Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 144.317870] ================================================================== [ 144.319086] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0xcc/0x1e0 [ 144.319749] Read of size 1 at addr c4fce77f by task kunit_try_catch/113 [ 144.320760] [ 144.321159] CPU: 0 PID: 113 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 144.322088] Hardware name: Generic DT based system [ 144.322623] unwind_backtrace from show_stack+0x18/0x1c [ 144.323373] show_stack from dump_stack_lvl+0x58/0x70 [ 144.324143] dump_stack_lvl from print_report+0x164/0x51c [ 144.324810] print_report from kasan_report+0xc8/0x104 [ 144.325477] kasan_report from kmalloc_oob_left+0xcc/0x1e0 [ 144.326584] kmalloc_oob_left from kunit_try_run_case+0x11c/0x2e4 [ 144.327481] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 144.328435] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 144.329319] kthread from ret_from_fork+0x14/0x30 [ 144.330025] Exception stack(0xf9ea3fb0 to 0xf9ea3ff8) [ 144.330627] 3fa0: 00000000 00000000 00000000 00000000 [ 144.331530] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 144.332442] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 144.333117] [ 144.333465] Allocated by task 109: [ 144.333889] kasan_set_track+0x3c/0x5c [ 144.334348] __kasan_kmalloc+0x8c/0x94 [ 144.335046] kunit_add_action+0xa0/0x1e8 [ 144.335651] kunit_add_action_or_reset+0x18/0x30 [ 144.336261] kunit_kmalloc_array+0x44/0x60 [ 144.336903] sysctl_test_api_dointvec_write_single_greater_int_max+0x134/0x2b8 [ 144.337693] kunit_try_run_case+0x11c/0x2e4 [ 144.338579] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 144.339265] kthread+0x184/0x1a8 [ 144.339793] ret_from_fork+0x14/0x30 [ 144.340229] [ 144.340552] Freed by task 110: [ 144.341048] kasan_set_track+0x3c/0x5c [ 144.341618] kasan_save_free_info+0x30/0x3c [ 144.342383] __kasan_slab_free+0xdc/0x124 [ 144.342894] __kmem_cache_free+0x140/0x2a8 [ 144.343596] kunit_cleanup+0x44/0x90 [ 144.344263] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 144.344999] kthread+0x184/0x1a8 [ 144.345476] ret_from_fork+0x14/0x30 [ 144.346038] [ 144.346755] The buggy address belongs to the object at c4fce700 [ 144.346755] which belongs to the cache kmalloc-64 of size 64 [ 144.348205] The buggy address is located 63 bytes to the right of [ 144.348205] allocated 64-byte region [c4fce700, c4fce740) [ 144.349225] [ 144.349558] The buggy address belongs to the physical page: [ 144.350043] page:44c7b72b refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x44fce [ 144.351110] flags: 0x800(slab|zone=0) [ 144.351541] page_type: 0xffffffff() [ 144.352098] raw: 00000800 c4801200 00000122 00000000 00000000 80200020 ffffffff 00000001 [ 144.352969] raw: 00000000 [ 144.353468] page dumped because: kasan: bad access detected [ 144.354247] [ 144.354486] Memory state around the buggy address: [ 144.355087] c4fce600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 144.355948] c4fce680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 144.356669] >c4fce700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 144.357484] ^ [ 144.358196] c4fce780: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 144.359007] c4fce800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 144.359725] ==================================================================
