x630 [ 1523.225035] ret_from_fork+0x10/0x20 [ 1523.225064] [ 1523.225073] The buggy address belongs to the object at ffff000800d21000 [ 1523.225073] which belongs to the cache kmalloc-256 of size 256 [ 1523.225110] The buggy address is located 7 bytes to the right of [ 1523.225110] allocated 201-byte region [ffff000800d21000, ffff000800d210c9) [ 1523.225153] [ 1523.225162] The buggy address belongs to the physical page: [ 1523.225180] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880d20 [ 1523.225212] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1523.225242] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 1523.225274] page_type: f5(slab) [ 1523.225299] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 1523.225333] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 1523.225369] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000 [ 1523.225403] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 1523.225438] head: 0bfffe0000000001 fffffdffe0034801 00000000ffffffff 00000000ffffffff [ 1523.225472] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 1523.225498] page dumped because: kasan: bad access detected [ 1523.225516] [ 1523.225524] Memory state around the buggy address: [ 1523.225543] ffff000800d20f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1523.225572] ffff000800d21000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1523.225601] >ffff000800d21080: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 1523.225625] ^ [ 1523.225647] ffff000800d21100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1523.225676] ffff000800d21180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1523.225700] ================================================================== [ 1523.225726] ================================================================== [ 1523.225747] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 1523.225781] Write of size 1 at addr ffff000800d210da by task kunit_try_catch/229 [ 1523.225813] [ 1523.225827] CPU: 5 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 1523.225884] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 1523.225902] Hardware name: ARM Juno development board (r2) (DT) [ 1523.225922] Call trace: [ 1523.225933] show_stack+0x20/0x38 (C) [ 1523.225968] dump_stack_lvl+0x8c/0xd0 [ 1523.226006] print_report+0x118/0x608 [ 1523.226045] kasan_report+0xdc/0x128 [ 1523.226084] __asan_report_store1_noabort+0x20/0x30 [ 1523.226120] krealloc_less_oob_helper+0xa80/0xc50 [ 1523.226159] krealloc_less_oob+0x20/0x38 [ 1523.226195] kunit_try_run_case+0x170/0x3f0 [ 1523.226232] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 1523.226276] kthread+0x328/0x630 [ 1523.226306] ret_from_fork+0x10/0x20 [ 1523.226342] [ 1523.226351] Allocated by task 229: [ 1523.226367] kasan_save_stack+0x3c/0x68 [ 1523.226399] kasan_save_track+0x20/0x40 [ 1523.226430] kasan_save_alloc_info+0x40/0x58 [ 1523.226457] __kasan_krealloc+0x118/0x178 [ 1523.226489] krealloc_noprof+0x128/0x360 [ 1523.226520] krealloc_less_oob_helper+0x168/0xc50 [ 1523.226553] krealloc_less_oob+0x20/0x38 [ 1523.226582] kunit_try_run_case+0x170/0x3f0 [ 1523.226613] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 1523.226650] kthread+0x328/0x630 [ 1523.226673] ret_from_fork+0x10/0x20 [ 1523.226702] [ 1523.226711] The buggy address belongs to the object at ffff000800d21000 [ 1523.226711] which belongs to the cache kmalloc-256 of size 256 [ 1523.226748] The buggy address is located 17 bytes to the right of [ 1523.226748] allocated 201-byte region [ffff000800d21000, ffff000800d210c9) [ 1523.226792] [ 1523.226801] The buggy address belongs to the physical page: [ 1523.226818] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880d20 [ 1523.226851] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1523.226881] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 1523.226913] page_type: f5(slab) [ 1523.227419] Write of size 1 at addr ffff000800d210ea by task kunit_try_catch/229 [ 1523.229260] show_stack+0x20/0x38 (C) [ 1523.233303] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 1523.234288] ffff000827892180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1523.240058] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 1523.246582] [ 1523.251060] kunit_try_run_case+0x170/0x3f0 [ 1523.257650] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 1523.273799] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 1523.289321] kunit_try_run_case+0x170/0x3f0 [ 1523.297919] The buggy address belongs to the object at ffff000827f2f300 [ 1523.297919] which belongs to the cache kmalloc-128 of size 128 [ 1525.271958] The buggy address belongs to the object at ffff000800c03c00 [ 1525.271958] which belongs to the cache kmalloc-128 of size 128 [ 1525.315974] The buggy address is located 1 bytes inside of [ 1525.315974] 128-byte region [ffff000827998100, ffff000827998180) [ 1525.341573] Read of size 1 at addr ffff000827f466d0 by task kunit_try_catch/330 [ 1525.361931] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa00/0xbc0 [ 1525.391784] ==================================================================
[ 26.649709] ================================================================== [ 26.649914] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 26.649974] Write of size 1 at addr fff00000c1c40cd0 by task kunit_try_catch/170 [ 26.650021] [ 26.650048] CPU: 0 UID: 0 PID: 170 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.650322] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.650356] Hardware name: linux,dummy-virt (DT) [ 26.650384] Call trace: [ 26.650404] show_stack+0x20/0x38 (C) [ 26.650453] dump_stack_lvl+0x8c/0xd0 [ 26.650499] print_report+0x118/0x608 [ 26.650546] kasan_report+0xdc/0x128 [ 26.651071] __asan_report_store1_noabort+0x20/0x30 [ 26.651201] krealloc_less_oob_helper+0xb9c/0xc50 [ 26.651252] krealloc_less_oob+0x20/0x38 [ 26.651307] kunit_try_run_case+0x170/0x3f0 [ 26.651516] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.651569] kthread+0x328/0x630 [ 26.651609] ret_from_fork+0x10/0x20 [ 26.651655] [ 26.651673] Allocated by task 170: [ 26.651698] kasan_save_stack+0x3c/0x68 [ 26.651744] kasan_save_track+0x20/0x40 [ 26.651898] kasan_save_alloc_info+0x40/0x58 [ 26.652091] __kasan_krealloc+0x118/0x178 [ 26.652279] krealloc_noprof+0x128/0x360 [ 26.652316] krealloc_less_oob_helper+0x168/0xc50 [ 26.652460] krealloc_less_oob+0x20/0x38 [ 26.652562] kunit_try_run_case+0x170/0x3f0 [ 26.652598] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.652639] kthread+0x328/0x630 [ 26.652669] ret_from_fork+0x10/0x20 [ 26.652709] [ 26.652795] The buggy address belongs to the object at fff00000c1c40c00 [ 26.652795] which belongs to the cache kmalloc-256 of size 256 [ 26.652899] The buggy address is located 7 bytes to the right of [ 26.652899] allocated 201-byte region [fff00000c1c40c00, fff00000c1c40cc9) [ 26.652960] [ 26.652979] The buggy address belongs to the physical page: [ 26.653010] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c40 [ 26.653069] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.653113] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.653163] page_type: f5(slab) [ 26.653626] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.653679] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.654076] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.654508] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.654689] head: 0bfffe0000000001 ffffc1ffc3071001 00000000ffffffff 00000000ffffffff [ 26.655117] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.655186] page dumped because: kasan: bad access detected [ 26.655217] [ 26.655234] Memory state around the buggy address: [ 26.655264] fff00000c1c40b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.655305] fff00000c1c40c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.655345] >fff00000c1c40c80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 26.655381] ^ [ 26.655880] fff00000c1c40d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.656033] fff00000c1c40d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.656081] ================================================================== [ 26.768025] ================================================================== [ 26.768160] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 26.768285] Write of size 1 at addr fff00000c649e0da by task kunit_try_catch/174 [ 26.768335] [ 26.768362] CPU: 0 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.768446] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.768471] Hardware name: linux,dummy-virt (DT) [ 26.768500] Call trace: [ 26.768520] show_stack+0x20/0x38 (C) [ 26.768568] dump_stack_lvl+0x8c/0xd0 [ 26.768614] print_report+0x118/0x608 [ 26.768782] kasan_report+0xdc/0x128 [ 26.769273] __asan_report_store1_noabort+0x20/0x30 [ 26.769679] krealloc_less_oob_helper+0xa80/0xc50 [ 26.769732] krealloc_large_less_oob+0x20/0x38 [ 26.769791] kunit_try_run_case+0x170/0x3f0 [ 26.769841] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.769893] kthread+0x328/0x630 [ 26.769937] ret_from_fork+0x10/0x20 [ 26.769984] [ 26.770003] The buggy address belongs to the physical page: [ 26.770032] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10649c [ 26.770091] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.770136] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.770191] page_type: f8(unknown) [ 26.770229] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.770276] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.770324] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.770371] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.770418] head: 0bfffe0000000002 ffffc1ffc3192701 00000000ffffffff 00000000ffffffff [ 26.770464] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 26.770502] page dumped because: kasan: bad access detected [ 26.770531] [ 26.770548] Memory state around the buggy address: [ 26.770577] fff00000c649df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.770616] fff00000c649e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.770656] >fff00000c649e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 26.770691] ^ [ 26.770726] fff00000c649e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.770765] fff00000c649e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.770801] ================================================================== [ 26.641459] ================================================================== [ 26.641515] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 26.641644] Write of size 1 at addr fff00000c1c40cc9 by task kunit_try_catch/170 [ 26.641696] [ 26.641726] CPU: 0 UID: 0 PID: 170 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.641809] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.641835] Hardware name: linux,dummy-virt (DT) [ 26.641871] Call trace: [ 26.641958] show_stack+0x20/0x38 (C) [ 26.642179] dump_stack_lvl+0x8c/0xd0 [ 26.642227] print_report+0x118/0x608 [ 26.642334] kasan_report+0xdc/0x128 [ 26.642379] __asan_report_store1_noabort+0x20/0x30 [ 26.642426] krealloc_less_oob_helper+0xa48/0xc50 [ 26.642474] krealloc_less_oob+0x20/0x38 [ 26.642524] kunit_try_run_case+0x170/0x3f0 [ 26.642762] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.642857] kthread+0x328/0x630 [ 26.643472] ret_from_fork+0x10/0x20 [ 26.643626] [ 26.643866] Allocated by task 170: [ 26.644155] kasan_save_stack+0x3c/0x68 [ 26.644206] kasan_save_track+0x20/0x40 [ 26.644242] kasan_save_alloc_info+0x40/0x58 [ 26.644277] __kasan_krealloc+0x118/0x178 [ 26.644314] krealloc_noprof+0x128/0x360 [ 26.644349] krealloc_less_oob_helper+0x168/0xc50 [ 26.644626] krealloc_less_oob+0x20/0x38 [ 26.644702] kunit_try_run_case+0x170/0x3f0 [ 26.644741] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.644783] kthread+0x328/0x630 [ 26.644825] ret_from_fork+0x10/0x20 [ 26.645092] [ 26.645159] The buggy address belongs to the object at fff00000c1c40c00 [ 26.645159] which belongs to the cache kmalloc-256 of size 256 [ 26.645225] The buggy address is located 0 bytes to the right of [ 26.645225] allocated 201-byte region [fff00000c1c40c00, fff00000c1c40cc9) [ 26.645370] [ 26.645389] The buggy address belongs to the physical page: [ 26.645419] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c40 [ 26.645470] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.645797] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.645885] page_type: f5(slab) [ 26.645922] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.645970] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.646074] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.646275] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.646364] head: 0bfffe0000000001 ffffc1ffc3071001 00000000ffffffff 00000000ffffffff [ 26.646749] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.646793] page dumped because: kasan: bad access detected [ 26.646824] [ 26.646842] Memory state around the buggy address: [ 26.646872] fff00000c1c40b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.646996] fff00000c1c40c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.647154] >fff00000c1c40c80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 26.647202] ^ [ 26.647298] fff00000c1c40d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.647428] fff00000c1c40d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.647464] ================================================================== [ 26.753337] ================================================================== [ 26.753389] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 26.753437] Write of size 1 at addr fff00000c649e0d0 by task kunit_try_catch/174 [ 26.754685] [ 26.754821] CPU: 0 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.755644] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.755850] Hardware name: linux,dummy-virt (DT) [ 26.756016] Call trace: [ 26.756045] show_stack+0x20/0x38 (C) [ 26.756600] dump_stack_lvl+0x8c/0xd0 [ 26.756884] print_report+0x118/0x608 [ 26.757015] kasan_report+0xdc/0x128 [ 26.757248] __asan_report_store1_noabort+0x20/0x30 [ 26.757302] krealloc_less_oob_helper+0xb9c/0xc50 [ 26.757571] krealloc_large_less_oob+0x20/0x38 [ 26.757650] kunit_try_run_case+0x170/0x3f0 [ 26.757697] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.758299] kthread+0x328/0x630 [ 26.758399] ret_from_fork+0x10/0x20 [ 26.758558] [ 26.759331] The buggy address belongs to the physical page: [ 26.759758] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10649c [ 26.760100] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.760149] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.760292] page_type: f8(unknown) [ 26.760533] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.760588] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.760957] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.761504] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.761749] head: 0bfffe0000000002 ffffc1ffc3192701 00000000ffffffff 00000000ffffffff [ 26.761798] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 26.761836] page dumped because: kasan: bad access detected [ 26.763019] [ 26.763043] Memory state around the buggy address: [ 26.763478] fff00000c649df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.763795] fff00000c649e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.764231] >fff00000c649e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 26.764278] ^ [ 26.764841] fff00000c649e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.765006] fff00000c649e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.765275] ================================================================== [ 26.657872] ================================================================== [ 26.658008] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 26.658207] Write of size 1 at addr fff00000c1c40cda by task kunit_try_catch/170 [ 26.658261] [ 26.658289] CPU: 0 UID: 0 PID: 170 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.658823] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.658963] Hardware name: linux,dummy-virt (DT) [ 26.658998] Call trace: [ 26.659084] show_stack+0x20/0x38 (C) [ 26.659133] dump_stack_lvl+0x8c/0xd0 [ 26.659185] print_report+0x118/0x608 [ 26.659370] kasan_report+0xdc/0x128 [ 26.659489] __asan_report_store1_noabort+0x20/0x30 [ 26.659582] krealloc_less_oob_helper+0xa80/0xc50 [ 26.659713] krealloc_less_oob+0x20/0x38 [ 26.659763] kunit_try_run_case+0x170/0x3f0 [ 26.659818] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.659871] kthread+0x328/0x630 [ 26.659911] ret_from_fork+0x10/0x20 [ 26.659957] [ 26.659974] Allocated by task 170: [ 26.660000] kasan_save_stack+0x3c/0x68 [ 26.660480] kasan_save_track+0x20/0x40 [ 26.660544] kasan_save_alloc_info+0x40/0x58 [ 26.660832] __kasan_krealloc+0x118/0x178 [ 26.660958] krealloc_noprof+0x128/0x360 [ 26.660994] krealloc_less_oob_helper+0x168/0xc50 [ 26.661035] krealloc_less_oob+0x20/0x38 [ 26.661363] kunit_try_run_case+0x170/0x3f0 [ 26.661434] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.661476] kthread+0x328/0x630 [ 26.661513] ret_from_fork+0x10/0x20 [ 26.661805] [ 26.661824] The buggy address belongs to the object at fff00000c1c40c00 [ 26.661824] which belongs to the cache kmalloc-256 of size 256 [ 26.662078] The buggy address is located 17 bytes to the right of [ 26.662078] allocated 201-byte region [fff00000c1c40c00, fff00000c1c40cc9) [ 26.662456] [ 26.662481] The buggy address belongs to the physical page: [ 26.662623] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c40 [ 26.662679] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.663113] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.663175] page_type: f5(slab) [ 