Hay
Date
Feb. 5, 2025, 2:09 p.m.

Environment
qemu-arm64

[  181.528360] ==================================================================
[  181.529938] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x150/0x378
[  181.531677] Read of size 1 at addr ffff0000c170c07f by task kunit_try_catch/190
[  181.533367] 
[  181.534029] CPU: 0 PID: 190 Comm: kunit_try_catch Tainted: G    B            N 6.6.76-rc1 #1
[  181.536141] Hardware name: linux,dummy-virt (DT)
[  181.537185] Call trace:
[  181.537973]  dump_backtrace+0x9c/0x128
[  181.539051]  show_stack+0x20/0x38
[  181.540028]  dump_stack_lvl+0x60/0xb0
[  181.541267]  print_report+0xf8/0x5d8
[  181.543457]  kasan_report+0xc8/0x118
[  181.544427]  __asan_load1+0x60/0x70
[  181.545622]  ksize_unpoisons_memory+0x150/0x378
[  181.546972]  kunit_try_run_case+0xf8/0x260
[  181.548196]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  181.549916]  kthread+0x18c/0x1a8
[  181.550707]  ret_from_fork+0x10/0x20
[  181.552619] 
[  181.553318] Allocated by task 190:
[  181.554474]  kasan_save_stack+0x3c/0x68
[  181.555446]  kasan_set_track+0x2c/0x40
[  181.556561]  kasan_save_alloc_info+0x24/0x38
[  181.557762]  __kasan_kmalloc+0xd4/0xd8
[  181.559693]  kmalloc_trace+0x68/0x130
[  181.561320]  ksize_unpoisons_memory+0xb0/0x378
[  181.562881]  kunit_try_run_case+0xf8/0x260
[  181.564131]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  181.565881]  kthread+0x18c/0x1a8
[  181.567043]  ret_from_fork+0x10/0x20
[  181.568200] 
[  181.568758] The buggy address belongs to the object at ffff0000c170c000
[  181.568758]  which belongs to the cache kmalloc-128 of size 128
[  181.571544] The buggy address is located 12 bytes to the right of
[  181.571544]  allocated 115-byte region [ffff0000c170c000, ffff0000c170c073)
[  181.574938] 
[  181.575391] The buggy address belongs to the physical page:
[  181.577278] page:00000000265a4d16 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10170c
[  181.579639] flags: 0xbfffc0000000800(slab|node=0|zone=2|lastcpupid=0xffff)
[  181.581292] page_type: 0xffffffff()
[  181.582405] raw: 0bfffc0000000800 ffff0000c00018c0 dead000000000122 0000000000000000
[  181.584670] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[  181.586329] page dumped because: kasan: bad access detected
[  181.587585] 
[  181.588127] Memory state around the buggy address:
[  181.589384]  ffff0000c170bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  181.591175]  ffff0000c170bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  181.593114] >ffff0000c170c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc
[  181.594784]                                                                 ^
[  181.596390]  ffff0000c170c080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  181.598288]  ffff0000c170c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  181.600164] ==================================================================
[  181.449245] ==================================================================
[  181.450968] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x128/0x378
[  181.452724] Read of size 1 at addr ffff0000c170c078 by task kunit_try_catch/190
[  181.454477] 
[  181.455244] CPU: 0 PID: 190 Comm: kunit_try_catch Tainted: G    B            N 6.6.76-rc1 #1
[  181.456921] Hardware name: linux,dummy-virt (DT)
[  181.457838] Call trace:
[  181.458566]  dump_backtrace+0x9c/0x128
[  181.460207]  show_stack+0x20/0x38
[  181.461335]  dump_stack_lvl+0x60/0xb0
[  181.462532]  print_report+0xf8/0x5d8
[  181.463680]  kasan_report+0xc8/0x118
[  181.464823]  __asan_load1+0x60/0x70
[  181.466291]  ksize_unpoisons_memory+0x128/0x378
[  181.467337]  kunit_try_run_case+0xf8/0x260
[  181.469163]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  181.470656]  kthread+0x18c/0x1a8
[  181.471660]  ret_from_fork+0x10/0x20
[  181.472757] 
[  181.473399] Allocated by task 190:
[  181.475113]  kasan_save_stack+0x3c/0x68
[  181.476423]  kasan_set_track+0x2c/0x40
[  181.477594]  kasan_save_alloc_info+0x24/0x38
[  181.478933]  __kasan_kmalloc+0xd4/0xd8
[  181.480241]  kmalloc_trace+0x68/0x130
[  181.481514]  ksize_unpoisons_memory+0xb0/0x378
[  181.483650]  kunit_try_run_case+0xf8/0x260
[  181.484958]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  181.486414]  kthread+0x18c/0x1a8
[  181.487403]  ret_from_fork+0x10/0x20