[ 46.722123] ================================================================== [ 46.723494] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0xcf/0x1f0 [ 46.724226] Read of size 1 at addr ffff888101a813bf by task kunit_try_catch/136 [ 46.724828] [ 46.725135] CPU: 0 PID: 136 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 46.726060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 46.726807] Call Trace: [ 46.727164] <TASK> [ 46.727596] dump_stack_lvl+0x4e/0x90 [ 46.728266] print_report+0xd2/0x660 [ 46.728852] ? __virt_addr_valid+0x156/0x1e0 [ 46.729484] ? kasan_complete_mode_report_info+0x2a/0x200 [ 46.730145] kasan_report+0xff/0x140 [ 46.730725] ? kmalloc_oob_left+0xcf/0x1f0 [ 46.731376] ? kmalloc_oob_left+0xcf/0x1f0 [ 46.732012] __asan_load1+0x66/0x70 [ 46.732553] kmalloc_oob_left+0xcf/0x1f0 [ 46.733118] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 46.733704] ? __schedule+0x70b/0x1190 [ 46.734206] ? ktime_get_ts64+0x118/0x140 [ 46.734865] kunit_try_run_case+0x126/0x290 [ 46.735524] ? __pfx_kunit_try_run_case+0x10/0x10 [ 46.736195] ? __kasan_check_write+0x18/0x20 [ 46.736829] ? trace_preempt_on+0x20/0xa0 [ 46.737375] ? __kthread_parkme+0x4f/0xd0 [ 46.737879] ? preempt_count_sub+0x50/0x80 [ 46.738545] ? __pfx_kunit_try_run_case+0x10/0x10 [ 46.739231] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 46.739905] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 46.740675] kthread+0x19e/0x1e0 [ 46.741257] ? __pfx_kthread+0x10/0x10 [ 46.741783] ret_from_fork+0x41/0x70 [ 46.742360] ? __pfx_kthread+0x10/0x10 [ 46.742972] ret_from_fork_asm+0x1b/0x30 [ 46.743575] </TASK> [ 46.743974] [ 46.744268] Allocated by task 1: [ 46.744645] kasan_save_stack+0x3c/0x60 [ 46.745230] kasan_set_track+0x29/0x40 [ 46.745765] kasan_save_alloc_info+0x22/0x30 [ 46.746384] __kasan_kmalloc+0xb7/0xc0 [ 46.746951] __kmalloc_node_track_caller+0x69/0x170 [ 46.747520] kvasprintf+0xc6/0x150 [ 46.748117] __kthread_create_on_node+0x128/0x260 [ 46.748617] kthread_create_on_node+0xa8/0xe0 [ 46.749150] create_worker+0x19a/0x3d0 [ 46.749606] alloc_unbound_pwq+0x4bf/0x4d0 [ 46.750133] apply_wqattrs_prepare+0x1b7/0x3c0 [ 46.750667] apply_workqueue_attrs_locked+0x66/0xa0 [ 46.751222] alloc_workqueue+0x78c/0x910 [ 46.751815] latency_fsnotify_init+0x1b/0x50 [ 46.752408] do_one_initcall+0xb3/0x340 [ 46.752860] kernel_init_freeable+0x2ae/0x470 [ 46.753452] kernel_init+0x23/0x1e0 [ 46.753913] ret_from_fork+0x41/0x70 [ 46.754447] ret_from_fork_asm+0x1b/0x30 [ 46.754966] [ 46.755226] The buggy address belongs to the object at ffff888101a813a0 [ 46.755226] which belongs to the cache kmalloc-16 of size 16 [ 46.756315] The buggy address is located 18 bytes to the right of [ 46.756315] allocated 13-byte region [ffff888101a813a0, ffff888101a813ad) [ 46.757495] [ 46.757729] The buggy address belongs to the physical page: [ 46.758403] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101a81 [ 46.759251] flags: 0x200000000000800(slab|node=0|zone=2) [ 46.759806] page_type: 0xffffffff() [ 46.760313] raw: 0200000000000800 ffff8881000413c0 dead000000000122 0000000000000000 [ 46.761078] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 46.761874] page dumped because: kasan: bad access detected [ 46.762332] [ 46.762606] Memory state around the buggy address: [ 46.763157] ffff888101a81280: 00 02 fc fc 00 05 fc fc 00 02 fc fc 00 02 fc fc [ 46.763725] ffff888101a81300: 00 02 fc fc 00 02 fc fc fa fb fc fc fa fb fc fc [ 46.764518] >ffff888101a81380: fa fb fc fc 00 05 fc fc 00 07 fc fc fc fc fc fc [ 46.765211] ^ [ 46.765811] ffff888101a81400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.766429] ffff888101a81480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.767147] ==================================================================