26.663212] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.663269] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.663317] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.663589] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.663897] head: 0bfffe0000000001 ffffc1ffc3071001 00000000ffffffff 00000000ffffffff [ 26.663975] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.664030] page dumped because: kasan: bad access detected [ 26.664075] [ 26.664092] Memory state around the buggy address: [ 26.664125] fff00000c1c40b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.664413] fff00000c1c40c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.664477] >fff00000c1c40c80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 26.664513] ^ [ 26.664610] fff00000c1c40d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.664780] fff00000c1c40d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.664815] ================================================================== [ 26.771360] ================================================================== [ 26.771402] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 26.771448] Write of size 1 at addr fff00000c649e0ea by task kunit_try_catch/174 [ 26.771495] [ 26.771523] CPU: 0 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.771603] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.771627] Hardware name: linux,dummy-virt (DT) [ 26.771655] Call trace: [ 26.771675] show_stack+0x20/0x38 (C) [ 26.771720] dump_stack_lvl+0x8c/0xd0 [ 26.771765] print_report+0x118/0x608 [ 26.771817] kasan_report+0xdc/0x128 [ 26.771862] __asan_report_store1_noabort+0x20/0x30 [ 26.771909] krealloc_less_oob_helper+0xae4/0xc50 [ 26.771957] krealloc_large_less_oob+0x20/0x38 [ 26.772004] kunit_try_run_case+0x170/0x3f0 [ 26.772050] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.772447] kthread+0x328/0x630 [ 26.772502] ret_from_fork+0x10/0x20 [ 26.772548] [ 26.772567] The buggy address belongs to the physical page: [ 26.772596] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10649c [ 26.772646] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.772690] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.772741] page_type: f8(unknown) [ 26.772779] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.772827] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.772875] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.772921] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.772967] head: 0bfffe0000000002 ffffc1ffc3192701 00000000ffffffff 00000000ffffffff [ 26.773014] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 26.773051] page dumped because: kasan: bad access detected [ 26.773093] [ 26.773110] Memory state around the buggy address: [ 26.773138] fff00000c649df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.773177] fff00000c649e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.773256] >fff00000c649e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 26.773314] ^ [ 26.773352] fff00000c649e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.773422] fff00000c649e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.773459] ================================================================== [ 26.774020] ================================================================== [ 26.774115] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 26.774169] Write of size 1 at addr fff00000c649e0eb by task kunit_try_catch/174 [ 26.774250] [ 26.774297] CPU: 0 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.774395] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.774447] Hardware name: linux,dummy-virt (DT) [ 26.774504] Call trace: [ 26.774542] show_stack+0x20/0x38 (C) [ 26.774589] dump_stack_lvl+0x8c/0xd0 [ 26.774634] print_report+0x118/0x608 [ 26.774759] kasan_report+0xdc/0x128 [ 26.775012] __asan_report_store1_noabort+0x20/0x30 [ 26.775093] krealloc_less_oob_helper+0xa58/0xc50 [ 26.775195] krealloc_large_less_oob+0x20/0x38 [ 26.775271] kunit_try_run_case+0x170/0x3f0 [ 26.775350] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.775404] kthread+0x328/0x630 [ 26.775517] ret_from_fork+0x10/0x20 [ 26.775699] [ 26.775718] The buggy address belongs to the physical page: [ 26.775755] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10649c [ 26.775805] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.775861] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.775910] page_type: f8(unknown) [ 26.775975] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.776029] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.776319] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.776403] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.776487] head: 0bfffe0000000002 ffffc1ffc3192701 00000000ffffffff 00000000ffffffff [ 26.776552] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 26.776590] page dumped because: kasan: bad access detected [ 26.776620] [ 26.776637] Memory state around the buggy address: [ 26.776665] fff00000c649df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.776876] fff00000c649e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.777182] >fff00000c649e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 26.777301] ^ [ 26.777366] fff00000c649e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.777406] fff00000c649e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.777616] ================================================================== [ 26.665806] ================================================================== [ 26.665962] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 26.666293] Write of size 1 at addr fff00000c1c40cea by task kunit_try_catch/170 [ 26.666859] [ 26.666900] CPU: 0 UID: 0 PID: 170 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.666994] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.667099] Hardware name: linux,dummy-virt (DT) [ 26.667136] Call trace: [ 26.667159] show_stack+0x20/0x38 (C) [ 26.667210] dump_stack_lvl+0x8c/0xd0 [ 26.667578] print_report+0x118/0x608 [ 26.667647] kasan_report+0xdc/0x128 [ 26.667695] __asan_report_store1_noabort+0x20/0x30 [ 26.667938] krealloc_less_oob_helper+0xae4/0xc50 [ 26.668288] krealloc_less_oob+0x20/0x38 [ 26.668335] kunit_try_run_case+0x170/0x3f0 [ 26.668381] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.668564] kthread+0x328/0x630 [ 26.668610] ret_from_fork+0x10/0x20 [ 26.668681] [ 26.668699] Allocated by task 170: [ 26.668967] kasan_save_stack+0x3c/0x68 [ 26.669013] kasan_save_track+0x20/0x40 [ 26.669049] kasan_save_alloc_info+0x40/0x58 [ 26.669095] __kasan_krealloc+0x118/0x178 [ 26.669131] krealloc_noprof+0x128/0x360 [ 26.669169] krealloc_less_oob_helper+0x168/0xc50 [ 26.669207] krealloc_less_oob+0x20/0x38 [ 26.669399] kunit_try_run_case+0x170/0x3f0 [ 26.669439] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.669643] kthread+0x328/0x630 [ 26.669794] ret_from_fork+0x10/0x20 [ 26.669828] [ 26.669846] The buggy address belongs to the object at fff00000c1c40c00 [ 26.669846] which belongs to the cache kmalloc-256 of size 256 [ 26.669900] The buggy address is located 33 bytes to the right of [ 26.669900] allocated 201-byte region [fff00000c1c40c00, fff00000c1c40cc9) [ 26.669983] [ 26.670040] The buggy address belongs to the physical page: [ 26.670078] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c40 [ 26.670126] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.670174] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.670222] page_type: f5(slab) [ 26.670258] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.670306] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.671258] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.671388] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.671785] head: 0bfffe0000000001 ffffc1ffc3071001 00000000ffffffff 00000000ffffffff [ 26.671926] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.671965] page dumped because: kasan: bad access detected [ 26.672017] [ 26.672035] Memory state around the buggy address: [ 26.672074] fff00000c1c40b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.672114] fff00000c1c40c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.672154] >fff00000c1c40c80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 26.672242] ^ [ 26.672402] fff00000c1c40d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.672526] fff00000c1c40d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.672581] ================================================================== [ 26.736712] ================================================================== [ 26.736768] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 26.736827] Write of size 1 at addr fff00000c649e0c9 by task kunit_try_catch/174 [ 26.736876] [ 26.736911] CPU: 0 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.736997] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.737023] Hardware