Date
June 26, 2025, 9:10 a.m.
Failure - log-parser-boot - kfence-bug-kfence-invalid-free-in-test_invalid_addr_free
[ 83.727412] ================================================================== [ 83.734749] BUG: KFENCE: invalid free in test_invalid_addr_free+0x1ac/0x238 [ 83.734749] [ 83.743296] Invalid free of 0x(____ptrval____) (in kfence-#207): [ 83.749385] test_invalid_addr_free+0x1ac/0x238 [ 83.753990] kunit_try_run_case+0x170/0x3f0 [ 83.758245] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.763810] kthread+0x328/0x630 [ 83.767099] ret_from_fork+0x10/0x20 [ 83.770734] [ 83.772268] kfence-#207: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=kmalloc-32 [ 83.772268] [ 83.782033] allocated by task 393 on cpu 7 at 83.727377s (0.054655s ago): [ 83.788918] test_alloc+0x29c/0x628 [ 83.792464] test_invalid_addr_free+0xd4/0x238 [ 83.796978] kunit_try_run_case+0x170/0x3f0 [ 83.801229] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.806793] kthread+0x328/0x630 [ 83.810076] ret_from_fork+0x10/0x20 [ 83.813708] [ 83.815246] CPU: 7 UID: 0 PID: 393 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 83.826507] Tainted: [B]=BAD_PAGE, [N]=TEST [ 83.830753] Hardware name: Thundercomm Dragonboard 845c (DT) [ 83.836485] ================================================================== [ 83.947381] ================================================================== [ 83.954715] BUG: KFENCE: invalid free in test_invalid_addr_free+0xec/0x238 [ 83.954715] [ 83.963181] Invalid free of 0x(____ptrval____) (in kfence-#209): [ 83.969275] test_invalid_addr_free+0xec/0x238 [ 83.973796] kunit_try_run_case+0x170/0x3f0 [ 83.978055] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.983622] kthread+0x328/0x630 [ 83.986911] ret_from_fork+0x10/0x20 [ 83.990548] [ 83.992074] kfence-#209: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=test [ 83.992074] [ 84.001314] allocated by task 395 on cpu 4 at 83.947346s (0.053967s ago): [ 84.008204] test_alloc+0x230/0x628 [ 84.011754] test_invalid_addr_free+0xd4/0x238 [ 84.016270] kunit_try_run_case+0x170/0x3f0 [ 84.020522] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 84.026090] kthread+0x328/0x630 [ 84.029375] ret_from_fork+0x10/0x20 [ 84.033010] [ 84.034541] CPU: 4 UID: 0 PID: 395 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 84.045809] Tainted: [B]=BAD_PAGE, [N]=TEST [ 84.050057] Hardware name: Thundercomm Dragonboard 845c (DT) [ 84.055796] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-copy_user_test_oob
[ 78.616990] ================================================================== [ 78.624309] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x4a0/0xec8 [ 78.631448] Read of size 121 at addr ffff00008039fd00 by task kunit_try_catch/371 [ 78.639020] [ 78.640552] CPU: 7 UID: 0 PID: 371 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 78.640581] Tainted: [B]=BAD_PAGE, [N]=TEST [ 78.640589] Hardware name: Thundercomm Dragonboard 845c (DT) [ 78.640598] Call trace: [ 78.640605] show_stack+0x20/0x38 (C) [ 78.640622] dump_stack_lvl+0x8c/0xd0 [ 78.640639] print_report+0x118/0x608 [ 78.640657] kasan_report+0xdc/0x128 [ 78.640675] kasan_check_range+0x100/0x1a8 [ 78.640694] __kasan_check_read+0x20/0x30 [ 78.640709] copy_user_test_oob+0x4a0/0xec8 [ 78.640728] kunit_try_run_case+0x170/0x3f0 [ 78.640745] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 78.640765] kthread+0x328/0x630 [ 78.640778] ret_from_fork+0x10/0x20 [ 78.640795] [ 78.709804] Allocated by task 371: [ 78.713255] kasan_save_stack+0x3c/0x68 [ 78.717161] kasan_save_track+0x20/0x40 [ 78.721065] kasan_save_alloc_info+0x40/0x58 [ 78.725400] __kasan_kmalloc+0xd4/0xd8 [ 78.729216] __kmalloc_noprof+0x198/0x4c8 [ 78.733293] kunit_kmalloc_array+0x34/0x88 [ 78.737455] copy_user_test_oob+0xac/0xec8 [ 78.741618] kunit_try_run_case+0x170/0x3f0 [ 78.745868] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 78.751431] kthread+0x328/0x630 [ 78.754715] ret_from_fork+0x10/0x20 [ 78.758346] [ 78.759875] The buggy address belongs to the object at ffff00008039fd00 [ 78.759875] which belongs to the cache kmalloc-128 of size 128 [ 78.772531] The buggy address is located 0 bytes inside of [ 78.772531] allocated 120-byte region [ffff00008039fd00, ffff00008039fd78) [ 78.785102] [ 78.786625] The buggy address belongs to the physical page: [ 78.792266] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 78.800366] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 78.808117] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 78.815168] page_type: f5(slab) [ 78.818364] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 78.826203] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 78.834043] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 78.841969] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 78.849897] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 78.857822] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 78.865743] page dumped because: kasan: bad access detected [ 78.871384] [ 78.872916] Memory state around the buggy address: [ 78.877769] ffff00008039fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.885086] ffff00008039fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.892391] >ffff00008039fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 78.899704] ^ [ 78.906924] ffff00008039fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.914230] ffff00008039fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.921543] ================================================================== [ 77.680578] ================================================================== [ 77.687898] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x35c/0xec8 [ 77.695045] Write of size 121 at addr ffff00008039fd00 by task kunit_try_catch/371 [ 77.702716] [ 77.704253] CPU: 7 UID: 0 PID: 371 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 77.704285] Tainted: [B]=BAD_PAGE, [N]=TEST [ 77.704293] Hardware name: Thundercomm Dragonboard 845c (DT) [ 77.704307] Call trace: [ 77.704314] show_stack+0x20/0x38 (C) [ 77.704333] dump_stack_lvl+0x8c/0xd0 [ 77.704352] print_report+0x118/0x608 [ 77.704370] kasan_report+0xdc/0x128 [ 77.704389] kasan_check_range+0x100/0x1a8 [ 77.704409] __kasan_check_write+0x20/0x30 [ 77.704425] copy_user_test_oob+0x35c/0xec8 [ 77.704444] kunit_try_run_case+0x170/0x3f0 [ 77.704462] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 77.704482] kthread+0x328/0x630 [ 77.704496] ret_from_fork+0x10/0x20 [ 77.704515] [ 77.773613] Allocated by task 371: [ 77.777067] kasan_save_stack+0x3c/0x68 [ 77.780975] kasan_save_track+0x20/0x40 [ 77.784878] kasan_save_alloc_info+0x40/0x58 [ 77.789213] __kasan_kmalloc+0xd4/0xd8 [ 77.793027] __kmalloc_noprof+0x198/0x4c8 [ 77.797105] kunit_kmalloc_array+0x34/0x88 [ 77.801267] copy_user_test_oob+0xac/0xec8 [ 77.805430] kunit_try_run_case+0x170/0x3f0 [ 77.809680] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 77.815245] kthread+0x328/0x630 [ 77.818527] ret_from_fork+0x10/0x20 [ 77.822158] [ 77.823688] The buggy address belongs to the object at ffff00008039fd00 [ 77.823688] which belongs to the cache kmalloc-128 of size 128 [ 77.836344] The buggy address is located 0 bytes inside of [ 77.836344] allocated 120-byte region [ffff00008039fd00, ffff00008039fd78) [ 77.848914] [ 77.850437] The buggy address belongs to the physical page: [ 77.856080] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 77.864180] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 77.871935] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 77.878988] page_type: f5(slab) [ 77.882185] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 77.890025] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 77.897867] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 77.905791] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 77.913720] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 77.921647] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 77.929569] page dumped because: kasan: bad access detected [ 77.935212] [ 77.936742] Memory state around the buggy address: [ 77.941593] ffff00008039fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.948907] ffff00008039fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.956222] >ffff00008039fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 77.963526] ^ [ 77.970744] ffff00008039fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.978050] ffff00008039fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.985362] ================================================================== [ 77.367631] ================================================================== [ 77.374950] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x728/0xec8 [ 77.382095] Read of size 121 at addr ffff00008039fd00 by task kunit_try_catch/371 [ 77.389680] [ 77.391216] CPU: 0 UID: 0 PID: 371 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 77.391247] Tainted: [B]=BAD_PAGE, [N]=TEST [ 77.391256] Hardware name: Thundercomm Dragonboard 845c (DT) [ 77.391268] Call trace: [ 77.391275] show_stack+0x20/0x38 (C) [ 77.391294] dump_stack_lvl+0x8c/0xd0 [ 77.391315] print_report+0x118/0x608 [ 77.391335] kasan_report+0xdc/0x128 [ 77.391355] kasan_check_range+0x100/0x1a8 [ 77.391376] __kasan_check_read+0x20/0x30 [ 77.391393] copy_user_test_oob+0x728/0xec8 [ 77.391413] kunit_try_run_case+0x170/0x3f0 [ 77.391432] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 77.391455] kthread+0x328/0x630 [ 77.391472] ret_from_fork+0x10/0x20 [ 77.391491] [ 77.460557] Allocated by task 371: [ 77.464017] kasan_save_stack+0x3c/0x68 [ 77.467927] kasan_save_track+0x20/0x40 [ 77.471839] kasan_save_alloc_info+0x40/0x58 [ 77.476184] __kasan_kmalloc+0xd4/0xd8 [ 77.480008] __kmalloc_noprof+0x198/0x4c8 [ 77.484090] kunit_kmalloc_array+0x34/0x88 [ 77.488258] copy_user_test_oob+0xac/0xec8 [ 77.492427] kunit_try_run_case+0x170/0x3f0 [ 77.496682] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 77.502255] kthread+0x328/0x630 [ 77.505548] ret_from_fork+0x10/0x20 [ 77.509185] [ 77.510715] The buggy address belongs to the object at ffff00008039fd00 [ 77.510715] which belongs to the cache kmalloc-128 of size 128 [ 77.523378] The buggy address is located 0 bytes inside of [ 77.523378] allocated 120-byte region [ffff00008039fd00, ffff00008039fd78) [ 77.535957] [ 77.537486] The buggy address belongs to the physical page: [ 77.543134] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 77.551245] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 77.559003] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 77.566058] page_type: f5(slab) [ 77.569263] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 77.577107] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 77.584952] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 77.592882] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 77.600813] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 77.608743] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 77.616671] page dumped because: kasan: bad access detected [ 77.622319] [ 77.623857] Memory state around the buggy address: [ 77.628715] ffff00008039fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.636040] ffff00008039fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.643356] >ffff00008039fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 77.650668] ^ [ 77.657901] ffff00008039fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.665226] ffff00008039fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.672545] ================================================================== [ 78.304816] ================================================================== [ 78.312136] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x434/0xec8 [ 78.319278] Write of size 121 at addr ffff00008039fd00 by task kunit_try_catch/371 [ 78.326947] [ 78.328479] CPU: 7 UID: 0 PID: 371 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 78.328508] Tainted: [B]=BAD_PAGE, [N]=TEST [ 78.328516] Hardware name: Thundercomm Dragonboard 845c (DT) [ 78.328527] Call trace: [ 78.328534] show_stack+0x20/0x38 (C) [ 78.328552] dump_stack_lvl+0x8c/0xd0 [ 78.328570] print_report+0x118/0x608 [ 78.328587] kasan_report+0xdc/0x128 [ 78.328606] kasan_check_range+0x100/0x1a8 [ 78.328626] __kasan_check_write+0x20/0x30 [ 78.328641] copy_user_test_oob+0x434/0xec8 [ 78.328658] kunit_try_run_case+0x170/0x3f0 [ 78.328676] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 78.328697] kthread+0x328/0x630 [ 78.328710] ret_from_fork+0x10/0x20 [ 78.328726] [ 78.397825] Allocated by task 371: [ 78.401278] kasan_save_stack+0x3c/0x68 [ 78.405187] kasan_save_track+0x20/0x40 [ 78.409093] kasan_save_alloc_info+0x40/0x58 [ 78.413429] __kasan_kmalloc+0xd4/0xd8 [ 78.417246] __kmalloc_noprof+0x198/0x4c8 [ 78.421323] kunit_kmalloc_array+0x34/0x88 [ 78.425485] copy_user_test_oob+0xac/0xec8 [ 78.429650] kunit_try_run_case+0x170/0x3f0 [ 78.433900] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 78.439464] kthread+0x328/0x630 [ 78.442750] ret_from_fork+0x10/0x20 [ 78.446381] [ 78.447910] The buggy address belongs to the object at ffff00008039fd00 [ 78.447910] which belongs to the cache kmalloc-128 of size 128 [ 78.460566] The buggy address is located 0 bytes inside of [ 78.460566] allocated 120-byte region [ffff00008039fd00, ffff00008039fd78) [ 78.473135] [ 78.474659] The buggy address belongs to the physical page: [ 78.480300] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 78.488401] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 78.496151] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 78.503202] page_type: f5(slab) [ 78.506399] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 78.514242] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 78.522080] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 78.530007] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 78.537934] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 78.545860] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 78.553783] page dumped because: kasan: bad access detected [ 78.559424] [ 78.560946] Memory state around the buggy address: [ 78.565799] ffff00008039fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.573115] ffff00008039fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.580431] >ffff00008039fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 78.587735] ^ [ 78.594954] ffff00008039fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.602260] ffff00008039fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.609574] ================================================================== [ 77.992867] ================================================================== [ 78.000190] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x3c8/0xec8 [ 78.007332] Read of size 121 at addr ffff00008039fd00 by task kunit_try_catch/371 [ 78.014906] [ 78.016439] CPU: 7 UID: 0 PID: 371 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 78.016469] Tainted: [B]=BAD_PAGE, [N]=TEST [ 78.016477] Hardware name: Thundercomm Dragonboard 845c (DT) [ 78.016490] Call trace: [ 78.016498] show_stack+0x20/0x38 (C) [ 78.016516] dump_stack_lvl+0x8c/0xd0 [ 78.016535] print_report+0x118/0x608 [ 78.016554] kasan_report+0xdc/0x128 [ 78.016571] kasan_check_range+0x100/0x1a8 [ 78.016591] __kasan_check_read+0x20/0x30 [ 78.016606] copy_user_test_oob+0x3c8/0xec8 [ 78.016622] kunit_try_run_case+0x170/0x3f0 [ 78.016641] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 78.016661] kthread+0x328/0x630 [ 78.016675] ret_from_fork+0x10/0x20 [ 78.016692] [ 78.085709] Allocated by task 371: [ 78.089162] kasan_save_stack+0x3c/0x68 [ 78.093066] kasan_save_track+0x20/0x40 [ 78.096971] kasan_save_alloc_info+0x40/0x58 [ 78.101306] __kasan_kmalloc+0xd4/0xd8 [ 78.105122] __kmalloc_noprof+0x198/0x4c8 [ 78.109201] kunit_kmalloc_array+0x34/0x88 [ 78.113363] copy_user_test_oob+0xac/0xec8 [ 78.117525] kunit_try_run_case+0x170/0x3f0 [ 78.121776] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 78.127340] kthread+0x328/0x630 [ 78.130624] ret_from_fork+0x10/0x20 [ 78.134257] [ 78.135786] The buggy address belongs to the object at ffff00008039fd00 [ 78.135786] which belongs to the cache kmalloc-128 of size 128 [ 78.148442] The buggy address is located 0 bytes inside of [ 78.148442] allocated 120-byte region [ffff00008039fd00, ffff00008039fd78) [ 78.161013] [ 78.162536] The buggy address belongs to the physical page: [ 78.168175] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 78.176276] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 78.184029] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 78.191080] page_type: f5(slab) [ 78.194275] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 78.202117] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 78.209957] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 78.217882] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 78.225809] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 78.233734] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 78.241656] page dumped because: kasan: bad access detected [ 78.247299] [ 78.248829] Memory state around the buggy address: [ 78.253682] ffff00008039fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.260995] ffff00008039fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.268300] >ffff00008039fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 78.275604] ^ [ 78.282824] ffff00008039fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.290138] ffff00008039fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.297442] ================================================================== [ 77.048851] ================================================================== [ 77.062340] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x234/0xec8 [ 77.069487] Write of size 121 at addr ffff00008039fd00 by task kunit_try_catch/371 [ 77.077159] [ 77.078697] CPU: 0 UID: 0 PID: 371 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 77.078731] Tainted: [B]=BAD_PAGE, [N]=TEST [ 77.078741] Hardware name: Thundercomm Dragonboard 845c (DT) [ 77.078756] Call trace: [ 77.078767] show_stack+0x20/0x38 (C) [ 77.078787] dump_stack_lvl+0x8c/0xd0 [ 77.078810] print_report+0x118/0x608 [ 77.078831] kasan_report+0xdc/0x128 [ 77.078850] kasan_check_range+0x100/0x1a8 [ 77.078873] __kasan_check_write+0x20/0x30 [ 77.078893] copy_user_test_oob+0x234/0xec8 [ 77.078912] kunit_try_run_case+0x170/0x3f0 [ 77.078935] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 77.078958] kthread+0x328/0x630 [ 77.078975] ret_from_fork+0x10/0x20 [ 77.078994] [ 77.148153] Allocated by task 371: [ 77.151618] kasan_save_stack+0x3c/0x68 [ 77.155528] kasan_save_track+0x20/0x40 [ 77.159438] kasan_save_alloc_info+0x40/0x58 [ 77.163777] __kasan_kmalloc+0xd4/0xd8 [ 77.167599] __kmalloc_noprof+0x198/0x4c8 [ 77.171683] kunit_kmalloc_array+0x34/0x88 [ 77.175849] copy_user_test_oob+0xac/0xec8 [ 77.180015] kunit_try_run_case+0x170/0x3f0 [ 77.184268] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 77.189842] kthread+0x328/0x630 [ 77.193133] ret_from_fork+0x10/0x20 [ 77.196771] [ 77.198302] The buggy address belongs to the object at ffff00008039fd00 [ 77.198302] which belongs to the cache kmalloc-128 of size 128 [ 77.210964] The buggy address is located 0 bytes inside of [ 77.210964] allocated 120-byte region [ffff00008039fd00, ffff00008039fd78) [ 77.223543] [ 77.225081] The buggy address belongs to the physical page: [ 77.230731] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 77.238846] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 77.246604] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 77.253661] page_type: f5(slab) [ 77.256865] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 77.264710] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 77.272555] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 77.280485] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 77.288417] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 77.296348] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 77.304274] page dumped because: kasan: bad access detected [ 77.309925] [ 77.311452] Memory state around the buggy address: [ 77.316313] ffff00008039fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.323630] ffff00008039fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.330947] >ffff00008039fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 77.338268] ^ [ 77.345503] ffff00008039fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.352828] ffff00008039fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.360149] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-copy_to_kernel_nofault
[ 76.404295] ================================================================== [ 76.419357] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x204/0x250 [ 76.426870] Read of size 8 at addr ffff000080dbcb78 by task kunit_try_catch/367 [ 76.434281] [ 76.435824] CPU: 1 UID: 0 PID: 367 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 76.435855] Tainted: [B]=BAD_PAGE, [N]=TEST [ 76.435864] Hardware name: Thundercomm Dragonboard 845c (DT) [ 76.435876] Call trace: [ 76.435884] show_stack+0x20/0x38 (C) [ 76.435905] dump_stack_lvl+0x8c/0xd0 [ 76.435927] print_report+0x118/0x608 [ 76.435947] kasan_report+0xdc/0x128 [ 76.435966] __asan_report_load8_noabort+0x20/0x30 [ 76.435985] copy_to_kernel_nofault+0x204/0x250 [ 76.436006] copy_to_kernel_nofault_oob+0x158/0x418 [ 76.436025] kunit_try_run_case+0x170/0x3f0 [ 76.436047] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 76.436070] kthread+0x328/0x630 [ 76.436087] ret_from_fork+0x10/0x20 [ 76.436107] [ 76.507081] Allocated by task 367: [ 76.510540] kasan_save_stack+0x3c/0x68 [ 76.514450] kasan_save_track+0x20/0x40 [ 76.518361] kasan_save_alloc_info+0x40/0x58 [ 76.522698] __kasan_kmalloc+0xd4/0xd8 [ 76.526522] __kmalloc_cache_noprof+0x16c/0x3c0 [ 76.531136] copy_to_kernel_nofault_oob+0xc8/0x418 [ 76.536009] kunit_try_run_case+0x170/0x3f0 [ 76.540262] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 76.545834] kthread+0x328/0x630 [ 76.549125] ret_from_fork+0x10/0x20 [ 76.552770] [ 76.554302] The buggy address belongs to the object at ffff000080dbcb00 [ 76.554302] which belongs to the cache kmalloc-128 of size 128 [ 76.566968] The buggy address is located 0 bytes to the right of [ 76.566968] allocated 120-byte region [ffff000080dbcb00, ffff000080dbcb78) [ 76.580071] [ 76.581604] The buggy address belongs to the physical page: [ 76.587253] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100dbc [ 76.595364] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 76.603122] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 76.610180] page_type: f5(slab) [ 76.613386] raw: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 76.621231] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 76.629077] head: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 76.637008] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 76.644939] head: 0bfffe0000000001 fffffdffc2036f01 00000000ffffffff 00000000ffffffff [ 76.652878] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 76.660812] page dumped because: kasan: bad access detected [ 76.666462] [ 76.667998] Memory state around the buggy address: [ 76.672861] ffff000080dbca00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.680185] ffff000080dbca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.687501] >ffff000080dbcb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 76.694813] ^ [ 76.702048] ffff000080dbcb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.709371] ffff000080dbcc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.716693] ================================================================== [ 76.724166] ================================================================== [ 76.731493] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x8c/0x250 [ 76.738911] Write of size 8 at addr ffff000080dbcb78 by task kunit_try_catch/367 [ 76.746409] [ 76.747952] CPU: 1 UID: 0 PID: 367 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 76.747984] Tainted: [B]=BAD_PAGE, [N]=TEST [ 76.747993] Hardware name: Thundercomm Dragonboard 845c (DT) [ 76.748005] Call trace: [ 76.748013] show_stack+0x20/0x38 (C) [ 76.748032] dump_stack_lvl+0x8c/0xd0 [ 76.748053] print_report+0x118/0x608 [ 76.748074] kasan_report+0xdc/0x128 [ 76.748093] kasan_check_range+0x100/0x1a8 [ 76.748114] __kasan_check_write+0x20/0x30 [ 76.748131] copy_to_kernel_nofault+0x8c/0x250 [ 76.748151] copy_to_kernel_nofault_oob+0x1bc/0x418 [ 76.748172] kunit_try_run_case+0x170/0x3f0 [ 76.748194] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 76.748216] kthread+0x328/0x630 [ 76.748232] ret_from_fork+0x10/0x20 [ 76.748253] [ 76.822595] Allocated by task 367: [ 76.826056] kasan_save_stack+0x3c/0x68 [ 76.829966] kasan_save_track+0x20/0x40 [ 76.833876] kasan_save_alloc_info+0x40/0x58 [ 76.838214] __kasan_kmalloc+0xd4/0xd8 [ 76.842033] __kmalloc_cache_noprof+0x16c/0x3c0 [ 76.846647] copy_to_kernel_nofault_oob+0xc8/0x418 [ 76.851511] kunit_try_run_case+0x170/0x3f0 [ 76.855766] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 76.861334] kthread+0x328/0x630 [ 76.864623] ret_from_fork+0x10/0x20 [ 76.868262] [ 76.869791] The buggy address belongs to the object at ffff000080dbcb00 [ 76.869791] which belongs to the cache kmalloc-128 of size 128 [ 76.882451] The buggy address is located 0 bytes to the right of [ 76.882451] allocated 120-byte region [ffff000080dbcb00, ffff000080dbcb78) [ 76.895555] [ 76.897093] The buggy address belongs to the physical page: [ 76.902741] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100dbc [ 76.910855] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 76.918620] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 76.925675] page_type: f5(slab) [ 76.928879] raw: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 76.936720] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 76.944565] head: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 76.952504] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 76.960445] head: 0bfffe0000000001 fffffdffc2036f01 00000000ffffffff 00000000ffffffff [ 76.968375] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 76.976310] page dumped because: kasan: bad access detected [ 76.981957] [ 76.983483] Memory state around the buggy address: [ 76.988351] ffff000080dbca00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 76.995676] ffff000080dbca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.002991] >ffff000080dbcb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 77.010311] ^ [ 77.017546] ffff000080dbcb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.024868] ffff000080dbcc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.032188] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-use-after-free-read-in-test_krealloc
[ 110.975612] ================================================================== [ 110.982955] BUG: KFENCE: use-after-free read in test_krealloc+0x51c/0x830 [ 110.982955] [ 110.991348] Use-after-free read at 0x000000005395c4ac (in kfence-#54): [ 110.997969] test_krealloc+0x51c/0x830 [ 111.001793] kunit_try_run_case+0x170/0x3f0 [ 111.006049] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 111.011614] kthread+0x328/0x630 [ 111.014903] ret_from_fork+0x10/0x20 [ 111.018537] [ 111.020072] kfence-#54: 0x000000005395c4ac-0x00000000fcae111b, size=32, cache=kmalloc-32 [ 111.020072] [ 111.029753] allocated by task 423 on cpu 4 at 110.975554s (0.054198s ago): [ 111.036730] test_alloc+0x29c/0x628 [ 111.040278] test_krealloc+0xc0/0x830 [ 111.043997] kunit_try_run_case+0x170/0x3f0 [ 111.048247] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 111.053813] kthread+0x328/0x630 [ 111.057096] ret_from_fork+0x10/0x20 [ 111.060727] [ 111.062251] freed by task 423 on cpu 4 at 110.975571s (0.086677s ago): [ 111.068875] krealloc_noprof+0x148/0x360 [ 111.072858] test_krealloc+0x1dc/0x830 [ 111.076675] kunit_try_run_case+0x170/0x3f0 [ 111.080925] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 111.086492] kthread+0x328/0x630 [ 111.089775] ret_from_fork+0x10/0x20 [ 111.093407] [ 111.094937] CPU: 4 UID: 0 PID: 423 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 111.106198] Tainted: [B]=BAD_PAGE, [N]=TEST [ 111.110444] Hardware name: Thundercomm Dragonboard 845c (DT) [ 111.116177] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-use-after-free-read-in-test_memcache_typesafe_by_rcu
[ 110.724214] ================================================================== [ 110.731576] BUG: KFENCE: use-after-free read in test_memcache_typesafe_by_rcu+0x280/0x560 [ 110.731576] [ 110.741365] Use-after-free read at 0x000000004136a86c (in kfence-#52): [ 110.747980] test_memcache_typesafe_by_rcu+0x280/0x560 [ 110.753197] kunit_try_run_case+0x170/0x3f0 [ 110.757457] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 110.763017] kthread+0x328/0x630 [ 110.766305] ret_from_fork+0x10/0x20 [ 110.769943] [ 110.771470] kfence-#52: 0x000000004136a86c-0x00000000777fe20d, size=32, cache=test [ 110.771470] [ 110.780625] allocated by task 421 on cpu 7 at 110.671157s (0.109466s ago): [ 110.787597] test_alloc+0x230/0x628 [ 110.791147] test_memcache_typesafe_by_rcu+0x15c/0x560 [ 110.796359] kunit_try_run_case+0x170/0x3f0 [ 110.800613] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 110.806181] kthread+0x328/0x630 [ 110.809468] ret_from_fork+0x10/0x20 [ 110.813102] [ 110.814626] freed by task 421 on cpu 7 at 110.671167s (0.143457s ago): [ 110.821242] test_memcache_typesafe_by_rcu+0x1a8/0x560 [ 110.826453] kunit_try_run_case+0x170/0x3f0 [ 110.830707] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 110.836275] kthread+0x328/0x630 [ 110.839561] ret_from_fork+0x10/0x20 [ 110.843196] [ 110.844726] CPU: 4 UID: 0 PID: 421 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 110.855994] Tainted: [B]=BAD_PAGE, [N]=TEST [ 110.860243] Hardware name: Thundercomm Dragonboard 845c (DT) [ 110.865982] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-invalid-read-in-test_invalid_access
[ 90.195665] ================================================================== [ 90.207294] BUG: KFENCE: invalid read in test_invalid_access+0xdc/0x1f0 [ 90.207294] [ 90.215566] Invalid read at 0x(____ptrval____): [ 90.220192] test_invalid_access+0xdc/0x1f0 [ 90.224494] kunit_try_run_case+0x170/0x3f0 [ 90.228772] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 90.234383] kthread+0x328/0x630 [ 90.237690] ret_from_fork+0x10/0x20 [ 90.241368] [ 90.242917] CPU: 7 UID: 0 PID: 417 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 90.254228] Tainted: [B]=BAD_PAGE, [N]=TEST [ 90.258495] Hardware name: Thundercomm Dragonboard 845c (DT) [ 90.264273] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-memory-corruption-in-test_kmalloc_aligned_oob_write
[ 89.819899] ================================================================== [ 89.827263] BUG: KFENCE: memory corruption in test_kmalloc_aligned_oob_write+0x214/0x2c0 [ 89.827263] [ 89.836948] Corrupted memory at 0x(____ptrval____) [ ! . . . . . . . . . . . . . . . ] (in kfence-#31): [ 89.846574] test_kmalloc_aligned_oob_write+0x214/0x2c0 [ 89.851878] kunit_try_run_case+0x170/0x3f0 [ 89.856136] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 89.861695] kthread+0x328/0x630 [ 89.864985] ret_from_fork+0x10/0x20 [ 89.868622] [ 89.870150] kfence-#31: 0x(____ptrval____)-0x(____ptrval____), size=73, cache=kmalloc-96 [ 89.870150] [ 89.879835] allocated by task 411 on cpu 4 at 89.819843s (0.059990s ago): [ 89.886725] test_alloc+0x29c/0x628 [ 89.890276] test_kmalloc_aligned_oob_write+0xbc/0x2c0 [ 89.895488] kunit_try_run_case+0x170/0x3f0 [ 89.899741] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 89.905309] kthread+0x328/0x630 [ 89.908593] ret_from_fork+0x10/0x20 [ 89.912225] [ 89.913750] freed by task 411 on cpu 4 at 89.819855s (0.093893s ago): [ 89.920282] test_kmalloc_aligned_oob_write+0x214/0x2c0 [ 89.925582] kunit_try_run_case+0x170/0x3f0 [ 89.929834] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 89.935391] kthread+0x328/0x630 [ 89.938678] ret_from_fork+0x10/0x20 [ 89.942312] [ 89.943842] CPU: 4 UID: 0 PID: 411 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 89.955112] Tainted: [B]=BAD_PAGE, [N]=TEST [ 89.959361] Hardware name: Thundercomm Dragonboard 845c (DT) [ 89.965099] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-out-of-bounds-read-in-test_kmalloc_aligned_oob_read
[ 89.492014] ================================================================== [ 89.499332] BUG: KFENCE: out-of-bounds read in test_kmalloc_aligned_oob_read+0x238/0x468 [ 89.499332] [ 89.509034] Out-of-bounds read at 0x(____ptrval____) (105B right of kfence-#26): [ 89.516530] test_kmalloc_aligned_oob_read+0x238/0x468 [ 89.521746] kunit_try_run_case+0x170/0x3f0 [ 89.526004] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 89.531574] kthread+0x328/0x630 [ 89.534863] ret_from_fork+0x10/0x20 [ 89.538500] [ 89.540026] kfence-#26: 0x(____ptrval____)-0x(____ptrval____), size=73, cache=kmalloc-96 [ 89.540026] [ 89.549710] allocated by task 409 on cpu 6 at 89.491992s (0.057717s ago): [ 89.556594] test_alloc+0x29c/0x628 [ 89.560145] test_kmalloc_aligned_oob_read+0x100/0x468 [ 89.565356] kunit_try_run_case+0x170/0x3f0 [ 89.569610] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 89.575178] kthread+0x328/0x630 [ 89.578463] ret_from_fork+0x10/0x20 [ 89.582097] [ 89.583627] CPU: 6 UID: 0 PID: 409 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 89.594895] Tainted: [B]=BAD_PAGE, [N]=TEST [ 89.599143] Hardware name: Thundercomm Dragonboard 845c (DT) [ 89.604882] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-memory-corruption-in-test_corruption
[ 85.563423] ================================================================== [ 85.570785] BUG: KFENCE: memory corruption in test_corruption+0x120/0x378 [ 85.570785] [ 85.579166] Corrupted memory at 0x(____ptrval____) [ ! . . . . . . . . . . . . . . . ] (in kfence-#224): [ 85.588875] test_corruption+0x120/0x378 [ 85.592865] kunit_try_run_case+0x170/0x3f0 [ 85.597124] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 85.602683] kthread+0x328/0x630 [ 85.605972] ret_from_fork+0x10/0x20 [ 85.609610] [ 85.611137] kfence-#224: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=test [ 85.611137] [ 85.620377] allocated by task 399 on cpu 4 at 85.563371s (0.057005s ago): [ 85.627254] test_alloc+0x230/0x628 [ 85.630804] test_corruption+0xdc/0x378 [ 85.634702] kunit_try_run_case+0x170/0x3f0 [ 85.638954] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 85.644522] kthread+0x328/0x630 [ 85.647808] ret_from_fork+0x10/0x20 [ 85.651442] [ 85.652966] freed by task 399 on cpu 4 at 85.563381s (0.089583s ago): [ 85.659497] test_corruption+0x120/0x378 [ 85.663485] kunit_try_run_case+0x170/0x3f0 [ 85.667738] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 85.673305] kthread+0x328/0x630 [ 85.676591] ret_from_fork+0x10/0x20 [ 85.680225] [ 85.681755] CPU: 4 UID: 0 PID: 399 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 85.693020] Tainted: [B]=BAD_PAGE, [N]=TEST [ 85.697264] Hardware name: Thundercomm Dragonboard 845c (DT) [ 85.703003] ================================================================== [ 84.167401] ================================================================== [ 84.174749] BUG: KFENCE: memory corruption in test_corruption+0x278/0x378 [ 84.174749] [ 84.183133] Corrupted memory at 0x(____ptrval____) [ ! . . . . . . . . . . . . . . . ] (in kfence-#211): [ 84.192841] test_corruption+0x278/0x378 [ 84.196831] kunit_try_run_case+0x170/0x3f0 [ 84.201090] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 84.206660] kthread+0x328/0x630 [ 84.209950] ret_from_fork+0x10/0x20 [ 84.213588] [ 84.215115] kfence-#211: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=kmalloc-32 [ 84.215115] [ 84.224886] allocated by task 397 on cpu 7 at 84.167356s (0.057530s ago): [ 84.231766] test_alloc+0x29c/0x628 [ 84.235317] test_corruption+0xdc/0x378 [ 84.239215] kunit_try_run_case+0x170/0x3f0 [ 84.243468] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 84.249038] kthread+0x328/0x630 [ 84.252323] ret_from_fork+0x10/0x20 [ 84.255958] [ 84.257483] freed by task 397 on cpu 7 at 84.167366s (0.090115s ago): [ 84.264015] test_corruption+0x278/0x378 [ 84.267999] kunit_try_run_case+0x170/0x3f0 [ 84.272253] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 84.277817] kthread+0x328/0x630 [ 84.281104] ret_from_fork+0x10/0x20 [ 84.284740] [ 84.286269] CPU: 7 UID: 0 PID: 397 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 84.297538] Tainted: [B]=BAD_PAGE, [N]=TEST [ 84.301786] Hardware name: Thundercomm Dragonboard 845c (DT) [ 84.307526] ================================================================== [ 86.019414] ================================================================== [ 86.026775] BUG: KFENCE: memory corruption in test_corruption+0x1d8/0x378 [ 86.026775] [ 86.035154] Corrupted memory at 0x(____ptrval____) [ ! ] (in kfence-#228): [ 86.042150] test_corruption+0x1d8/0x378 [ 86.046140] kunit_try_run_case+0x170/0x3f0 [ 86.050401] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 86.055971] kthread+0x328/0x630 [ 86.059260] ret_from_fork+0x10/0x20 [ 86.062897] [ 86.064424] kfence-#228: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=test [ 86.064424] [ 86.073664] allocated by task 399 on cpu 4 at 86.019360s (0.054303s ago): [ 86.080543] test_alloc+0x230/0x628 [ 86.084093] test_corruption+0x198/0x378 [ 86.088077] kunit_try_run_case+0x170/0x3f0 [ 86.092331] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 86.097899] kthread+0x328/0x630 [ 86.101186] ret_from_fork+0x10/0x20 [ 86.104821] [ 86.106344] freed by task 399 on cpu 4 at 86.019370s (0.086973s ago): [ 86.112876] test_corruption+0x1d8/0x378 [ 86.116861] kunit_try_run_case+0x170/0x3f0 [ 86.121110] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 86.126669] kthread+0x328/0x630 [ 86.129954] ret_from_fork+0x10/0x20 [ 86.133589] [ 86.135120] CPU: 4 UID: 0 PID: 399 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 86.146389] Tainted: [B]=BAD_PAGE, [N]=TEST [ 86.150637] Hardware name: Thundercomm Dragonboard 845c (DT) [ 86.156375] ================================================================== [ 84.899427] ================================================================== [ 84.906786] BUG: KFENCE: memory corruption in test_corruption+0x284/0x378 [ 84.906786] [ 84.915156] Corrupted memory at 0x(____ptrval____) [ ! ] (in kfence-#218): [ 84.922150] test_corruption+0x284/0x378 [ 84.926139] kunit_try_run_case+0x170/0x3f0 [ 84.930392] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 84.935962] kthread+0x328/0x630 [ 84.939252] ret_from_fork+0x10/0x20 [ 84.942889] [ 84.944415] kfence-#218: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=kmalloc-32 [ 84.944415] [ 84.954186] allocated by task 397 on cpu 7 at 84.899372s (0.054812s ago): [ 84.961076] test_alloc+0x29c/0x628 [ 84.964626] test_corruption+0x198/0x378 [ 84.968611] kunit_try_run_case+0x170/0x3f0 [ 84.972863] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 84.978431] kthread+0x328/0x630 [ 84.981717] ret_from_fork+0x10/0x20 [ 84.985352] [ 84.986876] freed by task 397 on cpu 7 at 84.899383s (0.087491s ago): [ 84.993408] test_corruption+0x284/0x378 [ 84.997393] kunit_try_run_case+0x170/0x3f0 [ 85.001646] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 85.007215] kthread+0x328/0x630 [ 85.010501] ret_from_fork+0x10/0x20 [ 85.014135] [ 85.015665] CPU: 7 UID: 0 PID: 397 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 85.026935] Tainted: [B]=BAD_PAGE, [N]=TEST [ 85.031183] Hardware name: Thundercomm Dragonboard 845c (DT) [ 85.036922] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-invalid-free-in-test_double_free
[ 83.259445] ================================================================== [ 83.266788] BUG: KFENCE: invalid free in test_double_free+0x1bc/0x238 [ 83.266788] [ 83.274810] Invalid free of 0x(____ptrval____) (in kfence-#203): [ 83.280905] test_double_free+0x1bc/0x238 [ 83.284980] kunit_try_run_case+0x170/0x3f0 [ 83.289239] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.294798] kthread+0x328/0x630 [ 83.298089] ret_from_fork+0x10/0x20 [ 83.301726] [ 83.303252] kfence-#203: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=kmalloc-32 [ 83.303252] [ 83.313024] allocated by task 389 on cpu 5 at 83.259393s (0.053630s ago): [ 83.319904] test_alloc+0x29c/0x628 [ 83.323454] test_double_free+0xd4/0x238 [ 83.327440] kunit_try_run_case+0x170/0x3f0 [ 83.331692] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.337262] kthread+0x328/0x630 [ 83.340547] ret_from_fork+0x10/0x20 [ 83.344182] [ 83.345706] freed by task 389 on cpu 5 at 83.259402s (0.086303s ago): [ 83.352237] test_double_free+0x1ac/0x238 [ 83.356307] kunit_try_run_case+0x170/0x3f0 [ 83.360561] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.366129] kthread+0x328/0x630 [ 83.369413] ret_from_fork+0x10/0x20 [ 83.373047] [ 83.374578] CPU: 5 UID: 0 PID: 389 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 83.385847] Tainted: [B]=BAD_PAGE, [N]=TEST [ 83.390096] Hardware name: Thundercomm Dragonboard 845c (DT) [ 83.395825] ================================================================== [ 83.507418] ================================================================== [ 83.514756] BUG: KFENCE: invalid free in test_double_free+0x100/0x238 [ 83.514756] [ 83.522777] Invalid free of 0x(____ptrval____) (in kfence-#205): [ 83.528868] test_double_free+0x100/0x238 [ 83.532944] kunit_try_run_case+0x170/0x3f0 [ 83.537203] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.542762] kthread+0x328/0x630 [ 83.546049] ret_from_fork+0x10/0x20 [ 83.549683] [ 83.551211] kfence-#205: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=test [ 83.551211] [ 83.560451] allocated by task 391 on cpu 7 at 83.507369s (0.053081s ago): [ 83.567339] test_alloc+0x230/0x628 [ 83.570889] test_double_free+0xd4/0x238 [ 83.574874] kunit_try_run_case+0x170/0x3f0 [ 83.579127] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.584686] kthread+0x328/0x630 [ 83.587971] ret_from_fork+0x10/0x20 [ 83.591606] [ 83.593129] freed by task 391 on cpu 7 at 83.507378s (0.085749s ago): [ 83.599662] test_double_free+0xf0/0x238 [ 83.603646] kunit_try_run_case+0x170/0x3f0 [ 83.607899] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 83.613468] kthread+0x328/0x630 [ 83.616753] ret_from_fork+0x10/0x20 [ 83.620384] [ 83.621914] CPU: 7 UID: 0 PID: 391 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 83.633180] Tainted: [B]=BAD_PAGE, [N]=TEST [ 83.637426] Hardware name: Thundercomm Dragonboard 845c (DT) [ 83.643164] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-use-after-free-read-in-test_use_after_free_read
[ 82.799399] ================================================================== [ 82.806736] BUG: KFENCE: use-after-free read in test_use_after_free_read+0x114/0x248 [ 82.806736] [ 82.816079] Use-after-free read at 0x(____ptrval____) (in kfence-#199): [ 82.822781] test_use_after_free_read+0x114/0x248 [ 82.827562] kunit_try_run_case+0x170/0x3f0 [ 82.831822] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 82.837392] kthread+0x328/0x630 [ 82.840681] ret_from_fork+0x10/0x20 [ 82.844318] [ 82.845844] kfence-#199: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=test [ 82.845844] [ 82.855083] allocated by task 383 on cpu 5 at 82.799365s (0.055717s ago): [ 82.861976] test_alloc+0x230/0x628 [ 82.865525] test_use_after_free_read+0xd0/0x248 [ 82.870215] kunit_try_run_case+0x170/0x3f0 [ 82.874469] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 82.880037] kthread+0x328/0x630 [ 82.883322] ret_from_fork+0x10/0x20 [ 82.886956] [ 82.888481] freed by task 383 on cpu 5 at 82.799374s (0.089105s ago): [ 82.895012] test_use_after_free_read+0xf0/0x248 [ 82.899702] kunit_try_run_case+0x170/0x3f0 [ 82.903956] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 82.909525] kthread+0x328/0x630 [ 82.912810] ret_from_fork+0x10/0x20 [ 82.916445] [ 82.917976] CPU: 5 UID: 0 PID: 383 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 82.929244] Tainted: [B]=BAD_PAGE, [N]=TEST [ 82.933493] Hardware name: Thundercomm Dragonboard 845c (DT) [ 82.939232] ================================================================== [ 82.547431] ================================================================== [ 82.554777] BUG: KFENCE: use-after-free read in test_use_after_free_read+0x114/0x248 [ 82.554777] [ 82.564126] Use-after-free read at 0x(____ptrval____) (in kfence-#197): [ 82.570825] test_use_after_free_read+0x114/0x248 [ 82.575607] kunit_try_run_case+0x170/0x3f0 [ 82.579866] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 82.585426] kthread+0x328/0x630 [ 82.588715] ret_from_fork+0x10/0x20 [ 82.592353] [ 82.593878] kfence-#197: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=kmalloc-32 [ 82.593878] [ 82.603649] allocated by task 381 on cpu 7 at 82.547392s (0.056255s ago): [ 82.610533] test_alloc+0x29c/0x628 [ 82.614082] test_use_after_free_read+0xd0/0x248 [ 82.618772] kunit_try_run_case+0x170/0x3f0 [ 82.623025] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 82.628593] kthread+0x328/0x630 [ 82.631879] ret_from_fork+0x10/0x20 [ 82.635514] [ 82.637038] freed by task 381 on cpu 7 at 82.547402s (0.089635s ago): [ 82.643570] test_use_after_free_read+0x1c0/0x248 [ 82.648346] kunit_try_run_case+0x170/0x3f0 [ 82.652599] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 82.658169] kthread+0x328/0x630 [ 82.661454] ret_from_fork+0x10/0x20 [ 82.665088] [ 82.666618] CPU: 7 UID: 0 PID: 381 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 82.677888] Tainted: [B]=BAD_PAGE, [N]=TEST [ 82.682136] Hardware name: Thundercomm Dragonboard 845c (DT) [ 82.687875] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-out-of-bounds-write-in-test_out_of_bounds_write
[ 82.327425] ================================================================== [ 82.334787] BUG: KFENCE: out-of-bounds write in test_out_of_bounds_write+0x100/0x240 [ 82.334787] [ 82.344137] Out-of-bounds write at 0x(____ptrval____) (1B left of kfence-#195): [ 82.351548] test_out_of_bounds_write+0x100/0x240 [ 82.356330] kunit_try_run_case+0x170/0x3f0 [ 82.360591] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 82.366151] kthread+0x328/0x630 [ 82.369441] ret_from_fork+0x10/0x20 [ 82.373078] [ 82.374604] kfence-#195: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=test [ 82.374604] [ 82.383844] allocated by task 379 on cpu 4 at 82.327399s (0.056444s ago): [ 82.390739] test_alloc+0x230/0x628 [ 82.394289] test_out_of_bounds_write+0xc8/0x240 [ 82.398979] kunit_try_run_case+0x170/0x3f0 [ 82.403234] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 82.408801] kthread+0x328/0x630 [ 82.412087] ret_from_fork+0x10/0x20 [ 82.415724] [ 82.417253] CPU: 4 UID: 0 PID: 379 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 82.428523] Tainted: [B]=BAD_PAGE, [N]=TEST [ 82.432771] Hardware name: Thundercomm Dragonboard 845c (DT) [ 82.438499] ================================================================== [ 81.899509] ================================================================== [ 81.906872] BUG: KFENCE: out-of-bounds write in test_out_of_bounds_write+0x100/0x240 [ 81.906872] [ 81.916222] Out-of-bounds write at 0x(____ptrval____) (1B left of kfence-#191): [ 81.923633] test_out_of_bounds_write+0x100/0x240 [ 81.928416] kunit_try_run_case+0x170/0x3f0 [ 81.932675] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 81.938247] kthread+0x328/0x630 [ 81.941535] ret_from_fork+0x10/0x20 [ 81.945173] [ 81.946699] kfence-#191: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=kmalloc-32 [ 81.946699] [ 81.956471] allocated by task 377 on cpu 7 at 81.899484s (0.056986s ago): [ 81.963365] test_alloc+0x29c/0x628 [ 81.966916] test_out_of_bounds_write+0xc8/0x240 [ 81.971607] kunit_try_run_case+0x170/0x3f0 [ 81.975860] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 81.981429] kthread+0x328/0x630 [ 81.984714] ret_from_fork+0x10/0x20 [ 81.988349] [ 81.989878] CPU: 7 UID: 0 PID: 377 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 82.001147] Tainted: [B]=BAD_PAGE, [N]=TEST [ 82.005387] Hardware name: Thundercomm Dragonboard 845c (DT) [ 82.011116] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-out-of-bounds-read-in-test_out_of_bounds_read
[ 81.263463] ================================================================== [ 81.270821] BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0x1c8/0x3e0 [ 81.270821] [ 81.279997] Out-of-bounds read at 0x(____ptrval____) (32B right of kfence-#185): [ 81.287494] test_out_of_bounds_read+0x1c8/0x3e0 [ 81.292189] kunit_try_run_case+0x170/0x3f0 [ 81.296447] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 81.302019] kthread+0x328/0x630 [ 81.305308] ret_from_fork+0x10/0x20 [ 81.308945] [ 81.310470] kfence-#185: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=test [ 81.310470] [ 81.319710] allocated by task 375 on cpu 7 at 81.263440s (0.056269s ago): [ 81.326593] test_alloc+0x230/0x628 [ 81.330143] test_out_of_bounds_read+0x198/0x3e0 [ 81.334834] kunit_try_run_case+0x170/0x3f0 [ 81.339088] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 81.344657] kthread+0x328/0x630 [ 81.347943] ret_from_fork+0x10/0x20 [ 81.351577] [ 81.353107] CPU: 7 UID: 0 PID: 375 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 81.364377] Tainted: [B]=BAD_PAGE, [N]=TEST [ 81.368627] Hardware name: Thundercomm Dragonboard 845c (DT) [ 81.374364] ================================================================== [ 79.875424] ================================================================== [ 79.882784] BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0x114/0x3e0 [ 79.882784] [ 79.891960] Out-of-bounds read at 0x(____ptrval____) (1B left of kfence-#172): [ 79.899285] test_out_of_bounds_read+0x114/0x3e0 [ 79.903980] kunit_try_run_case+0x170/0x3f0 [ 79.908239] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 79.913811] kthread+0x328/0x630 [ 79.917099] ret_from_fork+0x10/0x20 [ 79.920738] [ 79.922265] kfence-#172: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=kmalloc-32 [ 79.922265] [ 79.932037] allocated by task 373 on cpu 6 at 79.875399s (0.056636s ago): [ 79.938932] test_alloc+0x29c/0x628 [ 79.942481] test_out_of_bounds_read+0xdc/0x3e0 [ 79.947084] kunit_try_run_case+0x170/0x3f0 [ 79.951327] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 79.956885] kthread+0x328/0x630 [ 79.960170] ret_from_fork+0x10/0x20 [ 79.963806] [ 79.965336] CPU: 6 UID: 0 PID: 373 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 79.976606] Tainted: [B]=BAD_PAGE, [N]=TEST [ 79.980854] Hardware name: Thundercomm Dragonboard 845c (DT) [ 79.986593] ================================================================== [ 80.731382] ================================================================== [ 80.738734] BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0x114/0x3e0 [ 80.738734] [ 80.747910] Out-of-bounds read at 0x(____ptrval____) (1B left of kfence-#180): [ 80.755235] test_out_of_bounds_read+0x114/0x3e0 [ 80.759933] kunit_try_run_case+0x170/0x3f0 [ 80.764182] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 80.769741] kthread+0x328/0x630 [ 80.773029] ret_from_fork+0x10/0x20 [ 80.776667] [ 80.778195] kfence-#180: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=test [ 80.778195] [ 80.787433] allocated by task 375 on cpu 7 at 80.731358s (0.056074s ago): [ 80.794328] test_alloc+0x230/0x628 [ 80.797878] test_out_of_bounds_read+0xdc/0x3e0 [ 80.802482] kunit_try_run_case+0x170/0x3f0 [ 80.806736] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 80.812304] kthread+0x328/0x630 [ 80.815590] ret_from_fork+0x10/0x20 [ 80.819226] [ 80.820756] CPU: 7 UID: 0 PID: 375 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 80.832024] Tainted: [B]=BAD_PAGE, [N]=TEST [ 80.836274] Hardware name: Thundercomm Dragonboard 845c (DT) [ 80.842014] ================================================================== [ 80.407420] ================================================================== [ 80.414782] BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0x1c8/0x3e0 [ 80.414782] [ 80.423958] Out-of-bounds read at 0x(____ptrval____) (32B right of kfence-#177): [ 80.431455] test_out_of_bounds_read+0x1c8/0x3e0 [ 80.436150] kunit_try_run_case+0x170/0x3f0 [ 80.440407] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 80.445977] kthread+0x328/0x630 [ 80.449265] ret_from_fork+0x10/0x20 [ 80.452903] [ 80.454429] kfence-#177: 0x(____ptrval____)-0x(____ptrval____), size=32, cache=kmalloc-32 [ 80.454429] [ 80.464201] allocated by task 373 on cpu 6 at 80.407394s (0.056806s ago): [ 80.471087] test_alloc+0x29c/0x628 [ 80.474637] test_out_of_bounds_read+0x198/0x3e0 [ 80.479327] kunit_try_run_case+0x170/0x3f0 [ 80.483581] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 80.489149] kthread+0x328/0x630 [ 80.492435] ret_from_fork+0x10/0x20 [ 80.496070] [ 80.497599] CPU: 6 UID: 0 PID: 373 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 80.508869] Tainted: [B]=BAD_PAGE, [N]=TEST [ 80.513118] Hardware name: Thundercomm Dragonboard 845c (DT) [ 80.518857] ==================================================================
Failure - log-parser-boot - kfence-bug-kfence-memory-corruption-in-kmalloc_track_caller_oob_right
[ 31.727398] ================================================================== [ 31.751106] BUG: KFENCE: memory corruption in kmalloc_track_caller_oob_right+0x224/0x488 [ 31.751106] [ 31.760790] Corrupted memory at 0x(____ptrval____) [ ! . . . . . . . ] (in kfence-#100): [ 31.769053] kmalloc_track_caller_oob_right+0x224/0x488 [ 31.774356] kunit_try_run_case+0x170/0x3f0 [ 31.778604] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.784172] kthread+0x328/0x630 [ 31.787455] ret_from_fork+0x10/0x20 [ 31.791087] [ 31.792619] kfence-#100: 0x(____ptrval____)-0x(____ptrval____), size=120, cache=kmalloc-128 [ 31.792619] [ 31.802563] allocated by task 228 on cpu 7 at 31.727218s (0.075343s ago): [ 31.809443] kmalloc_track_caller_oob_right+0x184/0x488 [ 31.814747] kunit_try_run_case+0x170/0x3f0 [ 31.818995] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.824563] kthread+0x328/0x630 [ 31.827842] ret_from_fork+0x10/0x20 [ 31.831474] [ 31.833003] freed by task 228 on cpu 7 at 31.727375s (0.105626s ago): [ 31.839537] kmalloc_track_caller_oob_right+0x224/0x488 [ 31.844837] kunit_try_run_case+0x170/0x3f0 [ 31.849085] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.854649] kthread+0x328/0x630 [ 31.857927] ret_from_fork+0x10/0x20 [ 31.861566] [ 31.863090] CPU: 7 UID: 0 PID: 228 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 31.874350] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.878592] Hardware name: Thundercomm Dragonboard 845c (DT) [ 31.884326] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-__nvmem_cell_readpart
[ 213.907156] ================================================================== [ 213.907163] BUG: KASAN: slab-out-of-bounds in __nvmem_cell_read.part.0+0x518/0x650 [ 213.907178] Read of size 1 at addr ffff000097d0a8a4 by task kworker/u32:1/14 [ 213.907184] [ 213.907192] CPU: 7 UID: 0 PID: 14 Comm: kworker/u32:1 Tainted: G B D W N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 213.907204] Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN, [N]=TEST [ 213.907207] Hardware name: Thundercomm Dragonboard 845c (DT) [ 213.907213] Workqueue: events_unbound deferred_probe_work_func [ 213.907225] Call trace: [ 213.907229] show_stack+0x20/0x38 (C) [ 213.907237] dump_stack_lvl+0x8c/0xd0 [ 213.907245] print_report+0x118/0x608 [ 213.907253] kasan_report+0xdc/0x128 [ 213.907258] __asan_report_load1_noabort+0x20/0x30 [ 213.907263] __nvmem_cell_read.part.0+0x518/0x650 [ 213.907268] nvmem_cell_read+0x18c/0x248 [ 213.907273] qusb2_phy_init+0x6a4/0x1748 [ 213.907281] phy_init+0x120/0x2f8 [ 213.907288] dwc3_core_init+0x298/0x5290 [ 213.907295] dwc3_core_probe+0x1d1c/0x4bf8 [ 213.907300] dwc3_probe+0xd4/0x158 [ 213.907305] platform_probe+0xcc/0x198 [ 213.907311] really_probe+0x188/0x7f0 [ 213.907315] __driver_probe_device+0x164/0x378 [ 213.907320] driver_probe_device+0x64/0x180 [ 213.907324] __device_attach_driver+0x174/0x280 [ 213.907329] bus_for_each_drv+0x118/0x1b0 [ 213.907338] __device_attach+0x174/0x378 [ 213.907342] device_initial_probe+0x1c/0x30 [ 213.907346] bus_probe_device+0x12c/0x170 [ 213.907352] deferred_probe_work_func+0x140/0x208 [ 213.907356] process_one_work+0x530/0xf98 [ 213.907363] worker_thread+0x618/0xf38 [ 213.907367] kthread+0x328/0x630 [ 213.907372] ret_from_fork+0x10/0x20 [ 213.907379] [ 213.907381] Allocated by task 14: [ 213.907385] kasan_save_stack+0x3c/0x68 [ 213.907391] kasan_save_track+0x20/0x40 [ 213.907395] kasan_save_alloc_info+0x40/0x58 [ 213.907399] __kasan_kmalloc+0xd4/0xd8 [ 213.907403] __kmalloc_noprof+0x198/0x4c8 [ 213.907408] nvmem_cell_read+0xb8/0x248 [ 213.907412] qusb2_phy_init+0x6a4/0x1748 [ 213.907417] phy_init+0x120/0x2f8 [ 213.907422] dwc3_core_init+0x298/0x5290 [ 213.907425] dwc3_core_probe+0x1d1c/0x4bf8 [ 213.907429] dwc3_probe+0xd4/0x158 [ 213.907433] platform_probe+0xcc/0x198 [ 213.907437] really_probe+0x188/0x7f0 [ 213.907440] __driver_probe_device+0x164/0x378 [ 213.907444] driver_probe_device+0x64/0x180 [ 213.907447] __device_attach_driver+0x174/0x280 [ 213.907451] bus_for_each_drv+0x118/0x1b0 [ 213.907456] __device_attach+0x174/0x378 [ 213.907459] device_initial_probe+0x1c/0x30 [ 213.907463] bus_probe_device+0x12c/0x170 [ 213.907468] deferred_probe_work_func+0x140/0x208 [ 213.907471] process_one_work+0x530/0xf98 [ 213.907476] worker_thread+0x618/0xf38 [ 213.907479] kthread+0x328/0x630 [ 213.907482] ret_from_fork+0x10/0x20 [ 213.907487] [ 213.907488] The buggy address belongs to the object at ffff000097d0a8a0 [ 213.907488] which belongs to the cache kmalloc-8 of size 8 [ 213.907493] The buggy address is located 0 bytes to the right of [ 213.907493] allocated 4-byte region [ffff000097d0a8a0, ffff000097d0a8a4) [ 213.907498] [ 213.907500] The buggy address belongs to the physical page: [ 213.907504] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117d0a [ 213.907509] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 213.907516] page_type: f5(slab) [ 213.907522] raw: 0bfffe0000000000 ffff000080002500 dead000000000122 0000000000000000 [ 213.907527] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 213.907529] page dumped because: kasan: bad access detected [ 213.907532] [ 213.907534] Memory state around the buggy address: [ 213.907537] ffff000097d0a780: 00 fc fc fc 00 fc fc fc 04 fc fc fc 04 fc fc fc [ 213.907541] ffff000097d0a800: 00 fc fc fc 00 fc fc fc fa fc fc fc fa fc fc fc [ 213.907544] >ffff000097d0a880: 00 fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc [ 213.907546] ^ [ 213.907549] ffff000097d0a900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 213.907552] ffff000097d0a980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 213.907555] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-strncpy_from_user
[ 78.929293] ================================================================== [ 78.936627] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 78.943600] Write of size 121 at addr ffff00008039fd00 by task kunit_try_catch/371 [ 78.951262] [ 78.952798] CPU: 6 UID: 0 PID: 371 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 78.952830] Tainted: [B]=BAD_PAGE, [N]=TEST [ 78.952839] Hardware name: Thundercomm Dragonboard 845c (DT) [ 78.952851] Call trace: [ 78.952858] show_stack+0x20/0x38 (C) [ 78.952877] dump_stack_lvl+0x8c/0xd0 [ 78.952897] print_report+0x118/0x608 [ 78.952915] kasan_report+0xdc/0x128 [ 78.952935] kasan_check_range+0x100/0x1a8 [ 78.952956] __kasan_check_write+0x20/0x30 [ 78.952971] strncpy_from_user+0x3c/0x2a0 [ 78.952988] copy_user_test_oob+0x5c0/0xec8 [ 78.953005] kunit_try_run_case+0x170/0x3f0 [ 78.953023] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 78.953043] kthread+0x328/0x630 [ 78.953056] ret_from_fork+0x10/0x20 [ 78.953073] [ 79.026246] Allocated by task 371: [ 79.029699] kasan_save_stack+0x3c/0x68 [ 79.033607] kasan_save_track+0x20/0x40 [ 79.037512] kasan_save_alloc_info+0x40/0x58 [ 79.041847] __kasan_kmalloc+0xd4/0xd8 [ 79.045664] __kmalloc_noprof+0x198/0x4c8 [ 79.049741] kunit_kmalloc_array+0x34/0x88 [ 79.053904] copy_user_test_oob+0xac/0xec8 [ 79.058066] kunit_try_run_case+0x170/0x3f0 [ 79.062316] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 79.067877] kthread+0x328/0x630 [ 79.071163] ret_from_fork+0x10/0x20 [ 79.074793] [ 79.076324] The buggy address belongs to the object at ffff00008039fd00 [ 79.076324] which belongs to the cache kmalloc-128 of size 128 [ 79.088979] The buggy address is located 0 bytes inside of [ 79.088979] allocated 120-byte region [ffff00008039fd00, ffff00008039fd78) [ 79.101549] [ 79.103074] The buggy address belongs to the physical page: [ 79.108712] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 79.116813] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 79.124564] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 79.131611] page_type: f5(slab) [ 79.134812] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 79.142655] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 79.150495] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 79.158421] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 79.166347] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 79.174272] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 79.182194] page dumped because: kasan: bad access detected [ 79.187834] [ 79.189357] Memory state around the buggy address: [ 79.194208] ffff00008039fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.201515] ffff00008039fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.208821] >ffff00008039fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 79.216136] ^ [ 79.223354] ffff00008039fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.230659] ffff00008039fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.237974] ================================================================== [ 79.245580] ================================================================== [ 79.252913] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 79.259973] Write of size 1 at addr ffff00008039fd78 by task kunit_try_catch/371 [ 79.267474] [ 79.269007] CPU: 1 UID: 0 PID: 371 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 79.269038] Tainted: [B]=BAD_PAGE, [N]=TEST [ 79.269047] Hardware name: Thundercomm Dragonboard 845c (DT) [ 79.269058] Call trace: [ 79.269065] show_stack+0x20/0x38 (C) [ 79.269083] dump_stack_lvl+0x8c/0xd0 [ 79.269102] print_report+0x118/0x608 [ 79.269124] kasan_report+0xdc/0x128 [ 79.269145] __asan_report_store1_noabort+0x20/0x30 [ 79.269164] strncpy_from_user+0x270/0x2a0 [ 79.269183] copy_user_test_oob+0x5c0/0xec8 [ 79.269202] kunit_try_run_case+0x170/0x3f0 [ 79.269223] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 79.269244] kthread+0x328/0x630 [ 79.269260] ret_from_fork+0x10/0x20 [ 79.269278] [ 79.339217] Allocated by task 371: [ 79.342684] kasan_save_stack+0x3c/0x68 [ 79.346590] kasan_save_track+0x20/0x40 [ 79.350498] kasan_save_alloc_info+0x40/0x58 [ 79.354845] __kasan_kmalloc+0xd4/0xd8 [ 79.358662] __kmalloc_noprof+0x198/0x4c8 [ 79.362740] kunit_kmalloc_array+0x34/0x88 [ 79.366904] copy_user_test_oob+0xac/0xec8 [ 79.371068] kunit_try_run_case+0x170/0x3f0 [ 79.375329] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 79.380899] kthread+0x328/0x630 [ 79.384185] ret_from_fork+0x10/0x20 [ 79.387830] [ 79.389359] The buggy address belongs to the object at ffff00008039fd00 [ 79.389359] which belongs to the cache kmalloc-128 of size 128 [ 79.402021] The buggy address is located 0 bytes to the right of [ 79.402021] allocated 120-byte region [ffff00008039fd00, ffff00008039fd78) [ 79.415128] [ 79.416660] The buggy address belongs to the physical page: [ 79.422305] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 79.430410] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 79.438168] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 79.445225] page_type: f5(slab) [ 79.448425] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 79.456275] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 79.464124] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 79.472059] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 79.479993] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 79.487927] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 79.495857] page dumped because: kasan: bad access detected [ 79.501503] [ 79.503034] Memory state around the buggy address: [ 79.507892] ffff00008039fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.515209] ffff00008039fc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.522525] >ffff00008039fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 79.529839] ^ [ 79.537066] ffff00008039fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.544383] ffff00008039fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.551698] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-vmalloc-out-of-bounds-in-vmalloc_oob
