Date
July 2, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.523339] ================================================================== [ 30.523450] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 30.523514] Read of size 1 at addr fff00000c989d000 by task kunit_try_catch/173 [ 30.523617] [ 30.523648] CPU: 0 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT [ 30.523860] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.523976] Hardware name: linux,dummy-virt (DT) [ 30.524010] Call trace: [ 30.524032] show_stack+0x20/0x38 (C) [ 30.524100] dump_stack_lvl+0x8c/0xd0 [ 30.524259] print_report+0x118/0x608 [ 30.524328] kasan_report+0xdc/0x128 [ 30.524454] __asan_report_load1_noabort+0x20/0x30 [ 30.524515] kmalloc_node_oob_right+0x2f4/0x330 [ 30.524564] kunit_try_run_case+0x170/0x3f0 [ 30.524638] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.524692] kthread+0x328/0x630 [ 30.524952] ret_from_fork+0x10/0x20 [ 30.525147] [ 30.525167] Allocated by task 173: [ 30.525246] kasan_save_stack+0x3c/0x68 [ 30.525464] kasan_save_track+0x20/0x40 [ 30.525540] kasan_save_alloc_info+0x40/0x58 [ 30.525610] __kasan_kmalloc+0xd4/0xd8 [ 30.525709] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 30.525789] kmalloc_node_oob_right+0xbc/0x330 [ 30.525863] kunit_try_run_case+0x170/0x3f0 [ 30.525940] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.526020] kthread+0x328/0x630 [ 30.526052] ret_from_fork+0x10/0x20 [ 30.526303] [ 30.526359] The buggy address belongs to the object at fff00000c989c000 [ 30.526359] which belongs to the cache kmalloc-4k of size 4096 [ 30.526494] The buggy address is located 0 bytes to the right of [ 30.526494] allocated 4096-byte region [fff00000c989c000, fff00000c989d000) [ 30.526585] [ 30.526623] The buggy address belongs to the physical page: [ 30.526831] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109898 [ 30.527333] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.527434] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 30.528049] page_type: f5(slab) [ 30.528139] raw: 0bfffe0000000040 fff00000c0002140 dead000000000100 dead000000000122 [ 30.528210] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 30.528340] head: 0bfffe0000000040 fff00000c0002140 dead000000000100 dead000000000122 [ 30.528439] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 30.528628] head: 0bfffe0000000003 ffffc1ffc3262601 00000000ffffffff 00000000ffffffff [ 30.528809] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 30.529058] page dumped because: kasan: bad access detected [ 30.529118] [ 30.529186] Memory state around the buggy address: [ 30.529283] fff00000c989cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.529346] fff00000c989cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.529414] >fff00000c989d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.529498] ^ [ 30.529546] fff00000c989d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.529592] fff00000c989d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.529636] ==================================================================
[ 32.350479] ================================================================== [ 32.350620] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 32.350983] Read of size 1 at addr fff00000c9a71000 by task kunit_try_catch/171 [ 32.351033] [ 32.351067] CPU: 1 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT [ 32.351151] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.351191] Hardware name: linux,dummy-virt (DT) [ 32.351223] Call trace: [ 32.351244] show_stack+0x20/0x38 (C) [ 32.351293] dump_stack_lvl+0x8c/0xd0 [ 32.351341] print_report+0x118/0x608 [ 32.351389] kasan_report+0xdc/0x128 [ 32.351435] __asan_report_load1_noabort+0x20/0x30 [ 32.352044] kmalloc_node_oob_right+0x2f4/0x330 [ 32.352095] kunit_try_run_case+0x170/0x3f0 [ 32.352376] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.352438] kthread+0x328/0x630 [ 32.352576] ret_from_fork+0x10/0x20 [ 32.352626] [ 32.352763] Allocated by task 171: [ 32.352883] kasan_save_stack+0x3c/0x68 [ 32.352974] kasan_save_track+0x20/0x40 [ 32.353052] kasan_save_alloc_info+0x40/0x58 [ 32.353185] __kasan_kmalloc+0xd4/0xd8 [ 32.353241] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 32.353284] kmalloc_node_oob_right+0xbc/0x330 [ 32.353323] kunit_try_run_case+0x170/0x3f0 [ 32.353377] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.353586] kthread+0x328/0x630 [ 32.353649] ret_from_fork+0x10/0x20 [ 32.353722] [ 32.353744] The buggy address belongs to the object at fff00000c9a70000 [ 32.353744] which belongs to the cache kmalloc-4k of size 4096 [ 32.353913] The buggy address is located 0 bytes to the right of [ 32.353913] allocated 4096-byte region [fff00000c9a70000, fff00000c9a71000) [ 32.354033] [ 32.354089] The buggy address belongs to the physical page: [ 