Hay
Date
July 2, 2025, 11:10 a.m.

Environment
qemu-arm64
qemu-x86_64

[   30.545131] ==================================================================
[   30.545179] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x418/0x488
[   30.545227] Write of size 1 at addr fff00000c404fb78 by task kunit_try_catch/175
[   30.545275] 
[   30.545315] CPU: 0 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT 
[   30.545411] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.545439] Hardware name: linux,dummy-virt (DT)
[   30.545469] Call trace:
[   30.545491]  show_stack+0x20/0x38 (C)
[   30.545538]  dump_stack_lvl+0x8c/0xd0
[   30.545586]  print_report+0x118/0x608
[   30.545633]  kasan_report+0xdc/0x128
[   30.545681]  __asan_report_store1_noabort+0x20/0x30
[   30.545729]  kmalloc_track_caller_oob_right+0x418/0x488
[   30.545780]  kunit_try_run_case+0x170/0x3f0
[   30.545827]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.545880]  kthread+0x328/0x630
[   30.546229]  ret_from_fork+0x10/0x20
[   30.547027] 
[   30.547076] Allocated by task 175:
[   30.547117]  kasan_save_stack+0x3c/0x68
[   30.547161]  kasan_save_track+0x20/0x40
[   30.547198]  kasan_save_alloc_info+0x40/0x58
[   30.547234]  __kasan_kmalloc+0xd4/0xd8
[   30.547271]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   30.547315]  kmalloc_track_caller_oob_right+0x184/0x488
[   30.547359]  kunit_try_run_case+0x170/0x3f0
[   30.547397]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.547793]  kthread+0x328/0x630
[   30.547871]  ret_from_fork+0x10/0x20
[   30.548027] 
[   30.548049] The buggy address belongs to the object at fff00000c404fb00
[   30.548049]  which belongs to the cache kmalloc-128 of size 128
[   30.548106] The buggy address is located 0 bytes to the right of
[   30.548106]  allocated 120-byte region [fff00000c404fb00, fff00000c404fb78)
[   30.548176] 
[   30.548196] The buggy address belongs to the physical page:
[   30.548225] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10404f
[   30.549031] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.549138] page_type: f5(slab)
[   30.549216] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   30.549609] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   30.549782] page dumped because: kasan: bad access detected
[   30.549831] 
[   30.549850] Memory state around the buggy address:
[   30.550025]  fff00000c404fa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.550246]  fff00000c404fa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.550328] >fff00000c404fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   30.550504]                                                                 ^
[   30.550701]  fff00000c404fb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.550806]  fff00000c404fc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.550896] ==================================================================
[   30.535171] ==================================================================
[   30.535224] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488
[   30.535275] Write of size 1 at addr fff00000c404fa78 by task kunit_try_catch/175
[   30.535325] 
[   30.535356] CPU: 0 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT 
[   30.535460] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.535487] Hardware name: linux,dummy-virt (DT)
[   30.535517] Call trace:
[   30.535870]  show_stack+0x20/0x38 (C)
[   30.536197]  dump_stack_lvl+0x8c/0xd0
[   30.536406]  print_report+0x118/0x608
[   30.536885]  kasan_report+0xdc/0x128
[   30.536992]  __asan_report_store1_noabort+0x20/0x30
[   30.537190]  kmalloc_track_caller_oob_right+0x40c/0x488
[   30.537413]  kunit_try_run_case+0x170/0x3f0
[   30.537598]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.537746]  kthread+0x328/0x630
[   30.537800]  ret_from_fork+0x10/0x20
[   30.538639] 
[   30.538665] Allocated by task 175:
[   30.538696]  kasan_save_stack+0x3c/0x68
[   30.538757]  kasan_save_track+0x20/0x40
[   30.538819]  kasan_save_alloc_info+0x40/0x58
[   30.538899]  __kasan_kmalloc+0xd4/0xd8
[   30.538970]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   30.539208]  kmalloc_track_caller_oob_right+0xa8/0x488
[   30.539591]  kunit_try_run_case+0x170/0x3f0
[   30.539934]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.540110]  kthread+0x328/0x630
[   30.540162]  ret_from_fork+0x10/0x20
[   30.540199] 
[   30.540219] The buggy address belongs to the object at fff00000c404fa00
[   30.540219]  which belongs to the cache kmalloc-128 of size 128
[   30.540540] The buggy address is located 0 bytes to the right of
[   30.540540]  allocated 120-byte region [fff00000c404fa00, fff00000c404fa78)