[ 76.149071] ================================================================== [ 76.156393] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x51c/0x5d0 [ 76.163184] Read of size 1 at addr ffff80008029d7f8 by task kunit_try_catch/355 [ 76.170595] [ 76.172136] CPU: 0 UID: 0 PID: 355 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 76.172166] Tainted: [B]=BAD_PAGE, [N]=TEST [ 76.172174] Hardware name: Thundercomm Dragonboard 845c (DT) [ 76.172186] Call trace: [ 76.172193] show_stack+0x20/0x38 (C) [ 76.172211] dump_stack_lvl+0x8c/0xd0 [ 76.172230] print_report+0x310/0x608 [ 76.172250] kasan_report+0xdc/0x128 [ 76.172269] __asan_report_load1_noabort+0x20/0x30 [ 76.172289] vmalloc_oob+0x51c/0x5d0 [ 76.172305] kunit_try_run_case+0x170/0x3f0 [ 76.172325] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 76.172348] kthread+0x328/0x630 [ 76.172364] ret_from_fork+0x10/0x20 [ 76.172381] [ 76.237470] The buggy address belongs to the virtual mapping at [ 76.237470] [ffff80008029d000, ffff80008029f000) created by: [ 76.237470] vmalloc_oob+0x98/0x5d0 [ 76.252770] [ 76.254305] The buggy address belongs to the physical page: [ 76.259950] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116f1f [ 76.268061] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 76.274682] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 76.282526] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 76.290365] page dumped because: kasan: bad access detected [ 76.296011] [ 76.297539] Memory state around the buggy address: [ 76.302401] ffff80008029d680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.309723] ffff80008029d700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.317046] >ffff80008029d780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8 [ 76.324367] ^ [ 76.331595] ffff80008029d800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 76.338917] ffff80008029d880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 76.346235] ================================================================== [ 75.936637] ================================================================== [ 75.951974] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x578/0x5d0 [ 75.958772] Read of size 1 at addr ffff80008029d7f3 by task kunit_try_catch/355 [ 75.966182] [ 75.967717] CPU: 0 UID: 0 PID: 355 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 75.967747] Tainted: [B]=BAD_PAGE, [N]=TEST [ 75.967758] Hardware name: Thundercomm Dragonboard 845c (DT) [ 75.967772] Call trace: [ 75.967781] show_stack+0x20/0x38 (C) [ 75.967801] dump_stack_lvl+0x8c/0xd0 [ 75.967821] print_report+0x310/0x608 [ 75.967843] kasan_report+0xdc/0x128 [ 75.967862] __asan_report_load1_noabort+0x20/0x30 [ 75.967880] vmalloc_oob+0x578/0x5d0 [ 75.967897] kunit_try_run_case+0x170/0x3f0 [ 75.967918] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 75.967941] kthread+0x328/0x630 [ 75.967957] ret_from_fork+0x10/0x20 [ 75.967975] [ 76.033097] The buggy address belongs to the virtual mapping at [ 76.033097] [ffff80008029d000, ffff80008029f000) created by: [ 76.033097] vmalloc_oob+0x98/0x5d0 [ 76.048392] [ 76.049925] The buggy address belongs to the physical page: [ 76.055572] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116f1f [ 76.063681] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 76.070308] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 76.078152] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 76.086000] page dumped because: kasan: bad access detected [ 76.091649] [ 76.093181] Memory state around the buggy address: [ 76.098043] ffff80008029d680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.105364] ffff80008029d700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.112687] >ffff80008029d780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8 [ 76.120000] ^ [ 76.126967] ffff80008029d800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 76.134291] ffff80008029d880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 76.141612] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kasan_atomics_helper
[ 67.836201] ================================================================== [ 67.843514] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xdd4/0x4858 [ 67.850918] Read of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 67.858320] [ 67.859846] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 67.859875] Tainted: [B]=BAD_PAGE, [N]=TEST [ 67.859884] Hardware name: Thundercomm Dragonboard 845c (DT) [ 67.859894] Call trace: [ 67.859902] show_stack+0x20/0x38 (C) [ 67.859919] dump_stack_lvl+0x8c/0xd0 [ 67.859937] print_report+0x118/0x608 [ 67.859955] kasan_report+0xdc/0x128 [ 67.859972] kasan_check_range+0x100/0x1a8 [ 67.859992] __kasan_check_read+0x20/0x30 [ 67.860008] kasan_atomics_helper+0xdd4/0x4858 [ 67.860026] kasan_atomics+0x198/0x2e0 [ 67.860043] kunit_try_run_case+0x170/0x3f0 [ 67.860061] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.860081] kthread+0x328/0x630 [ 67.860094] ret_from_fork+0x10/0x20 [ 67.860110] [ 67.933169] Allocated by task 351: [ 67.936625] kasan_save_stack+0x3c/0x68 [ 67.940523] kasan_save_track+0x20/0x40 [ 67.944420] kasan_save_alloc_info+0x40/0x58 [ 67.948759] __kasan_kmalloc+0xd4/0xd8 [ 67.952568] __kmalloc_cache_noprof+0x16c/0x3c0 [ 67.957170] kasan_atomics+0xb8/0x2e0 [ 67.960891] kunit_try_run_case+0x170/0x3f0 [ 67.965145] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.970704] kthread+0x328/0x630 [ 67.973989] ret_from_fork+0x10/0x20 [ 67.977625] [ 67.979148] The buggy address belongs to the object at ffff0000934cf200 [ 67.979148] which belongs to the cache kmalloc-64 of size 64 [ 67.991629] The buggy address is located 0 bytes to the right of [ 67.991629] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 68.004633] [ 68.006156] The buggy address belongs to the physical page: [ 68.011803] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 68.019903] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 68.026511] page_type: f5(slab) [ 68.029712] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 68.037550] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 68.045384] page dumped because: kasan: bad access detected [ 68.051031] [ 68.052554] Memory state around the buggy address: [ 68.057409] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 68.064722] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 68.072036] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 68.079347] ^ [ 68.084203] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.091516] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.098827] ================================================================== [ 66.225295] ================================================================== [ 66.232607] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xc08/0x4858 [ 66.240012] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 66.247501] [ 66.249026] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 66.249055] Tainted: [B]=BAD_PAGE, [N]=TEST [ 66.249063] Hardware name: Thundercomm Dragonboard 845c (DT) [ 66.249072] Call trace: [ 66.249078] show_stack+0x20/0x38 (C) [ 66.249096] dump_stack_lvl+0x8c/0xd0 [ 66.249114] print_report+0x118/0x608 [ 66.249132] kasan_report+0xdc/0x128 [ 66.249150] kasan_check_range+0x100/0x1a8 [ 66.249168] __kasan_check_write+0x20/0x30 [ 66.249184] kasan_atomics_helper+0xc08/0x4858 [ 66.249202] kasan_atomics+0x198/0x2e0 [ 66.249219] kunit_try_run_case+0x170/0x3f0 [ 66.249236] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.249256] kthread+0x328/0x630 [ 66.249268] ret_from_fork+0x10/0x20 [ 66.249286] [ 66.322420] Allocated by task 351: [ 66.325876] kasan_save_stack+0x3c/0x68 [ 66.329774] kasan_save_track+0x20/0x40 [ 66.333671] kasan_save_alloc_info+0x40/0x58 [ 66.338008] __kasan_kmalloc+0xd4/0xd8 [ 66.341818] __kmalloc_cache_noprof+0x16c/0x3c0 [ 66.346420] kasan_atomics+0xb8/0x2e0 [ 66.350142] kunit_try_run_case+0x170/0x3f0 [ 66.354396] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.359965] kthread+0x328/0x630 [ 66.363250] ret_from_fork+0x10/0x20 [ 66.366885] [ 66.368408] The buggy address belongs to the object at ffff0000934cf200 [ 66.368408] which belongs to the cache kmalloc-64 of size 64 [ 66.380887] The buggy address is located 0 bytes to the right of [ 66.380887] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 66.393890] [ 66.395413] The buggy address belongs to the physical page: [ 66.401060] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 66.409157] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 66.415764] page_type: f5(slab) [ 66.418963] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 66.426799] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 66.434633] page dumped because: kasan: bad access detected [ 66.440279] [ 66.441802] Memory state around the buggy address: [ 66.446658] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 66.453970] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 66.461282] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 66.468593] ^ [ 66.473450] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.480763] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.488075] ================================================================== [ 69.720719] ================================================================== [ 69.728033] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xff0/0x4858 [ 69.735439] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 69.742929] [ 69.744454] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 69.744483] Tainted: [B]=BAD_PAGE, [N]=TEST [ 69.744490] Hardware name: Thundercomm Dragonboard 845c (DT) [ 69.744502] Call trace: [ 69.744507] show_stack+0x20/0x38 (C) [ 69.744524] dump_stack_lvl+0x8c/0xd0 [ 69.744541] print_report+0x118/0x608 [ 69.744559] kasan_report+0xdc/0x128 [ 69.744577] kasan_check_range+0x100/0x1a8 [ 69.744596] __kasan_check_write+0x20/0x30 [ 69.744611] kasan_atomics_helper+0xff0/0x4858 [ 69.744629] kasan_atomics+0x198/0x2e0 [ 69.744645] kunit_try_run_case+0x170/0x3f0 [ 69.744662] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 69.744682] kthread+0x328/0x630 [ 69.744695] ret_from_fork+0x10/0x20 [ 69.744711] [ 69.817867] Allocated by task 351: [ 69.821324] kasan_save_stack+0x3c/0x68 [ 69.825224] kasan_save_track+0x20/0x40 [ 69.829121] kasan_save_alloc_info+0x40/0x58 [ 69.833459] __kasan_kmalloc+0xd4/0xd8 [ 69.837268] __kmalloc_cache_noprof+0x16c/0x3c0 [ 69.841869] kasan_atomics+0xb8/0x2e0 [ 69.845591] kunit_try_run_case+0x170/0x3f0 [ 69.849845] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 69.855414] kthread+0x328/0x630 [ 69.858700] ret_from_fork+0x10/0x20 [ 69.862335] [ 69.863857] The buggy address belongs to the object at ffff0000934cf200 [ 69.863857] which belongs to the cache kmalloc-64 of size 64 [ 69.876336] The buggy address is located 0 bytes to the right of [ 69.876336] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 69.889339] [ 69.890862] The buggy address belongs to the physical page: [ 69.896509] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 69.904606] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 69.911214] page_type: f5(slab) [ 69.914413] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 69.922249] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 69.930082] page dumped because: kasan: bad access detected [ 69.935728] [ 69.937250] Memory state around the buggy address: [ 69.942105] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 69.949418] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 69.956731] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 69.964043] ^ [ 69.968899] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.976211] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.983521] ================================================================== [ 63.263223] ================================================================== [ 63.270536] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x7cc/0x4858 [ 63.277941] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 63.285433] [ 63.286958] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 63.286987] Tainted: [B]=BAD_PAGE, [N]=TEST [ 63.286995] Hardware name: Thundercomm Dragonboard 845c (DT) [ 63.287005] Call trace: [ 63.287011] show_stack+0x20/0x38 (C) [ 63.287028] dump_stack_lvl+0x8c/0xd0 [ 63.287045] print_report+0x118/0x608 [ 63.287062] kasan_report+0xdc/0x128 [ 63.287081] kasan_check_range+0x100/0x1a8 [ 63.287101] __kasan_check_write+0x20/0x30 [ 63.287117] kasan_atomics_helper+0x7cc/0x4858 [ 63.287135] kasan_atomics+0x198/0x2e0 [ 63.287152] kunit_try_run_case+0x170/0x3f0 [ 63.287169] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 63.287189] kthread+0x328/0x630 [ 63.287204] ret_from_fork+0x10/0x20 [ 63.287220] [ 63.360369] Allocated by task 351: [ 63.363826] kasan_save_stack+0x3c/0x68 [ 63.367724] kasan_save_track+0x20/0x40 [ 63.371621] kasan_save_alloc_info+0x40/0x58 [ 63.375961] __kasan_kmalloc+0xd4/0xd8 [ 63.379771] __kmalloc_cache_noprof+0x16c/0x3c0 [ 63.384373] kasan_atomics+0xb8/0x2e0 [ 63.388094] kunit_try_run_case+0x170/0x3f0 [ 63.392348] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 63.397909] kthread+0x328/0x630 [ 63.401196] ret_from_fork+0x10/0x20 [ 63.404831] [ 63.406354] The buggy address belongs to the object at ffff0000934cf200 [ 63.406354] which belongs to the cache kmalloc-64 of size 64 [ 63.418834] The buggy address is located 0 bytes to the right of [ 63.418834] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 63.431840] [ 63.433363] The buggy address belongs to the physical page: [ 63.439011] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 63.447109] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 63.453717] page_type: f5(slab) [ 63.456916] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 63.464753] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 63.472588] page dumped because: kasan: bad access detected [ 63.478236] [ 63.479758] Memory state around the buggy address: [ 63.484613] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 63.491927] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 63.499240] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 63.506552] ^ [ 63.511408] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.518722] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.526034] ================================================================== [ 62.452663] ================================================================== [ 62.459975] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x684/0x4858 [ 62.467380] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 62.474868] [ 62.476393] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 62.476421] Tainted: [B]=BAD_PAGE, [N]=TEST [ 62.476429] Hardware name: Thundercomm Dragonboard 845c (DT) [ 62.476439] Call trace: [ 62.476444] show_stack+0x20/0x38 (C) [ 62.476461] dump_stack_lvl+0x8c/0xd0 [ 62.476479] print_report+0x118/0x608 [ 62.476497] kasan_report+0xdc/0x128 [ 62.476514] kasan_check_range+0x100/0x1a8 [ 62.476534] __kasan_check_write+0x20/0x30 [ 62.476550] kasan_atomics_helper+0x684/0x4858 [ 62.476568] kasan_atomics+0x198/0x2e0 [ 62.476584] kunit_try_run_case+0x170/0x3f0 [ 62.476601] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 62.476621] kthread+0x328/0x630 [ 62.476634] ret_from_fork+0x10/0x20 [ 62.476650] [ 62.549805] Allocated by task 351: [ 62.553260] kasan_save_stack+0x3c/0x68 [ 62.557158] kasan_save_track+0x20/0x40 [ 62.561054] kasan_save_alloc_info+0x40/0x58 [ 62.565393] __kasan_kmalloc+0xd4/0xd8 [ 62.569203] __kmalloc_cache_noprof+0x16c/0x3c0 [ 62.573805] kasan_atomics+0xb8/0x2e0 [ 62.577527] kunit_try_run_case+0x170/0x3f0 [ 62.581780] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 62.587350] kthread+0x328/0x630 [ 62.590636] ret_from_fork+0x10/0x20 [ 62.594271] [ 62.595793] The buggy address belongs to the object at ffff0000934cf200 [ 62.595793] which belongs to the cache kmalloc-64 of size 64 [ 62.608273] The buggy address is located 0 bytes to the right of [ 62.608273] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 62.621277] [ 62.622800] The buggy address belongs to the physical page: [ 62.628445] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 62.636542] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 62.643149] page_type: f5(slab) [ 62.646349] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 62.654187] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 62.662021] page dumped because: kasan: bad access detected [ 62.667667] [ 62.669189] Memory state around the buggy address: [ 62.674045] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 62.681359] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 62.688672] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 62.695984] ^ [ 62.700840] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 62.708153] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 62.715465] ================================================================== [ 69.450536] ================================================================== [ 69.457850] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xf88/0x4858 [ 69.465255] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 69.472746] [ 69.474270] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 69.474298] Tainted: [B]=BAD_PAGE, [N]=TEST [ 69.474307] Hardware name: Thundercomm Dragonboard 845c (DT) [ 69.474316] Call trace: [ 69.474322] show_stack+0x20/0x38 (C) [ 69.474339] dump_stack_lvl+0x8c/0xd0 [ 69.474357] print_report+0x118/0x608 [ 69.474375] kasan_report+0xdc/0x128 [ 69.474393] kasan_check_range+0x100/0x1a8 [ 69.474412] __kasan_check_write+0x20/0x30 [ 69.474427] kasan_atomics_helper+0xf88/0x4858 [ 69.474445] kasan_atomics+0x198/0x2e0 [ 69.474462] kunit_try_run_case+0x170/0x3f0 [ 69.474480] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 69.474501] kthread+0x328/0x630 [ 69.474515] ret_from_fork+0x10/0x20 [ 69.474531] [ 69.547675] Allocated by task 351: [ 69.551131] kasan_save_stack+0x3c/0x68 [ 69.555029] kasan_save_track+0x20/0x40 [ 69.558926] kasan_save_alloc_info+0x40/0x58 [ 69.563265] __kasan_kmalloc+0xd4/0xd8 [ 69.567074] __kmalloc_cache_noprof+0x16c/0x3c0 [ 69.571676] kasan_atomics+0xb8/0x2e0 [ 69.575398] kunit_try_run_case+0x170/0x3f0 [ 69.579651] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 69.585222] kthread+0x328/0x630 [ 69.588507] ret_from_fork+0x10/0x20 [ 69.592142] [ 69.593665] The buggy address belongs to the object at ffff0000934cf200 [ 69.593665] which belongs to the cache kmalloc-64 of size 64 [ 69.606144] The buggy address is located 0 bytes to the right of [ 69.606144] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 69.619148] [ 69.620673] The buggy address belongs to the physical page: [ 69.626320] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 69.634417] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 69.641025] page_type: f5(slab) [ 69.644225] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 69.652063] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 69.659897] page dumped because: kasan: bad access detected [ 69.665544] [ 69.667066] Memory state around the buggy address: [ 69.671922] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 69.679234] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 69.686548] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 69.693858] ^ [ 69.698714] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.706026] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.713337] ================================================================== [ 62.993034] ================================================================== [ 63.000347] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x760/0x4858 [ 63.007751] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 63.015240] [ 63.016766] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 63.016794] Tainted: [B]=BAD_PAGE, [N]=TEST [ 63.016802] Hardware name: Thundercomm Dragonboard 845c (DT) [ 63.016813] Call trace: [ 63.016819] show_stack+0x20/0x38 (C) [ 63.016837] dump_stack_lvl+0x8c/0xd0 [ 63.016855] print_report+0x118/0x608 [ 63.016872] kasan_report+0xdc/0x128 [ 63.016891] kasan_check_range+0x100/0x1a8 [ 63.016909] __kasan_check_write+0x20/0x30 [ 63.016924] kasan_atomics_helper+0x760/0x4858 [ 63.016942] kasan_atomics+0x198/0x2e0 [ 63.016959] kunit_try_run_case+0x170/0x3f0 [ 63.016976] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 63.016998] kthread+0x328/0x630 [ 63.017013] ret_from_fork+0x10/0x20 [ 63.017030] [ 63.090180] Allocated by task 351: [ 63.093637] kasan_save_stack+0x3c/0x68 [ 63.097534] kasan_save_track+0x20/0x40 [ 63.101431] kasan_save_alloc_info+0x40/0x58 [ 63.105769] __kasan_kmalloc+0xd4/0xd8 [ 63.109578] __kmalloc_cache_noprof+0x16c/0x3c0 [ 63.114180] kasan_atomics+0xb8/0x2e0 [ 63.117902] kunit_try_run_case+0x170/0x3f0 [ 63.122155] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 63.127724] kthread+0x328/0x630 [ 63.131010] ret_from_fork+0x10/0x20 [ 63.134644] [ 63.136167] The buggy address belongs to the object at ffff0000934cf200 [ 63.136167] which belongs to the cache kmalloc-64 of size 64 [ 63.148649] The buggy address is located 0 bytes to the right of [ 63.148649] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 63.161653] [ 63.163176] The buggy address belongs to the physical page: [ 63.168823] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 63.176920] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 63.183529] page_type: f5(slab) [ 63.186728] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 63.194565] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 63.202398] page dumped because: kasan: bad access detected [ 63.208045] [ 63.209568] Memory state around the buggy address: [ 63.214423] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 63.221736] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 63.229049] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 63.236359] ^ [ 63.241216] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.248529] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.255839] ================================================================== [ 68.106211] ================================================================== [ 68.113524] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3f58/0x4858 [ 68.121017] Read of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 68.128419] [ 68.129945] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 68.129973] Tainted: [B]=BAD_PAGE, [N]=TEST [ 68.129982] Hardware name: Thundercomm Dragonboard 845c (DT) [ 68.129992] Call trace: [ 68.129997] show_stack+0x20/0x38 (C) [ 68.130015] dump_stack_lvl+0x8c/0xd0 [ 68.130031] print_report+0x118/0x608 [ 68.130051] kasan_report+0xdc/0x128 [ 68.130069] __asan_report_load8_noabort+0x20/0x30 [ 68.130085] kasan_atomics_helper+0x3f58/0x4858 [ 68.130104] kasan_atomics+0x198/0x2e0 [ 68.130120] kunit_try_run_case+0x170/0x3f0 [ 68.130137] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 68.130159] kthread+0x328/0x630 [ 68.130173] ret_from_fork+0x10/0x20 [ 68.130190] [ 68.199993] Allocated by task 351: [ 68.203449] kasan_save_stack+0x3c/0x68 [ 68.207348] kasan_save_track+0x20/0x40 [ 68.211246] kasan_save_alloc_info+0x40/0x58 [ 68.215586] __kasan_kmalloc+0xd4/0xd8 [ 68.219397] __kmalloc_cache_noprof+0x16c/0x3c0 [ 68.223999] kasan_atomics+0xb8/0x2e0 [ 68.227721] kunit_try_run_case+0x170/0x3f0 [ 68.231976] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 68.237545] kthread+0x328/0x630 [ 68.240831] ret_from_fork+0x10/0x20 [ 68.244466] [ 68.245989] The buggy address belongs to the object at ffff0000934cf200 [ 68.245989] which belongs to the cache kmalloc-64 of size 64 [ 68.258469] The buggy address is located 0 bytes to the right of [ 68.258469] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 68.271473] [ 68.272996] The buggy address belongs to the physical page: [ 68.278644] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 68.286741] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 68.293349] page_type: f5(slab) [ 68.296548] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 68.304385] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 68.312219] page dumped because: kasan: bad access detected [ 68.317865] [ 68.319389] Memory state around the buggy address: [ 68.324244] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 68.331556] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 68.338870] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 68.346181] ^ [ 68.351036] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.358350] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.365660] ================================================================== [ 65.688291] ================================================================== [ 65.695604] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xb70/0x4858 [ 65.703010] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 65.710500] [ 65.712026] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 65.712053] Tainted: [B]=BAD_PAGE, [N]=TEST [ 65.712061] Hardware name: Thundercomm Dragonboard 845c (DT) [ 65.712073] Call trace: [ 65.712078] show_stack+0x20/0x38 (C) [ 65.712096] dump_stack_lvl+0x8c/0xd0 [ 65.712113] print_report+0x118/0x608 [ 65.712131] kasan_report+0xdc/0x128 [ 65.712150] kasan_check_range+0x100/0x1a8 [ 65.712169] __kasan_check_write+0x20/0x30 [ 65.712184] kasan_atomics_helper+0xb70/0x4858 [ 65.712201] kasan_atomics+0x198/0x2e0 [ 65.712219] kunit_try_run_case+0x170/0x3f0 [ 65.712236] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 65.712256] kthread+0x328/0x630 [ 65.712270] ret_from_fork+0x10/0x20 [ 65.712288] [ 65.785435] Allocated by task 351: [ 65.788890] kasan_save_stack+0x3c/0x68 [ 65.792788] kasan_save_track+0x20/0x40 [ 65.796686] kasan_save_alloc_info+0x40/0x58 [ 65.801024] __kasan_kmalloc+0xd4/0xd8 [ 65.804833] __kmalloc_cache_noprof+0x16c/0x3c0 [ 65.809434] kasan_atomics+0xb8/0x2e0 [ 65.813157] kunit_try_run_case+0x170/0x3f0 [ 65.817410] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 65.822970] kthread+0x328/0x630 [ 65.826255] ret_from_fork+0x10/0x20 [ 65.829890] [ 65.831413] The buggy address belongs to the object at ffff0000934cf200 [ 65.831413] which belongs to the cache kmalloc-64 of size 64 [ 65.843893] The buggy address is located 0 bytes to the right of [ 65.843893] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 65.856897] [ 65.858423] The buggy address belongs to the physical page: [ 65.864069] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 65.872166] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 65.878774] page_type: f5(slab) [ 65.881973] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 65.889813] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 65.897646] page dumped because: kasan: bad access detected [ 65.903293] [ 65.904816] Memory state around the buggy address: [ 65.909671] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.916984] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.924297] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 65.931609] ^ [ 65.936465] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.943777] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.951088] ================================================================== [ 75.113532] ================================================================== [ 75.120846] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x175c/0x4858 [ 75.128338] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 75.135828] [ 75.137353] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 75.137381] Tainted: [B]=BAD_PAGE, [N]=TEST [ 75.137388] Hardware name: Thundercomm Dragonboard 845c (DT) [ 75.137398] Call trace: [ 75.137403] show_stack+0x20/0x38 (C) [ 75.137420] dump_stack_lvl+0x8c/0xd0 [ 75.137438] print_report+0x118/0x608 [ 75.137456] kasan_report+0xdc/0x128 [ 75.137474] kasan_check_range+0x100/0x1a8 [ 75.137495] __kasan_check_write+0x20/0x30 [ 75.137509] kasan_atomics_helper+0x175c/0x4858 [ 75.137527] kasan_atomics+0x198/0x2e0 [ 75.137544] kunit_try_run_case+0x170/0x3f0 [ 75.137561] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 75.137580] kthread+0x328/0x630 [ 75.137593] ret_from_fork+0x10/0x20 [ 75.137610] [ 75.210831] Allocated by task 351: [ 75.214288] kasan_save_stack+0x3c/0x68 [ 75.218185] kasan_save_track+0x20/0x40 [ 75.222082] kasan_save_alloc_info+0x40/0x58 [ 75.226421] __kasan_kmalloc+0xd4/0xd8 [ 75.230229] __kmalloc_cache_noprof+0x16c/0x3c0 [ 75.234831] kasan_atomics+0xb8/0x2e0 [ 75.238553] kunit_try_run_case+0x170/0x3f0 [ 75.242806] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 75.248375] kthread+0x328/0x630 [ 75.251660] ret_from_fork+0x10/0x20 [ 75.255295] [ 75.256817] The buggy address belongs to the object at ffff0000934cf200 [ 75.256817] which belongs to the cache kmalloc-64 of size 64 [ 75.269296] The buggy address is located 0 bytes to the right of [ 75.269296] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 75.282299] [ 75.283822] The buggy address belongs to the physical page: [ 75.289468] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 75.297565] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 75.304173] page_type: f5(slab) [ 75.307372] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 75.315208] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 75.323041] page dumped because: kasan: bad access detected [ 75.328687] [ 75.330210] Memory state around the buggy address: [ 75.335065] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 75.342378] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 75.349691] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 75.357002] ^ [ 75.361858] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.369170] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.376480] ================================================================== [ 71.883474] ================================================================== [ 71.890786] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x1384/0x4858 [ 71.898279] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 71.905769] [ 71.907294] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 71.907322] Tainted: [B]=BAD_PAGE, [N]=TEST [ 71.907330] Hardware name: Thundercomm Dragonboard 845c (DT) [ 71.907340] Call trace: [ 71.907345] show_stack+0x20/0x38 (C) [ 71.907362] dump_stack_lvl+0x8c/0xd0 [ 71.907379] print_report+0x118/0x608 [ 71.907397] kasan_report+0xdc/0x128 [ 71.907415] kasan_check_range+0x100/0x1a8 [ 71.907433] __kasan_check_write+0x20/0x30 [ 71.907449] kasan_atomics_helper+0x1384/0x4858 [ 71.907467] kasan_atomics+0x198/0x2e0 [ 71.907484] kunit_try_run_case+0x170/0x3f0 [ 71.907502] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 71.907521] kthread+0x328/0x630 [ 71.907535] ret_from_fork+0x10/0x20 [ 71.907552] [ 71.980787] Allocated by task 351: [ 71.984243] kasan_save_stack+0x3c/0x68 [ 71.988143] kasan_save_track+0x20/0x40 [ 71.992041] kasan_save_alloc_info+0x40/0x58 [ 71.996380] __kasan_kmalloc+0xd4/0xd8 [ 72.000188] __kmalloc_cache_noprof+0x16c/0x3c0 [ 72.004790] kasan_atomics+0xb8/0x2e0 [ 72.008512] kunit_try_run_case+0x170/0x3f0 [ 72.012765] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 72.018323] kthread+0x328/0x630 [ 72.021610] ret_from_fork+0x10/0x20 [ 72.025245] [ 72.026768] The buggy address belongs to the object at ffff0000934cf200 [ 72.026768] which belongs to the cache kmalloc-64 of size 64 [ 72.039248] The buggy address is located 0 bytes to the right of [ 72.039248] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 72.052251] [ 72.053774] The buggy address belongs to the physical page: [ 72.059420] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 72.067517] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 72.074127] page_type: f5(slab) [ 72.077327] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 72.085165] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 72.092998] page dumped because: kasan: bad access detected [ 72.098645] [ 72.100168] Memory state around the buggy address: [ 72.105025] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 72.112338] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 72.119651] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 72.126962] ^ [ 72.131818] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.139131] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.146442] ================================================================== [ 67.299221] ================================================================== [ 67.306534] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xd3c/0x4858 [ 67.313938] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 67.321428] [ 67.322954] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 67.322981] Tainted: [B]=BAD_PAGE, [N]=TEST [ 67.322990] Hardware name: Thundercomm Dragonboard 845c (DT) [ 67.323001] Call trace: [ 67.323007] show_stack+0x20/0x38 (C) [ 67.323025] dump_stack_lvl+0x8c/0xd0 [ 67.323042] print_report+0x118/0x608 [ 67.323060] kasan_report+0xdc/0x128 [ 67.323079] kasan_check_range+0x100/0x1a8 [ 67.323099] __kasan_check_write+0x20/0x30 [ 67.323114] kasan_atomics_helper+0xd3c/0x4858 [ 67.323133] kasan_atomics+0x198/0x2e0 [ 67.323149] kunit_try_run_case+0x170/0x3f0 [ 67.323166] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.323187] kthread+0x328/0x630 [ 67.323201] ret_from_fork+0x10/0x20 [ 67.323217] [ 67.396375] Allocated by task 351: [ 67.399831] kasan_save_stack+0x3c/0x68 [ 67.403730] kasan_save_track+0x20/0x40 [ 67.407627] kasan_save_alloc_info+0x40/0x58 [ 67.411965] __kasan_kmalloc+0xd4/0xd8 [ 67.415773] __kmalloc_cache_noprof+0x16c/0x3c0 [ 67.420374] kasan_atomics+0xb8/0x2e0 [ 67.424096] kunit_try_run_case+0x170/0x3f0 [ 67.428349] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.433918] kthread+0x328/0x630 [ 67.437204] ret_from_fork+0x10/0x20 [ 67.440838] [ 67.442360] The buggy address belongs to the object at ffff0000934cf200 [ 67.442360] which belongs to the cache kmalloc-64 of size 64 [ 67.454840] The buggy address is located 0 bytes to the right of [ 67.454840] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 67.467844] [ 67.469367] The buggy address belongs to the physical page: [ 67.475014] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 67.483111] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 67.489719] page_type: f5(slab) [ 67.492919] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 67.500755] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 67.508587] page dumped because: kasan: bad access detected [ 67.514234] [ 67.515756] Memory state around the buggy address: [ 67.520611] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 67.527923] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 67.535237] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 67.542547] ^ [ 67.547403] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.554716] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.562027] ================================================================== [ 60.022922] ================================================================== [ 60.030254] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x32c/0x4858 [ 60.037672] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 60.045172] [ 60.046706] CPU: 0 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 60.046737] Tainted: [B]=BAD_PAGE, [N]=TEST [ 60.046746] Hardware name: Thundercomm Dragonboard 845c (DT) [ 60.046758] Call trace: [ 60.046766] show_stack+0x20/0x38 (C) [ 60.046786] dump_stack_lvl+0x8c/0xd0 [ 60.046805] print_report+0x118/0x608 [ 60.046824] kasan_report+0xdc/0x128 [ 60.046844] kasan_check_range+0x100/0x1a8 [ 60.046866] __kasan_check_write+0x20/0x30 [ 60.046884] kasan_atomics_helper+0x32c/0x4858 [ 60.046903] kasan_atomics+0x198/0x2e0 [ 60.046922] kunit_try_run_case+0x170/0x3f0 [ 60.046940] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 60.046964] kthread+0x328/0x630 [ 60.046978] ret_from_fork+0x10/0x20 [ 60.046997] [ 60.120193] Allocated by task 351: [ 60.123660] kasan_save_stack+0x3c/0x68 [ 60.127567] kasan_save_track+0x20/0x40 [ 60.131473] kasan_save_alloc_info+0x40/0x58 [ 60.135819] __kasan_kmalloc+0xd4/0xd8 [ 60.139638] __kmalloc_cache_noprof+0x16c/0x3c0 [ 60.144244] kasan_atomics+0xb8/0x2e0 [ 60.147975] kunit_try_run_case+0x170/0x3f0 [ 60.152237] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 60.157806] kthread+0x328/0x630 [ 60.161094] ret_from_fork+0x10/0x20 [ 60.164740] [ 60.166271] The buggy address belongs to the object at ffff0000934cf200 [ 60.166271] which belongs to the cache kmalloc-64 of size 64 [ 60.178760] The buggy address is located 0 bytes to the right of [ 60.178760] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 60.191768] [ 60.193299] The buggy address belongs to the physical page: [ 60.198945] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 60.207050] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 60.213674] page_type: f5(slab) [ 60.216874] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 60.224722] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 60.232565] page dumped because: kasan: bad access detected [ 60.238212] [ 60.239742] Memory state around the buggy address: [ 60.244600] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.251915] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.259232] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 60.266545] ^ [ 60.271406] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.278721] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.286034] ================================================================== [ 71.342745] ================================================================== [ 71.350057] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x126c/0x4858 [ 71.357549] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 71.365040] [ 71.366565] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 71.366594] Tainted: [B]=BAD_PAGE, [N]=TEST [ 71.366604] Hardware name: Thundercomm Dragonboard 845c (DT) [ 71.366615] Call trace: [ 71.366620] show_stack+0x20/0x38 (C) [ 71.366637] dump_stack_lvl+0x8c/0xd0 [ 71.366654] print_report+0x118/0x608 [ 71.366672] kasan_report+0xdc/0x128 [ 71.366690] kasan_check_range+0x100/0x1a8 [ 71.366710] __kasan_check_write+0x20/0x30 [ 71.366725] kasan_atomics_helper+0x126c/0x4858 [ 71.366743] kasan_atomics+0x198/0x2e0 [ 71.366759] kunit_try_run_case+0x170/0x3f0 [ 71.366776] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 71.366796] kthread+0x328/0x630 [ 71.366810] ret_from_fork+0x10/0x20 [ 71.366826] [ 71.440070] Allocated by task 351: [ 71.443526] kasan_save_stack+0x3c/0x68 [ 71.447426] kasan_save_track+0x20/0x40 [ 71.451325] kasan_save_alloc_info+0x40/0x58 [ 71.455663] __kasan_kmalloc+0xd4/0xd8 [ 71.459472] __kmalloc_cache_noprof+0x16c/0x3c0 [ 71.464074] kasan_atomics+0xb8/0x2e0 [ 71.467795] kunit_try_run_case+0x170/0x3f0 [ 71.472048] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 71.477618] kthread+0x328/0x630 [ 71.480903] ret_from_fork+0x10/0x20 [ 71.484538] [ 71.486060] The buggy address belongs to the object at ffff0000934cf200 [ 71.486060] which belongs to the cache kmalloc-64 of size 64 [ 71.498541] The buggy address is located 0 bytes to the right of [ 71.498541] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 71.511546] [ 71.513069] The buggy address belongs to the physical page: [ 71.518716] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 71.526813] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 71.533422] page_type: f5(slab) [ 71.536621] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 71.544458] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 71.552291] page dumped because: kasan: bad access detected [ 71.557937] [ 71.559460] Memory state around the buggy address: [ 71.564316] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 71.571630] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 71.578943] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 71.586255] ^ [ 71.591112] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.598425] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.605736] ================================================================== [ 63.803599] ================================================================== [ 63.810912] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x42d8/0x4858 [ 63.818405] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 63.825808] [ 63.827333] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 63.827361] Tainted: [B]=BAD_PAGE, [N]=TEST [ 63.827370] Hardware name: Thundercomm Dragonboard 845c (DT) [ 63.827380] Call trace: [ 63.827388] show_stack+0x20/0x38 (C) [ 63.827406] dump_stack_lvl+0x8c/0xd0 [ 63.827424] print_report+0x118/0x608 [ 63.827444] kasan_report+0xdc/0x128 [ 63.827462] __asan_report_load4_noabort+0x20/0x30 [ 63.827479] kasan_atomics_helper+0x42d8/0x4858 [ 63.827499] kasan_atomics+0x198/0x2e0 [ 63.827516] kunit_try_run_case+0x170/0x3f0 [ 63.827535] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 63.827555] kthread+0x328/0x630 [ 63.827569] ret_from_fork+0x10/0x20 [ 63.827587] [ 63.897379] Allocated by task 351: [ 63.900836] kasan_save_stack+0x3c/0x68 [ 63.904734] kasan_save_track+0x20/0x40 [ 63.908632] kasan_save_alloc_info+0x40/0x58 [ 63.912972] __kasan_kmalloc+0xd4/0xd8 [ 63.916780] __kmalloc_cache_noprof+0x16c/0x3c0 [ 63.921383] kasan_atomics+0xb8/0x2e0 [ 63.925106] kunit_try_run_case+0x170/0x3f0 [ 63.929359] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 63.934930] kthread+0x328/0x630 [ 63.938217] ret_from_fork+0x10/0x20 [ 63.941853] [ 63.943375] The buggy address belongs to the object at ffff0000934cf200 [ 63.943375] which belongs to the cache kmalloc-64 of size 64 [ 63.955855] The buggy address is located 0 bytes to the right of [ 63.955855] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 63.968861] [ 63.970385] The buggy address belongs to the physical page: [ 63.976032] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 63.984130] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 63.990740] page_type: f5(slab) [ 63.993938] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 64.001775] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 64.009608] page dumped because: kasan: bad access detected [ 64.015257] [ 64.016781] Memory state around the buggy address: [ 64.021636] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 64.028948] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 64.036263] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 64.043573] ^ [ 64.048430] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.055742] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.063052] ================================================================== [ 64.340619] ================================================================== [ 64.347932] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x99c/0x4858 [ 64.355337] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 64.362827] [ 64.364353] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 64.364382] Tainted: [B]=BAD_PAGE, [N]=TEST [ 64.364390] Hardware name: Thundercomm Dragonboard 845c (DT) [ 64.364401] Call trace: [ 64.364407] show_stack+0x20/0x38 (C) [ 64.364424] dump_stack_lvl+0x8c/0xd0 [ 64.364442] print_report+0x118/0x608 [ 64.364459] kasan_report+0xdc/0x128 [ 64.364477] kasan_check_range+0x100/0x1a8 [ 64.364497] __kasan_check_write+0x20/0x30 [ 64.364512] kasan_atomics_helper+0x99c/0x4858 [ 64.364531] kasan_atomics+0x198/0x2e0 [ 64.364549] kunit_try_run_case+0x170/0x3f0 [ 64.364565] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 64.364585] kthread+0x328/0x630 [ 64.364599] ret_from_fork+0x10/0x20 [ 64.364616] [ 64.437774] Allocated by task 351: [ 64.441230] kasan_save_stack+0x3c/0x68 [ 64.445129] kasan_save_track+0x20/0x40 [ 64.449026] kasan_save_alloc_info+0x40/0x58 [ 64.453364] __kasan_kmalloc+0xd4/0xd8 [ 64.457173] __kmalloc_cache_noprof+0x16c/0x3c0 [ 64.461776] kasan_atomics+0xb8/0x2e0 [ 64.465498] kunit_try_run_case+0x170/0x3f0 [ 64.469750] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 64.475320] kthread+0x328/0x630 [ 64.478607] ret_from_fork+0x10/0x20 [ 64.482243] [ 64.483766] The buggy address belongs to the object at ffff0000934cf200 [ 64.483766] which belongs to the cache kmalloc-64 of size 64 [ 64.496247] The buggy address is located 0 bytes to the right of [ 64.496247] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 64.509252] [ 64.510776] The buggy address belongs to the physical page: [ 64.516424] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 64.524521] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 64.531131] page_type: f5(slab) [ 64.534330] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 64.542167] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 64.550001] page dumped because: kasan: bad access detected [ 64.555647] [ 64.557171] Memory state around the buggy address: [ 64.562027] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 64.569340] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 64.576654] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 64.583966] ^ [ 64.588822] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.596134] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.603446] ================================================================== [ 60.561262] ================================================================== [ 60.568583] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3ac/0x4858 [ 60.575994] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 60.583487] [ 60.585023] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 60.585052] Tainted: [B]=BAD_PAGE, [N]=TEST [ 60.585062] Hardware name: Thundercomm Dragonboard 845c (DT) [ 60.585072] Call trace: [ 60.585079] show_stack+0x20/0x38 (C) [ 60.585096] dump_stack_lvl+0x8c/0xd0 [ 60.585115] print_report+0x118/0x608 [ 60.585132] kasan_report+0xdc/0x128 [ 60.585150] kasan_check_range+0x100/0x1a8 [ 60.585169] __kasan_check_write+0x20/0x30 [ 60.585186] kasan_atomics_helper+0x3ac/0x4858 [ 60.585204] kasan_atomics+0x198/0x2e0 [ 60.585221] kunit_try_run_case+0x170/0x3f0 [ 60.585237] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 60.585257] kthread+0x328/0x630 [ 60.585271] ret_from_fork+0x10/0x20 [ 60.585287] [ 60.658437] Allocated by task 351: [ 60.661890] kasan_save_stack+0x3c/0x68 [ 60.665786] kasan_save_track+0x20/0x40 [ 60.669690] kasan_save_alloc_info+0x40/0x58 [ 60.674025] __kasan_kmalloc+0xd4/0xd8 [ 60.677840] __kmalloc_cache_noprof+0x16c/0x3c0 [ 60.682440] kasan_atomics+0xb8/0x2e0 [ 60.686167] kunit_try_run_case+0x170/0x3f0 [ 60.690417] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 60.695978] kthread+0x328/0x630 [ 60.699262] ret_from_fork+0x10/0x20 [ 60.702893] [ 60.704424] The buggy address belongs to the object at ffff0000934cf200 [ 60.704424] which belongs to the cache kmalloc-64 of size 64 [ 60.716903] The buggy address is located 0 bytes to the right of [ 60.716903] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 60.729909] [ 60.731441] The buggy address belongs to the physical page: [ 60.737083] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 60.745184] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 60.751795] page_type: f5(slab) [ 60.754995] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 60.762837] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 60.770673] page dumped because: kasan: bad access detected [ 60.776313] [ 60.777836] Memory state around the buggy address: [ 60.782688] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.790004] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.797319] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 60.804634] ^ [ 60.809486] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.816799] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.824114] ================================================================== [ 66.762269] ================================================================== [ 66.769583] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xca0/0x4858 [ 66.776989] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 66.784480] [ 66.786005] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 66.786035] Tainted: [B]=BAD_PAGE, [N]=TEST [ 66.786043] Hardware name: Thundercomm Dragonboard 845c (DT) [ 66.786052] Call trace: [ 66.786058] show_stack+0x20/0x38 (C) [ 66.786074] dump_stack_lvl+0x8c/0xd0 [ 66.786093] print_report+0x118/0x608 [ 66.786110] kasan_report+0xdc/0x128 [ 66.786129] kasan_check_range+0x100/0x1a8 [ 66.786148] __kasan_check_write+0x20/0x30 [ 66.786162] kasan_atomics_helper+0xca0/0x4858 [ 66.786180] kasan_atomics+0x198/0x2e0 [ 66.786196] kunit_try_run_case+0x170/0x3f0 [ 66.786213] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.786233] kthread+0x328/0x630 [ 66.786246] ret_from_fork+0x10/0x20 [ 66.786262] [ 66.859408] Allocated by task 351: [ 66.862865] kasan_save_stack+0x3c/0x68 [ 66.866762] kasan_save_track+0x20/0x40 [ 66.870659] kasan_save_alloc_info+0x40/0x58 [ 66.874997] __kasan_kmalloc+0xd4/0xd8 [ 66.878805] __kmalloc_cache_noprof+0x16c/0x3c0 [ 66.883407] kasan_atomics+0xb8/0x2e0 [ 66.887129] kunit_try_run_case+0x170/0x3f0 [ 66.891382] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.896940] kthread+0x328/0x630 [ 66.900226] ret_from_fork+0x10/0x20 [ 66.903860] [ 66.905382] The buggy address belongs to the object at ffff0000934cf200 [ 66.905382] which belongs to the cache kmalloc-64 of size 64 [ 66.917864] The buggy address is located 0 bytes to the right of [ 66.917864] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 66.930866] [ 66.932389] The buggy address belongs to the physical page: [ 66.938035] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 66.946132] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 66.952740] page_type: f5(slab) [ 66.955940] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 66.963777] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 66.971611] page dumped because: kasan: bad access detected [ 66.977257] [ 66.978780] Memory state around the buggy address: [ 66.983635] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 66.990948] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 66.998260] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 67.005572] ^ [ 67.010428] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.017741] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.025053] ================================================================== [ 67.032436] ================================================================== [ 67.039748] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3dd8/0x4858 [ 67.047239] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 67.054642] [ 67.056167] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 67.056195] Tainted: [B]=BAD_PAGE, [N]=TEST [ 67.056203] Hardware name: Thundercomm Dragonboard 845c (DT) [ 67.056212] Call trace: [ 67.056218] show_stack+0x20/0x38 (C) [ 67.056235] dump_stack_lvl+0x8c/0xd0 [ 67.056252] print_report+0x118/0x608 [ 67.056271] kasan_report+0xdc/0x128 [ 67.056289] __asan_report_load4_noabort+0x20/0x30 [ 67.056305] kasan_atomics_helper+0x3dd8/0x4858 [ 67.056323] kasan_atomics+0x198/0x2e0 [ 67.056339] kunit_try_run_case+0x170/0x3f0 [ 67.056356] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.056375] kthread+0x328/0x630 [ 67.056388] ret_from_fork+0x10/0x20 [ 67.056404] [ 67.126203] Allocated by task 351: [ 67.129659] kasan_save_stack+0x3c/0x68 [ 67.133557] kasan_save_track+0x20/0x40 [ 67.137454] kasan_save_alloc_info+0x40/0x58 [ 67.141791] __kasan_kmalloc+0xd4/0xd8 [ 67.145600] __kmalloc_cache_noprof+0x16c/0x3c0 [ 67.150201] kasan_atomics+0xb8/0x2e0 [ 67.153923] kunit_try_run_case+0x170/0x3f0 [ 67.158176] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.163745] kthread+0x328/0x630 [ 67.167031] ret_from_fork+0x10/0x20 [ 67.170665] [ 67.172187] The buggy address belongs to the object at ffff0000934cf200 [ 67.172187] which belongs to the cache kmalloc-64 of size 64 [ 67.184666] The buggy address is located 0 bytes to the right of [ 67.184666] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 67.197670] [ 67.199192] The buggy address belongs to the physical page: [ 67.204839] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 67.212935] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 67.219543] page_type: f5(slab) [ 67.222742] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 67.230578] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 67.238411] page dumped because: kasan: bad access detected [ 67.244058] [ 67.245579] Memory state around the buggy address: [ 67.250435] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 67.257747] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 67.265060] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 67.272371] ^ [ 67.277227] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.284539] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.291850] ================================================================== [ 70.261240] ================================================================== [ 70.268555] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x10c0/0x4858 [ 70.276050] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 70.283541] [ 70.285066] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 70.285096] Tainted: [B]=BAD_PAGE, [N]=TEST [ 70.285105] Hardware name: Thundercomm Dragonboard 845c (DT) [ 70.285116] Call trace: [ 70.285122] show_stack+0x20/0x38 (C) [ 70.285140] dump_stack_lvl+0x8c/0xd0 [ 70.285158] print_report+0x118/0x608 [ 70.285176] kasan_report+0xdc/0x128 [ 70.285195] kasan_check_range+0x100/0x1a8 [ 70.285215] __kasan_check_write+0x20/0x30 [ 70.285231] kasan_atomics_helper+0x10c0/0x4858 [ 70.285249] kasan_atomics+0x198/0x2e0 [ 70.285266] kunit_try_run_case+0x170/0x3f0 [ 70.285283] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 70.285303] kthread+0x328/0x630 [ 70.285317] ret_from_fork+0x10/0x20 [ 70.285333] [ 70.358578] Allocated by task 351: [ 70.362035] kasan_save_stack+0x3c/0x68 [ 70.365933] kasan_save_track+0x20/0x40 [ 70.369831] kasan_save_alloc_info+0x40/0x58 [ 70.374169] __kasan_kmalloc+0xd4/0xd8 [ 70.377978] __kmalloc_cache_noprof+0x16c/0x3c0 [ 70.382581] kasan_atomics+0xb8/0x2e0 [ 70.386302] kunit_try_run_case+0x170/0x3f0 [ 70.390556] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 70.396115] kthread+0x328/0x630 [ 70.399401] ret_from_fork+0x10/0x20 [ 70.403036] [ 70.404560] The buggy address belongs to the object at ffff0000934cf200 [ 70.404560] which belongs to the cache kmalloc-64 of size 64 [ 70.417039] The buggy address is located 0 bytes to the right of [ 70.417039] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 70.430042] [ 70.431564] The buggy address belongs to the physical page: [ 70.437211] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 70.445307] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 70.451916] page_type: f5(slab) [ 70.455115] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 70.462952] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 70.470785] page dumped because: kasan: bad access detected [ 70.476431] [ 70.477954] Memory state around the buggy address: [ 70.482809] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 70.490121] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 70.497434] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 70.504746] ^ [ 70.509603] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.516915] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.524226] ================================================================== [ 64.070422] ================================================================== [ 64.077734] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x934/0x4858 [ 64.085138] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 64.092630] [ 64.094155] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 64.094183] Tainted: [B]=BAD_PAGE, [N]=TEST [ 64.094191] Hardware name: Thundercomm Dragonboard 845c (DT) [ 64.094200] Call trace: [ 64.094207] show_stack+0x20/0x38 (C) [ 64.094223] dump_stack_lvl+0x8c/0xd0 [ 64.094240] print_report+0x118/0x608 [ 64.094259] kasan_report+0xdc/0x128 [ 64.094277] kasan_check_range+0x100/0x1a8 [ 64.094298] __kasan_check_write+0x20/0x30 [ 64.094313] kasan_atomics_helper+0x934/0x4858 [ 64.094331] kasan_atomics+0x198/0x2e0 [ 64.094348] kunit_try_run_case+0x170/0x3f0 [ 64.094366] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 64.094386] kthread+0x328/0x630 [ 64.094401] ret_from_fork+0x10/0x20 [ 64.094418] [ 64.167576] Allocated by task 351: [ 64.171031] kasan_save_stack+0x3c/0x68 [ 64.174931] kasan_save_track+0x20/0x40 [ 64.178829] kasan_save_alloc_info+0x40/0x58 [ 64.183169] __kasan_kmalloc+0xd4/0xd8 [ 64.186977] __kmalloc_cache_noprof+0x16c/0x3c0 [ 64.191580] kasan_atomics+0xb8/0x2e0 [ 64.195302] kunit_try_run_case+0x170/0x3f0 [ 64.199555] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 64.205113] kthread+0x328/0x630 [ 64.208400] ret_from_fork+0x10/0x20 [ 64.212035] [ 64.213558] The buggy address belongs to the object at ffff0000934cf200 [ 64.213558] which belongs to the cache kmalloc-64 of size 64 [ 64.226041] The buggy address is located 0 bytes to the right of [ 64.226041] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 64.239045] [ 64.240569] The buggy address belongs to the physical page: [ 64.246215] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 64.254313] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 64.260922] page_type: f5(slab) [ 64.264123] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 64.271960] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 64.279793] page dumped because: kasan: bad access detected [ 64.285441] [ 64.286963] Memory state around the buggy address: [ 64.291819] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 64.299131] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 64.306444] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 64.313756] ^ [ 64.318612] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.325925] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.333236] ================================================================== [ 65.151276] ================================================================== [ 65.158590] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xad4/0x4858 [ 65.165998] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 65.173489] [ 65.175015] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 65.175045] Tainted: [B]=BAD_PAGE, [N]=TEST [ 65.175052] Hardware name: Thundercomm Dragonboard 845c (DT) [ 65.175062] Call trace: [ 65.175069] show_stack+0x20/0x38 (C) [ 65.175086] dump_stack_lvl+0x8c/0xd0 [ 65.175104] print_report+0x118/0x608 [ 65.175124] kasan_report+0xdc/0x128 [ 65.175141] kasan_check_range+0x100/0x1a8 [ 65.175162] __kasan_check_write+0x20/0x30 [ 65.175177] kasan_atomics_helper+0xad4/0x4858 [ 65.175196] kasan_atomics+0x198/0x2e0 [ 65.175212] kunit_try_run_case+0x170/0x3f0 [ 65.175229] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 65.175249] kthread+0x328/0x630 [ 65.175262] ret_from_fork+0x10/0x20 [ 65.175278] [ 65.248415] Allocated by task 351: [ 65.251871] kasan_save_stack+0x3c/0x68 [ 65.255769] kasan_save_track+0x20/0x40 [ 65.259667] kasan_save_alloc_info+0x40/0x58 [ 65.264005] __kasan_kmalloc+0xd4/0xd8 [ 65.267814] __kmalloc_cache_noprof+0x16c/0x3c0 [ 65.272415] kasan_atomics+0xb8/0x2e0 [ 65.276137] kunit_try_run_case+0x170/0x3f0 [ 65.280390] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 65.285949] kthread+0x328/0x630 [ 65.289235] ret_from_fork+0x10/0x20 [ 65.292870] [ 65.294392] The buggy address belongs to the object at ffff0000934cf200 [ 65.294392] which belongs to the cache kmalloc-64 of size 64 [ 65.306872] The buggy address is located 0 bytes to the right of [ 65.306872] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 65.319877] [ 65.321400] The buggy address belongs to the physical page: [ 65.327047] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 65.335144] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 65.341753] page_type: f5(slab) [ 65.344953] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 65.352790] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 65.360624] page dumped because: kasan: bad access detected [ 65.366272] [ 65.367794] Memory state around the buggy address: [ 65.372650] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.379963] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.387276] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 65.394590] ^ [ 65.399446] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.406758] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.414070] ================================================================== [ 69.180385] ================================================================== [ 69.187697] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xf20/0x4858 [ 69.195102] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 69.202591] [ 69.204116] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 69.204144] Tainted: [B]=BAD_PAGE, [N]=TEST [ 69.204151] Hardware name: Thundercomm Dragonboard 845c (DT) [ 69.204161] Call trace: [ 69.204167] show_stack+0x20/0x38 (C) [ 69.204184] dump_stack_lvl+0x8c/0xd0 [ 69.204203] print_report+0x118/0x608 [ 69.204221] kasan_report+0xdc/0x128 [ 69.204239] kasan_check_range+0x100/0x1a8 [ 69.204258] __kasan_check_write+0x20/0x30 [ 69.204272] kasan_atomics_helper+0xf20/0x4858 [ 69.204290] kasan_atomics+0x198/0x2e0 [ 69.204307] kunit_try_run_case+0x170/0x3f0 [ 69.204324] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 69.204344] kthread+0x328/0x630 [ 69.204357] ret_from_fork+0x10/0x20 [ 69.204373] [ 69.277519] Allocated by task 351: [ 69.280976] kasan_save_stack+0x3c/0x68 [ 69.284874] kasan_save_track+0x20/0x40 [ 69.288771] kasan_save_alloc_info+0x40/0x58 [ 69.293110] __kasan_kmalloc+0xd4/0xd8 [ 69.296918] __kmalloc_cache_noprof+0x16c/0x3c0 [ 69.301519] kasan_atomics+0xb8/0x2e0 [ 69.305241] kunit_try_run_case+0x170/0x3f0 [ 69.309493] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 69.315062] kthread+0x328/0x630 [ 69.318347] ret_from_fork+0x10/0x20 [ 69.321982] [ 69.323505] The buggy address belongs to the object at ffff0000934cf200 [ 69.323505] which belongs to the cache kmalloc-64 of size 64 [ 69.335985] The buggy address is located 0 bytes to the right of [ 69.335985] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 69.348988] [ 69.350511] The buggy address belongs to the physical page: [ 69.356158] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 69.364255] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 69.370863] page_type: f5(slab) [ 69.374061] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 69.381899] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 69.389731] page dumped because: kasan: bad access detected [ 69.395377] [ 69.396899] Memory state around the buggy address: [ 69.401754] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 69.409066] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 