Date
July 2, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.583586] ================================================================== [ 30.584032] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x278/0x2b8 [ 30.584252] Write of size 1 at addr fff00000c99ce00a by task kunit_try_catch/179 [ 30.584354] [ 30.584413] CPU: 0 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT [ 30.584945] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.584982] Hardware name: linux,dummy-virt (DT) [ 30.585144] Call trace: [ 30.585212] show_stack+0x20/0x38 (C) [ 30.585400] dump_stack_lvl+0x8c/0xd0 [ 30.585570] print_report+0x118/0x608 [ 30.585647] kasan_report+0xdc/0x128 [ 30.585704] __asan_report_store1_noabort+0x20/0x30 [ 30.585996] kmalloc_large_oob_right+0x278/0x2b8 [ 30.586398] kunit_try_run_case+0x170/0x3f0 [ 30.586561] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.586684] kthread+0x328/0x630 [ 30.586741] ret_from_fork+0x10/0x20 [ 30.586953] [ 30.587022] The buggy address belongs to the physical page: [ 30.587279] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1099cc [ 30.587477] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.587658] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.587769] page_type: f8(unknown) [ 30.587976] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 30.588257] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 30.588343] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 30.588399] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 30.588448] head: 0bfffe0000000002 ffffc1ffc3267301 00000000ffffffff 00000000ffffffff [ 30.588495] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 30.588821] page dumped because: kasan: bad access detected [ 30.588988] [ 30.589040] Memory state around the buggy address: [ 30.589099] fff00000c99cdf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.589249] fff00000c99cdf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.589310] >fff00000c99ce000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 30.589581] ^ [ 30.589797] fff00000c99ce080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 30.589882] fff00000c99ce100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 30.590025] ==================================================================
[ 32.402564] ================================================================== [ 32.402631] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x278/0x2b8 [ 32.402887] Write of size 1 at addr fff00000c99ea00a by task kunit_try_catch/177 [ 32.403121] [ 32.403321] CPU: 1 UID: 0 PID: 177 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT [ 32.403412] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.403437] Hardware name: linux,dummy-virt (DT) [ 32.403481] Call trace: [ 32.403641] show_stack+0x20/0x38 (C) [ 32.403795] dump_stack_lvl+0x8c/0xd0 [ 32.403865] print_report+0x118/0x608 [ 32.403962] kasan_report+0xdc/0x128 [ 32.404039] __asan_report_store1_noabort+0x20/0x30 [ 32.404089] kmalloc_large_oob_right+0x278/0x2b8 [ 32.404138] kunit_try_run_case+0x170/0x3f0 [ 32.404198] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.404333] kthread+0x328/0x630 [ 32.404415] ret_from_fork+0x10/0x20 [ 32.404463] [ 32.404503] The buggy address belongs to the physical page: [ 32.404561] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1099e8 [ 32.404719] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.404765] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.404821] page_type: f8(unknown) [ 32.404859] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.404908] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.405096] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 32.405146] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 32.405247] head: 0bfffe0000000002 ffffc1ffc3267a01 00000000ffffffff 00000000ffffffff [ 32.405429] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 32.405474] page dumped because: kasan: bad access detected [ 32.405554] [ 32.405572] Memory state around the buggy address: [ 32.405604] fff00000c99e9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.405645] fff00000c99e9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.405851] >fff00000c99ea000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 32.405954] ^ [ 32.406014] fff00000c99ea080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 32.406088] fff00000c99ea100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 32.406139] ==================================================================
[ 22.611953] ================================================================== [ 22.612401] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x2e9/0x330 [ 22.612761] Write of size 1 at addr ffff8881060c200a by task kunit_try_catch/194 [ 22.613044] [ 22.613134] CPU: 0 UID: 0 PID: 194 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) [ 22.613183] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.613196] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.613217] Call Trace: [ 22.613229] <TASK> [ 22.613247] dump_stack_lvl+0x73/0xb0 [ 22.613276] print_report+0xd1/0x650 [ 22.613298] ? __virt_addr_valid+0x1db/0x2d0 [ 22.613334] ? kmalloc_large_oob_right+0x2e9/0x330 [ 22.613355] ? kasan_addr_to_slab+0x11/0xa0 [ 22.613374] ? kmalloc_large_oob_right+0x2e9/0x330 [ 22.613395] kasan_report+0x141/0x180 [ 22.613417] ? kmalloc_large_oob_right+0x2e9/0x330 [ 22.613443] __asan_report_store1_noabort+0x1b/0x30 [ 22.613467] kmalloc_large_oob_right+0x2e9/0x330 [ 22.613488] ? __pfx_kmalloc_large_oob_right+0x10/0x10 [ 22.613521] ? __schedule+0x10cc/0x2b60 [ 