[   30.541065] 
[   30.541185] The buggy address belongs to the physical page:
[   30.541223] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10404f
[   30.541311] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.541420] page_type: f5(slab)
[   30.541499] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   30.541598] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   30.541672] page dumped because: kasan: bad access detected
[   30.541773] 
[   30.541823] Memory state around the buggy address:
[   30.541874]  fff00000c404f900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   30.542046]  fff00000c404f980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.542327] >fff00000c404fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   30.542551]                                                                 ^
[   30.542682]  fff00000c404fa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.542900]  fff00000c404fb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.543024] ==================================================================

[   32.375176] ==================================================================
[   32.375359] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x418/0x488
[   32.375591] Write of size 1 at addr fff00000c63fb678 by task kunit_try_catch/173
[   32.375647] 
[   32.375678] CPU: 1 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT 
[   32.375762] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.375788] Hardware name: linux,dummy-virt (DT)
[   32.375835] Call trace:
[   32.375956]  show_stack+0x20/0x38 (C)
[   32.376010]  dump_stack_lvl+0x8c/0xd0
[   32.376248]  print_report+0x118/0x608
[   32.376302]  kasan_report+0xdc/0x128
[   32.376350]  __asan_report_store1_noabort+0x20/0x30
[   32.376399]  kmalloc_track_caller_oob_right+0x418/0x488
[   32.376450]  kunit_try_run_case+0x170/0x3f0
[   32.376511]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.376678]  kthread+0x328/0x630
[   32.376720]  ret_from_fork+0x10/0x20
[   32.376792] 
[   32.377136] Allocated by task 173:
[   32.377398]  kasan_save_stack+0x3c/0x68
[   32.377444]  kasan_save_track+0x20/0x40
[   32.377537]  kasan_save_alloc_info+0x40/0x58
[   32.377574]  __kasan_kmalloc+0xd4/0xd8
[   32.377631]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   32.377818]  kmalloc_track_caller_oob_right+0x184/0x488
[   32.377932]  kunit_try_run_case+0x170/0x3f0
[   32.377997]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.378046]  kthread+0x328/0x630
[   32.378079]  ret_from_fork+0x10/0x20
[   32.378425] 
[   32.378665] The buggy address belongs to the object at fff00000c63fb600
[   32.378665]  which belongs to the cache kmalloc-128 of size 128
[   32.378756] The buggy address is located 0 bytes to the right of
[   32.378756]  allocated 120-byte region [fff00000c63fb600, fff00000c63fb678)
[   32.378818] 
[   32.378837] The buggy address belongs to the physical page:
[   32.379128] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1063fb
[   32.379408] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   32.379517] page_type: f5(slab)
[   32.379601] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   32.379840] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   32.379985] page dumped because: kasan: bad access detected
[   32.380018] 
[   32.380035] Memory state around the buggy address:
[   32.380203]  fff00000c63fb500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   32.380249]  fff00000c63fb580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.380365] >fff00000c63fb600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   32.380561]                                                                 ^
[   32.380664]  fff00000c63fb680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.380844]  fff00000c63fb700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.380913] ==================================================================
[   32.368620] ==================================================================
[   32.368677] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488
[   32.368733] Write of size 1 at addr fff00000c63fb578 by task kunit_try_catch/173
[   32.368783] 
[   32.368815] CPU: 1 UID: 0 PID: 173 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT 
[   32.368901] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.368927] Hardware name: linux,dummy-virt (DT)
[   32.368958] Call trace:
[   32.369098]  show_stack+0x20/0x38 (C)
[   32.369174]  dump_stack_lvl+0x8c/0xd0
[   32.369224]  print_report+0x118/0x608
[   32.369586]  kasan_report+0xdc/0x128
[   32.369856]  __asan_report_store1_noabort+0x20/0x30