name: linux,dummy-virt (DT) [ 26.737066] Call trace: [ 26.737088] show_stack+0x20/0x38 (C) [ 26.738676] dump_stack_lvl+0x8c/0xd0 [ 26.739267] print_report+0x118/0x608 [ 26.739351] kasan_report+0xdc/0x128 [ 26.739397] __asan_report_store1_noabort+0x20/0x30 [ 26.739936] krealloc_less_oob_helper+0xa48/0xc50 [ 26.740464] krealloc_large_less_oob+0x20/0x38 [ 26.741035] kunit_try_run_case+0x170/0x3f0 [ 26.741097] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.741864] kthread+0x328/0x630 [ 26.742339] ret_from_fork+0x10/0x20 [ 26.742714] [ 26.742745] The buggy address belongs to the physical page: [ 26.743086] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10649c [ 26.743350] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.743842] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.744260] page_type: f8(unknown) [ 26.745261] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.745440] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.745744] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 26.746373] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 26.746487] head: 0bfffe0000000002 ffffc1ffc3192701 00000000ffffffff 00000000ffffffff [ 26.746534] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 26.746572] page dumped because: kasan: bad access detected [ 26.746602] [ 26.746619] Memory state around the buggy address: [ 26.747829] fff00000c649df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.747932] fff00000c649e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.747974] >fff00000c649e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 26.748011] ^ [ 26.748188] fff00000c649e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.748479] fff00000c649e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 26.749001] ================================================================== [ 26.674110] ================================================================== [ 26.674270] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 26.674355] Write of size 1 at addr fff00000c1c40ceb by task kunit_try_catch/170 [ 26.674403] [ 26.674430] CPU: 0 UID: 0 PID: 170 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 26.674511] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.674536] Hardware name: linux,dummy-virt (DT) [ 26.674564] Call trace: [ 26.674584] show_stack+0x20/0x38 (C) [ 26.674630] dump_stack_lvl+0x8c/0xd0 [ 26.674675] print_report+0x118/0x608 [ 26.674720] kasan_report+0xdc/0x128 [ 26.674775] __asan_report_store1_noabort+0x20/0x30 [ 26.674823] krealloc_less_oob_helper+0xa58/0xc50 [ 26.675001] krealloc_less_oob+0x20/0x38 [ 26.675045] kunit_try_run_case+0x170/0x3f0 [ 26.675100] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.675291] kthread+0x328/0x630 [ 26.675335] ret_from_fork+0x10/0x20 [ 26.675582] [ 26.675668] Allocated by task 170: [ 26.676089] kasan_save_stack+0x3c/0x68 [ 26.676697] kasan_save_track+0x20/0x40 [ 26.676748] kasan_save_alloc_info+0x40/0x58 [ 26.676784] __kasan_krealloc+0x118/0x178 [ 26.677462] krealloc_noprof+0x128/0x360 [ 26.677517] krealloc_less_oob_helper+0x168/0xc50 [ 26.678048] krealloc_less_oob+0x20/0x38 [ 26.678108] kunit_try_run_case+0x170/0x3f0 [ 26.678145] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.678939] kthread+0x328/0x630 [ 26.679405] ret_from_fork+0x10/0x20 [ 26.679902] [ 26.679942] The buggy address belongs to the object at fff00000c1c40c00 [ 26.679942] which belongs to the cache kmalloc-256 of size 256 [ 26.680008] The buggy address is located 34 bytes to the right of [ 26.680008] allocated 201-byte region [fff00000c1c40c00, fff00000c1c40cc9) [ 26.681040] [ 26.681091] The buggy address belongs to the physical page: [ 26.681121] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c40 [ 26.681264] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.681489] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 26.681863] page_type: f5(slab) [ 26.681932] raw: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.682039] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.682171] head: 0bfffe0000000040 fff00000c0001b40 dead000000000122 0000000000000000 [ 26.682332] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.682380] head: 0bfffe0000000001 ffffc1ffc3071001 00000000ffffffff 00000000ffffffff [ 26.682506] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 26.682656] page dumped because: kasan: bad access detected [ 26.682705] [ 26.682792] Memory state around the buggy address: [ 26.682864] fff00000c1c40b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.682906] fff00000c1c40c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.682965] >fff00000c1c40c80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 26.683016] ^ [ 26.683752] fff00000c1c40d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.683837] fff00000c1c40d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.683885] ==================================================================
[ 21.872562] ================================================================== [ 21.873319] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xec6/0x11d0 [ 21.873887] Write of size 1 at addr ffff888103aaa8da by task kunit_try_catch/187 [ 21.874236] [ 21.874335] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 21.874383] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.874405] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.874428] Call Trace: [ 21.874441] <TASK> [ 21.874460] dump_stack_lvl+0x73/0xb0 [ 21.874501] print_report+0xd1/0x650 [ 21.874525] ? __virt_addr_valid+0x1db/0x2d0 [ 21.874548] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 21.874571] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.874605] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 21.874627] kasan_report+0x141/0x180 [ 21.874648] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 21.874684] __asan_report_store1_noabort+0x1b/0x30 [ 21.874707] krealloc_less_oob_helper+0xec6/0x11d0 [ 21.874731] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 21.874755] ? __kasan_check_write+0x18/0x20 [ 21.874834] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.874862] ? irqentry_exit+0x2a/0x60 [ 21.874881] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 21.874902] ? trace_hardirqs_on+0x37/0xe0 [ 21.874924] ? __pfx_read_tsc+0x10/0x10 [ 21.874949] krealloc_less_oob+0x1c/0x30 [ 21.874969] kunit_try_run_case+0x1a5/0x480 [ 21.874993] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.875040] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.875064] ? __kthread_parkme+0x82/0x180 [ 21.875084] ? preempt_count_sub+0x50/0x80 [ 21.875106] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.875130] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.875152] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.875175] kthread+0x337/0x6f0 [ 21.875194] ? trace_preempt_on+0x20/0xc0 [ 21.875215] ? __pfx_kthread+0x10/0x10 [ 21.875243] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.875266] ? calculate_sigpending+0x7b/0xa0 [ 21.875290] ? __pfx_kthread+0x10/0x10 [ 21.875310] ret_from_fork+0x116/0x1d0 [ 21.875328] ? __pfx_kthread+0x10/0x10 [ 21.875348] ret_from_fork_asm+0x1a/0x30 [ 21.875378] </TASK> [ 21.875389] [ 21.883591] Allocated by task 187: [ 21.883863] kasan_save_stack+0x45/0x70 [ 21.884082] kasan_save_track+0x18/0x40 [ 21.884276] kasan_save_alloc_info+0x3b/0x50 [ 21.884475] __kasan_krealloc+0x190/0x1f0 [ 21.884661] krealloc_noprof+0xf3/0x340 [ 21.884914] krealloc_less_oob_helper+0x1aa/0x11d0 [ 21.885178] krealloc_less_oob+0x1c/0x30 [ 21.885326] kunit_try_run_case+0x1a5/0x480 [ 21.885552] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.885741] kthread+0x337/0x6f0 [ 21.885864] ret_from_fork+0x116/0x1d0 [ 21.885990] ret_from_fork_asm+0x1a/0x30 [ 21.886131] [ 21.886321] The buggy address belongs to the object at ffff888103aaa800 [ 21.886321] which belongs to the cache kmalloc-256 of size 256 [ 21.886900] The buggy address is located 17 bytes to the right of [ 21.886900] allocated 201-byte region [ffff888103aaa800, ffff888103aaa8c9) [ 21.887473] [ 21.887541] The buggy address belongs to the physical page: [ 21.887742] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103aaa [ 21.888345] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.888667] flags: 0x200000000000040(head|node=0|zone=2) [ 21.888983] page_type: f5(slab) [ 21.889183] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.889502] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.889887] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.890240] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.890576] head: 0200000000000001 ffffea00040eaa81 00000000ffffffff 00000000ffffffff [ 21.890951] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.891232] page dumped because: kasan: bad access detected [ 21.891481] [ 21.891571] Memory state around the buggy address: [ 