Date
June 23, 2025, 1:39 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 24.458309] ================================================================== [ 24.459373] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50 [ 24.459661] Write of size 1 at addr fff00000c772e0ea by task kunit_try_catch/164 [ 24.460559] [ 24.460744] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT [ 24.460930] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.460991] Hardware name: linux,dummy-virt (DT) [ 24.461062] Call trace: [ 24.461111] show_stack+0x20/0x38 (C) [ 24.461241] dump_stack_lvl+0x8c/0xd0 [ 24.463436] print_report+0x118/0x608 [ 24.464205] kasan_report+0xdc/0x128 [ 24.464635] __asan_report_store1_noabort+0x20/0x30 [ 24.465241] krealloc_less_oob_helper+0xae4/0xc50 [ 24.465983] krealloc_large_less_oob+0x20/0x38 [ 24.466107] kunit_try_run_case+0x170/0x3f0 [ 24.467257] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.467430] kthread+0x328/0x630 [ 24.467903] ret_from_fork+0x10/0x20 [ 24.468763] [ 24.468817] The buggy address belongs to the physical page: [ 24.469609] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10772c [ 24.470040] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.470153] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.470277] page_type: f8(unknown) [ 24.470372] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.470507] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.470626] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.470740] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.472574] head: 0bfffe0000000002 ffffc1ffc31dcb01 00000000ffffffff 00000000ffffffff [ 24.473326] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.474402] page dumped because: kasan: bad access detected [ 24.474679] [ 24.474727] Memory state around the buggy address: [ 24.475565] fff00000c772df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.475723] fff00000c772e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.476515] >fff00000c772e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 24.477067] ^ [ 24.477170] fff00000c772e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.477288] fff00000c772e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.478575] ================================================================== [ 24.419379] ================================================================== [ 24.419645] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50 [ 24.419961] Write of size 1 at addr fff00000c772e0c9 by task kunit_try_catch/164 [ 24.420286] [ 24.420525] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT [ 24.421214] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.421290] Hardware name: linux,dummy-virt (DT) [ 24.421377] Call trace: [ 24.421455] show_stack+0x20/0x38 (C) [ 24.421698] dump_stack_lvl+0x8c/0xd0 [ 24.421913] print_report+0x118/0x608 [ 24.422173] kasan_report+0xdc/0x128 [ 24.422460] __asan_report_store1_noabort+0x20/0x30 [ 24.422760] krealloc_less_oob_helper+0xa48/0xc50 [ 24.423107] krealloc_large_less_oob+0x20/0x38 [ 24.423230] kunit_try_run_case+0x170/0x3f0 [ 24.423357] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.423512] kthread+0x328/0x630 [ 24.423658] ret_from_fork+0x10/0x20 [ 24.423998] [ 24.424150] The buggy address belongs to the physical page: [ 24.424351] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10772c [ 24.424570] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.424693] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.424834] page_type: f8(unknown) [ 24.424939] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.425146] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.425275] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.425495] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.425611] head: 0bfffe0000000002 ffffc1ffc31dcb01 00000000ffffffff 00000000ffffffff [ 24.425722] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.425813] page dumped because: kasan: bad access detected [ 24.425881] [ 24.426636] Memory state around the buggy address: [ 24.426726] fff00000c772df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.426840] fff00000c772e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.426951] >fff00000c772e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 24.427053] ^ [ 24.427148] fff00000c772e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.427256] fff00000c772e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.427357] ================================================================== [ 24.428553] ================================================================== [ 24.428668] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50 [ 24.428776] Write of size 1 at addr fff00000c772e0d0 by task kunit_try_catch/164 [ 24.429047] [ 24.429127] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT [ 24.429326] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.429410] Hardware name: linux,dummy-virt (DT) [ 24.430578] Call trace: [ 24.430670] show_stack+0x20/0x38 (C) [ 24.430796] dump_stack_lvl+0x8c/0xd0 [ 24.430921] print_report+0x118/0x608 [ 24.431115] kasan_report+0xdc/0x128 [ 24.431303] __asan_report_store1_noabort+0x20/0x30 [ 24.431807] krealloc_less_oob_helper+0xb9c/0xc50 [ 24.432463] krealloc_large_less_oob+0x20/0x38 [ 24.432584] kunit_try_run_case+0x170/0x3f0 [ 24.433078] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.433400] kthread+0x328/0x630 [ 24.433811] ret_from_fork+0x10/0x20 [ 24.434135] [ 24.434198] The buggy address belongs to the physical page: [ 24.434277] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10772c [ 24.434606] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.434725] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.435043] page_type: f8(unknown) [ 24.435184] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.435303] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.435436] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.435539] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.435648] head: 0bfffe0000000002 ffffc1ffc31dcb01 00000000ffffffff 00000000ffffffff [ 24.435766] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.435858] page dumped because: kasan: bad access detected [ 24.436005] [ 24.436052] Memory state around the buggy address: [ 