Hay
Date
June 2, 2025, 2:11 p.m.

Environment
e850-96
qemu-arm64
qemu-x86_64

[   17.726033] ==================================================================
[   17.735368] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320
[   17.742221] Read of size 1 at addr ffff000800c2e07f by task kunit_try_catch/185
[   17.749511] 
[   17.750997] CPU: 5 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G    B            N  6.15.1-rc1 #1 PREEMPT 
[   17.751049] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.751064] Hardware name: WinLink E850-96 board (DT)
[   17.751089] Call trace:
[   17.751106]  show_stack+0x20/0x38 (C)
[   17.751139]  dump_stack_lvl+0x8c/0xd0
[   17.751174]  print_report+0x118/0x608
[   17.751205]  kasan_report+0xdc/0x128
[   17.751234]  __asan_report_load1_noabort+0x20/0x30
[   17.751270]  kmalloc_oob_left+0x2ec/0x320
[   17.751301]  kunit_try_run_case+0x170/0x3f0
[   17.751338]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.751376]  kthread+0x328/0x630
[   17.751411]  ret_from_fork+0x10/0x20
[   17.751448] 
[   17.813661] Allocated by task 56:
[   17.816961]  kasan_save_stack+0x3c/0x68
[   17.820779]  kasan_save_track+0x20/0x40
[   17.824598]  kasan_save_alloc_info+0x40/0x58
[   17.828850]  __kasan_kmalloc+0xd4/0xd8
[   17.832583]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   17.838138]  kstrdup+0x54/0xc8
[   17.841177]  devtmpfs_work_loop+0x6f8/0xa58
[   17.845343]  devtmpfsd+0x50/0x58
[   17.848555]  kthread+0x328/0x630
[   17.851766]  ret_from_fork+0x10/0x20
[   17.855325] 
[   17.856803] Freed by task 56:
[   17.859756]  kasan_save_stack+0x3c/0x68
[   17.863572]  kasan_save_track+0x20/0x40
[   17.867391]  kasan_save_free_info+0x4c/0x78
[   17.871558]  __kasan_slab_free+0x6c/0x98
[   17.875466]  kfree+0x214/0x3c8
[   17.878502]  devtmpfs_work_loop+0x804/0xa58
[   17.882668]  devtmpfsd+0x50/0x58
[   17.885881]  kthread+0x328/0x630
[   17.889092]  ret_from_fork+0x10/0x20
[   17.892651] 
[   17.894129] The buggy address belongs to the object at ffff000800c2e060
[   17.894129]  which belongs to the cache kmalloc-16 of size 16
[   17.906455] The buggy address is located 15 bytes to the right of
[   17.906455]  allocated 16-byte region [ffff000800c2e060, ffff000800c2e070)
[   17.919387] 
[   17.920865] The buggy address belongs to the physical page:
[   17.926425] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880c2e
[   17.934408] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.940917] page_type: f5(slab)
[   17.944054] raw: 0bfffe0000000000 ffff000800002640 dead000000000122 0000000000000000
[   17.951771] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   17.959490] page dumped because: kasan: bad access detected
[   17.965046] 
[   17.966522] Memory state around the buggy address:
[   17.971303]  ffff000800c2df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.978504]  ffff000800c2df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.985712] >ffff000800c2e000: 00 04 fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   17.992912]                                                                 ^
[   18.000032]  ffff000800c2e080: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.007237]  ffff000800c2e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.014439] ==================================================================

[   17.353221] ==================================================================
[   17.353279] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320
[   17.353368] Read of size 1 at addr fff00000c59158bf by task kunit_try_catch/141
