Date
July 2, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 30.861862] ================================================================== [ 30.862121] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x150/0x2f8 [ 30.862341] Write of size 8 at addr fff00000c404ff71 by task kunit_try_catch/209 [ 30.862404] [ 30.862452] CPU: 0 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT [ 30.862568] Tainted: [B]=BAD_PAGE, [N]=TEST [ 30.862595] Hardware name: linux,dummy-virt (DT) [ 30.862669] Call trace: [ 30.862711] show_stack+0x20/0x38 (C) [ 30.862768] dump_stack_lvl+0x8c/0xd0 [ 30.862882] print_report+0x118/0x608 [ 30.862991] kasan_report+0xdc/0x128 [ 30.863040] kasan_check_range+0x100/0x1a8 [ 30.863316] __asan_memset+0x34/0x78 [ 30.863439] kmalloc_oob_memset_8+0x150/0x2f8 [ 30.863509] kunit_try_run_case+0x170/0x3f0 [ 30.863629] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.863719] kthread+0x328/0x630 [ 30.863787] ret_from_fork+0x10/0x20 [ 30.863976] [ 30.864025] Allocated by task 209: [ 30.864074] kasan_save_stack+0x3c/0x68 [ 30.864124] kasan_save_track+0x20/0x40 [ 30.864359] kasan_save_alloc_info+0x40/0x58 [ 30.864590] __kasan_kmalloc+0xd4/0xd8 [ 30.864670] __kmalloc_cache_noprof+0x16c/0x3c0 [ 30.864790] kmalloc_oob_memset_8+0xb0/0x2f8 [ 30.864858] kunit_try_run_case+0x170/0x3f0 [ 30.864996] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 30.865054] kthread+0x328/0x630 [ 30.865086] ret_from_fork+0x10/0x20 [ 30.865155] [ 30.865308] The buggy address belongs to the object at fff00000c404ff00 [ 30.865308] which belongs to the cache kmalloc-128 of size 128 [ 30.865638] The buggy address is located 113 bytes inside of [ 30.865638] allocated 120-byte region [fff00000c404ff00, fff00000c404ff78) [ 30.865757] [ 30.865806] The buggy address belongs to the physical page: [ 30.865954] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10404f [ 30.866055] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 30.866253] page_type: f5(slab) [ 30.866415] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 30.866576] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 30.866718] page dumped because: kasan: bad access detected [ 30.866777] [ 30.866826] Memory state around the buggy address: [ 30.866954] fff00000c404fe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.867026] fff00000c404fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.867085] >fff00000c404ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 30.867277] ^ [ 30.867452] fff00000c404ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.867632] fff00000c4050000: 00 06 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 30.867694] ==================================================================
[ 32.630309] ================================================================== [ 32.630369] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x150/0x2f8 [ 32.630798] Write of size 8 at addr fff00000c63fba71 by task kunit_try_catch/207 [ 32.630875] [ 32.631148] CPU: 1 UID: 0 PID: 207 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT [ 32.631497] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.631525] Hardware name: linux,dummy-virt (DT) [ 32.631574] Call trace: [ 32.631597] show_stack+0x20/0x38 (C) [ 32.631647] dump_stack_lvl+0x8c/0xd0 [ 32.631696] print_report+0x118/0x608 [ 32.631742] kasan_report+0xdc/0x128 [ 32.631789] kasan_check_range+0x100/0x1a8 [ 32.631833] __asan_memset+0x34/0x78 [ 32.631876] kmalloc_oob_memset_8+0x150/0x2f8 [ 32.632153] kunit_try_run_case+0x170/0x3f0 [ 32.632226] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.632279] kthread+0x328/0x630 [ 32.632320] ret_from_fork+0x10/0x20 [ 32.632748] [ 32.632836] Allocated by task 207: [ 32.632919] kasan_save_stack+0x3c/0x68 [ 32.632963] kasan_save_track+0x20/0x40 [ 32.633007] kasan_save_alloc_info+0x40/0x58 [ 32.633049] __kasan_kmalloc+0xd4/0xd8 [ 32.633220] __kmalloc_cache_noprof+0x16c/0x3c0 [ 32.633280] kmalloc_oob_memset_8+0xb0/0x2f8 [ 32.633419] kunit_try_run_case+0x170/0x3f0 [ 32.633457] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.633503] kthread+0x328/0x630 [ 32.633550] ret_from_fork+0x10/0x20 [ 32.633585] [ 32.633661] The buggy address belongs to the object at fff00000c63fba00 [ 32.633661] which belongs to the cache kmalloc-128 of size 128 [ 32.633717] The buggy address is located 113 bytes inside of [ 