Date
June 2, 2025, 2:11 p.m.
| Environment | |
|---|---|
| e850-96 | |
| qemu-arm64 | |
| qemu-x86_64 |
[ 26.475302] ================================================================== [ 26.485148] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 26.492698] Read of size 18446744073709551614 at addr ffff000800cab184 by task kunit_try_catch/227 [ 26.501637] [ 26.503124] CPU: 6 UID: 0 PID: 227 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT [ 26.503175] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.503189] Hardware name: WinLink E850-96 board (DT) [ 26.503212] Call trace: [ 26.503230] show_stack+0x20/0x38 (C) [ 26.503265] dump_stack_lvl+0x8c/0xd0 [ 26.503300] print_report+0x118/0x608 [ 26.503333] kasan_report+0xdc/0x128 [ 26.503364] kasan_check_range+0x100/0x1a8 [ 26.503398] __asan_memmove+0x3c/0x98 [ 26.503430] kmalloc_memmove_negative_size+0x154/0x2e0 [ 26.503471] kunit_try_run_case+0x170/0x3f0 [ 26.503509] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.503547] kthread+0x328/0x630 [ 26.503583] ret_from_fork+0x10/0x20 [ 26.503621] [ 26.569866] Allocated by task 227: [ 26.573252] kasan_save_stack+0x3c/0x68 [ 26.577070] kasan_save_track+0x20/0x40 [ 26.580889] kasan_save_alloc_info+0x40/0x58 [ 26.585143] __kasan_kmalloc+0xd4/0xd8 [ 26.588875] __kmalloc_cache_noprof+0x16c/0x3c0 [ 26.593389] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 26.598425] kunit_try_run_case+0x170/0x3f0 [ 26.602589] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.608059] kthread+0x328/0x630 [ 26.611271] ret_from_fork+0x10/0x20 [ 26.614829] [ 26.616308] The buggy address belongs to the object at ffff000800cab180 [ 26.616308] which belongs to the cache kmalloc-64 of size 64 [ 26.628635] The buggy address is located 4 bytes inside of [ 26.628635] 64-byte region [ffff000800cab180, ffff000800cab1c0) [ 26.640089] [ 26.641569] The buggy address belongs to the physical page: [ 26.647125] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880cab [ 26.655110] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 26.661618] page_type: f5(slab) [ 26.664755] raw: 0bfffe0000000000 ffff0008000028c0 dead000000000122 0000000000000000 [ 26.672474] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 26.680193] page dumped because: kasan: bad access detected [ 26.685748] [ 26.687224] Memory state around the buggy address: [ 26.692006] ffff000800cab080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.699207] ffff000800cab100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.706412] >ffff000800cab180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 26.713613] ^ [ 26.716829] ffff000800cab200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.724032] ffff000800cab280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.731234] ==================================================================
[ 18.268860] ================================================================== [ 18.268957] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 18.269034] Read of size 18446744073709551614 at addr fff00000ffe7afc4 by task kunit_try_catch/183 [ 18.269116] [ 18.269155] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT [ 18.281479] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.281586] Hardware name: linux,dummy-virt (DT) [ 18.281631] Call trace: [ 18.281678] show_stack+0x20/0x38 (C) [ 18.281740] dump_stack_lvl+0x8c/0xd0 [ 18.281791] print_report+0x118/0x608 [ 18.281837] kasan_report+0xdc/0x128 [ 18.281989] kasan_check_range+0x100/0x1a8 [ 18.285444] __asan_memmove+0x3c/0x98 [ 