21.891827] ffff888103aaa780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.892069] ffff888103aaa800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.892417] >ffff888103aaa880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 21.892734] ^ [ 21.893191] ffff888103aaa900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.893476] ffff888103aaa980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.893865] ================================================================== [ 21.894411] ================================================================== [ 21.894838] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe90/0x11d0 [ 21.895211] Write of size 1 at addr ffff888103aaa8ea by task kunit_try_catch/187 [ 21.895515] [ 21.895636] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 21.895692] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.895704] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.895725] Call Trace: [ 21.895743] <TASK> [ 21.895767] dump_stack_lvl+0x73/0xb0 [ 21.895869] print_report+0xd1/0x650 [ 21.895890] ? __virt_addr_valid+0x1db/0x2d0 [ 21.895913] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 21.895935] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.895960] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 21.895990] kasan_report+0x141/0x180 [ 21.896011] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 21.896037] __asan_report_store1_noabort+0x1b/0x30 [ 21.896081] krealloc_less_oob_helper+0xe90/0x11d0 [ 21.896107] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 21.896132] ? __kasan_check_write+0x18/0x20 [ 21.896154] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.896178] ? irqentry_exit+0x2a/0x60 [ 21.896198] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 21.896227] ? trace_hardirqs_on+0x37/0xe0 [ 21.896249] ? __pfx_read_tsc+0x10/0x10 [ 21.896273] krealloc_less_oob+0x1c/0x30 [ 21.896302] kunit_try_run_case+0x1a5/0x480 [ 21.896327] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.896350] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.896384] ? __kthread_parkme+0x82/0x180 [ 21.896404] ? preempt_count_sub+0x50/0x80 [ 21.896427] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.896449] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.896471] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.896503] kthread+0x337/0x6f0 [ 21.896521] ? trace_preempt_on+0x20/0xc0 [ 21.896542] ? __pfx_kthread+0x10/0x10 [ 21.896562] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.896595] ? calculate_sigpending+0x7b/0xa0 [ 21.896618] ? __pfx_kthread+0x10/0x10 [ 21.896639] ret_from_fork+0x116/0x1d0 [ 21.896656] ? __pfx_kthread+0x10/0x10 [ 21.896684] ret_from_fork_asm+0x1a/0x30 [ 21.896714] </TASK> [ 21.896725] [ 21.904746] Allocated by task 187: [ 21.905202] kasan_save_stack+0x45/0x70 [ 21.905423] kasan_save_track+0x18/0x40 [ 21.905608] kasan_save_alloc_info+0x3b/0x50 [ 21.905899] __kasan_krealloc+0x190/0x1f0 [ 21.906086] krealloc_noprof+0xf3/0x340 [ 21.906281] krealloc_less_oob_helper+0x1aa/0x11d0 [ 21.906495] krealloc_less_oob+0x1c/0x30 [ 21.906680] kunit_try_run_case+0x1a5/0x480 [ 21.906941] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.907206] kthread+0x337/0x6f0 [ 21.907382] ret_from_fork+0x116/0x1d0 [ 21.907554] ret_from_fork_asm+0x1a/0x30 [ 21.907734] [ 21.907868] The buggy address belongs to the object at ffff888103aaa800 [ 21.907868] which belongs to the cache kmalloc-256 of size 256 [ 21.908309] The buggy address is located 33 bytes to the right of [ 21.908309] allocated 201-byte region [ffff888103aaa800, ffff888103aaa8c9) [ 21.908937] [ 21.909033] The buggy address belongs to the physical page: [ 21.909337] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103aaa [ 21.909672] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.910177] flags: 0x200000000000040(head|node=0|zone=2) [ 21.910509] page_type: f5(slab) [ 21.910699] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.911198] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.911581] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.911994] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.912281] head: 0200000000000001 ffffea00040eaa81 00000000ffffffff 00000000ffffffff [ 21.912650] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.913025] page dumped because: kasan: bad access detected [ 21.913275] [ 21.913375] Memory state around the buggy address: [ 21.913595] ffff888103aaa780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.913875] ffff888103aaa800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.914280] >ffff888103aaa880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 21.914587] ^ [ 21.914981] ffff888103aaa900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.915353] ffff888103aaa980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.915671] ================================================================== [ 21.916130] ================================================================== [ 21.916481] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd47/0x11d0 [ 21.916800] Write of size 1 at addr ffff888103aaa8eb by task kunit_try_catch/187 [ 21.917111] [ 21.917196] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 21.917493] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.917509] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.917531] Call Trace: [ 21.917551] <TASK> [ 21.917582] dump_stack_lvl+0x73/0xb0 [ 21.917611] print_report+0xd1/0x650 [ 21.917633] ? __virt_addr_valid+0x1db/0x2d0 [ 21.917655] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 21.917678] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.917713] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 21.917735] kasan_report+0x141/0x180 [ 21.917755] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 21.917839] __asan_report_store1_noabort+0x1b/0x30 [ 21.917865] krealloc_less_oob_helper+0xd47/0x11d0 [ 21.917889] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 21.917913] ? __kasan_check_write+0x18/0x20 [ 21.917935] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.917959] ? irqentry_exit+0x2a/0x60 [ 21.917978] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 21.917999] ? trace_hardirqs_on+0x37/0xe0 [ 21.918038] ? __pfx_read_tsc+0x10/0x10 [ 21.918063] krealloc_less_oob+0x1c/0x30 [ 21.918083] kunit_try_run_case+0x1a5/0x480 [ 21.918106] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.918130] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.918154] ? __kthread_parkme+0x82/0x180 [ 21.918174] ? preempt_count_sub+0x50/0x80 [ 21.918196] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.918228] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.918250] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.918273] kthread+0x337/0x6f0 [ 21.918291] ? trace_preempt_on+0x20/0xc0 [ 21.918322] ? __pfx_kthread+0x10/0x10 [ 21.918341] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.918364] ? calculate_sigpending+0x7b/0xa0 [ 21.918398] ? __pfx_kthread+0x10/0x10 [ 21.918418] ret_from_fork+0x116/0x1d0 [ 21.918436] ? __pfx_kthread+0x10/0x10 [ 21.918456] ret_from_fork_asm+0x1a/0x30 [ 21.918487] </TASK> [ 21.918498] [ 21.926612] Allocated by task 187: [ 21.926749] kasan_save_stack+0x45/0x70 [ 21.927269] kasan_save_track+0x18/0x40 [ 21.927460] kasan_save_alloc_info+0x3b/0x50 [ 21.927665] __kasan_krealloc+0x190/0x1f0 [ 21.927859] krealloc_noprof+0xf3/0x340 [ 21.928171] krealloc_less_oob_helper+0x1aa/0x11d0 [ 21.928408] krealloc_less_oob+0x1c/0x30 [ 21.928602] kunit_try_run_case+0x1a5/0x480 [ 21.928860] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.929148] kthread+0x337/0x6f0 [ 21.929319] ret_from_fork+0x116/0x1d0 [ 21.929445] ret_from_fork_asm+0x1a/0x30 [ 21.929576] [ 21.929641] The buggy address belongs to the object at ffff888103aaa800 [ 21.929641] which belongs to the cache kmalloc-256 of size 256 [ 21.930267] The buggy address is located 34 bytes to the right of [ 21.930267] allocated 201-byte region [ffff888103aaa800, ffff888103aaa8c9) [ 21.930757] [ 21.930832] The buggy address belongs to the physical page: [ 21.931013] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103aaa [ 21.931488] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.932062] flags: 0x200000000000040(head|node=0|zone=2) [ 21.932342] page_type: f5(slab) [ 21.932517] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.932915] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.933276] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.933522] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.933887] head: 0200000000000001 ffffea00040eaa81 00000000ffffffff 00000000ffffffff [ 21.934261] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.934573] page dumped because: kasan: bad access detected [ 21.934763] [ 21.934942] Memory state around the buggy address: [ 