Date
July 9, 2025, 1:08 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.051509] ================================================================== [ 29.051587] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 29.051678] Write of size 1 at addr fff00000c667df00 by task kunit_try_catch/176 [ 29.051818] [ 29.051859] CPU: 0 UID: 0 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250709 #1 PREEMPT [ 29.052123] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.052233] Hardware name: linux,dummy-virt (DT) [ 29.052322] Call trace: [ 29.052345] show_stack+0x20/0x38 (C) [ 29.052396] dump_stack_lvl+0x8c/0xd0 [ 29.052462] print_report+0x118/0x5d0 [ 29.052717] kasan_report+0xdc/0x128 [ 29.052812] __asan_report_store1_noabort+0x20/0x30 [ 29.052940] kmalloc_big_oob_right+0x2a4/0x2f0 [ 29.053063] kunit_try_run_case+0x170/0x3f0 [ 29.053184] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.053279] kthread+0x328/0x630 [ 29.053586] ret_from_fork+0x10/0x20 [ 29.053778] [ 29.053874] Allocated by task 176: [ 29.053930] kasan_save_stack+0x3c/0x68 [ 29.053995] kasan_save_track+0x20/0x40 [ 29.054033] kasan_save_alloc_info+0x40/0x58 [ 29.054382] __kasan_kmalloc+0xd4/0xd8 [ 29.054495] __kmalloc_cache_noprof+0x16c/0x3c0 [ 29.054654] kmalloc_big_oob_right+0xb8/0x2f0 [ 29.054753] kunit_try_run_case+0x170/0x3f0 [ 29.054890] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.054951] kthread+0x328/0x630 [ 29.054983] ret_from_fork+0x10/0x20 [ 29.055258] [ 29.055384] The buggy address belongs to the object at fff00000c667c000 [ 29.055384] which belongs to the cache kmalloc-8k of size 8192 [ 29.055510] The buggy address is located 0 bytes to the right of [ 29.055510] allocated 7936-byte region [fff00000c667c000, fff00000c667df00) [ 29.055572] [ 29.055591] The buggy address belongs to the physical page: [ 29.055646] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106678 [ 29.055697] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.055861] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.056003] page_type: f5(slab) [ 29.056128] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 29.056230] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 29.056298] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 29.056375] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 29.056423] head: 0bfffe0000000003 ffffc1ffc3199e01 00000000ffffffff 00000000ffffffff [ 29.056668] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 29.056758] page dumped because: kasan: bad access detected [ 29.056789] [ 29.056807] Memory state around the buggy address: [ 29.056929] fff00000c667de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.057158] fff00000c667de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.057392] >fff00000c667df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.057433] ^ [ 29.057683] fff00000c667df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.057809] fff00000c667e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.057941] ==================================================================
[ 23.610160] ================================================================== [ 23.611489] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 23.612254] Write of size 1 at addr ffff888106191f00 by task kunit_try_catch/194 [ 23.612817] [ 23.613052] CPU: 1 UID: 0 PID: 194 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc5-next-20250709 #1 PREEMPT(voluntary) [ 23.613109] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 23.613123] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.613144] Call Trace: [ 23.613158] <TASK> [ 23.613180] dump_stack_lvl+0x73/0xb0 [ 23.613212] print_report+0xd1/0x610 [ 23.613235] ? __virt_addr_valid+0x1db/0x2d0 [ 23.613260] ? kmalloc_big_oob_right+0x316/0x370 [ 23.613304] ? kasan_complete_mode_report_info+0x2a/0x200 [ 23.613331] ? kmalloc_big_oob_right+0x316/0x370 [ 23.613353] kasan_report+0x141/0x180 [ 23.613374] ? kmalloc_big_oob_right+0x316/0x370 [ 23.613401] __asan_report_store1_noabort+0x1b/0x30 [ 23.613425] kmalloc_big_oob_right+0x316/0x370 [ 23.613446] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 23.613471] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 23.613496] kunit_try_run_case+0x1a5/0x480 [ 23.613519] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.613538] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.613562] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.613585] ? __kthread_parkme+0x82/0x180 [ 23.613606] ? preempt_count_sub+0x50/0x80 [ 23.613629] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.613650] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.613674] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.613709] kthread+0x337/0x6f0 [ 23.613728] ? trace_preempt_on+0x20/0xc0 [ 23.613751] ? __pfx_kthread+0x10/0x10 [ 23.613792] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.613815] ? calculate_sigpending+0x7b/0xa0 [ 23.613839] ? __pfx_kthread+0x10/0x10 [ 23.613860] ret_from_fork+0x116/0x1d0 [ 23.613896] ? __pfx_kthread+0x10/0x10 [ 23.613918] ret_from_fork_asm+0x1a/0x30 [ 23.613949] </TASK> [ 23.613962] [ 23.625052] Allocated by task 194: [ 23.625363] kasan_save_stack+0x45/0x70 [ 23.625715] kasan_save_track+0x18/0x40 [ 23.626084] kasan_save_alloc_info+0x3b/0x50 [ 23.626376] __kasan_kmalloc+0xb7/0xc0 [ 23.626502] __kmalloc_cache_noprof+0x189/0x420 [ 23.626654] kmalloc_big_oob_right+0xa9/0x370 [ 23.626821] kunit_try_run_case+0x1a5/0x480 [ 23.627051] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.627228] kthread+0x337/0x6f0 [ 23.627342] ret_from_fork+0x116/0x1d0 [ 23.627468] ret_from_fork_asm+0x1a/0x30 [ 23.627599] [ 23.627663] The buggy address belongs to the object at ffff888106190000 [ 23.627663] which belongs to the cache kmalloc-8k of size 8192 [ 23.628829] The buggy address is located 0 bytes to the right of [ 23.628829] allocated 7936-byte region [ffff888106190000, ffff888106191f00) [ 23.630120] [ 23.630284] The buggy address belongs to the physical page: [ 23.630762] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106190 [ 23.631619] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.631907] flags: 0x200000000000040(head|node=0|zone=2) [ 23.632237] page_type: f5(slab) [ 23.632407] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 23.632711] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 23.633036] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 23.633421] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 23.633666] head: 0200000000000003 ffffea0004186401 00000000ffffffff 00000000ffffffff [ 23.634211] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 23.634614] page dumped because: kasan: bad access detected [ 23.634872] [ 23.634969] Memory state around the buggy address: [ 23.635147] ffff888106191e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.635420] ffff888106191e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.635729] >ffff888106191f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.636056] ^ [ 23.636216] ffff888106191f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.636490] ffff888106192000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.636806] ==================================================================