Date
July 4, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.282480] ================================================================== [ 29.282572] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 29.282624] Read of size 1 at addr fff00000c5a4897f by task kunit_try_catch/171 [ 29.282673] [ 29.282706] CPU: 0 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT [ 29.282799] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.282826] Hardware name: linux,dummy-virt (DT) [ 29.282856] Call trace: [ 29.282998] show_stack+0x20/0x38 (C) [ 29.283145] dump_stack_lvl+0x8c/0xd0 [ 29.283204] print_report+0x118/0x608 [ 29.283257] kasan_report+0xdc/0x128 [ 29.283406] __asan_report_load1_noabort+0x20/0x30 [ 29.283453] kmalloc_oob_left+0x2ec/0x320 [ 29.283498] kunit_try_run_case+0x170/0x3f0 [ 29.283598] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.283663] kthread+0x328/0x630 [ 29.283704] ret_from_fork+0x10/0x20 [ 29.283750] [ 29.283767] Allocated by task 10: [ 29.283795] kasan_save_stack+0x3c/0x68 [ 29.283837] kasan_save_track+0x20/0x40 [ 29.283874] kasan_save_alloc_info+0x40/0x58 [ 29.283920] __kasan_kmalloc+0xd4/0xd8 [ 29.283956] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 29.283999] kvasprintf+0xe0/0x180 [ 29.284035] __kthread_create_on_node+0x16c/0x350 [ 29.284074] kthread_create_on_node+0xe4/0x130 [ 29.284109] create_worker+0x380/0x6b8 [ 29.284161] worker_thread+0x808/0xf38 [ 29.284287] kthread+0x328/0x630 [ 29.284320] ret_from_fork+0x10/0x20 [ 29.284354] [ 29.284373] The buggy address belongs to the object at fff00000c5a48960 [ 29.284373] which belongs to the cache kmalloc-16 of size 16 [ 29.284428] The buggy address is located 19 bytes to the right of [ 29.284428] allocated 12-byte region [fff00000c5a48960, fff00000c5a4896c) [ 29.284489] [ 29.284508] The buggy address belongs to the physical page: [ 29.284547] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105a48 [ 29.284597] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 29.284642] page_type: f5(slab) [ 29.284968] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 29.285019] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 29.285058] page dumped because: kasan: bad access detected [ 29.285087] [ 29.285105] Memory state around the buggy address: [ 29.285144] fff00000c5a48800: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 29.285186] fff00000c5a48880: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 29.285228] >fff00000c5a48900: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc [ 29.285495] ^ [ 29.285538] fff00000c5a48980: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.285580] fff00000c5a48a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.285669] ==================================================================
[ 24.166527] ================================================================== [ 24.167774] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x361/0x3c0 [ 24.168467] Read of size 1 at addr ffff88810527f21f by task kunit_try_catch/187 [ 24.169110] [ 24.169212] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250704 #1 PREEMPT(voluntary) [ 24.169264] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.169276] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.169300] Call Trace: [ 24.169314] <TASK> [ 24.169334] dump_stack_lvl+0x73/0xb0 [ 24.169363] print_report+0xd1/0x650 [ 24.169386] ? __virt_addr_valid+0x1db/0x2d0 [ 24.169423] ? kmalloc_oob_left+0x361/0x3c0 [ 24.169444] ? kasan_complete_mode_report_info+0x64/0x200 [ 24.169470] ? kmalloc_oob_left+0x361/0x3c0 [ 24.169491] kasan_report+0x141/0x180 [ 24.169513] ? kmalloc_oob_left+0x361/0x3c0 [ 24.169539] __asan_report_load1_noabort+0x18/0x20 [ 24.169564] kmalloc_oob_left+0x361/0x3c0 [ 24.169585] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 