69.416379] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 69.423690] ^ [ 69.428546] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.435858] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.443168] ================================================================== [ 70.801977] ================================================================== [ 70.809293] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x1190/0x4858 [ 70.816787] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 70.824278] [ 70.825804] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 70.825833] Tainted: [B]=BAD_PAGE, [N]=TEST [ 70.825842] Hardware name: Thundercomm Dragonboard 845c (DT) [ 70.825852] Call trace: [ 70.825859] show_stack+0x20/0x38 (C) [ 70.825876] dump_stack_lvl+0x8c/0xd0 [ 70.825895] print_report+0x118/0x608 [ 70.825915] kasan_report+0xdc/0x128 [ 70.825933] kasan_check_range+0x100/0x1a8 [ 70.825953] __kasan_check_write+0x20/0x30 [ 70.825970] kasan_atomics_helper+0x1190/0x4858 [ 70.825988] kasan_atomics+0x198/0x2e0 [ 70.826004] kunit_try_run_case+0x170/0x3f0 [ 70.826022] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 70.826043] kthread+0x328/0x630 [ 70.826057] ret_from_fork+0x10/0x20 [ 70.826073] [ 70.899308] Allocated by task 351: [ 70.902766] kasan_save_stack+0x3c/0x68 [ 70.906665] kasan_save_track+0x20/0x40 [ 70.910563] kasan_save_alloc_info+0x40/0x58 [ 70.914901] __kasan_kmalloc+0xd4/0xd8 [ 70.918711] __kmalloc_cache_noprof+0x16c/0x3c0 [ 70.923313] kasan_atomics+0xb8/0x2e0 [ 70.927035] kunit_try_run_case+0x170/0x3f0 [ 70.931289] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 70.936858] kthread+0x328/0x630 [ 70.940144] ret_from_fork+0x10/0x20 [ 70.943781] [ 70.945303] The buggy address belongs to the object at ffff0000934cf200 [ 70.945303] which belongs to the cache kmalloc-64 of size 64 [ 70.957784] The buggy address is located 0 bytes to the right of [ 70.957784] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 70.970790] [ 70.972312] The buggy address belongs to the physical page: [ 70.977960] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 70.986059] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 70.992668] page_type: f5(slab) [ 70.995868] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 71.003706] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 71.011540] page dumped because: kasan: bad access detected [ 71.017189] [ 71.018712] Memory state around the buggy address: [ 71.023568] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 71.030880] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 71.038193] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 71.045503] ^ [ 71.050361] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.057674] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.064985] ================================================================== [ 59.755972] ================================================================== [ 59.763284] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x40fc/0x4858 [ 59.770775] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 59.778173] [ 59.779707] CPU: 6 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 59.779738] Tainted: [B]=BAD_PAGE, [N]=TEST [ 59.779746] Hardware name: Thundercomm Dragonboard 845c (DT) [ 59.779755] Call trace: [ 59.779763] show_stack+0x20/0x38 (C) [ 59.779780] dump_stack_lvl+0x8c/0xd0 [ 59.779798] print_report+0x118/0x608 [ 59.779817] kasan_report+0xdc/0x128 [ 59.779836] __asan_report_load4_noabort+0x20/0x30 [ 59.779853] kasan_atomics_helper+0x40fc/0x4858 [ 59.779873] kasan_atomics+0x198/0x2e0 [ 59.779890] kunit_try_run_case+0x170/0x3f0 [ 59.779909] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 59.779930] kthread+0x328/0x630 [ 59.779945] ret_from_fork+0x10/0x20 [ 59.779962] [ 59.849738] Allocated by task 351: [ 59.853193] kasan_save_stack+0x3c/0x68 [ 59.857099] kasan_save_track+0x20/0x40 [ 59.860994] kasan_save_alloc_info+0x40/0x58 [ 59.865329] __kasan_kmalloc+0xd4/0xd8 [ 59.869136] __kmalloc_cache_noprof+0x16c/0x3c0 [ 59.873734] kasan_atomics+0xb8/0x2e0 [ 59.877455] kunit_try_run_case+0x170/0x3f0 [ 59.881704] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 59.887270] kthread+0x328/0x630 [ 59.890552] ret_from_fork+0x10/0x20 [ 59.894185] [ 59.895714] The buggy address belongs to the object at ffff0000934cf200 [ 59.895714] which belongs to the cache kmalloc-64 of size 64 [ 59.908194] The buggy address is located 0 bytes to the right of [ 59.908194] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 59.921200] [ 59.922724] The buggy address belongs to the physical page: [ 59.928365] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 59.936467] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 59.943074] page_type: f5(slab) [ 59.946269] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 59.954112] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 59.961950] page dumped because: kasan: bad access detected [ 59.967592] [ 59.969123] Memory state around the buggy address: [ 59.973979] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 59.981287] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 59.988593] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 59.995897] ^ [ 60.000751] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.008057] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.015362] ================================================================== [ 75.383850] ================================================================== [ 75.391163] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3e20/0x4858 [ 75.398655] Read of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 75.406059] [ 75.407584] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 75.407612] Tainted: [B]=BAD_PAGE, [N]=TEST [ 75.407620] Hardware name: Thundercomm Dragonboard 845c (DT) [ 75.407630] Call trace: [ 75.407636] show_stack+0x20/0x38 (C) [ 75.407652] dump_stack_lvl+0x8c/0xd0 [ 75.407670] print_report+0x118/0x608 [ 75.407687] kasan_report+0xdc/0x128 [ 75.407704] __asan_report_load8_noabort+0x20/0x30 [ 75.407721] kasan_atomics_helper+0x3e20/0x4858 [ 75.407740] kasan_atomics+0x198/0x2e0 [ 75.407757] kunit_try_run_case+0x170/0x3f0 [ 75.407774] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 75.407794] kthread+0x328/0x630 [ 75.407808] ret_from_fork+0x10/0x20 [ 75.407824] [ 75.477624] Allocated by task 351: [ 75.481079] kasan_save_stack+0x3c/0x68 [ 75.484977] kasan_save_track+0x20/0x40 [ 75.488874] kasan_save_alloc_info+0x40/0x58 [ 75.493212] __kasan_kmalloc+0xd4/0xd8 [ 75.497021] __kmalloc_cache_noprof+0x16c/0x3c0 [ 75.501623] kasan_atomics+0xb8/0x2e0 [ 75.505344] kunit_try_run_case+0x170/0x3f0 [ 75.509597] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 75.515167] kthread+0x328/0x630 [ 75.518452] ret_from_fork+0x10/0x20 [ 75.522086] [ 75.523609] The buggy address belongs to the object at ffff0000934cf200 [ 75.523609] which belongs to the cache kmalloc-64 of size 64 [ 75.536088] The buggy address is located 0 bytes to the right of [ 75.536088] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 75.549090] [ 75.550613] The buggy address belongs to the physical page: [ 75.556259] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 75.564355] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 75.570963] page_type: f5(slab) [ 75.574162] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 75.581998] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 75.589831] page dumped because: kasan: bad access detected [ 75.595477] [ 75.596999] Memory state around the buggy address: [ 75.601855] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 75.609168] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 75.616481] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 75.623792] ^ [ 75.628648] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.635960] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.643270] ================================================================== [ 68.643222] ================================================================== [ 68.650533] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3e5c/0x4858 [ 68.658025] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 68.665514] [ 68.667039] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 68.667067] Tainted: [B]=BAD_PAGE, [N]=TEST [ 68.667075] Hardware name: Thundercomm Dragonboard 845c (DT) [ 68.667086] Call trace: [ 68.667092] show_stack+0x20/0x38 (C) [ 68.667109] dump_stack_lvl+0x8c/0xd0 [ 68.667127] print_report+0x118/0x608 [ 68.667145] kasan_report+0xdc/0x128 [ 68.667162] __asan_report_store8_noabort+0x20/0x30 [ 68.667179] kasan_atomics_helper+0x3e5c/0x4858 [ 68.667198] kasan_atomics+0x198/0x2e0 [ 68.667215] kunit_try_run_case+0x170/0x3f0 [ 68.667233] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 68.667252] kthread+0x328/0x630 [ 68.667266] ret_from_fork+0x10/0x20 [ 68.667282] [ 68.737179] Allocated by task 351: [ 68.740635] kasan_save_stack+0x3c/0x68 [ 68.744534] kasan_save_track+0x20/0x40 [ 68.748432] kasan_save_alloc_info+0x40/0x58 [ 68.752769] __kasan_kmalloc+0xd4/0xd8 [ 68.756578] __kmalloc_cache_noprof+0x16c/0x3c0 [ 68.761180] kasan_atomics+0xb8/0x2e0 [ 68.764901] kunit_try_run_case+0x170/0x3f0 [ 68.769155] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 68.774724] kthread+0x328/0x630 [ 68.778010] ret_from_fork+0x10/0x20 [ 68.781644] [ 68.783167] The buggy address belongs to the object at ffff0000934cf200 [ 68.783167] which belongs to the cache kmalloc-64 of size 64 [ 68.795647] The buggy address is located 0 bytes to the right of [ 68.795647] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 68.808649] [ 68.810172] The buggy address belongs to the physical page: [ 68.815819] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 68.823915] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 68.830524] page_type: f5(slab) [ 68.833723] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 68.841560] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 68.849393] page dumped because: kasan: bad access detected [ 68.855039] [ 68.856562] Memory state around the buggy address: [ 68.861417] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 68.868730] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 68.876043] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 68.883354] ^ [ 68.888211] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.895523] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.902834] ================================================================== [ 58.676944] ================================================================== [ 58.684266] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3f7c/0x4858 [ 58.691763] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 58.699250] [ 58.700784] CPU: 7 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 58.700814] Tainted: [B]=BAD_PAGE, [N]=TEST [ 58.700821] Hardware name: Thundercomm Dragonboard 845c (DT) [ 58.700832] Call trace: [ 58.700840] show_stack+0x20/0x38 (C) [ 58.700857] dump_stack_lvl+0x8c/0xd0 [ 58.700875] print_report+0x118/0x608 [ 58.700894] kasan_report+0xdc/0x128 [ 58.700914] __asan_report_store4_noabort+0x20/0x30 [ 58.700930] kasan_atomics_helper+0x3f7c/0x4858 [ 58.700949] kasan_atomics+0x198/0x2e0 [ 58.700966] kunit_try_run_case+0x170/0x3f0 [ 58.700985] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 58.701005] kthread+0x328/0x630 [ 58.701018] ret_from_fork+0x10/0x20 [ 58.701035] [ 58.770923] Allocated by task 351: [ 58.774376] kasan_save_stack+0x3c/0x68 [ 58.778282] kasan_save_track+0x20/0x40 [ 58.782187] kasan_save_alloc_info+0x40/0x58 [ 58.786522] __kasan_kmalloc+0xd4/0xd8 [ 58.790338] __kmalloc_cache_noprof+0x16c/0x3c0 [ 58.794936] kasan_atomics+0xb8/0x2e0 [ 58.798655] kunit_try_run_case+0x170/0x3f0 [ 58.802905] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 58.808467] kthread+0x328/0x630 [ 58.811750] ret_from_fork+0x10/0x20 [ 58.815382] [ 58.816914] The buggy address belongs to the object at ffff0000934cf200 [ 58.816914] which belongs to the cache kmalloc-64 of size 64 [ 58.829396] The buggy address is located 0 bytes to the right of [ 58.829396] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 58.842402] [ 58.843933] The buggy address belongs to the physical page: [ 58.849576] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 58.857677] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 58.864290] page_type: f5(slab) [ 58.867487] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 58.875331] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 58.883168] page dumped because: kasan: bad access detected [ 58.888807] [ 58.890331] Memory state around the buggy address: [ 58.895184] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 58.902490] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 58.909806] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 58.917111] ^ [ 58.921963] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.929269] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.936573] ================================================================== [ 68.910205] ================================================================== [ 68.917518] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xeb8/0x4858 [ 68.924924] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 68.932413] [ 68.933938] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 68.933966] Tainted: [B]=BAD_PAGE, [N]=TEST [ 68.933974] Hardware name: Thundercomm Dragonboard 845c (DT) [ 68.933985] Call trace: [ 68.933991] show_stack+0x20/0x38 (C) [ 68.934008] dump_stack_lvl+0x8c/0xd0 [ 68.934025] print_report+0x118/0x608 [ 68.934044] kasan_report+0xdc/0x128 [ 68.934062] kasan_check_range+0x100/0x1a8 [ 68.934082] __kasan_check_write+0x20/0x30 [ 68.934097] kasan_atomics_helper+0xeb8/0x4858 [ 68.934115] kasan_atomics+0x198/0x2e0 [ 68.934131] kunit_try_run_case+0x170/0x3f0 [ 68.934149] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 68.934169] kthread+0x328/0x630 [ 68.934182] ret_from_fork+0x10/0x20 [ 68.934199] [ 69.007356] Allocated by task 351: [ 69.010812] kasan_save_stack+0x3c/0x68 [ 69.014710] kasan_save_track+0x20/0x40 [ 69.018607] kasan_save_alloc_info+0x40/0x58 [ 69.022945] __kasan_kmalloc+0xd4/0xd8 [ 69.026754] __kmalloc_cache_noprof+0x16c/0x3c0 [ 69.031355] kasan_atomics+0xb8/0x2e0 [ 69.035076] kunit_try_run_case+0x170/0x3f0 [ 69.039329] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 69.044898] kthread+0x328/0x630 [ 69.048184] ret_from_fork+0x10/0x20 [ 69.051818] [ 69.053340] The buggy address belongs to the object at ffff0000934cf200 [ 69.053340] which belongs to the cache kmalloc-64 of size 64 [ 69.065820] The buggy address is located 0 bytes to the right of [ 69.065820] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 69.078822] [ 69.080346] The buggy address belongs to the physical page: [ 69.085992] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 69.094090] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 69.100698] page_type: f5(slab) [ 69.103897] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 69.111733] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 69.119566] page dumped because: kasan: bad access detected [ 69.125212] [ 69.126734] Memory state around the buggy address: [ 69.131589] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 69.138901] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 69.146214] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 69.153524] ^ [ 69.158380] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.165692] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.173002] ================================================================== [ 73.502045] ================================================================== [ 73.509359] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x15b4/0x4858 [ 73.516851] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 73.524341] [ 73.525866] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 73.525895] Tainted: [B]=BAD_PAGE, [N]=TEST [ 73.525903] Hardware name: Thundercomm Dragonboard 845c (DT) [ 73.525914] Call trace: [ 73.525919] show_stack+0x20/0x38 (C) [ 73.525936] dump_stack_lvl+0x8c/0xd0 [ 73.525953] print_report+0x118/0x608 [ 73.525971] kasan_report+0xdc/0x128 [ 73.525989] kasan_check_range+0x100/0x1a8 [ 73.526008] __kasan_check_write+0x20/0x30 [ 73.526024] kasan_atomics_helper+0x15b4/0x4858 [ 73.526042] kasan_atomics+0x198/0x2e0 [ 73.526059] kunit_try_run_case+0x170/0x3f0 [ 73.526076] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 73.526095] kthread+0x328/0x630 [ 73.526109] ret_from_fork+0x10/0x20 [ 73.526125] [ 73.599368] Allocated by task 351: [ 73.602824] kasan_save_stack+0x3c/0x68 [ 73.606722] kasan_save_track+0x20/0x40 [ 73.610619] kasan_save_alloc_info+0x40/0x58 [ 73.614957] __kasan_kmalloc+0xd4/0xd8 [ 73.618765] __kmalloc_cache_noprof+0x16c/0x3c0 [ 73.623366] kasan_atomics+0xb8/0x2e0 [ 73.627088] kunit_try_run_case+0x170/0x3f0 [ 73.631340] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 73.636909] kthread+0x328/0x630 [ 73.640195] ret_from_fork+0x10/0x20 [ 73.643829] [ 73.645351] The buggy address belongs to the object at ffff0000934cf200 [ 73.645351] which belongs to the cache kmalloc-64 of size 64 [ 73.657830] The buggy address is located 0 bytes to the right of [ 73.657830] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 73.670833] [ 73.672356] The buggy address belongs to the physical page: [ 73.678002] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 73.686099] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 73.692707] page_type: f5(slab) [ 73.695906] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 73.703742] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 73.711575] page dumped because: kasan: bad access detected [ 73.717222] [ 73.718744] Memory state around the buggy address: [ 73.723600] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 73.730913] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 73.738225] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 73.745536] ^ [ 73.750392] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.757704] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.765014] ================================================================== [ 74.039178] ================================================================== [ 74.046492] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x1644/0x4858 [ 74.053984] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 74.061474] [ 74.062999] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 74.063027] Tainted: [B]=BAD_PAGE, [N]=TEST [ 74.063034] Hardware name: Thundercomm Dragonboard 845c (DT) [ 74.063044] Call trace: [ 74.063050] show_stack+0x20/0x38 (C) [ 74.063068] dump_stack_lvl+0x8c/0xd0 [ 74.063085] print_report+0x118/0x608 [ 74.063103] kasan_report+0xdc/0x128 [ 74.063121] kasan_check_range+0x100/0x1a8 [ 74.063142] __kasan_check_write+0x20/0x30 [ 74.063157] kasan_atomics_helper+0x1644/0x4858 [ 74.063175] kasan_atomics+0x198/0x2e0 [ 74.063191] kunit_try_run_case+0x170/0x3f0 [ 74.063208] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 74.063227] kthread+0x328/0x630 [ 74.063241] ret_from_fork+0x10/0x20 [ 74.063258] [ 74.136501] Allocated by task 351: [ 74.139958] kasan_save_stack+0x3c/0x68 [ 74.143856] kasan_save_track+0x20/0x40 [ 74.147753] kasan_save_alloc_info+0x40/0x58 [ 74.152092] __kasan_kmalloc+0xd4/0xd8 [ 74.155903] __kmalloc_cache_noprof+0x16c/0x3c0 [ 74.160504] kasan_atomics+0xb8/0x2e0 [ 74.164226] kunit_try_run_case+0x170/0x3f0 [ 74.168479] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 74.174047] kthread+0x328/0x630 [ 74.177333] ret_from_fork+0x10/0x20 [ 74.180968] [ 74.182490] The buggy address belongs to the object at ffff0000934cf200 [ 74.182490] which belongs to the cache kmalloc-64 of size 64 [ 74.194968] The buggy address is located 0 bytes to the right of [ 74.194968] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 74.207972] [ 74.209496] The buggy address belongs to the physical page: [ 74.215143] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 74.223241] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 74.229850] page_type: f5(slab) [ 74.233048] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 74.240885] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 74.248717] page dumped because: kasan: bad access detected [ 74.254364] [ 74.255887] Memory state around the buggy address: [ 74.260742] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 74.268055] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 74.275368] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 74.282679] ^ [ 74.287535] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.294847] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.302157] ================================================================== [ 74.309528] ================================================================== [ 74.316840] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3df4/0x4858 [ 74.324334] Read of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 74.331737] [ 74.333262] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 74.333291] Tainted: [B]=BAD_PAGE, [N]=TEST [ 74.333298] Hardware name: Thundercomm Dragonboard 845c (DT) [ 74.333308] Call trace: [ 74.333315] show_stack+0x20/0x38 (C) [ 74.333332] dump_stack_lvl+0x8c/0xd0 [ 74.333350] print_report+0x118/0x608 [ 74.333369] kasan_report+0xdc/0x128 [ 74.333387] __asan_report_load8_noabort+0x20/0x30 [ 74.333404] kasan_atomics_helper+0x3df4/0x4858 [ 74.333423] kasan_atomics+0x198/0x2e0 [ 74.333440] kunit_try_run_case+0x170/0x3f0 [ 74.333457] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 74.333477] kthread+0x328/0x630 [ 74.333490] ret_from_fork+0x10/0x20 [ 74.333507] [ 74.403318] Allocated by task 351: [ 74.406773] kasan_save_stack+0x3c/0x68 [ 74.410672] kasan_save_track+0x20/0x40 [ 74.414569] kasan_save_alloc_info+0x40/0x58 [ 74.418908] __kasan_kmalloc+0xd4/0xd8 [ 74.422717] __kmalloc_cache_noprof+0x16c/0x3c0 [ 74.427319] kasan_atomics+0xb8/0x2e0 [ 74.431041] kunit_try_run_case+0x170/0x3f0 [ 74.435294] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 74.440864] kthread+0x328/0x630 [ 74.444150] ret_from_fork+0x10/0x20 [ 74.447784] [ 74.449306] The buggy address belongs to the object at ffff0000934cf200 [ 74.449306] which belongs to the cache kmalloc-64 of size 64 [ 74.461786] The buggy address is located 0 bytes to the right of [ 74.461786] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 74.474790] [ 74.476314] The buggy address belongs to the physical page: [ 74.481960] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 74.490057] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 74.496667] page_type: f5(slab) [ 74.499865] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 74.507703] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 74.515536] page dumped because: kasan: bad access detected [ 74.521183] [ 74.522705] Memory state around the buggy address: [ 74.527561] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 74.534873] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 74.542187] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 74.549497] ^ [ 74.554353] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.561665] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.568977] ================================================================== [ 72.420642] ================================================================== [ 72.427956] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x1414/0x4858 [ 72.435449] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 72.442939] [ 72.444465] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 72.444494] Tainted: [B]=BAD_PAGE, [N]=TEST [ 72.444503] Hardware name: Thundercomm Dragonboard 845c (DT) [ 72.444513] Call trace: [ 72.444518] show_stack+0x20/0x38 (C) [ 72.444535] dump_stack_lvl+0x8c/0xd0 [ 72.444552] print_report+0x118/0x608 [ 72.444571] kasan_report+0xdc/0x128 [ 72.444589] kasan_check_range+0x100/0x1a8 [ 72.444608] __kasan_check_write+0x20/0x30 [ 72.444622] kasan_atomics_helper+0x1414/0x4858 [ 72.444641] kasan_atomics+0x198/0x2e0 [ 72.444658] kunit_try_run_case+0x170/0x3f0 [ 72.444675] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 72.444696] kthread+0x328/0x630 [ 72.444711] ret_from_fork+0x10/0x20 [ 72.444727] [ 72.517971] Allocated by task 351: [ 72.521426] kasan_save_stack+0x3c/0x68 [ 72.525326] kasan_save_track+0x20/0x40 [ 72.529223] kasan_save_alloc_info+0x40/0x58 [ 72.533562] __kasan_kmalloc+0xd4/0xd8 [ 72.537371] __kmalloc_cache_noprof+0x16c/0x3c0 [ 72.541973] kasan_atomics+0xb8/0x2e0 [ 72.545695] kunit_try_run_case+0x170/0x3f0 [ 72.549948] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 72.555507] kthread+0x328/0x630 [ 72.558792] ret_from_fork+0x10/0x20 [ 72.562427] [ 72.563950] The buggy address belongs to the object at ffff0000934cf200 [ 72.563950] which belongs to the cache kmalloc-64 of size 64 [ 72.576429] The buggy address is located 0 bytes to the right of [ 72.576429] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 72.589432] [ 72.590955] The buggy address belongs to the physical page: [ 72.596601] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 72.604698] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 72.611307] page_type: f5(slab) [ 72.614505] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 72.622342] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 72.630175] page dumped because: kasan: bad access detected [ 72.635822] [ 72.637344] Memory state around the buggy address: [ 72.642199] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 72.649513] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 72.656826] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 72.664137] ^ [ 72.668993] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.676305] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.683615] ================================================================== [ 61.101694] ================================================================== [ 61.109007] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x47c/0x4858 [ 61.116413] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 61.123904] [ 61.125430] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 61.125458] Tainted: [B]=BAD_PAGE, [N]=TEST [ 61.125466] Hardware name: Thundercomm Dragonboard 845c (DT) [ 61.125476] Call trace: [ 61.125481] show_stack+0x20/0x38 (C) [ 61.125499] dump_stack_lvl+0x8c/0xd0 [ 61.125518] print_report+0x118/0x608 [ 61.125537] kasan_report+0xdc/0x128 [ 61.125554] kasan_check_range+0x100/0x1a8 [ 61.125573] __kasan_check_write+0x20/0x30 [ 61.125588] kasan_atomics_helper+0x47c/0x4858 [ 61.125606] kasan_atomics+0x198/0x2e0 [ 61.125622] kunit_try_run_case+0x170/0x3f0 [ 61.125640] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 61.125661] kthread+0x328/0x630 [ 61.125675] ret_from_fork+0x10/0x20 [ 61.125692] [ 61.198838] Allocated by task 351: [ 61.202295] kasan_save_stack+0x3c/0x68 [ 61.206193] kasan_save_track+0x20/0x40 [ 61.210090] kasan_save_alloc_info+0x40/0x58 [ 61.214429] __kasan_kmalloc+0xd4/0xd8 [ 61.218240] __kmalloc_cache_noprof+0x16c/0x3c0 [ 61.222841] kasan_atomics+0xb8/0x2e0 [ 61.226564] kunit_try_run_case+0x170/0x3f0 [ 61.230818] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 61.236387] kthread+0x328/0x630 [ 61.239674] ret_from_fork+0x10/0x20 [ 61.243308] [ 61.244841] The buggy address belongs to the object at ffff0000934cf200 [ 61.244841] which belongs to the cache kmalloc-64 of size 64 [ 61.257318] The buggy address is located 0 bytes to the right of [ 61.257318] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 61.270322] [ 61.271846] The buggy address belongs to the physical page: [ 61.277492] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 61.285591] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 61.292200] page_type: f5(slab) [ 61.295400] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 61.303238] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 61.311073] page dumped because: kasan: bad access detected [ 61.316721] [ 61.318243] Memory state around the buggy address: [ 61.323098] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 61.330411] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 61.337723] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 61.345034] ^ [ 61.349891] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.357203] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.364513] ================================================================== [ 69.990890] ================================================================== [ 69.998203] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x1058/0x4858 [ 70.005694] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 70.013183] [ 70.014708] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 70.014737] Tainted: [B]=BAD_PAGE, [N]=TEST [ 70.014745] Hardware name: Thundercomm Dragonboard 845c (DT) [ 70.014756] Call trace: [ 70.014762] show_stack+0x20/0x38 (C) [ 70.014779] dump_stack_lvl+0x8c/0xd0 [ 70.014796] print_report+0x118/0x608 [ 70.014815] kasan_report+0xdc/0x128 [ 70.014833] kasan_check_range+0x100/0x1a8 [ 70.014854] __kasan_check_write+0x20/0x30 [ 70.014871] kasan_atomics_helper+0x1058/0x4858 [ 70.014889] kasan_atomics+0x198/0x2e0 [ 70.014906] kunit_try_run_case+0x170/0x3f0 [ 70.014924] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 70.014943] kthread+0x328/0x630 [ 70.014958] ret_from_fork+0x10/0x20 [ 70.014975] [ 70.088207] Allocated by task 351: [ 70.091663] kasan_save_stack+0x3c/0x68 [ 70.095561] kasan_save_track+0x20/0x40 [ 70.099458] kasan_save_alloc_info+0x40/0x58 [ 70.103797] __kasan_kmalloc+0xd4/0xd8 [ 70.107605] __kmalloc_cache_noprof+0x16c/0x3c0 [ 70.112207] kasan_atomics+0xb8/0x2e0 [ 70.115928] kunit_try_run_case+0x170/0x3f0 [ 70.120182] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 70.125742] kthread+0x328/0x630 [ 70.129028] ret_from_fork+0x10/0x20 [ 70.132663] [ 70.134186] The buggy address belongs to the object at ffff0000934cf200 [ 70.134186] which belongs to the cache kmalloc-64 of size 64 [ 70.146666] The buggy address is located 0 bytes to the right of [ 70.146666] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 70.159670] [ 70.161193] The buggy address belongs to the physical page: [ 70.166840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 70.174938] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 70.181547] page_type: f5(slab) [ 70.184745] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 70.192582] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 70.200417] page dumped because: kasan: bad access detected [ 70.206063] [ 70.207586] Memory state around the buggy address: [ 70.212441] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 70.219753] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 70.227068] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 70.234378] ^ [ 70.239234] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.246546] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.253856] ================================================================== [ 64.610817] ================================================================== [ 64.618127] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xa04/0x4858 [ 64.625532] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 64.633023] [ 64.634549] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 64.634577] Tainted: [B]=BAD_PAGE, [N]=TEST [ 64.634584] Hardware name: Thundercomm Dragonboard 845c (DT) [ 64.634594] Call trace: [ 64.634601] show_stack+0x20/0x38 (C) [ 64.634617] dump_stack_lvl+0x8c/0xd0 [ 64.634635] print_report+0x118/0x608 [ 64.634655] kasan_report+0xdc/0x128 [ 64.634673] kasan_check_range+0x100/0x1a8 [ 64.634693] __kasan_check_write+0x20/0x30 [ 64.634708] kasan_atomics_helper+0xa04/0x4858 [ 64.634727] kasan_atomics+0x198/0x2e0 [ 64.634744] kunit_try_run_case+0x170/0x3f0 [ 64.634762] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 64.634782] kthread+0x328/0x630 [ 64.634797] ret_from_fork+0x10/0x20 [ 64.634813] [ 64.707962] Allocated by task 351: [ 64.711418] kasan_save_stack+0x3c/0x68 [ 64.715315] kasan_save_track+0x20/0x40 [ 64.719212] kasan_save_alloc_info+0x40/0x58 [ 64.723551] __kasan_kmalloc+0xd4/0xd8 [ 64.727360] __kmalloc_cache_noprof+0x16c/0x3c0 [ 64.731961] kasan_atomics+0xb8/0x2e0 [ 64.735683] kunit_try_run_case+0x170/0x3f0 [ 64.739936] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 64.745505] kthread+0x328/0x630 [ 64.748792] ret_from_fork+0x10/0x20 [ 64.752427] [ 64.753949] The buggy address belongs to the object at ffff0000934cf200 [ 64.753949] which belongs to the cache kmalloc-64 of size 64 [ 64.766428] The buggy address is located 0 bytes to the right of [ 64.766428] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 64.779431] [ 64.780956] The buggy address belongs to the physical page: [ 64.786601] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 64.794699] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 64.801308] page_type: f5(slab) [ 64.804508] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 64.812345] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 64.820179] page dumped because: kasan: bad access detected [ 64.825829] [ 64.827352] Memory state around the buggy address: [ 64.832218] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 64.839539] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 64.846856] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 64.854169] ^ [ 64.859028] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.866343] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.873657] ================================================================== [ 75.650653] ================================================================== [ 75.657964] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x17ec/0x4858 [ 75.665457] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 75.672947] [ 75.674472] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 75.674500] Tainted: [B]=BAD_PAGE, [N]=TEST [ 75.674507] Hardware name: Thundercomm Dragonboard 845c (DT) [ 75.674517] Call trace: [ 75.674522] show_stack+0x20/0x38 (C) [ 75.674539] dump_stack_lvl+0x8c/0xd0 [ 75.674557] print_report+0x118/0x608 [ 75.674576] kasan_report+0xdc/0x128 [ 75.674593] kasan_check_range+0x100/0x1a8 [ 75.674613] __kasan_check_write+0x20/0x30 [ 75.674628] kasan_atomics_helper+0x17ec/0x4858 [ 75.674647] kasan_atomics+0x198/0x2e0 [ 75.674664] kunit_try_run_case+0x170/0x3f0 [ 75.674681] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 75.674701] kthread+0x328/0x630 [ 75.674715] ret_from_fork+0x10/0x20 [ 75.674731] [ 75.747952] Allocated by task 351: [ 75.751408] kasan_save_stack+0x3c/0x68 [ 75.755306] kasan_save_track+0x20/0x40 [ 75.759203] kasan_save_alloc_info+0x40/0x58 [ 75.763541] __kasan_kmalloc+0xd4/0xd8 [ 75.767350] __kmalloc_cache_noprof+0x16c/0x3c0 [ 75.771952] kasan_atomics+0xb8/0x2e0 [ 75.775673] kunit_try_run_case+0x170/0x3f0 [ 75.779927] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 75.785496] kthread+0x328/0x630 [ 75.788782] ret_from_fork+0x10/0x20 [ 75.792417] [ 75.793939] The buggy address belongs to the object at ffff0000934cf200 [ 75.793939] which belongs to the cache kmalloc-64 of size 64 [ 75.806418] The buggy address is located 0 bytes to the right of [ 75.806418] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 75.819422] [ 75.820945] The buggy address belongs to the physical page: [ 75.826592] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 75.834689] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 75.841296] page_type: f5(slab) [ 75.844496] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 75.852332] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 75.860165] page dumped because: kasan: bad access detected [ 75.865812] [ 75.867334] Memory state around the buggy address: [ 75.872189] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 75.879502] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 75.886814] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 75.894124] ^ [ 75.898980] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.906292] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.913602] ================================================================== [ 68.373030] ================================================================== [ 68.380344] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xe44/0x4858 [ 68.387749] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 68.395238] [ 68.396763] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 68.396791] Tainted: [B]=BAD_PAGE, [N]=TEST [ 68.396799] Hardware name: Thundercomm Dragonboard 845c (DT) [ 68.396809] Call trace: [ 68.396816] show_stack+0x20/0x38 (C) [ 68.396833] dump_stack_lvl+0x8c/0xd0 [ 68.396851] print_report+0x118/0x608 [ 68.396869] kasan_report+0xdc/0x128 [ 68.396887] kasan_check_range+0x100/0x1a8 [ 68.396908] __kasan_check_write+0x20/0x30 [ 68.396925] kasan_atomics_helper+0xe44/0x4858 [ 68.396942] kasan_atomics+0x198/0x2e0 [ 68.396959] kunit_try_run_case+0x170/0x3f0 [ 68.396976] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 68.396998] kthread+0x328/0x630 [ 68.397011] ret_from_fork+0x10/0x20 [ 68.397027] [ 68.470186] Allocated by task 351: [ 68.473642] kasan_save_stack+0x3c/0x68 [ 68.477539] kasan_save_track+0x20/0x40 [ 68.481436] kasan_save_alloc_info+0x40/0x58 [ 68.485775] __kasan_kmalloc+0xd4/0xd8 [ 68.489583] __kmalloc_cache_noprof+0x16c/0x3c0 [ 68.494185] kasan_atomics+0xb8/0x2e0 [ 68.497906] kunit_try_run_case+0x170/0x3f0 [ 68.502161] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 68.507730] kthread+0x328/0x630 [ 68.511015] ret_from_fork+0x10/0x20 [ 68.514650] [ 68.516171] The buggy address belongs to the object at ffff0000934cf200 [ 68.516171] which belongs to the cache kmalloc-64 of size 64 [ 68.528650] The buggy address is located 0 bytes to the right of [ 68.528650] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 68.541654] [ 68.543177] The buggy address belongs to the physical page: [ 68.548824] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 68.556921] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 68.563530] page_type: f5(slab) [ 68.566729] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 68.574567] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 68.582400] page dumped because: kasan: bad access detected [ 68.588046] [ 68.589568] Memory state around the buggy address: [ 68.594423] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 68.601735] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 68.609048] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 68.616359] ^ [ 68.621216] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.628528] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 68.635840] ================================================================== [ 62.722848] ================================================================== [ 62.730160] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x6ec/0x4858 [ 62.737566] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 62.745055] [ 62.746581] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 62.746609] Tainted: [B]=BAD_PAGE, [N]=TEST [ 62.746617] Hardware name: Thundercomm Dragonboard 845c (DT) [ 62.746628] Call trace: [ 62.746634] show_stack+0x20/0x38 (C) [ 62.746650] dump_stack_lvl+0x8c/0xd0 [ 62.746668] print_report+0x118/0x608 [ 62.746686] kasan_report+0xdc/0x128 [ 62.746704] kasan_check_range+0x100/0x1a8 [ 62.746722] __kasan_check_write+0x20/0x30 [ 62.746738] kasan_atomics_helper+0x6ec/0x4858 [ 62.746756] kasan_atomics+0x198/0x2e0 [ 62.746774] kunit_try_run_case+0x170/0x3f0 [ 62.746792] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 62.746812] kthread+0x328/0x630 [ 62.746826] ret_from_fork+0x10/0x20 [ 62.746842] [ 62.820003] Allocated by task 351: [ 62.823459] kasan_save_stack+0x3c/0x68 [ 62.827357] kasan_save_track+0x20/0x40 [ 62.831254] kasan_save_alloc_info+0x40/0x58 [ 62.835593] __kasan_kmalloc+0xd4/0xd8 [ 62.839401] __kmalloc_cache_noprof+0x16c/0x3c0 [ 62.844004] kasan_atomics+0xb8/0x2e0 [ 62.847727] kunit_try_run_case+0x170/0x3f0 [ 62.851980] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 62.857539] kthread+0x328/0x630 [ 62.860825] ret_from_fork+0x10/0x20 [ 62.864461] [ 62.865984] The buggy address belongs to the object at ffff0000934cf200 [ 62.865984] which belongs to the cache kmalloc-64 of size 64 [ 62.878467] The buggy address is located 0 bytes to the right of [ 62.878467] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 62.891471] [ 62.892995] The buggy address belongs to the physical page: [ 62.898642] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 62.906739] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 62.913348] page_type: f5(slab) [ 62.916548] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 62.924386] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 62.932219] page dumped because: kasan: bad access detected [ 62.937867] [ 62.939390] Memory state around the buggy address: [ 62.944245] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 62.951559] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 62.958873] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 62.966185] ^ [ 62.971041] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 62.978354] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 62.985665] ================================================================== [ 61.642068] ================================================================== [ 61.649382] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x54c/0x4858 [ 61.656787] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 61.664278] [ 61.665803] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 61.665831] Tainted: [B]=BAD_PAGE, [N]=TEST [ 61.665838] Hardware name: Thundercomm Dragonboard 845c (DT) [ 61.665847] Call trace: [ 61.665853] show_stack+0x20/0x38 (C) [ 61.665869] dump_stack_lvl+0x8c/0xd0 [ 61.665887] print_report+0x118/0x608 [ 61.665904] kasan_report+0xdc/0x128 [ 61.665922] kasan_check_range+0x100/0x1a8 [ 61.665941] __kasan_check_write+0x20/0x30 [ 61.665957] kasan_atomics_helper+0x54c/0x4858 [ 61.665974] kasan_atomics+0x198/0x2e0 [ 61.665991] kunit_try_run_case+0x170/0x3f0 [ 61.666009] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 61.666029] kthread+0x328/0x630 [ 61.666041] ret_from_fork+0x10/0x20 [ 61.666057] [ 61.739214] Allocated by task 351: [ 61.742670] kasan_save_stack+0x3c/0x68 [ 61.746567] kasan_save_track+0x20/0x40 [ 61.750464] kasan_save_alloc_info+0x40/0x58 [ 61.754801] __kasan_kmalloc+0xd4/0xd8 [ 61.758610] __kmalloc_cache_noprof+0x16c/0x3c0 [ 61.763211] kasan_atomics+0xb8/0x2e0 [ 61.766933] kunit_try_run_case+0x170/0x3f0 [ 61.771187] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 61.776755] kthread+0x328/0x630 [ 61.780041] ret_from_fork+0x10/0x20 [ 61.783676] [ 61.785198] The buggy address belongs to the object at ffff0000934cf200 [ 61.785198] which belongs to the cache kmalloc-64 of size 64 [ 61.797676] The buggy address is located 0 bytes to the right of [ 61.797676] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 61.810679] [ 61.812203] The buggy address belongs to the physical page: [ 61.817849] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 61.825946] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 61.832554] page_type: f5(slab) [ 61.835754] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 61.843592] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 61.851424] page dumped because: kasan: bad access detected [ 61.857072] [ 61.858594] Memory state around the buggy address: [ 61.863450] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 61.870763] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 61.878075] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 61.885387] ^ [ 61.890244] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.897557] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.904869] ================================================================== [ 71.072363] ================================================================== [ 71.079679] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x11f8/0x4858 [ 71.087173] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 71.094666] [ 71.096191] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 71.096222] Tainted: [B]=BAD_PAGE, [N]=TEST [ 71.096231] Hardware name: Thundercomm Dragonboard 845c (DT) [ 71.096241] Call trace: [ 71.096246] show_stack+0x20/0x38 (C) [ 71.096264] dump_stack_lvl+0x8c/0xd0 [ 71.096283] print_report+0x118/0x608 [ 71.096301] kasan_report+0xdc/0x128 [ 71.096318] kasan_check_range+0x100/0x1a8 [ 71.096338] __kasan_check_write+0x20/0x30 [ 71.096355] kasan_atomics_helper+0x11f8/0x4858 [ 71.096375] kasan_atomics+0x198/0x2e0 [ 71.096392] kunit_try_run_case+0x170/0x3f0 [ 71.096409] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 71.096430] kthread+0x328/0x630 [ 71.096443] ret_from_fork+0x10/0x20 [ 71.096460] [ 71.169695] Allocated by task 351: [ 71.173152] kasan_save_stack+0x3c/0x68 [ 71.177051] kasan_save_track+0x20/0x40 [ 71.180947] kasan_save_alloc_info+0x40/0x58 [ 71.185285] __kasan_kmalloc+0xd4/0xd8 [ 71.189095] __kmalloc_cache_noprof+0x16c/0x3c0 [ 71.193697] kasan_atomics+0xb8/0x2e0 [ 71.197419] kunit_try_run_case+0x170/0x3f0 [ 71.201672] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 71.207241] kthread+0x328/0x630 [ 71.210526] ret_from_fork+0x10/0x20 [ 71.214162] [ 71.215684] The buggy address belongs to the object at ffff0000934cf200 [ 71.215684] which belongs to the cache kmalloc-64 of size 64 [ 71.228165] The buggy address is located 0 bytes to the right of [ 71.228165] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 71.241170] [ 71.242693] The buggy address belongs to the physical page: [ 71.248339] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 71.256436] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 71.263046] page_type: f5(slab) [ 71.266245] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 71.274083] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 71.281916] page dumped because: kasan: bad access detected [ 71.287562] [ 71.289085] Memory state around the buggy address: [ 71.293941] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 71.301254] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 71.308567] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 71.315878] ^ [ 71.320735] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.328047] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.335358] ================================================================== [ 64.881056] ================================================================== [ 64.888373] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0xa6c/0x4858 [ 64.895781] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 64.903273] [ 64.904801] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 64.904831] Tainted: [B]=BAD_PAGE, [N]=TEST [ 64.904839] Hardware name: Thundercomm Dragonboard 845c (DT) [ 64.904849] Call trace: [ 64.904855] show_stack+0x20/0x38 (C) [ 64.904874] dump_stack_lvl+0x8c/0xd0 [ 64.904892] print_report+0x118/0x608 [ 64.904911] kasan_report+0xdc/0x128 [ 64.904929] kasan_check_range+0x100/0x1a8 [ 64.904948] __kasan_check_write+0x20/0x30 [ 64.904963] kasan_atomics_helper+0xa6c/0x4858 [ 64.904983] kasan_atomics+0x198/0x2e0 [ 64.905000] kunit_try_run_case+0x170/0x3f0 [ 64.905019] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 64.905039] kthread+0x328/0x630 [ 64.905052] ret_from_fork+0x10/0x20 [ 64.905069] [ 64.978231] Allocated by task 351: [ 64.981689] kasan_save_stack+0x3c/0x68 [ 64.985588] kasan_save_track+0x20/0x40 [ 64.989486] kasan_save_alloc_info+0x40/0x58 [ 64.993824] __kasan_kmalloc+0xd4/0xd8 [ 64.997632] __kmalloc_cache_noprof+0x16c/0x3c0 [ 65.002234] kasan_atomics+0xb8/0x2e0 [ 65.005956] kunit_try_run_case+0x170/0x3f0 [ 65.010211] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 65.015769] kthread+0x328/0x630 [ 65.019056] ret_from_fork+0x10/0x20 [ 65.022690] [ 65.024214] The buggy address belongs to the object at ffff0000934cf200 [ 65.024214] which belongs to the cache kmalloc-64 of size 64 [ 65.036696] The buggy address is located 0 bytes to the right of [ 65.036696] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 65.049700] [ 65.051225] The buggy address belongs to the physical page: [ 65.056872] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 65.064969] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 65.071579] page_type: f5(slab) [ 65.074779] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 65.082618] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 65.090451] page dumped because: kasan: bad access detected [ 65.096098] [ 65.097622] Memory state around the buggy address: [ 65.102478] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.109791] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.117106] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 65.124417] ^ [ 65.129275] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.136587] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.143899] ================================================================== [ 60.294195] ================================================================== [ 60.301517] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3f94/0x4858 [ 60.309019] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 60.316514] [ 60.318043] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 60.318073] Tainted: [B]=BAD_PAGE, [N]=TEST [ 60.318082] Hardware name: Thundercomm Dragonboard 845c (DT) [ 60.318094] Call trace: [ 60.318102] show_stack+0x20/0x38 (C) [ 60.318121] dump_stack_lvl+0x8c/0xd0 [ 60.318141] print_report+0x118/0x608 [ 60.318160] kasan_report+0xdc/0x128 [ 60.318178] __asan_report_store4_noabort+0x20/0x30 [ 60.318195] kasan_atomics_helper+0x3f94/0x4858 [ 60.318215] kasan_atomics+0x198/0x2e0 [ 60.318232] kunit_try_run_case+0x170/0x3f0 [ 60.318249] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 60.318271] kthread+0x328/0x630 [ 60.318285] ret_from_fork+0x10/0x20 [ 60.318303] [ 60.388184] Allocated by task 351: [ 60.391640] kasan_save_stack+0x3c/0x68 [ 60.395547] kasan_save_track+0x20/0x40 [ 60.399451] kasan_save_alloc_info+0x40/0x58 [ 60.403784] __kasan_kmalloc+0xd4/0xd8 [ 60.407591] __kmalloc_cache_noprof+0x16c/0x3c0 [ 60.412189] kasan_atomics+0xb8/0x2e0 [ 60.415908] kunit_try_run_case+0x170/0x3f0 [ 60.420156] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 60.425723] kthread+0x328/0x630 [ 60.429005] ret_from_fork+0x10/0x20 [ 60.432636] [ 60.434159] The buggy address belongs to the object at ffff0000934cf200 [ 60.434159] which belongs to the cache kmalloc-64 of size 64 [ 60.446638] The buggy address is located 0 bytes to the right of [ 60.446638] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 60.459649] [ 60.461171] The buggy address belongs to the physical page: [ 60.466816] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 60.474915] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 60.481528] page_type: f5(slab) [ 60.484723] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 60.492566] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 60.500397] page dumped because: kasan: bad access detected [ 60.506040] [ 60.507571] Memory state around the buggy address: [ 60.512424] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.519741] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.527051] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 60.534363] ^ [ 60.539216] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.546523] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.553836] ================================================================== [ 65.421457] ================================================================== [ 65.428771] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3dcc/0x4858 [ 65.436265] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 65.443668] [ 65.445195] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 65.445224] Tainted: [B]=BAD_PAGE, [N]=TEST [ 65.445233] Hardware name: Thundercomm Dragonboard 845c (DT) [ 65.445244] Call trace: [ 65.445250] show_stack+0x20/0x38 (C) [ 65.445267] dump_stack_lvl+0x8c/0xd0 [ 65.445284] print_report+0x118/0x608 [ 65.445302] kasan_report+0xdc/0x128 [ 65.445320] __asan_report_load4_noabort+0x20/0x30 [ 65.445337] kasan_atomics_helper+0x3dcc/0x4858 [ 65.445355] kasan_atomics+0x198/0x2e0 [ 65.445372] kunit_try_run_case+0x170/0x3f0 [ 65.445390] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 65.445411] kthread+0x328/0x630 [ 65.445425] ret_from_fork+0x10/0x20 [ 65.445441] [ 65.515244] Allocated by task 351: [ 65.518701] kasan_save_stack+0x3c/0x68 [ 65.522600] kasan_save_track+0x20/0x40 [ 65.526499] kasan_save_alloc_info+0x40/0x58 [ 65.530838] __kasan_kmalloc+0xd4/0xd8 [ 65.534646] __kmalloc_cache_noprof+0x16c/0x3c0 [ 65.539249] kasan_atomics+0xb8/0x2e0 [ 65.542970] kunit_try_run_case+0x170/0x3f0 [ 65.547225] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 65.552795] kthread+0x328/0x630 [ 65.556081] ret_from_fork+0x10/0x20 [ 65.559717] [ 65.561239] The buggy address belongs to the object at ffff0000934cf200 [ 65.561239] which belongs to the cache kmalloc-64 of size 64 [ 65.573721] The buggy address is located 0 bytes to the right of [ 65.573721] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 65.586724] [ 65.588248] The buggy address belongs to the physical page: [ 65.593896] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 65.601993] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 65.608602] page_type: f5(slab) [ 65.611802] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 65.619639] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 65.627473] page dumped because: kasan: bad access detected [ 65.633121] [ 65.634642] Memory state around the buggy address: [ 65.639499] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.646812] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.654126] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 65.661438] ^ [ 65.666295] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.673608] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.680919] ================================================================== [ 58.402238] ================================================================== [ 58.417295] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x40a8/0x4858 [ 58.424797] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 58.432208] [ 58.433739] CPU: 7 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 58.433771] Tainted: [B]=BAD_PAGE, [N]=TEST [ 58.433780] Hardware name: Thundercomm Dragonboard 845c (DT) [ 58.433795] Call trace: [ 58.433802] show_stack+0x20/0x38 (C) [ 58.433822] dump_stack_lvl+0x8c/0xd0 [ 58.433841] print_report+0x118/0x608 [ 58.433860] kasan_report+0xdc/0x128 [ 58.433878] __asan_report_load4_noabort+0x20/0x30 [ 58.433895] kasan_atomics_helper+0x40a8/0x4858 [ 58.433914] kasan_atomics+0x198/0x2e0 [ 58.433932] kunit_try_run_case+0x170/0x3f0 [ 58.433952] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 58.433973] kthread+0x328/0x630 [ 58.433989] ret_from_fork+0x10/0x20 [ 58.434007] [ 58.503820] Allocated by task 351: [ 58.507278] kasan_save_stack+0x3c/0x68 [ 58.511175] kasan_save_track+0x20/0x40 [ 58.515069] kasan_save_alloc_info+0x40/0x58 [ 58.519403] __kasan_kmalloc+0xd4/0xd8 [ 58.523210] __kmalloc_cache_noprof+0x16c/0x3c0 [ 58.527805] kasan_atomics+0xb8/0x2e0 [ 58.531524] kunit_try_run_case+0x170/0x3f0 [ 58.535774] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 58.541340] kthread+0x328/0x630 [ 58.544621] ret_from_fork+0x10/0x20 [ 58.548253] [ 58.549777] The buggy address belongs to the object at ffff0000934cf200 [ 58.549777] which belongs to the cache kmalloc-64 of size 64 [ 58.562259] The buggy address is located 0 bytes to the right of [ 58.562259] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 58.575264] [ 58.576796] The buggy address belongs to the physical page: [ 58.582438] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 58.590537] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 58.597148] page_type: f5(slab) [ 58.600343] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 58.608183] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 58.616018] page dumped because: kasan: bad access detected [ 58.621659] [ 58.623191] Memory state around the buggy address: [ 58.628049] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 58.635366] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 58.642680] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 58.649993] ^ [ 58.654845] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.662159] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.669472] ================================================================== [ 72.690986] ================================================================== [ 72.698299] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x147c/0x4858 [ 72.705791] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 72.713281] [ 72.714806] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 72.714834] Tainted: [B]=BAD_PAGE, [N]=TEST [ 72.714843] Hardware name: Thundercomm Dragonboard 845c (DT) [ 72.714853] Call trace: [ 72.714859] show_stack+0x20/0x38 (C) [ 72.714876] dump_stack_lvl+0x8c/0xd0 [ 72.714893] print_report+0x118/0x608 [ 72.714912] kasan_report+0xdc/0x128 [ 72.714930] kasan_check_range+0x100/0x1a8 [ 72.714949] __kasan_check_write+0x20/0x30 [ 72.714964] kasan_atomics_helper+0x147c/0x4858 [ 72.714983] kasan_atomics+0x198/0x2e0 [ 72.715000] kunit_try_run_case+0x170/0x3f0 [ 72.715018] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 72.715039] kthread+0x328/0x630 [ 72.715052] ret_from_fork+0x10/0x20 [ 72.715069] [ 72.788302] Allocated by task 351: [ 72.791758] kasan_save_stack+0x3c/0x68 [ 72.795657] kasan_save_track+0x20/0x40 [ 72.799554] kasan_save_alloc_info+0x40/0x58 [ 72.803893] __kasan_kmalloc+0xd4/0xd8 [ 72.807702] __kmalloc_cache_noprof+0x16c/0x3c0 [ 72.812304] kasan_atomics+0xb8/0x2e0 [ 72.816026] kunit_try_run_case+0x170/0x3f0 [ 72.820279] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 72.825848] kthread+0x328/0x630 [ 72.829135] ret_from_fork+0x10/0x20 [ 72.832771] [ 72.834293] The buggy address belongs to the object at ffff0000934cf200 [ 72.834293] which belongs to the cache kmalloc-64 of size 64 [ 72.846774] The buggy address is located 0 bytes to the right of [ 72.846774] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 72.859777] [ 72.861301] The buggy address belongs to the physical page: [ 72.866948] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 72.875044] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 72.881653] page_type: f5(slab) [ 72.884853] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 72.892690] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 72.900523] page dumped because: kasan: bad access detected [ 72.906170] [ 72.907692] Memory state around the buggy address: [ 72.912548] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 72.919861] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 72.927175] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 72.934487] ^ [ 72.939343] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.946656] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.953966] ================================================================== [ 72.961349] ================================================================== [ 72.968663] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x14e4/0x4858 [ 72.976155] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 72.983645] [ 72.985170] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 72.985198] Tainted: [B]=BAD_PAGE, [N]=TEST [ 72.985207] Hardware name: Thundercomm Dragonboard 845c (DT) [ 72.985217] Call trace: [ 72.985222] show_stack+0x20/0x38 (C) [ 72.985239] dump_stack_lvl+0x8c/0xd0 [ 72.985257] print_report+0x118/0x608 [ 72.985275] kasan_report+0xdc/0x128 [ 72.985294] kasan_check_range+0x100/0x1a8 [ 72.985313] __kasan_check_write+0x20/0x30 [ 72.985329] kasan_atomics_helper+0x14e4/0x4858 [ 72.985347] kasan_atomics+0x198/0x2e0 [ 72.985364] kunit_try_run_case+0x170/0x3f0 [ 72.985381] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 72.985402] kthread+0x328/0x630 [ 72.985416] ret_from_fork+0x10/0x20 [ 72.985432] [ 73.058677] Allocated by task 351: [ 73.062133] kasan_save_stack+0x3c/0x68 [ 73.066032] kasan_save_track+0x20/0x40 [ 73.069929] kasan_save_alloc_info+0x40/0x58 [ 73.074267] __kasan_kmalloc+0xd4/0xd8 [ 73.078076] __kmalloc_cache_noprof+0x16c/0x3c0 [ 73.082678] kasan_atomics+0xb8/0x2e0 [ 73.086400] kunit_try_run_case+0x170/0x3f0 [ 73.090653] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 73.096222] kthread+0x328/0x630 [ 73.099509] ret_from_fork+0x10/0x20 [ 73.103143] [ 73.104666] The buggy address belongs to the object at ffff0000934cf200 [ 73.104666] which belongs to the cache kmalloc-64 of size 64 [ 73.117146] The buggy address is located 0 bytes to the right of [ 73.117146] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 73.130149] [ 73.131672] The buggy address belongs to the physical page: [ 73.137318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 73.145415] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 73.152023] page_type: f5(slab) [ 73.155222] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 73.163060] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 73.170893] page dumped because: kasan: bad access detected [ 73.176540] [ 73.178063] Memory state around the buggy address: [ 73.182919] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 73.190232] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 73.197546] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 73.204856] ^ [ 73.209712] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.217024] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.224334] ================================================================== [ 73.772384] ================================================================== [ 73.779698] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3db0/0x4858 [ 73.787191] Read of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 73.794594] [ 73.796119] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 73.796147] Tainted: [B]=BAD_PAGE, [N]=TEST [ 73.796155] Hardware name: Thundercomm Dragonboard 845c (DT) [ 73.796164] Call trace: [ 73.796170] show_stack+0x20/0x38 (C) [ 73.796187] dump_stack_lvl+0x8c/0xd0 [ 73.796204] print_report+0x118/0x608 [ 73.796223] kasan_report+0xdc/0x128 [ 73.796241] __asan_report_load8_noabort+0x20/0x30 [ 73.796257] kasan_atomics_helper+0x3db0/0x4858 [ 73.796276] kasan_atomics+0x198/0x2e0 [ 73.796292] kunit_try_run_case+0x170/0x3f0 [ 73.796310] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 73.796330] kthread+0x328/0x630 [ 73.796343] ret_from_fork+0x10/0x20 [ 73.796359] [ 73.866149] Allocated by task 351: [ 73.869606] kasan_save_stack+0x3c/0x68 [ 73.873504] kasan_save_track+0x20/0x40 [ 73.877400] kasan_save_alloc_info+0x40/0x58 [ 73.881738] __kasan_kmalloc+0xd4/0xd8 [ 73.885547] __kmalloc_cache_noprof+0x16c/0x3c0 [ 73.890149] kasan_atomics+0xb8/0x2e0 [ 73.893870] kunit_try_run_case+0x170/0x3f0 [ 73.898123] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 73.903692] kthread+0x328/0x630 [ 73.906977] ret_from_fork+0x10/0x20 [ 73.910612] [ 73.912134] The buggy address belongs to the object at ffff0000934cf200 [ 73.912134] which belongs to the cache kmalloc-64 of size 64 [ 73.924613] The buggy address is located 0 bytes to the right of [ 73.924613] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 73.937616] [ 73.939138] The buggy address belongs to the physical page: [ 73.944784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 73.952880] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 73.959488] page_type: f5(slab) [ 73.962687] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 73.970524] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 