21.935217] ffff888103aaa780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.935495] ffff888103aaa800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.935800] >ffff888103aaa880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 21.936171] ^ [ 21.936381] ffff888103aaa900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.936719] ffff888103aaa980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.937228] ================================================================== [ 21.849632] ================================================================== [ 21.850285] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe23/0x11d0 [ 21.850534] Write of size 1 at addr ffff888103aaa8d0 by task kunit_try_catch/187 [ 21.851035] [ 21.851149] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 21.851198] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.851210] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.851241] Call Trace: [ 21.851260] <TASK> [ 21.851279] dump_stack_lvl+0x73/0xb0 [ 21.851307] print_report+0xd1/0x650 [ 21.851328] ? __virt_addr_valid+0x1db/0x2d0 [ 21.851351] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 21.851374] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.851398] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 21.851420] kasan_report+0x141/0x180 [ 21.851441] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 21.851467] __asan_report_store1_noabort+0x1b/0x30 [ 21.851490] krealloc_less_oob_helper+0xe23/0x11d0 [ 21.851514] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 21.851538] ? __kasan_check_write+0x18/0x20 [ 21.851560] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.851595] ? irqentry_exit+0x2a/0x60 [ 21.851614] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 21.851635] ? trace_hardirqs_on+0x37/0xe0 [ 21.851669] ? __pfx_read_tsc+0x10/0x10 [ 21.851693] krealloc_less_oob+0x1c/0x30 [ 21.851713] kunit_try_run_case+0x1a5/0x480 [ 21.851746] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.851769] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.851843] ? __kthread_parkme+0x82/0x180 [ 21.851867] ? preempt_count_sub+0x50/0x80 [ 21.851891] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.851914] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.851937] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.851959] kthread+0x337/0x6f0 [ 21.851979] ? trace_preempt_on+0x20/0xc0 [ 21.852000] ? __pfx_kthread+0x10/0x10 [ 21.852020] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.852042] ? calculate_sigpending+0x7b/0xa0 [ 21.852066] ? __pfx_kthread+0x10/0x10 [ 21.852086] ret_from_fork+0x116/0x1d0 [ 21.852105] ? __pfx_kthread+0x10/0x10 [ 21.852124] ret_from_fork_asm+0x1a/0x30 [ 21.852155] </TASK> [ 21.852166] [ 21.860173] Allocated by task 187: [ 21.860379] kasan_save_stack+0x45/0x70 [ 21.860584] kasan_save_track+0x18/0x40 [ 21.860713] kasan_save_alloc_info+0x3b/0x50 [ 21.861244] __kasan_krealloc+0x190/0x1f0 [ 21.861457] krealloc_noprof+0xf3/0x340 [ 21.861646] krealloc_less_oob_helper+0x1aa/0x11d0 [ 21.861959] krealloc_less_oob+0x1c/0x30 [ 21.862172] kunit_try_run_case+0x1a5/0x480 [ 21.862378] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.862580] kthread+0x337/0x6f0 [ 21.862704] ret_from_fork+0x116/0x1d0 [ 21.862896] ret_from_fork_asm+0x1a/0x30 [ 21.863138] [ 21.863238] The buggy address belongs to the object at ffff888103aaa800 [ 21.863238] which belongs to the cache kmalloc-256 of size 256 [ 21.863768] The buggy address is located 7 bytes to the right of [ 21.863768] allocated 201-byte region [ffff888103aaa800, ffff888103aaa8c9) [ 21.864362] [ 21.864433] The buggy address belongs to the physical page: [ 21.864604] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103aaa [ 21.864932] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.865331] flags: 0x200000000000040(head|node=0|zone=2) [ 21.865616] page_type: f5(slab) [ 21.866081] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.866504] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.866946] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.867302] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.867623] head: 0200000000000001 ffffea00040eaa81 00000000ffffffff 00000000ffffffff [ 21.868009] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.868345] page dumped because: kasan: bad access detected [ 21.868593] [ 21.868683] Memory state around the buggy address: [ 21.868955] ffff888103aaa780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.869293] ffff888103aaa800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.869585] >ffff888103aaa880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 21.869930] ^ [ 21.870241] ffff888103aaa900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.870538] ffff888103aaa980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.871193] ================================================================== [ 22.001112] ================================================================== [ 22.001717] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe23/0x11d0 [ 22.002586] Write of size 1 at addr ffff888102bbe0d0 by task kunit_try_catch/191 [ 22.002819] [ 22.002909] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 22.002954] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.002966] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.002998] Call Trace: [ 22.003015] <TASK> [ 22.003038] dump_stack_lvl+0x73/0xb0 [ 22.003145] print_report+0xd1/0x650 [ 22.003168] ? __virt_addr_valid+0x1db/0x2d0 [ 22.003191] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 22.003213] ? kasan_addr_to_slab+0x11/0xa0 [ 22.003243] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 22.003265] kasan_report+0x141/0x180 [ 22.003287] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 22.003313] __asan_report_store1_noabort+0x1b/0x30 [ 22.003336] krealloc_less_oob_helper+0xe23/0x11d0 [ 22.003361] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 22.003384] ? finish_task_switch.isra.0+0x153/0x700 [ 22.003405] ? __switch_to+0x47/0xf50 [ 22.003439] ? __schedule+0x10cc/0x2b60 [ 22.003464] ? __pfx_read_tsc+0x10/0x10 [ 22.003489] krealloc_large_less_oob+0x1c/0x30 [ 22.003521] kunit_try_run_case+0x1a5/0x480 [ 22.003545] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.003567] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.003600] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.003624] ? __kthread_parkme+0x82/0x180 [ 22.003643] ? preempt_count_sub+0x50/0x80 [ 22.003675] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.003698] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.003721] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.003744] kthread+0x337/0x6f0 [ 22.003772] ? trace_preempt_on+0x20/0xc0 [ 22.003796] ? __pfx_kthread+0x10/0x10 [ 22.003819] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.003863] ? calculate_sigpending+0x7b/0xa0 [ 22.003886] ? __pfx_kthread+0x10/0x10 [ 22.003907] ret_from_fork+0x116/0x1d0 [ 22.003925] ? __pfx_kthread+0x10/0x10 [ 22.003984] ret_from_fork_asm+0x1a/0x30 [ 22.004038] </TASK> [ 22.004049] [ 22.012393] The buggy address belongs to the physical page: [ 22.012758] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bbc [ 22.013449] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.013768] flags: 0x200000000000040(head|node=0|zone=2) [ 22.014149] page_type: f8(unknown) [ 22.014327] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.014649] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.015062] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.015407] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.015634] head: 0200000000000002 ffffea00040aef01 00000000ffffffff 00000000ffffffff [ 22.015877] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 22.016303] page dumped because: kasan: bad access detected [ 22.016749] [ 22.016897] Memory state around the buggy address: [ 22.017245] ffff888102bbdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.017767] ffff888102bbe000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.018215] >ffff888102bbe080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 22.018442] ^ [ 22.018737] ffff888102bbe100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.019138] ffff888102bbe180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.019469] ================================================================== [ 22.038496] ================================================================== [ 22.039000] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe90/0x11d0 [ 22.039343] Write of size 1 at addr ffff888102bbe0ea by task kunit_try_catch/191 [ 22.039656] [ 22.039766] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 22.039826] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.039838] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.039861] Call Trace: [ 22.039966] <TASK> [ 22.039991] dump_stack_lvl+0x73/0xb0 [ 22.040034] print_report+0xd1/0x650 [ 