Date
June 23, 2025, 1:39 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 24.611875] ================================================================== [ 24.612243] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x3a0/0x3f8 [ 24.612634] Write of size 16 at addr fff00000c5e9dd40 by task kunit_try_catch/168 [ 24.612968] [ 24.613216] CPU: 0 UID: 0 PID: 168 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT [ 24.613619] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.613778] Hardware name: linux,dummy-virt (DT) [ 24.613856] Call trace: [ 24.613913] show_stack+0x20/0x38 (C) [ 24.614078] dump_stack_lvl+0x8c/0xd0 [ 24.614301] print_report+0x118/0x608 [ 24.614478] kasan_report+0xdc/0x128 [ 24.614647] __asan_report_store16_noabort+0x20/0x30 [ 24.614779] kmalloc_oob_16+0x3a0/0x3f8 [ 24.614931] kunit_try_run_case+0x170/0x3f0 [ 24.615052] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.615183] kthread+0x328/0x630 [ 24.615295] ret_from_fork+0x10/0x20 [ 24.615433] [ 24.615479] Allocated by task 168: [ 24.615545] kasan_save_stack+0x3c/0x68 [ 24.615765] kasan_save_track+0x20/0x40 [ 24.615855] kasan_save_alloc_info+0x40/0x58 [ 24.615949] __kasan_kmalloc+0xd4/0xd8 [ 24.616037] __kmalloc_cache_noprof+0x16c/0x3c0 [ 24.616131] kmalloc_oob_16+0xb4/0x3f8 [ 24.616223] kunit_try_run_case+0x170/0x3f0 [ 24.616312] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.616448] kthread+0x328/0x630 [ 24.616600] ret_from_fork+0x10/0x20 [ 24.616734] [ 24.616788] The buggy address belongs to the object at fff00000c5e9dd40 [ 24.616788] which belongs to the cache kmalloc-16 of size 16 [ 24.616991] The buggy address is located 0 bytes inside of [ 24.616991] allocated 13-byte region [fff00000c5e9dd40, fff00000c5e9dd4d) [ 24.617137] [ 24.617217] The buggy address belongs to the physical page: [ 24.617384] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105e9d [ 24.617540] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 24.617661] page_type: f5(slab) [ 24.617757] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 24.617874] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 24.617968] page dumped because: kasan: bad access detected [ 24.618061] [ 24.618114] Memory state around the buggy address: [ 24.618249] fff00000c5e9dc00: 00 05 fc fc fa fb fc fc 00 02 fc fc fa fb fc fc [ 24.618431] fff00000c5e9dc80: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 24.618660] >fff00000c5e9dd00: 00 04 fc fc fa fb fc fc 00 05 fc fc 00 00 fc fc [ 24.618959] ^ [ 24.619049] fff00000c5e9dd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.619154] fff00000c5e9de00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.619247] ==================================================================
[ 17.103538] ================================================================== [ 17.104625] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x452/0x4a0 [ 17.105430] Write of size 16 at addr ffff8881025ebc00 by task kunit_try_catch/187 [ 17.106583] [ 17.106989] CPU: 0 UID: 0 PID: 187 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 17.107118] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.107174] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.107254] Call Trace: [ 17.107296] <TASK> [ 17.107375] dump_stack_lvl+0x73/0xb0 [ 17.107439] print_report+0xd1/0x650 [ 17.107475] ? __virt_addr_valid+0x1db/0x2d0 [ 17.107509] ? kmalloc_oob_16+0x452/0x4a0 [ 17.107541] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.107574] ? kmalloc_oob_16+0x452/0x4a0 [ 17.107630] kasan_report+0x141/0x180 [ 17.107743] ? kmalloc_oob_16+0x452/0x4a0 [ 17.107833] __asan_report_store16_noabort+0x1b/0x30 [ 17.107911] kmalloc_oob_16+0x452/0x4a0 [ 17.107963] ? __pfx_kmalloc_oob_16+0x10/0x10 [ 17.107995] ? __schedule+0x10cc/0x2b60 [ 17.108028] ? __pfx_read_tsc+0x10/0x10 [ 17.108056] ? ktime_get_ts64+0x86/0x230 [ 17.108091] kunit_try_run_case+0x1a5/0x480 [ 17.108127] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.108158] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 17.108191] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 17.108270] ? __kthread_parkme+0x82/0x180 [ 17.108307] ? preempt_count_sub+0x50/0x80 [ 17.108343] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.108376] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.108409] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.108441] kthread+0x337/0x6f0 [ 17.108462] ? trace_preempt_on+0x20/0xc0 [ 17.108497] ? __pfx_kthread+0x10/0x10 [ 17.108520] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.108549] ? calculate_sigpending+0x7b/0xa0 [ 17.108578] ? __pfx_kthread+0x10/0x10 [ 17.108622] ret_from_fork+0x41/0x80 [ 17.108697] ? __pfx_kthread+0x10/0x10 [ 17.108754] ret_from_fork_asm+0x1a/0x30 [ 17.108798] </TASK> [ 17.108812] [ 17.127035] Allocated by task 187: [ 17.127302] kasan_save_stack+0x45/0x70 [ 17.127595] kasan_save_track+0x18/0x40 [ 17.127931] kasan_save_alloc_info+0x3b/0x50 [ 17.128256] __kasan_kmalloc+0xb7/0xc0 [ 17.128557] __kmalloc_cache_noprof+0x189/0x420 [ 17.129074] kmalloc_oob_16+0xa8/0x4a0 [ 17.130118] kunit_try_run_case+0x1a5/0x480 [ 17.130575] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.131378] kthread+0x337/0x6f0 [ 17.131951] ret_from_fork+0x41/0x80 [ 17.132391] ret_from_fork_asm+0x1a/0x30 [ 17.133313] [ 17.133687] The buggy address belongs to the object at ffff8881025ebc00 [ 17.133687] which belongs to the cache kmalloc-16 of size 16 [ 17.134629] The buggy address is located 0 bytes inside of [ 17.134629] allocated 13-byte region [ffff8881025ebc00, ffff8881025ebc0d) [ 17.136127] [ 17.136435] The buggy address belongs to the physical page: [ 17.137194] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1025eb [ 17.137747] flags: 0x200000000000000(node=0|zone=2) [ 17.138578] page_type: f5(slab) [ 17.139141] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 17.140130] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 17.141201] page dumped because: kasan: bad access detected [ 17.141913] [ 17.142092] Memory state around the buggy address: [ 17.142472] ffff8881025ebb00: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 02 fc fc [ 17.143420] ffff8881025ebb80: fa fb fc fc fa fb fc fc fa fb fc fc 00 05 fc fc [ 17.144040] >ffff8881025ebc00: 00 05 fc fc 00 00 fc fc fc fc fc fc fc fc fc fc [ 17.145205] ^ [ 17.145832] ffff8881025ebc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.146534] ffff8881025ebd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.147306] ==================================================================