18.287504] kmalloc_memmove_negative_size+0x154/0x2e0 [ 18.287582] kunit_try_run_case+0x170/0x3f0 [ 18.288574] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.290855] kthread+0x328/0x630 [ 18.290960] ret_from_fork+0x10/0x20 [ 18.293403] [ 18.293447] Allocated by task 2846403498: [ 18.298216] ------------[ cut here ]------------ [ 18.298291] pool index 44973 out of bounds (211) for stack id adacafae [ 18.301263] WARNING: CPU: 1 PID: 183 at lib/stackdepot.c:451 depot_fetch_stack+0x6c/0x90 [ 19.010058] Modules linked in: [ 19.011688] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT [ 19.013148] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.013871] Hardware name: linux,dummy-virt (DT) [ 19.014688] pstate: 624020c9 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 19.015906] pc : depot_fetch_stack+0x6c/0x90 [ 19.016559] lr : depot_fetch_stack+0x6c/0x90 [ 19.017307] sp : ffff800080977a20 [ 19.017951] x29: ffff800080977a20 x28: ffffaf0a3e9f1000 x27: 1ffff00010010f60 [ 19.019065] x26: 1ffff00010010f5f x25: 0000000000000000 x24: ffffaf0a37949884 [ 19.019880] x23: ffffc1ffc3ff9e80 x22: ffffaf0a3c3dd278 x21: ffffaf0a3c3e0498 [ 19.020857] x20: fff00000ffe7afc4 x19: ffff800080977b30 x18: 00000000fc2f539e [ 19.021864] x17: 0000000000000001 x16: 00000000f1f1f1f1 x15: 0000000000000007 [ 19.022643] x14: 0000000000000000 x13: 0000000000000007 x12: ffff70001012eea1 [ 19.023018] x11: 1ffff0001012eea0 x10: ffff70001012eea0 x9 : ffffaf0a372e4724 [ 19.023436] x8 : ffff800080977507 x7 : 0000000000000001 x6 : ffff70001012eea0 [ 19.023786] x5 : ffff800080977500 x4 : 1ffe000018ef9799 x3 : dfff800000000000 [ 19.024142] x2 : 0000000000000000 x1 : 0000000000000000 x0 : fff00000c77cbcc0 [ 19.024783] Call trace: [ 19.025084] depot_fetch_stack+0x6c/0x90 (P) [ 19.025547] stack_depot_print+0x24/0x60 [ 19.025958] print_report+0x5e4/0x608 [ 19.026344] kasan_report+0xdc/0x128 [ 19.026735] kasan_check_range+0x100/0x1a8 [ 19.027194] __asan_memmove+0x3c/0x98 [ 19.027592] kmalloc_memmove_negative_size+0x154/0x2e0 [ 19.028097] kunit_try_run_case+0x170/0x3f0 [ 19.028543] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.029474] kthread+0x328/0x630 [ 19.029992] ret_from_fork+0x10/0x20 [ 19.030678] ---[ end trace 0000000000000000 ]--- [ 19.031668] ------------[ cut here ]------------ [ 19.031719] corrupt handle or use after stack_depot_put() [ 19.031810] WARNING: CPU: 1 PID: 183 at lib/stackdepot.c:723 stack_depot_print+0x54/0x60 [ 19.034074] Modules linked in: [ 19.034562] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B W N 6.15.1-rc1 #1 PREEMPT [ 19.035612] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 19.036227] Hardware name: linux,dummy-virt (DT) [ 19.036828] pstate: 624020c9 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 19.037422] pc : stack_depot_print+0x54/0x60 [ 19.037641] lr : stack_depot_print+0x54/0x60 [ 19.037840] sp : ffff800080977a30 [ 19.037997] x29: ffff800080977a30 x28: ffffaf0a3e9f1000 x27: 1ffff00010010f60 [ 19.038368] x26: 1ffff00010010f5f x25: 0000000000000000 x24: ffffaf0a37949884 [ 19.039406] x23: ffffc1ffc3ff9e80 x22: ffffaf0a3c3dd278 x21: ffffaf0a3c3e0498 [ 19.040170] x20: fff00000ffe7afc4 x19: ffff800080977b30 x18: 00000000fc2f539e [ 19.040935] x17: 0000000000000001 x16: 00000000f1f1f1f1 x15: 00000000f3f3f3f3 [ 19.041710] x14: ffff70001012ef26 x13: 1ffe000018ef9799 x12: ffff75e147c20809 [ 19.042464] x11: 1ffff5e147c20808 x10: ffff75e147c20808 x9 : ffffaf0a372e4724 [ 19.043216] x8 : ffffaf0a3e104043 x7 : 0000000000000001 x6 : ffff75e147c20808 [ 