[   32.369912]  kmalloc_track_caller_oob_right+0x40c/0x488
[   32.369986]  kunit_try_run_case+0x170/0x3f0
[   32.370113]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.370176]  kthread+0x328/0x630
[   32.370219]  ret_from_fork+0x10/0x20
[   32.370266] 
[   32.370284] Allocated by task 173:
[   32.370312]  kasan_save_stack+0x3c/0x68
[   32.370354]  kasan_save_track+0x20/0x40
[   32.370392]  kasan_save_alloc_info+0x40/0x58
[   32.370429]  __kasan_kmalloc+0xd4/0xd8
[   32.370466]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   32.370509]  kmalloc_track_caller_oob_right+0xa8/0x488
[   32.370551]  kunit_try_run_case+0x170/0x3f0
[   32.370590]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.371018]  kthread+0x328/0x630
[   32.371371]  ret_from_fork+0x10/0x20
[   32.371536] 
[   32.371627] The buggy address belongs to the object at fff00000c63fb500
[   32.371627]  which belongs to the cache kmalloc-128 of size 128
[   32.371804] The buggy address is located 0 bytes to the right of
[   32.371804]  allocated 120-byte region [fff00000c63fb500, fff00000c63fb578)
[   32.372033] 
[   32.372056] The buggy address belongs to the physical page:
[   32.372227] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1063fb
[   32.372361] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   32.372411] page_type: f5(slab)
[   32.372450] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   32.372506] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   32.372546] page dumped because: kasan: bad access detected
[   32.372575] 
[   32.372593] Memory state around the buggy address:
[   32.372786]  fff00000c63fb400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   32.373026]  fff00000c63fb480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.373117] >fff00000c63fb500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   32.373216]                                                                 ^
[   32.373295]  fff00000c63fb580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.373393]  fff00000c63fb600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.373464] ==================================================================

[   22.530716] ==================================================================
[   22.531193] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.531465] Write of size 1 at addr ffff888104950178 by task kunit_try_catch/190
[   22.532814] 
[   22.533081] CPU: 1 UID: 0 PID: 190 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   22.533137] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.533151] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   22.533173] Call Trace:
[   22.533186]  <TASK>
[   22.533205]  dump_stack_lvl+0x73/0xb0
[   22.533238]  print_report+0xd1/0x650
[   22.533261]  ? __virt_addr_valid+0x1db/0x2d0
[   22.533284]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.533321]  ? kasan_complete_mode_report_info+0x2a/0x200
[   22.533346]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.533376]  kasan_report+0x141/0x180
[   22.533397]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.533469]  __asan_report_store1_noabort+0x1b/0x30
[   22.533492]  kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.533527]  ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10
[   22.533551]  ? __schedule+0x207f/0x2b60
[   22.533572]  ? __pfx_read_tsc+0x10/0x10
[   22.533593]  ? ktime_get_ts64+0x86/0x230
[   22.533618]  kunit_try_run_case+0x1a5/0x480
[   22.533643]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.533666]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   22.533697]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   22.533718]  ? __kthread_parkme+0x82/0x180
[   22.533742]  ? preempt_count_sub+0x50/0x80
[   22.533765]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.533789]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.533812]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   22.533836]  kthread+0x337/0x6f0
[   22.533855]  ? trace_preempt_on+0x20/0xc0
[   22.533878]  ? __pfx_kthread+0x10/0x10
[   22.533898]  ? _raw_spin_unlock_irq+0x47/0x80
[   22.533921]  ? calculate_sigpending+0x7b/0xa0
[   22.533944]  ? __pfx_kthread+0x10/0x10
[   22.533964]  ret_from_fork+0x116/0x1d0
[   22.533982]  ? __pfx_kthread+0x10/0x10
[   22.534002]  ret_from_fork_asm+0x1a/0x30
[   22.534033]  </TASK>
[   22.534045] 
[   22.547890] Allocated by task 190:
[   22.548299]  kasan_save_stack+0x45/0x70
[   22.548455]  kasan_save_track+0x18/0x40
[   22.548787]  kasan_save_alloc_info+0x3b/0x50
[   22.549384]  __kasan_kmalloc+0xb7/0xc0
[   22.549802]  __kmalloc_node_track_caller_noprof+0x1cb/0x500