73.978358] page dumped because: kasan: bad access detected [ 73.984004] [ 73.985526] Memory state around the buggy address: [ 73.990381] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 73.997693] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 74.005006] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 74.012317] ^ [ 74.017174] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.024486] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.031796] ================================================================== [ 65.958472] ================================================================== [ 65.965785] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3dbc/0x4858 [ 65.973280] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 65.980683] [ 65.982208] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 65.982236] Tainted: [B]=BAD_PAGE, [N]=TEST [ 65.982245] Hardware name: Thundercomm Dragonboard 845c (DT) [ 65.982256] Call trace: [ 65.982264] show_stack+0x20/0x38 (C) [ 65.982281] dump_stack_lvl+0x8c/0xd0 [ 65.982298] print_report+0x118/0x608 [ 65.982316] kasan_report+0xdc/0x128 [ 65.982335] __asan_report_load4_noabort+0x20/0x30 [ 65.982351] kasan_atomics_helper+0x3dbc/0x4858 [ 65.982369] kasan_atomics+0x198/0x2e0 [ 65.982385] kunit_try_run_case+0x170/0x3f0 [ 65.982403] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 65.982423] kthread+0x328/0x630 [ 65.982437] ret_from_fork+0x10/0x20 [ 65.982454] [ 66.052253] Allocated by task 351: [ 66.055710] kasan_save_stack+0x3c/0x68 [ 66.059609] kasan_save_track+0x20/0x40 [ 66.063506] kasan_save_alloc_info+0x40/0x58 [ 66.067845] __kasan_kmalloc+0xd4/0xd8 [ 66.071654] __kmalloc_cache_noprof+0x16c/0x3c0 [ 66.076256] kasan_atomics+0xb8/0x2e0 [ 66.079978] kunit_try_run_case+0x170/0x3f0 [ 66.084231] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.089800] kthread+0x328/0x630 [ 66.093087] ret_from_fork+0x10/0x20 [ 66.096722] [ 66.098245] The buggy address belongs to the object at ffff0000934cf200 [ 66.098245] which belongs to the cache kmalloc-64 of size 64 [ 66.110725] The buggy address is located 0 bytes to the right of [ 66.110725] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 66.123730] [ 66.125253] The buggy address belongs to the physical page: [ 66.130900] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 66.138998] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 66.145606] page_type: f5(slab) [ 66.148806] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 66.156644] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 66.164478] page dumped because: kasan: bad access detected [ 66.170126] [ 66.171648] Memory state around the buggy address: [ 66.176503] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 66.183818] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 66.191131] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 66.198441] ^ [ 66.203299] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.210613] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.217924] ================================================================== [ 61.371886] ================================================================== [ 61.379201] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x4e4/0x4858 [ 61.386607] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 61.394098] [ 61.395624] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 61.395653] Tainted: [B]=BAD_PAGE, [N]=TEST [ 61.395660] Hardware name: Thundercomm Dragonboard 845c (DT) [ 61.395670] Call trace: [ 61.395676] show_stack+0x20/0x38 (C) [ 61.395693] dump_stack_lvl+0x8c/0xd0 [ 61.395710] print_report+0x118/0x608 [ 61.395728] kasan_report+0xdc/0x128 [ 61.395745] kasan_check_range+0x100/0x1a8 [ 61.395766] __kasan_check_write+0x20/0x30 [ 61.395780] kasan_atomics_helper+0x4e4/0x4858 [ 61.395797] kasan_atomics+0x198/0x2e0 [ 61.395814] kunit_try_run_case+0x170/0x3f0 [ 61.395831] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 61.395852] kthread+0x328/0x630 [ 61.395865] ret_from_fork+0x10/0x20 [ 61.395882] [ 61.469039] Allocated by task 351: [ 61.472495] kasan_save_stack+0x3c/0x68 [ 61.476393] kasan_save_track+0x20/0x40 [ 61.480290] kasan_save_alloc_info+0x40/0x58 [ 61.484628] __kasan_kmalloc+0xd4/0xd8 [ 61.488437] __kmalloc_cache_noprof+0x16c/0x3c0 [ 61.493038] kasan_atomics+0xb8/0x2e0 [ 61.496761] kunit_try_run_case+0x170/0x3f0 [ 61.501014] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 61.506573] kthread+0x328/0x630 [ 61.509860] ret_from_fork+0x10/0x20 [ 61.513495] [ 61.515018] The buggy address belongs to the object at ffff0000934cf200 [ 61.515018] which belongs to the cache kmalloc-64 of size 64 [ 61.527493] The buggy address is located 0 bytes to the right of [ 61.527493] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 61.540496] [ 61.542019] The buggy address belongs to the physical page: [ 61.547664] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 61.555762] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 61.562370] page_type: f5(slab) [ 61.565568] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 61.573406] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 61.581239] page dumped because: kasan: bad access detected [ 61.586886] [ 61.588408] Memory state around the buggy address: [ 61.593264] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 61.600577] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 61.607891] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 61.615202] ^ [ 61.620058] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.627371] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.634682] ================================================================== [ 61.912278] ================================================================== [ 61.919594] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x5b4/0x4858 [ 61.927001] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 61.934491] [ 61.936018] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 61.936045] Tainted: [B]=BAD_PAGE, [N]=TEST [ 61.936053] Hardware name: Thundercomm Dragonboard 845c (DT) [ 61.936064] Call trace: [ 61.936070] show_stack+0x20/0x38 (C) [ 61.936087] dump_stack_lvl+0x8c/0xd0 [ 61.936105] print_report+0x118/0x608 [ 61.936123] kasan_report+0xdc/0x128 [ 61.936141] kasan_check_range+0x100/0x1a8 [ 61.936161] __kasan_check_write+0x20/0x30 [ 61.936176] kasan_atomics_helper+0x5b4/0x4858 [ 61.936194] kasan_atomics+0x198/0x2e0 [ 61.936211] kunit_try_run_case+0x170/0x3f0 [ 61.936228] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 61.936249] kthread+0x328/0x630 [ 61.936263] ret_from_fork+0x10/0x20 [ 61.936279] [ 62.009439] Allocated by task 351: [ 62.012895] kasan_save_stack+0x3c/0x68 [ 62.016795] kasan_save_track+0x20/0x40 [ 62.020692] kasan_save_alloc_info+0x40/0x58 [ 62.025030] __kasan_kmalloc+0xd4/0xd8 [ 62.028840] __kmalloc_cache_noprof+0x16c/0x3c0 [ 62.033442] kasan_atomics+0xb8/0x2e0 [ 62.037164] kunit_try_run_case+0x170/0x3f0 [ 62.041417] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 62.046978] kthread+0x328/0x630 [ 62.050263] ret_from_fork+0x10/0x20 [ 62.053897] [ 62.055420] The buggy address belongs to the object at ffff0000934cf200 [ 62.055420] which belongs to the cache kmalloc-64 of size 64 [ 62.067900] The buggy address is located 0 bytes to the right of [ 62.067900] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 62.080903] [ 62.082426] The buggy address belongs to the physical page: [ 62.088073] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 62.096169] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 62.102778] page_type: f5(slab) [ 62.105977] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 62.113813] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 62.121647] page dumped because: kasan: bad access detected [ 62.127294] [ 62.128817] Memory state around the buggy address: [ 62.133673] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 62.140987] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 62.148300] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 62.155611] ^ [ 62.160468] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 62.167780] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 62.175091] ================================================================== [ 62.182481] ================================================================== [ 62.189795] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x61c/0x4858 [ 62.197201] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 62.204692] [ 62.206217] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 62.206245] Tainted: [B]=BAD_PAGE, [N]=TEST [ 62.206252] Hardware name: Thundercomm Dragonboard 845c (DT) [ 62.206262] Call trace: [ 62.206268] show_stack+0x20/0x38 (C) [ 62.206286] dump_stack_lvl+0x8c/0xd0 [ 62.206303] print_report+0x118/0x608 [ 62.206321] kasan_report+0xdc/0x128 [ 62.206338] kasan_check_range+0x100/0x1a8 [ 62.206357] __kasan_check_write+0x20/0x30 [ 62.206372] kasan_atomics_helper+0x61c/0x4858 [ 62.206391] kasan_atomics+0x198/0x2e0 [ 62.206407] kunit_try_run_case+0x170/0x3f0 [ 62.206425] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 62.206444] kthread+0x328/0x630 [ 62.206457] ret_from_fork+0x10/0x20 [ 62.206473] [ 62.279631] Allocated by task 351: [ 62.283087] kasan_save_stack+0x3c/0x68 [ 62.286986] kasan_save_track+0x20/0x40 [ 62.290884] kasan_save_alloc_info+0x40/0x58 [ 62.295222] __kasan_kmalloc+0xd4/0xd8 [ 62.299031] __kmalloc_cache_noprof+0x16c/0x3c0 [ 62.303633] kasan_atomics+0xb8/0x2e0 [ 62.307354] kunit_try_run_case+0x170/0x3f0 [ 62.311608] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 62.317177] kthread+0x328/0x630 [ 62.320462] ret_from_fork+0x10/0x20 [ 62.324097] [ 62.325619] The buggy address belongs to the object at ffff0000934cf200 [ 62.325619] which belongs to the cache kmalloc-64 of size 64 [ 62.338099] The buggy address is located 0 bytes to the right of [ 62.338099] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 62.351103] [ 62.352627] The buggy address belongs to the physical page: [ 62.358273] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 62.366370] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 62.372978] page_type: f5(slab) [ 62.376177] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 62.384014] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 62.391848] page dumped because: kasan: bad access detected [ 62.397496] [ 62.399019] Memory state around the buggy address: [ 62.403875] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 62.411188] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 62.418502] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 62.425813] ^ [ 62.430670] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 62.437982] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 62.445293] ================================================================== [ 58.944180] ================================================================== [ 58.951512] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x1ec/0x4858 [ 58.958930] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 58.966333] [ 58.967869] CPU: 0 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 58.967899] Tainted: [B]=BAD_PAGE, [N]=TEST [ 58.967909] Hardware name: Thundercomm Dragonboard 845c (DT) [ 58.967921] Call trace: [ 58.967930] show_stack+0x20/0x38 (C) [ 58.967948] dump_stack_lvl+0x8c/0xd0 [ 58.967967] print_report+0x118/0x608 [ 58.967988] kasan_report+0xdc/0x128 [ 58.968008] kasan_check_range+0x100/0x1a8 [ 58.968029] __kasan_check_read+0x20/0x30 [ 58.968047] kasan_atomics_helper+0x1ec/0x4858 [ 58.968066] kasan_atomics+0x198/0x2e0 [ 58.968086] kunit_try_run_case+0x170/0x3f0 [ 58.968106] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 58.968128] kthread+0x328/0x630 [ 58.968143] ret_from_fork+0x10/0x20 [ 58.968161] [ 59.041274] Allocated by task 351: [ 59.044740] kasan_save_stack+0x3c/0x68 [ 59.048647] kasan_save_track+0x20/0x40 [ 59.052553] kasan_save_alloc_info+0x40/0x58 [ 59.056898] __kasan_kmalloc+0xd4/0xd8 [ 59.060715] __kmalloc_cache_noprof+0x16c/0x3c0 [ 59.065322] kasan_atomics+0xb8/0x2e0 [ 59.069053] kunit_try_run_case+0x170/0x3f0 [ 59.073316] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 59.078886] kthread+0x328/0x630 [ 59.082174] ret_from_fork+0x10/0x20 [ 59.085817] [ 59.087348] The buggy address belongs to the object at ffff0000934cf200 [ 59.087348] which belongs to the cache kmalloc-64 of size 64 [ 59.099837] The buggy address is located 0 bytes to the right of [ 59.099837] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 59.112845] [ 59.114377] The buggy address belongs to the physical page: [ 59.120023] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 59.128128] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 59.134745] page_type: f5(slab) [ 59.137945] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 59.145794] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 59.153636] page dumped because: kasan: bad access detected [ 59.159283] [ 59.160813] Memory state around the buggy address: [ 59.165672] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 59.172988] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 59.180304] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 59.187618] ^ [ 59.192480] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.199795] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.207108] ================================================================== [ 60.831486] ================================================================== [ 60.838796] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x414/0x4858 [ 60.846196] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 60.853680] [ 60.855206] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 60.855235] Tainted: [B]=BAD_PAGE, [N]=TEST [ 60.855244] Hardware name: Thundercomm Dragonboard 845c (DT) [ 60.855255] Call trace: [ 60.855261] show_stack+0x20/0x38 (C) [ 60.855278] dump_stack_lvl+0x8c/0xd0 [ 60.855297] print_report+0x118/0x608 [ 60.855315] kasan_report+0xdc/0x128 [ 60.855334] kasan_check_range+0x100/0x1a8 [ 60.855353] __kasan_check_write+0x20/0x30 [ 60.855371] kasan_atomics_helper+0x414/0x4858 [ 60.855389] kasan_atomics+0x198/0x2e0 [ 60.855406] kunit_try_run_case+0x170/0x3f0 [ 60.855423] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 60.855445] kthread+0x328/0x630 [ 60.855458] ret_from_fork+0x10/0x20 [ 60.855475] [ 60.928624] Allocated by task 351: [ 60.932080] kasan_save_stack+0x3c/0x68 [ 60.935979] kasan_save_track+0x20/0x40 [ 60.939875] kasan_save_alloc_info+0x40/0x58 [ 60.944214] __kasan_kmalloc+0xd4/0xd8 [ 60.948023] __kmalloc_cache_noprof+0x16c/0x3c0 [ 60.952627] kasan_atomics+0xb8/0x2e0 [ 60.956349] kunit_try_run_case+0x170/0x3f0 [ 60.960601] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 60.966171] kthread+0x328/0x630 [ 60.969458] ret_from_fork+0x10/0x20 [ 60.973093] [ 60.974616] The buggy address belongs to the object at ffff0000934cf200 [ 60.974616] which belongs to the cache kmalloc-64 of size 64 [ 60.987098] The buggy address is located 0 bytes to the right of [ 60.987098] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 61.000102] [ 61.001626] The buggy address belongs to the physical page: [ 61.007273] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 61.015370] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 61.021981] page_type: f5(slab) [ 61.025181] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 61.033018] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 61.040852] page dumped because: kasan: bad access detected [ 61.046499] [ 61.048021] Memory state around the buggy address: [ 61.052877] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 61.060191] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 61.067504] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 61.074815] ^ [ 61.079672] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.086985] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.094296] ================================================================== [ 59.214550] ================================================================== [ 59.221877] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x24c/0x4858 [ 59.229294] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 59.236798] [ 59.238331] CPU: 0 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 59.238362] Tainted: [B]=BAD_PAGE, [N]=TEST [ 59.238371] Hardware name: Thundercomm Dragonboard 845c (DT) [ 59.238385] Call trace: [ 59.238394] show_stack+0x20/0x38 (C) [ 59.238412] dump_stack_lvl+0x8c/0xd0 [ 59.238432] print_report+0x118/0x608 [ 59.238451] kasan_report+0xdc/0x128 [ 59.238473] kasan_check_range+0x100/0x1a8 [ 59.238495] __kasan_check_write+0x20/0x30 [ 59.238511] kasan_atomics_helper+0x24c/0x4858 [ 59.238531] kasan_atomics+0x198/0x2e0 [ 59.238550] kunit_try_run_case+0x170/0x3f0 [ 59.238568] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 59.238591] kthread+0x328/0x630 [ 59.238607] ret_from_fork+0x10/0x20 [ 59.238625] [ 59.311837] Allocated by task 351: [ 59.315299] kasan_save_stack+0x3c/0x68 [ 59.319211] kasan_save_track+0x20/0x40 [ 59.323121] kasan_save_alloc_info+0x40/0x58 [ 59.327460] __kasan_kmalloc+0xd4/0xd8 [ 59.331283] __kmalloc_cache_noprof+0x16c/0x3c0 [ 59.335893] kasan_atomics+0xb8/0x2e0 [ 59.339619] kunit_try_run_case+0x170/0x3f0 [ 59.343871] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 59.349442] kthread+0x328/0x630 [ 59.352732] ret_from_fork+0x10/0x20 [ 59.356373] [ 59.357902] The buggy address belongs to the object at ffff0000934cf200 [ 59.357902] which belongs to the cache kmalloc-64 of size 64 [ 59.370393] The buggy address is located 0 bytes to the right of [ 59.370393] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 59.383410] [ 59.384944] The buggy address belongs to the physical page: [ 59.390596] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 59.398699] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 59.405324] page_type: f5(slab) [ 59.408529] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 59.416376] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 59.424218] page dumped because: kasan: bad access detected [ 59.429868] [ 59.431397] Memory state around the buggy address: [ 59.436257] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 59.443576] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 59.450890] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 59.458213] ^ [ 59.463078] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.470394] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.477716] ================================================================== [ 74.846713] ================================================================== [ 74.854027] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3e10/0x4858 [ 74.861518] Read of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 74.868920] [ 74.870445] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 74.870474] Tainted: [B]=BAD_PAGE, [N]=TEST [ 74.870482] Hardware name: Thundercomm Dragonboard 845c (DT) [ 74.870492] Call trace: [ 74.870498] show_stack+0x20/0x38 (C) [ 74.870515] dump_stack_lvl+0x8c/0xd0 [ 74.870532] print_report+0x118/0x608 [ 74.870550] kasan_report+0xdc/0x128 [ 74.870568] __asan_report_load8_noabort+0x20/0x30 [ 74.870584] kasan_atomics_helper+0x3e10/0x4858 [ 74.870602] kasan_atomics+0x198/0x2e0 [ 74.870619] kunit_try_run_case+0x170/0x3f0 [ 74.870636] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 74.870656] kthread+0x328/0x630 [ 74.870670] ret_from_fork+0x10/0x20 [ 74.870687] [ 74.940498] Allocated by task 351: [ 74.943955] kasan_save_stack+0x3c/0x68 [ 74.947854] kasan_save_track+0x20/0x40 [ 74.951751] kasan_save_alloc_info+0x40/0x58 [ 74.956090] __kasan_kmalloc+0xd4/0xd8 [ 74.959900] __kmalloc_cache_noprof+0x16c/0x3c0 [ 74.964500] kasan_atomics+0xb8/0x2e0 [ 74.968222] kunit_try_run_case+0x170/0x3f0 [ 74.972475] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 74.978046] kthread+0x328/0x630 [ 74.981331] ret_from_fork+0x10/0x20 [ 74.984966] [ 74.986488] The buggy address belongs to the object at ffff0000934cf200 [ 74.986488] which belongs to the cache kmalloc-64 of size 64 [ 74.998967] The buggy address is located 0 bytes to the right of [ 74.998967] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 75.011970] [ 75.013493] The buggy address belongs to the physical page: [ 75.019139] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 75.027237] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 75.033845] page_type: f5(slab) [ 75.037044] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 75.044881] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 75.052713] page dumped because: kasan: bad access detected [ 75.058360] [ 75.059881] Memory state around the buggy address: [ 75.064736] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 75.072049] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 75.079361] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 75.086672] ^ [ 75.091527] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.098839] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.106149] ================================================================== [ 74.576359] ================================================================== [ 74.583673] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x16d0/0x4858 [ 74.591164] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 74.598653] [ 74.600178] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 74.600206] Tainted: [B]=BAD_PAGE, [N]=TEST [ 74.600215] Hardware name: Thundercomm Dragonboard 845c (DT) [ 74.600224] Call trace: [ 74.600230] show_stack+0x20/0x38 (C) [ 74.600246] dump_stack_lvl+0x8c/0xd0 [ 74.600264] print_report+0x118/0x608 [ 74.600283] kasan_report+0xdc/0x128 [ 74.600301] kasan_check_range+0x100/0x1a8 [ 74.600321] __kasan_check_write+0x20/0x30 [ 74.600336] kasan_atomics_helper+0x16d0/0x4858 [ 74.600355] kasan_atomics+0x198/0x2e0 [ 74.600371] kunit_try_run_case+0x170/0x3f0 [ 74.600389] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 74.600410] kthread+0x328/0x630 [ 74.600424] ret_from_fork+0x10/0x20 [ 74.600441] [ 74.673685] Allocated by task 351: [ 74.677141] kasan_save_stack+0x3c/0x68 [ 74.681039] kasan_save_track+0x20/0x40 [ 74.684936] kasan_save_alloc_info+0x40/0x58 [ 74.689275] __kasan_kmalloc+0xd4/0xd8 [ 74.693084] __kmalloc_cache_noprof+0x16c/0x3c0 [ 74.697686] kasan_atomics+0xb8/0x2e0 [ 74.701408] kunit_try_run_case+0x170/0x3f0 [ 74.705661] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 74.711231] kthread+0x328/0x630 [ 74.714517] ret_from_fork+0x10/0x20 [ 74.718152] [ 74.719675] The buggy address belongs to the object at ffff0000934cf200 [ 74.719675] which belongs to the cache kmalloc-64 of size 64 [ 74.732154] The buggy address is located 0 bytes to the right of [ 74.732154] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 74.745157] [ 74.746680] The buggy address belongs to the physical page: [ 74.752327] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 74.760424] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 74.767033] page_type: f5(slab) [ 74.770232] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 74.778070] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 74.785903] page dumped because: kasan: bad access detected [ 74.791550] [ 74.793073] Memory state around the buggy address: [ 74.797929] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 74.805241] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 74.812554] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 74.819864] ^ [ 74.824720] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.832032] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.839344] ================================================================== [ 73.231704] ================================================================== [ 73.239018] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x154c/0x4858 [ 73.246509] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 73.253999] [ 73.255524] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 73.255552] Tainted: [B]=BAD_PAGE, [N]=TEST [ 73.255560] Hardware name: Thundercomm Dragonboard 845c (DT) [ 73.255570] Call trace: [ 73.255576] show_stack+0x20/0x38 (C) [ 73.255592] dump_stack_lvl+0x8c/0xd0 [ 73.255610] print_report+0x118/0x608 [ 73.255627] kasan_report+0xdc/0x128 [ 73.255646] kasan_check_range+0x100/0x1a8 [ 73.255665] __kasan_check_write+0x20/0x30 [ 73.255681] kasan_atomics_helper+0x154c/0x4858 [ 73.255699] kasan_atomics+0x198/0x2e0 [ 73.255715] kunit_try_run_case+0x170/0x3f0 [ 73.255732] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 73.255752] kthread+0x328/0x630 [ 73.255765] ret_from_fork+0x10/0x20 [ 73.255781] [ 73.329014] Allocated by task 351: [ 73.332470] kasan_save_stack+0x3c/0x68 [ 73.336368] kasan_save_track+0x20/0x40 [ 73.340265] kasan_save_alloc_info+0x40/0x58 [ 73.344603] __kasan_kmalloc+0xd4/0xd8 [ 73.348411] __kmalloc_cache_noprof+0x16c/0x3c0 [ 73.353013] kasan_atomics+0xb8/0x2e0 [ 73.356734] kunit_try_run_case+0x170/0x3f0 [ 73.360987] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 73.366556] kthread+0x328/0x630 [ 73.369842] ret_from_fork+0x10/0x20 [ 73.373477] [ 73.374999] The buggy address belongs to the object at ffff0000934cf200 [ 73.374999] which belongs to the cache kmalloc-64 of size 64 [ 73.387479] The buggy address is located 0 bytes to the right of [ 73.387479] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 73.400484] [ 73.402007] The buggy address belongs to the physical page: [ 73.407653] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 73.415749] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 73.422357] page_type: f5(slab) [ 73.425556] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 73.433392] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 73.441225] page dumped because: kasan: bad access detected [ 73.446871] [ 73.448393] Memory state around the buggy address: [ 73.453249] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 73.460561] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 73.467874] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 73.475184] ^ [ 73.480041] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.487352] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.494663] ================================================================== [ 70.531597] ================================================================== [ 70.538910] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x1128/0x4858 [ 70.546401] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 70.553891] [ 70.555416] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 70.555445] Tainted: [B]=BAD_PAGE, [N]=TEST [ 70.555454] Hardware name: Thundercomm Dragonboard 845c (DT) [ 70.555463] Call trace: [ 70.555469] show_stack+0x20/0x38 (C) [ 70.555485] dump_stack_lvl+0x8c/0xd0 [ 70.555503] print_report+0x118/0x608 [ 70.555520] kasan_report+0xdc/0x128 [ 70.555538] kasan_check_range+0x100/0x1a8 [ 70.555557] __kasan_check_write+0x20/0x30 [ 70.555574] kasan_atomics_helper+0x1128/0x4858 [ 70.555593] kasan_atomics+0x198/0x2e0 [ 70.555610] kunit_try_run_case+0x170/0x3f0 [ 70.555628] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 70.555647] kthread+0x328/0x630 [ 70.555660] ret_from_fork+0x10/0x20 [ 70.555677] [ 70.628906] Allocated by task 351: [ 70.632363] kasan_save_stack+0x3c/0x68 [ 70.636260] kasan_save_track+0x20/0x40 [ 70.640157] kasan_save_alloc_info+0x40/0x58 [ 70.644495] __kasan_kmalloc+0xd4/0xd8 [ 70.648304] __kmalloc_cache_noprof+0x16c/0x3c0 [ 70.652906] kasan_atomics+0xb8/0x2e0 [ 70.656627] kunit_try_run_case+0x170/0x3f0 [ 70.660880] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 70.666439] kthread+0x328/0x630 [ 70.669725] ret_from_fork+0x10/0x20 [ 70.673360] [ 70.674882] The buggy address belongs to the object at ffff0000934cf200 [ 70.674882] which belongs to the cache kmalloc-64 of size 64 [ 70.687361] The buggy address is located 0 bytes to the right of [ 70.687361] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 70.700367] [ 70.701897] The buggy address belongs to the physical page: [ 70.707546] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 70.715648] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 70.722259] page_type: f5(slab) [ 70.725461] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 70.733299] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 70.741132] page dumped because: kasan: bad access detected [ 70.746779] [ 70.748302] Memory state around the buggy address: [ 70.753158] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 70.760471] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 70.767785] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 70.775097] ^ [ 70.779955] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.787268] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.794579] ================================================================== [ 66.495458] ================================================================== [ 66.502772] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3de4/0x4858 [ 66.510264] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 66.517669] [ 66.519195] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 66.519224] Tainted: [B]=BAD_PAGE, [N]=TEST [ 66.519231] Hardware name: Thundercomm Dragonboard 845c (DT) [ 66.519243] Call trace: [ 66.519249] show_stack+0x20/0x38 (C) [ 66.519266] dump_stack_lvl+0x8c/0xd0 [ 66.519285] print_report+0x118/0x608 [ 66.519303] kasan_report+0xdc/0x128 [ 66.519321] __asan_report_load4_noabort+0x20/0x30 [ 66.519338] kasan_atomics_helper+0x3de4/0x4858 [ 66.519355] kasan_atomics+0x198/0x2e0 [ 66.519371] kunit_try_run_case+0x170/0x3f0 [ 66.519388] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.519408] kthread+0x328/0x630 [ 66.519420] ret_from_fork+0x10/0x20 [ 66.519438] [ 66.589248] Allocated by task 351: [ 66.592706] kasan_save_stack+0x3c/0x68 [ 66.596604] kasan_save_track+0x20/0x40 [ 66.600500] kasan_save_alloc_info+0x40/0x58 [ 66.604838] __kasan_kmalloc+0xd4/0xd8 [ 66.608647] __kmalloc_cache_noprof+0x16c/0x3c0 [ 66.613249] kasan_atomics+0xb8/0x2e0 [ 66.616971] kunit_try_run_case+0x170/0x3f0 [ 66.621224] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.626784] kthread+0x328/0x630 [ 66.630071] ret_from_fork+0x10/0x20 [ 66.633706] [ 66.635229] The buggy address belongs to the object at ffff0000934cf200 [ 66.635229] which belongs to the cache kmalloc-64 of size 64 [ 66.647710] The buggy address is located 0 bytes to the right of [ 66.647710] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 66.660713] [ 66.662237] The buggy address belongs to the physical page: [ 66.667883] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 66.675980] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 66.682589] page_type: f5(slab) [ 66.685788] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 66.693624] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 66.701458] page dumped because: kasan: bad access detected [ 66.707104] [ 66.708626] Memory state around the buggy address: [ 66.713482] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 66.720794] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 66.728107] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 66.735419] ^ [ 66.740275] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.747588] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.754899] ================================================================== [ 59.485876] ================================================================== [ 59.493205] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x2b0/0x4858 [ 59.500617] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 59.508025] [ 59.509555] CPU: 6 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 59.509587] Tainted: [B]=BAD_PAGE, [N]=TEST [ 59.509595] Hardware name: Thundercomm Dragonboard 845c (DT) [ 59.509606] Call trace: [ 59.509614] show_stack+0x20/0x38 (C) [ 59.509634] dump_stack_lvl+0x8c/0xd0 [ 59.509653] print_report+0x118/0x608 [ 59.509672] kasan_report+0xdc/0x128 [ 59.509691] kasan_check_range+0x100/0x1a8 [ 59.509711] __kasan_check_read+0x20/0x30 [ 59.509728] kasan_atomics_helper+0x2b0/0x4858 [ 59.509747] kasan_atomics+0x198/0x2e0 [ 59.509764] kunit_try_run_case+0x170/0x3f0 [ 59.509784] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 59.509805] kthread+0x328/0x630 [ 59.509819] ret_from_fork+0x10/0x20 [ 59.509838] [ 59.582909] Allocated by task 351: [ 59.586362] kasan_save_stack+0x3c/0x68 [ 59.590261] kasan_save_track+0x20/0x40 [ 59.594166] kasan_save_alloc_info+0x40/0x58 [ 59.598503] __kasan_kmalloc+0xd4/0xd8 [ 59.602319] __kmalloc_cache_noprof+0x16c/0x3c0 [ 59.606920] kasan_atomics+0xb8/0x2e0 [ 59.610638] kunit_try_run_case+0x170/0x3f0 [ 59.614891] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 59.620455] kthread+0x328/0x630 [ 59.623737] ret_from_fork+0x10/0x20 [ 59.627369] [ 59.628892] The buggy address belongs to the object at ffff0000934cf200 [ 59.628892] which belongs to the cache kmalloc-64 of size 64 [ 59.641375] The buggy address is located 0 bytes to the right of [ 59.641375] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 59.654382] [ 59.655914] The buggy address belongs to the physical page: [ 59.661560] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 59.669663] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 59.676276] page_type: f5(slab) [ 59.679473] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 59.687308] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 59.695146] page dumped because: kasan: bad access detected [ 59.700787] [ 59.702310] Memory state around the buggy address: [ 59.707161] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 59.714468] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 59.721775] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 59.729080] ^ [ 59.733936] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.741241] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.748545] ================================================================== [ 71.613109] ================================================================== [ 71.620420] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x12d8/0x4858 [ 71.627913] Write of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 71.635403] [ 71.636928] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 71.636957] Tainted: [B]=BAD_PAGE, [N]=TEST [ 71.636965] Hardware name: Thundercomm Dragonboard 845c (DT) [ 71.636975] Call trace: [ 71.636980] show_stack+0x20/0x38 (C) [ 71.636998] dump_stack_lvl+0x8c/0xd0 [ 71.637017] print_report+0x118/0x608 [ 71.637035] kasan_report+0xdc/0x128 [ 71.637052] kasan_check_range+0x100/0x1a8 [ 71.637071] __kasan_check_write+0x20/0x30 [ 71.637087] kasan_atomics_helper+0x12d8/0x4858 [ 71.637107] kasan_atomics+0x198/0x2e0 [ 71.637123] kunit_try_run_case+0x170/0x3f0 [ 71.637140] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 71.637160] kthread+0x328/0x630 [ 71.637173] ret_from_fork+0x10/0x20 [ 71.637190] [ 71.710436] Allocated by task 351: [ 71.713893] kasan_save_stack+0x3c/0x68 [ 71.717791] kasan_save_track+0x20/0x40 [ 71.721688] kasan_save_alloc_info+0x40/0x58 [ 71.726026] __kasan_kmalloc+0xd4/0xd8 [ 71.729836] __kmalloc_cache_noprof+0x16c/0x3c0 [ 71.734439] kasan_atomics+0xb8/0x2e0 [ 71.738160] kunit_try_run_case+0x170/0x3f0 [ 71.742413] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 71.747983] kthread+0x328/0x630 [ 71.751268] ret_from_fork+0x10/0x20 [ 71.754903] [ 71.756426] The buggy address belongs to the object at ffff0000934cf200 [ 71.756426] which belongs to the cache kmalloc-64 of size 64 [ 71.768906] The buggy address is located 0 bytes to the right of [ 71.768906] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 71.781909] [ 71.783432] The buggy address belongs to the physical page: [ 71.789079] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 71.797176] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 71.803784] page_type: f5(slab) [ 71.806983] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 71.814819] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 71.822651] page dumped because: kasan: bad access detected [ 71.828298] [ 71.829821] Memory state around the buggy address: [ 71.834677] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 71.841990] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 71.849302] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 71.856612] ^ [ 71.861468] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.868780] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.876091] ================================================================== [ 67.569410] ================================================================== [ 67.576721] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3e04/0x4858 [ 67.584212] Read of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 67.591615] [ 67.593140] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 67.593169] Tainted: [B]=BAD_PAGE, [N]=TEST [ 67.593177] Hardware name: Thundercomm Dragonboard 845c (DT) [ 67.593187] Call trace: [ 67.593193] show_stack+0x20/0x38 (C) [ 67.593209] dump_stack_lvl+0x8c/0xd0 [ 67.593227] print_report+0x118/0x608 [ 67.593246] kasan_report+0xdc/0x128 [ 67.593264] __asan_report_load4_noabort+0x20/0x30 [ 67.593281] kasan_atomics_helper+0x3e04/0x4858 [ 67.593301] kasan_atomics+0x198/0x2e0 [ 67.593319] kunit_try_run_case+0x170/0x3f0 [ 67.593336] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.593356] kthread+0x328/0x630 [ 67.593370] ret_from_fork+0x10/0x20 [ 67.593387] [ 67.663184] Allocated by task 351: [ 67.666640] kasan_save_stack+0x3c/0x68 [ 67.670538] kasan_save_track+0x20/0x40 [ 67.674437] kasan_save_alloc_info+0x40/0x58 [ 67.678776] __kasan_kmalloc+0xd4/0xd8 [ 67.682584] __kmalloc_cache_noprof+0x16c/0x3c0 [ 67.687185] kasan_atomics+0xb8/0x2e0 [ 67.690907] kunit_try_run_case+0x170/0x3f0 [ 67.695160] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.700718] kthread+0x328/0x630 [ 67.704005] ret_from_fork+0x10/0x20 [ 67.707639] [ 67.709161] The buggy address belongs to the object at ffff0000934cf200 [ 67.709161] which belongs to the cache kmalloc-64 of size 64 [ 67.721640] The buggy address is located 0 bytes to the right of [ 67.721640] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 67.734643] [ 67.736168] The buggy address belongs to the physical page: [ 67.741815] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 67.749910] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 67.756520] page_type: f5(slab) [ 67.759718] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 67.767555] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 67.775388] page dumped because: kasan: bad access detected [ 67.781035] [ 67.782557] Memory state around the buggy address: [ 67.787412] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 67.794724] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 67.802037] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 67.809349] ^ [ 67.814205] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.821518] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.828829] ================================================================== [ 72.153813] ================================================================== [ 72.161128] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3f04/0x4858 [ 72.168620] Read of size 8 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 72.176024] [ 72.177550] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 72.177579] Tainted: [B]=BAD_PAGE, [N]=TEST [ 72.177587] Hardware name: Thundercomm Dragonboard 845c (DT) [ 72.177596] Call trace: [ 72.177602] show_stack+0x20/0x38 (C) [ 72.177619] dump_stack_lvl+0x8c/0xd0 [ 72.177637] print_report+0x118/0x608 [ 72.177656] kasan_report+0xdc/0x128 [ 72.177673] __asan_report_load8_noabort+0x20/0x30 [ 72.177690] kasan_atomics_helper+0x3f04/0x4858 [ 72.177709] kasan_atomics+0x198/0x2e0 [ 72.177725] kunit_try_run_case+0x170/0x3f0 [ 72.177742] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 72.177763] kthread+0x328/0x630 [ 72.177776] ret_from_fork+0x10/0x20 [ 72.177792] [ 72.247602] Allocated by task 351: [ 72.251058] kasan_save_stack+0x3c/0x68 [ 72.254958] kasan_save_track+0x20/0x40 [ 72.258855] kasan_save_alloc_info+0x40/0x58 [ 72.263193] __kasan_kmalloc+0xd4/0xd8 [ 72.267002] __kmalloc_cache_noprof+0x16c/0x3c0 [ 72.271603] kasan_atomics+0xb8/0x2e0 [ 72.275325] kunit_try_run_case+0x170/0x3f0 [ 72.279580] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 72.285149] kthread+0x328/0x630 [ 72.288434] ret_from_fork+0x10/0x20 [ 72.292069] [ 72.293591] The buggy address belongs to the object at ffff0000934cf200 [ 72.293591] which belongs to the cache kmalloc-64 of size 64 [ 72.306072] The buggy address is located 0 bytes to the right of [ 72.306072] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 72.319075] [ 72.320599] The buggy address belongs to the physical page: [ 72.326246] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 72.334343] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 72.340952] page_type: f5(slab) [ 72.344151] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 72.351988] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 72.359820] page dumped because: kasan: bad access detected [ 72.365467] [ 72.366988] Memory state around the buggy address: [ 72.371843] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 72.379156] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 72.386468] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 72.393778] ^ [ 72.398634] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.405947] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.413258] ================================================================== [ 63.533405] ================================================================== [ 63.540717] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x894/0x4858 [ 63.548122] Write of size 4 at addr ffff0000934cf230 by task kunit_try_catch/351 [ 63.555611] [ 63.557138] CPU: 5 UID: 0 PID: 351 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 63.557166] Tainted: [B]=BAD_PAGE, [N]=TEST [ 63.557175] Hardware name: Thundercomm Dragonboard 845c (DT) [ 63.557186] Call trace: [ 63.557193] show_stack+0x20/0x38 (C) [ 63.557210] dump_stack_lvl+0x8c/0xd0 [ 63.557229] print_report+0x118/0x608 [ 63.557248] kasan_report+0xdc/0x128 [ 63.557267] kasan_check_range+0x100/0x1a8 [ 63.557287] __kasan_check_write+0x20/0x30 [ 63.557304] kasan_atomics_helper+0x894/0x4858 [ 63.557323] kasan_atomics+0x198/0x2e0 [ 63.557340] kunit_try_run_case+0x170/0x3f0 [ 63.557358] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 63.557379] kthread+0x328/0x630 [ 63.557392] ret_from_fork+0x10/0x20 [ 63.557411] [ 63.630558] Allocated by task 351: [ 63.634014] kasan_save_stack+0x3c/0x68 [ 63.637914] kasan_save_track+0x20/0x40 [ 63.641811] kasan_save_alloc_info+0x40/0x58 [ 63.646148] __kasan_kmalloc+0xd4/0xd8 [ 63.649957] __kmalloc_cache_noprof+0x16c/0x3c0 [ 63.654559] kasan_atomics+0xb8/0x2e0 [ 63.658281] kunit_try_run_case+0x170/0x3f0 [ 63.662535] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 63.668094] kthread+0x328/0x630 [ 63.671380] ret_from_fork+0x10/0x20 [ 63.675014] [ 63.676537] The buggy address belongs to the object at ffff0000934cf200 [ 63.676537] which belongs to the cache kmalloc-64 of size 64 [ 63.689019] The buggy address is located 0 bytes to the right of [ 63.689019] allocated 48-byte region [ffff0000934cf200, ffff0000934cf230) [ 63.702024] [ 63.703548] The buggy address belongs to the physical page: [ 63.709195] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134cf [ 63.717292] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 63.723901] page_type: f5(slab) [ 63.727102] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 63.734939] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 63.742773] page dumped because: kasan: bad access detected [ 63.748421] [ 63.749943] Memory state around the buggy address: [ 63.754798] ffff0000934cf100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 63.762111] ffff0000934cf180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 63.769425] >ffff0000934cf200: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 63.776735] ^ [ 63.781592] ffff0000934cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.788905] ffff0000934cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.796215] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kasan_bitops_test_and_modifyconstprop
[ 57.571103] ================================================================== [ 57.578416] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x334/0xbc0 [ 57.587483] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 57.594973] [ 57.596498] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 57.596526] Tainted: [B]=BAD_PAGE, [N]=TEST [ 57.596534] Hardware name: Thundercomm Dragonboard 845c (DT) [ 57.596544] Call trace: [ 57.596550] show_stack+0x20/0x38 (C) [ 57.596566] dump_stack_lvl+0x8c/0xd0 [ 57.596584] print_report+0x118/0x608 [ 57.596602] kasan_report+0xdc/0x128 [ 57.596619] kasan_check_range+0x100/0x1a8 [ 57.596639] __kasan_check_write+0x20/0x30 [ 57.596655] kasan_bitops_test_and_modify.constprop.0+0x334/0xbc0 [ 57.596676] kasan_bitops_generic+0x11c/0x1c8 [ 57.596693] kunit_try_run_case+0x170/0x3f0 [ 57.596709] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 57.596730] kthread+0x328/0x630 [ 57.596743] ret_from_fork+0x10/0x20 [ 57.596759] [ 57.672171] Allocated by task 347: [ 57.675627] kasan_save_stack+0x3c/0x68 [ 57.679525] kasan_save_track+0x20/0x40 [ 57.683421] kasan_save_alloc_info+0x40/0x58 [ 57.687759] __kasan_kmalloc+0xd4/0xd8 [ 57.691568] __kmalloc_cache_noprof+0x16c/0x3c0 [ 57.696171] kasan_bitops_generic+0xa0/0x1c8 [ 57.700512] kunit_try_run_case+0x170/0x3f0 [ 57.704765] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 57.710333] kthread+0x328/0x630 [ 57.713621] ret_from_fork+0x10/0x20 [ 57.717255] [ 57.718778] The buggy address belongs to the object at ffff000093276b80 [ 57.718778] which belongs to the cache kmalloc-16 of size 16 [ 57.731257] The buggy address is located 8 bytes inside of [ 57.731257] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 57.743653] [ 57.745175] The buggy address belongs to the physical page: [ 57.750821] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 57.758919] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 57.765527] page_type: f5(slab) [ 57.768726] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 57.776563] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 57.784395] page dumped because: kasan: bad access detected [ 57.790043] [ 57.791566] Memory state around the buggy address: [ 57.796421] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 57.803735] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 57.811048] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.818360] ^ [ 57.821903] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.829216] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.836526] ================================================================== [ 57.843906] ================================================================== [ 57.851220] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa3c/0xbc0 [ 57.860286] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 57.867690] [ 57.869215] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 57.869243] Tainted: [B]=BAD_PAGE, [N]=TEST [ 57.869251] Hardware name: Thundercomm Dragonboard 845c (DT) [ 57.869260] Call trace: [ 57.869268] show_stack+0x20/0x38 (C) [ 57.869285] dump_stack_lvl+0x8c/0xd0 [ 57.869302] print_report+0x118/0x608 [ 57.869322] kasan_report+0xdc/0x128 [ 57.869340] __asan_report_load8_noabort+0x20/0x30 [ 57.869357] kasan_bitops_test_and_modify.constprop.0+0xa3c/0xbc0 [ 57.869377] kasan_bitops_generic+0x11c/0x1c8 [ 57.869395] kunit_try_run_case+0x170/0x3f0 [ 57.869412] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 57.869434] kthread+0x328/0x630 [ 57.869447] ret_from_fork+0x10/0x20 [ 57.869464] [ 57.941465] Allocated by task 347: [ 57.944922] kasan_save_stack+0x3c/0x68 [ 57.948819] kasan_save_track+0x20/0x40 [ 57.952716] kasan_save_alloc_info+0x40/0x58 [ 57.957054] __kasan_kmalloc+0xd4/0xd8 [ 57.960864] __kmalloc_cache_noprof+0x16c/0x3c0 [ 57.965466] kasan_bitops_generic+0xa0/0x1c8 [ 57.969807] kunit_try_run_case+0x170/0x3f0 [ 57.974061] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 57.979631] kthread+0x328/0x630 [ 57.982916] ret_from_fork+0x10/0x20 [ 57.986551] [ 57.988074] The buggy address belongs to the object at ffff000093276b80 [ 57.988074] which belongs to the cache kmalloc-16 of size 16 [ 58.000553] The buggy address is located 8 bytes inside of [ 58.000553] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 58.012949] [ 58.014473] The buggy address belongs to the physical page: [ 58.020119] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 58.028216] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 58.034824] page_type: f5(slab) [ 58.038023] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 58.045859] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 58.053692] page dumped because: kasan: bad access detected [ 58.059339] [ 58.060862] Memory state around the buggy address: [ 58.065718] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 58.073032] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 58.080344] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.087655] ^ [ 58.091199] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.098511] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.105823] ================================================================== [ 56.759722] ================================================================== [ 56.767034] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa48/0xbc0 [ 56.776100] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 56.783504] [ 56.785029] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 56.785057] Tainted: [B]=BAD_PAGE, [N]=TEST [ 56.785065] Hardware name: Thundercomm Dragonboard 845c (DT) [ 56.785074] Call trace: [ 56.785080] show_stack+0x20/0x38 (C) [ 56.785097] dump_stack_lvl+0x8c/0xd0 [ 56.785114] print_report+0x118/0x608 [ 56.785133] kasan_report+0xdc/0x128 [ 56.785150] __asan_report_load8_noabort+0x20/0x30 [ 56.785167] kasan_bitops_test_and_modify.constprop.0+0xa48/0xbc0 [ 56.785187] kasan_bitops_generic+0x11c/0x1c8 [ 56.785204] kunit_try_run_case+0x170/0x3f0 [ 56.785221] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 56.785243] kthread+0x328/0x630 [ 56.785257] ret_from_fork+0x10/0x20 [ 56.785273] [ 56.857275] Allocated by task 347: [ 56.860730] kasan_save_stack+0x3c/0x68 [ 56.864628] kasan_save_track+0x20/0x40 [ 56.868528] kasan_save_alloc_info+0x40/0x58 [ 56.872866] __kasan_kmalloc+0xd4/0xd8 [ 56.876674] __kmalloc_cache_noprof+0x16c/0x3c0 [ 56.881275] kasan_bitops_generic+0xa0/0x1c8 [ 56.885618] kunit_try_run_case+0x170/0x3f0 [ 56.889871] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 56.895442] kthread+0x328/0x630 [ 56.898728] ret_from_fork+0x10/0x20 [ 56.902363] [ 56.903885] The buggy address belongs to the object at ffff000093276b80 [ 56.903885] which belongs to the cache kmalloc-16 of size 16 [ 56.916364] The buggy address is located 8 bytes inside of [ 56.916364] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 56.928760] [ 56.930284] The buggy address belongs to the physical page: [ 56.935930] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 56.944026] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 56.950634] page_type: f5(slab) [ 56.953833] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 56.961671] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 56.969503] page dumped because: kasan: bad access detected [ 56.975150] [ 56.976673] Memory state around the buggy address: [ 56.981530] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 56.988842] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 56.996155] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.003467] ^ [ 57.007010] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.014323] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.021634] ================================================================== [ 57.301825] ================================================================== [ 57.309136] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xacc/0xbc0 [ 57.318202] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 57.325604] [ 57.327129] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 57.327156] Tainted: [B]=BAD_PAGE, [N]=TEST [ 57.327164] Hardware name: Thundercomm Dragonboard 845c (DT) [ 57.327175] Call trace: [ 57.327181] show_stack+0x20/0x38 (C) [ 57.327199] dump_stack_lvl+0x8c/0xd0 [ 57.327216] print_report+0x118/0x608 [ 57.327235] kasan_report+0xdc/0x128 [ 57.327252] __asan_report_load8_noabort+0x20/0x30 [ 57.327268] kasan_bitops_test_and_modify.constprop.0+0xacc/0xbc0 [ 57.327290] kasan_bitops_generic+0x11c/0x1c8 [ 57.327307] kunit_try_run_case+0x170/0x3f0 [ 57.327324] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 57.327344] kthread+0x328/0x630 [ 57.327357] ret_from_fork+0x10/0x20 [ 57.327373] [ 57.399375] Allocated by task 347: [ 57.402831] kasan_save_stack+0x3c/0x68 [ 57.406730] kasan_save_track+0x20/0x40 [ 57.410627] kasan_save_alloc_info+0x40/0x58 [ 57.414965] __kasan_kmalloc+0xd4/0xd8 [ 57.418774] __kmalloc_cache_noprof+0x16c/0x3c0 [ 57.423376] kasan_bitops_generic+0xa0/0x1c8 [ 57.427718] kunit_try_run_case+0x170/0x3f0 [ 57.431971] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 57.437540] kthread+0x328/0x630 [ 57.440826] ret_from_fork+0x10/0x20 [ 57.444461] [ 57.445983] The buggy address belongs to the object at ffff000093276b80 [ 57.445983] which belongs to the cache kmalloc-16 of size 16 [ 57.458462] The buggy address is located 8 bytes inside of [ 57.458462] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 57.470859] [ 57.472383] The buggy address belongs to the physical page: [ 57.478029] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 57.486126] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 57.492734] page_type: f5(slab) [ 57.495933] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 57.503770] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 57.511604] page dumped because: kasan: bad access detected [ 57.517250] [ 57.518773] Memory state around the buggy address: [ 57.523628] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 57.530941] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 57.538253] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.545564] ^ [ 57.549107] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.556420] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.563730] ================================================================== [ 58.113188] ================================================================== [ 58.120501] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa84/0xbc0 [ 58.129568] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 58.136971] [ 58.138497] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 58.138525] Tainted: [B]=BAD_PAGE, [N]=TEST [ 58.138534] Hardware name: Thundercomm Dragonboard 845c (DT) [ 58.138545] Call trace: [ 58.138553] show_stack+0x20/0x38 (C) [ 58.138569] dump_stack_lvl+0x8c/0xd0 [ 58.138587] print_report+0x118/0x608 [ 58.138605] kasan_report+0xdc/0x128 [ 58.138622] __asan_report_load8_noabort+0x20/0x30 [ 58.138641] kasan_bitops_test_and_modify.constprop.0+0xa84/0xbc0 [ 58.138662] kasan_bitops_generic+0x11c/0x1c8 [ 58.138679] kunit_try_run_case+0x170/0x3f0 [ 58.138698] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 58.138718] kthread+0x328/0x630 [ 58.138731] ret_from_fork+0x10/0x20 [ 58.138747] [ 58.210737] Allocated by task 347: [ 58.214194] kasan_save_stack+0x3c/0x68 [ 58.218091] kasan_save_track+0x20/0x40 [ 58.221988] kasan_save_alloc_info+0x40/0x58 [ 58.226327] __kasan_kmalloc+0xd4/0xd8 [ 58.230136] __kmalloc_cache_noprof+0x16c/0x3c0 [ 58.234737] kasan_bitops_generic+0xa0/0x1c8 [ 58.239079] kunit_try_run_case+0x170/0x3f0 [ 58.243332] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 58.248891] kthread+0x328/0x630 [ 58.252176] ret_from_fork+0x10/0x20 [ 58.255812] [ 58.257334] The buggy address belongs to the object at ffff000093276b80 [ 58.257334] which belongs to the cache kmalloc-16 of size 16 [ 58.269814] The buggy address is located 8 bytes inside of [ 58.269814] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 58.282211] [ 58.283734] The buggy address belongs to the physical page: [ 58.289381] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 58.297477] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 58.304085] page_type: f5(slab) [ 58.307285] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 58.315123] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 58.322955] page dumped because: kasan: bad access detected [ 58.328602] [ 58.330124] Memory state around the buggy address: [ 58.334980] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 58.342293] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 58.349607] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.356919] ^ [ 58.360462] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.367774] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.375085] ================================================================== [ 55.944940] ================================================================== [ 55.952253] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xfc/0xbc0 [ 55.961234] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 55.968724] [ 55.970249] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 55.970278] Tainted: [B]=BAD_PAGE, [N]=TEST [ 55.970285] Hardware name: Thundercomm Dragonboard 845c (DT) [ 55.970296] Call trace: [ 55.970302] show_stack+0x20/0x38 (C) [ 55.970319] dump_stack_lvl+0x8c/0xd0 [ 55.970336] print_report+0x118/0x608 [ 55.970355] kasan_report+0xdc/0x128 [ 55.970375] kasan_check_range+0x100/0x1a8 [ 55.970394] __kasan_check_write+0x20/0x30 [ 55.970409] kasan_bitops_test_and_modify.constprop.0+0xfc/0xbc0 [ 55.970429] kasan_bitops_generic+0x11c/0x1c8 [ 55.970446] kunit_try_run_case+0x170/0x3f0 [ 55.970465] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 55.970486] kthread+0x328/0x630 [ 55.970499] ret_from_fork+0x10/0x20 [ 55.970516] [ 56.045867] Allocated by task 347: [ 56.049323] kasan_save_stack+0x3c/0x68 [ 56.053221] kasan_save_track+0x20/0x40 [ 56.057119] kasan_save_alloc_info+0x40/0x58 [ 56.061458] __kasan_kmalloc+0xd4/0xd8 [ 56.065268] __kmalloc_cache_noprof+0x16c/0x3c0 [ 56.069870] kasan_bitops_generic+0xa0/0x1c8 [ 56.074212] kunit_try_run_case+0x170/0x3f0 [ 56.078466] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 56.084037] kthread+0x328/0x630 [ 56.087323] ret_from_fork+0x10/0x20 [ 56.090957] [ 56.092480] The buggy address belongs to the object at ffff000093276b80 [ 56.092480] which belongs to the cache kmalloc-16 of size 16 [ 56.104961] The buggy address is located 8 bytes inside of [ 56.104961] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 56.117358] [ 56.118881] The buggy address belongs to the physical page: [ 56.124528] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 56.132625] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 56.139234] page_type: f5(slab) [ 56.142433] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 56.150269] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 56.158101] page dumped because: kasan: bad access detected [ 56.163749] [ 56.165272] Memory state around the buggy address: [ 56.170127] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 56.177441] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 56.184753] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.192065] ^ [ 56.195608] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.202921] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.210231] ================================================================== [ 56.486914] ================================================================== [ 56.494226] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x1d8/0xbc0 [ 56.503293] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 56.510783] [ 56.512308] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 56.512336] Tainted: [B]=BAD_PAGE, [N]=TEST [ 56.512344] Hardware name: Thundercomm Dragonboard 845c (DT) [ 56.512353] Call trace: [ 56.512360] show_stack+0x20/0x38 (C) [ 56.512376] dump_stack_lvl+0x8c/0xd0 [ 56.512394] print_report+0x118/0x608 [ 56.512412] kasan_report+0xdc/0x128 [ 56.512430] kasan_check_range+0x100/0x1a8 [ 56.512448] __kasan_check_write+0x20/0x30 [ 56.512464] kasan_bitops_test_and_modify.constprop.0+0x1d8/0xbc0 [ 56.512487] kasan_bitops_generic+0x11c/0x1c8 [ 56.512504] kunit_try_run_case+0x170/0x3f0 [ 56.512521] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 56.512541] kthread+0x328/0x630 [ 56.512555] ret_from_fork+0x10/0x20 [ 56.512571] [ 56.587996] Allocated by task 347: [ 56.591451] kasan_save_stack+0x3c/0x68 [ 56.595350] kasan_save_track+0x20/0x40 [ 56.599247] kasan_save_alloc_info+0x40/0x58 [ 56.603586] __kasan_kmalloc+0xd4/0xd8 [ 56.607395] __kmalloc_cache_noprof+0x16c/0x3c0 [ 56.611998] kasan_bitops_generic+0xa0/0x1c8 [ 56.616338] kunit_try_run_case+0x170/0x3f0 [ 56.620592] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 56.626151] kthread+0x328/0x630 [ 56.629436] ret_from_fork+0x10/0x20 [ 56.633071] [ 56.634594] The buggy address belongs to the object at ffff000093276b80 [ 56.634594] which belongs to the cache kmalloc-16 of size 16 [ 56.647073] The buggy address is located 8 bytes inside of [ 56.647073] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 56.659469] [ 56.660992] The buggy address belongs to the physical page: [ 56.666638] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 56.674736] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 56.681345] page_type: f5(slab) [ 56.684545] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 56.692382] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 56.700215] page dumped because: kasan: bad access detected [ 56.705862] [ 56.707384] Memory state around the buggy address: [ 56.712241] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 56.719555] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 56.726868] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.734179] ^ [ 56.737721] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.745034] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.752345] ================================================================== [ 57.029005] ================================================================== [ 57.036316] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x25c/0xbc0 [ 57.045384] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 57.052873] [ 57.054399] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 57.054429] Tainted: [B]=BAD_PAGE, [N]=TEST [ 57.054438] Hardware name: Thundercomm Dragonboard 845c (DT) [ 57.054448] Call trace: [ 57.054454] show_stack+0x20/0x38 (C) [ 57.054470] dump_stack_lvl+0x8c/0xd0 [ 57.054488] print_report+0x118/0x608 [ 57.054507] kasan_report+0xdc/0x128 [ 57.054524] kasan_check_range+0x100/0x1a8 [ 57.054544] __kasan_check_write+0x20/0x30 [ 57.054561] kasan_bitops_test_and_modify.constprop.0+0x25c/0xbc0 [ 57.054582] kasan_bitops_generic+0x11c/0x1c8 [ 57.054601] kunit_try_run_case+0x170/0x3f0 [ 57.054618] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 57.054638] kthread+0x328/0x630 [ 57.054652] ret_from_fork+0x10/0x20 [ 57.054669] [ 57.130102] Allocated by task 347: [ 57.133558] kasan_save_stack+0x3c/0x68 [ 57.137456] kasan_save_track+0x20/0x40 [ 57.141353] kasan_save_alloc_info+0x40/0x58 [ 57.145692] __kasan_kmalloc+0xd4/0xd8 [ 57.149501] __kmalloc_cache_noprof+0x16c/0x3c0 [ 57.154103] kasan_bitops_generic+0xa0/0x1c8 [ 57.158443] kunit_try_run_case+0x170/0x3f0 [ 57.162697] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 57.168256] kthread+0x328/0x630 [ 57.171541] ret_from_fork+0x10/0x20 [ 57.175176] [ 57.176699] The buggy address belongs to the object at ffff000093276b80 [ 57.176699] which belongs to the cache kmalloc-16 of size 16 [ 57.189179] The buggy address is located 8 bytes inside of [ 57.189179] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 57.201575] [ 57.203097] The buggy address belongs to the physical page: [ 57.208744] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 57.216841] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 57.223450] page_type: f5(slab) [ 57.226649] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 57.234486] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 57.242320] page dumped because: kasan: bad access detected [ 57.247966] [ 57.249488] Memory state around the buggy address: [ 57.254343] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 57.261656] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 57.268968] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.276280] ^ [ 57.279823] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.287136] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.294447] ================================================================== [ 56.217611] ================================================================== [ 56.224923] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa00/0xbc0 [ 56.233991] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 56.241394] [ 56.242920] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 56.242949] Tainted: [B]=BAD_PAGE, [N]=TEST [ 56.242957] Hardware name: Thundercomm Dragonboard 845c (DT) [ 56.242967] Call trace: [ 56.242974] show_stack+0x20/0x38 (C) [ 56.242990] dump_stack_lvl+0x8c/0xd0 [ 56.243009] print_report+0x118/0x608 [ 56.243026] kasan_report+0xdc/0x128 [ 56.243044] __asan_report_load8_noabort+0x20/0x30 [ 56.243062] kasan_bitops_test_and_modify.constprop.0+0xa00/0xbc0 [ 56.243083] kasan_bitops_generic+0x11c/0x1c8 [ 56.243103] kunit_try_run_case+0x170/0x3f0 [ 56.243121] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 56.243141] kthread+0x328/0x630 [ 56.243154] ret_from_fork+0x10/0x20 [ 56.243170] [ 56.315173] Allocated by task 347: [ 56.318631] kasan_save_stack+0x3c/0x68 [ 56.322529] kasan_save_track+0x20/0x40 [ 56.326426] kasan_save_alloc_info+0x40/0x58 [ 56.330766] __kasan_kmalloc+0xd4/0xd8 [ 56.334576] __kmalloc_cache_noprof+0x16c/0x3c0 [ 56.339178] kasan_bitops_generic+0xa0/0x1c8 [ 56.343518] kunit_try_run_case+0x170/0x3f0 [ 56.347772] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 56.353341] kthread+0x328/0x630 [ 56.356628] ret_from_fork+0x10/0x20 [ 56.360263] [ 56.361787] The buggy address belongs to the object at ffff000093276b80 [ 56.361787] which belongs to the cache kmalloc-16 of size 16 [ 56.374268] The buggy address is located 8 bytes inside of [ 56.374268] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 56.386665] [ 56.388188] The buggy address belongs to the physical page: [ 56.393834] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 56.401934] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 56.408543] page_type: f5(slab) [ 56.411742] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 56.419580] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 56.427415] page dumped because: kasan: bad access detected [ 56.433062] [ 56.434585] Memory state around the buggy address: [ 56.439442] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 56.446756] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 56.454069] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.461381] ^ [ 56.464925] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.472239] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 56.479550] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kasan_bitops_modifyconstprop