[   17.353884] 
[   17.353967] CPU: 1 UID: 0 PID: 141 Comm: kunit_try_catch Tainted: G    B            N  6.15.1-rc1 #1 PREEMPT 
[   17.354058] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.354111] Hardware name: linux,dummy-virt (DT)
[   17.354142] Call trace:
[   17.354198]  show_stack+0x20/0x38 (C)
[   17.354277]  dump_stack_lvl+0x8c/0xd0
[   17.354329]  print_report+0x118/0x608
[   17.354387]  kasan_report+0xdc/0x128
[   17.354627]  __asan_report_load1_noabort+0x20/0x30
[   17.354695]  kmalloc_oob_left+0x2ec/0x320
[   17.354830]  kunit_try_run_case+0x170/0x3f0
[   17.355038]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.355147]  kthread+0x328/0x630
[   17.355211]  ret_from_fork+0x10/0x20
[   17.355280] 
[   17.355298] Allocated by task 52:
[   17.355328]  kasan_save_stack+0x3c/0x68
[   17.355384]  kasan_save_track+0x20/0x40
[   17.355609]  kasan_save_alloc_info+0x40/0x58
[   17.355680]  __kasan_kmalloc+0xd4/0xd8
[   17.355792]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   17.355880]  kvasprintf+0xe0/0x180
[   17.355970]  __kthread_create_on_node+0x16c/0x350
[   17.356051]  kthread_create_on_node+0xe4/0x130
[   17.356127]  create_worker+0x380/0x6b8
[   17.356200]  worker_thread+0x808/0xf38
[   17.356234]  kthread+0x328/0x630
[   17.356283]  ret_from_fork+0x10/0x20
[   17.356339] 
[   17.356810] The buggy address belongs to the object at fff00000c59158a0
[   17.356810]  which belongs to the cache kmalloc-16 of size 16
[   17.356871] The buggy address is located 19 bytes to the right of
[   17.356871]  allocated 12-byte region [fff00000c59158a0, fff00000c59158ac)
[   17.356954] 
[   17.357177] The buggy address belongs to the physical page:
[   17.357279] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105915
[   17.357407] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.357497] page_type: f5(slab)
[   17.357538] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   17.357766] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   17.357872] page dumped because: kasan: bad access detected
[   17.357917] 
[   17.357944] Memory state around the buggy address:
[   17.357977]  fff00000c5915780: 00 02 fc fc 00 05 fc fc fa fb fc fc 00 02 fc fc
[   17.358035]  fff00000c5915800: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   17.358076] >fff00000c5915880: fa fb fc fc 00 04 fc fc 00 07 fc fc fc fc fc fc
[   17.358112]                                         ^
[   17.358145]  fff00000c5915900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.358186]  fff00000c5915980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.358222] ==================================================================

[   15.531819] ==================================================================
[   15.532492] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x361/0x3c0
[   15.533161] Read of size 1 at addr ffff888101d9a39f by task kunit_try_catch/159
[   15.534007] 
[   15.534355] CPU: 1 UID: 0 PID: 159 Comm: kunit_try_catch Tainted: G    B            N  6.15.1-rc1 #1 PREEMPT(voluntary) 
[   15.534465] Tainted: [B]=BAD_PAGE, [N]=TEST
[   15.534737] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   15.534803] Call Trace:
[   15.534847]  <TASK>
[   15.534892]  dump_stack_lvl+0x73/0xb0
[   15.534980]  print_report+0xd1/0x650
[   15.535054]  ? __virt_addr_valid+0x1db/0x2d0
[   15.535141]  ? kmalloc_oob_left+0x361/0x3c0
[   15.535207]  ? kasan_complete_mode_report_info+0x2a/0x200
[   15.535257]  ? kmalloc_oob_left+0x361/0x3c0
