Date
July 8, 2025, 4:38 p.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 |
[ 17.548793] ================================================================== [ 17.548884] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 17.549136] Read of size 1 at addr fff00000c5cff65f by task kunit_try_catch/140 [ 17.549635] [ 17.549973] CPU: 1 UID: 0 PID: 140 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT [ 17.550072] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.550098] Hardware name: linux,dummy-virt (DT) [ 17.550172] Call trace: [ 17.550202] show_stack+0x20/0x38 (C) [ 17.550255] dump_stack_lvl+0x8c/0xd0 [ 17.550550] print_report+0x118/0x608 [ 17.550633] kasan_report+0xdc/0x128 [ 17.550680] __asan_report_load1_noabort+0x20/0x30 [ 17.550797] kmalloc_oob_left+0x2ec/0x320 [ 17.550855] kunit_try_run_case+0x170/0x3f0 [ 17.550965] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.551046] kthread+0x328/0x630 [ 17.551179] ret_from_fork+0x10/0x20 [ 17.551266] [ 17.551318] Allocated by task 26: [ 17.551438] kasan_save_stack+0x3c/0x68 [ 17.551496] kasan_save_track+0x20/0x40 [ 17.551559] kasan_save_alloc_info+0x40/0x58 [ 17.551733] __kasan_kmalloc+0xd4/0xd8 [ 17.551970] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 17.552027] kstrdup+0x54/0xc8 [ 17.552065] devtmpfs_work_loop+0x6f8/0xa58 [ 17.552106] devtmpfsd+0x50/0x58 [ 17.552141] kthread+0x328/0x630 [ 17.552176] ret_from_fork+0x10/0x20 [ 17.552836] [ 17.552915] Freed by task 26: [ 17.553067] kasan_save_stack+0x3c/0x68 [ 17.553133] kasan_save_track+0x20/0x40 [ 17.553723] kasan_save_free_info+0x4c/0x78 [ 17.553786] __kasan_slab_free+0x6c/0x98 [ 17.553983] kfree+0x214/0x3c8 [ 17.554050] devtmpfs_work_loop+0x804/0xa58 [ 17.554176] devtmpfsd+0x50/0x58 [ 17.554214] kthread+0x328/0x630 [ 17.554529] ret_from_fork+0x10/0x20 [ 17.554645] [ 17.554724] The buggy address belongs to the object at fff00000c5cff640 [ 17.554724] which belongs to the cache kmalloc-16 of size 16 [ 17.554874] The buggy address is located 15 bytes to the right of [ 17.554874] allocated 16-byte region [fff00000c5cff640, fff00000c5cff650) [ 17.554974] [ 17.555001] The buggy address belongs to the physical page: [ 17.555192] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105cff [ 17.555277] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 17.555440] page_type: f5(slab) [ 17.555619] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 17.555992] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 17.556153] page dumped because: kasan: bad access detected [ 17.556196] [ 17.556388] Memory state around the buggy address: [ 17.556496] fff00000c5cff500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 17.556703] fff00000c5cff580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 17.556757] >fff00000c5cff600: 00 00 fc fc fa fb fc fc fa fb fc fc 00 07 fc fc [ 17.556862] ^ [ 17.556949] fff00000c5cff680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.557006] fff00000c5cff700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.557104] ==================================================================
[ 10.513977] ================================================================== [ 10.515118] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x361/0x3c0 [ 10.516187] Read of size 1 at addr ffff88810217155f by task kunit_try_catch/158 [ 10.516950] [ 10.517063] CPU: 1 UID: 0 PID: 158 Comm: kunit_try_catch Tainted: G B N 6.15.6-rc1 #1 PREEMPT(voluntary) [ 10.517112] Tainted: [B]=BAD_PAGE, [N]=TEST [ 10.517124] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 10.517146] Call Trace: [ 10.517160] <TASK> [ 10.517177] dump_stack_lvl+0x73/0xb0 [ 10.517207] print_report+0xd1/0x650 [ 10.517230] ? __virt_addr_valid+0x1db/0x2d0 [ 10.517253] ? kmalloc_oob_left+0x361/0x3c0 [ 10.517276] ? kasan_complete_mode_report_info+0x64/0x200 [ 10.517299] ? kmalloc_oob_left+0x361/0x3c0 [ 10.517321] kasan_report+0x141/0x180 [ 10.517344] ? kmalloc_oob_left+0x361/0x3c0 [ 10.517371] __asan_report_load1_noabort+0x18/0x20 [ 10.517392] kmalloc_oob_left+0x361/0x3c0 [ 10.517415] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 10.517438] ? __schedule+0x10cc/0x2b60 [ 10.517462] ? __pfx_read_tsc+0x10/0x10 [ 