[ 53.785737] ================================================================== [ 53.793056] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x1dc/0xbc0 [ 53.801330] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 53.808821] [ 53.810347] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 53.810375] Tainted: [B]=BAD_PAGE, [N]=TEST [ 53.810383] Hardware name: Thundercomm Dragonboard 845c (DT) [ 53.810393] Call trace: [ 53.810399] show_stack+0x20/0x38 (C) [ 53.810416] dump_stack_lvl+0x8c/0xd0 [ 53.810434] print_report+0x118/0x608 [ 53.810453] kasan_report+0xdc/0x128 [ 53.810472] kasan_check_range+0x100/0x1a8 [ 53.810492] __kasan_check_write+0x20/0x30 [ 53.810507] kasan_bitops_modify.constprop.0+0x1dc/0xbc0 [ 53.810527] kasan_bitops_generic+0x110/0x1c8 [ 53.810545] kunit_try_run_case+0x170/0x3f0 [ 53.810562] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.810582] kthread+0x328/0x630 [ 53.810596] ret_from_fork+0x10/0x20 [ 53.810613] [ 53.885238] Allocated by task 347: [ 53.888688] kasan_save_stack+0x3c/0x68 [ 53.892590] kasan_save_track+0x20/0x40 [ 53.896493] kasan_save_alloc_info+0x40/0x58 [ 53.900827] __kasan_kmalloc+0xd4/0xd8 [ 53.904640] __kmalloc_cache_noprof+0x16c/0x3c0 [ 53.909236] kasan_bitops_generic+0xa0/0x1c8 [ 53.913572] kunit_try_run_case+0x170/0x3f0 [ 53.917820] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.923383] kthread+0x328/0x630 [ 53.926667] ret_from_fork+0x10/0x20 [ 53.930307] [ 53.931836] The buggy address belongs to the object at ffff000093276b80 [ 53.931836] which belongs to the cache kmalloc-16 of size 16 [ 53.944311] The buggy address is located 8 bytes inside of [ 53.944311] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 53.956704] [ 53.958226] The buggy address belongs to the physical page: [ 53.963872] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 53.971979] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 53.978594] page_type: f5(slab) [ 53.981788] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 53.989625] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 53.997456] page dumped because: kasan: bad access detected [ 54.003099] [ 54.004628] Memory state around the buggy address: [ 54.009488] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 54.016801] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 54.024115] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.031428] ^ [ 54.034968] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.042282] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.049594] ================================================================== [ 54.056995] ================================================================== [ 54.064310] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xa80/0xbc0 [ 54.072589] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 54.079994] [ 54.081519] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 54.081548] Tainted: [B]=BAD_PAGE, [N]=TEST [ 54.081556] Hardware name: Thundercomm Dragonboard 845c (DT) [ 54.081566] Call trace: [ 54.081573] show_stack+0x20/0x38 (C) [ 54.081591] dump_stack_lvl+0x8c/0xd0 [ 54.081610] print_report+0x118/0x608 [ 54.081628] kasan_report+0xdc/0x128 [ 54.081646] __asan_report_load8_noabort+0x20/0x30 [ 54.081663] kasan_bitops_modify.constprop.0+0xa80/0xbc0 [ 54.081682] kasan_bitops_generic+0x110/0x1c8 [ 54.081700] kunit_try_run_case+0x170/0x3f0 [ 54.081718] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.081738] kthread+0x328/0x630 [ 54.081753] ret_from_fork+0x10/0x20 [ 54.081770] [ 54.152985] Allocated by task 347: [ 54.156436] kasan_save_stack+0x3c/0x68 [ 54.160341] kasan_save_track+0x20/0x40 [ 54.164244] kasan_save_alloc_info+0x40/0x58 [ 54.168578] __kasan_kmalloc+0xd4/0xd8 [ 54.172393] __kmalloc_cache_noprof+0x16c/0x3c0 [ 54.176990] kasan_bitops_generic+0xa0/0x1c8 [ 54.181326] kunit_try_run_case+0x170/0x3f0 [ 54.185575] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.191140] kthread+0x328/0x630 [ 54.194421] ret_from_fork+0x10/0x20 [ 54.198051] [ 54.199581] The buggy address belongs to the object at ffff000093276b80 [ 54.199581] which belongs to the cache kmalloc-16 of size 16 [ 54.212055] The buggy address is located 8 bytes inside of [ 54.212055] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 54.224446] [ 54.225970] The buggy address belongs to the physical page: [ 54.231616] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 54.239715] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 54.246329] page_type: f5(slab) [ 54.249524] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 54.257362] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 54.265195] page dumped because: kasan: bad access detected [ 54.270837] [ 54.272365] Memory state around the buggy address: [ 54.277225] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 54.284541] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 54.291854] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.299160] ^ [ 54.302698] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.310009] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.317323] ================================================================== [ 55.134835] ================================================================== [ 55.142146] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x344/0xbc0 [ 55.150421] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 55.157910] [ 55.159436] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 55.159464] Tainted: [B]=BAD_PAGE, [N]=TEST [ 55.159471] Hardware name: Thundercomm Dragonboard 845c (DT) [ 55.159481] Call trace: [ 55.159487] show_stack+0x20/0x38 (C) [ 55.159503] dump_stack_lvl+0x8c/0xd0 [ 55.159520] print_report+0x118/0x608 [ 55.159538] kasan_report+0xdc/0x128 [ 55.159556] kasan_check_range+0x100/0x1a8 [ 55.159575] __kasan_check_write+0x20/0x30 [ 55.159590] kasan_bitops_modify.constprop.0+0x344/0xbc0 [ 55.159609] kasan_bitops_generic+0x110/0x1c8 [ 55.159626] kunit_try_run_case+0x170/0x3f0 [ 55.159643] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 55.159664] kthread+0x328/0x630 [ 55.159677] ret_from_fork+0x10/0x20 [ 55.159693] [ 55.234326] Allocated by task 347: [ 55.237782] kasan_save_stack+0x3c/0x68 [ 55.241680] kasan_save_track+0x20/0x40 [ 55.245577] kasan_save_alloc_info+0x40/0x58 [ 55.249915] __kasan_kmalloc+0xd4/0xd8 [ 55.253724] __kmalloc_cache_noprof+0x16c/0x3c0 [ 55.258325] kasan_bitops_generic+0xa0/0x1c8 [ 55.262666] kunit_try_run_case+0x170/0x3f0 [ 55.266919] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 55.272478] kthread+0x328/0x630 [ 55.275764] ret_from_fork+0x10/0x20 [ 55.279398] [ 55.280921] The buggy address belongs to the object at ffff000093276b80 [ 55.280921] which belongs to the cache kmalloc-16 of size 16 [ 55.293400] The buggy address is located 8 bytes inside of [ 55.293400] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 55.305796] [ 55.307319] The buggy address belongs to the physical page: [ 55.312965] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 55.321062] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 55.327670] page_type: f5(slab) [ 55.330869] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 55.338707] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 55.346539] page dumped because: kasan: bad access detected [ 55.352185] [ 55.353707] Memory state around the buggy address: [ 55.358562] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 55.365875] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 55.373188] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.380499] ^ [ 55.384042] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.391354] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.398664] ================================================================== [ 54.324681] ================================================================== [ 54.331995] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x2b4/0xbc0 [ 54.340271] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 54.347760] [ 54.349285] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 54.349313] Tainted: [B]=BAD_PAGE, [N]=TEST [ 54.349321] Hardware name: Thundercomm Dragonboard 845c (DT) [ 54.349331] Call trace: [ 54.349337] show_stack+0x20/0x38 (C) [ 54.349354] dump_stack_lvl+0x8c/0xd0 [ 54.349372] print_report+0x118/0x608 [ 54.349391] kasan_report+0xdc/0x128 [ 54.349409] kasan_check_range+0x100/0x1a8 [ 54.349429] __kasan_check_write+0x20/0x30 [ 54.349444] kasan_bitops_modify.constprop.0+0x2b4/0xbc0 [ 54.349463] kasan_bitops_generic+0x110/0x1c8 [ 54.349480] kunit_try_run_case+0x170/0x3f0 [ 54.349497] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.349518] kthread+0x328/0x630 [ 54.349531] ret_from_fork+0x10/0x20 [ 54.349547] [ 54.424212] Allocated by task 347: [ 54.427663] kasan_save_stack+0x3c/0x68 [ 54.431567] kasan_save_track+0x20/0x40 [ 54.435461] kasan_save_alloc_info+0x40/0x58 [ 54.439792] __kasan_kmalloc+0xd4/0xd8 [ 54.443609] __kmalloc_cache_noprof+0x16c/0x3c0 [ 54.448206] kasan_bitops_generic+0xa0/0x1c8 [ 54.452542] kunit_try_run_case+0x170/0x3f0 [ 54.456791] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.462357] kthread+0x328/0x630 [ 54.465637] ret_from_fork+0x10/0x20 [ 54.469268] [ 54.470791] The buggy address belongs to the object at ffff000093276b80 [ 54.470791] which belongs to the cache kmalloc-16 of size 16 [ 54.483267] The buggy address is located 8 bytes inside of [ 54.483267] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 54.495656] [ 54.497180] The buggy address belongs to the physical page: [ 54.502820] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 54.510917] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 54.517529] page_type: f5(slab) [ 54.520723] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 54.528562] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 54.536395] page dumped because: kasan: bad access detected [ 54.542037] [ 54.543567] Memory state around the buggy address: [ 54.548417] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 54.555731] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 54.563037] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.570349] ^ [ 54.573887] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.581202] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.588515] ================================================================== [ 54.595873] ================================================================== [ 54.603190] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x320/0xbc0 [ 54.611464] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 54.618947] [ 54.620473] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 54.620502] Tainted: [B]=BAD_PAGE, [N]=TEST [ 54.620511] Hardware name: Thundercomm Dragonboard 845c (DT) [ 54.620521] Call trace: [ 54.620527] show_stack+0x20/0x38 (C) [ 54.620544] dump_stack_lvl+0x8c/0xd0 [ 54.620561] print_report+0x118/0x608 [ 54.620581] kasan_report+0xdc/0x128 [ 54.620599] kasan_check_range+0x100/0x1a8 [ 54.620617] __kasan_check_write+0x20/0x30 [ 54.620634] kasan_bitops_modify.constprop.0+0x320/0xbc0 [ 54.620653] kasan_bitops_generic+0x110/0x1c8 [ 54.620671] kunit_try_run_case+0x170/0x3f0 [ 54.620688] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.620707] kthread+0x328/0x630 [ 54.620721] ret_from_fork+0x10/0x20 [ 54.620738] [ 54.695380] Allocated by task 347: [ 54.698837] kasan_save_stack+0x3c/0x68 [ 54.702736] kasan_save_track+0x20/0x40 [ 54.706633] kasan_save_alloc_info+0x40/0x58 [ 54.710970] __kasan_kmalloc+0xd4/0xd8 [ 54.714779] __kmalloc_cache_noprof+0x16c/0x3c0 [ 54.719381] kasan_bitops_generic+0xa0/0x1c8 [ 54.723721] kunit_try_run_case+0x170/0x3f0 [ 54.727975] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.733544] kthread+0x328/0x630 [ 54.736830] ret_from_fork+0x10/0x20 [ 54.740466] [ 54.741989] The buggy address belongs to the object at ffff000093276b80 [ 54.741989] which belongs to the cache kmalloc-16 of size 16 [ 54.754469] The buggy address is located 8 bytes inside of [ 54.754469] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 54.766865] [ 54.768388] The buggy address belongs to the physical page: [ 54.774034] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 54.782132] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 54.788740] page_type: f5(slab) [ 54.791940] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 54.799777] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 54.807611] page dumped because: kasan: bad access detected [ 54.813258] [ 54.814781] Memory state around the buggy address: [ 54.819637] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 54.826950] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 54.834263] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.841573] ^ [ 54.845116] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.852428] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 54.859739] ================================================================== [ 54.867113] ================================================================== [ 54.874428] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xaec/0xbc0 [ 54.882703] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 54.890107] [ 54.891634] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 54.891662] Tainted: [B]=BAD_PAGE, [N]=TEST [ 54.891669] Hardware name: Thundercomm Dragonboard 845c (DT) [ 54.891680] Call trace: [ 54.891686] show_stack+0x20/0x38 (C) [ 54.891704] dump_stack_lvl+0x8c/0xd0 [ 54.891722] print_report+0x118/0x608 [ 54.891741] kasan_report+0xdc/0x128 [ 54.891760] __asan_report_load8_noabort+0x20/0x30 [ 54.891776] kasan_bitops_modify.constprop.0+0xaec/0xbc0 [ 54.891796] kasan_bitops_generic+0x110/0x1c8 [ 54.891815] kunit_try_run_case+0x170/0x3f0 [ 54.891832] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 54.891853] kthread+0x328/0x630 [ 54.891867] ret_from_fork+0x10/0x20 [ 54.891883] [ 54.963094] Allocated by task 347: [ 54.966550] kasan_save_stack+0x3c/0x68 [ 54.970448] kasan_save_track+0x20/0x40 [ 54.974347] kasan_save_alloc_info+0x40/0x58 [ 54.978685] __kasan_kmalloc+0xd4/0xd8 [ 54.982493] __kmalloc_cache_noprof+0x16c/0x3c0 [ 54.987096] kasan_bitops_generic+0xa0/0x1c8 [ 54.991438] kunit_try_run_case+0x170/0x3f0 [ 54.995692] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 55.001250] kthread+0x328/0x630 [ 55.004536] ret_from_fork+0x10/0x20 [ 55.008171] [ 55.009693] The buggy address belongs to the object at ffff000093276b80 [ 55.009693] which belongs to the cache kmalloc-16 of size 16 [ 55.022174] The buggy address is located 8 bytes inside of [ 55.022174] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 55.034571] [ 55.036095] The buggy address belongs to the physical page: [ 55.041740] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 55.049838] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 55.056447] page_type: f5(slab) [ 55.059648] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 55.067485] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 55.075320] page dumped because: kasan: bad access detected [ 55.080969] [ 55.082491] Memory state around the buggy address: [ 55.087347] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 55.094661] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 55.101975] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.109287] ^ [ 55.112830] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.120143] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.127454] ================================================================== [ 55.406033] ================================================================== [ 55.413346] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x3b0/0xbc0 [ 55.421621] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 55.429111] [ 55.430636] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 55.430665] Tainted: [B]=BAD_PAGE, [N]=TEST [ 55.430672] Hardware name: Thundercomm Dragonboard 845c (DT) [ 55.430682] Call trace: [ 55.430687] show_stack+0x20/0x38 (C) [ 55.430704] dump_stack_lvl+0x8c/0xd0 [ 55.430722] print_report+0x118/0x608 [ 55.430740] kasan_report+0xdc/0x128 [ 55.430757] kasan_check_range+0x100/0x1a8 [ 55.430777] __kasan_check_write+0x20/0x30 [ 55.430793] kasan_bitops_modify.constprop.0+0x3b0/0xbc0 [ 55.430811] kasan_bitops_generic+0x110/0x1c8 [ 55.430829] kunit_try_run_case+0x170/0x3f0 [ 55.430846] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 55.430867] kthread+0x328/0x630 [ 55.430880] ret_from_fork+0x10/0x20 [ 55.430896] [ 55.505530] Allocated by task 347: [ 55.508986] kasan_save_stack+0x3c/0x68 [ 55.512884] kasan_save_track+0x20/0x40 [ 55.516781] kasan_save_alloc_info+0x40/0x58 [ 55.521119] __kasan_kmalloc+0xd4/0xd8 [ 55.524928] __kmalloc_cache_noprof+0x16c/0x3c0 [ 55.529530] kasan_bitops_generic+0xa0/0x1c8 [ 55.533871] kunit_try_run_case+0x170/0x3f0 [ 55.538124] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 55.543693] kthread+0x328/0x630 [ 55.546979] ret_from_fork+0x10/0x20 [ 55.550614] [ 55.552136] The buggy address belongs to the object at ffff000093276b80 [ 55.552136] which belongs to the cache kmalloc-16 of size 16 [ 55.564617] The buggy address is located 8 bytes inside of [ 55.564617] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 55.577013] [ 55.578536] The buggy address belongs to the physical page: [ 55.584184] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 55.592280] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 55.598889] page_type: f5(slab) [ 55.602088] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 55.609925] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 55.617759] page dumped because: kasan: bad access detected [ 55.623407] [ 55.624930] Memory state around the buggy address: [ 55.629785] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 55.637097] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 55.644412] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.651723] ^ [ 55.655267] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.662579] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.669892] ================================================================== [ 53.242874] ================================================================== [ 53.254084] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x100/0xbc0 [ 53.262377] Write of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 53.269869] [ 53.271406] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 53.271437] Tainted: [B]=BAD_PAGE, [N]=TEST [ 53.271445] Hardware name: Thundercomm Dragonboard 845c (DT) [ 53.271457] Call trace: [ 53.271464] show_stack+0x20/0x38 (C) [ 53.271482] dump_stack_lvl+0x8c/0xd0 [ 53.271500] print_report+0x118/0x608 [ 53.271519] kasan_report+0xdc/0x128 [ 53.271537] kasan_check_range+0x100/0x1a8 [ 53.271557] __kasan_check_write+0x20/0x30 [ 53.271573] kasan_bitops_modify.constprop.0+0x100/0xbc0 [ 53.271591] kasan_bitops_generic+0x110/0x1c8 [ 53.271609] kunit_try_run_case+0x170/0x3f0 [ 53.271628] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.271649] kthread+0x328/0x630 [ 53.271663] ret_from_fork+0x10/0x20 [ 53.271680] [ 53.346306] Allocated by task 347: [ 53.349768] kasan_save_stack+0x3c/0x68 [ 53.353675] kasan_save_track+0x20/0x40 [ 53.357580] kasan_save_alloc_info+0x40/0x58 [ 53.361914] __kasan_kmalloc+0xd4/0xd8 [ 53.365729] __kmalloc_cache_noprof+0x16c/0x3c0 [ 53.370327] kasan_bitops_generic+0xa0/0x1c8 [ 53.374662] kunit_try_run_case+0x170/0x3f0 [ 53.378911] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.384479] kthread+0x328/0x630 [ 53.387760] ret_from_fork+0x10/0x20 [ 53.391401] [ 53.392933] The buggy address belongs to the object at ffff000093276b80 [ 53.392933] which belongs to the cache kmalloc-16 of size 16 [ 53.405411] The buggy address is located 8 bytes inside of [ 53.405411] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 53.417804] [ 53.419337] The buggy address belongs to the physical page: [ 53.424977] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 53.433076] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 53.439688] page_type: f5(slab) [ 53.442890] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 53.450729] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 53.458563] page dumped because: kasan: bad access detected [ 53.464211] [ 53.465734] Memory state around the buggy address: [ 53.470597] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 53.477912] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 53.485226] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.492540] ^ [ 53.496079] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.503395] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.510698] ================================================================== [ 55.677270] ================================================================== [ 55.684582] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xa20/0xbc0 [ 55.692858] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 55.700261] [ 55.701786] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 55.701815] Tainted: [B]=BAD_PAGE, [N]=TEST [ 55.701823] Hardware name: Thundercomm Dragonboard 845c (DT) [ 55.701834] Call trace: [ 55.701839] show_stack+0x20/0x38 (C) [ 55.701856] dump_stack_lvl+0x8c/0xd0 [ 55.701874] print_report+0x118/0x608 [ 55.701893] kasan_report+0xdc/0x128 [ 55.701911] __asan_report_load8_noabort+0x20/0x30 [ 55.701926] kasan_bitops_modify.constprop.0+0xa20/0xbc0 [ 55.701946] kasan_bitops_generic+0x110/0x1c8 [ 55.701964] kunit_try_run_case+0x170/0x3f0 [ 55.701980] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 55.702000] kthread+0x328/0x630 [ 55.702013] ret_from_fork+0x10/0x20 [ 55.702030] [ 55.773220] Allocated by task 347: [ 55.776677] kasan_save_stack+0x3c/0x68 [ 55.780575] kasan_save_track+0x20/0x40 [ 55.784472] kasan_save_alloc_info+0x40/0x58 [ 55.788810] __kasan_kmalloc+0xd4/0xd8 [ 55.792619] __kmalloc_cache_noprof+0x16c/0x3c0 [ 55.797220] kasan_bitops_generic+0xa0/0x1c8 [ 55.801561] kunit_try_run_case+0x170/0x3f0 [ 55.805814] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 55.811384] kthread+0x328/0x630 [ 55.814669] ret_from_fork+0x10/0x20 [ 55.818303] [ 55.819826] The buggy address belongs to the object at ffff000093276b80 [ 55.819826] which belongs to the cache kmalloc-16 of size 16 [ 55.832305] The buggy address is located 8 bytes inside of [ 55.832305] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 55.844701] [ 55.846224] The buggy address belongs to the physical page: [ 55.851871] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 55.859968] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 55.866577] page_type: f5(slab) [ 55.869776] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 55.877614] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 55.885447] page dumped because: kasan: bad access detected [ 55.891093] [ 55.892615] Memory state around the buggy address: [ 55.897471] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 55.904783] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 55.912096] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.919407] ^ [ 55.922950] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.930263] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.937574] ================================================================== [ 53.518067] ================================================================== [ 53.525384] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xa44/0xbc0 [ 53.533662] Read of size 8 at addr ffff000093276b88 by task kunit_try_catch/347 [ 53.541065] [ 53.542592] CPU: 7 UID: 0 PID: 347 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 53.542621] Tainted: [B]=BAD_PAGE, [N]=TEST [ 53.542630] Hardware name: Thundercomm Dragonboard 845c (DT) [ 53.542640] Call trace: [ 53.542647] show_stack+0x20/0x38 (C) [ 53.542665] dump_stack_lvl+0x8c/0xd0 [ 53.542683] print_report+0x118/0x608 [ 53.542703] kasan_report+0xdc/0x128 [ 53.542722] __asan_report_load8_noabort+0x20/0x30 [ 53.542740] kasan_bitops_modify.constprop.0+0xa44/0xbc0 [ 53.542760] kasan_bitops_generic+0x110/0x1c8 [ 53.542779] kunit_try_run_case+0x170/0x3f0 [ 53.542797] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.542818] kthread+0x328/0x630 [ 53.542832] ret_from_fork+0x10/0x20 [ 53.542849] [ 53.614034] Allocated by task 347: [ 53.617485] kasan_save_stack+0x3c/0x68 [ 53.621389] kasan_save_track+0x20/0x40 [ 53.625293] kasan_save_alloc_info+0x40/0x58 [ 53.629627] __kasan_kmalloc+0xd4/0xd8 [ 53.633441] __kmalloc_cache_noprof+0x16c/0x3c0 [ 53.638038] kasan_bitops_generic+0xa0/0x1c8 [ 53.642375] kunit_try_run_case+0x170/0x3f0 [ 53.646623] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.652182] kthread+0x328/0x630 [ 53.655466] ret_from_fork+0x10/0x20 [ 53.659097] [ 53.660626] The buggy address belongs to the object at ffff000093276b80 [ 53.660626] which belongs to the cache kmalloc-16 of size 16 [ 53.673102] The buggy address is located 8 bytes inside of [ 53.673102] allocated 9-byte region [ffff000093276b80, ffff000093276b89) [ 53.685494] [ 53.687017] The buggy address belongs to the physical page: [ 53.692665] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 53.700765] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 53.707376] page_type: f5(slab) [ 53.710575] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 53.718413] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 53.726249] page dumped because: kasan: bad access detected [ 53.731896] [ 53.733419] Memory state around the buggy address: [ 53.738271] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 53.745584] ffff000093276b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 53.752898] >ffff000093276b80: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.760210] ^ [ 53.763757] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.771066] ffff000093276c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.778375] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-strnlen
[ 52.932696] ================================================================== [ 52.940011] BUG: KASAN: slab-use-after-free in strnlen+0x80/0x88 [ 52.946095] Read of size 1 at addr ffff000096c34790 by task kunit_try_catch/345 [ 52.953499] [ 52.955024] CPU: 4 UID: 0 PID: 345 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 52.955053] Tainted: [B]=BAD_PAGE, [N]=TEST [ 52.955060] Hardware name: Thundercomm Dragonboard 845c (DT) [ 52.955070] Call trace: [ 52.955076] show_stack+0x20/0x38 (C) [ 52.955093] dump_stack_lvl+0x8c/0xd0 [ 52.955111] print_report+0x118/0x608 [ 52.955129] kasan_report+0xdc/0x128 [ 52.955146] __asan_report_load1_noabort+0x20/0x30 [ 52.955162] strnlen+0x80/0x88 [ 52.955176] kasan_strings+0x478/0xb00 [ 52.955191] kunit_try_run_case+0x170/0x3f0 [ 52.955208] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.955228] kthread+0x328/0x630 [ 52.955241] ret_from_fork+0x10/0x20 [ 52.955259] [ 53.023566] Allocated by task 345: [ 53.027022] kasan_save_stack+0x3c/0x68 [ 53.030927] kasan_save_track+0x20/0x40 [ 53.034827] kasan_save_alloc_info+0x40/0x58 [ 53.039160] __kasan_kmalloc+0xd4/0xd8 [ 53.042976] __kmalloc_cache_noprof+0x16c/0x3c0 [ 53.047579] kasan_strings+0xc8/0xb00 [ 53.051298] kunit_try_run_case+0x170/0x3f0 [ 53.055545] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.061108] kthread+0x328/0x630 [ 53.064389] ret_from_fork+0x10/0x20 [ 53.068020] [ 53.069543] Freed by task 345: [ 53.072646] kasan_save_stack+0x3c/0x68 [ 53.076549] kasan_save_track+0x20/0x40 [ 53.080452] kasan_save_free_info+0x4c/0x78 [ 53.084698] __kasan_slab_free+0x6c/0x98 [ 53.088688] kfree+0x214/0x3c8 [ 53.091797] kasan_strings+0x24c/0xb00 [ 53.095611] kunit_try_run_case+0x170/0x3f0 [ 53.099859] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 53.105423] kthread+0x328/0x630 [ 53.108705] ret_from_fork+0x10/0x20 [ 53.112346] [ 53.113875] The buggy address belongs to the object at ffff000096c34780 [ 53.113875] which belongs to the cache kmalloc-32 of size 32 [ 53.126359] The buggy address is located 16 bytes inside of [ 53.126359] freed 32-byte region [ffff000096c34780, ffff000096c347a0) [ 53.138580] [ 53.140111] The buggy address belongs to the physical page: [ 53.145754] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116c34 [ 53.153854] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 53.160465] page_type: f5(slab) [ 53.163662] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000 [ 53.171503] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 53.179339] page dumped because: kasan: bad access detected [ 53.184978] [ 53.186501] Memory state around the buggy address: [ 53.191361] ffff000096c34680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 53.198668] ffff000096c34700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 53.205983] >ffff000096c34780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 53.213298] ^ [ 53.217109] ffff000096c34800: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 53.224425] ffff000096c34880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 53.231737] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-strlen
[ 52.626420] ================================================================== [ 52.633736] BUG: KASAN: slab-use-after-free in strlen+0xa8/0xb0 [ 52.639740] Read of size 1 at addr ffff000096c34790 by task kunit_try_catch/345 [ 52.647148] [ 52.648681] CPU: 4 UID: 0 PID: 345 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 52.648710] Tainted: [B]=BAD_PAGE, [N]=TEST [ 52.648719] Hardware name: Thundercomm Dragonboard 845c (DT) [ 52.648730] Call trace: [ 52.648735] show_stack+0x20/0x38 (C) [ 52.648753] dump_stack_lvl+0x8c/0xd0 [ 52.648772] print_report+0x118/0x608 [ 52.648790] kasan_report+0xdc/0x128 [ 52.648808] __asan_report_load1_noabort+0x20/0x30 [ 52.648825] strlen+0xa8/0xb0 [ 52.648839] kasan_strings+0x418/0xb00 [ 52.648854] kunit_try_run_case+0x170/0x3f0 [ 52.648873] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.648893] kthread+0x328/0x630 [ 52.648907] ret_from_fork+0x10/0x20 [ 52.648923] [ 52.717157] Allocated by task 345: [ 52.720609] kasan_save_stack+0x3c/0x68 [ 52.724514] kasan_save_track+0x20/0x40 [ 52.728417] kasan_save_alloc_info+0x40/0x58 [ 52.732751] __kasan_kmalloc+0xd4/0xd8 [ 52.736567] __kmalloc_cache_noprof+0x16c/0x3c0 [ 52.741164] kasan_strings+0xc8/0xb00 [ 52.744891] kunit_try_run_case+0x170/0x3f0 [ 52.749140] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.754704] kthread+0x328/0x630 [ 52.757985] ret_from_fork+0x10/0x20 [ 52.761625] [ 52.763147] Freed by task 345: [ 52.766250] kasan_save_stack+0x3c/0x68 [ 52.770154] kasan_save_track+0x20/0x40 [ 52.774056] kasan_save_free_info+0x4c/0x78 [ 52.778302] __kasan_slab_free+0x6c/0x98 [ 52.782294] kfree+0x214/0x3c8 [ 52.785402] kasan_strings+0x24c/0xb00 [ 52.789215] kunit_try_run_case+0x170/0x3f0 [ 52.793464] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.799028] kthread+0x328/0x630 [ 52.802309] ret_from_fork+0x10/0x20 [ 52.805939] [ 52.807469] The buggy address belongs to the object at ffff000096c34780 [ 52.807469] which belongs to the cache kmalloc-32 of size 32 [ 52.819942] The buggy address is located 16 bytes inside of [ 52.819942] freed 32-byte region [ffff000096c34780, ffff000096c347a0) [ 52.832162] [ 52.833685] The buggy address belongs to the physical page: [ 52.839325] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116c34 [ 52.847420] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 52.854034] page_type: f5(slab) [ 52.857230] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000 [ 52.865070] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 52.872905] page dumped because: kasan: bad access detected [ 52.878547] [ 52.880074] Memory state around the buggy address: [ 52.884926] ffff000096c34680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.892241] ffff000096c34700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.899556] >ffff000096c34780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.906861] ^ [ 52.910670] ffff000096c34800: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 52.917984] ffff000096c34880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.925293] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-alloca-out-of-bounds-in-kasan_alloca_oob_left
[ 51.218682] ================================================================== [ 51.229708] BUG: KASAN: alloca-out-of-bounds in kasan_alloca_oob_left+0x2b8/0x310 [ 51.237295] Read of size 1 at addr ffff8000841d7b5f by task kunit_try_catch/337 [ 51.244700] [ 51.246231] CPU: 6 UID: 0 PID: 337 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 51.246265] Tainted: [B]=BAD_PAGE, [N]=TEST [ 51.246273] Hardware name: Thundercomm Dragonboard 845c (DT) [ 51.246287] Call trace: [ 51.246295] show_stack+0x20/0x38 (C) [ 51.246313] dump_stack_lvl+0x8c/0xd0 [ 51.246332] print_report+0x310/0x608 [ 51.246351] kasan_report+0xdc/0x128 [ 51.246368] __asan_report_load1_noabort+0x20/0x30 [ 51.246386] kasan_alloca_oob_left+0x2b8/0x310 [ 51.246403] kunit_try_run_case+0x170/0x3f0 [ 51.246422] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 51.246445] kthread+0x328/0x630 [ 51.246458] ret_from_fork+0x10/0x20 [ 51.246476] [ 51.312391] The buggy address belongs to stack of task kunit_try_catch/337 [ 51.319362] [ 51.320895] The buggy address belongs to the virtual mapping at [ 51.320895] [ffff8000841d0000, ffff8000841d9000) created by: [ 51.320895] kernel_clone+0x150/0x7a8 [ 51.336358] [ 51.337884] The buggy address belongs to the physical page: [ 51.343525] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1166e7 [ 51.351626] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 51.358248] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 51.366091] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 51.373926] page dumped because: kasan: bad access detected [ 51.379567] [ 51.381089] Memory state around the buggy address: [ 51.385942] ffff8000841d7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.393259] ffff8000841d7a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.400566] >ffff8000841d7b00: 00 00 00 00 00 00 00 00 ca ca ca ca 00 02 cb cb [ 51.407879] ^ [ 51.414048] ffff8000841d7b80: cb cb cb cb 00 00 00 00 f1 f1 f1 f1 01 f2 04 f2 [ 51.421354] ffff8000841d7c00: 00 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00 [ 51.428668] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-kasan_strings
[ 52.322427] ================================================================== [ 52.329745] BUG: KASAN: slab-use-after-free in kasan_strings+0x95c/0xb00 [ 52.336540] Read of size 1 at addr ffff000096c34790 by task kunit_try_catch/345 [ 52.343944] [ 52.345470] CPU: 4 UID: 0 PID: 345 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 52.345500] Tainted: [B]=BAD_PAGE, [N]=TEST [ 52.345507] Hardware name: Thundercomm Dragonboard 845c (DT) [ 52.345518] Call trace: [ 52.345525] show_stack+0x20/0x38 (C) [ 52.345543] dump_stack_lvl+0x8c/0xd0 [ 52.345560] print_report+0x118/0x608 [ 52.345578] kasan_report+0xdc/0x128 [ 52.345597] __asan_report_load1_noabort+0x20/0x30 [ 52.345613] kasan_strings+0x95c/0xb00 [ 52.345629] kunit_try_run_case+0x170/0x3f0 [ 52.345645] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.345667] kthread+0x328/0x630 [ 52.345680] ret_from_fork+0x10/0x20 [ 52.345696] [ 52.410920] Allocated by task 345: [ 52.414372] kasan_save_stack+0x3c/0x68 [ 52.418277] kasan_save_track+0x20/0x40 [ 52.422179] kasan_save_alloc_info+0x40/0x58 [ 52.426513] __kasan_kmalloc+0xd4/0xd8 [ 52.430328] __kmalloc_cache_noprof+0x16c/0x3c0 [ 52.434924] kasan_strings+0xc8/0xb00 [ 52.438651] kunit_try_run_case+0x170/0x3f0 [ 52.442898] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.448458] kthread+0x328/0x630 [ 52.451740] ret_from_fork+0x10/0x20 [ 52.455372] [ 52.456903] Freed by task 345: [ 52.460007] kasan_save_stack+0x3c/0x68 [ 52.463909] kasan_save_track+0x20/0x40 [ 52.467812] kasan_save_free_info+0x4c/0x78 [ 52.472058] __kasan_slab_free+0x6c/0x98 [ 52.476047] kfree+0x214/0x3c8 [ 52.479159] kasan_strings+0x24c/0xb00 [ 52.482972] kunit_try_run_case+0x170/0x3f0 [ 52.487221] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.492781] kthread+0x328/0x630 [ 52.496062] ret_from_fork+0x10/0x20 [ 52.499702] [ 52.501225] The buggy address belongs to the object at ffff000096c34780 [ 52.501225] which belongs to the cache kmalloc-32 of size 32 [ 52.513702] The buggy address is located 16 bytes inside of [ 52.513702] freed 32-byte region [ffff000096c34780, ffff000096c347a0) [ 52.525921] [ 52.527451] The buggy address belongs to the physical page: [ 52.533091] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116c34 [ 52.541188] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 52.547798] page_type: f5(slab) [ 52.550998] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000 [ 52.558836] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 52.566671] page dumped because: kasan: bad access detected [ 52.572317] [ 52.573839] Memory state around the buggy address: [ 52.578690] ffff000096c34680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.586003] ffff000096c34700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.593318] >ffff000096c34780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.600629] ^ [ 52.604438] ffff000096c34800: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 52.611752] ffff000096c34880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.619058] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-strcmp
[ 51.999288] ================================================================== [ 52.023450] BUG: KASAN: slab-use-after-free in strcmp+0xc0/0xc8 [ 52.029451] Read of size 1 at addr ffff000096c34790 by task kunit_try_catch/345 [ 52.036857] [ 52.038388] CPU: 4 UID: 0 PID: 345 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 52.038422] Tainted: [B]=BAD_PAGE, [N]=TEST [ 52.038431] Hardware name: Thundercomm Dragonboard 845c (DT) [ 52.038445] Call trace: [ 52.038453] show_stack+0x20/0x38 (C) [ 52.038474] dump_stack_lvl+0x8c/0xd0 [ 52.038494] print_report+0x118/0x608 [ 52.038513] kasan_report+0xdc/0x128 [ 52.038532] __asan_report_load1_noabort+0x20/0x30 [ 52.038548] strcmp+0xc0/0xc8 [ 52.038562] kasan_strings+0x340/0xb00 [ 52.038578] kunit_try_run_case+0x170/0x3f0 [ 52.038599] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.038621] kthread+0x328/0x630 [ 52.038636] ret_from_fork+0x10/0x20 [ 52.038653] [ 52.106878] Allocated by task 345: [ 52.110332] kasan_save_stack+0x3c/0x68 [ 52.114238] kasan_save_track+0x20/0x40 [ 52.118140] kasan_save_alloc_info+0x40/0x58 [ 52.122474] __kasan_kmalloc+0xd4/0xd8 [ 52.126291] __kmalloc_cache_noprof+0x16c/0x3c0 [ 52.130889] kasan_strings+0xc8/0xb00 [ 52.134616] kunit_try_run_case+0x170/0x3f0 [ 52.138864] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.144433] kthread+0x328/0x630 [ 52.147714] ret_from_fork+0x10/0x20 [ 52.151347] [ 52.152877] Freed by task 345: [ 52.155983] kasan_save_stack+0x3c/0x68 [ 52.159886] kasan_save_track+0x20/0x40 [ 52.163790] kasan_save_free_info+0x4c/0x78 [ 52.168036] __kasan_slab_free+0x6c/0x98 [ 52.172026] kfree+0x214/0x3c8 [ 52.175139] kasan_strings+0x24c/0xb00 [ 52.178951] kunit_try_run_case+0x170/0x3f0 [ 52.183200] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 52.188760] kthread+0x328/0x630 [ 52.192042] ret_from_fork+0x10/0x20 [ 52.195673] [ 52.197196] The buggy address belongs to the object at ffff000096c34780 [ 52.197196] which belongs to the cache kmalloc-32 of size 32 [ 52.209672] The buggy address is located 16 bytes inside of [ 52.209672] freed 32-byte region [ffff000096c34780, ffff000096c347a0) [ 52.221891] [ 52.223422] The buggy address belongs to the physical page: [ 52.229061] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116c34 [ 52.237163] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 52.243774] page_type: f5(slab) [ 52.246976] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000 [ 52.254816] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 52.262649] page dumped because: kasan: bad access detected [ 52.268298] [ 52.269820] Memory state around the buggy address: [ 52.274672] ffff000096c34680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.281987] ffff000096c34700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.289300] >ffff000096c34780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.296612] ^ [ 52.300424] ffff000096c34800: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 52.307738] ffff000096c34880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 52.315044] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-memcmp
[ 51.685462] ================================================================== [ 51.696584] BUG: KASAN: slab-out-of-bounds in memcmp+0x198/0x1d8 [ 51.702678] Read of size 1 at addr ffff0000937e3758 by task kunit_try_catch/343 [ 51.710085] [ 51.711623] CPU: 6 UID: 0 PID: 343 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 51.711657] Tainted: [B]=BAD_PAGE, [N]=TEST [ 51.711665] Hardware name: Thundercomm Dragonboard 845c (DT) [ 51.711679] Call trace: [ 51.711686] show_stack+0x20/0x38 (C) [ 51.711706] dump_stack_lvl+0x8c/0xd0 [ 51.711725] print_report+0x118/0x608 [ 51.711744] kasan_report+0xdc/0x128 [ 51.711762] __asan_report_load1_noabort+0x20/0x30 [ 51.711778] memcmp+0x198/0x1d8 [ 51.711792] kasan_memcmp+0x16c/0x300 [ 51.711808] kunit_try_run_case+0x170/0x3f0 [ 51.711826] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 51.711847] kthread+0x328/0x630 [ 51.711860] ret_from_fork+0x10/0x20 [ 51.711879] [ 51.780175] Allocated by task 343: [ 51.783632] kasan_save_stack+0x3c/0x68 [ 51.787538] kasan_save_track+0x20/0x40 [ 51.791442] kasan_save_alloc_info+0x40/0x58 [ 51.795776] __kasan_kmalloc+0xd4/0xd8 [ 51.799594] __kmalloc_cache_noprof+0x16c/0x3c0 [ 51.804195] kasan_memcmp+0xbc/0x300 [ 51.807826] kunit_try_run_case+0x170/0x3f0 [ 51.812075] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 51.817640] kthread+0x328/0x630 [ 51.820923] ret_from_fork+0x10/0x20 [ 51.824555] [ 51.826078] The buggy address belongs to the object at ffff0000937e3740 [ 51.826078] which belongs to the cache kmalloc-32 of size 32 [ 51.838559] The buggy address is located 0 bytes to the right of [ 51.838559] allocated 24-byte region [ffff0000937e3740, ffff0000937e3758) [ 51.851562] [ 51.853086] The buggy address belongs to the physical page: [ 51.858730] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1137e3 [ 51.866833] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 51.873445] page_type: f5(slab) [ 51.876645] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000 [ 51.884489] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 51.892324] page dumped because: kasan: bad access detected [ 51.897968] [ 51.899497] Memory state around the buggy address: [ 51.904349] ffff0000937e3600: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 51.911664] ffff0000937e3680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 51.918974] >ffff0000937e3700: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc [ 51.926279] ^ [ 51.932453] ffff0000937e3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 51.939760] ffff0000937e3800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 51.947068] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-alloca-out-of-bounds-in-kasan_alloca_oob_right
[ 51.438899] ================================================================== [ 51.450459] BUG: KASAN: alloca-out-of-bounds in kasan_alloca_oob_right+0x2dc/0x340 [ 51.458137] Read of size 1 at addr ffff8000841f7b4a by task kunit_try_catch/339 [ 51.465550] [ 51.467086] CPU: 0 UID: 0 PID: 339 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 51.467118] Tainted: [B]=BAD_PAGE, [N]=TEST [ 51.467128] Hardware name: Thundercomm Dragonboard 845c (DT) [ 51.467144] Call trace: [ 51.467152] show_stack+0x20/0x38 (C) [ 51.467171] dump_stack_lvl+0x8c/0xd0 [ 51.467191] print_report+0x310/0x608 [ 51.467210] kasan_report+0xdc/0x128 [ 51.467231] __asan_report_load1_noabort+0x20/0x30 [ 51.467249] kasan_alloca_oob_right+0x2dc/0x340 [ 51.467268] kunit_try_run_case+0x170/0x3f0 [ 51.467289] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 51.467312] kthread+0x328/0x630 [ 51.467327] ret_from_fork+0x10/0x20 [ 51.467348] [ 51.533397] The buggy address belongs to stack of task kunit_try_catch/339 [ 51.540375] [ 51.541909] The buggy address belongs to the virtual mapping at [ 51.541909] [ffff8000841f0000, ffff8000841f9000) created by: [ 51.541909] kernel_clone+0x150/0x7a8 [ 51.557391] [ 51.558924] The buggy address belongs to the physical page: [ 51.564570] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116748 [ 51.572676] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 51.579296] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 51.587144] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 51.594987] page dumped because: kasan: bad access detected [ 51.600633] [ 51.602165] Memory state around the buggy address: [ 51.607024] ffff8000841f7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.614340] ffff8000841f7a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.621656] >ffff8000841f7b00: 00 00 00 00 ca ca ca ca 00 02 cb cb cb cb cb cb [ 51.628969] ^ [ 51.634619] ffff8000841f7b80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 01 f2 04 f2 [ 51.641934] ffff8000841f7c00: 00 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00 [ 51.649247] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-stack-out-of-bounds-in-kasan_stack_oob
[ 50.968079] ================================================================== [ 50.983311] BUG: KASAN: stack-out-of-bounds in kasan_stack_oob+0x238/0x270 [ 50.990285] Read of size 1 at addr ffff8000841b7c2a by task kunit_try_catch/335 [ 50.997695] [ 50.999229] CPU: 0 UID: 0 PID: 335 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 50.999261] Tainted: [B]=BAD_PAGE, [N]=TEST [ 50.999271] Hardware name: Thundercomm Dragonboard 845c (DT) [ 50.999283] Call trace: [ 50.999290] show_stack+0x20/0x38 (C) [ 50.999311] dump_stack_lvl+0x8c/0xd0 [ 50.999332] print_report+0x310/0x608 [ 50.999352] kasan_report+0xdc/0x128 [ 50.999372] __asan_report_load1_noabort+0x20/0x30 [ 50.999391] kasan_stack_oob+0x238/0x270 [ 50.999409] kunit_try_run_case+0x170/0x3f0 [ 50.999430] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 50.999453] kthread+0x328/0x630 [ 50.999468] ret_from_fork+0x10/0x20 [ 50.999489] [ 51.064944] The buggy address belongs to stack of task kunit_try_catch/335 [ 51.071911] and is located at offset 138 in frame: [ 51.076857] kasan_stack_oob+0x0/0x270 [ 51.080686] [ 51.082217] This frame has 4 objects: [ 51.085949] [48, 49) '__assertion' [ 51.085964] [64, 72) 'array' [ 51.089511] [96, 112) '__assertion' [ 51.092540] [128, 138) 'stack_array' [ 51.096174] [ 51.101409] The buggy address belongs to the virtual mapping at [ 51.101409] [ffff8000841b0000, ffff8000841b9000) created by: [ 51.101409] kernel_clone+0x150/0x7a8 [ 51.116891] [ 51.118426] The buggy address belongs to the physical page: [ 51.124072] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116e86 [ 51.132187] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 51.138814] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 51.146662] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 51.154505] page dumped because: kasan: bad access detected [ 51.160150] [ 51.161680] Memory state around the buggy address: [ 51.166544] ffff8000841b7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.173868] ffff8000841b7b80: 00 00 00 00 f1 f1 f1 f1 f1 f1 01 f2 00 f2 f2 f2 [ 51.181193] >ffff8000841b7c00: 00 00 f2 f2 00 02 f3 f3 00 00 00 00 00 00 00 00 [ 51.188506] ^ [ 51.193112] ffff8000841b7c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f2 f2 [ 51.200426] ffff8000841b7d00: 00 00 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00 [ 51.207743] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-global-out-of-bounds-in-kasan_global_oob_right
[ 50.738966] ================================================================== [ 50.751663] BUG: KASAN: global-out-of-bounds in kasan_global_oob_right+0x230/0x270 [ 50.759335] Read of size 1 at addr ffffd817b02c768d by task kunit_try_catch/331 [ 50.766743] [ 50.768279] CPU: 6 UID: 0 PID: 331 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 50.768313] Tainted: [B]=BAD_PAGE, [N]=TEST [ 50.768322] Hardware name: Thundercomm Dragonboard 845c (DT) [ 50.768336] Call trace: [ 50.768343] show_stack+0x20/0x38 (C) [ 50.768362] dump_stack_lvl+0x8c/0xd0 [ 50.768382] print_report+0x310/0x608 [ 50.768402] kasan_report+0xdc/0x128 [ 50.768420] __asan_report_load1_noabort+0x20/0x30 [ 50.768437] kasan_global_oob_right+0x230/0x270 [ 50.768454] kunit_try_run_case+0x170/0x3f0 [ 50.768473] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 50.768496] kthread+0x328/0x630 [ 50.768511] ret_from_fork+0x10/0x20 [ 50.768529] [ 50.834521] The buggy address belongs to the variable: [ 50.839721] global_array+0xd/0x40 [ 50.843188] [ 50.844727] The buggy address belongs to the virtual mapping at [ 50.844727] [ffffd817ae460000, ffffd817b0381000) created by: [ 50.844727] paging_init+0x66c/0x7d0 [ 50.860104] [ 50.861632] The buggy address belongs to the physical page: [ 50.867273] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa7ac7 [ 50.875285] flags: 0x3fffe0000002000(reserved|node=0|zone=0|lastcpupid=0x1ffff) [ 50.882699] raw: 03fffe0000002000 fffffdffc09eb1c8 fffffdffc09eb1c8 0000000000000000 [ 50.890535] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 50.898366] page dumped because: kasan: bad access detected [ 50.904012] [ 50.905534] Memory state around the buggy address: [ 50.910399] ffffd817b02c7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.917709] ffffd817b02c7600: 00 00 00 00 00 00 00 00 02 f9 f9 f9 f9 f9 f9 f9 [ 50.925022] >ffffd817b02c7680: 00 02 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 [ 50.932332] ^ [ 50.935880] ffffd817b02c7700: 00 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 [ 50.943186] ffffd817b02c7780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.950498] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-invalid-free-in-mempool_kmalloc_invalid_free_helper
[ 50.490530] ================================================================== [ 50.502705] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 50.510816] Free of addr ffff000096708001 by task kunit_try_catch/329 [ 50.517342] [ 50.518879] CPU: 1 UID: 0 PID: 329 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 50.518913] Tainted: [B]=BAD_PAGE, [N]=TEST [ 50.518925] Hardware name: Thundercomm Dragonboard 845c (DT) [ 50.518942] Call trace: [ 50.518951] show_stack+0x20/0x38 (C) [ 50.518971] dump_stack_lvl+0x8c/0xd0 [ 50.518993] print_report+0x118/0x608 [ 50.519014] kasan_report_invalid_free+0xc0/0xe8 [ 50.519035] __kasan_mempool_poison_object+0xfc/0x150 [ 50.519058] mempool_free+0x28c/0x328 [ 50.519078] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 50.519099] mempool_kmalloc_large_invalid_free+0xc0/0x118 [ 50.519122] kunit_try_run_case+0x170/0x3f0 [ 50.519144] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 50.519169] kthread+0x328/0x630 [ 50.519185] ret_from_fork+0x10/0x20 [ 50.519205] [ 50.596958] The buggy address belongs to the physical page: [ 50.602604] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116708 [ 50.610710] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 50.618469] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 50.625530] page_type: f8(unknown) [ 50.629003] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 50.636852] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 50.644699] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 50.652634] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 50.660568] head: 0bfffe0000000002 fffffdffc259c201 00000000ffffffff 00000000ffffffff [ 50.668501] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 50.676431] page dumped because: kasan: bad access detected [ 50.682078] [ 50.683607] Memory state around the buggy address: [ 50.688468] ffff000096707f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 50.695783] ffff000096707f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 50.703099] >ffff000096708000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.710412] ^ [ 50.713695] ffff000096708080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.721012] ffff000096708100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.728325] ================================================================== [ 50.153810] ================================================================== [ 50.166168] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 50.174291] Free of addr ffff00008039fa01 by task kunit_try_catch/327 [ 50.180824] [ 50.182363] CPU: 0 UID: 0 PID: 327 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 50.182400] Tainted: [B]=BAD_PAGE, [N]=TEST [ 50.182410] Hardware name: Thundercomm Dragonboard 845c (DT) [ 50.182428] Call trace: [ 50.182438] show_stack+0x20/0x38 (C) [ 50.182458] dump_stack_lvl+0x8c/0xd0 [ 50.182482] print_report+0x118/0x608 [ 50.182503] kasan_report_invalid_free+0xc0/0xe8 [ 50.182525] check_slab_allocation+0xfc/0x108 [ 50.182548] __kasan_mempool_poison_object+0x78/0x150 [ 50.182570] mempool_free+0x28c/0x328 [ 50.182590] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 50.182613] mempool_kmalloc_invalid_free+0xc0/0x118 [ 50.182633] kunit_try_run_case+0x170/0x3f0 [ 50.182656] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 50.182679] kthread+0x328/0x630 [ 50.182694] ret_from_fork+0x10/0x20 [ 50.182714] [ 50.264370] Allocated by task 327: [ 50.267836] kasan_save_stack+0x3c/0x68 [ 50.271748] kasan_save_track+0x20/0x40 [ 50.275657] kasan_save_alloc_info+0x40/0x58 [ 50.280004] __kasan_mempool_unpoison_object+0x11c/0x180 [ 50.285405] remove_element+0x130/0x1f8 [ 50.289313] mempool_alloc_preallocated+0x58/0xc0 [ 50.294097] mempool_kmalloc_invalid_free_helper+0x94/0x2a8 [ 50.299753] mempool_kmalloc_invalid_free+0xc0/0x118 [ 50.304802] kunit_try_run_case+0x170/0x3f0 [ 50.309056] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 50.314629] kthread+0x328/0x630 [ 50.317920] ret_from_fork+0x10/0x20 [ 50.321569] [ 50.323100] The buggy address belongs to the object at ffff00008039fa00 [ 50.323100] which belongs to the cache kmalloc-128 of size 128 [ 50.335764] The buggy address is located 1 bytes inside of [ 50.335764] 128-byte region [ffff00008039fa00, ffff00008039fa80) [ 50.347458] [ 50.348991] The buggy address belongs to the physical page: [ 50.354643] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 50.362755] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 50.370513] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 50.377571] page_type: f5(slab) [ 50.380778] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 50.388624] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 50.396467] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 50.404398] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 50.412332] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 50.420271] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 50.428205] page dumped because: kasan: bad access detected [ 50.433856] [ 50.435384] Memory state around the buggy address: [ 50.440253] ffff00008039f900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.447570] ffff00008039f980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.454895] >ffff00008039fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.462217] ^ [ 50.465503] ffff00008039fa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.472827] ffff00008039fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.480148] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-double-free-in-mempool_double_free_helper
[ 49.315735] ================================================================== [ 49.327411] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 49.334664] Free of addr ffff00008039f600 by task kunit_try_catch/321 [ 49.341196] [ 49.342735] CPU: 0 UID: 0 PID: 321 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 49.342774] Tainted: [B]=BAD_PAGE, [N]=TEST [ 49.342785] Hardware name: Thundercomm Dragonboard 845c (DT) [ 49.342804] Call trace: [ 49.342814] show_stack+0x20/0x38 (C) [ 49.342835] dump_stack_lvl+0x8c/0xd0 [ 49.342860] print_report+0x118/0x608 [ 49.342883] kasan_report_invalid_free+0xc0/0xe8 [ 49.342904] check_slab_allocation+0xd4/0x108 [ 49.342927] __kasan_mempool_poison_object+0x78/0x150 [ 49.342952] mempool_free+0x28c/0x328 [ 49.342973] mempool_double_free_helper+0x150/0x2e8 [ 49.342993] mempool_kmalloc_double_free+0xc0/0x118 [ 49.343013] kunit_try_run_case+0x170/0x3f0 [ 49.343038] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 49.343061] kthread+0x328/0x630 [ 49.343078] ret_from_fork+0x10/0x20 [ 49.343099] [ 49.423874] Allocated by task 321: [ 49.427337] kasan_save_stack+0x3c/0x68 [ 49.431248] kasan_save_track+0x20/0x40 [ 49.435159] kasan_save_alloc_info+0x40/0x58 [ 49.439505] __kasan_mempool_unpoison_object+0x11c/0x180 [ 49.444900] remove_element+0x130/0x1f8 [ 49.448806] mempool_alloc_preallocated+0x58/0xc0 [ 49.453588] mempool_double_free_helper+0x94/0x2e8 [ 49.458456] mempool_kmalloc_double_free+0xc0/0x118 [ 49.463420] kunit_try_run_case+0x170/0x3f0 [ 49.467676] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 49.473241] kthread+0x328/0x630 [ 49.476532] ret_from_fork+0x10/0x20 [ 49.480169] [ 49.481701] Freed by task 321: [ 49.484813] kasan_save_stack+0x3c/0x68 [ 49.488722] kasan_save_track+0x20/0x40 [ 49.492632] kasan_save_free_info+0x4c/0x78 [ 49.496882] __kasan_mempool_poison_object+0xc0/0x150 [ 49.502013] mempool_free+0x28c/0x328 [ 49.505748] mempool_double_free_helper+0x100/0x2e8 [ 49.510702] mempool_kmalloc_double_free+0xc0/0x118 [ 49.515654] kunit_try_run_case+0x170/0x3f0 [ 49.519916] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 49.525486] kthread+0x328/0x630 [ 49.528776] ret_from_fork+0x10/0x20 [ 49.532424] [ 49.533955] The buggy address belongs to the object at ffff00008039f600 [ 49.533955] which belongs to the cache kmalloc-128 of size 128 [ 49.546621] The buggy address is located 0 bytes inside of [ 49.546621] 128-byte region [ffff00008039f600, ffff00008039f680) [ 49.558321] [ 49.559850] The buggy address belongs to the physical page: [ 49.565499] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 49.573615] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 49.581371] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 49.588431] page_type: f5(slab) [ 49.591645] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 49.599489] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 49.607333] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 49.615265] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 49.623205] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 49.631144] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 49.639070] page dumped because: kasan: bad access detected [ 49.644722] [ 49.646253] Memory state around the buggy address: [ 49.651120] ffff00008039f500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.658440] ffff00008039f580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.665763] >ffff00008039f600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.673083] ^ [ 49.676368] ffff00008039f680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.683686] ffff00008039f700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.691006] ================================================================== [ 49.702329] ================================================================== [ 49.714432] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 49.721679] Free of addr ffff000096708000 by task kunit_try_catch/323 [ 49.728211] [ 49.729750] CPU: 1 UID: 0 PID: 323 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 49.729785] Tainted: [B]=BAD_PAGE, [N]=TEST [ 49.729797] Hardware name: Thundercomm Dragonboard 845c (DT) [ 49.729813] Call trace: [ 49.729823] show_stack+0x20/0x38 (C) [ 49.729844] dump_stack_lvl+0x8c/0xd0 [ 49.729867] print_report+0x118/0x608 [ 49.729889] kasan_report_invalid_free+0xc0/0xe8 [ 49.729910] __kasan_mempool_poison_object+0x14c/0x150 [ 49.729934] mempool_free+0x28c/0x328 [ 49.729955] mempool_double_free_helper+0x150/0x2e8 [ 49.729977] mempool_kmalloc_large_double_free+0xc0/0x118 [ 49.729999] kunit_try_run_case+0x170/0x3f0 [ 49.730020] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 49.730044] kthread+0x328/0x630 [ 49.730061] ret_from_fork+0x10/0x20 [ 49.730084] [ 49.807065] The buggy address belongs to the physical page: [ 49.812718] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116708 [ 49.820830] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 49.828585] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 49.835647] page_type: f8(unknown) [ 49.839116] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 49.846957] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 49.854809] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 49.862749] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 49.870689] head: 0bfffe0000000002 fffffdffc259c201 00000000ffffffff 00000000ffffffff [ 49.878628] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 49.886563] page dumped because: kasan: bad access detected [ 49.892215] [ 49.893743] Memory state around the buggy address: [ 49.898609] ffff000096707f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.905928] ffff000096707f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.913250] >ffff000096708000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.920568] ^ [ 49.923860] ffff000096708080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.931183] ffff000096708100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.938500] ================================================================== [ 49.949529] ================================================================== [ 49.962152] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 49.969396] Free of addr ffff000095370000 by task kunit_try_catch/325 [ 49.975929] [ 49.977466] CPU: 0 UID: 0 PID: 325 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 49.977502] Tainted: [B]=BAD_PAGE, [N]=TEST [ 49.977513] Hardware name: Thundercomm Dragonboard 845c (DT) [ 49.977530] Call trace: [ 49.977539] show_stack+0x20/0x38 (C) [ 49.977560] dump_stack_lvl+0x8c/0xd0 [ 49.977582] print_report+0x118/0x608 [ 49.977604] kasan_report_invalid_free+0xc0/0xe8 [ 49.977626] __kasan_mempool_poison_pages+0xe0/0xe8 [ 49.977649] mempool_free+0x24c/0x328 [ 49.977669] mempool_double_free_helper+0x150/0x2e8 [ 49.977690] mempool_page_alloc_double_free+0xbc/0x118 [ 49.977715] kunit_try_run_case+0x170/0x3f0 [ 49.977738] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 49.977762] kthread+0x328/0x630 [ 49.977778] ret_from_fork+0x10/0x20 [ 49.977800] [ 50.054259] The buggy address belongs to the physical page: [ 50.059904] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115370 [ 50.068016] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 50.074641] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 50.082482] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 50.090321] page dumped because: kasan: bad access detected [ 50.095966] [ 50.097492] Memory state around the buggy address: [ 50.102357] ffff00009536ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 50.109679] ffff00009536ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 50.117000] >ffff000095370000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 50.124319] ^ [ 50.127600] ffff000095370080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 50.134924] ffff000095370100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 50.142244] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-use-after-free-in-mempool_uaf_helper