[   15.535452]  kasan_report+0x141/0x180
[   15.535523]  ? kmalloc_oob_left+0x361/0x3c0
[   15.535571]  __asan_report_load1_noabort+0x18/0x20
[   15.535605]  kmalloc_oob_left+0x361/0x3c0
[   15.535658]  ? __pfx_kmalloc_oob_left+0x10/0x10
[   15.535694]  ? __schedule+0x10cc/0x2b30
[   15.535732]  ? __pfx_read_tsc+0x10/0x10
[   15.535781]  ? ktime_get_ts64+0x86/0x230
[   15.535826]  kunit_try_run_case+0x1a5/0x480
[   15.535866]  ? __pfx_kunit_try_run_case+0x10/0x10
[   15.535898]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   15.535934]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   15.535968]  ? __kthread_parkme+0x82/0x180
[   15.536002]  ? preempt_count_sub+0x50/0x80
[   15.536042]  ? __pfx_kunit_try_run_case+0x10/0x10
[   15.536081]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   15.536120]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   15.536171]  kthread+0x337/0x6f0
[   15.536200]  ? trace_preempt_on+0x20/0xc0
[   15.536243]  ? __pfx_kthread+0x10/0x10
[   15.536274]  ? _raw_spin_unlock_irq+0x47/0x80
[   15.536312]  ? calculate_sigpending+0x7b/0xa0
[   15.536342]  ? __pfx_kthread+0x10/0x10
[   15.536363]  ret_from_fork+0x41/0x80
[   15.536387]  ? __pfx_kthread+0x10/0x10
[   15.536406]  ret_from_fork_asm+0x1a/0x30
[   15.536441]  </TASK>
[   15.536458] 
[   15.549330] Allocated by task 1:
[   15.549575]  kasan_save_stack+0x45/0x70
[   15.549976]  kasan_save_track+0x18/0x40
[   15.550625]  kasan_save_alloc_info+0x3b/0x50
[   15.551085]  __kasan_kmalloc+0xb7/0xc0
[   15.551477]  __kmalloc_node_track_caller_noprof+0x1cb/0x500
[   15.552151]  kvasprintf+0xc5/0x150
[   15.552505]  __kthread_create_on_node+0x18b/0x3a0
[   15.552982]  kthread_create_on_node+0xab/0xe0
[   15.553711]  create_worker+0x3e5/0x7b0
[   15.554321]  alloc_unbound_pwq+0x8ea/0xdb0
[   15.554546]  apply_wqattrs_prepare+0x332/0xd20
[   15.554946]  apply_workqueue_attrs_locked+0x4d/0xa0
[   15.555371]  alloc_workqueue+0xcc7/0x1ad0
[   15.556389]  latency_fsnotify_init+0x1b/0x50
[   15.556873]  do_one_initcall+0xd8/0x370
[   15.557142]  kernel_init_freeable+0x420/0x6f0
[   15.557808]  kernel_init+0x23/0x1e0
[   15.558424]  ret_from_fork+0x41/0x80
[   15.558643]  ret_from_fork_asm+0x1a/0x30
[   15.559034] 
[   15.559210] The buggy address belongs to the object at ffff888101d9a380
[   15.559210]  which belongs to the cache kmalloc-16 of size 16
[   15.559797] The buggy address is located 18 bytes to the right of
[   15.559797]  allocated 13-byte region [ffff888101d9a380, ffff888101d9a38d)
[   15.561441] 
[   15.561850] The buggy address belongs to the physical page:
[   15.562101] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101d9a
[   15.562937] flags: 0x200000000000000(node=0|zone=2)
[   15.563213] page_type: f5(slab)
[   15.563569] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   15.564667] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   15.565063] page dumped because: kasan: bad access detected
[   15.565493] 
[   15.565825] Memory state around the buggy address:
[   15.566125]  ffff888101d9a280: fa fb fc fc 00 03 fc fc 00 03 fc fc fa fb fc fc
[   15.567428]  ffff888101d9a300: 00 01 fc fc 00 01 fc fc fa fb fc fc fa fb fc fc
[   15.567941] >ffff888101d9a380: 00 05 fc fc 00 07 fc fc fc fc fc fc fc fc fc fc
[   15.568921]                             ^
[   15.569169]  ffff888101d9a400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.569566]  ffff888101d9a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.570442] ==================================================================