32.354218] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109a70 [ 32.354401] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.354955] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.355089] page_type: f5(slab) [ 32.355314] raw: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 32.355414] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 32.355681] head: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 32.355835] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 32.355922] head: 0bfffe0000000003 ffffc1ffc3269c01 00000000ffffffff 00000000ffffffff [ 32.355972] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 32.356045] page dumped because: kasan: bad access detected [ 32.356076] [ 32.356094] Memory state around the buggy address: [ 32.356125] fff00000c9a70f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.356202] fff00000c9a70f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.356245] >fff00000c9a71000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.356436] ^ [ 32.356469] fff00000c9a71080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.356548] fff00000c9a71100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.356789] ==================================================================
[ 22.497158] ================================================================== [ 22.498316] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x369/0x3c0 [ 22.499058] Read of size 1 at addr ffff888105f7f000 by task kunit_try_catch/188 [ 22.499764] [ 22.500031] CPU: 0 UID: 0 PID: 188 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) [ 22.500087] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.500100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.500144] Call Trace: [ 22.500157] <TASK> [ 22.500177] dump_stack_lvl+0x73/0xb0 [ 22.500210] print_report+0xd1/0x650 [ 22.500232] ? __virt_addr_valid+0x1db/0x2d0 [ 22.500255] ? kmalloc_node_oob_right+0x369/0x3c0 [ 22.500278] ? kasan_complete_mode_report_info+0x2a/0x200 [ 22.500303] ? kmalloc_node_oob_right+0x369/0x3c0 [ 22.500340] kasan_report+0x141/0x180 [ 22.500361] ? kmalloc_node_oob_right+0x369/0x3c0 [ 22.500387] __asan_report_load1_noabort+0x18/0x20 [ 22.500410] kmalloc_node_oob_right+0x369/0x3c0 [ 22.500433] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 22.500456] ? __schedule+0x10cc/0x2b60 [ 22.500477] ? __pfx_read_tsc+0x10/0x10 [ 22.500508] ? ktime_get_ts64+0x86/0x230 [ 22.500534] kunit_try_run_case+0x1a5/0x480 [ 22.500560] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.500582] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.500603] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.500624] ? __kthread_parkme+0x82/0x180 [ 22.500645] ? preempt_count_sub+0x50/0x80 [ 22.500668] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.500746] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.500770] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.500793] kthread+0x337/0x6f0 [ 22.500813] ? trace_preempt_on+0x20/0xc0 [ 22.500836] ? __pfx_kthread+0x10/0x10 [ 22.500856] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.500879] ? calculate_sigpending+0x7b/0xa0 [ 22.500902] ? __pfx_kthread+0x10/0x10 [ 22.500923] ret_from_fork+0x116/0x1d0 [ 22.500942] ? __pfx_kthread+0x10/0x10 [ 22.500962] ret_from_fork_asm+0x1a/0x30 [ 22.500992] </TASK> [ 22.501005] [ 22.512458] Allocated by task 188: [ 22.512895] kasan_save_stack+0x45/0x70 [ 22.513064] kasan_save_track+0x18/0x40 [ 22.513196] kasan_save_alloc_info+0x3b/0x50 [ 22.513351] __kasan_kmalloc+0xb7/0xc0 [ 22.513484] __kmalloc_cache_node_noprof+0x188/0x420 [ 22.513730] kmalloc_node_oob_right+0xab/0x3c0 [ 22.514098] kunit_try_run_case+0x1a5/0x480 [ 22.514272] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.514521] kthread+0x337/0x6f0 [ 22.514696] ret_from_fork+0x116/0x1d0 [ 22.515455] ret_from_fork_asm+0x1a/0x30 [ 22.515619] [ 22.515715] The buggy address belongs to the object at ffff888105f7e000 [ 22.515715] which belongs to the cache kmalloc-4k of size 4096 [ 22.516493] The buggy address is located 0 bytes to the right of [ 22.516493] allocated 4096-byte region [ffff888105f7e000, ffff888105f7f000) [ 22.517037] [ 22.517133] The buggy address belongs to the physical page: [ 22.517461] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f78 [ 22.518386] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.518845] anon flags: 0x200000000000040(head|node=0|zone=2) [ 22.519281] page_type: f5(slab) [ 22.519422] raw: 0200000000000040 ffff888100042140 0000000000000000 dead000000000001 [ 22.519982] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 22.520429] head: 0200000000000040 ffff888100042140 0000000000000000 dead000000000001 [ 22.520989] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 22.521400] head: 0200000000000003 ffffea000417de01 00000000ffffffff 00000000ffffffff [ 22.521895] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 22.522337] page dumped because: kasan: bad access detected [ 22.522574] [ 22.522665] Memory state around the buggy address: [ 22.522869] ffff888105f7ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.523129] ffff888105f7ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.523440] >ffff888105f7f000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.523732] ^ [ 22.523883] ffff888105f7f080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.524107] ffff888105f7f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.524492] ==================================================================
