Date
June 2, 2025, 2:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.980855] ================================================================== [ 19.981658] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x15c/0x318 [ 19.982103] Write of size 4 at addr fff00000c5cb7575 by task kunit_try_catch/161 [ 19.983293] [ 19.983576] CPU: 0 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G B N 6.12.32-rc1 #1 [ 19.983766] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.983822] Hardware name: linux,dummy-virt (DT) [ 19.983899] Call trace: [ 19.983945] dump_backtrace+0x9c/0x128 [ 19.984055] show_stack+0x20/0x38 [ 19.984135] dump_stack_lvl+0x8c/0xd0 [ 19.984212] print_report+0x118/0x5f0 [ 19.984307] kasan_report+0xdc/0x128 [ 19.984387] kasan_check_range+0x100/0x1a8 [ 19.984477] __asan_memset+0x34/0x78 [ 19.984579] kmalloc_oob_memset_4+0x15c/0x318 [ 19.984683] kunit_try_run_case+0x170/0x3f0 [ 19.984772] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.984878] kthread+0x24c/0x2d0 [ 19.984971] ret_from_fork+0x10/0x20 [ 19.985049] [ 19.990618] Allocated by task 161: [ 19.991155] kasan_save_stack+0x3c/0x68 [ 19.991733] kasan_save_track+0x20/0x40 [ 19.992292] kasan_save_alloc_info+0x40/0x58 [ 19.992695] __kasan_kmalloc+0xd4/0xd8 [ 19.993302] __kmalloc_cache_noprof+0x154/0x320 [ 19.994123] kmalloc_oob_memset_4+0xb0/0x318 [ 19.994484] kunit_try_run_case+0x170/0x3f0 [ 19.994784] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.995523] kthread+0x24c/0x2d0 [ 19.996290] ret_from_fork+0x10/0x20 [ 19.996686] [ 19.996891] The buggy address belongs to the object at fff00000c5cb7500 [ 19.996891] which belongs to the cache kmalloc-128 of size 128 [ 19.997848] The buggy address is located 117 bytes inside of [ 19.997848] allocated 120-byte region [fff00000c5cb7500, fff00000c5cb7578) [ 19.998827] [ 19.999135] The buggy address belongs to the physical page: [ 20.000113] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105cb7 [ 20.001182] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.001858] page_type: f5(slab) [ 20.002181] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.003068] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 20.004085] page dumped because: kasan: bad access detected [ 20.004585] [ 20.004853] Memory state around the buggy address: [ 20.005119] fff00000c5cb7400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 20.005463] fff00000c5cb7480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.005794] >fff00000c5cb7500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.006116] ^ [ 20.007338] fff00000c5cb7580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.008077] fff00000c5cb7600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.008550] ==================================================================
[ 12.166627] ================================================================== [ 12.167109] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x167/0x330 [ 12.167742] Write of size 4 at addr ffff88810261c275 by task kunit_try_catch/179 [ 12.168321] [ 12.168469] CPU: 0 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G B N 6.12.32-rc1 #1 [ 12.168548] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.168570] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.168607] Call Trace: [ 12.168632] <TASK> [ 12.168672] dump_stack_lvl+0x73/0xb0 [ 12.168729] print_report+0xd1/0x640 [ 12.168769] ? __virt_addr_valid+0x1db/0x2d0 [ 12.168806] ? kmalloc_oob_memset_4+0x167/0x330 [ 12.168840] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.168879] ? kmalloc_oob_memset_4+0x167/0x330 [ 12.168921] kasan_report+0x140/0x180 [ 12.168964] ? kmalloc_oob_memset_4+0x167/0x330 [ 12.169019] kasan_check_range+0x10c/0x1c0 [ 12.169094] __asan_memset+0x27/0x50 [ 12.169135] kmalloc_oob_memset_4+0x167/0x330 [ 12.169173] ? __pfx_kmalloc_oob_memset_4+0x10/0x10 [ 12.169199] ? __schedule+0xc49/0x27a0 [ 12.169220] ? __pfx_read_tsc+0x10/0x10 [ 12.169238] ? ktime_get_ts64+0x84/0x230 [ 12.169264] kunit_try_run_case+0x1a6/0x480 [ 12.169284] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.169303] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 12.169322] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.169345] ? __kthread_parkme+0x82/0x160 [ 12.169363] ? preempt_count_sub+0x50/0x80 [ 12.169385] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.169403] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.169427] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.169450] kthread+0x257/0x310 [ 12.169466] ? __pfx_kthread+0x10/0x10 [ 12.169484] ret_from_fork+0x41/0x80 [ 12.169502] ? __pfx_kthread+0x10/0x10 [ 12.169519] ret_from_fork_asm+0x1a/0x30 [ 12.169547] </TASK> [ 12.169558] [ 12.177640] Allocated by task 179: [ 12.177848] kasan_save_stack+0x45/0x70 [ 12.178111] kasan_save_track+0x18/0x40 [ 12.178374] kasan_save_alloc_info+0x3b/0x50 [ 12.178727] __kasan_kmalloc+0xb7/0xc0 [ 12.180730] __kmalloc_cache_noprof+0x168/0x350 [ 12.182182] kmalloc_oob_memset_4+0xad/0x330 [ 12.182391] kunit_try_run_case+0x1a6/0x480 [ 12.182556] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.182778] kthread+0x257/0x310 [ 12.182916] ret_from_fork+0x41/0x80 [ 12.183094] ret_from_fork_asm+0x1a/0x30 [ 12.183313] [ 12.183407] The buggy address belongs to the object at ffff88810261c200 [ 12.183407] which belongs to the cache kmalloc-128 of size 128 [ 12.183831] The buggy address is located 117 bytes inside of [ 12.183831] allocated 120-byte region [ffff88810261c200, ffff88810261c278) [ 12.184208] [ 12.184308] The buggy address belongs to the physical page: [ 12.184485] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10261c [ 12.184793] flags: 0x200000000000000(node=0|zone=2) [ 12.184982] page_type: f5(slab) [ 12.185172] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.185622] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 12.186130] page dumped because: kasan: bad access detected [ 12.187808] [ 12.187983] Memory state around the buggy address: [ 12.188342] ffff88810261c100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.188807] ffff88810261c180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.189092] >ffff88810261c200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 12.189329] ^ [ 12.189753] ffff88810261c280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.190228] ffff88810261c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.190552] ==================================================================