24.436201] fff00000c772df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.436467] fff00000c772e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.436569] >fff00000c772e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 24.436654] ^ [ 24.436736] fff00000c772e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.436847] fff00000c772e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.437101] ================================================================== [ 24.439700] ================================================================== [ 24.439793] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50 [ 24.439893] Write of size 1 at addr fff00000c772e0da by task kunit_try_catch/164 [ 24.440001] [ 24.440073] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT [ 24.440256] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.440318] Hardware name: linux,dummy-virt (DT) [ 24.440411] Call trace: [ 24.440465] show_stack+0x20/0x38 (C) [ 24.440577] dump_stack_lvl+0x8c/0xd0 [ 24.440688] print_report+0x118/0x608 [ 24.440797] kasan_report+0xdc/0x128 [ 24.440907] __asan_report_store1_noabort+0x20/0x30 [ 24.441023] krealloc_less_oob_helper+0xa80/0xc50 [ 24.441134] krealloc_large_less_oob+0x20/0x38 [ 24.441267] kunit_try_run_case+0x170/0x3f0 [ 24.441381] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.443115] kthread+0x328/0x630 [ 24.443264] ret_from_fork+0x10/0x20 [ 24.443628] [ 24.443768] The buggy address belongs to the physical page: [ 24.444065] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10772c [ 24.444197] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.445059] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.445887] page_type: f8(unknown) [ 24.446108] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.446225] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.446340] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.448051] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.448181] head: 0bfffe0000000002 ffffc1ffc31dcb01 00000000ffffffff 00000000ffffffff [ 24.448360] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.449849] page dumped because: kasan: bad access detected [ 24.450170] [ 24.450274] Memory state around the buggy address: [ 24.450649] fff00000c772df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.451300] fff00000c772e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.451843] >fff00000c772e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 24.452415] ^ [ 24.452508] fff00000c772e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.452611] fff00000c772e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.452700] ================================================================== [ 24.481074] ================================================================== [ 24.481168] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50 [ 24.481285] Write of size 1 at addr fff00000c772e0eb by task kunit_try_catch/164 [ 24.486064] [ 24.486980] CPU: 0 UID: 0 PID: 164 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT [ 24.487332] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.487969] Hardware name: linux,dummy-virt (DT) [ 24.488689] Call trace: [ 24.488856] show_stack+0x20/0x38 (C) [ 24.488998] dump_stack_lvl+0x8c/0xd0 [ 24.490363] print_report+0x118/0x608 [ 24.491103] kasan_report+0xdc/0x128 [ 24.491231] __asan_report_store1_noabort+0x20/0x30 [ 24.492131] krealloc_less_oob_helper+0xa58/0xc50 [ 24.492262] krealloc_large_less_oob+0x20/0x38 [ 24.492376] kunit_try_run_case+0x170/0x3f0 [ 24.492512] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.494405] kthread+0x328/0x630 [ 24.495016] ret_from_fork+0x10/0x20 [ 24.495209] [ 24.495459] The buggy address belongs to the physical page: [ 24.495732] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10772c [ 24.496445] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.497151] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.497289] page_type: f8(unknown) [ 24.497378] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.498807] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.499502] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.499702] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.500459] head: 0bfffe0000000002 ffffc1ffc31dcb01 00000000ffffffff 00000000ffffffff [ 24.500588] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.500680] page dumped because: kasan: bad access detected [ 24.500751] [ 24.501885] Memory state around the buggy address: [ 24.502343] fff00000c772df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.502784] fff00000c772e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.502944] >fff00000c772e080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 24.503064] ^ [ 24.503307] fff00000c772e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.503488] fff00000c772e180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 24.503640] ==================================================================
[ 16.464542] ================================================================== [ 16.465914] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd70/0x11d0 [ 16.466672] Write of size 1 at addr ffff888100a100c9 by task kunit_try_catch/179 [ 16.467344] [ 16.467601] CPU: 1 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.467770] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.467809] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.467863] Call Trace: [ 16.467903] <TASK> [ 16.467948] dump_stack_lvl+0x73/0xb0 [ 16.468027] print_report+0xd1/0x650 [ 16.468102] ? __virt_addr_valid+0x1db/0x2d0 [ 16.468177] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 16.468288] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.468369] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 16.468439] kasan_report+0x141/0x180 [ 16.468511] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 16.468593] __asan_report_store1_noabort+0x1b/0x30 [ 16.468695] krealloc_less_oob_helper+0xd70/0x11d0 [ 16.468776] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.468846] ? finish_task_switch.isra.0+0x153/0x700 [ 16.468925] ? __switch_to+0x5d9/0xf60 [ 16.468960] ? dequeue_task_fair+0x166/0x4e0 [ 16.468996] ? __schedule+0x10cc/0x2b60 [ 16.469029] ? __pfx_read_tsc+0x10/0x10 [ 16.469062] krealloc_less_oob+0x1c/0x30 [ 16.469091] kunit_try_run_case+0x1a5/0x480 [ 