22.613542] ? __pfx_read_tsc+0x10/0x10 [ 22.613563] ? ktime_get_ts64+0x86/0x230 [ 22.613588] kunit_try_run_case+0x1a5/0x480 [ 22.613613] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.613636] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.613657] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.613689] ? __kthread_parkme+0x82/0x180 [ 22.613709] ? preempt_count_sub+0x50/0x80 [ 22.613732] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.613764] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.613787] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.613811] kthread+0x337/0x6f0 [ 22.613830] ? trace_preempt_on+0x20/0xc0 [ 22.613854] ? __pfx_kthread+0x10/0x10 [ 22.613874] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.613897] ? calculate_sigpending+0x7b/0xa0 [ 22.613921] ? __pfx_kthread+0x10/0x10 [ 22.613942] ret_from_fork+0x116/0x1d0 [ 22.613960] ? __pfx_kthread+0x10/0x10 [ 22.613980] ret_from_fork_asm+0x1a/0x30 [ 22.614011] </TASK> [ 22.614023] [ 22.621069] The buggy address belongs to the physical page: [ 22.621396] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1060c0 [ 22.621766] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.622027] flags: 0x200000000000040(head|node=0|zone=2) [ 22.622291] page_type: f8(unknown) [ 22.622464] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.623023] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.623300] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.623548] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.623898] head: 0200000000000002 ffffea0004183001 00000000ffffffff 00000000ffffffff [ 22.624259] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 22.625030] page dumped because: kasan: bad access detected [ 22.625276] [ 22.625383] Memory state around the buggy address: [ 22.625903] ffff8881060c1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.626207] ffff8881060c1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.626789] >ffff8881060c2000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.627107] ^ [ 22.627257] ffff8881060c2080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.627901] ffff8881060c2100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.628168] ==================================================================
[ 22.801402] ================================================================== [ 22.801957] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x2e9/0x330 [ 22.803097] Write of size 1 at addr ffff8881057a200a by task kunit_try_catch/195 [ 22.804083] [ 22.804287] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) [ 22.804345] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.804360] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.804383] Call Trace: [ 22.804397] <TASK> [ 22.804419] dump_stack_lvl+0x73/0xb0 [ 22.804455] print_report+0xd1/0x650 [ 22.804479] ? __virt_addr_valid+0x1db/0x2d0 [ 22.804503] ? kmalloc_large_oob_right+0x2e9/0x330 [ 22.804524] ? kasan_addr_to_slab+0x11/0xa0 [ 22.804544] ? kmalloc_large_oob_right+0x2e9/0x330 [ 22.804566] kasan_report+0x141/0x180 [ 22.804587] ? kmalloc_large_oob_right+0x2e9/0x330 [ 22.804613] __asan_report_store1_noabort+0x1b/0x30 [ 22.804637] kmalloc_large_oob_right+0x2e9/0x330 [ 22.804658] ? __pfx_kmalloc_large_oob_right+0x10/0x10 [ 22.804682] ? __schedule+0x10cc/0x2b60 [ 22.804704] ? __pfx_read_tsc+0x10/0x10 [ 22.804726] ? ktime_get_ts64+0x86/0x230 [ 22.804751] kunit_try_run_case+0x1a5/0x480 [ 22.804778] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.804801] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.804823] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.804844] ? __kthread_parkme+0x82/0x180 [ 22.804864] ? preempt_count_sub+0x50/0x80 [ 22.804887] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.804912] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.804953] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.804977] kthread+0x337/0x6f0 [ 22.804997] ? trace_preempt_on+0x20/0xc0 [ 22.805020] ? __pfx_kthread+0x10/0x10 [ 22.805041] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.805074] ? calculate_sigpending+0x7b/0xa0 [ 22.805098] ? __pfx_kthread+0x10/0x10 [ 22.805119] ret_from_fork+0x116/0x1d0 [ 22.805137] ? __pfx_kthread+0x10/0x10 [ 22.805158] ret_from_fork_asm+0x1a/0x30 [ 22.805220] </TASK> [ 22.805234] [ 22.817613] The buggy address belongs to the physical page: [ 22.818177] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1057a0 [ 22.818767] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.819084] flags: 0x200000000000040(head|node=0|zone=2) [ 22.819642] page_type: f8(unknown) [ 22.820119] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.820849] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.821308] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.821981] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 22.822665] head: 0200000000000002 ffffea000415e801 00000000ffffffff 00000000ffffffff [ 22.823432] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 22.824104] page dumped because: kasan: bad access detected [ 22.824417] [ 22.824605] Memory state around the buggy address: [ 22.824813] ffff8881057a1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.825080] ffff8881057a1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.825745] >ffff8881057a2000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.826484] ^ [ 22.826845] ffff8881057a2080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.827588] ffff8881057a2100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 22.828275] ==================================================================