Date
June 2, 2025, 2:13 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.826081] ================================================================== [ 17.827620] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 17.828507] Read of size 1 at addr fff00000c3e6061f by task kunit_try_catch/128 [ 17.829118] [ 17.829464] CPU: 0 UID: 0 PID: 128 Comm: kunit_try_catch Tainted: G B N 6.14.10-rc1 #1 [ 17.829677] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.829743] Hardware name: linux,dummy-virt (DT) [ 17.829823] Call trace: [ 17.829880] show_stack+0x20/0x38 (C) [ 17.830010] dump_stack_lvl+0x8c/0xd0 [ 17.830128] print_report+0x118/0x608 [ 17.830275] kasan_report+0xdc/0x128 [ 17.830365] __asan_report_load1_noabort+0x20/0x30 [ 17.830460] kmalloc_oob_left+0x2ec/0x320 [ 17.830552] kunit_try_run_case+0x170/0x3f0 [ 17.830607] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.830663] kthread+0x318/0x620 [ 17.830713] ret_from_fork+0x10/0x20 [ 17.830767] [ 17.835435] Allocated by task 29: [ 17.835696] kasan_save_stack+0x3c/0x68 [ 17.835991] kasan_save_track+0x20/0x40 [ 17.836438] kasan_save_alloc_info+0x40/0x58 [ 17.836938] __kasan_kmalloc+0xd4/0xd8 [ 17.839310] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 17.839728] kstrdup+0x54/0xc8 [ 17.840002] devtmpfs_work_loop+0x398/0x5b0 [ 17.840332] devtmpfsd+0x50/0x58 [ 17.840620] kthread+0x318/0x620 [ 17.840910] ret_from_fork+0x10/0x20 [ 17.841617] [ 17.843664] Freed by task 29: [ 17.844126] kasan_save_stack+0x3c/0x68 [ 17.844655] kasan_save_track+0x20/0x40 [ 17.845100] kasan_save_free_info+0x4c/0x78 [ 17.846519] __kasan_slab_free+0x6c/0x98 [ 17.846843] kfree+0x214/0x3c8 [ 17.847080] devtmpfs_work_loop+0x4b8/0x5b0 [ 17.847385] devtmpfsd+0x50/0x58 [ 17.847627] kthread+0x318/0x620 [ 17.847997] ret_from_fork+0x10/0x20 [ 17.848581] [ 17.848803] The buggy address belongs to the object at fff00000c3e60600 [ 17.848803] which belongs to the cache kmalloc-16 of size 16 [ 17.849445] The buggy address is located 15 bytes to the right of [ 17.849445] allocated 16-byte region [fff00000c3e60600, fff00000c3e60610) [ 17.850615] [ 17.850844] The buggy address belongs to the physical page: [ 17.851202] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103e60 [ 17.851942] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.852550] page_type: f5(slab) [ 17.852983] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 17.853772] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 17.854531] page dumped because: kasan: bad access detected [ 17.854851] [ 17.855035] Memory state around the buggy address: [ 17.855376] fff00000c3e60500: fa fb fc fc 00 05 fc fc fa fb fc fc fa fb fc fc [ 17.856039] fff00000c3e60580: 00 02 fc fc fa fb fc fc fa fb fc fc 00 05 fc fc [ 17.856649] >fff00000c3e60600: fa fb fc fc 00 07 fc fc fc fc fc fc fc fc fc fc [ 17.857147] ^ [ 17.857482] fff00000c3e60680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.858483] fff00000c3e60700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.859201] ==================================================================
[ 12.079344] ================================================================== [ 12.080658] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x363/0x3c0 [ 12.081750] Read of size 1 at addr ffff8881025d035f by task kunit_try_catch/146 [ 12.082873] [ 12.083070] CPU: 0 UID: 0 PID: 146 Comm: kunit_try_catch Tainted: G B N 6.14.10-rc1 #1 [ 12.083114] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.083127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.083149] Call Trace: [ 12.083162] <TASK> [ 12.083180] dump_stack_lvl+0x73/0xb0 [ 12.083211] print_report+0xd1/0x650 [ 12.083235] ? __virt_addr_valid+0x1db/0x2d0 [ 12.083261] ? kmalloc_oob_left+0x363/0x3c0 [ 12.083283] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.083310] ? kmalloc_oob_left+0x363/0x3c0 [ 12.083333] kasan_report+0x140/0x180 [ 12.083357] ? kmalloc_oob_left+0x363/0x3c0 [ 12.083384] __asan_report_load1_noabort+0x18/0x20 [ 12.083409] kmalloc_oob_left+0x363/0x3c0 [ 12.083549] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 12.083574] ? __schedule+0xce8/0x2840 [ 12.083601] ? __pfx_read_tsc+0x10/0x10 [ 12.083626] ? ktime_get_ts64+0x86/0x230 [ 12.083656] kunit_try_run_case+0x1a6/0x480 [ 12.083682] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.083705] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 12.083731] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.083756] ? __kthread_parkme+0x82/0x160 [ 12.083781] ? preempt_count_sub+0x50/0x80 [ 12.083808] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.083832] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.083860] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.083888] kthread+0x324/0x6e0 [ 12.083911] ? trace_preempt_on+0x20/0xc0 [ 12.083937] ? __pfx_kthread+0x10/0x10 [ 12.083961] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.083985] ? calculate_sigpending+0x7b/0xa0 [ 12.084009] ? __pfx_kthread+0x10/0x10 [ 12.084043] ret_from_fork+0x41/0x80 [ 12.084064] ? __pfx_kthread+0x10/0x10 [ 12.084089] ret_from_fork_asm+0x1a/0x30 [ 12.084122] </TASK> [ 12.084133] [ 12.098537] Allocated by task 1: [ 12.098857] kasan_save_stack+0x45/0x70 [ 12.099194] kasan_save_track+0x18/0x40 [ 12.099338] kasan_save_alloc_info+0x3b/0x50 [ 12.099490] __kasan_kmalloc+0xb7/0xc0 [ 12.099880] __kmalloc_node_track_caller_noprof+0x1cc/0x510 [ 12.100387] kstrdup+0x3e/0xa0 [ 12.100679] kstrdup_const+0x2c/0x40 [ 12.101320] __kernfs_new_node+0xa8/0x6d0 [ 12.102686] kernfs_new_node+0x128/0x230 [ 12.103085] __kernfs_create_file+0x2d/0x290 [ 12.103531] sysfs_add_bin_file_mode_ns+0x13f/0x4f0 [ 12.103884] sysfs_create_bin_file+0x151/0x200 [ 12.104323] pci_create_attr+0x1e2/0x460 [ 12.104479] pci_create_resource_files+0x74/0x110 [ 12.104739] pci_sysfs_init+0x32/0x90 [ 12.105368] do_one_initcall+0xd9/0x370 [ 12.105740] kernel_init_freeable+0x425/0x6f0 [ 12.106340] kernel_init+0x23/0x1e0 [ 12.106478] ret_from_fork+0x41/0x80 [ 12.106928] ret_from_fork_asm+0x1a/0x30 [ 12.107315] [ 12.107479] The buggy address belongs to the object at ffff8881025d0340 [ 12.107479] which belongs to the cache kmalloc-16 of size 16 [ 12.108835] The buggy address is located 21 bytes to the right of [ 12.108835] allocated 10-byte region [ffff8881025d0340, ffff8881025d034a) [ 12.109503] [ 12.109599] The buggy address belongs to the physical page: [ 12.110340] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1025d0 [ 12.111230] flags: 0x200000000000000(node=0|zone=2) [ 12.111402] page_type: f5(slab) [ 12.111526] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 12.112467] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 12.113216] page dumped because: kasan: bad access detected [ 12.113776] [ 12.113959] Memory state around the buggy address: [ 12.114349] ffff8881025d0200: 00 05 fc fc 00 05 fc fc 00 02 fc fc 00 03 fc fc [ 12.114609] ffff8881025d0280: fa fb fc fc 00 02 fc fc 00 05 fc fc 00 02 fc fc [ 12.115261] >ffff8881025d0300: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 07 fc fc [ 12.116086] ^ [ 12.116650] ffff8881025d0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.116870] ffff8881025d0400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.117092] ==================================================================