10.517482] ? ktime_get_ts64+0x86/0x230 [ 10.517516] kunit_try_run_case+0x1a5/0x480 [ 10.517538] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.517557] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 10.517582] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 10.517606] ? __kthread_parkme+0x82/0x180 [ 10.517629] ? preempt_count_sub+0x50/0x80 [ 10.517654] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.517674] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.517697] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 10.517720] kthread+0x337/0x6f0 [ 10.517737] ? trace_preempt_on+0x20/0xc0 [ 10.517761] ? __pfx_kthread+0x10/0x10 [ 10.517780] ? _raw_spin_unlock_irq+0x47/0x80 [ 10.517802] ? calculate_sigpending+0x7b/0xa0 [ 10.517824] ? __pfx_kthread+0x10/0x10 [ 10.517843] ret_from_fork+0x41/0x80 [ 10.517863] ? __pfx_kthread+0x10/0x10 [ 10.517899] ret_from_fork_asm+0x1a/0x30 [ 10.517929] </TASK> [ 10.517941] [ 10.533975] Allocated by task 1: [ 10.534114] kasan_save_stack+0x45/0x70 [ 10.534493] kasan_save_track+0x18/0x40 [ 10.534897] kasan_save_alloc_info+0x3b/0x50 [ 10.535335] __kasan_kmalloc+0xb7/0xc0 [ 10.535710] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 10.536280] kvasprintf+0xc5/0x150 [ 10.536626] __kthread_create_on_node+0x18b/0x3a0 [ 10.537103] kthread_create_on_node+0xab/0xe0 [ 10.537587] cryptomgr_notify+0x704/0x9f0 [ 10.538015] notifier_call_chain+0xcb/0x250 [ 10.538425] blocking_notifier_call_chain+0x64/0x90 [ 10.538938] crypto_alg_mod_lookup+0x21f/0x440 [ 10.539344] crypto_alloc_tfm_node+0xc5/0x1f0 [ 10.539491] crypto_alloc_sig+0x23/0x30 [ 10.539641] public_key_verify_signature+0x208/0x9f0 [ 10.539827] x509_check_for_self_signed+0x2cb/0x480 [ 10.539998] x509_cert_parse+0x59c/0x830 [ 10.540346] x509_key_preparse+0x68/0x8a0 [ 10.540727] asymmetric_key_preparse+0xb1/0x160 [ 10.540903] __key_create_or_update+0x43d/0xcc0 [ 10.541055] key_create_or_update+0x17/0x20 [ 10.541485] x509_load_certificate_list+0x174/0x200 [ 10.542012] regulatory_init_db+0xee/0x3a0 [ 10.542428] do_one_initcall+0xd8/0x370 [ 10.542662] kernel_init_freeable+0x420/0x6f0 [ 10.543109] kernel_init+0x23/0x1e0 [ 10.543343] ret_from_fork+0x41/0x80 [ 10.543497] ret_from_fork_asm+0x1a/0x30 [ 10.543770] [ 10.543981] Freed by task 0: [ 10.544274] kasan_save_stack+0x45/0x70 [ 10.544661] kasan_save_track+0x18/0x40 [ 10.545101] kasan_save_free_info+0x3f/0x60 [ 10.545537] __kasan_slab_free+0x56/0x70 [ 10.545933] kfree+0x222/0x3f0 [ 10.546234] free_kthread_struct+0xeb/0x150 [ 10.546407] free_task+0xf3/0x130 [ 10.546537] __put_task_struct+0x1c8/0x480 [ 10.546905] delayed_put_task_struct+0x10a/0x150 [ 10.547432] rcu_core+0x66c/0x1c30 [ 10.547801] rcu_core_si+0x12/0x20 [ 10.548216] handle_softirqs+0x209/0x730 [ 10.548439] __irq_exit_rcu+0xc9/0x110 [ 10.548638] irq_exit_rcu+0x12/0x20 [ 10.548969] sysvec_apic_timer_interrupt+0x81/0x90 [ 10.549450] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 10.550018] [ 10.550122] The buggy address belongs to the object at ffff888102171540 [ 10.550122] which belongs to the cache kmalloc-16 of size 16 [ 10.550461] The buggy address is located 15 bytes to the right of [ 10.550461] allocated 16-byte region [ffff888102171540, ffff888102171550) [ 10.550825] [ 10.550912] The buggy address belongs to the physical page: [ 10.551132] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102171 [ 10.551366] flags: 0x200000000000000(node=0|zone=2) [ 10.551544] page_type: f5(slab) [ 10.551676] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 10.551910] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 10.552157] page dumped because: kasan: bad access detected [ 10.552470] [ 10.552592] Memory state around the buggy address: [ 10.553061] ffff888102171400: 00 03 fc fc fa fb fc fc 00 02 fc fc 00 05 fc fc [ 10.553777] ffff888102171480: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 02 fc fc [ 10.554128] >ffff888102171500: fa fb fc fc fa fb fc fc fa fb fc fc 00 07 fc fc [ 10.554919] ^ [ 10.555437] ffff888102171580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.556146] ffff888102171600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.556637] ==================================================================