[ 49.119934] ================================================================== [ 49.131113] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 49.137928] Read of size 1 at addr ffff000096708000 by task kunit_try_catch/319 [ 49.145339] [ 49.146880] CPU: 1 UID: 0 PID: 319 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 49.146921] Tainted: [B]=BAD_PAGE, [N]=TEST [ 49.146932] Hardware name: Thundercomm Dragonboard 845c (DT) [ 49.146949] Call trace: [ 49.146959] show_stack+0x20/0x38 (C) [ 49.146983] dump_stack_lvl+0x8c/0xd0 [ 49.147006] print_report+0x118/0x608 [ 49.147030] kasan_report+0xdc/0x128 [ 49.147051] __asan_report_load1_noabort+0x20/0x30 [ 49.147072] mempool_uaf_helper+0x314/0x340 [ 49.147093] mempool_page_alloc_uaf+0xc0/0x118 [ 49.147115] kunit_try_run_case+0x170/0x3f0 [ 49.147139] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 49.147163] kthread+0x328/0x630 [ 49.147181] ret_from_fork+0x10/0x20 [ 49.147203] [ 49.217423] The buggy address belongs to the physical page: [ 49.223074] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116708 [ 49.231189] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 49.237824] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 49.245669] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 49.253508] page dumped because: kasan: bad access detected [ 49.259159] [ 49.260693] Memory state around the buggy address: [ 49.265557] ffff000096707f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.272877] ffff000096707f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.280202] >ffff000096708000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.287516] ^ [ 49.290803] ffff000096708080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.298124] ffff000096708100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 49.305443] ================================================================== [ 48.534537] ================================================================== [ 48.545941] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340 [ 48.552738] Read of size 1 at addr ffff000095078000 by task kunit_try_catch/315 [ 48.560145] [ 48.561678] CPU: 7 UID: 0 PID: 315 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 48.561715] Tainted: [B]=BAD_PAGE, [N]=TEST [ 48.561723] Hardware name: Thundercomm Dragonboard 845c (DT) [ 48.561739] Call trace: [ 48.561746] show_stack+0x20/0x38 (C) [ 48.561766] dump_stack_lvl+0x8c/0xd0 [ 48.561787] print_report+0x118/0x608 [ 48.561806] kasan_report+0xdc/0x128 [ 48.561824] __asan_report_load1_noabort+0x20/0x30 [ 48.561841] mempool_uaf_helper+0x314/0x340 [ 48.561859] mempool_kmalloc_large_uaf+0xc4/0x120 [ 48.561876] kunit_try_run_case+0x170/0x3f0 [ 48.561895] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 48.561915] kthread+0x328/0x630 [ 48.561930] ret_from_fork+0x10/0x20 [ 48.561949] [ 48.632374] The buggy address belongs to the physical page: [ 48.638018] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115078 [ 48.646121] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 48.653872] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 48.660931] page_type: f8(unknown) [ 48.664390] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 48.672228] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 48.680068] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 48.687992] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 48.695914] head: 0bfffe0000000002 fffffdffc2541e01 00000000ffffffff 00000000ffffffff [ 48.703837] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 48.711756] page dumped because: kasan: bad access detected [ 48.717398] [ 48.718919] Memory state around the buggy address: [ 48.723779] ffff000095077f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 48.731085] ffff000095077f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 48.738398] >ffff000095078000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 48.745709] ^ [ 48.748987] ffff000095078080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 48.756299] ffff000095078100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 48.763612] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-mempool_uaf_helper
[ 48.775173] ================================================================== [ 48.787100] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 48.794337] Read of size 1 at addr ffff000093786240 by task kunit_try_catch/317 [ 48.801748] [ 48.803288] CPU: 0 UID: 0 PID: 317 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 48.803326] Tainted: [B]=BAD_PAGE, [N]=TEST [ 48.803337] Hardware name: Thundercomm Dragonboard 845c (DT) [ 48.803353] Call trace: [ 48.803361] show_stack+0x20/0x38 (C) [ 48.803385] dump_stack_lvl+0x8c/0xd0 [ 48.803409] print_report+0x118/0x608 [ 48.803432] kasan_report+0xdc/0x128 [ 48.803453] __asan_report_load1_noabort+0x20/0x30 [ 48.803472] mempool_uaf_helper+0x314/0x340 [ 48.803491] mempool_slab_uaf+0xc0/0x118 [ 48.803513] kunit_try_run_case+0x170/0x3f0 [ 48.803537] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 48.803561] kthread+0x328/0x630 [ 48.803579] ret_from_fork+0x10/0x20 [ 48.803601] [ 48.873292] Allocated by task 317: [ 48.876754] kasan_save_stack+0x3c/0x68 [ 48.880662] kasan_save_track+0x20/0x40 [ 48.884572] kasan_save_alloc_info+0x40/0x58 [ 48.888909] __kasan_mempool_unpoison_object+0xbc/0x180 [ 48.894225] remove_element+0x16c/0x1f8 [ 48.898134] mempool_alloc_preallocated+0x58/0xc0 [ 48.902916] mempool_uaf_helper+0xa4/0x340 [ 48.907082] mempool_slab_uaf+0xc0/0x118 [ 48.911077] kunit_try_run_case+0x170/0x3f0 [ 48.915328] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 48.920894] kthread+0x328/0x630 [ 48.924185] ret_from_fork+0x10/0x20 [ 48.927825] [ 48.929362] Freed by task 317: [ 48.932474] kasan_save_stack+0x3c/0x68 [ 48.936382] kasan_save_track+0x20/0x40 [ 48.940289] kasan_save_free_info+0x4c/0x78 [ 48.944540] __kasan_mempool_poison_object+0xc0/0x150 [ 48.949670] mempool_free+0x28c/0x328 [ 48.953403] mempool_uaf_helper+0x104/0x340 [ 48.957656] mempool_slab_uaf+0xc0/0x118 [ 48.961652] kunit_try_run_case+0x170/0x3f0 [ 48.965904] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 48.971477] kthread+0x328/0x630 [ 48.974769] ret_from_fork+0x10/0x20 [ 48.978418] [ 48.979955] The buggy address belongs to the object at ffff000093786240 [ 48.979955] which belongs to the cache test_cache of size 123 [ 48.992527] The buggy address is located 0 bytes inside of [ 48.992527] freed 123-byte region [ffff000093786240, ffff0000937862bb) [ 49.004759] [ 49.006290] The buggy address belongs to the physical page: [ 49.011946] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113786 [ 49.020059] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 49.026676] page_type: f5(slab) [ 49.029883] raw: 0bfffe0000000000 ffff000096528280 dead000000000122 0000000000000000 [ 49.037726] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 49.045565] page dumped because: kasan: bad access detected [ 49.051213] [ 49.052749] Memory state around the buggy address: [ 49.057612] ffff000093786100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 49.064933] ffff000093786180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 49.072256] >ffff000093786200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 49.079572] ^ [ 49.084959] ffff000093786280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 49.092283] ffff000093786300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.099597] ================================================================== [ 48.160555] ================================================================== [ 48.172255] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340 [ 48.179500] Read of size 1 at addr ffff000080dbc900 by task kunit_try_catch/313 [ 48.186911] [ 48.188458] CPU: 1 UID: 0 PID: 313 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 48.188497] Tainted: [B]=BAD_PAGE, [N]=TEST [ 48.188509] Hardware name: Thundercomm Dragonboard 845c (DT) [ 48.188525] Call trace: [ 48.188534] show_stack+0x20/0x38 (C) [ 48.188558] dump_stack_lvl+0x8c/0xd0 [ 48.188581] print_report+0x118/0x608 [ 48.188604] kasan_report+0xdc/0x128 [ 48.188624] __asan_report_load1_noabort+0x20/0x30 [ 48.188644] mempool_uaf_helper+0x314/0x340 [ 48.188663] mempool_kmalloc_uaf+0xc4/0x120 [ 48.188683] kunit_try_run_case+0x170/0x3f0 [ 48.188708] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 48.188730] kthread+0x328/0x630 [ 48.188748] ret_from_fork+0x10/0x20 [ 48.188771] [ 48.258738] Allocated by task 313: [ 48.262198] kasan_save_stack+0x3c/0x68 [ 48.266108] kasan_save_track+0x20/0x40 [ 48.270016] kasan_save_alloc_info+0x40/0x58 [ 48.274352] __kasan_mempool_unpoison_object+0x11c/0x180 [ 48.279748] remove_element+0x130/0x1f8 [ 48.283656] mempool_alloc_preallocated+0x58/0xc0 [ 48.288443] mempool_uaf_helper+0xa4/0x340 [ 48.292605] mempool_kmalloc_uaf+0xc4/0x120 [ 48.296856] kunit_try_run_case+0x170/0x3f0 [ 48.301109] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 48.306679] kthread+0x328/0x630 [ 48.309970] ret_from_fork+0x10/0x20 [ 48.313618] [ 48.315147] Freed by task 313: [ 48.318258] kasan_save_stack+0x3c/0x68 [ 48.322165] kasan_save_track+0x20/0x40 [ 48.326074] kasan_save_free_info+0x4c/0x78 [ 48.330333] __kasan_mempool_poison_object+0xc0/0x150 [ 48.335463] mempool_free+0x28c/0x328 [ 48.339197] mempool_uaf_helper+0x104/0x340 [ 48.343457] mempool_kmalloc_uaf+0xc4/0x120 [ 48.347708] kunit_try_run_case+0x170/0x3f0 [ 48.351967] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 48.357534] kthread+0x328/0x630 [ 48.360823] ret_from_fork+0x10/0x20 [ 48.364468] [ 48.365999] The buggy address belongs to the object at ffff000080dbc900 [ 48.365999] which belongs to the cache kmalloc-128 of size 128 [ 48.378659] The buggy address is located 0 bytes inside of [ 48.378659] freed 128-byte region [ffff000080dbc900, ffff000080dbc980) [ 48.390887] [ 48.392422] The buggy address belongs to the physical page: [ 48.398074] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100dbc [ 48.406183] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 48.413945] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 48.421017] page_type: f5(slab) [ 48.424223] raw: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 48.432066] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 48.439908] head: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 48.447844] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 48.455782] head: 0bfffe0000000001 fffffdffc2036f01 00000000ffffffff 00000000ffffffff [ 48.463718] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 48.471649] page dumped because: kasan: bad access detected [ 48.477302] [ 48.478831] Memory state around the buggy address: [ 48.483691] ffff000080dbc800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.491012] ffff000080dbc880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.498330] >ffff000080dbc900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.505648] ^ [ 48.508932] ffff000080dbc980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.516254] ffff000080dbca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.523564] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-mempool_oob_right_helper
[ 47.618858] ================================================================== [ 47.630776] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 47.638455] Read of size 1 at addr ffff000095372001 by task kunit_try_catch/309 [ 47.645865] [ 47.647401] CPU: 0 UID: 0 PID: 309 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 47.647433] Tainted: [B]=BAD_PAGE, [N]=TEST [ 47.647442] Hardware name: Thundercomm Dragonboard 845c (DT) [ 47.647455] Call trace: [ 47.647462] show_stack+0x20/0x38 (C) [ 47.647484] dump_stack_lvl+0x8c/0xd0 [ 47.647507] print_report+0x118/0x608 [ 47.647530] kasan_report+0xdc/0x128 [ 47.647550] __asan_report_load1_noabort+0x20/0x30 [ 47.647568] mempool_oob_right_helper+0x2ac/0x2f0 [ 47.647588] mempool_kmalloc_large_oob_right+0xc4/0x120 [ 47.647610] kunit_try_run_case+0x170/0x3f0 [ 47.647630] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.647652] kthread+0x328/0x630 [ 47.647671] ret_from_fork+0x10/0x20 [ 47.647691] [ 47.719191] The buggy address belongs to the physical page: [ 47.724838] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115370 [ 47.732943] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 47.740702] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 47.747767] page_type: f8(unknown) [ 47.751234] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 47.759080] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 47.766925] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 47.774856] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 47.782789] head: 0bfffe0000000002 fffffdffc254dc01 00000000ffffffff 00000000ffffffff [ 47.790721] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 47.798647] page dumped because: kasan: bad access detected [ 47.804291] [ 47.805821] Memory state around the buggy address: [ 47.810685] ffff000095371f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.818000] ffff000095371f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.825324] >ffff000095372000: 01 fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 47.832644] ^ [ 47.835935] ffff000095372080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 47.843250] ffff000095372100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 47.850562] ================================================================== [ 47.862534] ================================================================== [ 47.874986] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 47.882667] Read of size 1 at addr ffff000096c812bb by task kunit_try_catch/311 [ 47.890079] [ 47.891614] CPU: 0 UID: 0 PID: 311 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 47.891649] Tainted: [B]=BAD_PAGE, [N]=TEST [ 47.891658] Hardware name: Thundercomm Dragonboard 845c (DT) [ 47.891674] Call trace: [ 47.891682] show_stack+0x20/0x38 (C) [ 47.891703] dump_stack_lvl+0x8c/0xd0 [ 47.891724] print_report+0x118/0x608 [ 47.891744] kasan_report+0xdc/0x128 [ 47.891761] __asan_report_load1_noabort+0x20/0x30 [ 47.891778] mempool_oob_right_helper+0x2ac/0x2f0 [ 47.891797] mempool_slab_oob_right+0xc0/0x118 [ 47.891818] kunit_try_run_case+0x170/0x3f0 [ 47.891837] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.891859] kthread+0x328/0x630 [ 47.891873] ret_from_fork+0x10/0x20 [ 47.891891] [ 47.962604] Allocated by task 311: [ 47.966064] kasan_save_stack+0x3c/0x68 [ 47.969976] kasan_save_track+0x20/0x40 [ 47.973885] kasan_save_alloc_info+0x40/0x58 [ 47.978224] __kasan_mempool_unpoison_object+0xbc/0x180 [ 47.983537] remove_element+0x16c/0x1f8 [ 47.987447] mempool_alloc_preallocated+0x58/0xc0 [ 47.992226] mempool_oob_right_helper+0x98/0x2f0 [ 47.996924] mempool_slab_oob_right+0xc0/0x118 [ 48.001441] kunit_try_run_case+0x170/0x3f0 [ 48.005694] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 48.011267] kthread+0x328/0x630 [ 48.014559] ret_from_fork+0x10/0x20 [ 48.018197] [ 48.019725] The buggy address belongs to the object at ffff000096c81240 [ 48.019725] which belongs to the cache test_cache of size 123 [ 48.032302] The buggy address is located 0 bytes to the right of [ 48.032302] allocated 123-byte region [ffff000096c81240, ffff000096c812bb) [ 48.045400] [ 48.046931] The buggy address belongs to the physical page: [ 48.052577] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116c81 [ 48.060684] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 48.067304] page_type: f5(slab) [ 48.070512] raw: 0bfffe0000000000 ffff000096528140 dead000000000122 0000000000000000 [ 48.078359] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 48.086201] page dumped because: kasan: bad access detected [ 48.091849] [ 48.093376] Memory state around the buggy address: [ 48.098240] ffff000096c81180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.105554] ffff000096c81200: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 48.112869] >ffff000096c81280: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 48.120180] ^ [ 48.125304] ffff000096c81300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.132619] ffff000096c81380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.139933] ================================================================== [ 47.289918] ================================================================== [ 47.300978] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 47.308674] Read of size 1 at addr ffff000080dbc573 by task kunit_try_catch/307 [ 47.316087] [ 47.317630] CPU: 1 UID: 0 PID: 307 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 47.317668] Tainted: [B]=BAD_PAGE, [N]=TEST [ 47.317680] Hardware name: Thundercomm Dragonboard 845c (DT) [ 47.317695] Call trace: [ 47.317703] show_stack+0x20/0x38 (C) [ 47.317728] dump_stack_lvl+0x8c/0xd0 [ 47.317751] print_report+0x118/0x608 [ 47.317773] kasan_report+0xdc/0x128 [ 47.317793] __asan_report_load1_noabort+0x20/0x30 [ 47.317812] mempool_oob_right_helper+0x2ac/0x2f0 [ 47.317833] mempool_kmalloc_oob_right+0xc4/0x120 [ 47.317852] kunit_try_run_case+0x170/0x3f0 [ 47.317876] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.317899] kthread+0x328/0x630 [ 47.317917] ret_from_fork+0x10/0x20 [ 47.317939] [ 47.388930] Allocated by task 307: [ 47.392392] kasan_save_stack+0x3c/0x68 [ 47.396303] kasan_save_track+0x20/0x40 [ 47.400215] kasan_save_alloc_info+0x40/0x58 [ 47.404555] __kasan_mempool_unpoison_object+0x11c/0x180 [ 47.409950] remove_element+0x130/0x1f8 [ 47.413863] mempool_alloc_preallocated+0x58/0xc0 [ 47.418648] mempool_oob_right_helper+0x98/0x2f0 [ 47.423345] mempool_kmalloc_oob_right+0xc4/0x120 [ 47.428126] kunit_try_run_case+0x170/0x3f0 [ 47.432382] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 47.437957] kthread+0x328/0x630 [ 47.441249] ret_from_fork+0x10/0x20 [ 47.444888] [ 47.446419] The buggy address belongs to the object at ffff000080dbc500 [ 47.446419] which belongs to the cache kmalloc-128 of size 128 [ 47.459077] The buggy address is located 0 bytes to the right of [ 47.459077] allocated 115-byte region [ffff000080dbc500, ffff000080dbc573) [ 47.472176] [ 47.473709] The buggy address belongs to the physical page: [ 47.479361] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100dbc [ 47.487470] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 47.495233] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 47.502300] page_type: f5(slab) [ 47.505512] raw: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 47.513360] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 47.521210] head: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 47.529143] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 47.537078] head: 0bfffe0000000001 fffffdffc2036f01 00000000ffffffff 00000000ffffffff [ 47.545010] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 47.552940] page dumped because: kasan: bad access detected [ 47.558591] [ 47.560125] Memory state around the buggy address: [ 47.564989] ffff000080dbc400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.572304] ffff000080dbc480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.579623] >ffff000080dbc500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 47.586941] ^ [ 47.593907] ffff000080dbc580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.601224] ffff000080dbc600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 47.608537] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-kmem_cache_double_destroy
[ 46.348548] ================================================================== [ 46.359901] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x174/0x300 [ 46.367770] Read of size 1 at addr ffff000082248000 by task kunit_try_catch/301 [ 46.375176] [ 46.376723] CPU: 3 UID: 0 PID: 301 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 46.376761] Tainted: [B]=BAD_PAGE, [N]=TEST [ 46.376772] Hardware name: Thundercomm Dragonboard 845c (DT) [ 46.376788] Call trace: [ 46.376799] show_stack+0x20/0x38 (C) [ 46.376821] dump_stack_lvl+0x8c/0xd0 [ 46.376845] print_report+0x118/0x608 [ 46.376866] kasan_report+0xdc/0x128 [ 46.376885] __kasan_check_byte+0x54/0x70 [ 46.376905] kmem_cache_destroy+0x34/0x218 [ 46.376929] kmem_cache_double_destroy+0x174/0x300 [ 46.376948] kunit_try_run_case+0x170/0x3f0 [ 46.376970] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 46.376993] kthread+0x328/0x630 [ 46.377012] ret_from_fork+0x10/0x20 [ 46.377034] [ 46.446701] Allocated by task 301: [ 46.450163] kasan_save_stack+0x3c/0x68 [ 46.454074] kasan_save_track+0x20/0x40 [ 46.457985] kasan_save_alloc_info+0x40/0x58 [ 46.462325] __kasan_slab_alloc+0xa8/0xb0 [ 46.466407] kmem_cache_alloc_noprof+0x10c/0x398 [ 46.471111] __kmem_cache_create_args+0x178/0x280 [ 46.475893] kmem_cache_double_destroy+0xc0/0x300 [ 46.480674] kunit_try_run_case+0x170/0x3f0 [ 46.484929] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 46.490503] kthread+0x328/0x630 [ 46.493796] ret_from_fork+0x10/0x20 [ 46.497435] [ 46.498966] Freed by task 301: [ 46.502080] kasan_save_stack+0x3c/0x68 [ 46.505991] kasan_save_track+0x20/0x40 [ 46.509902] kasan_save_free_info+0x4c/0x78 [ 46.514155] __kasan_slab_free+0x6c/0x98 [ 46.518153] kmem_cache_free+0x260/0x468 [ 46.522150] slab_kmem_cache_release+0x38/0x50 [ 46.526667] kmem_cache_release+0x1c/0x30 [ 46.530748] kobject_put+0x17c/0x420 [ 46.534388] sysfs_slab_release+0x1c/0x30 [ 46.538472] kmem_cache_destroy+0x118/0x218 [ 46.542725] kmem_cache_double_destroy+0x128/0x300 [ 46.547596] kunit_try_run_case+0x170/0x3f0 [ 46.551850] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 46.557420] kthread+0x328/0x630 [ 46.560712] ret_from_fork+0x10/0x20 [ 46.564352] [ 46.565882] The buggy address belongs to the object at ffff000082248000 [ 46.565882] which belongs to the cache kmem_cache of size 208 [ 46.578456] The buggy address is located 0 bytes inside of [ 46.578456] freed 208-byte region [ffff000082248000, ffff0000822480d0) [ 46.590682] [ 46.592221] The buggy address belongs to the physical page: [ 46.597875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102248 [ 46.605985] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 46.613744] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 46.620812] page_type: f5(slab) [ 46.624024] raw: 0bfffe0000000040 ffff000080002000 dead000000000122 0000000000000000 [ 46.631873] raw: 0000000000000000 0000000080190019 00000000f5000000 0000000000000000 [ 46.639718] head: 0bfffe0000000040 ffff000080002000 dead000000000122 0000000000000000 [ 46.647650] head: 0000000000000000 0000000080190019 00000000f5000000 0000000000000000 [ 46.655583] head: 0bfffe0000000001 fffffdffc2089201 00000000ffffffff 00000000ffffffff [ 46.663516] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 46.671445] page dumped because: kasan: bad access detected [ 46.677091] [ 46.678619] Memory state around the buggy address: [ 46.683486] ffff000082247f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.690800] ffff000082247f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.698117] >ffff000082248000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.705429] ^ [ 46.708716] ffff000082248080: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 46.716033] ffff000082248100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.723350] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-kmem_cache_rcu_uaf
[ 45.924166] ================================================================== [ 45.935939] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x388/0x468 [ 45.943178] Read of size 1 at addr ffff000094654000 by task kunit_try_catch/299 [ 45.950586] [ 45.952126] CPU: 7 UID: 0 PID: 299 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 45.952162] Tainted: [B]=BAD_PAGE, [N]=TEST [ 45.952170] Hardware name: Thundercomm Dragonboard 845c (DT) [ 45.952185] Call trace: [ 45.952193] show_stack+0x20/0x38 (C) [ 45.952215] dump_stack_lvl+0x8c/0xd0 [ 45.952236] print_report+0x118/0x608 [ 45.952258] kasan_report+0xdc/0x128 [ 45.952277] __asan_report_load1_noabort+0x20/0x30 [ 45.952293] kmem_cache_rcu_uaf+0x388/0x468 [ 45.952310] kunit_try_run_case+0x170/0x3f0 [ 45.952383] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 45.952402] kthread+0x328/0x630 [ 45.952416] ret_from_fork+0x10/0x20 [ 45.952435] [ 46.018092] Allocated by task 299: [ 46.021546] kasan_save_stack+0x3c/0x68 [ 46.025450] kasan_save_track+0x20/0x40 [ 46.029353] kasan_save_alloc_info+0x40/0x58 [ 46.033685] __kasan_slab_alloc+0xa8/0xb0 [ 46.037761] kmem_cache_alloc_noprof+0x10c/0x398 [ 46.042448] kmem_cache_rcu_uaf+0x12c/0x468 [ 46.046696] kunit_try_run_case+0x170/0x3f0 [ 46.050943] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 46.056512] kthread+0x328/0x630 [ 46.059793] ret_from_fork+0x10/0x20 [ 46.063423] [ 46.064954] Freed by task 0: [ 46.067888] kasan_save_stack+0x3c/0x68 [ 46.071790] kasan_save_track+0x20/0x40 [ 46.075693] kasan_save_free_info+0x4c/0x78 [ 46.079938] __kasan_slab_free+0x6c/0x98 [ 46.083928] slab_free_after_rcu_debug+0xd4/0x2f8 [ 46.088697] rcu_core+0x9f4/0x1e20 [ 46.092157] rcu_core_si+0x18/0x30 [ 46.095613] handle_softirqs+0x374/0xb28 [ 46.099602] __do_softirq+0x1c/0x28 [ 46.103147] [ 46.104675] Last potentially related work creation: [ 46.109611] kasan_save_stack+0x3c/0x68 [ 46.113512] kasan_record_aux_stack+0xb4/0xc8 [ 46.117933] kmem_cache_free+0x120/0x468 [ 46.121920] kmem_cache_rcu_uaf+0x16c/0x468 [ 46.126168] kunit_try_run_case+0x170/0x3f0 [ 46.130415] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 46.135983] kthread+0x328/0x630 [ 46.139267] ret_from_fork+0x10/0x20 [ 46.142899] [ 46.144425] The buggy address belongs to the object at ffff000094654000 [ 46.144425] which belongs to the cache test_cache of size 200 [ 46.156992] The buggy address is located 0 bytes inside of [ 46.156992] freed 200-byte region [ffff000094654000, ffff0000946540c8) [ 46.169210] [ 46.170735] The buggy address belongs to the physical page: [ 46.176384] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114654 [ 46.184485] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 46.192235] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 46.199292] page_type: f5(slab) [ 46.202493] raw: 0bfffe0000000040 ffff00008195f040 dead000000000122 0000000000000000 [ 46.210332] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 46.218170] head: 0bfffe0000000040 ffff00008195f040 dead000000000122 0000000000000000 [ 46.226095] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 46.234019] head: 0bfffe0000000001 fffffdffc2519501 00000000ffffffff 00000000ffffffff [ 46.241943] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 46.249863] page dumped because: kasan: bad access detected [ 46.255500] [ 46.257032] Memory state around the buggy address: [ 46.261885] ffff000094653f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.269198] ffff000094653f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.276511] >ffff000094654000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.283821] ^ [ 46.287105] ffff000094654080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 46.294416] ffff000094654100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.301726] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-invalid-free-in-kmem_cache_invalid_free
[ 45.459616] ================================================================== [ 45.471310] BUG: KASAN: invalid-free in kmem_cache_invalid_free+0x184/0x3c8 [ 45.478383] Free of addr ffff000096cb2001 by task kunit_try_catch/297 [ 45.484920] [ 45.486464] CPU: 1 UID: 0 PID: 297 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 45.486503] Tainted: [B]=BAD_PAGE, [N]=TEST [ 45.486513] Hardware name: Thundercomm Dragonboard 845c (DT) [ 45.486530] Call trace: [ 45.486538] show_stack+0x20/0x38 (C) [ 45.486562] dump_stack_lvl+0x8c/0xd0 [ 45.486587] print_report+0x118/0x608 [ 45.486608] kasan_report_invalid_free+0xc0/0xe8 [ 45.486629] check_slab_allocation+0xfc/0x108 [ 45.486650] __kasan_slab_pre_free+0x2c/0x48 [ 45.486670] kmem_cache_free+0xf0/0x468 [ 45.486692] kmem_cache_invalid_free+0x184/0x3c8 [ 45.486710] kunit_try_run_case+0x170/0x3f0 [ 45.486733] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 45.486756] kthread+0x328/0x630 [ 45.486775] ret_from_fork+0x10/0x20 [ 45.486841] [ 45.561806] Allocated by task 297: [ 45.565266] kasan_save_stack+0x3c/0x68 [ 45.569173] kasan_save_track+0x20/0x40 [ 45.573081] kasan_save_alloc_info+0x40/0x58 [ 45.577426] __kasan_slab_alloc+0xa8/0xb0 [ 45.581508] kmem_cache_alloc_noprof+0x10c/0x398 [ 45.586203] kmem_cache_invalid_free+0x12c/0x3c8 [ 45.590899] kunit_try_run_case+0x170/0x3f0 [ 45.595164] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 45.600738] kthread+0x328/0x630 [ 45.604027] ret_from_fork+0x10/0x20 [ 45.607669] [ 45.609204] The buggy address belongs to the object at ffff000096cb2000 [ 45.609204] which belongs to the cache test_cache of size 200 [ 45.621782] The buggy address is located 1 bytes inside of [ 45.621782] 200-byte region [ffff000096cb2000, ffff000096cb20c8) [ 45.633484] [ 45.635019] The buggy address belongs to the physical page: [ 45.640673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116cb2 [ 45.648787] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 45.656545] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 45.663610] page_type: f5(slab) [ 45.666819] raw: 0bfffe0000000040 ffff000096cae140 dead000000000122 0000000000000000 [ 45.674662] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 45.682507] head: 0bfffe0000000040 ffff000096cae140 dead000000000122 0000000000000000 [ 45.690448] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 45.698378] head: 0bfffe0000000001 fffffdffc25b2c81 00000000ffffffff 00000000ffffffff [ 45.706309] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 45.714243] page dumped because: kasan: bad access detected [ 45.719890] [ 45.721423] Memory state around the buggy address: [ 45.726291] ffff000096cb1f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.733612] ffff000096cb1f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 45.740937] >ffff000096cb2000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.748255] ^ [ 45.751537] ffff000096cb2080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 45.758857] ffff000096cb2100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.766179] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-double-free-in-kmem_cache_double_free
[ 45.088997] ================================================================== [ 45.099978] BUG: KASAN: double-free in kmem_cache_double_free+0x190/0x3c8 [ 45.106869] Free of addr ffff000094654000 by task kunit_try_catch/295 [ 45.113391] [ 45.114926] CPU: 7 UID: 0 PID: 295 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 45.114965] Tainted: [B]=BAD_PAGE, [N]=TEST [ 45.114973] Hardware name: Thundercomm Dragonboard 845c (DT) [ 45.114988] Call trace: [ 45.114995] show_stack+0x20/0x38 (C) [ 45.115016] dump_stack_lvl+0x8c/0xd0 [ 45.115037] print_report+0x118/0x608 [ 45.115059] kasan_report_invalid_free+0xc0/0xe8 [ 45.115080] check_slab_allocation+0xd4/0x108 [ 45.115099] __kasan_slab_pre_free+0x2c/0x48 [ 45.115117] kmem_cache_free+0xf0/0x468 [ 45.115136] kmem_cache_double_free+0x190/0x3c8 [ 45.115152] kunit_try_run_case+0x170/0x3f0 [ 45.115171] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 45.115191] kthread+0x328/0x630 [ 45.115205] ret_from_fork+0x10/0x20 [ 45.115224] [ 45.190038] Allocated by task 295: [ 45.193494] kasan_save_stack+0x3c/0x68 [ 45.197399] kasan_save_track+0x20/0x40 [ 45.201302] kasan_save_alloc_info+0x40/0x58 [ 45.205635] __kasan_slab_alloc+0xa8/0xb0 [ 45.209709] kmem_cache_alloc_noprof+0x10c/0x398 [ 45.214393] kmem_cache_double_free+0x12c/0x3c8 [ 45.218989] kunit_try_run_case+0x170/0x3f0 [ 45.223235] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 45.228794] kthread+0x328/0x630 [ 45.232074] ret_from_fork+0x10/0x20 [ 45.235703] [ 45.237225] Freed by task 295: [ 45.240328] kasan_save_stack+0x3c/0x68 [ 45.244231] kasan_save_track+0x20/0x40 [ 45.248134] kasan_save_free_info+0x4c/0x78 [ 45.252380] __kasan_slab_free+0x6c/0x98 [ 45.256368] kmem_cache_free+0x260/0x468 [ 45.260357] kmem_cache_double_free+0x140/0x3c8 [ 45.264952] kunit_try_run_case+0x170/0x3f0 [ 45.269199] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 45.274762] kthread+0x328/0x630 [ 45.278043] ret_from_fork+0x10/0x20 [ 45.281682] [ 45.283213] The buggy address belongs to the object at ffff000094654000 [ 45.283213] which belongs to the cache test_cache of size 200 [ 45.295775] The buggy address is located 0 bytes inside of [ 45.295775] 200-byte region [ffff000094654000, ffff0000946540c8) [ 45.307463] [ 45.308987] The buggy address belongs to the physical page: [ 45.314631] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114654 [ 45.322730] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 45.330481] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 45.337533] page_type: f5(slab) [ 45.340732] raw: 0bfffe0000000040 ffff00008195ef00 dead000000000122 0000000000000000 [ 45.348572] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 45.356409] head: 0bfffe0000000040 ffff00008195ef00 dead000000000122 0000000000000000 [ 45.364333] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 45.372258] head: 0bfffe0000000001 fffffdffc2519501 00000000ffffffff 00000000ffffffff [ 45.380180] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 45.388100] page dumped because: kasan: bad access detected [ 45.393742] [ 45.395274] Memory state around the buggy address: [ 45.400134] ffff000094653f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.407449] ffff000094653f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.414754] >ffff000094654000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.422065] ^ [ 45.425342] ffff000094654080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 45.432657] ffff000094654100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.439967] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-use-after-free-in-page_alloc_uaf
[ 32.883635] ================================================================== [ 32.898883] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350 [ 32.905325] Read of size 1 at addr ffff0000967b0000 by task kunit_try_catch/240 [ 32.912737] [ 32.914271] CPU: 2 UID: 0 PID: 240 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 32.914299] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.914308] Hardware name: Thundercomm Dragonboard 845c (DT) [ 32.914320] Call trace: [ 32.914329] show_stack+0x20/0x38 (C) [ 32.914347] dump_stack_lvl+0x8c/0xd0 [ 32.914366] print_report+0x118/0x608 [ 32.914385] kasan_report+0xdc/0x128 [ 32.914404] __asan_report_load1_noabort+0x20/0x30 [ 32.914421] page_alloc_uaf+0x328/0x350 [ 32.914438] kunit_try_run_case+0x170/0x3f0 [ 32.914458] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.914481] kthread+0x328/0x630 [ 32.914498] ret_from_fork+0x10/0x20 [ 32.914517] [ 32.979872] The buggy address belongs to the physical page: [ 32.985517] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1167b0 [ 32.993627] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.000249] page_type: f0(buddy) [ 33.003535] raw: 0bfffe0000000000 fffffdffc24e1408 ffff0000fd587da0 0000000000000000 [ 33.011381] raw: 0000000000000000 0000000000000004 00000000f0000000 0000000000000000 [ 33.019218] page dumped because: kasan: bad access detected [ 33.024870] [ 33.026399] Memory state around the buggy address: [ 33.031263] ffff0000967aff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.038585] ffff0000967aff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.045899] >ffff0000967b0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.053219] ^ [ 33.056508] ffff0000967b0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.063822] ffff0000967b0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.071131] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmem_cache_oob
[ 44.740433] ================================================================== [ 44.751381] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x344/0x430 [ 44.758182] Read of size 1 at addr ffff000096cb00c8 by task kunit_try_catch/293 [ 44.765596] [ 44.767131] CPU: 1 UID: 0 PID: 293 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 44.767161] Tainted: [B]=BAD_PAGE, [N]=TEST [ 44.767170] Hardware name: Thundercomm Dragonboard 845c (DT) [ 44.767184] Call trace: [ 44.767193] show_stack+0x20/0x38 (C) [ 44.767211] dump_stack_lvl+0x8c/0xd0 [ 44.767231] print_report+0x118/0x608 [ 44.767250] kasan_report+0xdc/0x128 [ 44.767270] __asan_report_load1_noabort+0x20/0x30 [ 44.767288] kmem_cache_oob+0x344/0x430 [ 44.767305] kunit_try_run_case+0x170/0x3f0 [ 44.767325] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 44.767347] kthread+0x328/0x630 [ 44.767362] ret_from_fork+0x10/0x20 [ 44.767383] [ 44.832730] Allocated by task 293: [ 44.836198] kasan_save_stack+0x3c/0x68 [ 44.840104] kasan_save_track+0x20/0x40 [ 44.844009] kasan_save_alloc_info+0x40/0x58 [ 44.848352] __kasan_slab_alloc+0xa8/0xb0 [ 44.852430] kmem_cache_alloc_noprof+0x10c/0x398 [ 44.857125] kmem_cache_oob+0x12c/0x430 [ 44.861029] kunit_try_run_case+0x170/0x3f0 [ 44.865289] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 44.870859] kthread+0x328/0x630 [ 44.874145] ret_from_fork+0x10/0x20 [ 44.877789] [ 44.879321] The buggy address belongs to the object at ffff000096cb0000 [ 44.879321] which belongs to the cache test_cache of size 200 [ 44.891896] The buggy address is located 0 bytes to the right of [ 44.891896] allocated 200-byte region [ffff000096cb0000, ffff000096cb00c8) [ 44.905001] [ 44.906531] The buggy address belongs to the physical page: [ 44.912175] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116cb0 [ 44.920280] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 44.928041] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 44.935100] page_type: f5(slab) [ 44.938300] raw: 0bfffe0000000040 ffff000096cae000 dead000000000122 0000000000000000 [ 44.946149] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 44.953995] head: 0bfffe0000000040 ffff000096cae000 dead000000000122 0000000000000000 [ 44.961928] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000 [ 44.969862] head: 0bfffe0000000001 fffffdffc25b2c01 00000000ffffffff 00000000ffffffff [ 44.977794] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 44.985722] page dumped because: kasan: bad access detected [ 44.991366] [ 44.992896] Memory state around the buggy address: [ 44.997756] ffff000096caff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.005070] ffff000096cb0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.012385] >ffff000096cb0080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 45.019698] ^ [ 45.025345] ffff000096cb0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.032659] ffff000096cb0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.039973] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-workqueue_uaf
[ 44.374217] ================================================================== [ 44.384564] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8 [ 44.391358] Read of size 8 at addr ffff000081a47540 by task kunit_try_catch/286 [ 44.398762] [ 44.400303] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 44.400332] Tainted: [B]=BAD_PAGE, [N]=TEST [ 44.400341] Hardware name: Thundercomm Dragonboard 845c (DT) [ 44.400354] Call trace: [ 44.400364] show_stack+0x20/0x38 (C) [ 44.400382] dump_stack_lvl+0x8c/0xd0 [ 44.400404] print_report+0x118/0x608 [ 44.400422] kasan_report+0xdc/0x128 [ 44.400442] __asan_report_load8_noabort+0x20/0x30 [ 44.400460] workqueue_uaf+0x480/0x4a8 [ 44.400477] kunit_try_run_case+0x170/0x3f0 [ 44.400497] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 44.400519] kthread+0x328/0x630 [ 44.400533] ret_from_fork+0x10/0x20 [ 44.400552] [ 44.465808] Allocated by task 286: [ 44.469269] kasan_save_stack+0x3c/0x68 [ 44.473180] kasan_save_track+0x20/0x40 [ 44.477087] kasan_save_alloc_info+0x40/0x58 [ 44.481428] __kasan_kmalloc+0xd4/0xd8 [ 44.485251] __kmalloc_cache_noprof+0x16c/0x3c0 [ 44.489862] workqueue_uaf+0x13c/0x4a8 [ 44.493683] kunit_try_run_case+0x170/0x3f0 [ 44.497938] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 44.503510] kthread+0x328/0x630 [ 44.506804] ret_from_fork+0x10/0x20 [ 44.510443] [ 44.511979] Freed by task 63: [ 44.514999] kasan_save_stack+0x3c/0x68 [ 44.518909] kasan_save_track+0x20/0x40 [ 44.522819] kasan_save_free_info+0x4c/0x78 [ 44.527070] __kasan_slab_free+0x6c/0x98 [ 44.531066] kfree+0x214/0x3c8 [ 44.534186] workqueue_uaf_work+0x18/0x30 [ 44.538265] process_one_work+0x530/0xf98 [ 44.542352] worker_thread+0x618/0xf38 [ 44.546175] kthread+0x328/0x630 [ 44.549465] ret_from_fork+0x10/0x20 [ 44.553105] [ 44.554634] Last potentially related work creation: [ 44.559583] kasan_save_stack+0x3c/0x68 [ 44.563491] kasan_record_aux_stack+0xb4/0xc8 [ 44.567916] __queue_work+0x65c/0xfe0 [ 44.571644] queue_work_on+0xbc/0xf8 [ 44.575282] workqueue_uaf+0x210/0x4a8 [ 44.579094] kunit_try_run_case+0x170/0x3f0 [ 44.583346] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 44.588915] kthread+0x328/0x630 [ 44.592209] ret_from_fork+0x10/0x20 [ 44.595848] [ 44.597375] The buggy address belongs to the object at ffff000081a47540 [ 44.597375] which belongs to the cache kmalloc-32 of size 32 [ 44.609858] The buggy address is located 0 bytes inside of [ 44.609858] freed 32-byte region [ffff000081a47540, ffff000081a47560) [ 44.621999] [ 44.623527] The buggy address belongs to the physical page: [ 44.629176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101a47 [ 44.637289] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 44.643906] page_type: f5(slab) [ 44.647114] raw: 0bfffe0000000000 ffff000080002780 dead000000000100 dead000000000122 [ 44.654961] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 44.662803] page dumped because: kasan: bad access detected [ 44.668448] [ 44.669978] Memory state around the buggy address: [ 44.674843] ffff000081a47400: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 44.682158] ffff000081a47480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 44.689475] >ffff000081a47500: 00 00 00 07 fc fc fc fc fa fb fb fb fc fc fc fc [ 44.696796] ^ [ 44.702180] ffff000081a47580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.709508] ffff000081a47600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.716821] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-rcu_uaf_reclaim
[ 43.967327] ================================================================== [ 43.977839] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70 [ 43.984637] Read of size 4 at addr ffff0000950f6e80 by task swapper/0/0 [ 43.991342] [ 43.992882] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 43.992912] Tainted: [B]=BAD_PAGE, [N]=TEST [ 43.992920] Hardware name: Thundercomm Dragonboard 845c (DT) [ 43.992932] Call trace: [ 43.992941] show_stack+0x20/0x38 (C) [ 43.992959] dump_stack_lvl+0x8c/0xd0 [ 43.992979] print_report+0x118/0x608 [ 43.992997] kasan_report+0xdc/0x128 [ 43.993016] __asan_report_load4_noabort+0x20/0x30 [ 43.993034] rcu_uaf_reclaim+0x64/0x70 [ 43.993051] rcu_core+0x9f4/0x1e20 [ 43.993072] rcu_core_si+0x18/0x30 [ 43.993090] handle_softirqs+0x374/0xb28 [ 43.993112] __do_softirq+0x1c/0x28 [ 43.993128] ____do_softirq+0x18/0x30 [ 43.993146] call_on_irq_stack+0x24/0x30 [ 43.993163] do_softirq_own_stack+0x24/0x38 [ 43.993183] __irq_exit_rcu+0x1fc/0x318 [ 43.993200] irq_exit_rcu+0x1c/0x80 [ 43.993218] el1_interrupt+0x38/0x58 [ 43.993241] el1h_64_irq_handler+0x18/0x28 [ 43.993262] el1h_64_irq+0x6c/0x70 [ 43.993278] arch_local_irq_enable+0x4/0x8 (P) [ 43.993300] cpuidle_enter+0x60/0xb8 [ 43.993317] do_idle+0x36c/0x4e8 [ 43.993339] cpu_startup_entry+0x64/0x80 [ 43.993357] rest_init+0x160/0x188 [ 43.993376] start_kernel+0x30c/0x3d0 [ 43.993401] __primary_switched+0x8c/0xa0 [ 43.993423] [ 44.112817] Allocated by task 284: [ 44.116278] kasan_save_stack+0x3c/0x68 [ 44.120189] kasan_save_track+0x20/0x40 [ 44.124099] kasan_save_alloc_info+0x40/0x58 [ 44.128438] __kasan_kmalloc+0xd4/0xd8 [ 44.132262] __kmalloc_cache_noprof+0x16c/0x3c0 [ 44.136863] rcu_uaf+0xb0/0x2d8 [ 44.140069] kunit_try_run_case+0x170/0x3f0 [ 44.144325] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 44.149901] kthread+0x328/0x630 [ 44.153192] ret_from_fork+0x10/0x20 [ 44.156833] [ 44.158362] Freed by task 0: [ 44.161293] kasan_save_stack+0x3c/0x68 [ 44.165204] kasan_save_track+0x20/0x40 [ 44.169115] kasan_save_free_info+0x4c/0x78 [ 44.173367] __kasan_slab_free+0x6c/0x98 [ 44.177365] kfree+0x214/0x3c8 [ 44.180483] rcu_uaf_reclaim+0x28/0x70 [ 44.184304] rcu_core+0x9f4/0x1e20 [ 44.187775] rcu_core_si+0x18/0x30 [ 44.191244] handle_softirqs+0x374/0xb28 [ 44.195242] __do_softirq+0x1c/0x28 [ 44.198792] [ 44.200327] Last potentially related work creation: [ 44.205274] kasan_save_stack+0x3c/0x68 [ 44.209185] kasan_record_aux_stack+0xb4/0xc8 [ 44.213610] __call_rcu_common.constprop.0+0x74/0x8c8 [ 44.218741] call_rcu+0x18/0x30 [ 44.221947] rcu_uaf+0x14c/0x2d8 [ 44.225241] kunit_try_run_case+0x170/0x3f0 [ 44.229497] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 44.235070] kthread+0x328/0x630 [ 44.238363] ret_from_fork+0x10/0x20 [ 44.242002] [ 44.243531] The buggy address belongs to the object at ffff0000950f6e80 [ 44.243531] which belongs to the cache kmalloc-32 of size 32 [ 44.256021] The buggy address is located 0 bytes inside of [ 44.256021] freed 32-byte region [ffff0000950f6e80, ffff0000950f6ea0) [ 44.268160] [ 44.269691] The buggy address belongs to the physical page: [ 44.275342] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1150f6 [ 44.283450] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 44.290065] page_type: f5(slab) [ 44.293270] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000 [ 44.301117] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000 [ 44.308960] page dumped because: kasan: bad access detected [ 44.314611] [ 44.316146] Memory state around the buggy address: [ 44.321010] ffff0000950f6d80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 44.328325] ffff0000950f6e00: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc [ 44.335645] >ffff0000950f6e80: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 44.342957] ^ [ 44.346247] ffff0000950f6f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.353561] ffff0000950f6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.360874] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-ksize_uaf
[ 42.903806] ================================================================== [ 42.915450] BUG: KASAN: slab-use-after-free in ksize_uaf+0x168/0x5f8 [ 42.921895] Read of size 1 at addr ffff00009462ca00 by task kunit_try_catch/282 [ 42.929299] [ 42.930826] CPU: 7 UID: 0 PID: 282 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 42.930856] Tainted: [B]=BAD_PAGE, [N]=TEST [ 42.930864] Hardware name: Thundercomm Dragonboard 845c (DT) [ 42.930877] Call trace: [ 42.930884] show_stack+0x20/0x38 (C) [ 42.930902] dump_stack_lvl+0x8c/0xd0 [ 42.930920] print_report+0x118/0x608 [ 42.930939] kasan_report+0xdc/0x128 [ 42.930957] __kasan_check_byte+0x54/0x70 [ 42.930975] ksize+0x30/0x88 [ 42.930992] ksize_uaf+0x168/0x5f8 [ 42.931009] kunit_try_run_case+0x170/0x3f0 [ 42.931026] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 42.931046] kthread+0x328/0x630 [ 42.931060] ret_from_fork+0x10/0x20 [ 42.931077] [ 42.998083] Allocated by task 282: [ 43.001535] kasan_save_stack+0x3c/0x68 [ 43.005439] kasan_save_track+0x20/0x40 [ 43.009342] kasan_save_alloc_info+0x40/0x58 [ 43.013677] __kasan_kmalloc+0xd4/0xd8 [ 43.017490] __kmalloc_cache_noprof+0x16c/0x3c0 [ 43.022088] ksize_uaf+0xb8/0x5f8 [ 43.025459] kunit_try_run_case+0x170/0x3f0 [ 43.029703] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 43.035264] kthread+0x328/0x630 [ 43.038546] ret_from_fork+0x10/0x20 [ 43.042185] [ 43.043713] Freed by task 282: [ 43.046821] kasan_save_stack+0x3c/0x68 [ 43.050724] kasan_save_track+0x20/0x40 [ 43.054627] kasan_save_free_info+0x4c/0x78 [ 43.058873] __kasan_slab_free+0x6c/0x98 [ 43.062861] kfree+0x214/0x3c8 [ 43.065967] ksize_uaf+0x11c/0x5f8 [ 43.069422] kunit_try_run_case+0x170/0x3f0 [ 43.073671] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 43.079232] kthread+0x328/0x630 [ 43.082513] ret_from_fork+0x10/0x20 [ 43.086144] [ 43.087672] The buggy address belongs to the object at ffff00009462ca00 [ 43.087672] which belongs to the cache kmalloc-128 of size 128 [ 43.100322] The buggy address is located 0 bytes inside of [ 43.100322] freed 128-byte region [ffff00009462ca00, ffff00009462ca80) [ 43.112540] [ 43.114063] The buggy address belongs to the physical page: [ 43.119702] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11462c [ 43.127808] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 43.135554] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 43.142604] page_type: f5(slab) [ 43.145799] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 43.153638] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 43.161476] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 43.169397] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 43.177322] head: 0bfffe0000000001 fffffdffc2518b01 00000000ffffffff 00000000ffffffff [ 43.185244] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 43.193162] page dumped because: kasan: bad access detected [ 43.198804] [ 43.200332] Memory state around the buggy address: [ 43.205194] ffff00009462c900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.212507] ffff00009462c980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.219818] >ffff00009462ca00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.227124] ^ [ 43.230401] ffff00009462ca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.237714] ffff00009462cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.245026] ================================================================== [ 43.252643] ================================================================== [ 43.259963] BUG: KASAN: slab-use-after-free in ksize_uaf+0x598/0x5f8 [ 43.266403] Read of size 1 at addr ffff00009462ca00 by task kunit_try_catch/282 [ 43.273802] [ 43.275339] CPU: 6 UID: 0 PID: 282 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 43.275370] Tainted: [B]=BAD_PAGE, [N]=TEST [ 43.275378] Hardware name: Thundercomm Dragonboard 845c (DT) [ 43.275389] Call trace: [ 43.275395] show_stack+0x20/0x38 (C) [ 43.275413] dump_stack_lvl+0x8c/0xd0 [ 43.275431] print_report+0x118/0x608 [ 43.275449] kasan_report+0xdc/0x128 [ 43.275466] __asan_report_load1_noabort+0x20/0x30 [ 43.275482] ksize_uaf+0x598/0x5f8 [ 43.275497] kunit_try_run_case+0x170/0x3f0 [ 43.275515] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 43.275536] kthread+0x328/0x630 [ 43.275548] ret_from_fork+0x10/0x20 [ 43.275564] [ 43.340411] Allocated by task 282: [ 43.343866] kasan_save_stack+0x3c/0x68 [ 43.347762] kasan_save_track+0x20/0x40 [ 43.351656] kasan_save_alloc_info+0x40/0x58 [ 43.355993] __kasan_kmalloc+0xd4/0xd8 [ 43.359810] __kmalloc_cache_noprof+0x16c/0x3c0 [ 43.364408] ksize_uaf+0xb8/0x5f8 [ 43.367779] kunit_try_run_case+0x170/0x3f0 [ 43.372030] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 43.377595] kthread+0x328/0x630 [ 43.380877] ret_from_fork+0x10/0x20 [ 43.384508] [ 43.386032] Freed by task 282: [ 43.389137] kasan_save_stack+0x3c/0x68 [ 43.393031] kasan_save_track+0x20/0x40 [ 43.396936] kasan_save_free_info+0x4c/0x78 [ 43.401182] __kasan_slab_free+0x6c/0x98 [ 43.405174] kfree+0x214/0x3c8 [ 43.408285] ksize_uaf+0x11c/0x5f8 [ 43.411741] kunit_try_run_case+0x170/0x3f0 [ 43.415992] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 43.421557] kthread+0x328/0x630 [ 43.424840] ret_from_fork+0x10/0x20 [ 43.428471] [ 43.429993] The buggy address belongs to the object at ffff00009462ca00 [ 43.429993] which belongs to the cache kmalloc-128 of size 128 [ 43.442651] The buggy address is located 0 bytes inside of [ 43.442651] freed 128-byte region [ffff00009462ca00, ffff00009462ca80) [ 43.454863] [ 43.456394] The buggy address belongs to the physical page: [ 43.462040] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11462c [ 43.470142] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 43.477894] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 43.484944] page_type: f5(slab) [ 43.488140] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 43.495983] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 43.503825] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 43.511752] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 43.519680] head: 0bfffe0000000001 fffffdffc2518b01 00000000ffffffff 00000000ffffffff [ 43.527605] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 43.535528] page dumped because: kasan: bad access detected [ 43.541171] [ 43.542692] Memory state around the buggy address: [ 43.547549] ffff00009462c900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.554858] ffff00009462c980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.562165] >ffff00009462ca00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.569471] ^ [ 43.572751] ffff00009462ca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.580056] ffff00009462cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.587361] ================================================================== [ 43.594721] ================================================================== [ 43.602033] BUG: KASAN: slab-use-after-free in ksize_uaf+0x544/0x5f8 [ 43.608478] Read of size 1 at addr ffff00009462ca78 by task kunit_try_catch/282 [ 43.615875] [ 43.617401] CPU: 6 UID: 0 PID: 282 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 43.617429] Tainted: [B]=BAD_PAGE, [N]=TEST [ 43.617436] Hardware name: Thundercomm Dragonboard 845c (DT) [ 43.617445] Call trace: [ 43.617451] show_stack+0x20/0x38 (C) [ 43.617469] dump_stack_lvl+0x8c/0xd0 [ 43.617486] print_report+0x118/0x608 [ 43.617504] kasan_report+0xdc/0x128 [ 43.617523] __asan_report_load1_noabort+0x20/0x30 [ 43.617540] ksize_uaf+0x544/0x5f8 [ 43.617555] kunit_try_run_case+0x170/0x3f0 [ 43.617571] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 43.617590] kthread+0x328/0x630 [ 43.617603] ret_from_fork+0x10/0x20 [ 43.617620] [ 43.682465] Allocated by task 282: [ 43.685919] kasan_save_stack+0x3c/0x68 [ 43.689825] kasan_save_track+0x20/0x40 [ 43.693719] kasan_save_alloc_info+0x40/0x58 [ 43.698053] __kasan_kmalloc+0xd4/0xd8 [ 43.701859] __kmalloc_cache_noprof+0x16c/0x3c0 [ 43.706457] ksize_uaf+0xb8/0x5f8 [ 43.709827] kunit_try_run_case+0x170/0x3f0 [ 43.714076] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 43.719640] kthread+0x328/0x630 [ 43.722924] ret_from_fork+0x10/0x20 [ 43.726556] [ 43.728085] Freed by task 282: [ 43.731191] kasan_save_stack+0x3c/0x68 [ 43.735086] kasan_save_track+0x20/0x40 [ 43.738979] kasan_save_free_info+0x4c/0x78 [ 43.743224] __kasan_slab_free+0x6c/0x98 [ 43.747206] kfree+0x214/0x3c8 [ 43.750315] ksize_uaf+0x11c/0x5f8 [ 43.753773] kunit_try_run_case+0x170/0x3f0 [ 43.758023] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 43.763585] kthread+0x328/0x630 [ 43.766870] ret_from_fork+0x10/0x20 [ 43.770500] [ 43.772029] The buggy address belongs to the object at ffff00009462ca00 [ 43.772029] which belongs to the cache kmalloc-128 of size 128 [ 43.784685] The buggy address is located 120 bytes inside of [ 43.784685] freed 128-byte region [ffff00009462ca00, ffff00009462ca80) [ 43.797071] [ 43.798594] The buggy address belongs to the physical page: [ 43.804235] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11462c [ 43.812336] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 43.820089] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 43.827139] page_type: f5(slab) [ 43.830335] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 43.838179] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 43.846020] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 43.853947] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 43.861875] head: 0bfffe0000000001 fffffdffc2518b01 00000000ffffffff 00000000ffffffff [ 43.869800] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 43.877723] page dumped because: kasan: bad access detected [ 43.883365] [ 43.884886] Memory state around the buggy address: [ 43.889738] ffff00009462c900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.897052] ffff00009462c980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.904357] >ffff00009462ca00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.911663] ^ [ 43.918884] ffff00009462ca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.926190] ffff00009462cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.933495] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-ksize_unpoisons_memory