16.469129] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.469162] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.469195] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.469270] ? __kthread_parkme+0x82/0x180 [ 16.469317] ? preempt_count_sub+0x50/0x80 [ 16.469353] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.469387] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.469419] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.469451] kthread+0x337/0x6f0 [ 16.469473] ? trace_preempt_on+0x20/0xc0 [ 16.469505] ? __pfx_kthread+0x10/0x10 [ 16.469530] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.469559] ? calculate_sigpending+0x7b/0xa0 [ 16.469590] ? __pfx_kthread+0x10/0x10 [ 16.469639] ret_from_fork+0x41/0x80 [ 16.469672] ? __pfx_kthread+0x10/0x10 [ 16.469696] ret_from_fork_asm+0x1a/0x30 [ 16.469738] </TASK> [ 16.469751] [ 16.487054] Allocated by task 179: [ 16.487595] kasan_save_stack+0x45/0x70 [ 16.487944] kasan_save_track+0x18/0x40 [ 16.488335] kasan_save_alloc_info+0x3b/0x50 [ 16.488790] __kasan_krealloc+0x190/0x1f0 [ 16.489223] krealloc_noprof+0xf3/0x340 [ 16.489548] krealloc_less_oob_helper+0x1aa/0x11d0 [ 16.490187] krealloc_less_oob+0x1c/0x30 [ 16.490657] kunit_try_run_case+0x1a5/0x480 [ 16.491197] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.491776] kthread+0x337/0x6f0 [ 16.492167] ret_from_fork+0x41/0x80 [ 16.492698] ret_from_fork_asm+0x1a/0x30 [ 16.493185] [ 16.493458] The buggy address belongs to the object at ffff888100a10000 [ 16.493458] which belongs to the cache kmalloc-256 of size 256 [ 16.494506] The buggy address is located 0 bytes to the right of [ 16.494506] allocated 201-byte region [ffff888100a10000, ffff888100a100c9) [ 16.495635] [ 16.495955] The buggy address belongs to the physical page: [ 16.496453] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a10 [ 16.496964] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.497632] flags: 0x200000000000040(head|node=0|zone=2) [ 16.498600] page_type: f5(slab) [ 16.499230] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.500154] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.500850] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.501541] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.502194] head: 0200000000000001 ffffea0004028401 00000000ffffffff 00000000ffffffff [ 16.502863] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.503538] page dumped because: kasan: bad access detected [ 16.504108] [ 16.504381] Memory state around the buggy address: [ 16.504955] ffff888100a0ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.505681] ffff888100a10000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.506280] >ffff888100a10080: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 16.506963] ^ [ 16.507475] ffff888100a10100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.508047] ffff888100a10180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.508574] ================================================================== [ 16.955361] ================================================================== [ 16.956022] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd47/0x11d0 [ 16.956820] Write of size 1 at addr ffff88810a0a60eb by task kunit_try_catch/183 [ 16.957456] [ 16.957847] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.957962] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.957996] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.958045] Call Trace: [ 16.958088] <TASK> [ 16.958128] dump_stack_lvl+0x73/0xb0 [ 16.958198] print_report+0xd1/0x650 [ 16.958315] ? __virt_addr_valid+0x1db/0x2d0 [ 16.958391] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 16.958458] ? kasan_addr_to_slab+0x11/0xa0 [ 16.958679] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 16.958786] kasan_report+0x141/0x180 [ 16.958867] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 16.958948] __asan_report_store1_noabort+0x1b/0x30 [ 16.959018] krealloc_less_oob_helper+0xd47/0x11d0 [ 16.959092] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.959254] ? finish_task_switch.isra.0+0x153/0x700 [ 16.959336] ? __switch_to+0x5d9/0xf60 [ 16.959402] ? dequeue_task_fair+0x166/0x4e0 [ 16.959537] ? __schedule+0x10cc/0x2b60 [ 16.959688] ? __pfx_read_tsc+0x10/0x10 [ 16.959766] krealloc_large_less_oob+0x1c/0x30 [ 16.959803] kunit_try_run_case+0x1a5/0x480 [ 16.959845] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.959880] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.959917] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.959953] ? __kthread_parkme+0x82/0x180 [ 16.959984] ? preempt_count_sub+0x50/0x80 [ 16.960018] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.960053] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.960085] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.960118] kthread+0x337/0x6f0 [ 16.960142] ? trace_preempt_on+0x20/0xc0 [ 16.960177] ? __pfx_kthread+0x10/0x10 [ 16.960202] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.960272] ? calculate_sigpending+0x7b/0xa0 [ 16.960307] ? __pfx_kthread+0x10/0x10 [ 16.960335] ret_from_fork+0x41/0x80 [ 16.960366] ? __pfx_kthread+0x10/0x10 [ 16.960393] ret_from_fork_asm+0x1a/0x30 [ 16.960437] </TASK> [ 16.960451] [ 16.978397] The buggy address belongs to the physical page: [ 16.979376] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a0a4 [ 16.980049] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.980761] flags: 0x200000000000040(head|node=0|zone=2) [ 16.981373] page_type: f8(unknown) [ 16.981954] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.982875] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.983813] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.984574] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.985498] head: 0200000000000002 ffffea0004282901 00000000ffffffff 00000000ffffffff [ 16.986140] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 16.986732] page dumped because: kasan: bad access detected [ 16.987421] [ 16.987737] Memory state around the buggy address: [ 16.988133] ffff88810a0a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.988952] ffff88810a0a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.989663] >ffff88810a0a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 16.990361] ^ [ 