Date
July 14, 2025, 10:38 a.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 36.858018] ================================================================== [ 36.867155] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 36.874006] Read of size 1 at addr ffff000804b5a03f by task kunit_try_catch/222 [ 36.881298] [ 36.882784] CPU: 2 UID: 0 PID: 222 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250714 #1 PREEMPT [ 36.882836] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.882852] Hardware name: WinLink E850-96 board (DT) [ 36.882874] Call trace: [ 36.882887] show_stack+0x20/0x38 (C) [ 36.882924] dump_stack_lvl+0x8c/0xd0 [ 36.882959] print_report+0x118/0x5d0 [ 36.882986] kasan_report+0xdc/0x128 [ 36.883013] __asan_report_load1_noabort+0x20/0x30 [ 36.883046] kmalloc_oob_left+0x2ec/0x320 [ 36.883077] kunit_try_run_case+0x170/0x3f0 [ 36.883113] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.883144] kthread+0x328/0x630 [ 36.883175] ret_from_fork+0x10/0x20 [ 36.883211] [ 36.946664] Allocated by task 152: [ 36.950050] kasan_save_stack+0x3c/0x68 [ 36.953867] kasan_save_track+0x20/0x40 [ 36.957687] kasan_save_alloc_info+0x40/0x58 [ 36.961939] __kasan_kmalloc+0xd4/0xd8 [ 36.965671] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 36.971227] kvasprintf+0xe0/0x180 [ 36.974612] kasprintf+0xd0/0x110 [ 36.977910] miscdev_test_can_open+0xac/0x2c8 [ 36.982251] miscdev_test_conflict+0x1e0/0x338 [ 36.986678] kunit_try_run_case+0x170/0x3f0 [ 36.990846] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 36.996313] kthread+0x328/0x630 [ 36.999525] ret_from_fork+0x10/0x20 [ 37.003084] [ 37.004561] Freed by task 152: [ 37.007601] kasan_save_stack+0x3c/0x68 [ 37.011417] kasan_save_track+0x20/0x40 [ 37.015238] kasan_save_free_info+0x4c/0x78 [ 37.019403] __kasan_slab_free+0x6c/0x98 [ 37.023309] kfree+0x214/0x3c8 [ 37.026347] miscdev_test_can_open+0x138/0x2c8 [ 37.030774] miscdev_test_conflict+0x1e0/0x338 [ 37.035201] kunit_try_run_case+0x170/0x3f0 [ 37.039368] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 37.044837] kthread+0x328/0x630 [ 37.048050] ret_from_fork+0x10/0x20 [ 37.051607] [ 37.053086] The buggy address belongs to the object at ffff000804b5a020 [ 37.053086] which belongs to the cache kmalloc-16 of size 16 [ 37.065413] The buggy address is located 15 bytes to the right of [ 37.065413] allocated 16-byte region [ffff000804b5a020, ffff000804b5a030) [ 37.078343] [ 37.079821] The buggy address belongs to the physical page: [ 37.085378] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x884b5a [ 37.093365] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.099872] page_type: f5(slab) [ 37.103009] raw: 0bfffe0000000000 ffff000800002640 dead000000000122 0000000000000000 [ 37.110728] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 37.118448] page dumped because: kasan: bad access detected [ 37.124002] [ 37.125478] Memory state around the buggy address: [ 37.130259] ffff000804b59f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.137460] ffff000804b59f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 37.144667] >ffff000804b5a000: fa fb fc fc fa fb fc fc 00 07 fc fc fc fc fc fc [ 37.151866] ^ [ 37.156904] ffff000804b5a080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.164109] ffff000804b5a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.171312] ==================================================================
[ 29.299790] ================================================================== [ 29.299880] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 29.299936] Read of size 1 at addr fff00000c64c1a5f by task kunit_try_catch/169 [ 29.300012] [ 29.300207] CPU: 0 UID: 0 PID: 169 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250714 #1 PREEMPT [ 29.300374] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.300497] Hardware name: linux,dummy-virt (DT) [ 29.300550] Call trace: [ 29.300609] show_stack+0x20/0x38 (C) [ 29.300695] dump_stack_lvl+0x8c/0xd0 [ 29.300772] print_report+0x118/0x5d0 [ 29.300815] kasan_report+0xdc/0x128 [ 29.300894] __asan_report_load1_noabort+0x20/0x30 [ 29.300941] kmalloc_oob_left+0x2ec/0x320 [ 