Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 145.475793] ================================================================== [ 145.477020] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0xdc/0x1e0 [ 145.477850] Write of size 16 at addr c4fd0469 by task kunit_try_catch/151 [ 145.478573] [ 145.478798] CPU: 0 PID: 151 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 145.479882] Hardware name: Generic DT based system [ 145.480452] unwind_backtrace from show_stack+0x18/0x1c [ 145.481223] show_stack from dump_stack_lvl+0x58/0x70 [ 145.481872] dump_stack_lvl from print_report+0x164/0x51c [ 145.482629] print_report from kasan_report+0xc8/0x104 [ 145.483363] kasan_report from kasan_check_range+0x14c/0x198 [ 145.484133] kasan_check_range from __asan_memset+0x20/0x3c [ 145.484915] __asan_memset from kmalloc_oob_memset_16+0xdc/0x1e0 [ 145.485814] kmalloc_oob_memset_16 from kunit_try_run_case+0x11c/0x2e4 [ 145.486731] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.487537] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 145.488397] kthread from ret_from_fork+0x14/0x30 [ 145.488973] Exception stack(0xf9fb3fb0 to 0xf9fb3ff8) [ 145.489613] 3fa0: 00000000 00000000 00000000 00000000 [ 145.490523] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 145.491404] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 145.492097] [ 145.492386] Allocated by task 151: [ 145.492843] kasan_set_track+0x3c/0x5c [ 145.493462] __kasan_kmalloc+0x8c/0x94 [ 145.494032] kmalloc_oob_memset_16+0xa0/0x1e0 [ 145.494643] kunit_try_run_case+0x11c/0x2e4 [ 145.495211] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.496130] kthread+0x184/0x1a8 [ 145.496618] ret_from_fork+0x14/0x30 [ 145.497126] [ 145.497422] The buggy address belongs to the object at c4fd0400 [ 145.497422] which belongs to the cache kmalloc-128 of size 128 [ 145.498596] The buggy address is located 105 bytes inside of [ 145.498596] allocated 120-byte region [c4fd0400, c4fd0478) [ 145.499778] [ 145.500032] The buggy address belongs to the physical page: [ 145.500657] page:c1b69563 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x44fd0 [ 145.501389] flags: 0x800(slab|zone=0) [ 145.501994] page_type: 0xffffffff() [ 145.502525] raw: 00000800 c4801300 00000122 00000000 00000000 80100010 ffffffff 00000001 [ 145.503563] raw: 00000000 [ 145.503895] page dumped because: kasan: bad access detected [ 145.504625] [ 145.504827] Memory state around the buggy address: [ 145.505521] c4fd0300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 145.506460] c4fd0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.507247] >c4fd0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 145.507926] ^ [ 145.508626] c4fd0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.509389] c4fd0500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.510072] ==================================================================
[ 48.296861] ================================================================== [ 48.298013] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0xdd/0x1e0 [ 48.298921] Write of size 16 at addr ffff888102944169 by task kunit_try_catch/174 [ 48.299749] [ 48.300782] CPU: 1 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 48.301834] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 48.302885] Call Trace: [ 48.303230] <TASK> [ 48.303484] dump_stack_lvl+0x4e/0x90 [ 48.304603] print_report+0xd2/0x660 [ 48.305142] ? __virt_addr_valid+0x156/0x1e0 [ 48.305929] ? kasan_complete_mode_report_info+0x2a/0x200 [ 48.306770] kasan_report+0xff/0x140 [ 48.307669] ? kmalloc_oob_memset_16+0xdd/0x1e0 [ 48.308648] ? kmalloc_oob_memset_16+0xdd/0x1e0 [ 48.309496] kasan_check_range+0x10c/0x1c0 [ 48.310205] __asan_memset+0x27/0x50 [ 48.310813] kmalloc_oob_memset_16+0xdd/0x1e0 [ 48.311504] ? __pfx_kmalloc_oob_memset_16+0x10/0x10 [ 48.312095] ? __schedule+0x70b/0x1190 [ 48.312701] ? ktime_get_ts64+0x118/0x140 [ 48.313183] kunit_try_run_case+0x126/0x290 [ 48.313892] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.314444] ? __kasan_check_write+0x18/0x20 [ 48.315150] ? trace_preempt_on+0x20/0xa0 [ 48.315774] ? __kthread_parkme+0x4f/0xd0 [ 48.316242] ? preempt_count_sub+0x50/0x80 [ 48.316931] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.317575] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 48.319129] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.320001] kthread+0x19e/0x1e0 [ 48.320652] ? __pfx_kthread+0x10/0x10 [ 48.321376] ret_from_fork+0x41/0x70 [ 48.322145] ? __pfx_kthread+0x10/0x10 [ 48.322639] ret_from_fork_asm+0x1b/0x30 [ 48.323387] </TASK> [ 48.324197] [ 48.324363] Allocated by task 174: [ 48.324551] kasan_save_stack+0x3c/0x60 [ 48.324897] kasan_set_track+0x29/0x40 [ 48.326343] kasan_save_alloc_info+0x22/0x30 [ 48.327062] __kasan_kmalloc+0xb7/0xc0 [ 48.327782] kmalloc_trace+0x4c/0xb0 [ 48.328843] kmalloc_oob_memset_16+0x9f/0x1e0 [ 48.329389] kunit_try_run_case+0x126/0x290 [ 48.330150] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.330901] kthread+0x19e/0x1e0 [ 48.331560] ret_from_fork+0x41/0x70 [ 48.332314] ret_from_fork_asm+0x1b/0x30 [ 48.332925] [ 48.333426] The buggy address belongs to the object at ffff888102944100 [ 48.333426] which belongs to the cache kmalloc-128 of size 128 [ 48.335488] The buggy address is located 105 bytes inside of [ 48.335488] allocated 120-byte region [ffff888102944100, ffff888102944178) [ 48.336718] [ 48.337183] The buggy address belongs to the physical page: [ 48.337782] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102944 [ 48.339327] flags: 0x200000000000800(slab|node=0|zone=2) [ 48.339934] page_type: 0xffffffff() [ 48.340570] raw: 0200000000000800 ffff8881000418c0 dead000000000122 0000000000000000 [ 48.341347] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 48.342286] page dumped because: kasan: bad access detected [ 48.342936] [ 48.343217] Memory state around the buggy address: [ 48.343767] ffff888102944000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.344645] ffff888102944080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.346203] >ffff888102944100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 48.346858] ^ [ 48.347510] ffff888102944180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.348481] ffff888102944200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.349308] ==================================================================