[   22.550225]  kmalloc_track_caller_oob_right+0x99/0x520
[   22.550402]  kunit_try_run_case+0x1a5/0x480
[   22.550560]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.551074]  kthread+0x337/0x6f0
[   22.551196]  ret_from_fork+0x116/0x1d0
[   22.551331]  ret_from_fork_asm+0x1a/0x30
[   22.551463] 
[   22.551630] The buggy address belongs to the object at ffff888104950100
[   22.551630]  which belongs to the cache kmalloc-128 of size 128
[   22.552884] The buggy address is located 0 bytes to the right of
[   22.552884]  allocated 120-byte region [ffff888104950100, ffff888104950178)
[   22.554336] 
[   22.554414] The buggy address belongs to the physical page:
[   22.554805] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104950
[   22.555505] flags: 0x200000000000000(node=0|zone=2)
[   22.555673] page_type: f5(slab)
[   22.555902] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   22.556781] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   22.557350] page dumped because: kasan: bad access detected
[   22.557911] 
[   22.558065] Memory state around the buggy address:
[   22.558620]  ffff888104950000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.558993]  ffff888104950080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.559512] >ffff888104950100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   22.560008]                                                                 ^
[   22.560209]  ffff888104950180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.560422]  ffff888104950200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.560636] ==================================================================
[   22.561824] ==================================================================
[   22.563010] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.563616] Write of size 1 at addr ffff888104950278 by task kunit_try_catch/190
[   22.564262] 
[   22.564455] CPU: 1 UID: 0 PID: 190 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   22.564504] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.564517] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   22.564538] Call Trace:
[   22.564551]  <TASK>
[   22.564569]  dump_stack_lvl+0x73/0xb0
[   22.564598]  print_report+0xd1/0x650
[   22.564620]  ? __virt_addr_valid+0x1db/0x2d0
[   22.564644]  ? kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.564667]  ? kasan_complete_mode_report_info+0x2a/0x200
[   22.564692]  ? kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.564716]  kasan_report+0x141/0x180
[   22.564736]  ? kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.564764]  __asan_report_store1_noabort+0x1b/0x30
[   22.564787]  kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.564810]  ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10
[   22.564835]  ? __schedule+0x207f/0x2b60
[   22.564856]  ? __pfx_read_tsc+0x10/0x10
[   22.564885]  ? ktime_get_ts64+0x86/0x230
[   22.564909]  kunit_try_run_case+0x1a5/0x480
[   22.564934]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.564957]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   22.564978]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   22.564999]  ? __kthread_parkme+0x82/0x180
[   22.565019]  ? preempt_count_sub+0x50/0x80
[   22.565042]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.565067]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.565090]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   22.565113]  kthread+0x337/0x6f0
[   22.565133]  ? trace_preempt_on+0x20/0xc0
[   22.565157]  ? __pfx_kthread+0x10/0x10
[   22.565177]  ? _raw_spin_unlock_irq+0x47/0x80
[   22.565200]  ? calculate_sigpending+0x7b/0xa0
[   22.565224]  ? __pfx_kthread+0x10/0x10
[   22.565244]  ret_from_fork+0x116/0x1d0
[   22.565262]  ? __pfx_kthread+0x10/0x10
[   22.565282]  ret_from_fork_asm+0x1a/0x30
[   22.565324]  </TASK>
[   22.565335] 
[   22.574571] Allocated by task 190:
[   22.574764]  kasan_save_stack+0x45/0x70
[   22.575026]  kasan_save_track+0x18/0x40
[   22.575166]  kasan_save_alloc_info+0x3b/0x50
[   22.575320]  __kasan_kmalloc+0xb7/0xc0
[   22.575445]  __kmalloc_node_track_caller_noprof+0x1cb/0x500
[   22.575633]  kmalloc_track_caller_oob_right+0x19a/0x520
[   22.576018]  kunit_try_run_case+0x1a5/0x480
[   22.576213]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.576468]  kthread+0x337/0x6f0
[   22.576603]  ret_from_fork+0x116/0x1d0
[   22.576728]  ret_from_fork_asm+0x1a/0x30
[   22.576860] 
[   22.576927] The buggy address belongs to the object at ffff888104950200
[   22.576927]  which belongs to the cache kmalloc-128 of size 128
[   22.578167] The buggy address is located 0 bytes to the right of
