Date
July 3, 2025, 10:10 a.m.
| Environment | |
|---|---|
| dragonboard-845c | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 39.705265] ================================================================== [ 39.716745] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300 [ 39.724068] Write of size 4 at addr ffff000095356175 by task kunit_try_catch/283 [ 39.731563] [ 39.733101] CPU: 4 UID: 0 PID: 283 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT [ 39.733131] Tainted: [B]=BAD_PAGE, [N]=TEST [ 39.733141] Hardware name: Thundercomm Dragonboard 845c (DT) [ 39.733152] Call trace: [ 39.733160] show_stack+0x20/0x38 (C) [ 39.733178] dump_stack_lvl+0x8c/0xd0 [ 39.733199] print_report+0x118/0x608 [ 39.733218] kasan_report+0xdc/0x128 [ 39.733237] kasan_check_range+0x100/0x1a8 [ 39.733257] __asan_memset+0x34/0x78 [ 39.733272] kmalloc_oob_memset_4+0x150/0x300 [ 39.733289] kunit_try_run_case+0x170/0x3f0 [ 39.733307] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.733329] kthread+0x328/0x630 [ 39.733342] ret_from_fork+0x10/0x20 [ 39.733358] [ 39.802129] Allocated by task 283: [ 39.805582] kasan_save_stack+0x3c/0x68 [ 39.809488] kasan_save_track+0x20/0x40 [ 39.813394] kasan_save_alloc_info+0x40/0x58 [ 39.817729] __kasan_kmalloc+0xd4/0xd8 [ 39.821546] __kmalloc_cache_noprof+0x16c/0x3c0 [ 39.826147] kmalloc_oob_memset_4+0xb0/0x300 [ 39.830486] kunit_try_run_case+0x170/0x3f0 [ 39.834737] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 39.840297] kthread+0x328/0x630 [ 39.843579] ret_from_fork+0x10/0x20 [ 39.847211] [ 39.848743] The buggy address belongs to the object at ffff000095356100 [ 39.848743] which belongs to the cache kmalloc-128 of size 128 [ 39.861399] The buggy address is located 117 bytes inside of [ 39.861399] allocated 120-byte region [ffff000095356100, ffff000095356178) [ 39.874140] [ 39.875671] The buggy address belongs to the physical page: [ 39.881319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115356 [ 39.889417] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 39.897171] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 39.904217] page_type: f5(slab) [ 39.907414] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 39.915255] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 39.923098] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000 [ 39.931024] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 39.938949] head: 0bfffe0000000001 fffffdffc254d581 00000000ffffffff 00000000ffffffff [ 39.946874] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 39.954799] page dumped because: kasan: bad access detected [ 39.960440] [ 39.961963] Memory state around the buggy address: [ 39.966817] ffff000095356000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.974133] ffff000095356080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.981447] >ffff000095356100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 39.988763] ^ [ 39.995986] ffff000095356180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.003303] ffff000095356200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.010610] ==================================================================
[ 31.094543] ================================================================== [ 31.094621] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300 [ 31.094677] Write of size 4 at addr fff00000c9ae3175 by task kunit_try_catch/206 [ 31.094733] [ 31.094766] CPU: 0 UID: 0 PID: 206 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT [ 31.094865] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.094894] Hardware name: linux,dummy-virt (DT) [ 31.094924] Call trace: [ 31.094954] show_stack+0x20/0x38 (C) [ 31.095002] dump_stack_lvl+0x8c/0xd0 [ 31.095052] print_report+0x118/0x608 [ 31.095101] kasan_report+0xdc/0x128 [ 31.095146] kasan_check_range+0x100/0x1a8 [ 31.095201] __asan_memset+0x34/0x78 [ 31.095244] kmalloc_oob_memset_4+0x150/0x300 [ 31.095300] kunit_try_run_case+0x170/0x3f0 [ 31.095357] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.095411] kthread+0x328/0x630 [ 31.095459] ret_from_fork+0x10/0x20 [ 31.095506] [ 31.095525] Allocated by task 206: [ 31.095560] kasan_save_stack+0x3c/0x68 [ 31.095602] kasan_save_track+0x20/0x40 [ 31.095646] kasan_save_alloc_info+0x40/0x58 [ 31.095692] __kasan_kmalloc+0xd4/0xd8 [ 31.095739] __kmalloc_cache_noprof+0x16c/0x3c0 [ 31.095781] kmalloc_oob_memset_4+0xb0/0x300 [ 31.095827] kunit_try_run_case+0x170/0x3f0 [ 31.096021] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.096453] kthread+0x328/0x630 [ 31.096493] ret_from_fork+0x10/0x20 [ 31.096649] [ 31.096782] The buggy address belongs to the object at fff00000c9ae3100 [ 31.096782] which belongs to the cache kmalloc-128 of size 128 [ 31.096892] The buggy address is located 117 bytes inside of [ 31.096892] allocated 120-byte region [fff00000c9ae3100, fff00000c9ae3178) [ 