22.040056] ? __virt_addr_valid+0x1db/0x2d0 [ 22.040092] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 22.040115] ? kasan_addr_to_slab+0x11/0xa0 [ 22.040134] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 22.040158] kasan_report+0x141/0x180 [ 22.040179] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 22.040213] __asan_report_store1_noabort+0x1b/0x30 [ 22.040252] krealloc_less_oob_helper+0xe90/0x11d0 [ 22.040276] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 22.040299] ? finish_task_switch.isra.0+0x153/0x700 [ 22.040321] ? __switch_to+0x47/0xf50 [ 22.040346] ? __schedule+0x10cc/0x2b60 [ 22.040370] ? __pfx_read_tsc+0x10/0x10 [ 22.040404] krealloc_large_less_oob+0x1c/0x30 [ 22.040425] kunit_try_run_case+0x1a5/0x480 [ 22.040450] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.040481] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.040506] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.040530] ? __kthread_parkme+0x82/0x180 [ 22.040551] ? preempt_count_sub+0x50/0x80 [ 22.040574] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.040598] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.040620] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.040643] kthread+0x337/0x6f0 [ 22.040662] ? trace_preempt_on+0x20/0xc0 [ 22.040686] ? __pfx_kthread+0x10/0x10 [ 22.040705] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.040737] ? calculate_sigpending+0x7b/0xa0 [ 22.040761] ? __pfx_kthread+0x10/0x10 [ 22.040781] ret_from_fork+0x116/0x1d0 [ 22.040810] ? __pfx_kthread+0x10/0x10 [ 22.040830] ret_from_fork_asm+0x1a/0x30 [ 22.040862] </TASK> [ 22.040873] [ 22.049414] The buggy address belongs to the physical page: [ 22.049708] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bbc [ 22.050156] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.050396] flags: 0x200000000000040(head|node=0|zone=2) [ 22.050609] page_type: f8(unknown) [ 22.050782] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.051071] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.051522] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.051769] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.052366] head: 0200000000000002 ffffea00040aef01 00000000ffffffff 00000000ffffffff [ 22.052646] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 22.052911] page dumped because: kasan: bad access detected [ 22.053184] [ 22.053298] Memory state around the buggy address: [ 22.053484] ffff888102bbdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.054091] ffff888102bbe000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.054437] >ffff888102bbe080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 22.054733] ^ [ 22.055178] ffff888102bbe100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.055468] ffff888102bbe180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.055747] ================================================================== [ 21.827395] ================================================================== [ 21.827886] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd70/0x11d0 [ 21.828513] Write of size 1 at addr ffff888103aaa8c9 by task kunit_try_catch/187 [ 21.828820] [ 21.828944] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 21.828998] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.829011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.829035] Call Trace: [ 21.829049] <TASK> [ 21.829089] dump_stack_lvl+0x73/0xb0 [ 21.829132] print_report+0xd1/0x650 [ 21.829155] ? __virt_addr_valid+0x1db/0x2d0 [ 21.829180] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 21.829279] ? kasan_complete_mode_report_info+0x2a/0x200 [ 21.829304] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 21.829327] kasan_report+0x141/0x180 [ 21.829347] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 21.829374] __asan_report_store1_noabort+0x1b/0x30 [ 21.829408] krealloc_less_oob_helper+0xd70/0x11d0 [ 21.829432] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 21.829456] ? __kasan_check_write+0x18/0x20 [ 21.829490] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.829515] ? irqentry_exit+0x2a/0x60 [ 21.829534] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 21.829555] ? trace_hardirqs_on+0x37/0xe0 [ 21.829587] ? __pfx_read_tsc+0x10/0x10 [ 21.829612] krealloc_less_oob+0x1c/0x30 [ 21.829633] kunit_try_run_case+0x1a5/0x480 [ 21.829668] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.829692] ? queued_spin_lock_slowpath+0x116/0xb40 [ 21.829716] ? __kthread_parkme+0x82/0x180 [ 21.829736] ? preempt_count_sub+0x50/0x80 [ 21.829759] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.829782] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.829851] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.829874] kthread+0x337/0x6f0 [ 21.829893] ? trace_preempt_on+0x20/0xc0 [ 21.829915] ? __pfx_kthread+0x10/0x10 [ 21.829934] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.829957] ? calculate_sigpending+0x7b/0xa0 [ 21.829981] ? __pfx_kthread+0x10/0x10 [ 21.830002] ret_from_fork+0x116/0x1d0 [ 21.830020] ? __pfx_kthread+0x10/0x10 [ 21.830040] ret_from_fork_asm+0x1a/0x30 [ 21.830070] </TASK> [ 21.830082] [ 21.838526] Allocated by task 187: [ 21.838732] kasan_save_stack+0x45/0x70 [ 21.839002] kasan_save_track+0x18/0x40 [ 21.839197] kasan_save_alloc_info+0x3b/0x50 [ 21.839383] __kasan_krealloc+0x190/0x1f0 [ 21.839583] krealloc_noprof+0xf3/0x340 [ 21.839768] krealloc_less_oob_helper+0x1aa/0x11d0 [ 21.840067] krealloc_less_oob+0x1c/0x30 [ 21.840232] kunit_try_run_case+0x1a5/0x480 [ 21.840463] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.840672] kthread+0x337/0x6f0 [ 21.840851] ret_from_fork+0x116/0x1d0 [ 21.841009] ret_from_fork_asm+0x1a/0x30 [ 21.841413] [ 21.841516] The buggy address belongs to the object at ffff888103aaa800 [ 21.841516] which belongs to the cache kmalloc-256 of size 256 [ 21.842185] The buggy address is located 0 bytes to the right of [ 21.842185] allocated 201-byte region [ffff888103aaa800, ffff888103aaa8c9) [ 21.842617] [ 21.842689] The buggy address belongs to the physical page: [ 21.842901] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103aaa [ 21.843323] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.843574] flags: 0x200000000000040(head|node=0|zone=2) [ 21.843749] page_type: f5(slab) [ 21.843986] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.844375] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.844722] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 21.845107] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.845416] head: 0200000000000001 ffffea00040eaa81 00000000ffffffff 00000000ffffffff [ 21.845760] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 21.846195] page dumped because: kasan: bad access detected [ 21.846419] [ 21.846506] Memory state around the buggy address: [ 21.846686] ffff888103aaa780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.847256] ffff888103aaa800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.847579] >ffff888103aaa880: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 21.847881] ^ [ 21.848294] ffff888103aaa900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.848587] ffff888103aaa980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.849040] ================================================================== [ 22.056300] ================================================================== [ 22.056619] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd47/0x11d0 [ 22.057108] Write of size 1 at addr ffff888102bbe0eb by task kunit_try_catch/191 [ 22.057381] [ 22.057491] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 22.057548] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.057561] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.057582] Call Trace: [ 22.057612] <TASK> [ 22.057631] dump_stack_lvl+0x73/0xb0 [ 22.057659] print_report+0xd1/0x650 [ 22.057682] ? __virt_addr_valid+0x1db/0x2d0 [ 22.057705] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 22.057727] ? kasan_addr_to_slab+0x11/0xa0 [ 22.057747] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 22.057769] kasan_report+0x141/0x180 [ 22.057801] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 22.057828] __asan_report_store1_noabort+0x1b/0x30 [ 22.057949] krealloc_less_oob_helper+0xd47/0x11d0 [ 22.057976] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 22.058001] ? finish_task_switch.isra.0+0x153/0x700 [ 22.058023] ? __switch_to+0x47/0xf50 [ 22.058145] ? __schedule+0x10cc/0x2b60 [ 22.058171] ? __pfx_read_tsc+0x10/0x10 [ 22.058196] krealloc_large_less_oob+0x1c/0x30 [ 22.058218] kunit_try_run_case+0x1a5/0x480 [ 22.058253] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.058275] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.058299] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.058322] ? __kthread_parkme+0x82/0x180 [ 22.058342] ? preempt_count_sub+0x50/0x80 [ 22.058364] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.058429] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.058453] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.058487] kthread+0x337/0x6f0 [ 22.058507] ? trace_preempt_on+0x20/0xc0 [ 22.058530] ? __pfx_kthread+0x10/0x10 [ 22.058550] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.058572] ? calculate_sigpending+0x7b/0xa0 [ 22.058595] ? __pfx_kthread+0x10/0x10 [ 22.058616] ret_from_fork+0x116/0x1d0 [ 22.058634] ? __pfx_kthread+0x10/0x10 [ 22.058654] ret_from_fork_asm+0x1a/0x30 [ 22.058685] </TASK> [ 22.058696] [ 22.067037] The buggy address belongs to the physical page: [ 22.067405] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bbc [ 22.067770] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.068200] flags: 0x200000000000040(head|node=0|zone=2) [ 22.068460] page_type: f8(unknown) [ 22.068618] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.068928] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.069261] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.069488] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.070143] head: 0200000000000002 ffffea00040aef01 00000000ffffffff 00000000ffffffff [ 22.070564] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 22.070896] page dumped because: kasan: bad access detected [ 22.071307] [ 22.071414] Memory state around the buggy address: [ 22.071600] ffff888102bbdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.071996] ffff888102bbe000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.072353] >ffff888102bbe080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 22.072647] ^ [ 22.072961] ffff888102bbe100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.073330] ffff888102bbe180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.073644] ================================================================== [ 22.019904] ================================================================== [ 22.020320] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xec6/0x11d0 [ 22.020674] Write of size 1 at addr ffff888102bbe0da by task kunit_try_catch/191 [ 22.021237] [ 22.021375] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 22.021425] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.021437] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.021460] Call Trace: [ 22.021480] <TASK> [ 22.021501] dump_stack_lvl+0x73/0xb0 [ 22.021543] print_report+0xd1/0x650 [ 22.021566] ? __virt_addr_valid+0x1db/0x2d0 [ 22.021589] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 22.021624] ? kasan_addr_to_slab+0x11/0xa0 [ 22.021643] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 22.021666] kasan_report+0x141/0x180 [ 22.021687] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 22.021713] __asan_report_store1_noabort+0x1b/0x30 [ 22.021737] krealloc_less_oob_helper+0xec6/0x11d0 [ 22.021761] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 22.021834] ? finish_task_switch.isra.0+0x153/0x700 [ 22.021861] ? __switch_to+0x47/0xf50 [ 22.021887] ? __schedule+0x10cc/0x2b60 [ 22.021967] ? __pfx_read_tsc+0x10/0x10 [ 22.021994] krealloc_large_less_oob+0x1c/0x30 [ 22.022027] kunit_try_run_case+0x1a5/0x480 [ 22.022052] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.022085] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.022110] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.022133] ? __kthread_parkme+0x82/0x180 [ 22.022153] ? preempt_count_sub+0x50/0x80 [ 22.022175] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.022198] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.022238] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.022261] kthread+0x337/0x6f0 [ 22.022291] ? trace_preempt_on+0x20/0xc0 [ 22.022314] ? __pfx_kthread+0x10/0x10 [ 22.022334] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.022357] ? calculate_sigpending+0x7b/0xa0 [ 22.022380] ? __pfx_kthread+0x10/0x10 [ 22.022401] ret_from_fork+0x116/0x1d0 [ 22.022419] ? __pfx_kthread+0x10/0x10 [ 22.022439] ret_from_fork_asm+0x1a/0x30 [ 22.022479] </TASK> [ 22.022490] [ 22.031051] The buggy address belongs to the physical page: [ 22.031266] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bbc [ 22.031627] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.031963] flags: 0x200000000000040(head|node=0|zone=2) [ 22.032276] page_type: f8(unknown) [ 22.032481] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.033058] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.033426] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.033670] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.033944] head: 0200000000000002 ffffea00040aef01 00000000ffffffff 00000000ffffffff [ 22.034366] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 22.034801] page dumped because: kasan: bad access detected [ 22.034966] [ 22.035035] Memory state around the buggy address: [ 22.035187] ffff888102bbdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.035880] ffff888102bbe000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.036366] >ffff888102bbe080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 22.036575] ^ [ 22.037270] ffff888102bbe100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.037561] ffff888102bbe180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.038058] ================================================================== [ 21.984467] ================================================================== [ 21.984940] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd70/0x11d0 [ 21.985362] Write of size 1 at addr ffff888102bbe0c9 by task kunit_try_catch/191 [ 21.985677] [ 21.985790] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT(voluntary) [ 21.985854] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.985867] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.985890] Call Trace: [ 21.985916] <TASK> [ 21.985938] dump_stack_lvl+0x73/0xb0 [ 21.985971] print_report+0xd1/0x650 [ 21.985994] ? __virt_addr_valid+0x1db/0x2d0 [ 21.986019] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 21.986052] ? kasan_addr_to_slab+0x11/0xa0 [ 21.986071] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 21.986094] kasan_report+0x141/0x180 [ 21.986115] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 21.986151] __asan_report_store1_noabort+0x1b/0x30 [ 21.986174] krealloc_less_oob_helper+0xd70/0x11d0 [ 21.986198] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 21.986241] ? finish_task_switch.isra.0+0x153/0x700 [ 21.986264] ? __switch_to+0x47/0xf50 [ 21.986291] ? __schedule+0x10cc/0x2b60 [ 21.986316] ? __pfx_read_tsc+0x10/0x10 [ 21.986341] krealloc_large_less_oob+0x1c/0x30 [ 21.986362] kunit_try_run_case+0x1a5/0x480 [ 21.986388] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.986410] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.986443] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.986467] ? __kthread_parkme+0x82/0x180 [ 21.986488] ? preempt_count_sub+0x50/0x80 [ 21.986521] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.986544] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.986567] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.986590] kthread+0x337/0x6f0 [ 21.986609] ? trace_preempt_on+0x20/0xc0 [ 21.986634] ? __pfx_kthread+0x10/0x10 [ 21.986653] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.986676] ? calculate_sigpending+0x7b/0xa0 [ 21.986700] ? __pfx_kthread+0x10/0x10 [ 21.986720] ret_from_fork+0x116/0x1d0 [ 21.986739] ? __pfx_kthread+0x10/0x10 [ 21.986758] ret_from_fork_asm+0x1a/0x30 [ 21.986800] </TASK> [ 21.986813] [ 21.994625] The buggy address belongs to the physical page: [ 21.994816] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bbc [ 21.995180] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.995534] flags: 0x200000000000040(head|node=0|zone=2) [ 21.995711] page_type: f8(unknown) [ 21.996022] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 21.996574] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 21.996937] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 21.997413] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 21.997740] head: 0200000000000002 ffffea00040aef01 00000000ffffffff 00000000ffffffff [ 21.998216] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 21.998555] page dumped because: kasan: bad access detected [ 21.998777] [ 21.998944] Memory state around the buggy address: [ 21.999186] ffff888102bbdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.999435] ffff888102bbe000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.999646] >ffff888102bbe080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 21.999913] ^ [ 22.000295] ffff888102bbe100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.000591] ffff888102bbe180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.000795] ==================================================================