Hay
Date
Feb. 5, 2025, 2:09 p.m.

Environment
qemu-arm64

[  179.744701] ==================================================================
[  179.747531] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0xe0/0x1f0
[  179.749269] Read of size 18446744073709551614 at addr ffff0000c5f70e04 by task kunit_try_catch/158
[  179.751354] 
[  179.752061] CPU: 0 PID: 158 Comm: kunit_try_catch Tainted: G    B            N 6.6.76-rc1 #1
[  179.754095] Hardware name: linux,dummy-virt (DT)
[  179.755345] Call trace:
[  179.756068]  dump_backtrace+0x9c/0x128
[  179.757381]  show_stack+0x20/0x38
[  179.758517]  dump_stack_lvl+0x60/0xb0
[  179.759879]  print_report+0xf8/0x5d8
[  179.760859]  kasan_report+0xc8/0x118
[  179.762489]  kasan_check_range+0xe8/0x190
[  179.764334]  __asan_memmove+0x3c/0x98
[  179.765551]  kmalloc_memmove_negative_size+0xe0/0x1f0
[  179.767201]  kunit_try_run_case+0xf8/0x260
[  179.768455]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  179.769895]  kthread+0x18c/0x1a8
[  179.770934]  ret_from_fork+0x10/0x20
[  179.772076] 
[  179.772635] Allocated by task 158:
[  179.773844]  kasan_save_stack+0x3c/0x68
[  179.775092]  kasan_set_track+0x2c/0x40
[  179.776315]  kasan_save_alloc_info+0x24/0x38
[  179.777680]  __kasan_kmalloc+0xd4/0xd8
[  179.778404]  kmalloc_trace+0x68/0x130
[  179.779034]  kmalloc_memmove_negative_size+0xa0/0x1f0
[  179.780658]  kunit_try_run_case+0xf8/0x260
[  179.782274]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  179.784207]  kthread+0x18c/0x1a8
[  179.785471]  ret_from_fork+0x10/0x20
[  179.786978] 
[  179.787437] The buggy address belongs to the object at ffff0000c5f70e00
[  179.787437]  which belongs to the cache kmalloc-64 of size 64
[  179.790520] The buggy address is located 4 bytes inside of
[  179.790520]  64-byte region [ffff0000c5f70e00, ffff0000c5f70e40)
[  179.792782] 
[  179.793364] The buggy address belongs to the physical page:
[  179.795261] page:00000000a682f890 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f70
[  179.797392] flags: 0xbfffc0000000800(slab|node=0|zone=2|lastcpupid=0xffff)
[  179.799054] page_type: 0xffffffff()
[  179.800110] raw: 0bfffc0000000800 ffff0000c0001640 dead000000000122 0000000000000000
[  179.801771] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[  179.803466] page dumped because: kasan: bad access detected
[  179.804451] 
[  179.804960] Memory state around the buggy address:
[  179.806202]  ffff0000c5f70d00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  179.807993]  ffff0000c5f70d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  179.810137] >ffff0000c5f70e00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[  179.811663]                    ^
[  179.812523]  ffff0000c5f70e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  179.814415]  ffff0000c5f70f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  179.816219] ==================================================================