Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 20.260843] ================================================================== [ 20.261873] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x308/0x340 [ 20.262693] Read of size 1 at addr fff00000c662acdf by task kunit_try_catch/128 [ 20.263895] [ 20.264329] CPU: 1 UID: 0 PID: 128 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 20.264584] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.264663] Hardware name: linux,dummy-virt (DT) [ 20.264759] Call trace: [ 20.264820] dump_backtrace+0x9c/0x128 [ 20.264878] show_stack+0x20/0x38 [ 20.264921] dump_stack_lvl+0x8c/0xd0 [ 20.264997] print_report+0x118/0x5f0 [ 20.265046] kasan_report+0xdc/0x128 [ 20.265088] __asan_report_load1_noabort+0x20/0x30 [ 20.265137] kmalloc_oob_left+0x308/0x340 [ 20.265184] kunit_try_run_case+0x170/0x3f0 [ 20.265234] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.265286] kthread+0x24c/0x2d0 [ 20.265332] ret_from_fork+0x10/0x20 [ 20.265381] [ 20.272578] Allocated by task 1: [ 20.273075] kasan_save_stack+0x3c/0x68 [ 20.273720] kasan_save_track+0x20/0x40 [ 20.274240] kasan_save_alloc_info+0x40/0x58 [ 20.274835] __kasan_kmalloc+0xd4/0xd8 [ 20.275630] __kmalloc_node_track_caller_noprof+0x194/0x438 [ 20.276384] kvasprintf+0xe0/0x180 [ 20.276937] __kthread_create_on_node+0x16c/0x348 [ 20.277575] kthread_create_on_node+0xe4/0x130 [ 20.278162] create_worker+0x380/0x6b8 [ 20.278771] alloc_unbound_pwq+0x62c/0x778 [ 20.279348] apply_wqattrs_prepare+0x1a0/0x6e0 [ 20.280206] apply_workqueue_attrs_locked+0x58/0xb8 [ 20.280860] alloc_workqueue+0x9ac/0x1440 [ 20.281475] latency_fsnotify_init+0x28/0x60 [ 20.282146] do_one_initcall+0xd0/0x608 [ 20.282708] kernel_init_freeable+0x3e0/0x8a0 [ 20.283629] kernel_init+0x2c/0x1f8 [ 20.284107] ret_from_fork+0x10/0x20 [ 20.284542] [ 20.284830] The buggy address belongs to the object at fff00000c662acc0 [ 20.284830] which belongs to the cache kmalloc-16 of size 16 [ 20.285898] The buggy address is located 18 bytes to the right of [ 20.285898] allocated 13-byte region [fff00000c662acc0, fff00000c662accd) [ 20.286999] [ 20.287342] The buggy address belongs to the physical page: [ 20.287877] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10662a [ 20.288740] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.289513] page_type: f5(slab) [ 20.289975] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 20.290805] raw: 0000000000000000 0000000080800080 00000001f5000000 0000000000000000 [ 20.292185] page dumped because: kasan: bad access detected [ 20.292728] [ 20.293057] Memory state around the buggy address: [ 20.293623] fff00000c662ab80: 00 02 fc fc 00 05 fc fc fa fb fc fc 00 02 fc fc [ 20.294843] fff00000c662ac00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 20.296020] >fff00000c662ac80: fa fb fc fc 00 04 fc fc 00 05 fc fc 00 07 fc fc [ 20.296730] ^ [ 20.297376] fff00000c662ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.298097] fff00000c662ad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.298829] ==================================================================
