Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 145.519601] ================================================================== [ 145.520685] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0xe4/0x1f0 [ 145.521597] Read of size 4294967294 at addr c4fcf404 by task kunit_try_catch/153 [ 145.522219] [ 145.522600] CPU: 0 PID: 153 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 145.523556] Hardware name: Generic DT based system [ 145.524146] unwind_backtrace from show_stack+0x18/0x1c [ 145.524727] show_stack from dump_stack_lvl+0x58/0x70 [ 145.525569] dump_stack_lvl from print_report+0x164/0x51c [ 145.526163] print_report from kasan_report+0xc8/0x104 [ 145.526949] kasan_report from kasan_check_range+0x14c/0x198 [ 145.527800] kasan_check_range from __asan_memmove+0x28/0x68 [ 145.528898] __asan_memmove from kmalloc_memmove_negative_size+0xe4/0x1f0 [ 145.529828] kmalloc_memmove_negative_size from kunit_try_run_case+0x11c/0x2e4 [ 145.530912] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.531887] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 145.532768] kthread from ret_from_fork+0x14/0x30 [ 145.533384] Exception stack(0xf9fc3fb0 to 0xf9fc3ff8) [ 145.533934] 3fa0: 00000000 00000000 00000000 00000000 [ 145.534819] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 145.535798] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 145.536434] [ 145.536782] Allocated by task 153: [ 145.537513] kasan_set_track+0x3c/0x5c [ 145.538537] __kasan_kmalloc+0x8c/0x94 [ 145.539152] kmalloc_memmove_negative_size+0xa0/0x1f0 [ 145.539858] kunit_try_run_case+0x11c/0x2e4 [ 145.540539] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.541463] kthread+0x184/0x1a8 [ 145.541886] ret_from_fork+0x14/0x30 [ 145.542437] [ 145.542743] The buggy address belongs to the object at c4fcf400 [ 145.542743] which belongs to the cache kmalloc-64 of size 64 [ 145.543996] The buggy address is located 4 bytes inside of [ 145.543996] 64-byte region [c4fcf400, c4fcf440) [ 145.545189] [ 145.545409] The buggy address belongs to the physical page: [ 145.546310] page:8516b471 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x44fcf [ 145.547236] flags: 0x800(slab|zone=0) [ 145.547736] page_type: 0xffffffff() [ 145.548280] raw: 00000800 c4801200 00000122 00000000 00000000 80200020 ffffffff 00000001 [ 145.549306] raw: 00000000 [ 145.549743] page dumped because: kasan: bad access detected [ 145.550425] [ 145.550749] Memory state around the buggy address: [ 145.551496] c4fcf300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 145.552367] c4fcf380: 00 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.553178] >c4fcf400: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 145.553907] ^ [ 145.554403] c4fcf480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.555166] c4fcf500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.556351] ==================================================================
[ 48.359383] ================================================================== [ 48.360438] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0xeb/0x1f0 [ 48.361182] Read of size 18446744073709551614 at addr ffff8881028cf984 by task kunit_try_catch/176 [ 48.362094] [ 48.362414] CPU: 1 PID: 176 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 48.363414] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 48.364416] Call Trace: [ 48.364760] <TASK> [ 48.365388] dump_stack_lvl+0x4e/0x90 [ 48.366025] print_report+0xd2/0x660 [ 48.366683] ? __virt_addr_valid+0x156/0x1e0 [ 48.367265] ? kasan_complete_mode_report_info+0x2a/0x200 [ 48.367957] kasan_report+0xff/0x140 [ 48.368405] ? kmalloc_memmove_negative_size+0xeb/0x1f0 [ 48.369139] ? kmalloc_memmove_negative_size+0xeb/0x1f0 [ 48.369801] kasan_check_range+0x10c/0x1c0 [ 48.370401] __asan_memmove+0x27/0x70 [ 48.370999] kmalloc_memmove_negative_size+0xeb/0x1f0 [ 48.371685] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 48.372356] ? ret_from_fork+0x41/0x70 [ 48.372981] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 48.373657] ? kunit_try_run_case+0x11b/0x290 [ 48.374290] kunit_try_run_case+0x126/0x290 [ 48.374901] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.375528] ? __kasan_check_write+0x18/0x20 [ 48.376156] ? trace_preempt_on+0x20/0xa0 [ 48.376676] ? __kthread_parkme+0x4f/0xd0 [ 48.377222] ? preempt_count_sub+0x50/0x80 [ 48.377849] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.378494] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 48.379261] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.379954] kthread+0x19e/0x1e0 [ 48.380421] ? __pfx_kthread+0x10/0x10 [ 48.381042] ret_from_fork+0x41/0x70 [ 48.381568] ? __pfx_kthread+0x10/0x10 [ 48.382198] ret_from_fork_asm+0x1b/0x30 [ 48.382879] </TASK> [ 48.383225] [ 48.383453] Allocated by task 176: [ 48.383953] kasan_save_stack+0x3c/0x60 [ 48.384499] kasan_set_track+0x29/0x40 [ 48.385025] kasan_save_alloc_info+0x22/0x30 [ 48.385599] __kasan_kmalloc+0xb7/0xc0 [ 48.386160] kmalloc_trace+0x4c/0xb0 [ 48.386725] kmalloc_memmove_negative_size+0x9f/0x1f0 [ 48.387316] kunit_try_run_case+0x126/0x290 [ 48.387854] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.388529] kthread+0x19e/0x1e0 [ 48.389106] ret_from_fork+0x41/0x70 [ 48.389635] ret_from_fork_asm+0x1b/0x30 [ 48.390134] [ 48.390377] The buggy address belongs to the object at ffff8881028cf980 [ 48.390377] which belongs to the cache kmalloc-64 of size 64 [ 48.391599] The buggy address is located 4 bytes inside of [ 48.391599] 64-byte region [ffff8881028cf980, ffff8881028cf9c0) [ 48.392534] [ 48.392818] The buggy address belongs to the physical page: [ 48.393493] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1028cf [ 48.394571] flags: 0x200000000000800(slab|node=0|zone=2) [ 48.395313] page_type: 0xffffffff() [ 48.395908] raw: 0200000000000800 ffff888100041640 dead000000000122 0000000000000000 [ 48.396676] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 48.397572] page dumped because: kasan: bad access detected [ 48.398227] [ 48.398533] Memory state around the buggy address: [ 48.399085] ffff8881028cf880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 48.399973] ffff8881028cf900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 48.400781] >ffff8881028cf980: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 48.401576] ^ [ 48.402104] ffff8881028cfa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.402892] ffff8881028cfa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.403626] ==================================================================