29.300985] kunit_try_run_case+0x170/0x3f0 [ 29.301032] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.301093] kthread+0x328/0x630 [ 29.301134] ret_from_fork+0x10/0x20 [ 29.301182] [ 29.301200] Allocated by task 110: [ 29.301229] kasan_save_stack+0x3c/0x68 [ 29.301268] kasan_save_track+0x20/0x40 [ 29.301305] kasan_save_alloc_info+0x40/0x58 [ 29.301340] __kasan_kmalloc+0xd4/0xd8 [ 29.301375] __kmalloc_noprof+0x198/0x4c8 [ 29.301412] kunit_kmalloc_array+0x34/0x88 [ 29.301448] test_readerwriter+0x3b0/0x948 [ 29.301623] kunit_try_run_case+0x170/0x3f0 [ 29.301669] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.301797] kthread+0x328/0x630 [ 29.301916] ret_from_fork+0x10/0x20 [ 29.302013] [ 29.302148] The buggy address belongs to the object at fff00000c64c1a40 [ 29.302148] which belongs to the cache kmalloc-16 of size 16 [ 29.302223] The buggy address is located 15 bytes to the right of [ 29.302223] allocated 16-byte region [fff00000c64c1a40, fff00000c64c1a50) [ 29.302512] [ 29.302577] The buggy address belongs to the physical page: [ 29.302625] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c64c1a40 pfn:0x1064c1 [ 29.302758] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 29.302896] page_type: f5(slab) [ 29.302959] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 29.303311] raw: fff00000c64c1a40 000000008080007f 00000000f5000000 0000000000000000 [ 29.303423] page dumped because: kasan: bad access detected [ 29.303571] [ 29.303655] Memory state around the buggy address: [ 29.303688] fff00000c64c1900: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 29.303784] fff00000c64c1980: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 29.304070] >fff00000c64c1a00: fa fb fc fc fa fb fc fc fa fb fc fc 00 07 fc fc [ 29.304110] ^ [ 29.304154] fff00000c64c1a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.304432] fff00000c64c1b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.304566] ==================================================================
[ 23.529758] ================================================================== [ 23.530487] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x361/0x3c0 [ 23.531085] Read of size 1 at addr ffff8881058420bf by task kunit_try_catch/187 [ 23.531572] [ 23.532049] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary) [ 23.532109] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.532122] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.532145] Call Trace: [ 23.532162] <TASK> [ 23.532181] dump_stack_lvl+0x73/0xb0 [ 23.532217] print_report+0xd1/0x610 [ 23.532239] ? __virt_addr_valid+0x1db/0x2d0 [ 23.532263] ? kmalloc_oob_left+0x361/0x3c0 [ 23.532283] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.532307] ? kmalloc_oob_left+0x361/0x3c0 [ 23.532327] kasan_report+0x141/0x180 [ 23.532347] ? kmalloc_oob_left+0x361/0x3c0 [ 23.532371] __asan_report_load1_noabort+0x18/0x20 [ 23.532395] kmalloc_oob_left+0x361/0x3c0 [ 23.532416] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 23.532437] ? __schedule+0x10cc/0x2b60 [ 23.532460] ? __pfx_read_tsc+0x10/0x10 [ 23.532483] ? ktime_get_ts64+0x86/0x230 [ 23.532509] kunit_try_run_case+0x1a5/0x480 [ 23.532533] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.532553] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.532575] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.532598] ? __kthread_parkme+0x82/0x180 [ 23.532620] ? preempt_count_sub+0x50/0x80 [ 23.532643] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.532675] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.532699] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.532723] kthread+0x337/0x6f0 [ 23.532742] ? trace_preempt_on+0x20/0xc0 [ 23.532768] ? __pfx_kthread+0x10/0x10 [ 23.532787] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.532808] ? calculate_sigpending+0x7b/0xa0 [ 23.532831] ? __pfx_kthread+0x10/0x10 [ 23.532852] ret_from_fork+0x116/0x1d0 [ 23.532870] ? __pfx_kthread+0x10/0x10 [ 23.532890] ret_from_fork_asm+0x1a/0x30 [ 23.532920] </TASK> [ 23.532931] [ 23.543529] Allocated by task 119: [ 23.543947] kasan_save_stack+0x45/0x70 [ 23.544266] kasan_save_track+0x18/0x40 [ 23.544549] kasan_save_alloc_info+0x3b/0x50 [ 23.544916] __kasan_kmalloc+0xb7/0xc0 [ 23.545228] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 23.545550] kvasprintf+0xc5/0x150 [ 23.545889] kasprintf+0xb6/0xf0 [ 23.546238] miscdev_test_can_open+0x9a/0x2e0 [ 23.546401] miscdev_test_collision_reverse+0x402/0x750 [ 23.546648] kunit_try_run_case+0x1a5/0x480 [ 23.547231] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.547446] kthread+0x337/0x6f0 [ 23.547815] ret_from_fork+0x116/0x1d0 [ 23.548167] ret_from_fork_asm+0x1a/0x30 [ 23.548491] [ 23.548608] Freed by task 92545664: [ 23.549340] ------------[ cut here ]------------ [ 23.549572] pool index 100480 out of bounds (155) for stack id ffff8881 [ 23.550806] WARNING: lib/stackdepot.c:451 at depot_fetch_stack+0x62/0x80, CPU#1: kunit_try_catch/187 [ 23.551741] Modules linked in: [ 23.552078] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary) [ 23.552866] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.553360] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.554070] RIP: 0010:depot_fetch_stack+0x62/0x80 [ 23.554800] Code: d2 74 05 c3 cc cc cc cc 90 0f 0b 90 31 c0 e9 d5 25 69 02 55 48 89 e5 90 89 f9 44 89 c2 48 c7 c7 90 c9 99 95 e8 9f d7 ba fe 90 <0f> 0b 90 90 31 c0 5d c3 cc cc cc cc 90 0f 0b 90 31 c0 c3 cc cc cc [ 23.555800] RSP: 0000:ffff888106127b28 EFLAGS: 00010082 [ 23.556354] RAX: 0000000000000000 RBX: ffff888106127b50 RCX: 1ffffffff2ba4bc0 [ 23.556788] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 23.557468] RBP: ffff888106127b28 R08: 0000000000000000 R09: fffffbfff2ba4bc0 [ 23.558099] R10: 0000000000000003 R11: 0000000000000001 R12: ffff8881058420bf [ 23.558686] R13: ffff888106168000 R14: ffffea0004161080 R15: 0000000000000001 [ 23.559288] FS: 0000000000000000(0000) GS:ffff8881bd71a000(0000) knlGS:0000000000000000 [ 23.559775] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.560238] CR2: 0000000000000000 CR3: 0000000160ebc000 CR4: 00000000000006f0 [ 23.560668] DR0: ffffffff970ac504 DR1: ffffffff970ac509 DR2: ffffffff970ac50a [ 23.561222] DR3: ffffffff970ac50b DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 23.561571] Call Trace: [ 23.562015] <TASK> [ 23.562141] stack_depot_fetch+0x2c/0x60 [ 23.562453] stack_depot_print+0x23/0x50 [ 23.562651] print_report+0x5f8/0x610 [ 23.563121] ? __virt_addr_valid+0x1db/0x2d0 [ 23.563287] ? kmalloc_oob_left+0x361/0x3c0 [ 23.563670] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.564053] ? kmalloc_oob_left+0x361/0x3c0 [ 23.564456] kasan_report+0x141/0x180 [ 23.564670] ? kmalloc_oob_left+0x361/0x3c0 [ 23.565090] __asan_report_load1_noabort+0x18/0x20 [ 23.565470] kmalloc_oob_left+0x361/0x3c0 [ 23.565899] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 23.566315] ? __schedule+0x10cc/0x2b60 [ 23.566562] ? __pfx_read_tsc+0x10/0x10 [ 23.566731] ? ktime_get_ts64+0x86/0x230 [ 23.566884] kunit_try_run_case+0x1a5/0x480 [ 23.567189] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.567792] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.568165] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.568518] ? __kthread_parkme+0x82/0x180 [ 23.568896] ? preempt_count_sub+0x50/0x80 [ 23.569157] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.569539] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.569900] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.570428] kthread+0x337/0x6f0 [ 23.570615] ? trace_preempt_on+0x20/0xc0 [ 23.570958] ? __pfx_kthread+0x10/0x10 [ 23.571208] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.571415] ? calculate_sigpending+0x7b/0xa0 [ 23.571908] ? __pfx_kthread+0x10/0x10 [ 23.572213] ret_from_fork+0x116/0x1d0 [ 23.572551] ? __pfx_kthread+0x10/0x10 [ 23.572807] ret_from_fork_asm+0x1a/0x30 [ 23.573240] </TASK> [ 23.573714] ---[ end trace 0000000000000000 ]--- [ 23.574239] ------------[ cut here ]------------ [ 23.574588] corrupt handle or use after stack_depot_put() [ 23.574703] WARNING: lib/stackdepot.c:723 at stack_depot_fetch+0x53/0x60, CPU#1: kunit_try_catch/187 [ 23.575688] Modules linked in: [ 23.575948] CPU: 1 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary) [ 