Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 144.368685] ================================================================== [ 144.369861] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0xd4/0x1e8 [ 144.370751] Read of size 1 at addr c5813000 by task kunit_try_catch/115 [ 144.371672] [ 144.372005] CPU: 0 PID: 115 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 144.372825] Hardware name: Generic DT based system [ 144.373525] unwind_backtrace from show_stack+0x18/0x1c [ 144.374308] show_stack from dump_stack_lvl+0x58/0x70 [ 144.375167] dump_stack_lvl from print_report+0x164/0x51c [ 144.376302] print_report from kasan_report+0xc8/0x104 [ 144.377029] kasan_report from kmalloc_node_oob_right+0xd4/0x1e8 [ 144.377929] kmalloc_node_oob_right from kunit_try_run_case+0x11c/0x2e4 [ 144.379291] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 144.380355] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 144.381314] kthread from ret_from_fork+0x14/0x30 [ 144.381922] Exception stack(0xf9eb3fb0 to 0xf9eb3ff8) [ 144.382521] 3fa0: 00000000 00000000 00000000 00000000 [ 144.383387] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 144.384263] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 144.385105] [ 144.385416] Allocated by task 115: [ 144.385815] kasan_set_track+0x3c/0x5c [ 144.386523] __kasan_kmalloc+0x8c/0x94 [ 144.387144] kmalloc_node_oob_right+0xa4/0x1e8 [ 144.387844] kunit_try_run_case+0x11c/0x2e4 [ 144.388409] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 144.389219] kthread+0x184/0x1a8 [ 144.389638] ret_from_fork+0x14/0x30 [ 144.390212] [ 144.390555] The buggy address belongs to the object at c5812000 [ 144.390555] which belongs to the cache kmalloc-4k of size 4096 [ 144.391834] The buggy address is located 0 bytes to the right of [ 144.391834] allocated 4096-byte region [c5812000, c5813000) [ 144.393006] [ 144.393358] The buggy address belongs to the physical page: [ 144.394034] page:5db007ca refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x45810 [ 144.394909] head:5db007ca order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 144.395919] flags: 0x840(slab|head|zone=0) [ 144.396499] page_type: 0xffffffff() [ 144.396917] raw: 00000840 c4801900 00000122 00000000 00000000 80040004 ffffffff 00000001 [ 144.398009] raw: 00000000 [ 144.398333] page dumped because: kasan: bad access detected [ 144.399092] [ 144.399349] Memory state around the buggy address: [ 144.399962] c5812f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 144.401047] c5812f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 144.401790] >c5813000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 144.402359] ^ [ 144.402906] c5813080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 144.403648] c5813100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 144.404553] ==================================================================
[ 46.776756] ================================================================== [ 46.777699] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0xd4/0x1f0 [ 46.778501] Read of size 1 at addr ffff888101d4d000 by task kunit_try_catch/138 [ 46.779473] [ 46.779789] CPU: 0 PID: 138 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 46.781223] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 46.782497] Call Trace: [ 46.782818] <TASK> [ 46.783130] dump_stack_lvl+0x4e/0x90 [ 46.783655] print_report+0xd2/0x660 [ 46.784235] ? __virt_addr_valid+0x156/0x1e0 [ 46.784785] ? kasan_complete_mode_report_info+0x2a/0x200 [ 46.785469] kasan_report+0xff/0x140 [ 46.786637] ? kmalloc_node_oob_right+0xd4/0x1f0 [ 46.787206] ? kmalloc_node_oob_right+0xd4/0x1f0 [ 46.787877] __asan_load1+0x66/0x70 [ 46.788393] kmalloc_node_oob_right+0xd4/0x1f0 [ 46.788977] ? __pfx_kmalloc_node_oob_right+0x10/0x10 [ 46.790402] ? __schedule+0x70b/0x1190 [ 46.790973] ? ktime_get_ts64+0x118/0x140 [ 46.791809] kunit_try_run_case+0x126/0x290 [ 46.792451] ? __pfx_kunit_try_run_case+0x10/0x10 [ 46.793200] ? __kasan_check_write+0x18/0x20 [ 46.793665] ? trace_preempt_on+0x20/0xa0 [ 46.794375] ? __kthread_parkme+0x4f/0xd0 [ 46.795247] ? preempt_count_sub+0x50/0x80 [ 46.795881] ? __pfx_kunit_try_run_case+0x10/0x10 [ 46.796434] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 46.797081] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 46.797883] kthread+0x19e/0x1e0 [ 46.798428] ? __pfx_kthread+0x10/0x10 [ 46.799261] ret_from_fork+0x41/0x70 [ 46.799914] ? __pfx_kthread+0x10/0x10 [ 46.800555] ret_from_fork_asm+0x1b/0x30 [ 46.801117] </TASK> [ 46.801482] [ 46.801688] Allocated by task 138: [ 46.802090] kasan_save_stack+0x3c/0x60 [ 46.802643] kasan_set_track+0x29/0x40 [ 46.803205] kasan_save_alloc_info+0x22/0x30 [ 46.804019] __kasan_kmalloc+0xb7/0xc0 [ 46.804549] kmalloc_node_trace+0x49/0xb0 [ 46.805190] kmalloc_node_oob_right+0xa1/0x1f0 [ 46.805699] kunit_try_run_case+0x126/0x290 [ 46.806280] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 46.807566] kthread+0x19e/0x1e0 [ 46.808101] ret_from_fork+0x41/0x70 [ 46.808648] ret_from_fork_asm+0x1b/0x30 [ 46.809195] [ 46.809421] The buggy address belongs to the object at ffff888101d4c000 [ 46.809421] which belongs to the cache kmalloc-4k of size 4096 [ 46.810449] The buggy address is located 0 bytes to the right of [ 46.810449] allocated 4096-byte region [ffff888101d4c000, ffff888101d4d000) [ 46.812512] [ 46.812840] The buggy address belongs to the physical page: [ 46.813333] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101d48 [ 46.814476] head:(____ptrval____) order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 46.815608] flags: 0x200000000000840(slab|head|node=0|zone=2) [ 46.816510] page_type: 0xffffffff() [ 46.816961] raw: 0200000000000840 ffff888100042140 dead000000000122 0000000000000000 [ 46.818055] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000 [ 46.818814] page dumped because: kasan: bad access detected [ 46.819759] [ 46.819966] Memory state around the buggy address: [ 46.820696] ffff888101d4cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.821287] ffff888101d4cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.822175] >ffff888101d4d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.822915] ^ [ 46.823504] ffff888101d4d080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.824510] ffff888101d4d100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.825274] ==================================================================