19.043971] x5 : ffffaf0a3e104040 x4 : 1ffe000018ef9799 x3 : dfff800000000000 [ 19.044724] x2 : 0000000000000000 x1 : 0000000000000000 x0 : fff00000c77cbcc0 [ 19.045482] Call trace: [ 19.045787] stack_depot_print+0x54/0x60 (P) [ 19.046158] print_report+0x5e4/0x608 [ 19.046552] kasan_report+0xdc/0x128 [ 19.046863] kasan_check_range+0x100/0x1a8 [ 19.047078] __asan_memmove+0x3c/0x98 [ 19.047267] kmalloc_memmove_negative_size+0x154/0x2e0 [ 19.047854] kunit_try_run_case+0x170/0x3f0 [ 19.048320] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.048895] kthread+0x328/0x630 [ 19.049277] ret_from_fork+0x10/0x20 [ 19.049707] ---[ end trace 0000000000000000 ]--- [ 19.050211] [ 19.050245] Last potentially related work creation: [ 19.050283] ------------[ cut here ]------------ [ 19.050310] pool index 43945 out of bounds (211) for stack id a9a8abaa [ 19.050431] WARNING: CPU: 1 PID: 183 at lib/stackdepot.c:451 depot_fetch_stack+0x6c/0x90 [ 19.052151] Modules linked in: [ 19.052343] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B W N 6.15.1-rc1 #1 PREEMPT [ 19.053323] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 19.053849] Hardware name: linux,dummy-virt (DT) [ 19.054329] pstate: 624020c9 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 19.055012] pc : depot_fetch_stack+0x6c/0x90 [ 19.055489] lr : depot_fetch_stack+0x6c/0x90 [ 19.055922] sp : ffff800080977a00 [ 19.056083] x29: ffff800080977a00 x28: ffffaf0a3e9f1000 x27: 1ffff00010010f60 [ 19.056443] x26: 1ffff00010010f5f x25: 0000000000000000 x24: ffffaf0a37949884 [ 19.056791] x23: ffffc1ffc3ff9e80 x22: ffffaf0a3c3dd278 x21: ffffaf0a3c3e0498 [ 19.057135] x20: fff00000ffe7afc4 x19: fff00000ffe7a040 x18: 00000000fc2f539e [ 19.057759] x17: 0000000000000001 x16: 00000000f1f1f1f1 x15: 0000000000000007 [ 19.058515] x14: 0000000000000000 x13: 0000000000000007 x12: ffff75e147c20809 [ 19.059288] x11: 1ffff5e147c20808 x10: ffff75e147c20808 x9 : ffffaf0a372e4724 [ 19.060042] x8 : ffffaf0a3e104043 x7 : 0000000000000001 x6 : ffff75e147c20808 [ 19.060790] x5 : ffffaf0a3e104040 x4 : 1ffe000018ef9799 x3 : dfff800000000000 [ 19.061670] x2 : 0000000000000000 x1 : 0000000000000000 x0 : fff00000c77cbcc0 [ 19.062454] Call trace: [ 19.062734] depot_fetch_stack+0x6c/0x90 (P) [ 19.063227] stack_depot_print+0x24/0x60 [ 19.063490] kasan_print_aux_stacks+0x50/0x98 [ 19.063713] print_report+0x348/0x608 [ 19.063902] kasan_report+0xdc/0x128 [ 19.064082] kasan_check_range+0x100/0x1a8 [ 19.064280] __asan_memmove+0x3c/0x98 [ 19.064710] kmalloc_memmove_negative_size+0x154/0x2e0 [ 19.065264] kunit_try_run_case+0x170/0x3f0 [ 19.065738] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.066306] kthread+0x328/0x630 [ 19.066701] ret_from_fork+0x10/0x20 [ 19.067115] ---[ end trace 0000000000000000 ]--- [ 19.067621] ------------[ cut here ]------------ [ 19.067649] corrupt handle or use after stack_depot_put() [ 19.067731] WARNING: CPU: 1 PID: 183 at lib/stackdepot.c:723 stack_depot_print+0x54/0x60 [ 19.069458] Modules linked in: [ 19.069820] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B W N 6.15.1-rc1 #1 PREEMPT [ 19.070658] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 19.070866] Hardware name: linux,dummy-virt (DT) [ 19.071071] pstate: 624020c9 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 19.071365] pc : stack_depot_print+0x54/0x60 [ 19.071820] lr : stack_depot_print+0x54/0x60 [ 19.072286] sp : ffff800080977a10 [ 19.072635] x29: ffff800080977a10 x28: ffffaf0a3e9f1000 x27: 1ffff00010010f60 [ 19.073387] x26: 1ffff00010010f5f x25: 