Date
July 18, 2025, 1:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.260412] ================================================================== [ 31.260473] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 31.260526] Read of size 1 at addr fff00000c9ad9000 by task kunit_try_catch/171 [ 31.260575] [ 31.260605] CPU: 0 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250718 #1 PREEMPT [ 31.260729] Tainted: [B]=BAD_PAGE, [N]=TEST [ 31.260786] Hardware name: linux,dummy-virt (DT) [ 31.260913] Call trace: [ 31.260952] show_stack+0x20/0x38 (C) [ 31.261000] dump_stack_lvl+0x8c/0xd0 [ 31.261102] print_report+0x118/0x5e8 [ 31.261172] kasan_report+0xdc/0x128 [ 31.261235] __asan_report_load1_noabort+0x20/0x30 [ 31.261283] kmalloc_node_oob_right+0x2f4/0x330 [ 31.261331] kunit_try_run_case+0x170/0x3f0 [ 31.261375] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.261469] kthread+0x328/0x630 [ 31.261548] ret_from_fork+0x10/0x20 [ 31.261593] [ 31.261611] Allocated by task 171: [ 31.261637] kasan_save_stack+0x3c/0x68 [ 31.261672] kasan_save_track+0x20/0x40 [ 31.261716] kasan_save_alloc_info+0x40/0x58 [ 31.261753] __kasan_kmalloc+0xd4/0xd8 [ 31.261797] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 31.261837] kmalloc_node_oob_right+0xbc/0x330 [ 31.261875] kunit_try_run_case+0x170/0x3f0 [ 31.261950] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.261991] kthread+0x328/0x630 [ 31.262088] ret_from_fork+0x10/0x20 [ 31.262150] [ 31.262168] The buggy address belongs to the object at fff00000c9ad8000 [ 31.262168] which belongs to the cache kmalloc-4k of size 4096 [ 31.262290] The buggy address is located 0 bytes to the right of [ 31.262290] allocated 4096-byte region [fff00000c9ad8000, fff00000c9ad9000) [ 31.262431] [ 31.262483] The buggy address belongs to the physical page: [ 31.262685] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109ad8 [ 31.263014] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 31.263072] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 31.263147] page_type: f5(slab) [ 31.263184] raw: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 31.263231] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 31.263296] head: 0bfffe0000000040 fff00000c0002140 dead000000000122 0000000000000000 [ 31.263355] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 31.263414] head: 0bfffe0000000003 ffffc1ffc326b601 00000000ffffffff 00000000ffffffff [ 31.263551] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 31.263697] page dumped because: kasan: bad access detected [ 31.263727] [ 31.263753] Memory state around the buggy address: [ 31.263830] fff00000c9ad8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.263902] fff00000c9ad8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.263955] >fff00000c9ad9000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.264015] ^ [ 31.264129] fff00000c9ad9080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.264194] fff00000c9ad9100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.264229] ==================================================================
[ 24.144384] ================================================================== [ 24.144867] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x369/0x3c0 [ 24.145274] Read of size 1 at addr ffff888102b21000 by task kunit_try_catch/188 [ 24.145520] [ 24.145643] CPU: 1 UID: 0 PID: 188 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250718 #1 PREEMPT(voluntary) [ 24.145694] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.145707] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.145729] Call Trace: [ 24.145741] <TASK> [ 24.145758] dump_stack_lvl+0x73/0xb0 [ 24.145790] print_report+0xd1/0x640 [ 24.145923] ? __virt_addr_valid+0x1db/0x2d0 [ 24.145948] ? kmalloc_node_oob_right+0x369/0x3c0 [ 24.145971] ? kasan_complete_mode_report_info+0x2a/0x200 [ 24.145996] ? kmalloc_node_oob_right+0x369/0x3c0 [ 24.146018] kasan_report+0x141/0x180 [ 24.146039] ? kmalloc_node_oob_right+0x369/0x3c0 [ 24.146066] __asan_report_load1_noabort+0x18/0x20 [ 24.146096] kmalloc_node_oob_right+0x369/0x3c0 [ 24.146126] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 24.146149] ? __schedule+0x10da/0x2b60 [ 24.146457] ? __pfx_read_tsc+0x10/0x10 [ 24.146482] ? ktime_get_ts64+0x86/0x230 [ 24.146508] kunit_try_run_case+0x1a5/0x480 [ 24.146533] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.146554] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 24.146577] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.146600] ? __kthread_parkme+0x82/0x180 [ 24.146627] ? preempt_count_sub+0x50/0x80 [ 24.146649] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.146671] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.146693] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.146715] kthread+0x337/0x6f0 [ 24.146733] ? trace_preempt_on+0x20/0xc0 [ 24.146756] ? __pfx_kthread+0x10/0x10 [ 24.146775] ? _raw_spin_unlock_irq+0x47/0x80 [ 24.146812] ? calculate_sigpending+0x7b/0xa0 [ 24.146847] ? __pfx_kthread+0x10/0x10 [ 24.146868] ret_from_fork+0x116/0x1d0 [ 24.146886] ? __pfx_kthread+0x10/0x10 [ 24.146905] ret_from_fork_asm+0x1a/0x30 [ 24.146934] </TASK> [ 24.146945] [ 24.160635] Allocated by task 188: [ 24.160767] kasan_save_stack+0x45/0x70 [ 24.161378] kasan_save_track+0x18/0x40 [ 24.161848] kasan_save_alloc_info+0x3b/0x50 [ 24.162315] __kasan_kmalloc+0xb7/0xc0 [ 24.162721] __kmalloc_cache_node_noprof+0x188/0x420 [ 24.163308] kmalloc_node_oob_right+0xab/0x3c0 [ 24.163761] kunit_try_run_case+0x1a5/0x480 [ 24.164202] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.164383] kthread+0x337/0x6f0 [ 24.164501] ret_from_fork+0x116/0x1d0 [ 24.164629] ret_from_fork_asm+0x1a/0x30 [ 24.164762] [ 24.165200] The buggy address belongs to the object at ffff888102b20000 [ 24.165200] which belongs to the cache kmalloc-4k of size 4096 [ 24.166443] The buggy address is located 0 bytes to the right of [ 24.166443] allocated 4096-byte region [ffff888102b20000, ffff888102b21000) [ 24.167678] [ 24.167756] The buggy address belongs to the physical page: [ 24.168001] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b20 [ 24.168430] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.168759] flags: 0x200000000000040(head|node=0|zone=2) [ 24.169119] page_type: f5(slab) [ 24.169474] raw: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 24.169898] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 24.170223] head: 0200000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 24.170630] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 24.170973] head: 0200000000000003 ffffea00040ac801 00000000ffffffff 00000000ffffffff [ 24.171427] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 24.171768] page dumped because: kasan: bad access detected [ 24.172002] [ 24.172073] Memory state around the buggy address: [ 24.172289] ffff888102b20f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.172588] ffff888102b20f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.172897] >ffff888102b21000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.173429] ^ [ 24.173553] ffff888102b21080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.173793] ffff888102b21100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.174288] ==================================================================