16.990944] ffff88810a0a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.991755] ffff88810a0a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.992395] ================================================================== [ 16.786463] ================================================================== [ 16.787503] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd70/0x11d0 [ 16.788544] Write of size 1 at addr ffff88810a0a60c9 by task kunit_try_catch/183 [ 16.789408] [ 16.790018] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.790145] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.790180] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.790324] Call Trace: [ 16.790367] <TASK> [ 16.790427] dump_stack_lvl+0x73/0xb0 [ 16.790493] print_report+0xd1/0x650 [ 16.790529] ? __virt_addr_valid+0x1db/0x2d0 [ 16.790564] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 16.790617] ? kasan_addr_to_slab+0x11/0xa0 [ 16.790689] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 16.790760] kasan_report+0x141/0x180 [ 16.790826] ? krealloc_less_oob_helper+0xd70/0x11d0 [ 16.790863] __asan_report_store1_noabort+0x1b/0x30 [ 16.790895] krealloc_less_oob_helper+0xd70/0x11d0 [ 16.790926] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.790956] ? finish_task_switch.isra.0+0x153/0x700 [ 16.790991] ? __switch_to+0x5d9/0xf60 [ 16.791021] ? dequeue_task_fair+0x166/0x4e0 [ 16.791055] ? __schedule+0x10cc/0x2b60 [ 16.791088] ? __pfx_read_tsc+0x10/0x10 [ 16.791122] krealloc_large_less_oob+0x1c/0x30 [ 16.791149] kunit_try_run_case+0x1a5/0x480 [ 16.791187] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.791230] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.791285] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.791320] ? __kthread_parkme+0x82/0x180 [ 16.791353] ? preempt_count_sub+0x50/0x80 [ 16.791390] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.791425] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.791460] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.791493] kthread+0x337/0x6f0 [ 16.791516] ? trace_preempt_on+0x20/0xc0 [ 16.791551] ? __pfx_kthread+0x10/0x10 [ 16.791576] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.791704] ? calculate_sigpending+0x7b/0xa0 [ 16.791749] ? __pfx_kthread+0x10/0x10 [ 16.791777] ret_from_fork+0x41/0x80 [ 16.791808] ? __pfx_kthread+0x10/0x10 [ 16.791835] ret_from_fork_asm+0x1a/0x30 [ 16.791877] </TASK> [ 16.791893] [ 16.810486] The buggy address belongs to the physical page: [ 16.812271] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a0a4 [ 16.813333] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.813932] flags: 0x200000000000040(head|node=0|zone=2) [ 16.814403] page_type: f8(unknown) [ 16.814814] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.815381] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.816489] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.817287] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.817946] head: 0200000000000002 ffffea0004282901 00000000ffffffff 00000000ffffffff [ 16.818537] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 16.819144] page dumped because: kasan: bad access detected [ 16.819764] [ 16.819995] Memory state around the buggy address: [ 16.820488] ffff88810a0a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.821195] ffff88810a0a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.821990] >ffff88810a0a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 16.822730] ^ [ 16.823175] ffff88810a0a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.823944] ffff88810a0a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.824494] ================================================================== [ 16.603245] ================================================================== [ 16.603819] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe90/0x11d0 [ 16.604780] Write of size 1 at addr ffff888100a100ea by task kunit_try_catch/179 [ 16.605525] [ 16.605832] CPU: 1 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.605953] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.605987] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.606281] Call Trace: [ 16.606333] <TASK> [ 16.606374] dump_stack_lvl+0x73/0xb0 [ 16.606452] print_report+0xd1/0x650 [ 16.606526] ? __virt_addr_valid+0x1db/0x2d0 [ 16.606645] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 16.606715] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.606786] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 16.606820] kasan_report+0x141/0x180 [ 16.606859] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 16.606897] __asan_report_store1_noabort+0x1b/0x30 [ 16.606952] krealloc_less_oob_helper+0xe90/0x11d0 [ 16.607027] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.607115] ? finish_task_switch.isra.0+0x153/0x700 [ 16.607252] ? __switch_to+0x5d9/0xf60 [ 16.607325] ? dequeue_task_fair+0x166/0x4e0 [ 16.607421] ? __schedule+0x10cc/0x2b60 [ 16.607526] ? __pfx_read_tsc+0x10/0x10 [ 16.607619] krealloc_less_oob+0x1c/0x30 [ 16.607679] kunit_try_run_case+0x1a5/0x480 [ 16.607722] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.607756] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.607792] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.607828] ? __kthread_parkme+0x82/0x180 [ 16.607859] ? preempt_count_sub+0x50/0x80 [ 16.607894] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.607930] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.607964] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.607999] kthread+0x337/0x6f0 [ 16.608023] ? trace_preempt_on+0x20/0xc0 [ 16.608057] ? __pfx_kthread+0x10/0x10 [ 16.608082] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.608112] ? calculate_sigpending+0x7b/0xa0 [ 16.608143] ? __pfx_kthread+0x10/0x10 [ 16.608169] ret_from_fork+0x41/0x80 [ 16.608200] ? __pfx_kthread+0x10/0x10 [ 16.608262] ret_from_fork_asm+0x1a/0x30 [ 16.608311] </TASK> [ 16.608326] [ 16.627253] Allocated by task 179: [ 16.627601] kasan_save_stack+0x45/0x70 [ 16.628056] kasan_save_track+0x18/0x40 [ 16.628911] kasan_save_alloc_info+0x3b/0x50 [ 16.629467] __kasan_krealloc+0x190/0x1f0 [ 16.629841] krealloc_noprof+0xf3/0x340 [ 16.630198] krealloc_less_oob_helper+0x1aa/0x11d0 [ 16.630942] krealloc_less_oob+0x1c/0x30 [ 16.631489] kunit_try_run_case+0x1a5/0x480 [ 16.632027] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.632617] kthread+0x337/0x6f0 [ 16.633008] ret_from_fork+0x41/0x80 [ 16.633436] ret_from_fork_asm+0x1a/0x30 [ 16.633996] [ 16.634269] The buggy address belongs to the object at ffff888100a10000 [ 16.634269] which belongs to the cache kmalloc-256 of size 256 [ 16.635442] The buggy address is located 33 bytes to the right of [ 16.635442] allocated 201-byte region [ffff888100a10000, ffff888100a100c9) [ 16.636562] [ 16.636801] The buggy address belongs to the physical page: [ 16.637467] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a10 [ 16.638299] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.639020] flags: 0x200000000000040(head|node=0|zone=2) [ 16.639546] page_type: f5(slab) [ 16.639931] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.640579] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.641156] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.641821] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.642563] head: 0200000000000001 ffffea0004028401 00000000ffffffff 00000000ffffffff [ 16.643046] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.643863] page dumped because: kasan: bad access detected [ 16.644501] [ 16.644699] Memory state around the buggy address: [ 16.645125] ffff888100a0ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.645946] ffff888100a10000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.646599] >ffff888100a10080: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 16.647377] ^ [ 16.648073] ffff888100a10100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.648780] ffff888100a10180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.649359] ================================================================== [ 16.827094] ================================================================== [ 16.827730] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe23/0x11d0 [ 16.828377] Write of size 1 at addr ffff88810a0a60d0 by task kunit_try_catch/183 [ 16.828969] [ 16.829212] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.829332] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.829368] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.829421] Call Trace: [ 16.829467] <TASK> [ 16.829509] dump_stack_lvl+0x73/0xb0 [ 16.829585] print_report+0xd1/0x650 [ 16.829678] ? __virt_addr_valid+0x1db/0x2d0 [ 16.829750] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 16.829828] ? kasan_addr_to_slab+0x11/0xa0 [ 16.829904] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 16.829976] kasan_report+0x141/0x180 [ 16.830057] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 16.830140] __asan_report_store1_noabort+0x1b/0x30 [ 16.830217] krealloc_less_oob_helper+0xe23/0x11d0 [ 16.830291] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.830359] ? finish_task_switch.isra.0+0x153/0x700 [ 16.830430] ? __switch_to+0x5d9/0xf60 [ 16.830497] ? dequeue_task_fair+0x166/0x4e0 [ 16.830572] ? __schedule+0x10cc/0x2b60 [ 16.830706] ? __pfx_read_tsc+0x10/0x10 [ 16.830768] krealloc_large_less_oob+0x1c/0x30 [ 16.830802] kunit_try_run_case+0x1a5/0x480 [ 16.830840] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.830875] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.830910] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.830945] ? __kthread_parkme+0x82/0x180 [ 16.830975] ? preempt_count_sub+0x50/0x80 [ 16.831010] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.831046] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.831080] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.831114] kthread+0x337/0x6f0 [ 16.831139] ? trace_preempt_on+0x20/0xc0 [ 16.831174] ? __pfx_kthread+0x10/0x10 [ 16.831200] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.831272] ? calculate_sigpending+0x7b/0xa0 [ 16.831309] ? __pfx_kthread+0x10/0x10 [ 16.831335] ret_from_fork+0x41/0x80 [ 16.831366] ? __pfx_kthread+0x10/0x10 [ 16.831391] ret_from_fork_asm+0x1a/0x30 [ 16.831433] </TASK> [ 16.831447] [ 16.852229] The buggy address belongs to the physical page: [ 16.852798] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a0a4 [ 16.853554] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.854146] flags: 0x200000000000040(head|node=0|zone=2) [ 16.854830] page_type: f8(unknown) [ 16.855311] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.856166] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.857251] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.858118] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.858903] head: 0200000000000002 ffffea0004282901 00000000ffffffff 00000000ffffffff [ 16.859600] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 16.860419] page dumped because: kasan: bad access detected [ 16.861043] [ 16.861260] Memory state around the buggy address: [ 16.862010] ffff88810a0a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.862584] ffff88810a0a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.863861] >ffff88810a0a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 16.864461] ^ [ 16.865045] ffff88810a0a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.865887] ffff88810a0a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.866497] ================================================================== [ 16.912157] ================================================================== [ 16.912559] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe90/0x11d0 [ 16.914349] Write of size 1 at addr ffff88810a0a60ea by task kunit_try_catch/183 [ 16.915864] [ 16.916144] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.916352] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.916388] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.916458] Call Trace: [ 16.916530] <TASK> [ 16.916573] dump_stack_lvl+0x73/0xb0 [ 16.916678] print_report+0xd1/0x650 [ 16.916749] ? __virt_addr_valid+0x1db/0x2d0 [ 16.916788] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 16.916819] ? kasan_addr_to_slab+0x11/0xa0 [ 16.916850] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 16.916881] kasan_report+0x141/0x180 [ 16.916914] ? krealloc_less_oob_helper+0xe90/0x11d0 [ 16.916951] __asan_report_store1_noabort+0x1b/0x30 [ 16.916982] krealloc_less_oob_helper+0xe90/0x11d0 [ 16.917015] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.917046] ? finish_task_switch.isra.0+0x153/0x700 [ 16.917080] ? __switch_to+0x5d9/0xf60 [ 16.917108] ? dequeue_task_fair+0x166/0x4e0 [ 16.917144] ? __schedule+0x10cc/0x2b60 [ 16.917176] ? __pfx_read_tsc+0x10/0x10 [ 16.917209] krealloc_large_less_oob+0x1c/0x30 [ 16.917266] kunit_try_run_case+0x1a5/0x480 [ 16.917306] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.917340] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.917375] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.917409] ? __kthread_parkme+0x82/0x180 [ 16.917441] ? preempt_count_sub+0x50/0x80 [ 16.917476] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.917510] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.917544] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.917578] kthread+0x337/0x6f0 [ 16.917622] ? trace_preempt_on+0x20/0xc0 [ 16.917701] ? __pfx_kthread+0x10/0x10 [ 16.917742] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.917788] ? calculate_sigpending+0x7b/0xa0 [ 16.917821] ? __pfx_kthread+0x10/0x10 [ 16.917847] ret_from_fork+0x41/0x80 [ 16.917879] ? __pfx_kthread+0x10/0x10 [ 16.917905] ret_from_fork_asm+0x1a/0x30 [ 16.917948] </TASK> [ 16.917962] [ 16.938093] The buggy address belongs to the physical page: [ 16.938910] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a0a4 [ 16.939880] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.940786] flags: 0x200000000000040(head|node=0|zone=2) [ 16.941500] page_type: f8(unknown) [ 16.942100] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.942960] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.943694] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.944594] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.945403] head: 0200000000000002 ffffea0004282901 00000000ffffffff 00000000ffffffff [ 16.946713] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 16.947286] page dumped because: kasan: bad access detected [ 16.948102] [ 16.948413] Memory state around the buggy address: [ 16.948869] ffff88810a0a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.949841] ffff88810a0a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.951370] >ffff88810a0a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 16.951966] ^ [ 16.952757] ffff88810a0a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.953523] ffff88810a0a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.954261] ================================================================== [ 16.511392] ================================================================== [ 16.512059] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xe23/0x11d0 [ 16.512760] Write of size 1 at addr ffff888100a100d0 by task kunit_try_catch/179 [ 16.513287] [ 16.513693] CPU: 1 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.513926] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.513965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.514016] Call Trace: [ 16.514051] <TASK> [ 16.514086] dump_stack_lvl+0x73/0xb0 [ 16.514159] print_report+0xd1/0x650 [ 16.514430] ? __virt_addr_valid+0x1db/0x2d0 [ 16.514536] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 16.514602] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.514677] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 16.514708] kasan_report+0x141/0x180 [ 16.514741] ? krealloc_less_oob_helper+0xe23/0x11d0 [ 16.514776] __asan_report_store1_noabort+0x1b/0x30 [ 16.514808] krealloc_less_oob_helper+0xe23/0x11d0 [ 16.514839] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.514867] ? finish_task_switch.isra.0+0x153/0x700 [ 16.514900] ? __switch_to+0x5d9/0xf60 [ 16.514929] ? dequeue_task_fair+0x166/0x4e0 [ 16.514961] ? __schedule+0x10cc/0x2b60 [ 16.514992] ? __pfx_read_tsc+0x10/0x10 [ 16.515023] krealloc_less_oob+0x1c/0x30 [ 16.515050] kunit_try_run_case+0x1a5/0x480 [ 16.515085] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.515116] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.515149] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.515181] ? __kthread_parkme+0x82/0x180 [ 16.515234] ? preempt_count_sub+0x50/0x80 [ 16.515289] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.515324] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.515356] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.515389] kthread+0x337/0x6f0 [ 16.515412] ? trace_preempt_on+0x20/0xc0 [ 16.515444] ? __pfx_kthread+0x10/0x10 [ 16.515467] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.515496] ? calculate_sigpending+0x7b/0xa0 [ 16.515526] ? __pfx_kthread+0x10/0x10 [ 16.515549] ret_from_fork+0x41/0x80 [ 16.515578] ? __pfx_kthread+0x10/0x10 [ 16.515602] ret_from_fork_asm+0x1a/0x30 [ 16.515669] </TASK> [ 16.515683] [ 16.533166] Allocated by task 179: [ 16.533552] kasan_save_stack+0x45/0x70 [ 16.534145] kasan_save_track+0x18/0x40 [ 16.534633] kasan_save_alloc_info+0x3b/0x50 [ 16.535271] __kasan_krealloc+0x190/0x1f0 [ 16.535679] krealloc_noprof+0xf3/0x340 [ 16.536082] krealloc_less_oob_helper+0x1aa/0x11d0 [ 16.536470] krealloc_less_oob+0x1c/0x30 [ 16.536855] kunit_try_run_case+0x1a5/0x480 [ 16.537516] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.538164] kthread+0x337/0x6f0 [ 16.538637] ret_from_fork+0x41/0x80 [ 16.539122] ret_from_fork_asm+0x1a/0x30 [ 16.539669] [ 16.539902] The buggy address belongs to the object at ffff888100a10000 [ 16.539902] which belongs to the cache kmalloc-256 of size 256 [ 16.540800] The buggy address is located 7 bytes to the right of [ 16.540800] allocated 201-byte region [ffff888100a10000, ffff888100a100c9) [ 16.542039] [ 16.542400] The buggy address belongs to the physical page: [ 16.542913] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a10 [ 16.543756] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.544491] flags: 0x200000000000040(head|node=0|zone=2) [ 16.545064] page_type: f5(slab) [ 16.545538] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.546148] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.546925] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.547711] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.548437] head: 0200000000000001 ffffea0004028401 00000000ffffffff 00000000ffffffff [ 16.549117] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.549844] page dumped because: kasan: bad access detected [ 16.550439] [ 16.550655] Memory state around the buggy address: [ 16.551199] ffff888100a0ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.551845] ffff888100a10000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.552586] >ffff888100a10080: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 