Hay
Date
July 10, 2025, 9:07 a.m.

Environment
qemu-arm64
qemu-x86_64

[   29.470115] ==================================================================
[   29.470191] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x144/0x2d0
[   29.470243] Write of size 128 at addr fff00000c5a4df00 by task kunit_try_catch/201
[   29.470293] 
[   29.470403] CPU: 0 UID: 0 PID: 201 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5-next-20250710 #1 PREEMPT 
[   29.470731] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.470818] Hardware name: linux,dummy-virt (DT)
[   29.470854] Call trace:
[   29.470894]  show_stack+0x20/0x38 (C)
[   29.471002]  dump_stack_lvl+0x8c/0xd0
[   29.471047]  print_report+0x118/0x5d0
[   29.471088]  kasan_report+0xdc/0x128
[   29.471139]  kasan_check_range+0x100/0x1a8
[   29.471183]  __asan_memset+0x34/0x78
[   29.471235]  kmalloc_oob_in_memset+0x144/0x2d0
[   29.471292]  kunit_try_run_case+0x170/0x3f0
[   29.471340]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.471409]  kthread+0x328/0x630
[   29.471449]  ret_from_fork+0x10/0x20
[   29.471497] 
[   29.471523] Allocated by task 201:
[   29.471550]  kasan_save_stack+0x3c/0x68
[   29.471684]  kasan_save_track+0x20/0x40
[   29.471724]  kasan_save_alloc_info+0x40/0x58
[   29.472152]  __kasan_kmalloc+0xd4/0xd8
[   29.472197]  __kmalloc_cache_noprof+0x16c/0x3c0
[   29.472236]  kmalloc_oob_in_memset+0xb0/0x2d0
[   29.472274]  kunit_try_run_case+0x170/0x3f0
[   29.472312]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.472395]  kthread+0x328/0x630
[   29.472547]  ret_from_fork+0x10/0x20
[   29.472697] 
[   29.472718] The buggy address belongs to the object at fff00000c5a4df00
[   29.472718]  which belongs to the cache kmalloc-128 of size 128
[   29.472821] The buggy address is located 0 bytes inside of
[   29.472821]  allocated 120-byte region [fff00000c5a4df00, fff00000c5a4df78)
[   29.472991] 
[   29.473094] The buggy address belongs to the physical page:
[   29.473125] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105a4d
[   29.473187] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   29.473235] page_type: f5(slab)
[   29.473273] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   29.473322] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   29.473373] page dumped because: kasan: bad access detected
[   29.473403] 
[   29.473422] Memory state around the buggy address:
[   29.473464]  fff00000c5a4de00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   29.473507]  fff00000c5a4de80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.473549] >fff00000c5a4df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   29.473587]                                                                 ^
[   29.473626]  fff00000c5a4df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.473678]  fff00000c5a4e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   29.473717] ==================================================================

[   25.079242] ==================================================================
[   25.079615] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x15f/0x320
[   25.080546] Write of size 128 at addr ffff888105182900 by task kunit_try_catch/218
[   25.081618] 
[   25.082003] CPU: 1 UID: 0 PID: 218 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5-next-20250710 #1 PREEMPT(voluntary) 
[   25.082061] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.082074] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   25.082097] Call Trace:
[   25.082112]  <TASK>
[   25.082132]  dump_stack_lvl+0x73/0xb0
[   25.082165]  print_report+0xd1/0x610
[   25.082190]  ? __virt_addr_valid+0x1db/0x2d0
[   25.082216]  ? kmalloc_oob_in_memset+0x15f/0x320
[   25.082239]  ? kasan_complete_mode_report_info+0x2a/0x200
[   25.082265]  ? kmalloc_oob_in_memset+0x15f/0x320
[   25.082288]  kasan_report+0x141/0x180
[   25.082311]  ? kmalloc_oob_in_memset+0x15f/0x320
[   25.082338]  kasan_check_range+0x10c/0x1c0
[   25.082362]  __asan_memset+0x27/0x50
[   25.082386]  kmalloc_oob_in_memset+0x15f/0x320
[   25.082409]  ? __pfx_kmalloc_oob_in_memset+0x10/0x10
[   25.082433]  ? __schedule+0x10cc/0x2b60
[   25.082457]  ? __pfx_read_tsc+0x10/0x10
[   25.082479]  ? ktime_get_ts64+0x86/0x230
[   25.082684]  kunit_try_run_case+0x1a5/0x480
[   25.082735]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.082757]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   25.082831]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   25.082859]  ? __kthread_parkme+0x82/0x180
[   25.082881]  ? preempt_count_sub+0x50/0x80
[   25.082906]  ? __pfx_kunit_try_run_case+0x10/0x10
[   25.082929]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.082955]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   25.082981]  kthread+0x337/0x6f0
[   25.083001]  ? trace_preempt_on+0x20/0xc0
[   25.083026]  ? __pfx_kthread+0x10/0x10
[   25.083048]  ? _raw_spin_unlock_irq+0x47/0x80
[   25.083070]  ? calculate_sigpending+0x7b/0xa0
[   25.083096]  ? __pfx_kthread+0x10/0x10
[   25.083118]  ret_from_fork+0x116/0x1d0
[   25.083137]  ? __pfx_kthread+0x10/0x10
[   25.083158]  ret_from_fork_asm+0x1a/0x30
[   25.083191]  </TASK>
[   25.083203] 
[   25.095478] Allocated by task 218:
[   25.095807]  kasan_save_stack+0x45/0x70
[   25.096270]  kasan_save_track+0x18/0x40
[   25.096459]  kasan_save_alloc_info+0x3b/0x50
[   25.096897]  __kasan_kmalloc+0xb7/0xc0
[   25.097244]  __kmalloc_cache_noprof+0x189/0x420
[   25.097598]  kmalloc_oob_in_memset+0xac/0x320
[   25.097761]  kunit_try_run_case+0x1a5/0x480
[   25.098326]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   25.098927]  kthread+0x337/0x6f0
[   25.099179]  ret_from_fork+0x116/0x1d0
[   25.099312]  ret_from_fork_asm+0x1a/0x30
[   25.099450] 
[   25.099562] The buggy address belongs to the object at ffff888105182900
[   25.099562]  which belongs to the cache kmalloc-128 of size 128
[   25.100936] The buggy address is located 0 bytes inside of
[   25.100936]  allocated 120-byte region [ffff888105182900, ffff888105182978)
[   25.101906] 
[   25.102090] The buggy address belongs to the physical page:
[   25.102607] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105182
[   25.103237] flags: 0x200000000000000(node=0|zone=2)
[   25.103406] page_type: f5(slab)
[   25.103546] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   25.104370] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   25.105266] page dumped because: kasan: bad access detected
[   25.105752] 
[   25.106056] Memory state around the buggy address:
[   25.106275]  ffff888105182800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   25.106489]  ffff888105182880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.107217] >ffff888105182900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   25.108008]                                                                 ^
[   25.108459]  ffff888105182980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.109175]  ffff888105182a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.109670] ==================================================================