32.633717] allocated 120-byte region [fff00000c63fba00, fff00000c63fba78) [ 32.633817] [ 32.633895] The buggy address belongs to the physical page: [ 32.633984] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1063fb [ 32.634034] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.634080] page_type: f5(slab) [ 32.634174] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.634224] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.634263] page dumped because: kasan: bad access detected [ 32.634293] [ 32.634311] Memory state around the buggy address: [ 32.634340] fff00000c63fb900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.634381] fff00000c63fb980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.634474] >fff00000c63fba00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 32.634511] ^ [ 32.634550] fff00000c63fba80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.634590] fff00000c63fbb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.634627] ==================================================================
[ 23.186864] ================================================================== [ 23.187369] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x166/0x330 [ 23.187924] Write of size 8 at addr ffff888105887f71 by task kunit_try_catch/224 [ 23.188217] [ 23.188331] CPU: 0 UID: 0 PID: 224 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) [ 23.188403] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.188415] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.188435] Call Trace: [ 23.188447] <TASK> [ 23.188479] dump_stack_lvl+0x73/0xb0 [ 23.188518] print_report+0xd1/0x650 [ 23.188540] ? __virt_addr_valid+0x1db/0x2d0 [ 23.188562] ? kmalloc_oob_memset_8+0x166/0x330 [ 23.188583] ? kasan_complete_mode_report_info+0x2a/0x200 [ 23.188608] ? kmalloc_oob_memset_8+0x166/0x330 [ 23.188629] kasan_report+0x141/0x180 [ 23.188650] ? kmalloc_oob_memset_8+0x166/0x330 [ 23.188719] kasan_check_range+0x10c/0x1c0 [ 23.188745] __asan_memset+0x27/0x50 [ 23.188789] kmalloc_oob_memset_8+0x166/0x330 [ 23.188812] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 23.188834] ? __schedule+0x10cc/0x2b60 [ 23.188855] ? __pfx_read_tsc+0x10/0x10 [ 23.188877] ? ktime_get_ts64+0x86/0x230 [ 23.188901] kunit_try_run_case+0x1a5/0x480 [ 23.188925] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.188948] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.188969] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.188991] ? __kthread_parkme+0x82/0x180 [ 23.189010] ? preempt_count_sub+0x50/0x80 [ 23.189033] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.189058] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.189098] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.189124] kthread+0x337/0x6f0 [ 23.189143] ? trace_preempt_on+0x20/0xc0 [ 23.189166] ? __pfx_kthread+0x10/0x10 [ 23.189187] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.189211] ? calculate_sigpending+0x7b/0xa0 [ 23.189234] ? __pfx_kthread+0x10/0x10 [ 23.189272] ret_from_fork+0x116/0x1d0 [ 23.189290] ? __pfx_kthread+0x10/0x10 [ 23.189322] ret_from_fork_asm+0x1a/0x30 [ 23.189352] </TASK> [ 23.189364] [ 23.197258] Allocated by task 224: [ 23.197474] kasan_save_stack+0x45/0x70 [ 23.197806] kasan_save_track+0x18/0x40 [ 23.198024] kasan_save_alloc_info+0x3b/0x50 [ 23.198234] __kasan_kmalloc+0xb7/0xc0 [ 23.198432] __kmalloc_cache_noprof+0x189/0x420 [ 23.198728] kmalloc_oob_memset_8+0xac/0x330 [ 23.198962] kunit_try_run_case+0x1a5/0x480 [ 23.199121] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.199338] kthread+0x337/0x6f0 [ 23.199510] ret_from_fork+0x116/0x1d0 [ 23.199757] ret_from_fork_asm+0x1a/0x30 [ 23.199996] [ 23.200098] The buggy address belongs to the object at ffff888105887f00 [ 23.200098] which belongs to the cache kmalloc-128 of size 128 [ 23.200581] The buggy address is located 113 bytes inside of [ 23.200581] allocated 120-byte region [ffff888105887f00, ffff888105887f78) [ 23.201105] [ 23.201172] The buggy address belongs to the physical page: [ 23.201394] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105887 [ 23.202063] flags: 0x200000000000000(node=0|zone=2) [ 23.202243] page_type: f5(slab) [ 23.202452] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 23.202978] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.203281] page dumped because: kasan: bad access detected [ 23.203542] [ 23.203699] Memory state around the buggy address: [ 23.203930] ffff888105887e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.204223] ffff888105887e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.204590] >ffff888105887f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 23.204947] ^ [ 23.205220] ffff888105887f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.205554] ffff888105888000: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 23.205981] ==================================================================