[ 16.343953] ================================================================== [ 16.345006] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x363/0x3c0 [ 16.345523] Read of size 1 at addr ffff8881025abcff by task kunit_try_catch/145 [ 16.347312] [ 16.347660] CPU: 0 UID: 0 PID: 145 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 16.347763] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.347784] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.347842] Call Trace: [ 16.347880] <TASK> [ 16.347906] dump_stack_lvl+0x73/0xb0 [ 16.347950] print_report+0xd1/0x640 [ 16.347986] ? __virt_addr_valid+0x1db/0x2d0 [ 16.348021] ? kmalloc_oob_left+0x363/0x3c0 [ 16.348053] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.348087] ? kmalloc_oob_left+0x363/0x3c0 [ 16.348119] kasan_report+0x140/0x180 [ 16.348153] ? kmalloc_oob_left+0x363/0x3c0 [ 16.348192] __asan_report_load1_noabort+0x18/0x20 [ 16.348260] kmalloc_oob_left+0x363/0x3c0 [ 16.348338] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 16.348417] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 16.348588] kunit_try_run_case+0x1a6/0x480 [ 16.348631] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.348661] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 16.348692] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.348729] ? __kthread_parkme+0x82/0x160 [ 16.348759] ? preempt_count_sub+0x50/0x80 [ 16.348792] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.348837] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.348885] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.348923] kthread+0x257/0x310 [ 16.348950] ? __pfx_kthread+0x10/0x10 [ 16.348976] ret_from_fork+0x41/0x80 [ 16.349008] ? __pfx_kthread+0x10/0x10 [ 16.349033] ret_from_fork_asm+0x1a/0x30 [ 16.349075] </TASK> [ 16.349089] [ 16.364618] Allocated by task 1: [ 16.364960] kasan_save_stack+0x45/0x70 [ 16.365508] kasan_save_track+0x18/0x40 [ 16.366266] kasan_save_alloc_info+0x3b/0x50 [ 16.366611] __kasan_kmalloc+0xb7/0xc0 [ 16.367300] __kmalloc_node_track_caller_noprof+0x1ee/0x460 [ 16.368038] kvasprintf+0xc6/0x150 [ 16.368436] __kthread_create_on_node+0x18c/0x3a0 [ 16.368840] kthread_create_on_node+0xac/0xe0 [ 16.369292] create_worker+0x3e7/0x7b0 [ 16.369600] alloc_unbound_pwq+0x8ea/0xdb0 [ 16.370253] apply_wqattrs_prepare+0x332/0xd20 [ 16.370690] apply_workqueue_attrs_locked+0x4d/0xa0 [ 16.371278] alloc_workqueue+0xcc8/0x1ad0 [ 16.372305] latency_fsnotify_init+0x1b/0x50 [ 16.373347] do_one_initcall+0xd9/0x370 [ 16.374087] kernel_init_freeable+0x425/0x6f0 [ 16.374876] kernel_init+0x23/0x1e0 [ 16.375581] ret_from_fork+0x41/0x80 [ 16.375964] ret_from_fork_asm+0x1a/0x30 [ 16.376355] [ 16.376582] The buggy address belongs to the object at ffff8881025abce0 [ 16.376582] which belongs to the cache kmalloc-16 of size 16 [ 16.378136] The buggy address is located 18 bytes to the right of [ 16.378136] allocated 13-byte region [ffff8881025abce0, ffff8881025abced) [ 16.379464] [ 16.379649] The buggy address belongs to the physical page: [ 16.381141] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1025ab [ 16.381965] flags: 0x200000000000000(node=0|zone=2) [ 16.382337] page_type: f5(slab) [ 16.382786] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 16.384032] raw: 0000000000000000 0000000080800080 00000001f5000000 0000000000000000 [ 16.384604] page dumped because: kasan: bad access detected [ 16.385618] [ 16.385776] Memory state around the buggy address: [ 16.386547] ffff8881025abb80: 00 03 fc fc fa fb fc fc 00 02 fc fc 00 05 fc fc [ 16.386809] ffff8881025abc00: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 02 fc fc [ 16.387067] >ffff8881025abc80: fa fb fc fc fa fb fc fc fa fb fc fc 00 05 fc fc [ 16.387407] ^ [ 16.387991] ffff8881025abd00: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.389227] ffff8881025abd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.389760] ==================================================================