Date
July 8, 2025, 4:38 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.947328] ================================================================== [ 17.947457] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x154/0x2e0 [ 17.947688] Read of size 64 at addr fff00000c638a104 by task kunit_try_catch/184 [ 17.947914] [ 17.948064] CPU: 1 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT [ 17.948232] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.948259] Hardware name: linux,dummy-virt (DT) [ 17.948290] Call trace: [ 17.948673] show_stack+0x20/0x38 (C) [ 17.948759] dump_stack_lvl+0x8c/0xd0 [ 17.948904] print_report+0x118/0x608 [ 17.949054] kasan_report+0xdc/0x128 [ 17.949151] kasan_check_range+0x100/0x1a8 [ 17.949259] __asan_memmove+0x3c/0x98 [ 17.949403] kmalloc_memmove_invalid_size+0x154/0x2e0 [ 17.949478] kunit_try_run_case+0x170/0x3f0 [ 17.949550] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.949603] kthread+0x328/0x630 [ 17.949650] ret_from_fork+0x10/0x20 [ 17.949827] [ 17.949853] Allocated by task 184: [ 17.949883] kasan_save_stack+0x3c/0x68 [ 17.949924] kasan_save_track+0x20/0x40 [ 17.949960] kasan_save_alloc_info+0x40/0x58 [ 17.950000] __kasan_kmalloc+0xd4/0xd8 [ 17.950037] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.950134] kmalloc_memmove_invalid_size+0xb0/0x2e0 [ 17.950210] kunit_try_run_case+0x170/0x3f0 [ 17.950261] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.950352] kthread+0x328/0x630 [ 17.950481] ret_from_fork+0x10/0x20 [ 17.950571] [ 17.950591] The buggy address belongs to the object at fff00000c638a100 [ 17.950591] which belongs to the cache kmalloc-64 of size 64 [ 17.950649] The buggy address is located 4 bytes inside of [ 17.950649] allocated 64-byte region [fff00000c638a100, fff00000c638a140) [ 17.950711] [ 17.950731] The buggy address belongs to the physical page: [ 17.950817] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10638a [ 17.950990] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.951043] page_type: f5(slab) [ 17.951082] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 17.951139] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 17.951225] page dumped because: kasan: bad access detected [ 17.951275] [ 17.951293] Memory state around the buggy address: [ 17.951325] fff00000c638a000: 00 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc [ 17.951400] fff00000c638a080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 17.951461] >fff00000c638a100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 17.951557] ^ [ 17.951610] fff00000c638a180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.951731] fff00000c638a200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.951770] ==================================================================
[ 11.489790] ================================================================== [ 11.490789] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.491406] Read of size 64 at addr ffff8881029d6004 by task kunit_try_catch/202 [ 11.492012] [ 11.492272] CPU: 1 UID: 0 PID: 202 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT(voluntary) [ 11.492331] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.492343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.492366] Call Trace: [ 11.492378] <TASK> [ 11.492393] dump_stack_lvl+0x73/0xb0 [ 11.492420] print_report+0xd1/0x650 [ 11.492444] ? __virt_addr_valid+0x1db/0x2d0 [ 11.492466] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.492487] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.492618] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.492647] kasan_report+0x141/0x180 [ 11.492672] ? kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.492699] kasan_check_range+0x10c/0x1c0 [ 11.492720] __asan_memmove+0x27/0x70 [ 11.492741] kmalloc_memmove_invalid_size+0x16f/0x330 [ 11.492762] ? __pfx_kmalloc_memmove_invalid_size+0x10/0x10 [ 11.492785] ? __schedule+0x10cc/0x2b60 [ 11.492808] ? __pfx_read_tsc+0x10/0x10 [ 11.492829] ? ktime_get_ts64+0x86/0x230 [ 11.492886] kunit_try_run_case+0x1a5/0x480 [ 11.492909] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.492928] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.492953] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.492977] ? __kthread_parkme+0x82/0x180 [ 11.493000] ? preempt_count_sub+0x50/0x80 [ 11.493059] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.493080] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.493104] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.493127] kthread+0x337/0x6f0 [ 11.493145] ? trace_preempt_on+0x20/0xc0 [ 11.493168] ? __pfx_kthread+0x10/0x10 [ 11.493186] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.493208] ? calculate_sigpending+0x7b/0xa0 [ 11.493230] ? __pfx_kthread+0x10/0x10 [ 11.493248] ret_from_fork+0x41/0x80 [ 11.493269] ? __pfx_kthread+0x10/0x10 [ 11.493287] ret_from_fork_asm+0x1a/0x30 [ 11.493318] </TASK> [ 11.493329] [ 11.505379] Allocated by task 202: [ 11.505833] kasan_save_stack+0x45/0x70 [ 11.506272] kasan_save_track+0x18/0x40 [ 11.506569] kasan_save_alloc_info+0x3b/0x50 [ 11.506917] __kasan_kmalloc+0xb7/0xc0 [ 11.507177] __kmalloc_cache_noprof+0x189/0x420 [ 11.507389] kmalloc_memmove_invalid_size+0xac/0x330 [ 11.508016] kunit_try_run_case+0x1a5/0x480 [ 11.508277] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.508679] kthread+0x337/0x6f0 [ 11.509009] ret_from_fork+0x41/0x80 [ 11.509204] ret_from_fork_asm+0x1a/0x30 [ 11.509391] [ 11.509482] The buggy address belongs to the object at ffff8881029d6000 [ 11.509482] which belongs to the cache kmalloc-64 of size 64 [ 11.510498] The buggy address is located 4 bytes inside of [ 11.510498] allocated 64-byte region [ffff8881029d6000, ffff8881029d6040) [ 11.511374] [ 11.511472] The buggy address belongs to the physical page: [ 11.512016] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029d6 [ 11.512475] flags: 0x200000000000000(node=0|zone=2) [ 11.512856] page_type: f5(slab) [ 11.513242] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 11.513927] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 11.514661] page dumped because: kasan: bad access detected [ 11.514972] [ 11.515211] Memory state around the buggy address: [ 11.515405] ffff8881029d5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.515986] ffff8881029d5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.516411] >ffff8881029d6000: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 11.517182] ^ [ 11.517485] ffff8881029d6080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.518100] ffff8881029d6100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.518637] ==================================================================