[ 42.286641] ================================================================== [ 42.293956] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x618/0x740 [ 42.301459] Read of size 1 at addr ffff000080e00378 by task kunit_try_catch/280 [ 42.308870] [ 42.310404] CPU: 2 UID: 0 PID: 280 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 42.310433] Tainted: [B]=BAD_PAGE, [N]=TEST [ 42.310442] Hardware name: Thundercomm Dragonboard 845c (DT) [ 42.310454] Call trace: [ 42.310460] show_stack+0x20/0x38 (C) [ 42.310478] dump_stack_lvl+0x8c/0xd0 [ 42.310498] print_report+0x118/0x608 [ 42.310517] kasan_report+0xdc/0x128 [ 42.310536] __asan_report_load1_noabort+0x20/0x30 [ 42.310554] ksize_unpoisons_memory+0x618/0x740 [ 42.310572] kunit_try_run_case+0x170/0x3f0 [ 42.310591] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 42.310613] kthread+0x328/0x630 [ 42.310628] ret_from_fork+0x10/0x20 [ 42.310647] [ 42.376715] Allocated by task 280: [ 42.380173] kasan_save_stack+0x3c/0x68 [ 42.384083] kasan_save_track+0x20/0x40 [ 42.387993] kasan_save_alloc_info+0x40/0x58 [ 42.392329] __kasan_kmalloc+0xd4/0xd8 [ 42.396151] __kmalloc_cache_noprof+0x16c/0x3c0 [ 42.400761] ksize_unpoisons_memory+0xc0/0x740 [ 42.405277] kunit_try_run_case+0x170/0x3f0 [ 42.409531] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 42.415103] kthread+0x328/0x630 [ 42.418394] ret_from_fork+0x10/0x20 [ 42.422031] [ 42.423557] The buggy address belongs to the object at ffff000080e00300 [ 42.423557] which belongs to the cache kmalloc-128 of size 128 [ 42.436218] The buggy address is located 5 bytes to the right of [ 42.436218] allocated 115-byte region [ffff000080e00300, ffff000080e00373) [ 42.449318] [ 42.450848] The buggy address belongs to the physical page: [ 42.456492] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100e00 [ 42.464596] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 42.472353] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 42.479410] page_type: f5(slab) [ 42.482616] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 42.490462] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 42.498308] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 42.506241] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 42.514172] head: 0bfffe0000000001 fffffdffc2038001 00000000ffffffff 00000000ffffffff [ 42.522103] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 42.530029] page dumped because: kasan: bad access detected [ 42.535676] [ 42.537203] Memory state around the buggy address: [ 42.542066] ffff000080e00200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.549379] ffff000080e00280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.556695] >ffff000080e00300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 42.564007] ^ [ 42.571236] ffff000080e00380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.578551] ffff000080e00400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.585862] ================================================================== [ 41.976054] ================================================================== [ 41.987617] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x628/0x740 [ 41.995113] Read of size 1 at addr ffff000080e00373 by task kunit_try_catch/280 [ 42.002525] [ 42.004065] CPU: 2 UID: 0 PID: 280 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 42.004094] Tainted: [B]=BAD_PAGE, [N]=TEST [ 42.004103] Hardware name: Thundercomm Dragonboard 845c (DT) [ 42.004113] Call trace: [ 42.004119] show_stack+0x20/0x38 (C) [ 42.004138] dump_stack_lvl+0x8c/0xd0 [ 42.004158] print_report+0x118/0x608 [ 42.004176] kasan_report+0xdc/0x128 [ 42.004195] __asan_report_load1_noabort+0x20/0x30 [ 42.004212] ksize_unpoisons_memory+0x628/0x740 [ 42.004231] kunit_try_run_case+0x170/0x3f0 [ 42.004249] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 42.004272] kthread+0x328/0x630 [ 42.004287] ret_from_fork+0x10/0x20 [ 42.004305] [ 42.070332] Allocated by task 280: [ 42.073791] kasan_save_stack+0x3c/0x68 [ 42.077703] kasan_save_track+0x20/0x40 [ 42.081613] kasan_save_alloc_info+0x40/0x58 [ 42.085952] __kasan_kmalloc+0xd4/0xd8 [ 42.089773] __kmalloc_cache_noprof+0x16c/0x3c0 [ 42.094388] ksize_unpoisons_memory+0xc0/0x740 [ 42.098901] kunit_try_run_case+0x170/0x3f0 [ 42.103155] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 42.108722] kthread+0x328/0x630 [ 42.112015] ret_from_fork+0x10/0x20 [ 42.115655] [ 42.117183] The buggy address belongs to the object at ffff000080e00300 [ 42.117183] which belongs to the cache kmalloc-128 of size 128 [ 42.129849] The buggy address is located 0 bytes to the right of [ 42.129849] allocated 115-byte region [ffff000080e00300, ffff000080e00373) [ 42.142949] [ 42.144484] The buggy address belongs to the physical page: [ 42.150136] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100e00 [ 42.158242] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 42.166000] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 42.173059] page_type: f5(slab) [ 42.176263] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 42.184110] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 42.191957] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 42.199887] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 42.207818] head: 0bfffe0000000001 fffffdffc2038001 00000000ffffffff 00000000ffffffff [ 42.215752] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 42.223679] page dumped because: kasan: bad access detected [ 42.229327] [ 42.230857] Memory state around the buggy address: [ 42.235718] ffff000080e00200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.243034] ffff000080e00280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.250349] >ffff000080e00300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 42.257659] ^ [ 42.264626] ffff000080e00380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.271943] ffff000080e00400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.279257] ================================================================== [ 42.594035] ================================================================== [ 42.601365] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x690/0x740 [ 42.608865] Read of size 1 at addr ffff000080e0037f by task kunit_try_catch/280 [ 42.616275] [ 42.617804] CPU: 4 UID: 0 PID: 280 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 42.617834] Tainted: [B]=BAD_PAGE, [N]=TEST [ 42.617843] Hardware name: Thundercomm Dragonboard 845c (DT) [ 42.617854] Call trace: [ 42.617861] show_stack+0x20/0x38 (C) [ 42.617879] dump_stack_lvl+0x8c/0xd0 [ 42.617898] print_report+0x118/0x608 [ 42.617917] kasan_report+0xdc/0x128 [ 42.617935] __asan_report_load1_noabort+0x20/0x30 [ 42.617951] ksize_unpoisons_memory+0x690/0x740 [ 42.617969] kunit_try_run_case+0x170/0x3f0 [ 42.617985] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 42.618004] kthread+0x328/0x630 [ 42.618017] ret_from_fork+0x10/0x20 [ 42.618034] [ 42.684038] Allocated by task 280: [ 42.687493] kasan_save_stack+0x3c/0x68 [ 42.691398] kasan_save_track+0x20/0x40 [ 42.695292] kasan_save_alloc_info+0x40/0x58 [ 42.699623] __kasan_kmalloc+0xd4/0xd8 [ 42.703440] __kmalloc_cache_noprof+0x16c/0x3c0 [ 42.708036] ksize_unpoisons_memory+0xc0/0x740 [ 42.712548] kunit_try_run_case+0x170/0x3f0 [ 42.716797] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 42.722363] kthread+0x328/0x630 [ 42.725644] ret_from_fork+0x10/0x20 [ 42.729275] [ 42.730797] The buggy address belongs to the object at ffff000080e00300 [ 42.730797] which belongs to the cache kmalloc-128 of size 128 [ 42.743447] The buggy address is located 12 bytes to the right of [ 42.743447] allocated 115-byte region [ffff000080e00300, ffff000080e00373) [ 42.756625] [ 42.758148] The buggy address belongs to the physical page: [ 42.763789] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100e00 [ 42.771889] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 42.779641] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 42.786692] page_type: f5(slab) [ 42.789888] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 42.797729] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 42.805568] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 42.813492] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 42.821421] head: 0bfffe0000000001 fffffdffc2038001 00000000ffffffff 00000000ffffffff [ 42.829346] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 42.837268] page dumped because: kasan: bad access detected [ 42.842909] [ 42.844437] Memory state around the buggy address: [ 42.849289] ffff000080e00200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.856594] ffff000080e00280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.863909] >ffff000080e00300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 42.871216] ^ [ 42.878432] ffff000080e00380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.885747] ffff000080e00400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.893051] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-double-free-in-kfree_sensitive
[ 41.652057] ================================================================== [ 41.659370] BUG: KASAN: double-free in kfree_sensitive+0x3c/0xb0 [ 41.665459] Free of addr ffff000094759bc0 by task kunit_try_catch/278 [ 41.671985] [ 41.673511] CPU: 6 UID: 0 PID: 278 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 41.673541] Tainted: [B]=BAD_PAGE, [N]=TEST [ 41.673548] Hardware name: Thundercomm Dragonboard 845c (DT) [ 41.673557] Call trace: [ 41.673564] show_stack+0x20/0x38 (C) [ 41.673581] dump_stack_lvl+0x8c/0xd0 [ 41.673598] print_report+0x118/0x608 [ 41.673615] kasan_report_invalid_free+0xc0/0xe8 [ 41.673634] check_slab_allocation+0xd4/0x108 [ 41.673653] __kasan_slab_pre_free+0x2c/0x48 [ 41.673671] kfree+0xe8/0x3c8 [ 41.673685] kfree_sensitive+0x3c/0xb0 [ 41.673701] kmalloc_double_kzfree+0x168/0x308 [ 41.673717] kunit_try_run_case+0x170/0x3f0 [ 41.673733] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.673753] kthread+0x328/0x630 [ 41.673768] ret_from_fork+0x10/0x20 [ 41.673784] [ 41.751434] Allocated by task 278: [ 41.754889] kasan_save_stack+0x3c/0x68 [ 41.758794] kasan_save_track+0x20/0x40 [ 41.762688] kasan_save_alloc_info+0x40/0x58 [ 41.767023] __kasan_kmalloc+0xd4/0xd8 [ 41.770829] __kmalloc_cache_noprof+0x16c/0x3c0 [ 41.775426] kmalloc_double_kzfree+0xb8/0x308 [ 41.779848] kunit_try_run_case+0x170/0x3f0 [ 41.784098] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.789664] kthread+0x328/0x630 [ 41.792948] ret_from_fork+0x10/0x20 [ 41.796577] [ 41.798098] Freed by task 278: [ 41.801202] kasan_save_stack+0x3c/0x68 [ 41.805098] kasan_save_track+0x20/0x40 [ 41.808992] kasan_save_free_info+0x4c/0x78 [ 41.813240] __kasan_slab_free+0x6c/0x98 [ 41.817229] kfree+0x214/0x3c8 [ 41.820339] kfree_sensitive+0x80/0xb0 [ 41.824144] kmalloc_double_kzfree+0x11c/0x308 [ 41.828656] kunit_try_run_case+0x170/0x3f0 [ 41.832906] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.838471] kthread+0x328/0x630 [ 41.841753] ret_from_fork+0x10/0x20 [ 41.845384] [ 41.846907] The buggy address belongs to the object at ffff000094759bc0 [ 41.846907] which belongs to the cache kmalloc-16 of size 16 [ 41.859386] The buggy address is located 0 bytes inside of [ 41.859386] 16-byte region [ffff000094759bc0, ffff000094759bd0) [ 41.870994] [ 41.872525] The buggy address belongs to the physical page: [ 41.878167] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114759 [ 41.886270] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 41.892885] page_type: f5(slab) [ 41.896079] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 41.903922] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 41.911760] page dumped because: kasan: bad access detected [ 41.917403] [ 41.918926] Memory state around the buggy address: [ 41.923776] ffff000094759a80: 00 02 fc fc 00 02 fc fc 00 03 fc fc 00 03 fc fc [ 41.931087] ffff000094759b00: 00 03 fc fc 00 03 fc fc 00 03 fc fc 00 03 fc fc [ 41.938393] >ffff000094759b80: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 41.945698] ^ [ 41.951085] ffff000094759c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.958390] ffff000094759c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.965696] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-kmalloc_double_kzfree
[ 41.329600] ================================================================== [ 41.344220] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308 [ 41.351721] Read of size 1 at addr ffff000094759bc0 by task kunit_try_catch/278 [ 41.359122] [ 41.360660] CPU: 6 UID: 0 PID: 278 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 41.360691] Tainted: [B]=BAD_PAGE, [N]=TEST [ 41.360699] Hardware name: Thundercomm Dragonboard 845c (DT) [ 41.360711] Call trace: [ 41.360717] show_stack+0x20/0x38 (C) [ 41.360735] dump_stack_lvl+0x8c/0xd0 [ 41.360754] print_report+0x118/0x608 [ 41.360772] kasan_report+0xdc/0x128 [ 41.360791] __kasan_check_byte+0x54/0x70 [ 41.360809] kfree_sensitive+0x30/0xb0 [ 41.360829] kmalloc_double_kzfree+0x168/0x308 [ 41.360846] kunit_try_run_case+0x170/0x3f0 [ 41.360865] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.360885] kthread+0x328/0x630 [ 41.360899] ret_from_fork+0x10/0x20 [ 41.360917] [ 41.429828] Allocated by task 278: [ 41.433281] kasan_save_stack+0x3c/0x68 [ 41.437177] kasan_save_track+0x20/0x40 [ 41.441071] kasan_save_alloc_info+0x40/0x58 [ 41.445406] __kasan_kmalloc+0xd4/0xd8 [ 41.449212] __kmalloc_cache_noprof+0x16c/0x3c0 [ 41.453811] kmalloc_double_kzfree+0xb8/0x308 [ 41.458235] kunit_try_run_case+0x170/0x3f0 [ 41.462485] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.468049] kthread+0x328/0x630 [ 41.471333] ret_from_fork+0x10/0x20 [ 41.474965] [ 41.476495] Freed by task 278: [ 41.479600] kasan_save_stack+0x3c/0x68 [ 41.483493] kasan_save_track+0x20/0x40 [ 41.487388] kasan_save_free_info+0x4c/0x78 [ 41.491635] __kasan_slab_free+0x6c/0x98 [ 41.495616] kfree+0x214/0x3c8 [ 41.498729] kfree_sensitive+0x80/0xb0 [ 41.502534] kmalloc_double_kzfree+0x11c/0x308 [ 41.507046] kunit_try_run_case+0x170/0x3f0 [ 41.511295] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.516858] kthread+0x328/0x630 [ 41.520142] ret_from_fork+0x10/0x20 [ 41.523780] [ 41.525303] The buggy address belongs to the object at ffff000094759bc0 [ 41.525303] which belongs to the cache kmalloc-16 of size 16 [ 41.537785] The buggy address is located 0 bytes inside of [ 41.537785] freed 16-byte region [ffff000094759bc0, ffff000094759bd0) [ 41.549913] [ 41.551444] The buggy address belongs to the physical page: [ 41.557089] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114759 [ 41.565192] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 41.571807] page_type: f5(slab) [ 41.575009] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 41.582853] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 41.590691] page dumped because: kasan: bad access detected [ 41.596332] [ 41.597853] Memory state around the buggy address: [ 41.602706] ffff000094759a80: 00 02 fc fc 00 02 fc fc 00 03 fc fc 00 03 fc fc [ 41.610013] ffff000094759b00: 00 03 fc fc 00 03 fc fc 00 03 fc fc 00 03 fc fc [ 41.617320] >ffff000094759b80: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 41.624626] ^ [ 41.630013] ffff000094759c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.637319] ffff000094759c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.644624] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-invalid-free-in-kfree
[ 32.634748] ================================================================== [ 32.645872] BUG: KASAN: invalid-free in kfree+0x270/0x3c8 [ 32.651355] Free of addr ffff0000966fc001 by task kunit_try_catch/236 [ 32.657879] [ 32.659412] CPU: 1 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 32.659440] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.659448] Hardware name: Thundercomm Dragonboard 845c (DT) [ 32.659457] Call trace: [ 32.659463] show_stack+0x20/0x38 (C) [ 32.659482] dump_stack_lvl+0x8c/0xd0 [ 32.659501] print_report+0x118/0x608 [ 32.659519] kasan_report_invalid_free+0xc0/0xe8 [ 32.659541] __kasan_kfree_large+0x5c/0xa8 [ 32.659559] free_large_kmalloc+0x68/0x150 [ 32.659577] kfree+0x270/0x3c8 [ 32.659593] kmalloc_large_invalid_free+0x108/0x270 [ 32.659611] kunit_try_run_case+0x170/0x3f0 [ 32.659630] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.659651] kthread+0x328/0x630 [ 32.659665] ret_from_fork+0x10/0x20 [ 32.659684] [ 32.733667] The buggy address belongs to the physical page: [ 32.739310] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1166fc [ 32.747414] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.755170] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.762227] page_type: f8(unknown) [ 32.765698] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.773544] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.781391] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.789324] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.797256] head: 0bfffe0000000002 fffffdffc259bf01 00000000ffffffff 00000000ffffffff [ 32.805187] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 32.813114] page dumped because: kasan: bad access detected [ 32.818757] [ 32.820286] Memory state around the buggy address: [ 32.825142] ffff0000966fbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.832456] ffff0000966fbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.839770] >ffff0000966fc000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.847082] ^ [ 32.850364] ffff0000966fc080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.857678] ffff0000966fc100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.864990] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-kmalloc_uaf2
[ 41.008069] ================================================================== [ 41.019370] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468 [ 41.026078] Read of size 1 at addr ffff0000954c97a8 by task kunit_try_catch/274 [ 41.033489] [ 41.035023] CPU: 1 UID: 0 PID: 274 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 41.035054] Tainted: [B]=BAD_PAGE, [N]=TEST [ 41.035063] Hardware name: Thundercomm Dragonboard 845c (DT) [ 41.035074] Call trace: [ 41.035082] show_stack+0x20/0x38 (C) [ 41.035100] dump_stack_lvl+0x8c/0xd0 [ 41.035118] print_report+0x118/0x608 [ 41.035137] kasan_report+0xdc/0x128 [ 41.035157] __asan_report_load1_noabort+0x20/0x30 [ 41.035174] kmalloc_uaf2+0x3f4/0x468 [ 41.035190] kunit_try_run_case+0x170/0x3f0 [ 41.035210] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.035231] kthread+0x328/0x630 [ 41.035245] ret_from_fork+0x10/0x20 [ 41.035262] [ 41.100462] Allocated by task 274: [ 41.103924] kasan_save_stack+0x3c/0x68 [ 41.107834] kasan_save_track+0x20/0x40 [ 41.111741] kasan_save_alloc_info+0x40/0x58 [ 41.116086] __kasan_kmalloc+0xd4/0xd8 [ 41.119907] __kmalloc_cache_noprof+0x16c/0x3c0 [ 41.124516] kmalloc_uaf2+0xc4/0x468 [ 41.128153] kunit_try_run_case+0x170/0x3f0 [ 41.132406] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.137980] kthread+0x328/0x630 [ 41.141271] ret_from_fork+0x10/0x20 [ 41.144917] [ 41.146446] Freed by task 274: [ 41.149559] kasan_save_stack+0x3c/0x68 [ 41.153468] kasan_save_track+0x20/0x40 [ 41.157375] kasan_save_free_info+0x4c/0x78 [ 41.161628] __kasan_slab_free+0x6c/0x98 [ 41.165624] kfree+0x214/0x3c8 [ 41.168741] kmalloc_uaf2+0x134/0x468 [ 41.172474] kunit_try_run_case+0x170/0x3f0 [ 41.176727] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 41.182298] kthread+0x328/0x630 [ 41.185589] ret_from_fork+0x10/0x20 [ 41.189227] [ 41.190757] The buggy address belongs to the object at ffff0000954c9780 [ 41.190757] which belongs to the cache kmalloc-64 of size 64 [ 41.203240] The buggy address is located 40 bytes inside of [ 41.203240] freed 64-byte region [ffff0000954c9780, ffff0000954c97c0) [ 41.215462] [ 41.216997] The buggy address belongs to the physical page: [ 41.222647] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1154c9 [ 41.230760] anon flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 41.237817] page_type: f5(slab) [ 41.241022] raw: 0bfffe0000000000 ffff0000800028c0 0000000000000000 dead000000000001 [ 41.248868] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 41.256710] page dumped because: kasan: bad access detected [ 41.262359] [ 41.263885] Memory state around the buggy address: [ 41.268742] ffff0000954c9680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 41.276057] ffff0000954c9700: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc [ 41.283373] >ffff0000954c9780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 41.290683] ^ [ 41.295280] ffff0000954c9800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 41.302604] ffff0000954c9880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 41.309927] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-kmalloc_uaf_memset
[ 40.692743] ================================================================== [ 40.703431] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310 [ 40.710662] Write of size 33 at addr ffff000093903980 by task kunit_try_catch/272 [ 40.718247] [ 40.719778] CPU: 0 UID: 0 PID: 272 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 40.719806] Tainted: [B]=BAD_PAGE, [N]=TEST [ 40.719815] Hardware name: Thundercomm Dragonboard 845c (DT) [ 40.719827] Call trace: [ 40.719834] show_stack+0x20/0x38 (C) [ 40.719852] dump_stack_lvl+0x8c/0xd0 [ 40.719871] print_report+0x118/0x608 [ 40.719890] kasan_report+0xdc/0x128 [ 40.719908] kasan_check_range+0x100/0x1a8 [ 40.719928] __asan_memset+0x34/0x78 [ 40.719942] kmalloc_uaf_memset+0x170/0x310 [ 40.719959] kunit_try_run_case+0x170/0x3f0 [ 40.719977] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 40.720000] kthread+0x328/0x630 [ 40.720014] ret_from_fork+0x10/0x20 [ 40.720031] [ 40.788647] Allocated by task 272: [ 40.792107] kasan_save_stack+0x3c/0x68 [ 40.796017] kasan_save_track+0x20/0x40 [ 40.799927] kasan_save_alloc_info+0x40/0x58 [ 40.804272] __kasan_kmalloc+0xd4/0xd8 [ 40.808096] __kmalloc_cache_noprof+0x16c/0x3c0 [ 40.812704] kmalloc_uaf_memset+0xb8/0x310 [ 40.816871] kunit_try_run_case+0x170/0x3f0 [ 40.821126] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 40.826699] kthread+0x328/0x630 [ 40.829990] ret_from_fork+0x10/0x20 [ 40.833628] [ 40.835156] Freed by task 272: [ 40.838269] kasan_save_stack+0x3c/0x68 [ 40.842178] kasan_save_track+0x20/0x40 [ 40.846087] kasan_save_free_info+0x4c/0x78 [ 40.850339] __kasan_slab_free+0x6c/0x98 [ 40.854335] kfree+0x214/0x3c8 [ 40.857453] kmalloc_uaf_memset+0x11c/0x310 [ 40.861706] kunit_try_run_case+0x170/0x3f0 [ 40.865958] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 40.871531] kthread+0x328/0x630 [ 40.874821] ret_from_fork+0x10/0x20 [ 40.878461] [ 40.879988] The buggy address belongs to the object at ffff000093903980 [ 40.879988] which belongs to the cache kmalloc-64 of size 64 [ 40.892475] The buggy address is located 0 bytes inside of [ 40.892475] freed 64-byte region [ffff000093903980, ffff0000939039c0) [ 40.904611] [ 40.906142] The buggy address belongs to the physical page: [ 40.911789] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113903 [ 40.919902] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 40.926516] page_type: f5(slab) [ 40.929720] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 40.937567] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 40.945407] page dumped because: kasan: bad access detected [ 40.951056] [ 40.952590] Memory state around the buggy address: [ 40.957452] ffff000093903880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 40.964777] ffff000093903900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 40.972091] >ffff000093903980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 40.979406] ^ [ 40.982695] ffff000093903a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.990017] ffff000093903a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.997339] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-kmalloc_uaf
[ 40.379114] ================================================================== [ 40.391291] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338 [ 40.397912] Read of size 1 at addr ffff000081a1d448 by task kunit_try_catch/270 [ 40.405319] [ 40.406853] CPU: 1 UID: 0 PID: 270 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 40.406883] Tainted: [B]=BAD_PAGE, [N]=TEST [ 40.406892] Hardware name: Thundercomm Dragonboard 845c (DT) [ 40.406904] Call trace: [ 40.406914] show_stack+0x20/0x38 (C) [ 40.406933] dump_stack_lvl+0x8c/0xd0 [ 40.406952] print_report+0x118/0x608 [ 40.406973] kasan_report+0xdc/0x128 [ 40.406992] __asan_report_load1_noabort+0x20/0x30 [ 40.407009] kmalloc_uaf+0x300/0x338 [ 40.407027] kunit_try_run_case+0x170/0x3f0 [ 40.407046] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 40.407069] kthread+0x328/0x630 [ 40.407083] ret_from_fork+0x10/0x20 [ 40.407100] [ 40.472199] Allocated by task 270: [ 40.475663] kasan_save_stack+0x3c/0x68 [ 40.479572] kasan_save_track+0x20/0x40 [ 40.483479] kasan_save_alloc_info+0x40/0x58 [ 40.487823] __kasan_kmalloc+0xd4/0xd8 [ 40.491643] __kmalloc_cache_noprof+0x16c/0x3c0 [ 40.496246] kmalloc_uaf+0xb8/0x338 [ 40.499799] kunit_try_run_case+0x170/0x3f0 [ 40.504059] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 40.509626] kthread+0x328/0x630 [ 40.512914] ret_from_fork+0x10/0x20 [ 40.516561] [ 40.518089] Freed by task 270: [ 40.521197] kasan_save_stack+0x3c/0x68 [ 40.525104] kasan_save_track+0x20/0x40 [ 40.529011] kasan_save_free_info+0x4c/0x78 [ 40.533271] __kasan_slab_free+0x6c/0x98 [ 40.537266] kfree+0x214/0x3c8 [ 40.540382] kmalloc_uaf+0x11c/0x338 [ 40.544020] kunit_try_run_case+0x170/0x3f0 [ 40.548279] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 40.553850] kthread+0x328/0x630 [ 40.557136] ret_from_fork+0x10/0x20 [ 40.560783] [ 40.562316] The buggy address belongs to the object at ffff000081a1d440 [ 40.562316] which belongs to the cache kmalloc-16 of size 16 [ 40.574800] The buggy address is located 8 bytes inside of [ 40.574800] freed 16-byte region [ffff000081a1d440, ffff000081a1d450) [ 40.586940] [ 40.588473] The buggy address belongs to the physical page: [ 40.594121] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101a1d [ 40.602232] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 40.608851] page_type: f5(slab) [ 40.612058] raw: 0bfffe0000000000 ffff000080002640 dead000000000100 dead000000000122 [ 40.619899] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 40.627738] page dumped because: kasan: bad access detected [ 40.633388] [ 40.634917] Memory state around the buggy address: [ 40.639777] ffff000081a1d300: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 40.647099] ffff000081a1d380: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 40.654419] >ffff000081a1d400: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc [ 40.661739] ^ [ 40.667388] ffff000081a1d480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.674710] ffff000081a1d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.682029] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_memmove_invalid_size
[ 40.102576] ================================================================== [ 40.114843] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x154/0x2e0 [ 40.122872] Read of size 64 at addr ffff000093903904 by task kunit_try_catch/268 [ 40.130369] [ 40.131898] CPU: 0 UID: 0 PID: 268 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 40.131928] Tainted: [B]=BAD_PAGE, [N]=TEST [ 40.131936] Hardware name: Thundercomm Dragonboard 845c (DT) [ 40.131949] Call trace: [ 40.131956] show_stack+0x20/0x38 (C) [ 40.131975] dump_stack_lvl+0x8c/0xd0 [ 40.131994] print_report+0x118/0x608 [ 40.132013] kasan_report+0xdc/0x128 [ 40.132032] kasan_check_range+0x100/0x1a8 [ 40.132051] __asan_memmove+0x3c/0x98 [ 40.132067] kmalloc_memmove_invalid_size+0x154/0x2e0 [ 40.132087] kunit_try_run_case+0x170/0x3f0 [ 40.132104] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 40.132125] kthread+0x328/0x630 [ 40.132139] ret_from_fork+0x10/0x20 [ 40.132156] [ 40.201747] Allocated by task 268: [ 40.205204] kasan_save_stack+0x3c/0x68 [ 40.209113] kasan_save_track+0x20/0x40 [ 40.213022] kasan_save_alloc_info+0x40/0x58 [ 40.217359] __kasan_kmalloc+0xd4/0xd8 [ 40.221179] __kmalloc_cache_noprof+0x16c/0x3c0 [ 40.225789] kmalloc_memmove_invalid_size+0xb0/0x2e0 [ 40.230829] kunit_try_run_case+0x170/0x3f0 [ 40.235082] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 40.240659] kthread+0x328/0x630 [ 40.243953] ret_from_fork+0x10/0x20 [ 40.247592] [ 40.249126] The buggy address belongs to the object at ffff000093903900 [ 40.249126] which belongs to the cache kmalloc-64 of size 64 [ 40.261612] The buggy address is located 4 bytes inside of [ 40.261612] allocated 64-byte region [ffff000093903900, ffff000093903940) [ 40.274101] [ 40.275630] The buggy address belongs to the physical page: [ 40.281282] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113903 [ 40.289391] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 40.296014] page_type: f5(slab) [ 40.299221] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 40.307063] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 40.314900] page dumped because: kasan: bad access detected [ 40.320551] [ 40.322081] Memory state around the buggy address: [ 40.326944] ffff000093903800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 40.334265] ffff000093903880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 40.341588] >ffff000093903900: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 40.348908] ^ [ 40.354299] ffff000093903980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.361622] ffff000093903a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.368942] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-out-of-bounds-in-kmalloc_memmove_negative_size
[ 39.829617] ================================================================== [ 39.841175] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 39.848853] Read of size 18446744073709551614 at addr ffff000093903884 by task kunit_try_catch/266 [ 39.857932] [ 39.859467] CPU: 0 UID: 0 PID: 266 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 39.859495] Tainted: [B]=BAD_PAGE, [N]=TEST [ 39.859504] Hardware name: Thundercomm Dragonboard 845c (DT) [ 39.859516] Call trace: [ 39.859523] show_stack+0x20/0x38 (C) [ 39.859542] dump_stack_lvl+0x8c/0xd0 [ 39.859562] print_report+0x118/0x608 [ 39.859582] kasan_report+0xdc/0x128 [ 39.859600] kasan_check_range+0x100/0x1a8 [ 39.859621] __asan_memmove+0x3c/0x98 [ 39.859636] kmalloc_memmove_negative_size+0x154/0x2e0 [ 39.859656] kunit_try_run_case+0x170/0x3f0 [ 39.859675] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.859697] kthread+0x328/0x630 [ 39.859711] ret_from_fork+0x10/0x20 [ 39.859730] [ 39.929399] Allocated by task 266: [ 39.932865] kasan_save_stack+0x3c/0x68 [ 39.936771] kasan_save_track+0x20/0x40 [ 39.940675] kasan_save_alloc_info+0x40/0x58 [ 39.945019] __kasan_kmalloc+0xd4/0xd8 [ 39.948837] __kmalloc_cache_noprof+0x16c/0x3c0 [ 39.953444] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 39.958581] kunit_try_run_case+0x170/0x3f0 [ 39.962840] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.968408] kthread+0x328/0x630 [ 39.971693] ret_from_fork+0x10/0x20 [ 39.975338] [ 39.976868] The buggy address belongs to the object at ffff000093903880 [ 39.976868] which belongs to the cache kmalloc-64 of size 64 [ 39.989356] The buggy address is located 4 bytes inside of [ 39.989356] 64-byte region [ffff000093903880, ffff0000939038c0) [ 40.000970] [ 40.002500] The buggy address belongs to the physical page: [ 40.008144] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113903 [ 40.016249] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 40.022873] page_type: f5(slab) [ 40.026075] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000 [ 40.033921] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 40.041763] page dumped because: kasan: bad access detected [ 40.047408] [ 40.048938] Memory state around the buggy address: [ 40.053796] ffff000093903780: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 40.061110] ffff000093903800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 40.068426] >ffff000093903880: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 40.075738] ^ [ 40.079022] ffff000093903900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.086337] ffff000093903980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.093649] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_oob_memset_16
[ 39.514605] ================================================================== [ 39.526080] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x150/0x2f8 [ 39.533485] Write of size 16 at addr ffff00009462c969 by task kunit_try_catch/264 [ 39.541061] [ 39.542591] CPU: 7 UID: 0 PID: 264 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 39.542621] Tainted: [B]=BAD_PAGE, [N]=TEST [ 39.542629] Hardware name: Thundercomm Dragonboard 845c (DT) [ 39.542642] Call trace: [ 39.542649] show_stack+0x20/0x38 (C) [ 39.542667] dump_stack_lvl+0x8c/0xd0 [ 39.542684] print_report+0x118/0x608 [ 39.542702] kasan_report+0xdc/0x128 [ 39.542720] kasan_check_range+0x100/0x1a8 [ 39.542739] __asan_memset+0x34/0x78 [ 39.542753] kmalloc_oob_memset_16+0x150/0x2f8 [ 39.542771] kunit_try_run_case+0x170/0x3f0 [ 39.542789] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.542808] kthread+0x328/0x630 [ 39.542821] ret_from_fork+0x10/0x20 [ 39.542838] [ 39.611692] Allocated by task 264: [ 39.615148] kasan_save_stack+0x3c/0x68 [ 39.619053] kasan_save_track+0x20/0x40 [ 39.622955] kasan_save_alloc_info+0x40/0x58 [ 39.627286] __kasan_kmalloc+0xd4/0xd8 [ 39.631101] __kmalloc_cache_noprof+0x16c/0x3c0 [ 39.635702] kmalloc_oob_memset_16+0xb0/0x2f8 [ 39.640123] kunit_try_run_case+0x170/0x3f0 [ 39.644371] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.649935] kthread+0x328/0x630 [ 39.653214] ret_from_fork+0x10/0x20 [ 39.656844] [ 39.658366] The buggy address belongs to the object at ffff00009462c900 [ 39.658366] which belongs to the cache kmalloc-128 of size 128 [ 39.671017] The buggy address is located 105 bytes inside of [ 39.671017] allocated 120-byte region [ffff00009462c900, ffff00009462c978) [ 39.683761] [ 39.685285] The buggy address belongs to the physical page: [ 39.690929] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11462c [ 39.699027] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 39.706777] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 39.713831] page_type: f5(slab) [ 39.717028] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 39.724866] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 39.732703] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 39.740626] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 39.748550] head: 0bfffe0000000001 fffffdffc2518b01 00000000ffffffff 00000000ffffffff [ 39.756473] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 39.764392] page dumped because: kasan: bad access detected [ 39.770033] [ 39.771562] Memory state around the buggy address: [ 39.776422] ffff00009462c800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.783735] ffff00009462c880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.791039] >ffff00009462c900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 39.798350] ^ [ 39.805574] ffff00009462c980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.812887] ffff00009462ca00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.820199] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_oob_memset_8
[ 39.198917] ================================================================== [ 39.210399] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x150/0x2f8 [ 39.217719] Write of size 8 at addr ffff00008039f371 by task kunit_try_catch/262 [ 39.225220] [ 39.226754] CPU: 0 UID: 0 PID: 262 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 39.226785] Tainted: [B]=BAD_PAGE, [N]=TEST [ 39.226793] Hardware name: Thundercomm Dragonboard 845c (DT) [ 39.226805] Call trace: [ 39.226813] show_stack+0x20/0x38 (C) [ 39.226831] dump_stack_lvl+0x8c/0xd0 [ 39.226849] print_report+0x118/0x608 [ 39.226869] kasan_report+0xdc/0x128 [ 39.226887] kasan_check_range+0x100/0x1a8 [ 39.226909] __asan_memset+0x34/0x78 [ 39.226923] kmalloc_oob_memset_8+0x150/0x2f8 [ 39.226940] kunit_try_run_case+0x170/0x3f0 [ 39.226959] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.226982] kthread+0x328/0x630 [ 39.226996] ret_from_fork+0x10/0x20 [ 39.227014] [ 39.295808] Allocated by task 262: [ 39.299274] kasan_save_stack+0x3c/0x68 [ 39.303181] kasan_save_track+0x20/0x40 [ 39.307086] kasan_save_alloc_info+0x40/0x58 [ 39.311431] __kasan_kmalloc+0xd4/0xd8 [ 39.315248] __kmalloc_cache_noprof+0x16c/0x3c0 [ 39.319854] kmalloc_oob_memset_8+0xb0/0x2f8 [ 39.324199] kunit_try_run_case+0x170/0x3f0 [ 39.328460] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.334030] kthread+0x328/0x630 [ 39.337315] ret_from_fork+0x10/0x20 [ 39.340958] [ 39.342489] The buggy address belongs to the object at ffff00008039f300 [ 39.342489] which belongs to the cache kmalloc-128 of size 128 [ 39.355150] The buggy address is located 113 bytes inside of [ 39.355150] allocated 120-byte region [ffff00008039f300, ffff00008039f378) [ 39.367903] [ 39.369432] The buggy address belongs to the physical page: [ 39.375077] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 39.383181] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 39.390937] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 39.397995] page_type: f5(slab) [ 39.401196] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 39.409043] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 39.416890] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 39.424822] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 39.432755] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 39.440689] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 39.448618] page dumped because: kasan: bad access detected [ 39.454262] [ 39.455793] Memory state around the buggy address: [ 39.460649] ffff00008039f200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.467964] ffff00008039f280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.475278] >ffff00008039f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 39.482593] ^ [ 39.489819] ffff00008039f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.497136] ffff00008039f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.504448] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_oob_memset_4
[ 38.881947] ================================================================== [ 38.893423] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300 [ 38.900748] Write of size 4 at addr ffff00008039f275 by task kunit_try_catch/260 [ 38.908242] [ 38.909775] CPU: 0 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 38.909805] Tainted: [B]=BAD_PAGE, [N]=TEST [ 38.909814] Hardware name: Thundercomm Dragonboard 845c (DT) [ 38.909827] Call trace: [ 38.909834] show_stack+0x20/0x38 (C) [ 38.909853] dump_stack_lvl+0x8c/0xd0 [ 38.909872] print_report+0x118/0x608 [ 38.909891] kasan_report+0xdc/0x128 [ 38.909909] kasan_check_range+0x100/0x1a8 [ 38.909929] __asan_memset+0x34/0x78 [ 38.909946] kmalloc_oob_memset_4+0x150/0x300 [ 38.909963] kunit_try_run_case+0x170/0x3f0 [ 38.909981] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.910004] kthread+0x328/0x630 [ 38.910019] ret_from_fork+0x10/0x20 [ 38.910036] [ 38.978819] Allocated by task 260: [ 38.982280] kasan_save_stack+0x3c/0x68 [ 38.986191] kasan_save_track+0x20/0x40 [ 38.990102] kasan_save_alloc_info+0x40/0x58 [ 38.994441] __kasan_kmalloc+0xd4/0xd8 [ 38.998263] __kmalloc_cache_noprof+0x16c/0x3c0 [ 39.002865] kmalloc_oob_memset_4+0xb0/0x300 [ 39.007206] kunit_try_run_case+0x170/0x3f0 [ 39.011462] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.017031] kthread+0x328/0x630 [ 39.020323] ret_from_fork+0x10/0x20 [ 39.023964] [ 39.025493] The buggy address belongs to the object at ffff00008039f200 [ 39.025493] which belongs to the cache kmalloc-128 of size 128 [ 39.038149] The buggy address is located 117 bytes inside of [ 39.038149] allocated 120-byte region [ffff00008039f200, ffff00008039f278) [ 39.050894] [ 39.052430] The buggy address belongs to the physical page: [ 39.058080] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 39.066186] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 39.073945] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 39.081003] page_type: f5(slab) [ 39.084208] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 39.092056] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 39.099904] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 39.107838] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 39.115771] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 39.123704] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 39.131632] page dumped because: kasan: bad access detected [ 39.137277] [ 39.138807] Memory state around the buggy address: [ 39.143670] ffff00008039f100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.150985] ffff00008039f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.158300] >ffff00008039f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 39.165613] ^ [ 39.172840] ffff00008039f280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.180157] ffff00008039f300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.187474] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_oob_memset_2
[ 38.566464] ================================================================== [ 38.578030] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x150/0x2f8 [ 38.585351] Write of size 2 at addr ffff00009462c877 by task kunit_try_catch/258 [ 38.592844] [ 38.594373] CPU: 7 UID: 0 PID: 258 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 38.594403] Tainted: [B]=BAD_PAGE, [N]=TEST [ 38.594412] Hardware name: Thundercomm Dragonboard 845c (DT) [ 38.594426] Call trace: [ 38.594433] show_stack+0x20/0x38 (C) [ 38.594451] dump_stack_lvl+0x8c/0xd0 [ 38.594468] print_report+0x118/0x608 [ 38.594487] kasan_report+0xdc/0x128 [ 38.594504] kasan_check_range+0x100/0x1a8 [ 38.594524] __asan_memset+0x34/0x78 [ 38.594537] kmalloc_oob_memset_2+0x150/0x2f8 [ 38.594555] kunit_try_run_case+0x170/0x3f0 [ 38.594571] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.594590] kthread+0x328/0x630 [ 38.594604] ret_from_fork+0x10/0x20 [ 38.594621] [ 38.663361] Allocated by task 258: [ 38.666819] kasan_save_stack+0x3c/0x68 [ 38.670717] kasan_save_track+0x20/0x40 [ 38.674614] kasan_save_alloc_info+0x40/0x58 [ 38.678952] __kasan_kmalloc+0xd4/0xd8 [ 38.682760] __kmalloc_cache_noprof+0x16c/0x3c0 [ 38.687362] kmalloc_oob_memset_2+0xb0/0x2f8 [ 38.691701] kunit_try_run_case+0x170/0x3f0 [ 38.695954] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.701522] kthread+0x328/0x630 [ 38.704807] ret_from_fork+0x10/0x20 [ 38.708442] [ 38.709967] The buggy address belongs to the object at ffff00009462c800 [ 38.709967] which belongs to the cache kmalloc-128 of size 128 [ 38.722622] The buggy address is located 119 bytes inside of [ 38.722622] allocated 120-byte region [ffff00009462c800, ffff00009462c878) [ 38.735366] [ 38.736889] The buggy address belongs to the physical page: [ 38.742538] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11462c [ 38.750636] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 38.758386] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 38.765442] page_type: f5(slab) [ 38.768641] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 38.776478] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 38.784315] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 38.792237] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 38.800160] head: 0bfffe0000000001 fffffdffc2518b01 00000000ffffffff 00000000ffffffff [ 38.808082] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 38.816001] page dumped because: kasan: bad access detected [ 38.821647] [ 38.823168] Memory state around the buggy address: [ 38.828025] ffff00009462c700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.835337] ffff00009462c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.842649] >ffff00009462c800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 38.849958] ^ [ 38.857182] ffff00009462c880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.864493] ffff00009462c900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.871804] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_oob_in_memset
[ 38.251011] ================================================================== [ 38.261955] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x144/0x2d0 [ 38.269370] Write of size 128 at addr ffff00008039f100 by task kunit_try_catch/256 [ 38.277043] [ 38.278576] CPU: 0 UID: 0 PID: 256 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 38.278607] Tainted: [B]=BAD_PAGE, [N]=TEST [ 38.278615] Hardware name: Thundercomm Dragonboard 845c (DT) [ 38.278628] Call trace: [ 38.278635] show_stack+0x20/0x38 (C) [ 38.278654] dump_stack_lvl+0x8c/0xd0 [ 38.278672] print_report+0x118/0x608 [ 38.278691] kasan_report+0xdc/0x128 [ 38.278711] kasan_check_range+0x100/0x1a8 [ 38.278732] __asan_memset+0x34/0x78 [ 38.278748] kmalloc_oob_in_memset+0x144/0x2d0 [ 38.278766] kunit_try_run_case+0x170/0x3f0 [ 38.278785] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.278806] kthread+0x328/0x630 [ 38.278821] ret_from_fork+0x10/0x20 [ 38.278840] [ 38.347721] Allocated by task 256: [ 38.351182] kasan_save_stack+0x3c/0x68 [ 38.355091] kasan_save_track+0x20/0x40 [ 38.359001] kasan_save_alloc_info+0x40/0x58 [ 38.363338] __kasan_kmalloc+0xd4/0xd8 [ 38.367161] __kmalloc_cache_noprof+0x16c/0x3c0 [ 38.371768] kmalloc_oob_in_memset+0xb0/0x2d0 [ 38.376200] kunit_try_run_case+0x170/0x3f0 [ 38.380449] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.386024] kthread+0x328/0x630 [ 38.389314] ret_from_fork+0x10/0x20 [ 38.392962] [ 38.394492] The buggy address belongs to the object at ffff00008039f100 [ 38.394492] which belongs to the cache kmalloc-128 of size 128 [ 38.407155] The buggy address is located 0 bytes inside of [ 38.407155] allocated 120-byte region [ffff00008039f100, ffff00008039f178) [ 38.419732] [ 38.421267] The buggy address belongs to the physical page: [ 38.426917] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10039e [ 38.435030] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 38.442784] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 38.449839] page_type: f5(slab) [ 38.453041] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 38.460887] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 38.468729] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 38.476659] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 38.484590] head: 0bfffe0000000001 fffffdffc200e781 00000000ffffffff 00000000ffffffff [ 38.492520] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 38.500446] page dumped because: kasan: bad access detected [ 38.506094] [ 38.507625] Memory state around the buggy address: [ 38.512491] ffff00008039f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 38.519807] ffff00008039f080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.527121] >ffff00008039f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 38.534441] ^ [ 38.541674] ffff00008039f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.548996] ffff00008039f200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.556317] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-kmalloc_uaf_16
[ 37.938274] ================================================================== [ 37.949220] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x3bc/0x438 [ 37.956105] Read of size 16 at addr ffff000093276b60 by task kunit_try_catch/254 [ 37.963597] [ 37.965126] CPU: 7 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 37.965156] Tainted: [B]=BAD_PAGE, [N]=TEST [ 37.965164] Hardware name: Thundercomm Dragonboard 845c (DT) [ 37.965179] Call trace: [ 37.965186] show_stack+0x20/0x38 (C) [ 37.965203] dump_stack_lvl+0x8c/0xd0 [ 37.965223] print_report+0x118/0x608 [ 37.965240] kasan_report+0xdc/0x128 [ 37.965258] __asan_report_load16_noabort+0x20/0x30 [ 37.965274] kmalloc_uaf_16+0x3bc/0x438 [ 37.965290] kunit_try_run_case+0x170/0x3f0 [ 37.965308] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.965328] kthread+0x328/0x630 [ 37.965341] ret_from_fork+0x10/0x20 [ 37.965357] [ 38.030750] Allocated by task 254: [ 38.034207] kasan_save_stack+0x3c/0x68 [ 38.038105] kasan_save_track+0x20/0x40 [ 38.042004] kasan_save_alloc_info+0x40/0x58 [ 38.046342] __kasan_kmalloc+0xd4/0xd8 [ 38.050150] __kmalloc_cache_noprof+0x16c/0x3c0 [ 38.054751] kmalloc_uaf_16+0x140/0x438 [ 38.058647] kunit_try_run_case+0x170/0x3f0 [ 38.062899] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.068467] kthread+0x328/0x630 [ 38.071752] ret_from_fork+0x10/0x20 [ 38.075387] [ 38.076909] Freed by task 254: [ 38.080018] kasan_save_stack+0x3c/0x68 [ 38.083914] kasan_save_track+0x20/0x40 [ 38.087811] kasan_save_free_info+0x4c/0x78 [ 38.092061] __kasan_slab_free+0x6c/0x98 [ 38.096044] kfree+0x214/0x3c8 [ 38.099157] kmalloc_uaf_16+0x190/0x438 [ 38.103051] kunit_try_run_case+0x170/0x3f0 [ 38.107305] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 38.112874] kthread+0x328/0x630 [ 38.116160] ret_from_fork+0x10/0x20 [ 38.119794] [ 38.121316] The buggy address belongs to the object at ffff000093276b60 [ 38.121316] which belongs to the cache kmalloc-16 of size 16 [ 38.133799] The buggy address is located 0 bytes inside of [ 38.133799] freed 16-byte region [ffff000093276b60, ffff000093276b70) [ 38.145924] [ 38.147447] The buggy address belongs to the physical page: [ 38.153095] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113276 [ 38.161192] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 38.167801] page_type: f5(slab) [ 38.171000] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 38.178838] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 38.186671] page dumped because: kasan: bad access detected [ 38.192318] [ 38.193840] Memory state around the buggy address: [ 38.198695] ffff000093276a00: 00 03 fc fc 00 03 fc fc 00 03 fc fc 00 03 fc fc [ 38.206008] ffff000093276a80: 00 03 fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc [ 38.213321] >ffff000093276b00: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 38.220631] ^ [ 38.227063] ffff000093276b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.234385] ffff000093276c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.241703] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_oob_16
[ 37.670646] ================================================================== [ 37.681425] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x3a0/0x3f8 [ 37.688221] Write of size 16 at addr ffff0000820e8620 by task kunit_try_catch/252 [ 37.695801] [ 37.697338] CPU: 0 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 37.697368] Tainted: [B]=BAD_PAGE, [N]=TEST [ 37.697376] Hardware name: Thundercomm Dragonboard 845c (DT) [ 37.697388] Call trace: [ 37.697396] show_stack+0x20/0x38 (C) [ 37.697415] dump_stack_lvl+0x8c/0xd0 [ 37.697435] print_report+0x118/0x608 [ 37.697455] kasan_report+0xdc/0x128 [ 37.697473] __asan_report_store16_noabort+0x20/0x30 [ 37.697493] kmalloc_oob_16+0x3a0/0x3f8 [ 37.697509] kunit_try_run_case+0x170/0x3f0 [ 37.697528] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.697549] kthread+0x328/0x630 [ 37.697564] ret_from_fork+0x10/0x20 [ 37.697583] [ 37.763108] Allocated by task 252: [ 37.766567] kasan_save_stack+0x3c/0x68 [ 37.770476] kasan_save_track+0x20/0x40 [ 37.774385] kasan_save_alloc_info+0x40/0x58 [ 37.778723] __kasan_kmalloc+0xd4/0xd8 [ 37.782542] __kmalloc_cache_noprof+0x16c/0x3c0 [ 37.787154] kmalloc_oob_16+0xb4/0x3f8 [ 37.790975] kunit_try_run_case+0x170/0x3f0 [ 37.795226] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.800795] kthread+0x328/0x630 [ 37.804087] ret_from_fork+0x10/0x20 [ 37.807726] [ 37.809262] The buggy address belongs to the object at ffff0000820e8620 [ 37.809262] which belongs to the cache kmalloc-16 of size 16 [ 37.821751] The buggy address is located 0 bytes inside of [ 37.821751] allocated 13-byte region [ffff0000820e8620, ffff0000820e862d) [ 37.834243] [ 37.835773] The buggy address belongs to the physical page: [ 37.841417] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1020e8 [ 37.849531] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.856153] page_type: f5(slab) [ 37.859351] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 37.867195] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 37.875035] page dumped because: kasan: bad access detected [ 37.880688] [ 37.882219] Memory state around the buggy address: [ 37.887083] ffff0000820e8500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 37.894404] ffff0000820e8580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 37.901729] >ffff0000820e8600: fa fb fc fc 00 05 fc fc 00 00 fc fc fc fc fc fc [ 37.909049] ^ [ 37.913654] ffff0000820e8680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.920976] ffff0000820e8700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.928297] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-use-after-free-in-krealloc_uaf
[ 37.323270] ================================================================== [ 37.330595] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520 [ 37.337305] Read of size 1 at addr ffff00008036f000 by task kunit_try_catch/250 [ 37.344717] [ 37.346250] CPU: 0 UID: 0 PID: 250 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 37.346280] Tainted: [B]=BAD_PAGE, [N]=TEST [ 37.346289] Hardware name: Thundercomm Dragonboard 845c (DT) [ 37.346301] Call trace: [ 37.346308] show_stack+0x20/0x38 (C) [ 37.346328] dump_stack_lvl+0x8c/0xd0 [ 37.346346] print_report+0x118/0x608 [ 37.346365] kasan_report+0xdc/0x128 [ 37.346383] __asan_report_load1_noabort+0x20/0x30 [ 37.346401] krealloc_uaf+0x4c8/0x520 [ 37.346419] kunit_try_run_case+0x170/0x3f0 [ 37.346439] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.346461] kthread+0x328/0x630 [ 37.346475] ret_from_fork+0x10/0x20 [ 37.346492] [ 37.411693] Allocated by task 250: [ 37.415153] kasan_save_stack+0x3c/0x68 [ 37.419064] kasan_save_track+0x20/0x40 [ 37.422971] kasan_save_alloc_info+0x40/0x58 [ 37.427309] __kasan_kmalloc+0xd4/0xd8 [ 37.431132] __kmalloc_cache_noprof+0x16c/0x3c0 [ 37.435739] krealloc_uaf+0xc8/0x520 [ 37.439377] kunit_try_run_case+0x170/0x3f0 [ 37.443630] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.449194] kthread+0x328/0x630 [ 37.452485] ret_from_fork+0x10/0x20 [ 37.456124] [ 37.457650] Freed by task 250: [ 37.460762] kasan_save_stack+0x3c/0x68 [ 37.464672] kasan_save_track+0x20/0x40 [ 37.468578] kasan_save_free_info+0x4c/0x78 [ 37.472828] __kasan_slab_free+0x6c/0x98 [ 37.476825] kfree+0x214/0x3c8 [ 37.479945] krealloc_uaf+0x12c/0x520 [ 37.483669] kunit_try_run_case+0x170/0x3f0 [ 37.487920] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.493487] kthread+0x328/0x630 [ 37.496777] ret_from_fork+0x10/0x20 [ 37.500414] [ 37.501944] The buggy address belongs to the object at ffff00008036f000 [ 37.501944] which belongs to the cache kmalloc-256 of size 256 [ 37.514603] The buggy address is located 0 bytes inside of [ 37.514603] freed 256-byte region [ffff00008036f000, ffff00008036f100) [ 37.526825] [ 37.528360] The buggy address belongs to the physical page: [ 37.534008] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 37.542120] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 37.549877] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 37.556929] page_type: f5(slab) [ 37.560136] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 37.567979] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 37.575825] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 37.583755] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 37.591685] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 37.599617] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 37.607542] page dumped because: kasan: bad access detected [ 37.613195] [ 37.614724] Memory state around the buggy address: [ 37.619584] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.626907] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.634231] >ffff00008036f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.641551] ^ [ 37.644838] ffff00008036f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.652160] ffff00008036f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.659475] ================================================================== [ 36.972115] ================================================================== [ 36.983845] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520 [ 36.990558] Read of size 1 at addr ffff00008036f000 by task kunit_try_catch/250 [ 36.997967] [ 36.999499] CPU: 0 UID: 0 PID: 250 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.999529] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.999536] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.999548] Call trace: [ 36.999556] show_stack+0x20/0x38 (C) [ 36.999575] dump_stack_lvl+0x8c/0xd0 [ 36.999593] print_report+0x118/0x608 [ 36.999612] kasan_report+0xdc/0x128 [ 36.999630] __kasan_check_byte+0x54/0x70 [ 36.999648] krealloc_noprof+0x44/0x360 [ 36.999667] krealloc_uaf+0x180/0x520 [ 36.999684] kunit_try_run_case+0x170/0x3f0 [ 36.999703] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.999723] kthread+0x328/0x630 [ 36.999738] ret_from_fork+0x10/0x20 [ 36.999755] [ 37.068051] Allocated by task 250: [ 37.071515] kasan_save_stack+0x3c/0x68 [ 37.075425] kasan_save_track+0x20/0x40 [ 37.079333] kasan_save_alloc_info+0x40/0x58 [ 37.083669] __kasan_kmalloc+0xd4/0xd8 [ 37.087491] __kmalloc_cache_noprof+0x16c/0x3c0 [ 37.092097] krealloc_uaf+0xc8/0x520 [ 37.095736] kunit_try_run_case+0x170/0x3f0 [ 37.099987] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.105555] kthread+0x328/0x630 [ 37.108845] ret_from_fork+0x10/0x20 [ 37.112491] [ 37.114020] Freed by task 250: [ 37.117132] kasan_save_stack+0x3c/0x68 [ 37.121042] kasan_save_track+0x20/0x40 [ 37.124948] kasan_save_free_info+0x4c/0x78 [ 37.129199] __kasan_slab_free+0x6c/0x98 [ 37.133195] kfree+0x214/0x3c8 [ 37.136312] krealloc_uaf+0x12c/0x520 [ 37.140036] kunit_try_run_case+0x170/0x3f0 [ 37.144287] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.149859] kthread+0x328/0x630 [ 37.153151] ret_from_fork+0x10/0x20 [ 37.156788] [ 37.158317] The buggy address belongs to the object at ffff00008036f000 [ 37.158317] which belongs to the cache kmalloc-256 of size 256 [ 37.170979] The buggy address is located 0 bytes inside of [ 37.170979] freed 256-byte region [ffff00008036f000, ffff00008036f100) [ 37.183199] [ 37.184732] The buggy address belongs to the physical page: [ 37.190383] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 37.198493] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 37.206249] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 37.213304] page_type: f5(slab) [ 37.216508] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 37.224351] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 37.232197] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 37.240127] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 37.248056] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 37.255987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 37.263911] page dumped because: kasan: bad access detected [ 37.269556] [ 37.271085] Memory state around the buggy address: [ 37.275945] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.283259] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.290582] >ffff00008036f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.297901] ^ [ 37.301189] ffff00008036f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 37.308512] ffff00008036f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.315827] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-krealloc_less_oob_helper
