Date
July 17, 2025, 10:12 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 29.287372] ================================================================== [ 29.287432] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 29.287484] Read of size 1 at addr fff00000c992f000 by task kunit_try_catch/171 [ 29.287532] [ 29.287560] CPU: 1 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT [ 29.287656] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.287692] Hardware name: linux,dummy-virt (DT) [ 29.287736] Call trace: [ 29.287765] show_stack+0x20/0x38 (C) [ 29.287813] dump_stack_lvl+0x8c/0xd0 [ 29.287860] print_report+0x118/0x5d0 [ 29.287903] kasan_report+0xdc/0x128 [ 29.287946] __asan_report_load1_noabort+0x20/0x30 [ 29.287993] kmalloc_node_oob_right+0x2f4/0x330 [ 29.288047] kunit_try_run_case+0x170/0x3f0 [ 29.288420] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.288518] kthread+0x328/0x630 [ 29.288646] ret_from_fork+0x10/0x20 [ 29.288755] [ 29.288774] Allocated by task 171: [ 29.288819] kasan_save_stack+0x3c/0x68 [ 29.288909] kasan_save_track+0x20/0x40 [ 29.289001] kasan_save_alloc_info+0x40/0x58 [ 29.289050] __kasan_kmalloc+0xd4/0xd8 [ 29.289096] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 29.289137] kmalloc_node_oob_right+0xbc/0x330 [ 29.289175] kunit_try_run_case+0x170/0x3f0 [ 29.289210] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 29.289404] kthread+0x328/0x630 [ 29.289441] ret_from_fork+0x10/0x20 [ 29.289508] [ 29.289565] The buggy address belongs to the object at fff00000c992e000 [ 29.289565] which belongs to the cache kmalloc-4k of size 4096 [ 29.289650] The buggy address is located 0 bytes to the right of [ 29.289650] allocated 4096-byte region [fff00000c992e000, fff00000c992f000) [ 29.289724] [ 29.289787] The buggy address belongs to the physical page: [ 29.290001] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109928 [ 29.290389] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 29.290497] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 29.290800] page_type: f5(slab) [ 29.290951] raw: 0bfffe0000000040 fff00000c0002140 dead000000000100 dead000000000122 [ 29.291046] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 29.291175] head: 0bfffe0000000040 fff00000c0002140 dead000000000100 dead000000000122 [ 29.291259] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 29.291371] head: 0bfffe0000000003 ffffc1ffc3264a01 00000000ffffffff 00000000ffffffff [ 29.291465] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 29.291543] page dumped because: kasan: bad access detected [ 29.291614] [ 29.291632] Memory state around the buggy address: [ 29.291662] fff00000c992ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.291721] fff00000c992ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.292065] >fff00000c992f000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.292143] ^ [ 29.292253] fff00000c992f080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.292296] fff00000c992f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.292377] ==================================================================
[ 25.078531] ================================================================== [ 25.079232] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x369/0x3c0 [ 25.079709] Read of size 1 at addr ffff888106053000 by task kunit_try_catch/189 [ 25.080026] [ 25.080155] CPU: 0 UID: 0 PID: 189 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT(voluntary) [ 25.080203] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.080215] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.080235] Call Trace: [ 25.080298] <TASK> [ 25.080315] dump_stack_lvl+0x73/0xb0 [ 25.080345] print_report+0xd1/0x610 [ 25.080402] ? __virt_addr_valid+0x1db/0x2d0 [ 25.080425] ? kmalloc_node_oob_right+0x369/0x3c0 [ 25.080459] ? kasan_complete_mode_report_info+0x2a/0x200 [ 25.080484] ? kmalloc_node_oob_right+0x369/0x3c0 [ 25.080506] kasan_report+0x141/0x180 [ 25.080527] ? kmalloc_node_oob_right+0x369/0x3c0 [ 25.080563] __asan_report_load1_noabort+0x18/0x20 [ 25.080586] kmalloc_node_oob_right+0x369/0x3c0 [ 25.080609] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 25.080643] ? __schedule+0x10c6/0x2b60 [ 25.080665] ? __pfx_read_tsc+0x10/0x10 [ 25.080685] ? ktime_get_ts64+0x86/0x230 [ 25.080717] kunit_try_run_case+0x1a5/0x480 [ 25.080740] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.080761] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.080793] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.080815] ? __kthread_parkme+0x82/0x180 [ 25.080838] ? preempt_count_sub+0x50/0x80 [ 25.080861] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.080883] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.080904] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.080926] kthread+0x337/0x6f0 [ 25.080944] ? trace_preempt_on+0x20/0xc0 [ 25.080966] ? __pfx_kthread+0x10/0x10 [ 25.080985] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.081005] ? calculate_sigpending+0x7b/0xa0 [ 25.081028] ? __pfx_kthread+0x10/0x10 [ 25.081048] ret_from_fork+0x116/0x1d0 [ 25.081065] ? __pfx_kthread+0x10/0x10 [ 25.081095] ret_from_fork_asm+0x1a/0x30 [ 25.081125] </TASK> [ 25.081136] [ 25.090103] Allocated by task 189: [ 25.090410] kasan_save_stack+0x45/0x70 [ 25.090593] kasan_save_track+0x18/0x40 [ 25.090766] kasan_save_alloc_info+0x3b/0x50 [ 25.090908] __kasan_kmalloc+0xb7/0xc0 [ 25.091091] __kmalloc_cache_node_noprof+0x188/0x420 [ 25.091467] kmalloc_node_oob_right+0xab/0x3c0 [ 25.091660] kunit_try_run_case+0x1a5/0x480 [ 25.091845] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.092095] kthread+0x337/0x6f0 [ 25.092320] ret_from_fork+0x116/0x1d0 [ 25.092452] ret_from_fork_asm+0x1a/0x30 [ 25.092643] [ 25.092729] The buggy address belongs to the object at ffff888106052000 [ 25.092729] which belongs to the cache kmalloc-4k of size 4096 [ 25.093171] The buggy address is located 0 bytes to the right of [ 25.093171] allocated 4096-byte region [ffff888106052000, ffff888106053000) [ 25.093761] [ 25.093839] The buggy address belongs to the physical page: [ 25.094136] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106050 [ 25.094635] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.094901] flags: 0x200000000000040(head|node=0|zone=2) [ 25.095493] page_type: f5(slab) [ 25.095669] raw: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 25.095939] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 25.096385] head: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 25.096694] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 25.096972] head: 0200000000000003 ffffea0004181401 00000000ffffffff 00000000ffffffff [ 25.097386] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 25.097677] page dumped because: kasan: bad access detected [ 25.097935] [ 25.098025] Memory state around the buggy address: [ 25.098215] ffff888106052f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.098696] ffff888106052f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.098987] >ffff888106053000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.099384] ^ [ 25.099556] ffff888106053080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.099826] ffff888106053100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.100110] ==================================================================