24.169608] ? __schedule+0x10cc/0x2b60 [ 24.169633] ? __pfx_read_tsc+0x10/0x10 [ 24.169656] ? ktime_get_ts64+0x86/0x230 [ 24.169681] kunit_try_run_case+0x1a5/0x480 [ 24.169708] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.169731] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.169756] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.169781] ? __kthread_parkme+0x82/0x180 [ 24.169802] ? preempt_count_sub+0x50/0x80 [ 24.169826] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.169852] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.169877] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.169902] kthread+0x337/0x6f0 [ 24.169921] ? trace_preempt_on+0x20/0xc0 [ 24.169946] ? __pfx_kthread+0x10/0x10 [ 24.169967] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.169990] ? calculate_sigpending+0x7b/0xa0 [ 24.170015] ? __pfx_kthread+0x10/0x10 [ 24.170036] ret_from_fork+0x116/0x1d0 [ 24.170056] ? __pfx_kthread+0x10/0x10 [ 24.170076] ret_from_fork_asm+0x1a/0x30 [ 24.170110] </TASK> [ 24.170123] [ 24.184181] Allocated by task 21: [ 24.184546] kasan_save_stack+0x45/0x70 [ 24.185044] kasan_save_track+0x18/0x40 [ 24.185431] kasan_save_alloc_info+0x3b/0x50 [ 24.185582] __kasan_kmalloc+0xb7/0xc0 [ 24.185714] __kmalloc_cache_node_noprof+0x188/0x420 [ 24.185872] build_sched_domains+0x38c/0x5dd0 [ 24.186022] partition_sched_domains+0x471/0x9c0 [ 24.186233] rebuild_sched_domains_locked+0x97d/0xd50 [ 24.186530] cpuset_update_active_cpus+0x80f/0x1a90 [ 24.186727] sched_cpu_activate+0x2bf/0x330 [ 24.186871] cpuhp_invoke_callback+0x2a1/0xf00 [ 24.187212] cpuhp_thread_fun+0x2ce/0x5c0 [ 24.187447] smpboot_thread_fn+0x2bc/0x730 [ 24.187668] kthread+0x337/0x6f0 [ 24.188520] ret_from_fork+0x116/0x1d0 [ 24.188732] ret_from_fork_asm+0x1a/0x30 [ 24.188972] [ 24.189144] Freed by task 21: [ 24.189411] kasan_save_stack+0x45/0x70 [ 24.189570] kasan_save_track+0x18/0x40 [ 24.189990] kasan_save_free_info+0x3f/0x60 [ 24.190238] __kasan_slab_free+0x56/0x70 [ 24.190430] kfree+0x222/0x3f0 [ 24.190675] build_sched_domains+0x1fff/0x5dd0 [ 24.190872] partition_sched_domains+0x471/0x9c0 [ 24.191425] rebuild_sched_domains_locked+0x97d/0xd50 [ 24.191895] cpuset_update_active_cpus+0x80f/0x1a90 [ 24.192064] sched_cpu_activate+0x2bf/0x330 [ 24.192523] cpuhp_invoke_callback+0x2a1/0xf00 [ 24.193041] cpuhp_thread_fun+0x2ce/0x5c0 [ 24.193521] smpboot_thread_fn+0x2bc/0x730 [ 24.194060] kthread+0x337/0x6f0 [ 24.194227] ret_from_fork+0x116/0x1d0 [ 24.194637] ret_from_fork_asm+0x1a/0x30 [ 24.194810] [ 24.194895] The buggy address belongs to the object at ffff88810527f200 [ 24.194895] which belongs to the cache kmalloc-16 of size 16 [ 24.196319] The buggy address is located 15 bytes to the right of [ 24.196319] allocated 16-byte region [ffff88810527f200, ffff88810527f210) [ 24.197279] [ 24.197568] The buggy address belongs to the physical page: [ 24.198066] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10527f [ 24.198451] flags: 0x200000000000000(node=0|zone=2) [ 24.198614] page_type: f5(slab) [ 24.198734] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122 [ 24.199342] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 24.200200] page dumped because: kasan: bad access detected [ 24.200774] [ 24.200955] Memory state around the buggy address: [ 24.201547] ffff88810527f100: 00 06 fc fc 00 06 fc fc fa fb fc fc 00 00 fc fc [ 24.202290] ffff88810527f180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 24.202682] >ffff88810527f200: fa fb fc fc 00 07 fc fc fc fc fc fc fc fc fc fc [ 24.202907] ^ [ 24.203037] ffff88810527f280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.203663] ffff88810527f300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.204477] ==================================================================