0000000000000000 x24: ffffaf0a37949884 [ 19.074156] x23: ffffc1ffc3ff9e80 x22: ffffaf0a3c3dd278 x21: ffffaf0a3c3e0498 [ 19.074906] x20: fff00000ffe7afc4 x19: fff00000ffe7a040 x18: 00000000fc2f539e [ 19.075671] x17: 0000000000000001 x16: 00000000f1f1f1f1 x15: 00000000f3f3f3f3 [ 19.076406] x14: ffff70001012ef22 x13: 1ffe000018ef9799 x12: ffff75e147c20809 [ 19.076761] x11: 1ffff5e147c20808 x10: ffff75e147c20808 x9 : ffffaf0a372e4724 [ 19.077109] x8 : ffffaf0a3e104043 x7 : 0000000000000001 x6 : ffff75e147c20808 [ 19.077476] x5 : ffffaf0a3e104040 x4 : 1ffe000018ef9799 x3 : dfff800000000000 [ 19.077917] x2 : 0000000000000000 x1 : 0000000000000000 x0 : fff00000c77cbcc0 [ 19.078309] Call trace: [ 19.078499] stack_depot_print+0x54/0x60 (P) [ 19.078766] kasan_print_aux_stacks+0x50/0x98 [ 19.079053] print_report+0x348/0x608 [ 19.079296] kasan_report+0xdc/0x128 [ 19.079536] kasan_check_range+0x100/0x1a8 [ 19.079782] __asan_memmove+0x3c/0x98 [ 19.080052] kmalloc_memmove_negative_size+0x154/0x2e0 [ 19.080382] kunit_try_run_case+0x170/0x3f0 [ 19.080669] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.081023] kthread+0x328/0x630 [ 19.081235] ret_from_fork+0x10/0x20 [ 19.081521] ---[ end trace 0000000000000000 ]--- [ 19.081790] [ 19.081827] Second to last potentially related work creation: [ 19.081879] ------------[ cut here ]------------ [ 19.081906] pool index 44973 out of bounds (211) for stack id adacafae [ 19.082025] WARNING: CPU: 1 PID: 183 at lib/stackdepot.c:451 depot_fetch_stack+0x6c/0x90 [ 19.083329] Modules linked in: [ 19.083572] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B W N 6.15.1-rc1 #1 PREEMPT [ 19.084123] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 19.084463] Hardware name: linux,dummy-virt (DT) [ 19.084739] pstate: 624020c9 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 19.085109] pc : depot_fetch_stack+0x6c/0x90 [ 19.085391] lr : depot_fetch_stack+0x6c/0x90 [ 19.085649] sp : ffff800080977a00 [ 19.085860] x29: ffff800080977a00 x28: ffffaf0a3e9f1000 x27: 1ffff00010010f60 [ 19.086285] x26: 1ffff00010010f5f x25: 0000000000000000 x24: ffffaf0a37949884 [ 19.086745] x23: ffffc1ffc3ff9e80 x22: ffffaf0a3c3dd278 x21: ffffaf0a3c3e0498 [ 19.087227] x20: fff00000ffe7afc4 x19: fff00000ffe7a040 x18: 00000000fc2f539e [ 19.087677] x17: 0000000000000001 x16: 00000000f1f1f1f1 x15: 0000000000000007 [ 19.088077] x14: 0000000000000000 x13: 0000000000000007 x12: ffff75e147c20809 [ 19.088562] x11: 1ffff5e147c20808 x10: ffff75e147c20808 x9 : ffffaf0a372e4724 [ 19.088983] x8 : ffffaf0a3e104043 x7 : 0000000000000001 x6 : ffff75e147c20808 [ 19.089445] x5 : ffffaf0a3e104040 x4 : 1ffe000018ef9799 x3 : dfff800000000000 [ 19.089914] x2 : 0000000000000000 x1 : 0000000000000000 x0 : fff00000c77cbcc0 [ 19.090329] Call trace: [ 19.090511] depot_fetch_stack+0x6c/0x90 (P) [ 19.090803] stack_depot_print+0x24/0x60 [ 19.091076] kasan_print_aux_stacks+0x78/0x98 [ 19.091345] print_report+0x348/0x608 [ 19.091610] kasan_report+0xdc/0x128 [ 19.091871] kasan_check_range+0x100/0x1a8 [ 19.092132] __asan_memmove+0x3c/0x98 [ 19.092375] kmalloc_memmove_negative_size+0x154/0x2e0 [ 19.092695] kunit_try_run_case+0x170/0x3f0 [ 19.092985] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.093294] kthread+0x328/0x630 [ 19.093496] ret_from_fork+0x10/0x20 [ 19.093773] ---[ end trace 0000000000000000 ]--- [ 19.093991] ------------[ cut here ]------------ [ 19.094020] corrupt handle or use after stack_depot_put() [ 19.094097] WARNING: CPU: 1 PID: 183 at lib/stackdepot.c:723 stack_depot_print+0x54/0x60 [ 19.095030] Modules linked in: [ 19.095266] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B W N 6.15.1-rc1 #1 PREEMPT [ 19.095717] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 19.096002] Hardware name: linux,dummy-virt (DT) [ 19.096229] pstate: 624020c9 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 19.096650] pc : stack_depot_print+0x54/0x60 [ 19.096935] lr : stack_depot_print+0x54/0x60 [ 19.097185] sp : ffff800080977a10 [ 19.097403] x29: ffff800080977a10 x28: ffffaf0a3e9f1000 x27: 1ffff00010010f60 [ 19.097851] x26: 1ffff00010010f5f x25: 0000000000000000 x24: ffffaf0a37949884 [ 19.098270] x23: ffffc1ffc3ff9e80 x22: ffffaf0a3c3dd278 x21: ffffaf0a3c3e0498 [ 19.098728] x20: fff00000ffe7afc4 x19: fff00000ffe7a040 x18: 00000000fc2f539e [ 19.099163] x17: 0000000000000001 x16: 00000000f1f1f1f1 x15: 00000000f3f3f3f3 [ 19.099638] x14: ffff70001012ef22 x13: 1ffe000018ef9799 x12: ffff75e147c20809 [ 19.100133] x11: 1ffff5e147c20808 x10: ffff75e147c20808 x9 : ffffaf0a372e4724 [ 19.100622] x8 : ffffaf0a3e104043 x7 : 0000000000000001 x6 : ffff75e147c20808 [ 19.101093] x5 : ffffaf0a3e104040 x4 : 1ffe000018ef9799 x3 : dfff800000000000 [ 19.101572] x2 : 0000000000000000 x1 : 0000000000000000 x0 : fff00000c77cbcc0 [ 19.101980] Call trace: [ 19.102156] stack_depot_print+0x54/0x60 (P) [ 19.102469] kasan_print_aux_stacks+0x78/0x98 [ 19.102744] print_report+0x348/0x608 [ 19.103016] kasan_report+0xdc/0x128 [ 19.103257] kasan_check_range+0x100/0x1a8 [ 19.103540] __asan_memmove+0x3c/0x98 [ 19.103804] kmalloc_memmove_negative_size+0x154/0x2e0 [ 19.104123] kunit_try_run_case+0x170/0x3f0 [ 19.104403] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.104733] kthread+0x328/0x630 [ 19.104979] ret_from_fork+0x10/0x20 [ 19.105229] ---[ end trace 0000000000000000 ]--- [ 19.105539] [ 19.105580] The buggy address belongs to the object at fff00000ffe7a000 [ 19.105580] which belongs to the cache kmalloc-64 of size 64 [ 19.105654] The buggy address is located 3972 bytes to the right of [ 19.105654] 64-byte region [fff00000ffe7a000, fff00000ffe7a040) [ 19.105730] [ 19.105754] The buggy address belongs to the physical page: [ 19.105789] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13fe7a [ 19.105850] memcg:fff00000d9d6f461 [ 19.105881] flags: 0xbfffe0000002000(reserved|node=0|zone=2|lastcpupid=0x1ffff) [ 19.105941] page_type: f5(slab) [ 19.105983] raw: 0bfffe0000002000 fff00000c00018c0 ffffc1ffc3ff9e88 0000000000000000 [ 19.106035] raw: 0000000000000000 0000000000010000 00000001f5000000 fff00000d9d6f461 [ 19.106076] page dumped because: kasan: bad access detected [ 19.106108] [ 19.106128] Memory state around the buggy address: [ 19.106163] fff00000ffe7ae80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.106207] fff00000ffe7af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.106251] >fff00000ffe7af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.106289] ^ [ 19.106326] fff00000ffe7b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.106380] fff00000ffe7b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.106419] ==================================================================