[ 23.466411] ================================================================== [ 23.466837] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x166/0x330 [ 23.467237] Write of size 8 at addr ffff88810255e771 by task kunit_try_catch/225 [ 23.467803] [ 23.467925] CPU: 0 UID: 0 PID: 225 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) [ 23.467989] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.468002] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.468035] Call Trace: [ 23.468068] <TASK> [ 23.468088] dump_stack_lvl+0x73/0xb0 [ 23.468120] print_report+0xd1/0x650 [ 23.468143] ? __virt_addr_valid+0x1db/0x2d0 [ 23.468177] ? kmalloc_oob_memset_8+0x166/0x330 [ 23.468198] ? kasan_complete_mode_report_info+0x2a/0x200 [ 23.468223] ? kmalloc_oob_memset_8+0x166/0x330 [ 23.468255] kasan_report+0x141/0x180 [ 23.468329] ? kmalloc_oob_memset_8+0x166/0x330 [ 23.468360] kasan_check_range+0x10c/0x1c0 [ 23.468384] __asan_memset+0x27/0x50 [ 23.468407] kmalloc_oob_memset_8+0x166/0x330 [ 23.468429] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 23.468453] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 23.468478] kunit_try_run_case+0x1a5/0x480 [ 23.468506] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.468529] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.468563] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.468585] ? __kthread_parkme+0x82/0x180 [ 23.468607] ? preempt_count_sub+0x50/0x80 [ 23.468642] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.468667] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.468691] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.468717] kthread+0x337/0x6f0 [ 23.468737] ? trace_preempt_on+0x20/0xc0 [ 23.468761] ? __pfx_kthread+0x10/0x10 [ 23.468781] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.468805] ? calculate_sigpending+0x7b/0xa0 [ 23.468829] ? __pfx_kthread+0x10/0x10 [ 23.468850] ret_from_fork+0x116/0x1d0 [ 23.468870] ? __pfx_kthread+0x10/0x10 [ 23.468890] ret_from_fork_asm+0x1a/0x30 [ 23.468921] </TASK> [ 23.468935] [ 23.478129] Allocated by task 225: [ 23.478519] kasan_save_stack+0x45/0x70 [ 23.478689] kasan_save_track+0x18/0x40 [ 23.478868] kasan_save_alloc_info+0x3b/0x50 [ 23.479282] __kasan_kmalloc+0xb7/0xc0 [ 23.479434] __kmalloc_cache_noprof+0x189/0x420 [ 23.479656] kmalloc_oob_memset_8+0xac/0x330 [ 23.479970] kunit_try_run_case+0x1a5/0x480 [ 23.480397] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.480781] kthread+0x337/0x6f0 [ 23.481078] ret_from_fork+0x116/0x1d0 [ 23.481326] ret_from_fork_asm+0x1a/0x30 [ 23.481709] [ 23.481814] The buggy address belongs to the object at ffff88810255e700 [ 23.481814] which belongs to the cache kmalloc-128 of size 128 [ 23.482517] The buggy address is located 113 bytes inside of [ 23.482517] allocated 120-byte region [ffff88810255e700, ffff88810255e778) [ 23.483359] [ 23.483440] The buggy address belongs to the physical page: [ 23.483682] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10255e [ 23.484052] flags: 0x200000000000000(node=0|zone=2) [ 23.484237] page_type: f5(slab) [ 23.484442] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 23.485140] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.485541] page dumped because: kasan: bad access detected [ 23.485812] [ 23.485912] Memory state around the buggy address: [ 23.486219] ffff88810255e600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.486627] ffff88810255e680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.487005] >ffff88810255e700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 23.487368] ^ [ 23.487763] ffff88810255e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.488012] ffff88810255e800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.488465] ==================================================================