Date
July 8, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.490649] ================================================================== [ 31.490752] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x344/0x430 [ 31.490816] Read of size 1 at addr fff00000c9a8f0c8 by task kunit_try_catch/238 [ 31.490883] [ 31.490920] CPU: 0 UID: 0 PID: 238 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 31.491005] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.491041] Hardware name: linux,dummy-virt (DT) [ 31.491079] Call trace: [ 31.491135] show_stack+0x20/0x38 (C) [ 31.491186] dump_stack_lvl+0x8c/0xd0 [ 31.491263] print_report+0x118/0x5d0 [ 31.491544] kasan_report+0xdc/0x128 [ 31.491606] __asan_report_load1_noabort+0x20/0x30 [ 31.491701] kmem_cache_oob+0x344/0x430 [ 31.491793] kunit_try_run_case+0x170/0x3f0 [ 31.491847] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.491903] kthread+0x328/0x630 [ 31.491945] ret_from_fork+0x10/0x20 [ 31.491993] [ 31.492012] Allocated by task 238: [ 31.492040] kasan_save_stack+0x3c/0x68 [ 31.492092] kasan_save_track+0x20/0x40 [ 31.492130] kasan_save_alloc_info+0x40/0x58 [ 31.492169] __kasan_slab_alloc+0xa8/0xb0 [ 31.492219] kmem_cache_alloc_noprof+0x10c/0x398 [ 31.492259] kmem_cache_oob+0x12c/0x430 [ 31.492296] kunit_try_run_case+0x170/0x3f0 [ 31.492454] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.492542] kthread+0x328/0x630 [ 31.492578] ret_from_fork+0x10/0x20 [ 31.492648] [ 31.492694] The buggy address belongs to the object at fff00000c9a8f000 [ 31.492694] which belongs to the cache test_cache of size 200 [ 31.492777] The buggy address is located 0 bytes to the right of [ 31.492777] allocated 200-byte region [fff00000c9a8f000, fff00000c9a8f0c8) [ 31.492866] [ 31.492949] The buggy address belongs to the physical page: [ 31.492988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109a8f [ 31.493057] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.493166] page_type: f5(slab) [ 31.493245] raw: 0bfffe0000000000 fff00000c5c50a00 dead000000000122 0000000000000000 [ 31.493369] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 31.493438] page dumped because: kasan: bad access detected [ 31.493493] [ 31.493564] Memory state around the buggy address: [ 31.493613] fff00000c9a8ef80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 31.493657] fff00000c9a8f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.493727] >fff00000c9a8f080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 31.493766] ^ [ 31.493802] fff00000c9a8f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.493844] fff00000c9a8f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.493920] ==================================================================
[ 24.000934] ================================================================== [ 24.002982] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x402/0x530 [ 24.004091] Read of size 1 at addr ffff8881059c30c8 by task kunit_try_catch/255 [ 24.004434] [ 24.004533] CPU: 0 UID: 0 PID: 255 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 24.004589] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.004601] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.004625] Call Trace: [ 24.004640] <TASK> [ 24.004662] dump_stack_lvl+0x73/0xb0 [ 24.004698] print_report+0xd1/0x610 [ 24.004722] ? __virt_addr_valid+0x1db/0x2d0 [ 24.004749] ? kmem_cache_oob+0x402/0x530 [ 24.004827] ? kasan_complete_mode_report_info+0x2a/0x200 [ 24.004857] ? kmem_cache_oob+0x402/0x530 [ 24.004882] kasan_report+0x141/0x180 [ 24.004906] ? kmem_cache_oob+0x402/0x530 [ 24.004935] __asan_report_load1_noabort+0x18/0x20 [ 24.004962] kmem_cache_oob+0x402/0x530 [ 24.004985] ? trace_hardirqs_on+0x37/0xe0 [ 24.005012] ? __pfx_kmem_cache_oob+0x10/0x10 [ 24.005046] ? finish_task_switch.isra.0+0x153/0x700 [ 24.005071] ? __switch_to+0x47/0xf50 [ 24.005104] ? __pfx_read_tsc+0x10/0x10 [ 24.005130] ? ktime_get_ts64+0x86/0x230 [ 24.005158] kunit_try_run_case+0x1a5/0x480 [ 24.005183] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.005210] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.005233] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.005273] ? __kthread_parkme+0x82/0x180 [ 24.005295] ? preempt_count_sub+0x50/0x80 [ 24.005318] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.005340] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.005367] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.005394] kthread+0x337/0x6f0 [ 24.005415] ? trace_preempt_on+0x20/0xc0 [ 24.005439] ? __pfx_kthread+0x10/0x10 [ 24.005461] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.005488] ? calculate_sigpending+0x7b/0xa0 [ 24.005516] ? __pfx_kthread+0x10/0x10 [ 24.005540] ret_from_fork+0x116/0x1d0 [ 24.005559] ? __pfx_kthread+0x10/0x10 [ 24.005582] ret_from_fork_asm+0x1a/0x30 [ 24.005617] </TASK> [ 24.005629] [ 24.015744] Allocated by task 255: [ 24.016404] kasan_save_stack+0x45/0x70 [ 24.016672] kasan_save_track+0x18/0x40 [ 24.016919] kasan_save_alloc_info+0x3b/0x50 [ 24.017114] __kasan_slab_alloc+0x91/0xa0 [ 24.017303] kmem_cache_alloc_noprof+0x123/0x3f0 [ 24.017508] kmem_cache_oob+0x157/0x530 [ 24.017679] kunit_try_run_case+0x1a5/0x480 [ 24.018038] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.018288] kthread+0x337/0x6f0 [ 24.018444] ret_from_fork+0x116/0x1d0 [ 24.018612] ret_from_fork_asm+0x1a/0x30 [ 24.019316] [ 24.019397] The buggy address belongs to the object at ffff8881059c3000 [ 24.019397] which belongs to the cache test_cache of size 200 [ 24.019827] The buggy address is located 0 bytes to the right of [ 24.019827] allocated 200-byte region [ffff8881059c3000, ffff8881059c30c8) [ 24.021292] [ 24.021406] The buggy address belongs to the physical page: [ 24.021667] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059c3 [ 24.022148] flags: 0x200000000000000(node=0|zone=2) [ 24.022610] page_type: f5(slab) [ 24.022826] raw: 0200000000000000 ffff888101ea6140 dead000000000122 0000000000000000 [ 24.023153] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000 [ 24.023479] page dumped because: kasan: bad access detected [ 24.023705] [ 24.024092] Memory state around the buggy address: [ 24.024328] ffff8881059c2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.024615] ffff8881059c3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.025120] >ffff8881059c3080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 24.025428] ^ [ 24.025664] ffff8881059c3100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.026188] ffff8881059c3180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.026482] ==================================================================