[  181.488509] 
[  181.489222] The buggy address belongs to the object at ffff0000c170c000
[  181.489222]  which belongs to the cache kmalloc-128 of size 128
[  181.492953] The buggy address is located 5 bytes to the right of
[  181.492953]  allocated 115-byte region [ffff0000c170c000, ffff0000c170c073)
[  181.495656] 
[  181.496139] The buggy address belongs to the physical page:
[  181.497506] page:00000000265a4d16 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10170c
[  181.501313] flags: 0xbfffc0000000800(slab|node=0|zone=2|lastcpupid=0xffff)
[  181.502927] page_type: 0xffffffff()
[  181.503979] raw: 0bfffc0000000800 ffff0000c00018c0 dead000000000122 0000000000000000
[  181.505895] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[  181.507995] page dumped because: kasan: bad access detected
[  181.509360] 
[  181.509963] Memory state around the buggy address:
[  181.511191]  ffff0000c170bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  181.512447]  ffff0000c170bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  181.514019] >ffff0000c170c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc
[  181.516846]                                                                 ^
[  181.520029]  ffff0000c170c080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  181.521919]  ffff0000c170c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  181.523451] ==================================================================
[  181.373790] ==================================================================
[  181.376530] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x104/0x378
[  181.378065] Read of size 1 at addr ffff0000c170c073 by task kunit_try_catch/190
[  181.380198] 
[  181.381223] CPU: 0 PID: 190 Comm: kunit_try_catch Tainted: G    B            N 6.6.76-rc1 #1
[  181.382720] Hardware name: linux,dummy-virt (DT)
[  181.384005] Call trace:
[  181.384801]  dump_backtrace+0x9c/0x128
[  181.385974]  show_stack+0x20/0x38
[  181.386919]  dump_stack_lvl+0x60/0xb0
[  181.388083]  print_report+0xf8/0x5d8
[  181.389555]  kasan_report+0xc8/0x118
[  181.390730]  __asan_load1+0x60/0x70
[  181.392605]  ksize_unpoisons_memory+0x104/0x378
[  181.394234]  kunit_try_run_case+0xf8/0x260
[  181.395119]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  181.396514]  kthread+0x18c/0x1a8
[  181.397506]  ret_from_fork+0x10/0x20
[  181.398607] 
[  181.399095] Allocated by task 190:
[  181.400062]  kasan_save_stack+0x3c/0x68
[  181.401254]  kasan_set_track+0x2c/0x40
[  181.402831]  kasan_save_alloc_info+0x24/0x38
[  181.404349]  __kasan_kmalloc+0xd4/0xd8
[  181.405450]  kmalloc_trace+0x68/0x130
[  181.406518]  ksize_unpoisons_memory+0xb0/0x378
[  181.407855]  kunit_try_run_case+0xf8/0x260
[  181.409245]  kunit_generic_run_threadfn_adapter+0x38/0x60
[  181.410472]  kthread+0x18c/0x1a8
[  181.411322]  ret_from_fork+0x10/0x20
[  181.412787] 
[  181.413326] The buggy address belongs to the object at ffff0000c170c000
[  181.413326]  which belongs to the cache kmalloc-128 of size 128
[  181.415599] The buggy address is located 0 bytes to the right of
[  181.415599]  allocated 115-byte region [ffff0000c170c000, ffff0000c170c073)
[  181.418517] 
[  181.419012] The buggy address belongs to the physical page:
[  181.420744] page:00000000265a4d16 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10170c
[  181.422682] flags: 0xbfffc0000000800(slab|node=0|zone=2|lastcpupid=0xffff)
[  181.424257] page_type: 0xffffffff()
[  181.425502] raw: 0bfffc0000000800 ffff0000c00018c0 dead000000000122 0000000000000000
[  181.427622] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[  181.429586] page dumped because: kasan: bad access detected
[  181.430668] 
[  181.431135] Memory state around the buggy address:
[  181.432118]  ffff0000c170bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  181.434103]  ffff0000c170bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  181.435918] >ffff0000c170c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc
[  181.437225]                                                              ^
[  181.438769]  ffff0000c170c080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  181.440384]  ffff0000c170c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  181.441980] ==================================================================