Date
June 2, 2025, 2:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.906190] ================================================================== [ 19.906865] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x150/0x2e8 [ 19.907898] Write of size 128 at addr fff00000c6492500 by task kunit_try_catch/157 [ 19.908913] [ 19.909183] CPU: 1 UID: 0 PID: 157 Comm: kunit_try_catch Tainted: G B N 6.12.32-rc1 #1 [ 19.909493] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.909564] Hardware name: linux,dummy-virt (DT) [ 19.909608] Call trace: [ 19.909636] dump_backtrace+0x9c/0x128 [ 19.909700] show_stack+0x20/0x38 [ 19.909740] dump_stack_lvl+0x8c/0xd0 [ 19.909787] print_report+0x118/0x5f0 [ 19.909829] kasan_report+0xdc/0x128 [ 19.909868] kasan_check_range+0x100/0x1a8 [ 19.909911] __asan_memset+0x34/0x78 [ 19.909951] kmalloc_oob_in_memset+0x150/0x2e8 [ 19.909997] kunit_try_run_case+0x170/0x3f0 [ 19.910042] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.910090] kthread+0x24c/0x2d0 [ 19.910131] ret_from_fork+0x10/0x20 [ 19.910177] [ 19.916789] Allocated by task 157: [ 19.917255] kasan_save_stack+0x3c/0x68 [ 19.917764] kasan_save_track+0x20/0x40 [ 19.918220] kasan_save_alloc_info+0x40/0x58 [ 19.918740] __kasan_kmalloc+0xd4/0xd8 [ 19.919233] __kmalloc_cache_noprof+0x154/0x320 [ 19.919780] kmalloc_oob_in_memset+0xb0/0x2e8 [ 19.920290] kunit_try_run_case+0x170/0x3f0 [ 19.920947] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.921454] kthread+0x24c/0x2d0 [ 19.921809] ret_from_fork+0x10/0x20 [ 19.922172] [ 19.922411] The buggy address belongs to the object at fff00000c6492500 [ 19.922411] which belongs to the cache kmalloc-128 of size 128 [ 19.924251] The buggy address is located 0 bytes inside of [ 19.924251] allocated 120-byte region [fff00000c6492500, fff00000c6492578) [ 19.925890] [ 19.926168] The buggy address belongs to the physical page: [ 19.926631] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106492 [ 19.927663] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.928221] page_type: f5(slab) [ 19.928607] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.929182] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 19.929661] page dumped because: kasan: bad access detected [ 19.930252] [ 19.930529] Memory state around the buggy address: [ 19.930926] fff00000c6492400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.931532] fff00000c6492480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.932200] >fff00000c6492500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.932699] ^ [ 19.933641] fff00000c6492580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.934165] fff00000c6492600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.934718] ==================================================================
[ 12.109921] ================================================================== [ 12.110533] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x160/0x320 [ 12.111062] Write of size 128 at addr ffff88810261c000 by task kunit_try_catch/175 [ 12.111349] [ 12.111469] CPU: 0 UID: 0 PID: 175 Comm: kunit_try_catch Tainted: G B N 6.12.32-rc1 #1 [ 12.111546] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.111570] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.111605] Call Trace: [ 12.111621] <TASK> [ 12.111637] dump_stack_lvl+0x73/0xb0 [ 12.111689] print_report+0xd1/0x640 [ 12.111722] ? __virt_addr_valid+0x1db/0x2d0 [ 12.111756] ? kmalloc_oob_in_memset+0x160/0x320 [ 12.111789] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.111821] ? kmalloc_oob_in_memset+0x160/0x320 [ 12.111860] kasan_report+0x140/0x180 [ 12.111900] ? kmalloc_oob_in_memset+0x160/0x320 [ 12.111952] kasan_check_range+0x10c/0x1c0 [ 12.111993] __asan_memset+0x27/0x50 [ 12.112033] kmalloc_oob_in_memset+0x160/0x320 [ 12.112078] ? __pfx_kmalloc_oob_in_memset+0x10/0x10 [ 12.112124] ? __schedule+0xc49/0x27a0 [ 12.112164] ? __pfx_read_tsc+0x10/0x10 [ 12.112200] ? ktime_get_ts64+0x84/0x230 [ 12.112251] kunit_try_run_case+0x1a6/0x480 [ 12.112294] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.112333] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 12.112371] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.112415] ? __kthread_parkme+0x82/0x160 [ 12.112606] ? preempt_count_sub+0x50/0x80 [ 12.112629] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.112649] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.112695] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.112720] kthread+0x257/0x310 [ 12.112737] ? __pfx_kthread+0x10/0x10 [ 12.112755] ret_from_fork+0x41/0x80 [ 12.112773] ? __pfx_kthread+0x10/0x10 [ 12.112791] ret_from_fork_asm+0x1a/0x30 [ 12.112819] </TASK> [ 12.112830] [ 12.123176] Allocated by task 175: [ 12.123724] kasan_save_stack+0x45/0x70 [ 12.124065] kasan_save_track+0x18/0x40 [ 12.124322] kasan_save_alloc_info+0x3b/0x50 [ 12.124618] __kasan_kmalloc+0xb7/0xc0 [ 12.124776] __kmalloc_cache_noprof+0x168/0x350 [ 12.125150] kmalloc_oob_in_memset+0xad/0x320 [ 12.125467] kunit_try_run_case+0x1a6/0x480 [ 12.125695] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.126171] kthread+0x257/0x310 [ 12.126481] ret_from_fork+0x41/0x80 [ 12.126723] ret_from_fork_asm+0x1a/0x30 [ 12.126872] [ 12.126963] The buggy address belongs to the object at ffff88810261c000 [ 12.126963] which belongs to the cache kmalloc-128 of size 128 [ 12.128002] The buggy address is located 0 bytes inside of [ 12.128002] allocated 120-byte region [ffff88810261c000, ffff88810261c078) [ 12.129109] [ 12.129301] The buggy address belongs to the physical page: [ 12.129958] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10261c [ 12.130334] flags: 0x200000000000000(node=0|zone=2) [ 12.130522] page_type: f5(slab) [ 12.130791] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.131089] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 12.131366] page dumped because: kasan: bad access detected [ 12.131731] [ 12.131881] Memory state around the buggy address: [ 12.132076] ffff88810261bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.132534] ffff88810261bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.132851] >ffff88810261c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 12.133302] ^ [ 12.133710] ffff88810261c080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.133952] ffff88810261c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.134325] ==================================================================