Date
June 7, 2025, 10:40 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 22.221062] ================================================================== [ 22.222295] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x350/0x440 [ 22.222621] Read of size 1 at addr fff00000c41840c8 by task kunit_try_catch/195 [ 22.222943] [ 22.223278] CPU: 1 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 22.223558] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.223640] Hardware name: linux,dummy-virt (DT) [ 22.223729] Call trace: [ 22.223799] dump_backtrace+0x9c/0x128 [ 22.223921] show_stack+0x20/0x38 [ 22.224045] dump_stack_lvl+0x8c/0xd0 [ 22.224161] print_report+0x118/0x5f0 [ 22.224268] kasan_report+0xdc/0x128 [ 22.224378] __asan_report_load1_noabort+0x20/0x30 [ 22.224501] kmem_cache_oob+0x350/0x440 [ 22.224623] kunit_try_run_case+0x170/0x3f0 [ 22.224740] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.224874] kthread+0x24c/0x2d0 [ 22.224991] ret_from_fork+0x10/0x20 [ 22.225138] [ 22.232309] Allocated by task 195: [ 22.232876] kasan_save_stack+0x3c/0x68 [ 22.233493] kasan_save_track+0x20/0x40 [ 22.234130] kasan_save_alloc_info+0x40/0x58 [ 22.234715] __kasan_slab_alloc+0xa8/0xb0 [ 22.235272] kmem_cache_alloc_noprof+0xf8/0x300 [ 22.236753] kmem_cache_oob+0x130/0x440 [ 22.237338] kunit_try_run_case+0x170/0x3f0 [ 22.237885] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.238524] kthread+0x24c/0x2d0 [ 22.238995] ret_from_fork+0x10/0x20 [ 22.239832] [ 22.240143] The buggy address belongs to the object at fff00000c4184000 [ 22.240143] which belongs to the cache test_cache of size 200 [ 22.241306] The buggy address is located 0 bytes to the right of [ 22.241306] allocated 200-byte region [fff00000c4184000, fff00000c41840c8) [ 22.242478] [ 22.242801] The buggy address belongs to the physical page: [ 22.243623] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104184 [ 22.244458] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 22.245205] page_type: f5(slab) [ 22.245704] raw: 0bfffe0000000000 fff00000c5c00dc0 dead000000000122 0000000000000000 [ 22.246930] raw: 0000000000000000 00000000800f000f 00000001f5000000 0000000000000000 [ 22.247707] page dumped because: kasan: bad access detected [ 22.248338] [ 22.248643] Memory state around the buggy address: [ 22.249720] fff00000c4183f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 22.250433] fff00000c4184000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.251124] >fff00000c4184080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 22.251868] ^ [ 22.252513] fff00000c4184100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.253276] fff00000c4184180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.254075] ==================================================================
[ 18.766428] ================================================================== [ 18.767239] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x404/0x530 [ 18.767872] Read of size 1 at addr ffff88810292b0c8 by task kunit_try_catch/212 [ 18.768584] [ 18.769306] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G B N 6.12.33-rc1 #1 [ 18.769423] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.769459] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.769825] Call Trace: [ 18.769865] <TASK> [ 18.769912] dump_stack_lvl+0x73/0xb0 [ 18.769994] print_report+0xd1/0x640 [ 18.770069] ? __virt_addr_valid+0x1db/0x2d0 [ 18.770145] ? kmem_cache_oob+0x404/0x530 [ 18.770212] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.770307] ? kmem_cache_oob+0x404/0x530 [ 18.770370] kasan_report+0x140/0x180 [ 18.770448] ? kmem_cache_oob+0x404/0x530 [ 18.770645] __asan_report_load1_noabort+0x18/0x20 [ 18.770720] kmem_cache_oob+0x404/0x530 [ 18.770781] ? trace_hardirqs_on+0x37/0xe0 [ 18.770836] ? __pfx_kmem_cache_oob+0x10/0x10 [ 18.770892] ? finish_task_switch.isra.0+0x153/0x700 [ 18.770921] ? __switch_to+0x5d9/0xf60 [ 18.770958] ? __pfx_read_tsc+0x10/0x10 [ 18.770984] ? ktime_get_ts64+0x84/0x230 [ 18.771019] kunit_try_run_case+0x1a6/0x480 [ 18.771052] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.771080] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 18.771110] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.771145] ? __kthread_parkme+0x82/0x160 [ 18.771172] ? preempt_count_sub+0x50/0x80 [ 18.771200] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.771267] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.771311] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.771347] kthread+0x257/0x310 [ 18.771372] ? __pfx_kthread+0x10/0x10 [ 18.771397] ret_from_fork+0x41/0x80 [ 18.771425] ? __pfx_kthread+0x10/0x10 [ 18.771464] ret_from_fork_asm+0x1a/0x30 [ 18.771541] </TASK> [ 18.771557] [ 18.786183] Allocated by task 212: [ 18.786571] kasan_save_stack+0x45/0x70 [ 18.787174] kasan_save_track+0x18/0x40 [ 18.787573] kasan_save_alloc_info+0x3b/0x50 [ 18.788176] __kasan_slab_alloc+0x91/0xa0 [ 18.788527] kmem_cache_alloc_noprof+0x107/0x350 [ 18.789001] kmem_cache_oob+0x158/0x530 [ 18.789807] kunit_try_run_case+0x1a6/0x480 [ 18.790294] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.790835] kthread+0x257/0x310 [ 18.791190] ret_from_fork+0x41/0x80 [ 18.791531] ret_from_fork_asm+0x1a/0x30 [ 18.791844] [ 18.792055] The buggy address belongs to the object at ffff88810292b000 [ 18.792055] which belongs to the cache test_cache of size 200 [ 18.792995] The buggy address is located 0 bytes to the right of [ 18.792995] allocated 200-byte region [ffff88810292b000, ffff88810292b0c8) [ 18.795599] [ 18.795854] The buggy address belongs to the physical page: [ 18.796912] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10292b [ 18.798154] flags: 0x200000000000000(node=0|zone=2) [ 18.799606] page_type: f5(slab) [ 18.800190] raw: 0200000000000000 ffff888101a84b40 dead000000000122 0000000000000000 [ 18.800833] raw: 0000000000000000 00000000800f000f 00000001f5000000 0000000000000000 [ 18.801884] page dumped because: kasan: bad access detected [ 18.802392] [ 18.803006] Memory state around the buggy address: [ 18.803671] ffff88810292af80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.804391] ffff88810292b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.805195] >ffff88810292b080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 18.806087] ^ [ 18.806643] ffff88810292b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.807539] ffff88810292b180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.808506] ==================================================================