Date
July 15, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 17.579128] ================================================================== [ 17.579192] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 17.579352] Write of size 1 at addr fff00000c665df00 by task kunit_try_catch/146 [ 17.579437] [ 17.579485] CPU: 0 UID: 0 PID: 146 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT [ 17.579629] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.579654] Hardware name: linux,dummy-virt (DT) [ 17.579683] Call trace: [ 17.580031] show_stack+0x20/0x38 (C) [ 17.580100] dump_stack_lvl+0x8c/0xd0 [ 17.580187] print_report+0x118/0x5d0 [ 17.580259] kasan_report+0xdc/0x128 [ 17.580302] __asan_report_store1_noabort+0x20/0x30 [ 17.580411] kmalloc_big_oob_right+0x2a4/0x2f0 [ 17.580478] kunit_try_run_case+0x170/0x3f0 [ 17.580671] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.580732] kthread+0x328/0x630 [ 17.580777] ret_from_fork+0x10/0x20 [ 17.580823] [ 17.580841] Allocated by task 146: [ 17.580867] kasan_save_stack+0x3c/0x68 [ 17.580905] kasan_save_track+0x20/0x40 [ 17.580939] kasan_save_alloc_info+0x40/0x58 [ 17.580976] __kasan_kmalloc+0xd4/0xd8 [ 17.581010] __kmalloc_cache_noprof+0x16c/0x3c0 [ 17.581047] kmalloc_big_oob_right+0xb8/0x2f0 [ 17.581470] kunit_try_run_case+0x170/0x3f0 [ 17.581582] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 17.581799] kthread+0x328/0x630 [ 17.581882] ret_from_fork+0x10/0x20 [ 17.582263] [ 17.582356] The buggy address belongs to the object at fff00000c665c000 [ 17.582356] which belongs to the cache kmalloc-8k of size 8192 [ 17.582486] The buggy address is located 0 bytes to the right of [ 17.582486] allocated 7936-byte region [fff00000c665c000, fff00000c665df00) [ 17.582660] [ 17.582720] The buggy address belongs to the physical page: [ 17.582863] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106658 [ 17.582951] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.582998] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 17.583325] page_type: f5(slab) [ 17.583409] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 17.583512] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 17.583574] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 17.583624] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 17.583682] head: 0bfffe0000000003 ffffc1ffc3199601 00000000ffffffff 00000000ffffffff [ 17.583745] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 17.583796] page dumped because: kasan: bad access detected [ 17.583835] [ 17.583853] Memory state around the buggy address: [ 17.583889] fff00000c665de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.583953] fff00000c665de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 17.583996] >fff00000c665df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.584034] ^ [ 17.584061] fff00000c665df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.584103] fff00000c665e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.584141] ==================================================================
[ 10.472586] ================================================================== [ 10.474022] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 10.474295] Write of size 1 at addr ffff888103931f00 by task kunit_try_catch/163 [ 10.474520] [ 10.474603] CPU: 0 UID: 0 PID: 163 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT(voluntary) [ 10.474646] Tainted: [B]=BAD_PAGE, [N]=TEST [ 10.474657] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 10.474683] Call Trace: [ 10.474696] <TASK> [ 10.474710] dump_stack_lvl+0x73/0xb0 [ 10.474734] print_report+0xd1/0x610 [ 10.474757] ? __virt_addr_valid+0x1db/0x2d0 [ 10.474779] ? kmalloc_big_oob_right+0x316/0x370 [ 10.474800] ? kasan_complete_mode_report_info+0x2a/0x200 [ 10.474821] ? kmalloc_big_oob_right+0x316/0x370 [ 10.474843] kasan_report+0x141/0x180 [ 10.474864] ? kmalloc_big_oob_right+0x316/0x370 [ 10.474900] __asan_report_store1_noabort+0x1b/0x30 [ 10.474920] kmalloc_big_oob_right+0x316/0x370 [ 10.474941] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 10.474963] ? __schedule+0x10cc/0x2b60 [ 10.474986] ? __pfx_read_tsc+0x10/0x10 [ 10.475009] ? ktime_get_ts64+0x86/0x230 [ 10.475034] kunit_try_run_case+0x1a5/0x480 [ 10.475054] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.475071] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 10.475094] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 10.475117] ? __kthread_parkme+0x82/0x180 [ 10.475141] ? preempt_count_sub+0x50/0x80 [ 10.475166] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.475186] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.475208] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 10.475230] kthread+0x337/0x6f0 [ 10.475246] ? trace_preempt_on+0x20/0xc0 [ 10.475269] ? __pfx_kthread+0x10/0x10 [ 10.475286] ? _raw_spin_unlock_irq+0x47/0x80 [ 10.475306] ? calculate_sigpending+0x7b/0xa0 [ 10.475329] ? __pfx_kthread+0x10/0x10 [ 10.475347] ret_from_fork+0x41/0x80 [ 10.475374] ? __pfx_kthread+0x10/0x10 [ 10.475391] ret_from_fork_asm+0x1a/0x30 [ 10.475426] </TASK> [ 10.475435] [ 10.485082] Allocated by task 163: [ 10.485264] kasan_save_stack+0x45/0x70 [ 10.485472] kasan_save_track+0x18/0x40 [ 10.485676] kasan_save_alloc_info+0x3b/0x50 [ 10.485924] __kasan_kmalloc+0xb7/0xc0 [ 10.486105] __kmalloc_cache_noprof+0x189/0x420 [ 10.486378] kmalloc_big_oob_right+0xa9/0x370 [ 10.486589] kunit_try_run_case+0x1a5/0x480 [ 10.486740] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.486922] kthread+0x337/0x6f0 [ 10.487038] ret_from_fork+0x41/0x80 [ 10.487191] ret_from_fork_asm+0x1a/0x30 [ 10.487482] [ 10.487576] The buggy address belongs to the object at ffff888103930000 [ 10.487576] which belongs to the cache kmalloc-8k of size 8192 [ 10.488228] The buggy address is located 0 bytes to the right of [ 10.488228] allocated 7936-byte region [ffff888103930000, ffff888103931f00) [ 10.488647] [ 10.488819] The buggy address belongs to the physical page: [ 10.489110] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103930 [ 10.489482] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 10.489728] flags: 0x200000000000040(head|node=0|zone=2) [ 10.489946] page_type: f5(slab) [ 10.490112] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 10.490662] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 10.491010] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 10.491326] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 10.491606] head: 0200000000000003 ffffea00040e4c01 00000000ffffffff 00000000ffffffff [ 10.491917] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 10.492255] page dumped because: kasan: bad access detected [ 10.492517] [ 10.492606] Memory state around the buggy address: [ 10.493026] ffff888103931e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 10.493357] ffff888103931e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 10.493580] >ffff888103931f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.493782] ^ [ 10.493905] ffff888103931f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.494259] ffff888103932000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 10.494605] ==================================================================