Date
July 23, 2025, 3:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 31.138266] ================================================================== [ 31.138339] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x154/0x2e0 [ 31.138585] Read of size 64 at addr fff00000c9a6f604 by task kunit_try_catch/215 [ 31.138681] [ 31.138725] CPU: 0 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250723 #1 PREEMPT [ 31.138852] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 31.138885] Hardware name: linux,dummy-virt (DT) [ 31.138928] Call trace: [ 31.139252] show_stack+0x20/0x38 (C) [ 31.139653] dump_stack_lvl+0x8c/0xd0 [ 31.139956] print_report+0x118/0x5e8 [ 31.140011] kasan_report+0xdc/0x128 [ 31.140067] kasan_check_range+0x100/0x1a8 [ 31.140134] __asan_memmove+0x3c/0x98 [ 31.140186] kmalloc_memmove_invalid_size+0x154/0x2e0 [ 31.140391] kunit_try_run_case+0x170/0x3f0 [ 31.140442] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.140494] kthread+0x328/0x630 [ 31.140548] ret_from_fork+0x10/0x20 [ 31.140946] [ 31.140991] Allocated by task 215: [ 31.141220] kasan_save_stack+0x3c/0x68 [ 31.141748] kasan_save_track+0x20/0x40 [ 31.141818] kasan_save_alloc_info+0x40/0x58 [ 31.141883] __kasan_kmalloc+0xd4/0xd8 [ 31.141947] __kmalloc_cache_noprof+0x16c/0x3c0 [ 31.142148] kmalloc_memmove_invalid_size+0xb0/0x2e0 [ 31.142213] kunit_try_run_case+0x170/0x3f0 [ 31.142252] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 31.142537] kthread+0x328/0x630 [ 31.142625] ret_from_fork+0x10/0x20 [ 31.142702] [ 31.143131] The buggy address belongs to the object at fff00000c9a6f600 [ 31.143131] which belongs to the cache kmalloc-64 of size 64 [ 31.143201] The buggy address is located 4 bytes inside of [ 31.143201] allocated 64-byte region [fff00000c9a6f600, fff00000c9a6f640) [ 31.143290] [ 31.143320] The buggy address belongs to the physical page: [ 31.143368] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109a6f [ 31.143811] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 31.143888] page_type: f5(slab) [ 31.143960] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 31.144677] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 31.144741] page dumped because: kasan: bad access detected [ 31.144774] [ 31.144798] Memory state around the buggy address: [ 31.144859] fff00000c9a6f500: 00 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc [ 31.144914] fff00000c9a6f580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 31.144957] >fff00000c9a6f600: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 31.145289] ^ [ 31.145371] fff00000c9a6f680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.145537] fff00000c9a6f700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.145755] ==================================================================
[ 25.393236] ================================================================== [ 25.393889] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x16f/0x330 [ 25.394290] Read of size 64 at addr ffff88810610f784 by task kunit_try_catch/231 [ 25.394977] [ 25.395108] CPU: 0 UID: 0 PID: 231 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250723 #1 PREEMPT(voluntary) [ 25.395174] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.395188] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.395210] Call Trace: [ 25.395224] <TASK> [ 25.395244] dump_stack_lvl+0x73/0xb0 [ 25.395278] print_report+0xd1/0x640 [ 25.395303] ? __virt_addr_valid+0x1db/0x2d0 [ 25.395328] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 25.395352] ? kasan_complete_mode_report_info+0x2a/0x200 [ 25.395438] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 25.395473] kasan_report+0x141/0x180 [ 25.395496] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 25.395524] kasan_check_range+0x10c/0x1c0 [ 25.395547] __asan_memmove+0x27/0x70 [ 25.395570] kmalloc_memmove_invalid_size+0x16f/0x330 [ 25.395594] ? __pfx_kmalloc_memmove_invalid_size+0x10/0x10 [ 25.395624] ? __schedule+0x10da/0x2b60 [ 25.395650] ? __pfx_read_tsc+0x10/0x10 [ 25.395691] ? ktime_get_ts64+0x86/0x230 [ 25.395716] kunit_try_run_case+0x1a5/0x480 [ 25.395743] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.395766] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.395791] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.395816] ? __kthread_parkme+0x82/0x180 [ 25.395837] ? preempt_count_sub+0x50/0x80 [ 25.395861] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.395884] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.395908] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.395931] kthread+0x337/0x6f0 [ 25.395967] ? trace_preempt_on+0x20/0xc0 [ 25.395992] ? __pfx_kthread+0x10/0x10 [ 25.396013] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.396036] ? calculate_sigpending+0x7b/0xa0 [ 25.396060] ? __pfx_kthread+0x10/0x10 [ 25.396081] ret_from_fork+0x116/0x1d0 [ 25.396101] ? __pfx_kthread+0x10/0x10 [ 25.396122] ret_from_fork_asm+0x1a/0x30 [ 25.396163] </TASK> [ 25.396174] [ 25.406753] Allocated by task 231: [ 25.407184] kasan_save_stack+0x45/0x70 [ 25.407421] kasan_save_track+0x18/0x40 [ 25.407570] kasan_save_alloc_info+0x3b/0x50 [ 25.407784] __kasan_kmalloc+0xb7/0xc0 [ 25.408263] __kmalloc_cache_noprof+0x189/0x420 [ 25.408722] kmalloc_memmove_invalid_size+0xac/0x330 [ 25.409017] kunit_try_run_case+0x1a5/0x480 [ 25.409470] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.409678] kthread+0x337/0x6f0 [ 25.409836] ret_from_fork+0x116/0x1d0 [ 25.410235] ret_from_fork_asm+0x1a/0x30 [ 25.410588] [ 25.410692] The buggy address belongs to the object at ffff88810610f780 [ 25.410692] which belongs to the cache kmalloc-64 of size 64 [ 25.411491] The buggy address is located 4 bytes inside of [ 25.411491] allocated 64-byte region [ffff88810610f780, ffff88810610f7c0) [ 25.412132] [ 25.412233] The buggy address belongs to the physical page: [ 25.412794] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10610f [ 25.413203] flags: 0x200000000000000(node=0|zone=2) [ 25.413723] page_type: f5(slab) [ 25.414117] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 25.414457] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 25.415007] page dumped because: kasan: bad access detected [ 25.415211] [ 25.415322] Memory state around the buggy address: [ 25.415746] ffff88810610f680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.416288] ffff88810610f700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 25.416700] >ffff88810610f780: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 25.417141] ^ [ 25.417538] ffff88810610f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.417814] ffff88810610f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.418140] ==================================================================