[ 16.759929] ================================================================== [ 16.760654] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330 [ 16.761458] Read of size 18446744073709551614 at addr ffff888101deef84 by task kunit_try_catch/201 [ 16.763076] [ 16.763585] CPU: 1 UID: 0 PID: 201 Comm: kunit_try_catch Tainted: G B N 6.15.1-rc1 #1 PREEMPT(voluntary) [ 16.763721] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.763761] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.763954] Call Trace: [ 16.763996] <TASK> [ 16.764038] dump_stack_lvl+0x73/0xb0 [ 16.764151] print_report+0xd1/0x650 [ 16.764216] ? __virt_addr_valid+0x1db/0x2d0 [ 16.764263] ? kmalloc_memmove_negative_size+0x171/0x330 [ 16.764305] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.764340] ? kmalloc_memmove_negative_size+0x171/0x330 [ 16.764426] kasan_report+0x141/0x180 [ 16.764464] ? kmalloc_memmove_negative_size+0x171/0x330 [ 16.764536] kasan_check_range+0x10c/0x1c0 [ 16.764563] __asan_memmove+0x27/0x70 [ 16.764587] kmalloc_memmove_negative_size+0x171/0x330 [ 16.764613] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 16.764640] ? __schedule+0x10cc/0x2b30 [ 16.764665] ? __pfx_read_tsc+0x10/0x10 [ 16.764688] ? ktime_get_ts64+0x86/0x230 [ 16.764718] kunit_try_run_case+0x1a5/0x480 [ 16.764746] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.764795] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.764822] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.764846] ? __kthread_parkme+0x82/0x180 [ 16.764870] ? preempt_count_sub+0x50/0x80 [ 16.764899] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.764924] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.764948] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.764972] kthread+0x337/0x6f0 [ 16.764991] ? trace_preempt_on+0x20/0xc0 [ 16.765018] ? __pfx_kthread+0x10/0x10 [ 16.765037] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.765059] ? calculate_sigpending+0x7b/0xa0 [ 16.765084] ? __pfx_kthread+0x10/0x10 [ 16.765117] ret_from_fork+0x41/0x80 [ 16.765158] ? __pfx_kthread+0x10/0x10 [ 16.765180] ret_from_fork_asm+0x1a/0x30 [ 16.765238] </TASK> [ 16.765262] [ 16.785005] Allocated by task 201: [ 16.786130] kasan_save_stack+0x45/0x70 [ 16.787178] kasan_save_track+0x18/0x40 [ 16.788185] kasan_save_alloc_info+0x3b/0x50 [ 16.788921] __kasan_kmalloc+0xb7/0xc0 [ 16.789918] __kmalloc_cache_noprof+0x189/0x420 [ 16.790205] kmalloc_memmove_negative_size+0xac/0x330 [ 16.790659] kunit_try_run_case+0x1a5/0x480 [ 16.791099] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.791342] kthread+0x337/0x6f0 [ 16.791715] ret_from_fork+0x41/0x80 [ 16.792147] ret_from_fork_asm+0x1a/0x30 [ 16.792470] [ 16.792642] The buggy address belongs to the object at ffff888101deef80 [ 16.792642] which belongs to the cache kmalloc-64 of size 64 [ 16.793504] The buggy address is located 4 bytes inside of [ 16.793504] 64-byte region [ffff888101deef80, ffff888101deefc0) [ 16.794216] [ 16.794477] The buggy address belongs to the physical page: [ 16.795032] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101dee [ 16.795585] flags: 0x200000000000000(node=0|zone=2) [ 16.796025] page_type: f5(slab) [ 16.796378] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 16.796825] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 16.797286] page dumped because: kasan: bad access detected [ 16.797845] [ 16.797944] Memory state around the buggy address: [ 16.798103] ffff888101deee80: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 16.798314] ffff888101deef00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 16.798510] >ffff888101deef80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 16.798968] ^ [ 16.799326] ffff888101def000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.799805] ffff888101def080: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.800264] ==================================================================