16.553192] ^ [ 16.553833] ffff888100a10100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.554530] ffff888100a10180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.555170] ================================================================== [ 16.557684] ================================================================== [ 16.558271] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xec6/0x11d0 [ 16.558989] Write of size 1 at addr ffff888100a100da by task kunit_try_catch/179 [ 16.559785] [ 16.560098] CPU: 1 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.560324] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.560386] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.560441] Call Trace: [ 16.560491] <TASK> [ 16.560537] dump_stack_lvl+0x73/0xb0 [ 16.560628] print_report+0xd1/0x650 [ 16.560759] ? __virt_addr_valid+0x1db/0x2d0 [ 16.560861] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 16.560928] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.560985] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 16.561019] kasan_report+0x141/0x180 [ 16.561054] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 16.561090] __asan_report_store1_noabort+0x1b/0x30 [ 16.561120] krealloc_less_oob_helper+0xec6/0x11d0 [ 16.561152] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.561182] ? finish_task_switch.isra.0+0x153/0x700 [ 16.561265] ? __switch_to+0x5d9/0xf60 [ 16.561302] ? dequeue_task_fair+0x166/0x4e0 [ 16.561338] ? __schedule+0x10cc/0x2b60 [ 16.561371] ? __pfx_read_tsc+0x10/0x10 [ 16.561404] krealloc_less_oob+0x1c/0x30 [ 16.561430] kunit_try_run_case+0x1a5/0x480 [ 16.561467] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.561499] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.561533] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.561568] ? __kthread_parkme+0x82/0x180 [ 16.561600] ? preempt_count_sub+0x50/0x80 [ 16.561662] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.561699] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.561732] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.561776] kthread+0x337/0x6f0 [ 16.561801] ? trace_preempt_on+0x20/0xc0 [ 16.561835] ? __pfx_kthread+0x10/0x10 [ 16.561860] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.561891] ? calculate_sigpending+0x7b/0xa0 [ 16.561922] ? __pfx_kthread+0x10/0x10 [ 16.561949] ret_from_fork+0x41/0x80 [ 16.561980] ? __pfx_kthread+0x10/0x10 [ 16.562005] ret_from_fork_asm+0x1a/0x30 [ 16.562047] </TASK> [ 16.562061] [ 16.580557] Allocated by task 179: [ 16.581152] kasan_save_stack+0x45/0x70 [ 16.581684] kasan_save_track+0x18/0x40 [ 16.582154] kasan_save_alloc_info+0x3b/0x50 [ 16.582651] __kasan_krealloc+0x190/0x1f0 [ 16.583077] krealloc_noprof+0xf3/0x340 [ 16.583695] krealloc_less_oob_helper+0x1aa/0x11d0 [ 16.584168] krealloc_less_oob+0x1c/0x30 [ 16.584596] kunit_try_run_case+0x1a5/0x480 [ 16.585153] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.585775] kthread+0x337/0x6f0 [ 16.586203] ret_from_fork+0x41/0x80 [ 16.586656] ret_from_fork_asm+0x1a/0x30 [ 16.587156] [ 16.587422] The buggy address belongs to the object at ffff888100a10000 [ 16.587422] which belongs to the cache kmalloc-256 of size 256 [ 16.588555] The buggy address is located 17 bytes to the right of [ 16.588555] allocated 201-byte region [ffff888100a10000, ffff888100a100c9) [ 16.589719] [ 16.590046] The buggy address belongs to the physical page: [ 16.590663] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a10 [ 16.591392] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.592002] flags: 0x200000000000040(head|node=0|zone=2) [ 16.592460] page_type: f5(slab) [ 16.592777] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.593528] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.594167] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.594932] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.595653] head: 0200000000000001 ffffea0004028401 00000000ffffffff 00000000ffffffff [ 16.596364] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.596968] page dumped because: kasan: bad access detected [ 16.597444] [ 16.597693] Memory state around the buggy address: [ 16.598093] ffff888100a0ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.598718] ffff888100a10000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.599383] >ffff888100a10080: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 16.600009] ^ [ 16.600585] ffff888100a10100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.601181] ffff888100a10180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.601839] ================================================================== [ 16.651498] ================================================================== [ 16.652564] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xd47/0x11d0 [ 16.653178] Write of size 1 at addr ffff888100a100eb by task kunit_try_catch/179 [ 16.653803] [ 16.654161] CPU: 1 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.654284] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.654319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.654370] Call Trace: [ 16.654422] <TASK> [ 16.654468] dump_stack_lvl+0x73/0xb0 [ 16.654544] print_report+0xd1/0x650 [ 16.654638] ? __virt_addr_valid+0x1db/0x2d0 [ 16.654714] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 16.654782] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.654903] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 16.654976] kasan_report+0x141/0x180 [ 16.655055] ? krealloc_less_oob_helper+0xd47/0x11d0 [ 16.655133] __asan_report_store1_noabort+0x1b/0x30 [ 16.655200] krealloc_less_oob_helper+0xd47/0x11d0 [ 16.655272] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.655305] ? finish_task_switch.isra.0+0x153/0x700 [ 16.655341] ? __switch_to+0x5d9/0xf60 [ 16.655369] ? dequeue_task_fair+0x166/0x4e0 [ 16.655402] ? __schedule+0x10cc/0x2b60 [ 16.655433] ? __pfx_read_tsc+0x10/0x10 [ 16.655463] krealloc_less_oob+0x1c/0x30 [ 16.655488] kunit_try_run_case+0x1a5/0x480 [ 16.655522] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.655553] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.655585] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.655646] ? __kthread_parkme+0x82/0x180 [ 16.655679] ? preempt_count_sub+0x50/0x80 [ 16.655714] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.655748] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.655780] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.655813] kthread+0x337/0x6f0 [ 16.655835] ? trace_preempt_on+0x20/0xc0 [ 16.655868] ? __pfx_kthread+0x10/0x10 [ 16.655891] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.655920] ? calculate_sigpending+0x7b/0xa0 [ 16.655949] ? __pfx_kthread+0x10/0x10 [ 16.655973] ret_from_fork+0x41/0x80 [ 16.656003] ? __pfx_kthread+0x10/0x10 [ 16.656028] ret_from_fork_asm+0x1a/0x30 [ 16.656069] </TASK> [ 16.656082] [ 16.671796] Allocated by task 179: [ 16.672201] kasan_save_stack+0x45/0x70 [ 16.672670] kasan_save_track+0x18/0x40 [ 16.673091] kasan_save_alloc_info+0x3b/0x50 [ 16.673595] __kasan_krealloc+0x190/0x1f0 [ 16.674037] krealloc_noprof+0xf3/0x340 [ 16.674477] krealloc_less_oob_helper+0x1aa/0x11d0 [ 16.674971] krealloc_less_oob+0x1c/0x30 [ 16.675475] kunit_try_run_case+0x1a5/0x480 [ 16.675930] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.676518] kthread+0x337/0x6f0 [ 16.676865] ret_from_fork+0x41/0x80 [ 16.677337] ret_from_fork_asm+0x1a/0x30 [ 16.677779] [ 16.678039] The buggy address belongs to the object at ffff888100a10000 [ 16.678039] which belongs to the cache kmalloc-256 of size 256 [ 16.679015] The buggy address is located 34 bytes to the right of [ 16.679015] allocated 201-byte region [ffff888100a10000, ffff888100a100c9) [ 16.680054] [ 16.680346] The buggy address belongs to the physical page: [ 16.680853] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100a10 [ 16.681396] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.682020] flags: 0x200000000000040(head|node=0|zone=2) [ 16.682666] page_type: f5(slab) [ 16.683056] raw: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.683817] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.684536] head: 0200000000000040 ffff888100041b40 dead000000000122 0000000000000000 [ 16.685111] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.685721] head: 0200000000000001 ffffea0004028401 00000000ffffffff 00000000ffffffff [ 16.686516] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 16.688159] page dumped because: kasan: bad access detected [ 16.688792] [ 16.688999] Memory state around the buggy address: [ 16.689375] ffff888100a0ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.689985] ffff888100a10000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.690825] >ffff888100a10080: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 16.691518] ^ [ 16.692293] ffff888100a10100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.692981] ffff888100a10180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.693668] ================================================================== [ 16.869069] ================================================================== [ 16.870239] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xec6/0x11d0 [ 16.871179] Write of size 1 at addr ffff88810a0a60da by task kunit_try_catch/183 [ 16.872092] [ 16.872358] CPU: 1 UID: 0 PID: 183 Comm: kunit_try_catch Tainted: G B N 6.15.4-rc1 #1 PREEMPT(voluntary) [ 16.872476] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.872510] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.872562] Call Trace: [ 16.872679] <TASK> [ 16.872800] dump_stack_lvl+0x73/0xb0 [ 16.872878] print_report+0xd1/0x650 [ 16.872949] ? __virt_addr_valid+0x1db/0x2d0 [ 16.873018] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 16.873084] ? kasan_addr_to_slab+0x11/0xa0 [ 16.873149] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 16.873260] kasan_report+0x141/0x180 [ 16.873307] ? krealloc_less_oob_helper+0xec6/0x11d0 [ 16.873386] __asan_report_store1_noabort+0x1b/0x30 [ 16.873469] krealloc_less_oob_helper+0xec6/0x11d0 [ 16.873510] ? __pfx_krealloc_less_oob_helper+0x10/0x10 [ 16.873540] ? finish_task_switch.isra.0+0x153/0x700 [ 16.873573] ? __switch_to+0x5d9/0xf60 [ 16.873650] ? dequeue_task_fair+0x166/0x4e0 [ 16.873729] ? __schedule+0x10cc/0x2b60 [ 16.873775] ? __pfx_read_tsc+0x10/0x10 [ 16.873809] krealloc_large_less_oob+0x1c/0x30 [ 16.873836] kunit_try_run_case+0x1a5/0x480 [ 16.873874] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.873906] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.873940] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.873972] ? __kthread_parkme+0x82/0x180 [ 16.874002] ? preempt_count_sub+0x50/0x80 [ 16.874035] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.874068] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.874099] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.874131] kthread+0x337/0x6f0 [ 16.874153] ? trace_preempt_on+0x20/0xc0 [ 16.874185] ? __pfx_kthread+0x10/0x10 [ 16.874209] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.874268] ? calculate_sigpending+0x7b/0xa0 [ 16.874301] ? __pfx_kthread+0x10/0x10 [ 16.874326] ret_from_fork+0x41/0x80 [ 16.874357] ? __pfx_kthread+0x10/0x10 [ 16.874380] ret_from_fork_asm+0x1a/0x30 [ 16.874422] </TASK> [ 16.874435] [ 16.895127] The buggy address belongs to the physical page: [ 16.896291] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a0a4 [ 16.897078] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.897777] flags: 0x200000000000040(head|node=0|zone=2) [ 16.898742] page_type: f8(unknown) [ 16.899187] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.899903] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.900519] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.901385] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.902256] head: 0200000000000002 ffffea0004282901 00000000ffffffff 00000000ffffffff [ 16.903188] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 16.904134] page dumped because: kasan: bad access detected [ 16.904696] [ 16.904927] Memory state around the buggy address: [ 16.905944] ffff88810a0a5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.906845] ffff88810a0a6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.907584] >ffff88810a0a6080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 16.908305] ^ [ 16.909447] ffff88810a0a6100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.910278] ffff88810a0a6180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.911177] ==================================================================