lkft/linux-next-master - next-20250711 - log-parser-boot/kasan-bug-kasan-slab-out-of-bounds-in-kmalloc_large_oob_right

Date

July 11, 2025, 10:11 a.m.

Environment
e850-96
qemu-arm64
qemu-x86_64

[   38.294314] ==================================================================
[   38.303645] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x278/0x2b8
[   38.311106] Write of size 1 at addr ffff000805b3e00a by task kunit_try_catch/230
[   38.318481] 
[   38.319967] CPU: 3 UID: 0 PID: 230 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5-next-20250711 #1 PREEMPT 
[   38.320026] Tainted: [B]=BAD_PAGE, [N]=TEST
[   38.320040] Hardware name: WinLink E850-96 board (DT)
[   38.320061] Call trace:
[   38.320074]  show_stack+0x20/0x38 (C)
[   38.320112]  dump_stack_lvl+0x8c/0xd0
[   38.320145]  print_report+0x118/0x5d0
[   38.320176]  kasan_report+0xdc/0x128
[   38.320203]  __asan_report_store1_noabort+0x20/0x30
[   38.320239]  kmalloc_large_oob_right+0x278/0x2b8
[   38.320274]  kunit_try_run_case+0x170/0x3f0
[   38.320312]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.320343]  kthread+0x328/0x630
[   38.320372]  ret_from_fork+0x10/0x20
[   38.320407] 
[   38.384543] The buggy address belongs to the physical page:
[   38.390098] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x885b3c
[   38.398082] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   38.405722] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   38.412664] page_type: f8(unknown)
[   38.416061] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   38.423781] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   38.431509] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   38.439319] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   38.447132] head: 0bfffe0000000002 fffffdffe016cf01 00000000ffffffff 00000000ffffffff
[   38.454944] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   38.462749] page dumped because: kasan: bad access detected
[   38.468305] 
[   38.469780] Memory state around the buggy address:
[   38.474561]  ffff000805b3df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   38.481765]  ffff000805b3df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   38.488971] >ffff000805b3e000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   38.496169]                       ^
[   38.499645]  ffff000805b3e080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   38.506849]  ffff000805b3e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   38.514051] ==================================================================

Metadata Full log Test run details

[   30.119275] ==================================================================
[   30.119936] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x278/0x2b8
[   30.120025] Write of size 1 at addr fff00000c9a0e00a by task kunit_try_catch/177
[   30.120180] 
[   30.120225] CPU: 1 UID: 0 PID: 177 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5-next-20250711 #1 PREEMPT 
[   30.120369] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.120429] Hardware name: linux,dummy-virt (DT)
[   30.120463] Call trace:
[   30.120488]  show_stack+0x20/0x38 (C)
[   30.120698]  dump_stack_lvl+0x8c/0xd0
[   30.120767]  print_report+0x118/0x5d0
[   30.120863]  kasan_report+0xdc/0x128
[   30.120930]  __asan_report_store1_noabort+0x20/0x30
[   30.121030]  kmalloc_large_oob_right+0x278/0x2b8
[   30.121098]  kunit_try_run_case+0x170/0x3f0
[   30.121147]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.121213]  kthread+0x328/0x630
[   30.121258]  ret_from_fork+0x10/0x20
[   30.121520] 
[   30.121727] The buggy address belongs to the physical page:
[   30.121776] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109a0c
[   30.121893] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   30.121960] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   30.122026] page_type: f8(unknown)
[   30.122192] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   30.122241] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   30.122448] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   30.122582] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   30.122677] head: 0bfffe0000000002 ffffc1ffc3268301 00000000ffffffff 00000000ffffffff
[   30.122805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   30.122843] page dumped because: kasan: bad access detected
[   30.123020] 
[   30.123053] Memory state around the buggy address:
[   30.123087]  fff00000c9a0df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   30.123130]  fff00000c9a0df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   30.123226] >fff00000c9a0e000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   30.123309]                       ^
[   30.123426]  fff00000c9a0e080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   30.123478]  fff00000c9a0e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   30.123743] ==================================================================

Metadata Full log Test run details

arch

arm64

host

x86_64

plan

2zizK5DpLdiSo5JTRmUPvSCnGxG

job_id

TEST:linaro@lkft#2zizOeD8Jm6gvF6WEX3HpY0Yiv3

job_url

https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2zizOeD8Jm6gvF6WEX3HpY0Yiv3

artefacts

kernel

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2zizLHXy0YY4Eb3Uvf7RBZBjPJe/Image.gz
sha256sum	37d9d8f3bf88d1e931fe46cf36571593b5a433a5d7333af6ff92cab414d2ee0c

rootfs

url	https://storage.tuxboot.com/debian/20250617/trixie/arm64/rootfs.ext4.xz
sha256sum	1eaaae772692e22cefec5345d642e254407cec1431dd51a20007af2a1819b610

