Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 21.416297] ================================================================== [ 21.417303] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x15c/0x310 [ 21.418000] Write of size 8 at addr fff00000c416b871 by task kunit_try_catch/164 [ 21.419322] [ 21.420008] CPU: 1 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 21.420285] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.420353] Hardware name: linux,dummy-virt (DT) [ 21.420393] Call trace: [ 21.420421] dump_backtrace+0x9c/0x128 [ 21.420474] show_stack+0x20/0x38 [ 21.420516] dump_stack_lvl+0x8c/0xd0 [ 21.420563] print_report+0x118/0x5f0 [ 21.420605] kasan_report+0xdc/0x128 [ 21.420646] kasan_check_range+0x100/0x1a8 [ 21.420690] __asan_memset+0x34/0x78 [ 21.420733] kmalloc_oob_memset_8+0x15c/0x310 [ 21.420795] kunit_try_run_case+0x170/0x3f0 [ 21.420842] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.420894] kthread+0x24c/0x2d0 [ 21.420936] ret_from_fork+0x10/0x20 [ 21.421012] [ 21.428993] Allocated by task 164: [ 21.429491] kasan_save_stack+0x3c/0x68 [ 21.429985] kasan_save_track+0x20/0x40 [ 21.430467] kasan_save_alloc_info+0x40/0x58 [ 21.430985] __kasan_kmalloc+0xd4/0xd8 [ 21.431505] __kmalloc_cache_noprof+0x154/0x320 [ 21.432033] kmalloc_oob_memset_8+0xb0/0x310 [ 21.432598] kunit_try_run_case+0x170/0x3f0 [ 21.433404] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.433986] kthread+0x24c/0x2d0 [ 21.434506] ret_from_fork+0x10/0x20 [ 21.435032] [ 21.435314] The buggy address belongs to the object at fff00000c416b800 [ 21.435314] which belongs to the cache kmalloc-128 of size 128 [ 21.438101] The buggy address is located 113 bytes inside of [ 21.438101] allocated 120-byte region [fff00000c416b800, fff00000c416b878) [ 21.439836] [ 21.440149] The buggy address belongs to the physical page: [ 21.441031] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10416b [ 21.441805] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.442512] page_type: f5(slab) [ 21.442951] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 21.444467] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 21.445245] page dumped because: kasan: bad access detected [ 21.445814] [ 21.446163] Memory state around the buggy address: [ 21.446706] fff00000c416b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 21.447645] fff00000c416b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.448736] >fff00000c416b800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 21.449513] ^ [ 21.450096] fff00000c416b880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.450780] fff00000c416b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.451479] ==================================================================
[ 17.764642] ================================================================== [ 17.765447] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x167/0x330 [ 17.766664] Write of size 8 at addr ffff888102921b71 by task kunit_try_catch/181 [ 17.767069] [ 17.768303] CPU: 0 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 17.768406] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.768454] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.768513] Call Trace: [ 17.768566] <TASK> [ 17.768611] dump_stack_lvl+0x73/0xb0 [ 17.768657] print_report+0xd1/0x640 [ 17.768692] ? __virt_addr_valid+0x1db/0x2d0 [ 17.768727] ? kmalloc_oob_memset_8+0x167/0x330 [ 17.768758] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.768789] ? kmalloc_oob_memset_8+0x167/0x330 [ 17.768840] kasan_report+0x140/0x180 [ 17.768883] ? kmalloc_oob_memset_8+0x167/0x330 [ 17.768922] kasan_check_range+0x10c/0x1c0 [ 17.768949] __asan_memset+0x27/0x50 [ 17.768977] kmalloc_oob_memset_8+0x167/0x330 [ 17.769010] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 17.769043] ? __schedule+0xc49/0x27a0 [ 17.769074] ? __pfx_read_tsc+0x10/0x10 [ 17.769103] ? ktime_get_ts64+0x84/0x230 [ 17.769141] kunit_try_run_case+0x1a6/0x480 [ 17.769174] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.769202] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 17.769258] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.769294] ? __kthread_parkme+0x82/0x160 [ 17.769323] ? preempt_count_sub+0x50/0x80 [ 17.769354] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.769382] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.769418] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.769473] kthread+0x257/0x310 [ 17.769560] ? __pfx_kthread+0x10/0x10 [ 17.769596] ret_from_fork+0x41/0x80 [ 17.769627] ? __pfx_kthread+0x10/0x10 [ 17.769651] ret_from_fork_asm+0x1a/0x30 [ 17.769694] </TASK> [ 17.769708] [ 17.792090] Allocated by task 181: [ 17.792552] kasan_save_stack+0x45/0x70 [ 17.793719] kasan_save_track+0x18/0x40 [ 17.794333] kasan_save_alloc_info+0x3b/0x50 [ 17.794934] __kasan_kmalloc+0xb7/0xc0 [ 17.795813] __kmalloc_cache_noprof+0x168/0x350 [ 17.796417] kmalloc_oob_memset_8+0xad/0x330 [ 17.797262] kunit_try_run_case+0x1a6/0x480 [ 17.797955] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.798408] kthread+0x257/0x310 [ 17.798901] ret_from_fork+0x41/0x80 [ 17.799328] ret_from_fork_asm+0x1a/0x30 [ 17.799756] [ 17.800122] The buggy address belongs to the object at ffff888102921b00 [ 17.800122] which belongs to the cache kmalloc-128 of size 128 [ 17.801098] The buggy address is located 113 bytes inside of [ 17.801098] allocated 120-byte region [ffff888102921b00, ffff888102921b78) [ 17.803239] [ 17.803436] The buggy address belongs to the physical page: [ 17.803975] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102921 [ 17.805134] flags: 0x200000000000000(node=0|zone=2) [ 17.805904] page_type: f5(slab) [ 17.806263] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 17.807406] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 17.808393] page dumped because: kasan: bad access detected [ 17.809234] [ 17.809471] Memory state around the buggy address: [ 17.809815] ffff888102921a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 17.811239] ffff888102921a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.812197] >ffff888102921b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.813084] ^ [ 17.813976] ffff888102921b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.815078] ffff888102921c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.815651] ==================================================================