31.097341] [ 31.097406] The buggy address belongs to the physical page: [ 31.097903] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109ae3 [ 31.098291] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.098360] page_type: f5(slab) [ 31.098702] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 31.098824] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.099043] page dumped because: kasan: bad access detected [ 31.099219] [ 31.099399] Memory state around the buggy address: [ 31.099539] fff00000c9ae3000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.099605] fff00000c9ae3080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.099809] >fff00000c9ae3100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 31.100070] ^ [ 31.100175] fff00000c9ae3180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.100235] fff00000c9ae3200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.100584] ==================================================================
[ 23.252865] ================================================================== [ 23.253485] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x166/0x330 [ 23.253834] Write of size 4 at addr ffff888105479d75 by task kunit_try_catch/223 [ 23.254246] [ 23.254362] CPU: 1 UID: 0 PID: 223 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT(voluntary) [ 23.254623] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.254642] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.254665] Call Trace: [ 23.254677] <TASK> [ 23.254692] dump_stack_lvl+0x73/0xb0 [ 23.254810] print_report+0xd1/0x650 [ 23.254833] ? __virt_addr_valid+0x1db/0x2d0 [ 23.254857] ? kmalloc_oob_memset_4+0x166/0x330 [ 23.254877] ? kasan_complete_mode_report_info+0x2a/0x200 [ 23.254901] ? kmalloc_oob_memset_4+0x166/0x330 [ 23.254922] kasan_report+0x141/0x180 [ 23.254943] ? kmalloc_oob_memset_4+0x166/0x330 [ 23.254968] kasan_check_range+0x10c/0x1c0 [ 23.254990] __asan_memset+0x27/0x50 [ 23.255012] kmalloc_oob_memset_4+0x166/0x330 [ 23.255034] ? __pfx_kmalloc_oob_memset_4+0x10/0x10 [ 23.255055] ? __schedule+0x10cc/0x2b60 [ 23.255080] ? __pfx_read_tsc+0x10/0x10 [ 23.255101] ? ktime_get_ts64+0x86/0x230 [ 23.255124] kunit_try_run_case+0x1a5/0x480 [ 23.255157] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.255180] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.255200] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.255224] ? __kthread_parkme+0x82/0x180 [ 23.255244] ? preempt_count_sub+0x50/0x80 [ 23.255267] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.255292] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.255314] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.255337] kthread+0x337/0x6f0 [ 23.255356] ? trace_preempt_on+0x20/0xc0 [ 23.255378] ? __pfx_kthread+0x10/0x10 [ 23.255398] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.255421] ? calculate_sigpending+0x7b/0xa0 [ 23.255444] ? __pfx_kthread+0x10/0x10 [ 23.255612] ret_from_fork+0x116/0x1d0 [ 23.255634] ? __pfx_kthread+0x10/0x10 [ 23.255655] ret_from_fork_asm+0x1a/0x30 [ 23.255686] </TASK> [ 23.255697] [ 23.265926] Allocated by task 223: [ 23.266317] kasan_save_stack+0x45/0x70 [ 23.266535] kasan_save_track+0x18/0x40 [ 23.266725] kasan_save_alloc_info+0x3b/0x50 [ 23.267119] __kasan_kmalloc+0xb7/0xc0 [ 23.267450] __kmalloc_cache_noprof+0x189/0x420 [ 23.267814] kmalloc_oob_memset_4+0xac/0x330 [ 23.268044] kunit_try_run_case+0x1a5/0x480 [ 23.268219] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.268781] kthread+0x337/0x6f0 [ 23.269049] ret_from_fork+0x116/0x1d0 [ 23.269349] ret_from_fork_asm+0x1a/0x30 [ 23.269669] [ 23.269763] The buggy address belongs to the object at ffff888105479d00 [ 23.269763] which belongs to the cache kmalloc-128 of size 128 [ 23.270316] The buggy address is located 117 bytes inside of [ 23.270316] allocated 120-byte region [ffff888105479d00, ffff888105479d78) [ 23.271192] [ 23.271278] The buggy address belongs to the physical page: [ 23.271741] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105479 [ 23.272066] flags: 0x200000000000000(node=0|zone=2) [ 23.272465] page_type: f5(slab) [ 23.272798] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 23.273198] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.273648] page dumped because: kasan: bad access detected [ 23.274016] [ 23.274114] Memory state around the buggy address: [ 23.274509] ffff888105479c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.274985] ffff888105479c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.275596] >ffff888105479d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 23.275877] ^ [ 23.276368] ffff888105479d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.276764] ffff888105479e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.277308] ==================================================================