[   22.578167]  allocated 120-byte region [ffff888104950200, ffff888104950278)
[   22.578736] 
[   22.578881] The buggy address belongs to the physical page:
[   22.579098] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104950
[   22.579419] flags: 0x200000000000000(node=0|zone=2)
[   22.579577] page_type: f5(slab)
[   22.579745] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   22.580076] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   22.580413] page dumped because: kasan: bad access detected
[   22.580613] 
[   22.580676] Memory state around the buggy address:
[   22.580821]  ffff888104950100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.581225]  ffff888104950180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.581688] >ffff888104950200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   22.581897]                                                                 ^
[   22.582295]  ffff888104950280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.582891]  ffff888104950300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.583205] ==================================================================

[   22.747617] ==================================================================
[   22.747926] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.748358] Write of size 1 at addr ffff88810255e578 by task kunit_try_catch/191
[   22.748671] 
[   22.749082] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   22.749139] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.749153] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   22.749176] Call Trace:
[   22.749415]  <TASK>
[   22.749438]  dump_stack_lvl+0x73/0xb0
[   22.749471]  print_report+0xd1/0x650
[   22.749494]  ? __virt_addr_valid+0x1db/0x2d0
[   22.749518]  ? kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.749543]  ? kasan_complete_mode_report_info+0x2a/0x200
[   22.749570]  ? kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.749594]  kasan_report+0x141/0x180
[   22.749615]  ? kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.749645]  __asan_report_store1_noabort+0x1b/0x30
[   22.749669]  kmalloc_track_caller_oob_right+0x4b1/0x520
[   22.749692]  ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10
[   22.749717]  ? __schedule+0x10cc/0x2b60
[   22.749739]  ? __pfx_read_tsc+0x10/0x10
[   22.749761]  ? ktime_get_ts64+0x86/0x230
[   22.749786]  kunit_try_run_case+0x1a5/0x480
[   22.749812]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.749843]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   22.749865]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   22.749886]  ? __kthread_parkme+0x82/0x180
[   22.749907]  ? preempt_count_sub+0x50/0x80
[   22.749940]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.749964]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.749988]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   22.750012]  kthread+0x337/0x6f0
[   22.750032]  ? trace_preempt_on+0x20/0xc0
[   22.750054]  ? __pfx_kthread+0x10/0x10
[   22.750086]  ? _raw_spin_unlock_irq+0x47/0x80
[   22.750110]  ? calculate_sigpending+0x7b/0xa0
[   22.750134]  ? __pfx_kthread+0x10/0x10
[   22.750155]  ret_from_fork+0x116/0x1d0
[   22.750174]  ? __pfx_kthread+0x10/0x10
[   22.750247]  ret_from_fork_asm+0x1a/0x30
[   22.750280]  </TASK>
[   22.750292] 
[   22.758979] Allocated by task 191:
[   22.759398]  kasan_save_stack+0x45/0x70
[   22.759594]  kasan_save_track+0x18/0x40
[   22.759755]  kasan_save_alloc_info+0x3b/0x50
[   22.759945]  __kasan_kmalloc+0xb7/0xc0
[   22.760526]  __kmalloc_node_track_caller_noprof+0x1cb/0x500
[   22.760796]  kmalloc_track_caller_oob_right+0x19a/0x520
[   22.760988]  kunit_try_run_case+0x1a5/0x480
[   22.761282]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.761491]  kthread+0x337/0x6f0
[   22.761641]  ret_from_fork+0x116/0x1d0
[   22.761811]  ret_from_fork_asm+0x1a/0x30
[   22.761960] 
[   22.762057] The buggy address belongs to the object at ffff88810255e500
[   22.762057]  which belongs to the cache kmalloc-128 of size 128
[   22.762708] The buggy address is located 0 bytes to the right of
[   22.762708]  allocated 120-byte region [ffff88810255e500, ffff88810255e578)
[   22.763257] 
[   22.763359] The buggy address belongs to the physical page:
[   22.763560] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10255e
[   22.763849] flags: 0x200000000000000(node=0|zone=2)
[   22.764091] page_type: f5(slab)
[   22.764465] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   22.764730] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   22.765115] page dumped because: kasan: bad access detected
[   22.765370] 
[   22.765438] Memory state around the buggy address:
