Hay
Date
June 23, 2025, 1:39 p.m.

Environment
qemu-arm64
qemu-x86_64

[   25.466198] ==================================================================
[   25.466515] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x344/0x430
[   25.466682] Read of size 1 at addr fff00000c11870c8 by task kunit_try_catch/209
[   25.466842] 
[   25.466983] CPU: 0 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G    B            N  6.15.4-rc1 #1 PREEMPT 
[   25.467181] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.467254] Hardware name: linux,dummy-virt (DT)
[   25.467346] Call trace:
[   25.467482]  show_stack+0x20/0x38 (C)
[   25.467667]  dump_stack_lvl+0x8c/0xd0
[   25.468043]  print_report+0x118/0x608
[   25.468175]  kasan_report+0xdc/0x128
[   25.468440]  __asan_report_load1_noabort+0x20/0x30
[   25.468586]  kmem_cache_oob+0x344/0x430
[   25.468793]  kunit_try_run_case+0x170/0x3f0
[   25.468931]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.469586]  kthread+0x328/0x630
[   25.469734]  ret_from_fork+0x10/0x20
[   25.470046] 
[   25.470165] Allocated by task 209:
[   25.470303]  kasan_save_stack+0x3c/0x68
[   25.470435]  kasan_save_track+0x20/0x40
[   25.470527]  kasan_save_alloc_info+0x40/0x58
[   25.471483]  __kasan_slab_alloc+0xa8/0xb0
[   25.471942]  kmem_cache_alloc_noprof+0x10c/0x398
[   25.472385]  kmem_cache_oob+0x12c/0x430
[   25.473007]  kunit_try_run_case+0x170/0x3f0
[   25.474058]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.474649]  kthread+0x328/0x630
[   25.474780]  ret_from_fork+0x10/0x20
[   25.475019] 
[   25.475087] The buggy address belongs to the object at fff00000c1187000
[   25.475087]  which belongs to the cache test_cache of size 200
[   25.475354] The buggy address is located 0 bytes to the right of
[   25.475354]  allocated 200-byte region [fff00000c1187000, fff00000c11870c8)
[   25.475523] 
[   25.475580] The buggy address belongs to the physical page:
[   25.475658] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101187
[   25.476013] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.476318] page_type: f5(slab)
[   25.476712] raw: 0bfffe0000000000 fff00000c59eba00 dead000000000122 0000000000000000
[   25.477122] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000
[   25.477246] page dumped because: kasan: bad access detected
[   25.477327] 
[   25.477751] Memory state around the buggy address:
[   25.477906]  fff00000c1186f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.478272]  fff00000c1187000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   25.478483] >fff00000c1187080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   25.478603]                                               ^
[   25.478690]  fff00000c1187100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.478789]  fff00000c1187180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.478882] ==================================================================

[   18.305328] ==================================================================
[   18.306308] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x402/0x530
[   18.306892] Read of size 1 at addr ffff888102a1e0c8 by task kunit_try_catch/228
[   18.307540] 
[   18.307804] CPU: 0 UID: 0 PID: 228 Comm: kunit_try_catch Tainted: G    B            N  6.15.4-rc1 #1 PREEMPT(voluntary) 
[   18.307920] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.307954] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.308011] Call Trace:
[   18.308049]  <TASK>
[   18.308097]  dump_stack_lvl+0x73/0xb0
[   18.308183]  print_report+0xd1/0x650
[   18.308277]  ? __virt_addr_valid+0x1db/0x2d0
[   18.308350]  ? kmem_cache_oob+0x402/0x530
[   18.308418]  ? kasan_complete_mode_report_info+0x2a/0x200
[   18.308493]  ? kmem_cache_oob+0x402/0x530
[   18.308560]  kasan_report+0x141/0x180
[   18.308670]  ? kmem_cache_oob+0x402/0x530
[   18.308758]  __asan_report_load1_noabort+0x18/0x20
[   18.308828]  kmem_cache_oob+0x402/0x530
[   18.308895]  ? __pfx_kmem_cache_oob+0x10/0x10
[   18.308957]  ? sysvec_apic_timer_interrupt+0x50/0x90
[   18.309056]  ? __pfx_kmem_cache_oob+0x10/0x10
[   18.309138]  kunit_try_run_case+0x1a5/0x480
[   18.309220]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.309294]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   18.309370]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.309423]  ? __kthread_parkme+0x82/0x180
[   18.309457]  ? preempt_count_sub+0x50/0x80
[   18.309494]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.309528]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.309561]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.309592]  kthread+0x337/0x6f0
[   18.309670]  ? trace_preempt_on+0x20/0xc0
[   18.309745]  ? __pfx_kthread+0x10/0x10
[   18.309785]  ? _raw_spin_unlock_irq+0x47/0x80
[   18.309816]  ? calculate_sigpending+0x7b/0xa0
[   18.309847]  ? __pfx_kthread+0x10/0x10
[   18.309871]  ret_from_fork+0x41/0x80
[   18.309903]  ? __pfx_kthread+0x10/0x10
[   18.309928]  ret_from_fork_asm+0x1a/0x30
[   18.309969]  </TASK>
[   18.309983] 
[   18.328195] Allocated by task 228:
[   18.328590]  kasan_save_stack+0x45/0x70
[   18.329176]  kasan_save_track+0x18/0x40
[   18.329738]  kasan_save_alloc_info+0x3b/0x50
[   18.330267]  __kasan_slab_alloc+0x91/0xa0
[   18.330832]  kmem_cache_alloc_noprof+0x123/0x3f0
[   18.331347]  kmem_cache_oob+0x157/0x530
[   18.331951]  kunit_try_run_case+0x1a5/0x480
[   18.332365]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.333466]  kthread+0x337/0x6f0
[   18.334003]  ret_from_fork+0x41/0x80
[   18.334994]  ret_from_fork_asm+0x1a/0x30
[   18.335365] 
[   18.335726] The buggy address belongs to the object at ffff888102a1e000
[   18.335726]  which belongs to the cache test_cache of size 200
[   18.336923] The buggy address is located 0 bytes to the right of
[   18.336923]  allocated 200-byte region [ffff888102a1e000, ffff888102a1e0c8)
[   18.338377] 
[   18.338845] The buggy address belongs to the physical page:
[   18.339351] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a1e
[   18.340185] flags: 0x200000000000000(node=0|zone=2)
[   18.340754] page_type: f5(slab)
[   18.341120] raw: 0200000000000000 ffff888101488c80 dead000000000122 0000000000000000
[   18.342089] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000
[   18.342850] page dumped because: kasan: bad access detected
[   18.343129] 
[   18.343226] Memory state around the buggy address:
[   18.343629]  ffff888102a1df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.344934]  ffff888102a1e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   18.346001] >ffff888102a1e080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   18.346596]                                               ^
[   18.347092]  ffff888102a1e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.348041]  ffff888102a1e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.349047] ==================================================================