[ 35.780770] ================================================================== [ 35.792501] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 35.800175] Write of size 1 at addr ffff0000953620c9 by task kunit_try_catch/248 [ 35.807667] [ 35.809206] CPU: 0 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 35.809234] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.809242] Hardware name: Thundercomm Dragonboard 845c (DT) [ 35.809253] Call trace: [ 35.809260] show_stack+0x20/0x38 (C) [ 35.809278] dump_stack_lvl+0x8c/0xd0 [ 35.809297] print_report+0x118/0x608 [ 35.809315] kasan_report+0xdc/0x128 [ 35.809334] __asan_report_store1_noabort+0x20/0x30 [ 35.809352] krealloc_less_oob_helper+0xa48/0xc50 [ 35.809370] krealloc_large_less_oob+0x20/0x38 [ 35.809389] kunit_try_run_case+0x170/0x3f0 [ 35.809409] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.809429] kthread+0x328/0x630 [ 35.809443] ret_from_fork+0x10/0x20 [ 35.809459] [ 35.880274] The buggy address belongs to the physical page: [ 35.885922] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 35.894034] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 35.901788] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 35.908843] page_type: f8(unknown) [ 35.912307] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 35.920151] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 35.927996] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 35.935926] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 35.943856] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 35.951785] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 35.959710] page dumped because: kasan: bad access detected [ 35.965353] [ 35.966883] Memory state around the buggy address: [ 35.971743] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.979055] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.986378] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 35.993697] ^ [ 35.999348] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.006670] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.013990] ================================================================== [ 33.719133] ================================================================== [ 33.730345] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 33.738021] Write of size 1 at addr ffff00008036eec9 by task kunit_try_catch/244 [ 33.745521] [ 33.747053] CPU: 0 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 33.747081] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.747090] Hardware name: Thundercomm Dragonboard 845c (DT) [ 33.747102] Call trace: [ 33.747109] show_stack+0x20/0x38 (C) [ 33.747129] dump_stack_lvl+0x8c/0xd0 [ 33.747147] print_report+0x118/0x608 [ 33.747165] kasan_report+0xdc/0x128 [ 33.747185] __asan_report_store1_noabort+0x20/0x30 [ 33.747203] krealloc_less_oob_helper+0xa48/0xc50 [ 33.747223] krealloc_less_oob+0x20/0x38 [ 33.747240] kunit_try_run_case+0x170/0x3f0 [ 33.747260] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.747283] kthread+0x328/0x630 [ 33.747298] ret_from_fork+0x10/0x20 [ 33.747316] [ 33.817595] Allocated by task 244: [ 33.821053] kasan_save_stack+0x3c/0x68 [ 33.824964] kasan_save_track+0x20/0x40 [ 33.828872] kasan_save_alloc_info+0x40/0x58 [ 33.833210] __kasan_krealloc+0x118/0x178 [ 33.837294] krealloc_noprof+0x128/0x360 [ 33.841290] krealloc_less_oob_helper+0x168/0xc50 [ 33.846073] krealloc_less_oob+0x20/0x38 [ 33.850067] kunit_try_run_case+0x170/0x3f0 [ 33.854319] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.859887] kthread+0x328/0x630 [ 33.863179] ret_from_fork+0x10/0x20 [ 33.866815] [ 33.868351] The buggy address belongs to the object at ffff00008036ee00 [ 33.868351] which belongs to the cache kmalloc-256 of size 256 [ 33.881015] The buggy address is located 0 bytes to the right of [ 33.881015] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 33.894114] [ 33.895643] The buggy address belongs to the physical page: [ 33.901288] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 33.909391] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.917147] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 33.924204] page_type: f5(slab) [ 33.927412] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 33.935257] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.943102] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 33.951033] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.958967] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 33.966898] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 33.974823] page dumped because: kasan: bad access detected [ 33.980475] [ 33.982006] Memory state around the buggy address: [ 33.986868] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.994180] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.001494] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 34.008815] ^ [ 34.014467] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.021780] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.029091] ================================================================== [ 36.021411] ================================================================== [ 36.028733] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 36.036406] Write of size 1 at addr ffff0000953620d0 by task kunit_try_catch/248 [ 36.043907] [ 36.045436] CPU: 0 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.045464] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.045472] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.045484] Call trace: [ 36.045490] show_stack+0x20/0x38 (C) [ 36.045509] dump_stack_lvl+0x8c/0xd0 [ 36.045527] print_report+0x118/0x608 [ 36.045545] kasan_report+0xdc/0x128 [ 36.045563] __asan_report_store1_noabort+0x20/0x30 [ 36.045581] krealloc_less_oob_helper+0xb9c/0xc50 [ 36.045599] krealloc_large_less_oob+0x20/0x38 [ 36.045620] kunit_try_run_case+0x170/0x3f0 [ 36.045639] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.045660] kthread+0x328/0x630 [ 36.045674] ret_from_fork+0x10/0x20 [ 36.045691] [ 36.116497] The buggy address belongs to the physical page: [ 36.122146] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 36.130259] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.138014] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.145069] page_type: f8(unknown) [ 36.148532] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.156375] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.164220] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.172149] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.180078] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 36.188008] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 36.195934] page dumped because: kasan: bad access detected [ 36.201579] [ 36.203107] Memory state around the buggy address: [ 36.207965] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.215280] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.222602] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 36.229922] ^ [ 36.235832] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.243145] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.250465] ================================================================== [ 34.351107] ================================================================== [ 34.358426] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 34.366101] Write of size 1 at addr ffff00008036eeda by task kunit_try_catch/244 [ 34.373595] [ 34.375124] CPU: 6 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 34.375154] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.375162] Hardware name: Thundercomm Dragonboard 845c (DT) [ 34.375172] Call trace: [ 34.375177] show_stack+0x20/0x38 (C) [ 34.375195] dump_stack_lvl+0x8c/0xd0 [ 34.375213] print_report+0x118/0x608 [ 34.375231] kasan_report+0xdc/0x128 [ 34.375247] __asan_report_store1_noabort+0x20/0x30 [ 34.375263] krealloc_less_oob_helper+0xa80/0xc50 [ 34.375280] krealloc_less_oob+0x20/0x38 [ 34.375296] kunit_try_run_case+0x170/0x3f0 [ 34.375312] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.375332] kthread+0x328/0x630 [ 34.375344] ret_from_fork+0x10/0x20 [ 34.375361] [ 34.445554] Allocated by task 244: [ 34.449006] kasan_save_stack+0x3c/0x68 [ 34.452913] kasan_save_track+0x20/0x40 [ 34.456816] kasan_save_alloc_info+0x40/0x58 [ 34.461150] __kasan_krealloc+0x118/0x178 [ 34.465227] krealloc_noprof+0x128/0x360 [ 34.469215] krealloc_less_oob_helper+0x168/0xc50 [ 34.473986] krealloc_less_oob+0x20/0x38 [ 34.477975] kunit_try_run_case+0x170/0x3f0 [ 34.482224] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.487785] kthread+0x328/0x630 [ 34.491071] ret_from_fork+0x10/0x20 [ 34.494702] [ 34.496231] The buggy address belongs to the object at ffff00008036ee00 [ 34.496231] which belongs to the cache kmalloc-256 of size 256 [ 34.508885] The buggy address is located 17 bytes to the right of [ 34.508885] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 34.522063] [ 34.523594] The buggy address belongs to the physical page: [ 34.529235] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 34.537337] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.545090] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.552138] page_type: f5(slab) [ 34.555337] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.563178] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.571017] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.578944] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.586869] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 34.594793] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 34.602716] page dumped because: kasan: bad access detected [ 34.608352] [ 34.609874] Memory state around the buggy address: [ 34.614725] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.622029] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.629333] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 34.636637] ^ [ 34.642803] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.650116] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.657418] ================================================================== [ 36.495194] ================================================================== [ 36.502511] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 36.510180] Write of size 1 at addr ffff0000953620ea by task kunit_try_catch/248 [ 36.517673] [ 36.519208] CPU: 5 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.519236] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.519243] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.519252] Call trace: [ 36.519258] show_stack+0x20/0x38 (C) [ 36.519274] dump_stack_lvl+0x8c/0xd0 [ 36.519291] print_report+0x118/0x608 [ 36.519308] kasan_report+0xdc/0x128 [ 36.519325] __asan_report_store1_noabort+0x20/0x30 [ 36.519340] krealloc_less_oob_helper+0xae4/0xc50 [ 36.519357] krealloc_large_less_oob+0x20/0x38 [ 36.519373] kunit_try_run_case+0x170/0x3f0 [ 36.519389] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.519408] kthread+0x328/0x630 [ 36.519420] ret_from_fork+0x10/0x20 [ 36.519436] [ 36.590199] The buggy address belongs to the physical page: [ 36.595846] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 36.603944] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.611691] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.618740] page_type: f8(unknown) [ 36.622195] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.630032] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.637870] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.645793] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.653717] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 36.661640] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 36.669560] page dumped because: kasan: bad access detected [ 36.675200] [ 36.676729] Memory state around the buggy address: [ 36.681580] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.688894] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.696208] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 36.703521] ^ [ 36.710217] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.717530] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.724841] ================================================================== [ 34.664854] ================================================================== [ 34.672174] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 34.679846] Write of size 1 at addr ffff00008036eeea by task kunit_try_catch/244 [ 34.687330] [ 34.688864] CPU: 6 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 34.688892] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.688899] Hardware name: Thundercomm Dragonboard 845c (DT) [ 34.688908] Call trace: [ 34.688913] show_stack+0x20/0x38 (C) [ 34.688929] dump_stack_lvl+0x8c/0xd0 [ 34.688947] print_report+0x118/0x608 [ 34.688965] kasan_report+0xdc/0x128 [ 34.688982] __asan_report_store1_noabort+0x20/0x30 [ 34.688998] krealloc_less_oob_helper+0xae4/0xc50 [ 34.689017] krealloc_less_oob+0x20/0x38 [ 34.689033] kunit_try_run_case+0x170/0x3f0 [ 34.689050] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.689069] kthread+0x328/0x630 [ 34.689082] ret_from_fork+0x10/0x20 [ 34.689097] [ 34.759333] Allocated by task 244: [ 34.762788] kasan_save_stack+0x3c/0x68 [ 34.766693] kasan_save_track+0x20/0x40 [ 34.770596] kasan_save_alloc_info+0x40/0x58 [ 34.774930] __kasan_krealloc+0x118/0x178 [ 34.779008] krealloc_noprof+0x128/0x360 [ 34.782998] krealloc_less_oob_helper+0x168/0xc50 [ 34.787775] krealloc_less_oob+0x20/0x38 [ 34.791764] kunit_try_run_case+0x170/0x3f0 [ 34.796014] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.801580] kthread+0x328/0x630 [ 34.804861] ret_from_fork+0x10/0x20 [ 34.808490] [ 34.810013] The buggy address belongs to the object at ffff00008036ee00 [ 34.810013] which belongs to the cache kmalloc-256 of size 256 [ 34.822666] The buggy address is located 33 bytes to the right of [ 34.822666] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 34.835849] [ 34.837370] The buggy address belongs to the physical page: [ 34.843012] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 34.851113] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.858864] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.865911] page_type: f5(slab) [ 34.869104] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.876943] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.884782] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.892707] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.900632] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 34.908555] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 34.916476] page dumped because: kasan: bad access detected [ 34.922118] [ 34.923647] Memory state around the buggy address: [ 34.928497] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.935811] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.943119] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 34.950421] ^ [ 34.957114] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.964418] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.971733] ================================================================== [ 36.258667] ================================================================== [ 36.265994] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 36.273664] Write of size 1 at addr ffff0000953620da by task kunit_try_catch/248 [ 36.281157] [ 36.282685] CPU: 5 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.282714] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.282723] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.282734] Call trace: [ 36.282741] show_stack+0x20/0x38 (C) [ 36.282758] dump_stack_lvl+0x8c/0xd0 [ 36.282775] print_report+0x118/0x608 [ 36.282793] kasan_report+0xdc/0x128 [ 36.282809] __asan_report_store1_noabort+0x20/0x30 [ 36.282826] krealloc_less_oob_helper+0xa80/0xc50 [ 36.282844] krealloc_large_less_oob+0x20/0x38 [ 36.282861] kunit_try_run_case+0x170/0x3f0 [ 36.282877] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.282896] kthread+0x328/0x630 [ 36.282908] ret_from_fork+0x10/0x20 [ 36.282924] [ 36.353703] The buggy address belongs to the physical page: [ 36.359351] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 36.367449] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.375197] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.382251] page_type: f8(unknown) [ 36.385712] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.393547] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.401383] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.409305] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.417228] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 36.425150] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 36.433069] page dumped because: kasan: bad access detected [ 36.438714] [ 36.440236] Memory state around the buggy address: [ 36.445090] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.452402] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.459715] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 36.467025] ^ [ 36.473196] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.480508] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.487818] ================================================================== [ 36.732248] ================================================================== [ 36.739564] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 36.747234] Write of size 1 at addr ffff0000953620eb by task kunit_try_catch/248 [ 36.754727] [ 36.756260] CPU: 5 UID: 0 PID: 248 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 36.756287] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.756294] Hardware name: Thundercomm Dragonboard 845c (DT) [ 36.756303] Call trace: [ 36.756308] show_stack+0x20/0x38 (C) [ 36.756324] dump_stack_lvl+0x8c/0xd0 [ 36.756341] print_report+0x118/0x608 [ 36.756360] kasan_report+0xdc/0x128 [ 36.756377] __asan_report_store1_noabort+0x20/0x30 [ 36.756392] krealloc_less_oob_helper+0xa58/0xc50 [ 36.756408] krealloc_large_less_oob+0x20/0x38 [ 36.756425] kunit_try_run_case+0x170/0x3f0 [ 36.756441] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.756461] kthread+0x328/0x630 [ 36.756473] ret_from_fork+0x10/0x20 [ 36.756490] [ 36.827249] The buggy address belongs to the physical page: [ 36.832888] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115360 [ 36.840986] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.848734] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 36.855779] page_type: f8(unknown) [ 36.859237] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.867076] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.874912] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 36.882835] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 36.890758] head: 0bfffe0000000002 fffffdffc254d801 00000000ffffffff 00000000ffffffff [ 36.898681] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 36.906601] page dumped because: kasan: bad access detected [ 36.912238] [ 36.913760] Memory state around the buggy address: [ 36.918609] ffff000095361f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.925923] ffff000095362000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 36.933238] >ffff000095362080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 36.940549] ^ [ 36.947245] ffff000095362100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.954550] ffff000095362180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 36.961861] ================================================================== [ 34.979515] ================================================================== [ 34.986832] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 34.994505] Write of size 1 at addr ffff00008036eeeb by task kunit_try_catch/244 [ 35.001999] [ 35.003535] CPU: 4 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 35.003566] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.003574] Hardware name: Thundercomm Dragonboard 845c (DT) [ 35.003585] Call trace: [ 35.003590] show_stack+0x20/0x38 (C) [ 35.003608] dump_stack_lvl+0x8c/0xd0 [ 35.003625] print_report+0x118/0x608 [ 35.003643] kasan_report+0xdc/0x128 [ 35.003660] __asan_report_store1_noabort+0x20/0x30 [ 35.003677] krealloc_less_oob_helper+0xa58/0xc50 [ 35.003695] krealloc_less_oob+0x20/0x38 [ 35.003710] kunit_try_run_case+0x170/0x3f0 [ 35.003727] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.003747] kthread+0x328/0x630 [ 35.003759] ret_from_fork+0x10/0x20 [ 35.003775] [ 35.073982] Allocated by task 244: [ 35.077437] kasan_save_stack+0x3c/0x68 [ 35.081332] kasan_save_track+0x20/0x40 [ 35.085238] kasan_save_alloc_info+0x40/0x58 [ 35.089574] __kasan_krealloc+0x118/0x178 [ 35.093652] krealloc_noprof+0x128/0x360 [ 35.097642] krealloc_less_oob_helper+0x168/0xc50 [ 35.102413] krealloc_less_oob+0x20/0x38 [ 35.106404] kunit_try_run_case+0x170/0x3f0 [ 35.110655] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.116217] kthread+0x328/0x630 [ 35.119499] ret_from_fork+0x10/0x20 [ 35.123132] [ 35.124662] The buggy address belongs to the object at ffff00008036ee00 [ 35.124662] which belongs to the cache kmalloc-256 of size 256 [ 35.137318] The buggy address is located 34 bytes to the right of [ 35.137318] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 35.150498] [ 35.152029] The buggy address belongs to the physical page: [ 35.157673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 35.165775] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 35.173527] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 35.180576] page_type: f5(slab) [ 35.183773] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 35.191614] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 35.199455] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 35.207382] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 35.215309] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 35.223235] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 35.231155] page dumped because: kasan: bad access detected [ 35.236795] [ 35.238316] Memory state around the buggy address: [ 35.243167] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.250474] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.257782] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 35.265086] ^ [ 35.271781] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.279089] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.286393] ================================================================== [ 34.036575] ================================================================== [ 34.043891] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 34.051568] Write of size 1 at addr ffff00008036eed0 by task kunit_try_catch/244 [ 34.059068] [ 34.060604] CPU: 0 UID: 0 PID: 244 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 34.060632] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.060641] Hardware name: Thundercomm Dragonboard 845c (DT) [ 34.060652] Call trace: [ 34.060660] show_stack+0x20/0x38 (C) [ 34.060678] dump_stack_lvl+0x8c/0xd0 [ 34.060697] print_report+0x118/0x608 [ 34.060716] kasan_report+0xdc/0x128 [ 34.060733] __asan_report_store1_noabort+0x20/0x30 [ 34.060752] krealloc_less_oob_helper+0xb9c/0xc50 [ 34.060770] krealloc_less_oob+0x20/0x38 [ 34.060788] kunit_try_run_case+0x170/0x3f0 [ 34.060808] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.060830] kthread+0x328/0x630 [ 34.060844] ret_from_fork+0x10/0x20 [ 34.060863] [ 34.131151] Allocated by task 244: [ 34.134612] kasan_save_stack+0x3c/0x68 [ 34.138522] kasan_save_track+0x20/0x40 [ 34.142431] kasan_save_alloc_info+0x40/0x58 [ 34.146771] __kasan_krealloc+0x118/0x178 [ 34.150854] krealloc_noprof+0x128/0x360 [ 34.154851] krealloc_less_oob_helper+0x168/0xc50 [ 34.159633] krealloc_less_oob+0x20/0x38 [ 34.163628] kunit_try_run_case+0x170/0x3f0 [ 34.167879] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.173448] kthread+0x328/0x630 [ 34.176740] ret_from_fork+0x10/0x20 [ 34.180379] [ 34.181908] The buggy address belongs to the object at ffff00008036ee00 [ 34.181908] which belongs to the cache kmalloc-256 of size 256 [ 34.194571] The buggy address is located 7 bytes to the right of [ 34.194571] allocated 201-byte region [ffff00008036ee00, ffff00008036eec9) [ 34.207667] [ 34.209204] The buggy address belongs to the physical page: [ 34.214853] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 34.222965] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 34.230719] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 34.237775] page_type: f5(slab) [ 34.240979] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.248824] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.256669] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 34.264599] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 34.272529] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 34.280460] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 34.288386] page dumped because: kasan: bad access detected [ 34.294037] [ 34.295564] Memory state around the buggy address: [ 34.300421] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.307738] ffff00008036ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 34.315053] >ffff00008036ee80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 34.322362] ^ [ 34.328278] ffff00008036ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.335595] ffff00008036ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.342907] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-krealloc_more_oob_helper
[ 35.297829] ================================================================== [ 35.309048] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x60c/0x678 [ 35.316722] Write of size 1 at addr ffff00009535e0eb by task kunit_try_catch/246 [ 35.324220] [ 35.325752] CPU: 0 UID: 0 PID: 246 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 35.325779] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.325787] Hardware name: Thundercomm Dragonboard 845c (DT) [ 35.325796] Call trace: [ 35.325803] show_stack+0x20/0x38 (C) [ 35.325821] dump_stack_lvl+0x8c/0xd0 [ 35.325839] print_report+0x118/0x608 [ 35.325858] kasan_report+0xdc/0x128 [ 35.325877] __asan_report_store1_noabort+0x20/0x30 [ 35.325894] krealloc_more_oob_helper+0x60c/0x678 [ 35.325913] krealloc_large_more_oob+0x20/0x38 [ 35.325931] kunit_try_run_case+0x170/0x3f0 [ 35.325950] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.325970] kthread+0x328/0x630 [ 35.325985] ret_from_fork+0x10/0x20 [ 35.326004] [ 35.396813] The buggy address belongs to the physical page: [ 35.402461] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11535c [ 35.410574] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 35.418329] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 35.425383] page_type: f8(unknown) [ 35.428846] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 35.436689] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 35.444535] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 35.452464] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 35.460394] head: 0bfffe0000000002 fffffdffc254d701 00000000ffffffff 00000000ffffffff [ 35.468324] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 35.476248] page dumped because: kasan: bad access detected [ 35.481896] [ 35.483425] Memory state around the buggy address: [ 35.488291] ffff00009535df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.495609] ffff00009535e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.502931] >ffff00009535e080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fe fe [ 35.510248] ^ [ 35.516953] ffff00009535e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.524275] ffff00009535e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.531592] ================================================================== [ 35.539044] ================================================================== [ 35.546369] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5c0/0x678 [ 35.554042] Write of size 1 at addr ffff00009535e0f0 by task kunit_try_catch/246 [ 35.561538] [ 35.563070] CPU: 0 UID: 0 PID: 246 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 35.563099] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.563107] Hardware name: Thundercomm Dragonboard 845c (DT) [ 35.563119] Call trace: [ 35.563125] show_stack+0x20/0x38 (C) [ 35.563143] dump_stack_lvl+0x8c/0xd0 [ 35.563162] print_report+0x118/0x608 [ 35.563181] kasan_report+0xdc/0x128 [ 35.563200] __asan_report_store1_noabort+0x20/0x30 [ 35.563217] krealloc_more_oob_helper+0x5c0/0x678 [ 35.563236] krealloc_large_more_oob+0x20/0x38 [ 35.563255] kunit_try_run_case+0x170/0x3f0 [ 35.563273] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.563295] kthread+0x328/0x630 [ 35.563310] ret_from_fork+0x10/0x20 [ 35.563327] [ 35.634141] The buggy address belongs to the physical page: [ 35.639788] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11535c [ 35.647898] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 35.655653] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 35.662707] page_type: f8(unknown) [ 35.666170] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 35.674014] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 35.681858] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 35.689787] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 35.697716] head: 0bfffe0000000002 fffffdffc254d701 00000000ffffffff 00000000ffffffff [ 35.705645] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 35.713569] page dumped because: kasan: bad access detected [ 35.719218] [ 35.720750] Memory state around the buggy address: [ 35.725612] ffff00009535df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.732934] ffff00009535e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.740255] >ffff00009535e080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fe fe [ 35.747570] ^ [ 35.754532] ffff00009535e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.761852] ffff00009535e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.769173] ================================================================== [ 33.082823] ================================================================== [ 33.093771] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x60c/0x678 [ 33.101448] Write of size 1 at addr ffff00008036eceb by task kunit_try_catch/242 [ 33.108947] [ 33.110481] CPU: 0 UID: 0 PID: 242 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 33.110510] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.110519] Hardware name: Thundercomm Dragonboard 845c (DT) [ 33.110531] Call trace: [ 33.110538] show_stack+0x20/0x38 (C) [ 33.110556] dump_stack_lvl+0x8c/0xd0 [ 33.110576] print_report+0x118/0x608 [ 33.110595] kasan_report+0xdc/0x128 [ 33.110614] __asan_report_store1_noabort+0x20/0x30 [ 33.110632] krealloc_more_oob_helper+0x60c/0x678 [ 33.110651] krealloc_more_oob+0x20/0x38 [ 33.110668] kunit_try_run_case+0x170/0x3f0 [ 33.110688] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.110711] kthread+0x328/0x630 [ 33.110727] ret_from_fork+0x10/0x20 [ 33.110745] [ 33.181020] Allocated by task 242: [ 33.184488] kasan_save_stack+0x3c/0x68 [ 33.188394] kasan_save_track+0x20/0x40 [ 33.192298] kasan_save_alloc_info+0x40/0x58 [ 33.196643] __kasan_krealloc+0x118/0x178 [ 33.200720] krealloc_noprof+0x128/0x360 [ 33.204713] krealloc_more_oob_helper+0x168/0x678 [ 33.209492] krealloc_more_oob+0x20/0x38 [ 33.213484] kunit_try_run_case+0x170/0x3f0 [ 33.217743] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.223312] kthread+0x328/0x630 [ 33.226598] ret_from_fork+0x10/0x20 [ 33.230242] [ 33.231772] The buggy address belongs to the object at ffff00008036ec00 [ 33.231772] which belongs to the cache kmalloc-256 of size 256 [ 33.244434] The buggy address is located 0 bytes to the right of [ 33.244434] allocated 235-byte region [ffff00008036ec00, ffff00008036eceb) [ 33.257539] [ 33.259070] The buggy address belongs to the physical page: [ 33.264716] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 33.272821] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.280578] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 33.287636] page_type: f5(slab) [ 33.290837] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 33.298683] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.306529] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 33.314463] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.322395] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 33.330328] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 33.338255] page dumped because: kasan: bad access detected [ 33.343899] [ 33.345428] Memory state around the buggy address: [ 33.350286] ffff00008036eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.357600] ffff00008036ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.364915] >ffff00008036ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc [ 33.372227] ^ [ 33.378932] ffff00008036ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.386246] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.393557] ================================================================== [ 33.400951] ================================================================== [ 33.408275] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5c0/0x678 [ 33.415946] Write of size 1 at addr ffff00008036ecf0 by task kunit_try_catch/242 [ 33.423439] [ 33.424977] CPU: 0 UID: 0 PID: 242 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 33.425005] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.425014] Hardware name: Thundercomm Dragonboard 845c (DT) [ 33.425024] Call trace: [ 33.425031] show_stack+0x20/0x38 (C) [ 33.425050] dump_stack_lvl+0x8c/0xd0 [ 33.425069] print_report+0x118/0x608 [ 33.425090] kasan_report+0xdc/0x128 [ 33.425109] __asan_report_store1_noabort+0x20/0x30 [ 33.425127] krealloc_more_oob_helper+0x5c0/0x678 [ 33.425146] krealloc_more_oob+0x20/0x38 [ 33.425162] kunit_try_run_case+0x170/0x3f0 [ 33.425181] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.425201] kthread+0x328/0x630 [ 33.425216] ret_from_fork+0x10/0x20 [ 33.425234] [ 33.495515] Allocated by task 242: [ 33.498975] kasan_save_stack+0x3c/0x68 [ 33.502883] kasan_save_track+0x20/0x40 [ 33.506790] kasan_save_alloc_info+0x40/0x58 [ 33.511126] __kasan_krealloc+0x118/0x178 [ 33.515206] krealloc_noprof+0x128/0x360 [ 33.519202] krealloc_more_oob_helper+0x168/0x678 [ 33.523981] krealloc_more_oob+0x20/0x38 [ 33.527974] kunit_try_run_case+0x170/0x3f0 [ 33.532223] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.537793] kthread+0x328/0x630 [ 33.541083] ret_from_fork+0x10/0x20 [ 33.544720] [ 33.546250] The buggy address belongs to the object at ffff00008036ec00 [ 33.546250] which belongs to the cache kmalloc-256 of size 256 [ 33.558913] The buggy address is located 5 bytes to the right of [ 33.558913] allocated 235-byte region [ffff00008036ec00, ffff00008036eceb) [ 33.572016] [ 33.573542] The buggy address belongs to the physical page: [ 33.579189] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10036c [ 33.587298] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.595053] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 33.602105] page_type: f5(slab) [ 33.605309] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 33.613152] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.620995] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000 [ 33.628925] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 33.636853] head: 0bfffe0000000002 fffffdffc200db01 00000000ffffffff 00000000ffffffff [ 33.644781] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 33.652705] page dumped because: kasan: bad access detected [ 33.658354] [ 33.659889] Memory state around the buggy address: [ 33.664746] ffff00008036eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.672070] ffff00008036ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.679383] >ffff00008036ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc [ 33.686704] ^ [ 33.693668] ffff00008036ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.700988] ffff00008036ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.708307] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-use-after-free-in-kmalloc_large_uaf
[ 32.444502] ================================================================== [ 32.456144] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8 [ 32.462855] Read of size 1 at addr ffff0000962c8000 by task kunit_try_catch/234 [ 32.470262] [ 32.471798] CPU: 6 UID: 0 PID: 234 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 32.471827] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.471835] Hardware name: Thundercomm Dragonboard 845c (DT) [ 32.471848] Call trace: [ 32.471854] show_stack+0x20/0x38 (C) [ 32.471871] dump_stack_lvl+0x8c/0xd0 [ 32.471890] print_report+0x118/0x608 [ 32.471908] kasan_report+0xdc/0x128 [ 32.471926] __asan_report_load1_noabort+0x20/0x30 [ 32.471942] kmalloc_large_uaf+0x2cc/0x2f8 [ 32.471957] kunit_try_run_case+0x170/0x3f0 [ 32.471976] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.471996] kthread+0x328/0x630 [ 32.472009] ret_from_fork+0x10/0x20 [ 32.472026] [ 32.537574] The buggy address belongs to the physical page: [ 32.543216] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1162c8 [ 32.551316] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.557932] raw: 0bfffe0000000000 fffffdffc258b308 ffff0000dae6ec40 0000000000000000 [ 32.565773] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 32.573609] page dumped because: kasan: bad access detected [ 32.579249] [ 32.580779] Memory state around the buggy address: [ 32.585631] ffff0000962c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.592936] ffff0000962c7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.600249] >ffff0000962c8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.607552] ^ [ 32.610836] ffff0000962c8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.618150] ffff0000962c8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 32.625464] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_large_oob_right
[ 32.205463] ================================================================== [ 32.216938] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x278/0x2b8 [ 32.224522] Write of size 1 at addr ffff0000966fe00a by task kunit_try_catch/232 [ 32.232021] [ 32.233553] CPU: 1 UID: 0 PID: 232 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 32.233582] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.233590] Hardware name: Thundercomm Dragonboard 845c (DT) [ 32.233602] Call trace: [ 32.233610] show_stack+0x20/0x38 (C) [ 32.233629] dump_stack_lvl+0x8c/0xd0 [ 32.233648] print_report+0x118/0x608 [ 32.233667] kasan_report+0xdc/0x128 [ 32.233685] __asan_report_store1_noabort+0x20/0x30 [ 32.233703] kmalloc_large_oob_right+0x278/0x2b8 [ 32.233720] kunit_try_run_case+0x170/0x3f0 [ 32.233739] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.233761] kthread+0x328/0x630 [ 32.233775] ret_from_fork+0x10/0x20 [ 32.233792] [ 32.300037] The buggy address belongs to the physical page: [ 32.305683] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1166fc [ 32.313792] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.321544] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.328598] page_type: f8(unknown) [ 32.332065] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.339909] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.347751] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.355682] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.363610] head: 0bfffe0000000002 fffffdffc259bf01 00000000ffffffff 00000000ffffffff [ 32.371547] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 32.379471] page dumped because: kasan: bad access detected [ 32.385121] [ 32.386653] Memory state around the buggy address: [ 32.391514] ffff0000966fdf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.398832] ffff0000966fdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.406152] >ffff0000966fe000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 32.413473] ^ [ 32.417016] ffff0000966fe080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 32.424339] ffff0000966fe100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 32.431651] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_big_oob_right
[ 31.894142] ================================================================== [ 31.906757] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 31.914172] Write of size 1 at addr ffff000096639f00 by task kunit_try_catch/230 [ 31.921668] [ 31.923200] CPU: 0 UID: 0 PID: 230 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 31.923228] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.923236] Hardware name: Thundercomm Dragonboard 845c (DT) [ 31.923249] Call trace: [ 31.923256] show_stack+0x20/0x38 (C) [ 31.923274] dump_stack_lvl+0x8c/0xd0 [ 31.923294] print_report+0x118/0x608 [ 31.923312] kasan_report+0xdc/0x128 [ 31.923331] __asan_report_store1_noabort+0x20/0x30 [ 31.923350] kmalloc_big_oob_right+0x2a4/0x2f0 [ 31.923368] kunit_try_run_case+0x170/0x3f0 [ 31.923387] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.923409] kthread+0x328/0x630 [ 31.923424] ret_from_fork+0x10/0x20 [ 31.923442] [ 31.989486] Allocated by task 230: [ 31.992945] kasan_save_stack+0x3c/0x68 [ 31.996855] kasan_save_track+0x20/0x40 [ 32.000763] kasan_save_alloc_info+0x40/0x58 [ 32.005101] __kasan_kmalloc+0xd4/0xd8 [ 32.008923] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.013534] kmalloc_big_oob_right+0xb8/0x2f0 [ 32.017959] kunit_try_run_case+0x170/0x3f0 [ 32.022212] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.027782] kthread+0x328/0x630 [ 32.031075] ret_from_fork+0x10/0x20 [ 32.034712] [ 32.036247] The buggy address belongs to the object at ffff000096638000 [ 32.036247] which belongs to the cache kmalloc-8k of size 8192 [ 32.048909] The buggy address is located 0 bytes to the right of [ 32.048909] allocated 7936-byte region [ffff000096638000, ffff000096639f00) [ 32.062094] [ 32.063623] The buggy address belongs to the physical page: [ 32.069277] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116638 [ 32.077389] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.085144] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.092198] page_type: f5(slab) [ 32.095398] raw: 0bfffe0000000040 ffff000080003180 dead000000000122 0000000000000000 [ 32.103243] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 32.111088] head: 0bfffe0000000040 ffff000080003180 dead000000000122 0000000000000000 [ 32.119018] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 32.126949] head: 0bfffe0000000003 fffffdffc2598e01 00000000ffffffff 00000000ffffffff [ 32.134879] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 32.142804] page dumped because: kasan: bad access detected [ 32.148458] [ 32.149987] Memory state around the buggy address: [ 32.154849] ffff000096639e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.162172] ffff000096639e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.169484] >ffff000096639f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.176805] ^ [ 32.180093] ffff000096639f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.187410] ffff00009663a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.194730] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_track_caller_oob_right
[ 31.413365] ================================================================== [ 31.424924] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488 [ 31.433119] Write of size 1 at addr ffff00009462c678 by task kunit_try_catch/228 [ 31.440610] [ 31.442139] CPU: 7 UID: 0 PID: 228 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 31.442170] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.442178] Hardware name: Thundercomm Dragonboard 845c (DT) [ 31.442190] Call trace: [ 31.442196] show_stack+0x20/0x38 (C) [ 31.442214] dump_stack_lvl+0x8c/0xd0 [ 31.442233] print_report+0x118/0x608 [ 31.442251] kasan_report+0xdc/0x128 [ 31.442267] __asan_report_store1_noabort+0x20/0x30 [ 31.442284] kmalloc_track_caller_oob_right+0x40c/0x488 [ 31.442303] kunit_try_run_case+0x170/0x3f0 [ 31.442321] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.442340] kthread+0x328/0x630 [ 31.442353] ret_from_fork+0x10/0x20 [ 31.442372] [ 31.509173] Allocated by task 228: [ 31.512625] kasan_save_stack+0x3c/0x68 [ 31.516531] kasan_save_track+0x20/0x40 [ 31.520433] kasan_save_alloc_info+0x40/0x58 [ 31.524766] __kasan_kmalloc+0xd4/0xd8 [ 31.528579] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 31.534228] kmalloc_track_caller_oob_right+0xa8/0x488 [ 31.539441] kunit_try_run_case+0x170/0x3f0 [ 31.543686] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.549248] kthread+0x328/0x630 [ 31.552527] ret_from_fork+0x10/0x20 [ 31.556165] [ 31.557687] The buggy address belongs to the object at ffff00009462c600 [ 31.557687] which belongs to the cache kmalloc-128 of size 128 [ 31.570336] The buggy address is located 0 bytes to the right of [ 31.570336] allocated 120-byte region [ffff00009462c600, ffff00009462c678) [ 31.583428] [ 31.584958] The buggy address belongs to the physical page: [ 31.590602] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11462c [ 31.598699] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.606447] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.613493] page_type: f5(slab) [ 31.616687] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 31.624525] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 31.632360] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 31.640282] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 31.648206] head: 0bfffe0000000001 fffffdffc2518b01 00000000ffffffff 00000000ffffffff [ 31.656128] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 31.664047] page dumped because: kasan: bad access detected [ 31.669687] [ 31.671208] Memory state around the buggy address: [ 31.676064] ffff00009462c500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.683368] ffff00009462c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.690681] >ffff00009462c600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 31.697992] ^ [ 31.705214] ffff00009462c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.712525] ffff00009462c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.719835] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_node_oob_right
[ 31.102112] ================================================================== [ 31.113158] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 31.120661] Read of size 1 at addr ffff0000954d9000 by task kunit_try_catch/226 [ 31.128074] [ 31.129605] CPU: 1 UID: 0 PID: 226 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 31.129636] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.129644] Hardware name: Thundercomm Dragonboard 845c (DT) [ 31.129657] Call trace: [ 31.129664] show_stack+0x20/0x38 (C) [ 31.129682] dump_stack_lvl+0x8c/0xd0 [ 31.129701] print_report+0x118/0x608 [ 31.129719] kasan_report+0xdc/0x128 [ 31.129737] __asan_report_load1_noabort+0x20/0x30 [ 31.129754] kmalloc_node_oob_right+0x2f4/0x330 [ 31.129773] kunit_try_run_case+0x170/0x3f0 [ 31.129793] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.129815] kthread+0x328/0x630 [ 31.129829] ret_from_fork+0x10/0x20 [ 31.129847] [ 31.195900] Allocated by task 226: [ 31.199361] kasan_save_stack+0x3c/0x68 [ 31.203271] kasan_save_track+0x20/0x40 [ 31.207180] kasan_save_alloc_info+0x40/0x58 [ 31.211515] __kasan_kmalloc+0xd4/0xd8 [ 31.215335] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 31.220375] kmalloc_node_oob_right+0xbc/0x330 [ 31.224899] kunit_try_run_case+0x170/0x3f0 [ 31.229152] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.234724] kthread+0x328/0x630 [ 31.238014] ret_from_fork+0x10/0x20 [ 31.241651] [ 31.243180] The buggy address belongs to the object at ffff0000954d8000 [ 31.243180] which belongs to the cache kmalloc-4k of size 4096 [ 31.255840] The buggy address is located 0 bytes to the right of [ 31.255840] allocated 4096-byte region [ffff0000954d8000, ffff0000954d9000) [ 31.269029] [ 31.270560] The buggy address belongs to the physical page: [ 31.276211] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1154d8 [ 31.284322] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.292079] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.299138] page_type: f5(slab) [ 31.302343] raw: 0bfffe0000000040 ffff000080003040 dead000000000122 0000000000000000 [ 31.310186] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 31.318031] head: 0bfffe0000000040 ffff000080003040 dead000000000122 0000000000000000 [ 31.325960] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 31.333888] head: 0bfffe0000000003 fffffdffc2553601 00000000ffffffff 00000000ffffffff [ 31.341820] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 31.349747] page dumped because: kasan: bad access detected [ 31.355393] [ 31.356928] Memory state around the buggy address: [ 31.361791] ffff0000954d8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.369112] ffff0000954d8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.376426] >ffff0000954d9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.383738] ^ [ 31.387027] ffff0000954d9080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.394350] ffff0000954d9100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.401670] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_oob_left
[ 30.675989] ================================================================== [ 30.687111] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 30.694083] Read of size 1 at addr ffff0000820e85ff by task kunit_try_catch/224 [ 30.701493] [ 30.703028] CPU: 0 UID: 0 PID: 224 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 30.703059] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.703067] Hardware name: Thundercomm Dragonboard 845c (DT) [ 30.703080] Call trace: [ 30.703086] show_stack+0x20/0x38 (C) [ 30.703105] dump_stack_lvl+0x8c/0xd0 [ 30.703126] print_report+0x118/0x608 [ 30.703145] kasan_report+0xdc/0x128 [ 30.703164] __asan_report_load1_noabort+0x20/0x30 [ 30.703181] kmalloc_oob_left+0x2ec/0x320 [ 30.703199] kunit_try_run_case+0x170/0x3f0 [ 30.703217] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.703238] kthread+0x328/0x630 [ 30.703253] ret_from_fork+0x10/0x20 [ 30.703271] [ 30.768790] Allocated by task 67: [ 30.772163] kasan_save_stack+0x3c/0x68 [ 30.776074] kasan_save_track+0x20/0x40 [ 30.779984] kasan_save_alloc_info+0x40/0x58 [ 30.784320] __kasan_kmalloc+0xd4/0xd8 [ 30.788142] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 30.793802] kvasprintf+0xe0/0x180 [ 30.797269] kasprintf+0xd0/0x110 [ 30.800646] of_icc_get_by_index+0x3cc/0x558 [ 30.804991] dev_pm_opp_of_find_icc_paths+0x1b8/0x460 [ 30.810123] qcom_cpufreq_hw_driver_probe+0x12c/0x4a8 [ 30.815258] platform_probe+0xcc/0x198 [ 30.819072] really_probe+0x188/0x7f0 [ 30.822796] __driver_probe_device+0x164/0x378 [ 30.827316] driver_probe_device+0x64/0x180 [ 30.831569] __device_attach_driver+0x174/0x280 [ 30.836174] bus_for_each_drv+0x118/0x1b0 [ 30.840260] __device_attach+0x174/0x378 [ 30.844253] device_initial_probe+0x1c/0x30 [ 30.848505] bus_probe_device+0x12c/0x170 [ 30.852589] deferred_probe_work_func+0x140/0x208 [ 30.857371] process_one_work+0x530/0xf98 [ 30.861455] worker_thread+0x618/0xf38 [ 30.865275] kthread+0x328/0x630 [ 30.868565] ret_from_fork+0x10/0x20 [ 30.872202] [ 30.873731] Freed by task 67: [ 30.876759] kasan_save_stack+0x3c/0x68 [ 30.880668] kasan_save_track+0x20/0x40 [ 30.884578] kasan_save_free_info+0x4c/0x78 [ 30.888829] __kasan_slab_free+0x6c/0x98 [ 30.892826] kfree+0x214/0x3c8 [ 30.895948] icc_put+0x19c/0x340 [ 30.899243] dev_pm_opp_of_find_icc_paths+0x234/0x460 [ 30.904379] qcom_cpufreq_hw_driver_probe+0x12c/0x4a8 [ 30.909511] platform_probe+0xcc/0x198 [ 30.913334] really_probe+0x188/0x7f0 [ 30.917066] __driver_probe_device+0x164/0x378 [ 30.921578] driver_probe_device+0x64/0x180 [ 30.925830] __device_attach_driver+0x174/0x280 [ 30.930429] bus_for_each_drv+0x118/0x1b0 [ 30.934509] __device_attach+0x174/0x378 [ 30.938502] device_initial_probe+0x1c/0x30 [ 30.942755] bus_probe_device+0x12c/0x170 [ 30.946839] deferred_probe_work_func+0x140/0x208 [ 30.951619] process_one_work+0x530/0xf98 [ 30.955699] worker_thread+0x618/0xf38 [ 30.959519] kthread+0x328/0x630 [ 30.962812] ret_from_fork+0x10/0x20 [ 30.966449] [ 30.967985] The buggy address belongs to the object at ffff0000820e85e0 [ 30.967985] which belongs to the cache kmalloc-16 of size 16 [ 30.980473] The buggy address is located 15 bytes to the right of [ 30.980473] allocated 16-byte region [ffff0000820e85e0, ffff0000820e85f0) [ 30.993571] [ 30.995101] The buggy address belongs to the physical page: [ 31.000745] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1020e8 [ 31.008858] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.015475] page_type: f5(slab) [ 31.018682] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000 [ 31.026527] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 31.034369] page dumped because: kasan: bad access detected [ 31.040013] [ 31.041541] Memory state around the buggy address: [ 31.046403] ffff0000820e8480: fa fb fc fc fa fb fc fc 00 04 fc fc fa fb fc fc [ 31.053715] ffff0000820e8500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 31.061029] >ffff0000820e8580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 31.068350] ^ [ 31.075578] ffff0000820e8600: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.082894] ffff0000820e8680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.090215] ==================================================================
Failure - log-parser-boot - kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_oob_right
[ 29.756231] ================================================================== [ 29.763570] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x5a4/0x660 [ 29.770647] Write of size 1 at addr ffff000080dbc173 by task kunit_try_catch/222 [ 29.778144] [ 29.779682] CPU: 1 UID: 0 PID: 222 Comm: kunit_try_catch Tainted: G N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 29.779713] Tainted: [N]=TEST [ 29.779720] Hardware name: Thundercomm Dragonboard 845c (DT) [ 29.779731] Call trace: [ 29.779739] show_stack+0x20/0x38 (C) [ 29.779762] dump_stack_lvl+0x8c/0xd0 [ 29.779784] print_report+0x118/0x608 [ 29.779806] kasan_report+0xdc/0x128 [ 29.779823] __asan_report_store1_noabort+0x20/0x30 [ 29.779842] kmalloc_oob_right+0x5a4/0x660 [ 29.779858] kunit_try_run_case+0x170/0x3f0 [ 29.779879] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.779900] kthread+0x328/0x630 [ 29.779916] ret_from_fork+0x10/0x20 [ 29.779937] [ 29.844445] Allocated by task 222: [ 29.847906] kasan_save_stack+0x3c/0x68 [ 29.851817] kasan_save_track+0x20/0x40 [ 29.855724] kasan_save_alloc_info+0x40/0x58 [ 29.860068] __kasan_kmalloc+0xd4/0xd8 [ 29.863890] __kmalloc_cache_noprof+0x16c/0x3c0 [ 29.868499] kmalloc_oob_right+0xb0/0x660 [ 29.872579] kunit_try_run_case+0x170/0x3f0 [ 29.876834] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.882405] kthread+0x328/0x630 [ 29.885696] ret_from_fork+0x10/0x20 [ 29.889339] [ 29.890870] The buggy address belongs to the object at ffff000080dbc100 [ 29.890870] which belongs to the cache kmalloc-128 of size 128 [ 29.903529] The buggy address is located 0 bytes to the right of [ 29.903529] allocated 115-byte region [ffff000080dbc100, ffff000080dbc173) [ 29.916629] [ 29.918161] The buggy address belongs to the physical page: [ 29.923808] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100dbc [ 29.931920] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.939679] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.946742] page_type: f5(slab) [ 29.949950] raw: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 29.957793] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 29.965636] head: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 29.973575] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 29.981513] head: 0bfffe0000000001 fffffdffc2036f01 00000000ffffffff 00000000ffffffff [ 29.989444] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 29.997379] page dumped because: kasan: bad access detected [ 30.003028] [ 30.004560] Memory state around the buggy address: [ 30.009423] ffff000080dbc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.016743] ffff000080dbc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.024065] >ffff000080dbc100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 30.031377] ^ [ 30.038340] ffff000080dbc180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.045661] ffff000080dbc200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.052979] ================================================================== [ 30.371783] ================================================================== [ 30.379093] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x5d0/0x660 [ 30.386139] Read of size 1 at addr ffff000080dbc180 by task kunit_try_catch/222 [ 30.393544] [ 30.395069] CPU: 5 UID: 0 PID: 222 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 30.395096] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.395103] Hardware name: Thundercomm Dragonboard 845c (DT) [ 30.395112] Call trace: [ 30.395118] show_stack+0x20/0x38 (C) [ 30.395134] dump_stack_lvl+0x8c/0xd0 [ 30.395151] print_report+0x118/0x608 [ 30.395168] kasan_report+0xdc/0x128 [ 30.395185] __asan_report_load1_noabort+0x20/0x30 [ 30.395200] kmalloc_oob_right+0x5d0/0x660 [ 30.395215] kunit_try_run_case+0x170/0x3f0 [ 30.395231] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.395251] kthread+0x328/0x630 [ 30.395263] ret_from_fork+0x10/0x20 [ 30.395279] [ 30.460838] Allocated by task 222: [ 30.464290] kasan_save_stack+0x3c/0x68 [ 30.468193] kasan_save_track+0x20/0x40 [ 30.472095] kasan_save_alloc_info+0x40/0x58 [ 30.476426] __kasan_kmalloc+0xd4/0xd8 [ 30.480241] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.484837] kmalloc_oob_right+0xb0/0x660 [ 30.488911] kunit_try_run_case+0x170/0x3f0 [ 30.493157] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.498721] kthread+0x328/0x630 [ 30.502002] ret_from_fork+0x10/0x20 [ 30.505641] [ 30.507163] The buggy address belongs to the object at ffff000080dbc100 [ 30.507163] which belongs to the cache kmalloc-128 of size 128 [ 30.519816] The buggy address is located 13 bytes to the right of [ 30.519816] allocated 115-byte region [ffff000080dbc100, ffff000080dbc173) [ 30.532989] [ 30.534511] The buggy address belongs to the physical page: [ 30.540157] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100dbc [ 30.548253] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.556001] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.563050] page_type: f5(slab) [ 30.566243] raw: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 30.574080] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 30.581916] head: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 30.589838] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 30.597760] head: 0bfffe0000000001 fffffdffc2036f01 00000000ffffffff 00000000ffffffff [ 30.605682] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.613600] page dumped because: kasan: bad access detected [ 30.619240] [ 30.620768] Memory state around the buggy address: [ 30.625618] ffff000080dbc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.632932] ffff000080dbc100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 30.640244] >ffff000080dbc180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.647558] ^ [ 30.650839] ffff000080dbc200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.658149] ffff000080dbc280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.665458] ================================================================== [ 30.066624] ================================================================== [ 30.073954] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x538/0x660 [ 30.081020] Write of size 1 at addr ffff000080dbc178 by task kunit_try_catch/222 [ 30.088514] [ 30.090044] CPU: 5 UID: 0 PID: 222 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 30.090077] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.090084] Hardware name: Thundercomm Dragonboard 845c (DT) [ 30.090097] Call trace: [ 30.090103] show_stack+0x20/0x38 (C) [ 30.090124] dump_stack_lvl+0x8c/0xd0 [ 30.090144] print_report+0x118/0x608 [ 30.090163] kasan_report+0xdc/0x128 [ 30.090180] __asan_report_store1_noabort+0x20/0x30 [ 30.090196] kmalloc_oob_right+0x538/0x660 [ 30.090211] kunit_try_run_case+0x170/0x3f0 [ 30.090229] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.090248] kthread+0x328/0x630 [ 30.090261] ret_from_fork+0x10/0x20 [ 30.090279] [ 30.155946] Allocated by task 222: [ 30.159402] kasan_save_stack+0x3c/0x68 [ 30.163308] kasan_save_track+0x20/0x40 [ 30.167201] kasan_save_alloc_info+0x40/0x58 [ 30.171530] __kasan_kmalloc+0xd4/0xd8 [ 30.175334] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.179928] kmalloc_oob_right+0xb0/0x660 [ 30.184003] kunit_try_run_case+0x170/0x3f0 [ 30.188250] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.193813] kthread+0x328/0x630 [ 30.197094] ret_from_fork+0x10/0x20 [ 30.200723] [ 30.202245] The buggy address belongs to the object at ffff000080dbc100 [ 30.202245] which belongs to the cache kmalloc-128 of size 128 [ 30.214896] The buggy address is located 5 bytes to the right of [ 30.214896] allocated 115-byte region [ffff000080dbc100, ffff000080dbc173) [ 30.227988] [ 30.229511] The buggy address belongs to the physical page: [ 30.235154] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100dbc [ 30.243252] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.251003] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.258050] page_type: f5(slab) [ 30.261249] raw: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 30.269088] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 30.276925] head: 0bfffe0000000040 ffff000080002a00 dead000000000100 dead000000000122 [ 30.284850] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 30.292773] head: 0bfffe0000000001 fffffdffc2036f01 00000000ffffffff 00000000ffffffff [ 30.300696] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 30.308614] page dumped because: kasan: bad access detected [ 30.314255] [ 30.315782] Memory state around the buggy address: [ 30.320633] ffff000080dbc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.327945] ffff000080dbc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.335251] >ffff000080dbc100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 30.342562] ^ [ 30.349785] ffff000080dbc180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.357098] ffff000080dbc200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.364408] ==================================================================
Failure - log-parser-boot - exception-warning-libmathint_log-at-intlog10
------------[ cut here ]------------ [ 125.358157] WARNING: lib/math/int_log.c:120 at intlog10+0x38/0x48, CPU#7: kunit_try_catch/745 [ 125.366807] Modules linked in: [ 125.369931] CPU: 7 UID: 0 PID: 745 Comm: kunit_try_catch Tainted: G B D W N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 125.381200] Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN, [N]=TEST [ 125.387106] Hardware name: Thundercomm Dragonboard 845c (DT) [ 125.392836] pstate: 10400005 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 125.399881] pc : intlog10+0x38/0x48 [ 125.403428] lr : intlog10_test+0xe4/0x200 [ 125.407504] sp : ffff800086587c10 [ 125.410873] x29: ffff800086587c90 x28: 0000000000000000 x27: 0000000000000000 [ 125.418120] x26: 1fffe000127c5ec1 x25: 0000000000000000 x24: ffff800086587ce0 [ 125.425354] x23: ffff800086587d00 x22: 0000000000000000 x21: 1ffff00010cb0f82 [ 125.432588] x20: ffffd817ac3fcb60 x19: ffff8000800a7990 x18: 00000000c745b607 [ 125.439830] x17: 000000040044ffff x16: 005000f4b5503510 x15: 0000000000000000 [ 125.447068] x14: ffff0000808f1440 x13: 1fffe0001b5d1989 x12: ffff7b02f6052389 [ 125.454310] x11: 1ffffb02f6052388 x10: ffff7b02f6052388 x9 : ffffd817a9a3d25c [ 125.461552] x8 : ffffd817b0291c43 x7 : 0000000000000001 x6 : 00000000f1f1f1f1 [ 125.468783] x5 : ffff700010cb0f82 x4 : 1ffff00010014f3b x3 : 1ffffb02f587f96c [ 125.476025] x2 : 1ffffb02f587f96c x1 : 0000000000000003 x0 : 0000000000000000 [ 125.483259] Call trace: [ 125.485757] intlog10+0x38/0x48 (P) [ 125.489306] kunit_try_run_case+0x170/0x3f0 [ 125.493561] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 125.499129] kthread+0x328/0x630 [ 125.502416] ret_from_fork+0x10/0x20 [ 125.506053] ---[ end trace 0000000000000000 ]---
Failure - log-parser-boot - exception-warning-libmathint_log-at-intlog2
------------[ cut here ]------------ [ 125.131394] WARNING: lib/math/int_log.c:63 at intlog2+0xd8/0xf8, CPU#7: kunit_try_catch/727 [ 125.139868] Modules linked in: [ 125.142997] CPU: 7 UID: 0 PID: 727 Comm: kunit_try_catch Tainted: G B D N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 125.154261] Tainted: [B]=BAD_PAGE, [D]=DIE, [N]=TEST [ 125.159295] Hardware name: Thundercomm Dragonboard 845c (DT) [ 125.165025] pstate: 10400005 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 125.172071] pc : intlog2+0xd8/0xf8 [ 125.175530] lr : intlog2_test+0xe4/0x200 [ 125.179519] sp : ffff800086417c10 [ 125.182886] x29: ffff800086417c90 x28: 0000000000000000 x27: 0000000000000000 [ 125.190122] x26: 1fffe000127afae1 x25: 0000000000000000 x24: ffff800086417ce0 [ 125.197364] x23: ffff800086417d00 x22: 0000000000000000 x21: 1ffff00010c82f82 [ 125.204606] x20: ffffd817ac3fca60 x19: ffff8000800a7990 x18: 00000000f8140849 [ 125.211848] x17: 000000040044ffff x16: 005000f4b5503510 x15: 0000000000000000 [ 125.219083] x14: ffff0000808f1440 x13: 1fffe0001b5d1989 x12: ffff7b02f6052389 [ 125.226315] x11: 1ffffb02f6052388 x10: ffff7b02f6052388 x9 : ffffd817a9a3d45c [ 125.233558] x8 : ffffd817b0291c43 x7 : 0000000000000001 x6 : 00000000f1f1f1f1 [ 125.240798] x5 : ffff700010c82f82 x4 : 1ffff00010014f3b x3 : 1ffffb02f587f94c [ 125.248039] x2 : 1ffffb02f587f94c x1 : 0000000000000003 x0 : 0000000000000000 [ 125.255275] Call trace: [ 125.257773] intlog2+0xd8/0xf8 (P) [ 125.261235] kunit_try_run_case+0x170/0x3f0 [ 125.265488] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 125.271055] kthread+0x328/0x630 [ 125.274341] ret_from_fork+0x10/0x20 [ 125.277989] ---[ end trace 0000000000000000 ]---
Failure - lava - job
(no logs available)
Failure - lava - fastboot-boot
(no logs available)
Failure - lava - auto-login-action
(no logs available)
Failure - lava - login-action
(no logs available)
Failure - boot - gcc-13-lkftconfig-kunit
(no logs available)
Failure - log-parser-boot - internal-error-oops-oops-smp
KNOWN ISSUE - LKFT: Dragonboard 845c: Internal error: Oops: ufs_qcom_setup_clocks
[ 123.824337] Internal error: Oops: 0000000096000005 [#1] SMP [ 123.830078] Modules linked in: [ 123.833205] CPU: 4 UID: 0 PID: 618 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 123.844479] Tainted: [B]=BAD_PAGE, [N]=TEST [ 123.848724] Hardware name: Thundercomm Dragonboard 845c (DT) [ 123.854459] pstate: 10400005 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 123.861508] pc : kunit_test_null_dereference+0x70/0x170 [ 123.866827] lr : kunit_generic_run_threadfn_adapter+0x88/0x100 [ 123.872741] sp : ffff800085df7d30 [ 123.876107] x29: ffff800085df7d90 x28: 0000000000000000 x27: 0000000000000000 [ 123.883347] x26: 1fffe0001026ccc1 x25: 0000000000000000 x24: 0000000000000004 [ 123.890582] x23: ffff00008136660c x22: ffffd817a9a29ce8 x21: ffff0000819edb08 [ 123.897819] x20: 1ffff00010bbefa6 x19: ffff8000800a7990 x18: 0000000035f12c14 [ 123.905051] x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000 [ 123.912285] x14: ffff0000808ebcc0 x13: 1fffe0001b5c0989 x12: ffff600012d9c62c [ 123.919519] x11: 1fffe00012d9c62b x10: ffff600012d9c62b x9 : ffffd817a9a21478 [ 123.926754] x8 : ffff800085df7c18 x7 : 0000000000000000 x6 : 0000000041b58ab3 [ 123.933988] x5 : ffff700010bbefa6 x4 : 00000000f1f1f1f1 x3 : 0000000000000003 [ 123.941220] x2 : dfff800000000000 x1 : ffff000096ce2880 x0 : ffff8000800a7990 [ 123.948454] Call trace: [ 123.950945] kunit_test_null_dereference+0x70/0x170 (P) [ 123.956253] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 123.961821] kthread+0x328/0x630 [ 123.965109] ret_from_fork+0x10/0x20 [ 123.968754] Code: b90004a3 d5384101 52800063 aa0003f3 (39c00042) [ 123.974927] ---[ end trace 0000000000000000 ]--- [ 213.321518] Internal error: Oops: 0000000096000005 [#2] SMP [ 213.321532] Modules linked in: aux_bridge drm_display_helper videobuf2_dma_sg bluetooth(+) videobuf2_memops cec i2c_qcom_geni(+) videobuf2_v4l2 qcom_q6v5_mss(+) camcc_sdm845 spi_geni_qcom(+) [ 213.333057] /soc@0/display-subsystem@ae00000/dsi@ae96000: Fixed dependency cycle(s) with /soc@0/geniqup@ac0000/i2c@a88000/hdmi-bridge@3b [ 213.334949] cpu cpu4: EM: created perf domain [ 213.334992] energy_model: updating cpu0 cpu_cap=407 old capacity=611 [ 213.335024] cpu cpu0: EM: OPP:576000 is inefficient [ 213.335042] cpu cpu0: EM: OPP:480000 is inefficient [ 213.336929] videobuf2_common pwrseq_core gpi [ 213.339098] cpu cpu0: EM: OPP:403200 is inefficient [ 213.339120] cpu cpu0: EM: OPP:300000 is inefficient [ 213.511249] typec phy_qcom_qmp_usb qcom_rng coresight_stm stm_core cfg80211 qrtr qcrypto phy_qcom_qmp_pcie ufs_qcom(+) phy_qcom_qmp_ufs rfkill lmh slim_qcom_ngd_ctrl qcom_q6v5_pas(+) slimbus icc_osm_l3 qcom_pil_info display_connector qcom_q6v5 pdr_interface qcom_wdt qcom_pdr_msg qcom_sysmon drm_kms_helper qcom_common icc_bwmon llcc_qcom drm qcom_glink_smem mdt_loader qmi_helpers socinfo backlight rmtfs_mem [ 213.547915] CPU: 1 UID: 0 PID: 3548 Comm: (udev-worker) Tainted: G B D W N 6.16.0-rc3-next-20250626 #1 PREEMPT [ 213.559104] Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN, [N]=TEST [ 213.565015] Hardware name: Thundercomm Dragonboard 845c (DT) [ 213.570752] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 213.577803] pc : ufs_qcom_setup_clocks+0x50/0x270 [ufs_qcom] [ 213.583580] lr : ufshcd_setup_clocks+0xc0/0xd28 [ 213.588202] sp : ffff800084626de0 [ 213.591571] x29: ffff800084626de0 x28: 1fffe0001074b927 x27: ffff000083a5c870 [ 213.598817] x26: ffff000083a5d2a0 x25: 1ffff000108c4df6 x24: ffff000083a5c870 [ 213.606064] x23: ffff000083a5d280 x22: 0000000000000001 x21: ffff000083a5d298 [ 213.613312] x20: 0000000000000000 x19: ffff000083a5c870 x18: ffff000095f5f418 [ 213.620559] x17: 0000000000000000 x16: 0000000000000000 x15: ffffd817a8b95f64 [ 213.627807] x14: ffffd817a8b959dc x13: ffffd817ac1363a4 x12: ffff7b02f6052389 [ 213.635048] x11: 1ffffb02f6052388 x10: ffff7b02f6052388 x9 : ffffd817ab642938 [ 213.642287] x8 : ffffd817b0291c43 x7 : 0000000000000001 x6 : ffff7b02f6052388 [ 213.649532] x5 : ffffd817b0291c40 x4 : 1fffe0001074b925 x3 : 0000000000000000 [ 213.656779] x2 : 0000000000000000 x1 : 0000000000000001 x0 : dfff800000000000 [ 213.664029] Call trace: [ 213.666528] ufs_qcom_setup_clocks+0x50/0x270 [ufs_qcom] (P) [ 213.672292] ufshcd_setup_clocks+0xc0/0xd28 [ 213.676546] ufshcd_init+0x5c0/0x3690 [ 213.680284] ufshcd_pltfrm_init+0x868/0xf10 [ 213.684539] ufs_qcom_probe+0x2c/0x68 [ufs_qcom] [ 213.689246] platform_probe+0xcc/0x198 [ 213.693075] really_probe+0x188/0x7f0 [ 213.696812] __driver_probe_device+0x164/0x378 [ 213.701333] driver_probe_device+0x64/0x180 [ 213.705583] __driver_attach+0x1cc/0x478 [ 213.709575] bus_for_each_dev+0x10c/0x1a0 [ 213.713659] driver_attach+0x44/0x68 [ 213.717305] bus_add_driver+0x23c/0x4e8 [ 213.721212] driver_register+0xf8/0x3d0 [ 213.725117] __platform_driver_register+0x64/0x98 [ 213.729897] ufs_qcom_pltform_init+0x28/0xff8 [ufs_qcom] [ 213.735300] do_one_initcall+0xcc/0x610 [ 213.739211] do_init_module+0x234/0x730 [ 213.743122] load_module+0x4afc/0x5e20 [ 213.746942] init_module_from_file+0xec/0x158 [ 213.751374] __arm64_sys_finit_module+0x434/0x790 [ 213.756154] invoke_syscall+0x74/0x268 [ 213.759974] el0_svc_common.constprop.0+0xb4/0x240 [ 213.764838] do_el0_svc+0x48/0x68 [ 213.768215] el0_svc+0x38/0xb8 [ 213.771340] el0t_64_sync_handler+0x10c/0x138 [ 213.775773] el0t_64_sync+0x198/0x1a0 [ 213.779516] Code: f9405e74 d2d00000 f2fbffe0 d343fe83 (38e06860) [ 213.785698] ---[ end trace 0000000000000000 ]---