[   22.765639]  ffff88810255e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.765910]  ffff88810255e480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.766213] >ffff88810255e500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   22.766477]                                                                 ^
[   22.766768]  ffff88810255e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.767094]  ffff88810255e600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.767298] ==================================================================
[   22.721866] ==================================================================
[   22.722693] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.723634] Write of size 1 at addr ffff88810255e478 by task kunit_try_catch/191
[   22.724764] 
[   22.724950] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   22.725029] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.725043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   22.725091] Call Trace:
[   22.725107]  <TASK>
[   22.725127]  dump_stack_lvl+0x73/0xb0
[   22.725164]  print_report+0xd1/0x650
[   22.725203]  ? __virt_addr_valid+0x1db/0x2d0
[   22.725227]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.725252]  ? kasan_complete_mode_report_info+0x2a/0x200
[   22.725277]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.725301]  kasan_report+0x141/0x180
[   22.725322]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.725350]  __asan_report_store1_noabort+0x1b/0x30
[   22.725374]  kmalloc_track_caller_oob_right+0x4c8/0x520
[   22.725398]  ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10
[   22.725422]  ? __schedule+0x10cc/0x2b60
[   22.725443]  ? __pfx_read_tsc+0x10/0x10
[   22.725465]  ? ktime_get_ts64+0x86/0x230
[   22.725489]  kunit_try_run_case+0x1a5/0x480
[   22.725516]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.725538]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   22.725559]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   22.725580]  ? __kthread_parkme+0x82/0x180
[   22.725600]  ? preempt_count_sub+0x50/0x80
[   22.725623]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.725647]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.725670]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   22.725693]  kthread+0x337/0x6f0
[   22.725713]  ? trace_preempt_on+0x20/0xc0
[   22.725736]  ? __pfx_kthread+0x10/0x10
[   22.725755]  ? _raw_spin_unlock_irq+0x47/0x80
[   22.725779]  ? calculate_sigpending+0x7b/0xa0
[   22.725803]  ? __pfx_kthread+0x10/0x10
[   22.725830]  ret_from_fork+0x116/0x1d0
[   22.725849]  ? __pfx_kthread+0x10/0x10
[   22.725869]  ret_from_fork_asm+0x1a/0x30
[   22.725900]  </TASK>
[   22.725912] 
[   22.736417] Allocated by task 191:
[   22.736647]  kasan_save_stack+0x45/0x70
[   22.736849]  kasan_save_track+0x18/0x40
[   22.736973]  kasan_save_alloc_info+0x3b/0x50
[   22.737147]  __kasan_kmalloc+0xb7/0xc0
[   22.737348]  __kmalloc_node_track_caller_noprof+0x1cb/0x500
[   22.737659]  kmalloc_track_caller_oob_right+0x99/0x520
[   22.737922]  kunit_try_run_case+0x1a5/0x480
[   22.738152]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.738372]  kthread+0x337/0x6f0
[   22.738563]  ret_from_fork+0x116/0x1d0
[   22.738744]  ret_from_fork_asm+0x1a/0x30
[   22.738951] 
[   22.739039] The buggy address belongs to the object at ffff88810255e400
[   22.739039]  which belongs to the cache kmalloc-128 of size 128
[   22.739384] The buggy address is located 0 bytes to the right of
[   22.739384]  allocated 120-byte region [ffff88810255e400, ffff88810255e478)
[   22.739998] 
[   22.740119] The buggy address belongs to the physical page:
[   22.740485] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10255e
[   22.740730] flags: 0x200000000000000(node=0|zone=2)
[   22.741512] page_type: f5(slab)
[   22.741720] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   22.742437] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   22.742761] page dumped because: kasan: bad access detected
[   22.743288] 
[   22.743377] Memory state around the buggy address:
[   22.743836]  ffff88810255e300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.744288]  ffff88810255e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.744590] >ffff88810255e400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   22.744880]                                                                 ^
[   22.745578]  ffff88810255e480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.746029]  ffff88810255e500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.746493] ==================================================================