Date
July 24, 2025, 4:41 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 32.144722] ================================================================== [ 32.144853] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2f4/0x330 [ 32.144918] Read of size 1 at addr fff00000c9879000 by task kunit_try_catch/171 [ 32.145186] [ 32.145290] CPU: 0 UID: 0 PID: 171 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250724 #1 PREEMPT [ 32.145400] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.145435] Hardware name: linux,dummy-virt (DT) [ 32.145619] Call trace: [ 32.145662] show_stack+0x20/0x38 (C) [ 32.145866] dump_stack_lvl+0x8c/0xd0 [ 32.146183] print_report+0x118/0x5e8 [ 32.146357] kasan_report+0xdc/0x128 [ 32.146853] __asan_report_load1_noabort+0x20/0x30 [ 32.146955] kmalloc_node_oob_right+0x2f4/0x330 [ 32.147218] kunit_try_run_case+0x170/0x3f0 [ 32.147306] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.147527] kthread+0x328/0x630 [ 32.147853] ret_from_fork+0x10/0x20 [ 32.148016] [ 32.148075] Allocated by task 171: [ 32.148198] kasan_save_stack+0x3c/0x68 [ 32.148275] kasan_save_track+0x20/0x40 [ 32.148385] kasan_save_alloc_info+0x40/0x58 [ 32.148460] __kasan_kmalloc+0xd4/0xd8 [ 32.148500] __kmalloc_cache_node_noprof+0x178/0x3d0 [ 32.148578] kmalloc_node_oob_right+0xbc/0x330 [ 32.148624] kunit_try_run_case+0x170/0x3f0 [ 32.148660] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.148700] kthread+0x328/0x630 [ 32.148742] ret_from_fork+0x10/0x20 [ 32.148799] [ 32.148829] The buggy address belongs to the object at fff00000c9878000 [ 32.148829] which belongs to the cache kmalloc-4k of size 4096 [ 32.148896] The buggy address is located 0 bytes to the right of [ 32.148896] allocated 4096-byte region [fff00000c9878000, fff00000c9879000) [ 32.148968] [ 32.148989] The buggy address belongs to the physical page: [ 32.149175] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109878 [ 32.149296] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.149378] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 32.149460] page_type: f5(slab) [ 32.149502] raw: 0bfffe0000000040 fff00000c0002140 dead000000000100 dead000000000122 [ 32.149563] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 32.149633] head: 0bfffe0000000040 fff00000c0002140 dead000000000100 dead000000000122 [ 32.149697] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 32.149765] head: 0bfffe0000000003 ffffc1ffc3261e01 00000000ffffffff 00000000ffffffff [ 32.149813] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 32.150153] page dumped because: kasan: bad access detected [ 32.150563] [ 32.150616] Memory state around the buggy address: [ 32.150934] fff00000c9878f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.151292] fff00000c9878f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.151366] >fff00000c9879000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.151405] ^ [ 32.152028] fff00000c9879080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.152119] fff00000c9879100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.152187] ==================================================================
[ 26.205006] ================================================================== [ 26.205496] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x369/0x3c0 [ 26.205890] Read of size 1 at addr ffff888106007000 by task kunit_try_catch/188 [ 26.206644] [ 26.206783] CPU: 0 UID: 0 PID: 188 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250724 #1 PREEMPT(voluntary) [ 26.206837] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 26.206851] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.206873] Call Trace: [ 26.206886] <TASK> [ 26.206904] dump_stack_lvl+0x73/0xb0 [ 26.207132] print_report+0xd1/0x640 [ 26.207159] ? __virt_addr_valid+0x1db/0x2d0 [ 26.207186] ? kmalloc_node_oob_right+0x369/0x3c0 [ 26.207210] ? kasan_complete_mode_report_info+0x2a/0x200 [ 26.207236] ? kmalloc_node_oob_right+0x369/0x3c0 [ 26.207266] kasan_report+0x141/0x180 [ 26.207287] ? kmalloc_node_oob_right+0x369/0x3c0 [ 26.207314] __asan_report_load1_noabort+0x18/0x20 [ 26.207338] kmalloc_node_oob_right+0x369/0x3c0 [ 26.207363] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 26.207388] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 26.207416] kunit_try_run_case+0x1a5/0x480 [ 26.207442] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.207465] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 26.207493] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 26.207517] ? __kthread_parkme+0x82/0x180 [ 26.207538] ? preempt_count_sub+0x50/0x80 [ 26.207563] ? __pfx_kunit_try_run_case+0x10/0x10 [ 26.207601] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.207625] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 26.207648] kthread+0x337/0x6f0 [ 26.207668] ? trace_preempt_on+0x20/0xc0 [ 26.207693] ? __pfx_kthread+0x10/0x10 [ 26.207713] ? _raw_spin_unlock_irq+0x47/0x80 [ 26.207735] ? calculate_sigpending+0x7b/0xa0 [ 26.207758] ? __pfx_kthread+0x10/0x10 [ 26.207843] ret_from_fork+0x116/0x1d0 [ 26.207868] ? __pfx_kthread+0x10/0x10 [ 26.207889] ret_from_fork_asm+0x1a/0x30 [ 26.207920] </TASK> [ 26.207931] [ 26.214629] Allocated by task 188: [ 26.214803] kasan_save_stack+0x45/0x70 [ 26.215111] kasan_save_track+0x18/0x40 [ 26.215352] kasan_save_alloc_info+0x3b/0x50 [ 26.215548] __kasan_kmalloc+0xb7/0xc0 [ 26.215716] __kmalloc_cache_node_noprof+0x188/0x420 [ 26.215974] kmalloc_node_oob_right+0xab/0x3c0 [ 26.216184] kunit_try_run_case+0x1a5/0x480 [ 26.216389] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 26.216632] kthread+0x337/0x6f0 [ 26.216755] ret_from_fork+0x116/0x1d0 [ 26.216943] ret_from_fork_asm+0x1a/0x30 [ 26.217104] [ 26.217168] The buggy address belongs to the object at ffff888106006000 [ 26.217168] which belongs to the cache kmalloc-4k of size 4096 [ 26.217694] The buggy address is located 0 bytes to the right of [ 26.217694] allocated 4096-byte region [ffff888106006000, ffff888106007000) [ 26.218199] [ 26.218520] The buggy address belongs to the physical page: [ 26.218926] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106000 [ 26.219383] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 26.219687] flags: 0x200000000000040(head|node=0|zone=2) [ 26.220110] page_type: f5(slab) [ 26.220256] raw: 0200000000000040 ffff888100042140 ffffea0004180400 dead000000000002 [ 26.220542] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 26.220936] head: 0200000000000040 ffff888100042140 ffffea0004180400 dead000000000002 [ 26.221229] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ 26.221509] head: 0200000000000003 ffffea0004180001 00000000ffffffff 00000000ffffffff [ 26.221831] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 26.222190] page dumped because: kasan: bad access detected [ 26.222592] [ 26.222680] Memory state around the buggy address: [ 26.222993] ffff888106006f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.223265] ffff888106006f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.223546] >ffff888106007000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.224020] ^ [ 26.224189] ffff888106007080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.224473] ffff888106007100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.224766] ==================================================================