modules

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2zizLHXy0YY4Eb3Uvf7RBZBjPJe/modules.tar.xz
sha256sum	f716ec16fb4ddf54116cb1eb73ee916ed3bd359ff95e4d969af9a161c3cb0a9f

durations

tests

boot	0
kunit	172.65

host_arch

amd64

build_name

gcc-13-lkftconfig-kunit

job_status

Complete

qemu_version

1:10.0.0+ds-1

[   23.234173] ==================================================================
[   23.235064] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x2e9/0x330
[   23.235555] Write of size 1 at addr ffff888102b9600a by task kunit_try_catch/196
[   23.236646] 
[   23.236870] CPU: 1 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5-next-20250711 #1 PREEMPT(voluntary) 
[   23.236925] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.236957] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.236979] Call Trace:
[   23.236994]  <TASK>
[   23.237013]  dump_stack_lvl+0x73/0xb0
[   23.237046]  print_report+0xd1/0x610
[   23.237068]  ? __virt_addr_valid+0x1db/0x2d0
[   23.237092]  ? kmalloc_large_oob_right+0x2e9/0x330
[   23.237114]  ? kasan_addr_to_slab+0x11/0xa0
[   23.237135]  ? kmalloc_large_oob_right+0x2e9/0x330
[   23.237156]  kasan_report+0x141/0x180
[   23.237177]  ? kmalloc_large_oob_right+0x2e9/0x330
[   23.237203]  __asan_report_store1_noabort+0x1b/0x30
[   23.237226]  kmalloc_large_oob_right+0x2e9/0x330
[   23.237247]  ? __pfx_kmalloc_large_oob_right+0x10/0x10
[   23.237328]  ? __schedule+0x10cc/0x2b60
[   23.237355]  ? __pfx_read_tsc+0x10/0x10
[   23.237377]  ? ktime_get_ts64+0x86/0x230
[   23.237402]  kunit_try_run_case+0x1a5/0x480
[   23.237435]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.237455]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.237477]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.237500]  ? __kthread_parkme+0x82/0x180
[   23.237523]  ? preempt_count_sub+0x50/0x80
[   23.237547]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.237568]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.237594]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.237618]  kthread+0x337/0x6f0
[   23.237638]  ? trace_preempt_on+0x20/0xc0
[   23.237661]  ? __pfx_kthread+0x10/0x10
[   23.237681]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.237702]  ? calculate_sigpending+0x7b/0xa0
[   23.237727]  ? __pfx_kthread+0x10/0x10
[   23.237759]  ret_from_fork+0x116/0x1d0
[   23.237778]  ? __pfx_kthread+0x10/0x10
[   23.237798]  ret_from_fork_asm+0x1a/0x30
[   23.237828]  </TASK>
[   23.237840] 
[   23.250840] The buggy address belongs to the physical page:
[   23.251019] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b94
[   23.251259] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   23.252124] flags: 0x200000000000040(head|node=0|zone=2)
[   23.252745] page_type: f8(unknown)
[   23.253087] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   23.253862] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   23.254611] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   23.255022] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   23.255248] head: 0200000000000002 ffffea00040ae501 00000000ffffffff 00000000ffffffff
[   23.256134] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   23.256982] page dumped because: kasan: bad access detected
[   23.257546] 
[   23.257669] Memory state around the buggy address:
[   23.257835]  ffff888102b95f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   23.258044]  ffff888102b95f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   23.258249] >ffff888102b96000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.259193]                       ^
[   23.259684]  ffff888102b96080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.260431]  ffff888102b96100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.261045] ==================================================================

Metadata Full log Test run details

arch

x86_64

host

x86_64

plan

2zizK5DpLdiSo5JTRmUPvSCnGxG

job_id

TEST:linaro@lkft#2zizPosnQ5rY23goGLqjSSGUMDT

job_url

https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2zizPosnQ5rY23goGLqjSSGUMDT

artefacts

kernel

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2zizMF2TFo5wqp9ExxxKcu7DMgd/bzImage
sha256sum	0b86f8183e71d185ecf48e91daf338a38748221ed84c99d5fcc0aff2fb4fe4d2

rootfs

url	https://storage.tuxboot.com/debian/20250617/trixie/amd64/rootfs.ext4.xz
sha256sum	a7dcdb286e1265c85a4d6cd5429adc51604a3ebde1d9a3c934aef78862d5fee4

modules

url	https://storage.tuxsuite.com/public/linaro/lkft/builds/2zizMF2TFo5wqp9ExxxKcu7DMgd/modules.tar.xz
sha256sum	1cecf8a22d53cbe6f1135ddb095fc53e6fe8ebbda902547c47910320c1d5aa61

durations

tests

boot	0
kunit	220.78

host_arch

amd64

build_name

gcc-13-lkftconfig-kunit

job_status

Complete

qemu_version

1:10.0.0+ds-1

Metadata

Failure - e850-96 - gcc-13-lkftconfig-kunit

Failure - qemu-arm64 - gcc-13-lkftconfig-kunit

Failure - qemu-x86_64 - gcc-13-lkftconfig-kunit