[ 22.685796] ================================================================== [ 22.686442] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x369/0x3c0 [ 22.687618] Read of size 1 at addr ffff888105f31000 by task kunit_try_catch/189 [ 22.688387] [ 22.688629] CPU: 1 UID: 0 PID: 189 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) [ 22.688700] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.688714] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.688739] Call Trace: [ 22.688754] <TASK> [ 22.688778] dump_stack_lvl+0x73/0xb0 [ 22.688816] print_report+0xd1/0x650 [ 22.688840] ? __virt_addr_valid+0x1db/0x2d0 [ 22.688866] ? kmalloc_node_oob_right+0x369/0x3c0 [ 22.688889] ? kasan_complete_mode_report_info+0x2a/0x200 [ 22.688915] ? kmalloc_node_oob_right+0x369/0x3c0 [ 22.688938] kasan_report+0x141/0x180 [ 22.688960] ? kmalloc_node_oob_right+0x369/0x3c0 [ 22.688987] __asan_report_load1_noabort+0x18/0x20 [ 22.689010] kmalloc_node_oob_right+0x369/0x3c0 [ 22.689034] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 22.689058] ? __schedule+0x10cc/0x2b60 [ 22.689090] ? __pfx_read_tsc+0x10/0x10 [ 22.689113] ? ktime_get_ts64+0x86/0x230 [ 22.689139] kunit_try_run_case+0x1a5/0x480 [ 22.689167] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.689308] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 22.689336] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 22.689358] ? __kthread_parkme+0x82/0x180 [ 22.689381] ? preempt_count_sub+0x50/0x80 [ 22.689405] ? __pfx_kunit_try_run_case+0x10/0x10 [ 22.689473] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.689500] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 22.689524] kthread+0x337/0x6f0 [ 22.689544] ? trace_preempt_on+0x20/0xc0 [ 22.689569] ? __pfx_kthread+0x10/0x10 [ 22.689589] ? _raw_spin_unlock_irq+0x47/0x80 [ 22.689613] ? calculate_sigpending+0x7b/0xa0 [ 22.689638] ? __pfx_kthread+0x10/0x10 [ 22.689659] ret_from_fork+0x116/0x1d0 [ 22.689678] ? __pfx_kthread+0x10/0x10 [ 22.689698] ret_from_fork_asm+0x1a/0x30 [ 22.689731] </TASK> [ 22.689744] [ 22.703986] Allocated by task 189: [ 22.704351] kasan_save_stack+0x45/0x70 [ 22.704770] kasan_save_track+0x18/0x40 [ 22.705246] kasan_save_alloc_info+0x3b/0x50 [ 22.705625] __kasan_kmalloc+0xb7/0xc0 [ 22.705952] __kmalloc_cache_node_noprof+0x188/0x420 [ 22.706445] kmalloc_node_oob_right+0xab/0x3c0 [ 22.706890] kunit_try_run_case+0x1a5/0x480 [ 22.707507] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 22.707830] kthread+0x337/0x6f0 [ 22.707960] ret_from_fork+0x116/0x1d0 [ 22.708365] ret_from_fork_asm+0x1a/0x30 [ 22.708729] [ 22.708884] The buggy address belongs to the object at ffff888105f30000 [ 22.708884] which belongs to the cache kmalloc-4k of size 4096 [ 22.709650] The buggy address is located 0 bytes to the right of [ 22.709650] allocated 4096-byte region [ffff888105f30000, ffff888105f31000) [ 22.710059] [ 22.710145] The buggy address belongs to the physical page: [ 22.710492] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f30 [ 22.711691] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.712150] flags: 0x200000000000040(head|node=0|zone=2) [ 22.712738] page_type: f5(slab) [ 22.713053] raw: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 22.713761] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 22.714048] head: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 22.714327] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 22.714732] head: 0200000000000003 ffffea000417cc01 00000000ffffffff 00000000ffffffff [ 22.715102] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 22.715617] page dumped because: kasan: bad access detected [ 22.715835] [ 22.715924] Memory state around the buggy address: [ 22.716266] ffff888105f30f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.716523] ffff888105f30f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.716791] >ffff888105f31000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.717087] ^ [ 22.717319] ffff888105f31080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.717596] ffff888105f31100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.717885] ==================================================================