23.576492] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 23.576736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.577448] RIP: 0010:stack_depot_fetch+0x53/0x60 [ 23.577764] Code: ff ff ff 48 85 c0 74 14 48 8d 50 20 48 89 13 8b 40 14 48 8b 5d f8 c9 e9 4b 25 69 02 90 48 c7 c7 c8 c9 99 95 e8 1e d7 ba fe 90 <0f> 0b 90 90 31 c0 eb e0 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 [ 23.578832] RSP: 0000:ffff888106127b38 EFLAGS: 00010082 [ 23.579371] RAX: 0000000000000000 RBX: ffff888106127b50 RCX: 1ffffffff2ba4bc0 [ 23.579852] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 23.580441] RBP: ffff888106127b40 R08: 0000000000000000 R09: fffffbfff2ba4bc0 [ 23.580836] R10: 0000000000000003 R11: 0000000000000001 R12: ffff8881058420bf [ 23.581243] R13: ffff888106168000 R14: ffffea0004161080 R15: 0000000000000001 [ 23.581538] FS: 0000000000000000(0000) GS:ffff8881bd71a000(0000) knlGS:0000000000000000 [ 23.582197] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.582464] CR2: 0000000000000000 CR3: 0000000160ebc000 CR4: 00000000000006f0 [ 23.582936] DR0: ffffffff970ac504 DR1: ffffffff970ac509 DR2: ffffffff970ac50a [ 23.583267] DR3: ffffffff970ac50b DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 23.583697] Call Trace: [ 23.583907] <TASK> [ 23.584245] stack_depot_print+0x23/0x50 [ 23.584628] print_report+0x5f8/0x610 [ 23.584832] ? __virt_addr_valid+0x1db/0x2d0 [ 23.585411] ? kmalloc_oob_left+0x361/0x3c0 [ 23.585649] ? kasan_complete_mode_report_info+0x64/0x200 [ 23.586178] ? kmalloc_oob_left+0x361/0x3c0 [ 23.586469] kasan_report+0x141/0x180 [ 23.586713] ? kmalloc_oob_left+0x361/0x3c0 [ 23.587039] __asan_report_load1_noabort+0x18/0x20 [ 23.587371] kmalloc_oob_left+0x361/0x3c0 [ 23.587848] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 23.588060] ? __schedule+0x10cc/0x2b60 [ 23.588233] ? __pfx_read_tsc+0x10/0x10 [ 23.588655] ? ktime_get_ts64+0x86/0x230 [ 23.588913] kunit_try_run_case+0x1a5/0x480 [ 23.589051] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.589585] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.589905] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.590362] ? __kthread_parkme+0x82/0x180 [ 23.590692] ? preempt_count_sub+0x50/0x80 [ 23.590974] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.591138] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.591704] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.592087] kthread+0x337/0x6f0 [ 23.592406] ? trace_preempt_on+0x20/0xc0 [ 23.592623] ? __pfx_kthread+0x10/0x10 [ 23.592888] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.593262] ? calculate_sigpending+0x7b/0xa0 [ 23.593484] ? __pfx_kthread+0x10/0x10 [ 23.593680] ret_from_fork+0x116/0x1d0 [ 23.594094] ? __pfx_kthread+0x10/0x10 [ 23.594398] ret_from_fork_asm+0x1a/0x30 [ 23.594814] </TASK> [ 23.594967] ---[ end trace 0000000000000000 ]--- [ 23.595505] [ 23.595620] The buggy address belongs to the object at ffff8881058420a0 [ 23.595620] which belongs to the cache kmalloc-16 of size 16 [ 23.596435] The buggy address is located 15 bytes to the right of [ 23.596435] allocated 16-byte region [ffff8881058420a0, ffff8881058420b0) [ 23.597191] [ 23.597292] The buggy address belongs to the physical page: [ 23.597537] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105842 [ 23.597939] flags: 0x200000000000000(node=0|zone=2) [ 23.598457] page_type: f5(slab) [ 23.598636] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122 [ 23.599092] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 23.599604] page dumped because: kasan: bad access detected [ 23.599967] [ 23.600094] Memory state around the buggy address: [ 23.600426] ffff888105841f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.601087] ffff888105842000: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 23.601391] >ffff888105842080: fa fb fc fc fa fb fc fc 00 07 fc fc fa fb fc fc [ 23.601999] ^ [ 23.602492] ffff888105842100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 23.602841] ffff888105842180: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 23.603131] ==================================================================