Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 145.343182] ================================================================== [ 145.344324] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0xdc/0x1e4 [ 145.345079] Write of size 2 at addr c4fd0177 by task kunit_try_catch/145 [ 145.346697] [ 145.347021] CPU: 0 PID: 145 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 145.348287] Hardware name: Generic DT based system [ 145.348898] unwind_backtrace from show_stack+0x18/0x1c [ 145.349793] show_stack from dump_stack_lvl+0x58/0x70 [ 145.350585] dump_stack_lvl from print_report+0x164/0x51c [ 145.351264] print_report from kasan_report+0xc8/0x104 [ 145.352007] kasan_report from kasan_check_range+0x14c/0x198 [ 145.352874] kasan_check_range from __asan_memset+0x20/0x3c [ 145.353683] __asan_memset from kmalloc_oob_memset_2+0xdc/0x1e4 [ 145.354487] kmalloc_oob_memset_2 from kunit_try_run_case+0x11c/0x2e4 [ 145.355388] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.356521] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 145.357630] kthread from ret_from_fork+0x14/0x30 [ 145.358396] Exception stack(0xf9f83fb0 to 0xf9f83ff8) [ 145.359162] 3fa0: 00000000 00000000 00000000 00000000 [ 145.360076] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 145.361048] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 145.361755] [ 145.362032] Allocated by task 145: [ 145.362420] kasan_set_track+0x3c/0x5c [ 145.363103] __kasan_kmalloc+0x8c/0x94 [ 145.363618] kmalloc_oob_memset_2+0xa0/0x1e4 [ 145.364144] kunit_try_run_case+0x11c/0x2e4 [ 145.364887] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.365529] kthread+0x184/0x1a8 [ 145.366377] ret_from_fork+0x14/0x30 [ 145.366929] [ 145.367309] The buggy address belongs to the object at c4fd0100 [ 145.367309] which belongs to the cache kmalloc-128 of size 128 [ 145.368728] The buggy address is located 119 bytes inside of [ 145.368728] allocated 120-byte region [c4fd0100, c4fd0178) [ 145.369949] [ 145.370492] The buggy address belongs to the physical page: [ 145.371097] page:c1b69563 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x44fd0 [ 145.371798] flags: 0x800(slab|zone=0) [ 145.372407] page_type: 0xffffffff() [ 145.372890] raw: 00000800 c4801300 00000122 00000000 00000000 80100010 ffffffff 00000001 [ 145.373760] raw: 00000000 [ 145.374206] page dumped because: kasan: bad access detected [ 145.374786] [ 145.375027] Memory state around the buggy address: [ 145.375657] c4fd0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 145.376634] c4fd0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.377282] >c4fd0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 145.378034] ^ [ 145.378715] c4fd0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.379655] c4fd0200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.380327] ==================================================================
[ 48.117359] ================================================================== [ 48.118410] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0xdd/0x1e0 [ 48.119276] Write of size 2 at addr ffff888102844a77 by task kunit_try_catch/168 [ 48.120147] [ 48.120449] CPU: 0 PID: 168 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 48.121297] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 48.122205] Call Trace: [ 48.122646] <TASK> [ 48.123115] dump_stack_lvl+0x4e/0x90 [ 48.123658] print_report+0xd2/0x660 [ 48.124300] ? __virt_addr_valid+0x156/0x1e0 [ 48.125142] ? kasan_complete_mode_report_info+0x2a/0x200 [ 48.126878] kasan_report+0xff/0x140 [ 48.127396] ? kmalloc_oob_memset_2+0xdd/0x1e0 [ 48.127963] ? kmalloc_oob_memset_2+0xdd/0x1e0 [ 48.128634] kasan_check_range+0x10c/0x1c0 [ 48.129162] __asan_memset+0x27/0x50 [ 48.129729] kmalloc_oob_memset_2+0xdd/0x1e0 [ 48.130304] ? __pfx_kmalloc_oob_memset_2+0x10/0x10 [ 48.130933] ? __schedule+0x70b/0x1190 [ 48.131517] ? ktime_get_ts64+0x118/0x140 [ 48.132088] kunit_try_run_case+0x126/0x290 [ 48.132613] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.133381] ? __kasan_check_write+0x18/0x20 [ 48.134052] ? trace_preempt_on+0x20/0xa0 [ 48.134630] ? __kthread_parkme+0x4f/0xd0 [ 48.135257] ? preempt_count_sub+0x50/0x80 [ 48.135948] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.136526] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 48.137255] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.138109] kthread+0x19e/0x1e0 [ 48.138602] ? __pfx_kthread+0x10/0x10 [ 48.139296] ret_from_fork+0x41/0x70 [ 48.139880] ? __pfx_kthread+0x10/0x10 [ 48.140423] ret_from_fork_asm+0x1b/0x30 [ 48.141138] </TASK> [ 48.141409] [ 48.141622] Allocated by task 168: [ 48.142153] kasan_save_stack+0x3c/0x60 [ 48.142665] kasan_set_track+0x29/0x40 [ 48.143267] kasan_save_alloc_info+0x22/0x30 [ 48.143847] __kasan_kmalloc+0xb7/0xc0 [ 48.144287] kmalloc_trace+0x4c/0xb0 [ 48.144904] kmalloc_oob_memset_2+0x9f/0x1e0 [ 48.145478] kunit_try_run_case+0x126/0x290 [ 48.146141] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.146667] kthread+0x19e/0x1e0 [ 48.147278] ret_from_fork+0x41/0x70 [ 48.147923] ret_from_fork_asm+0x1b/0x30 [ 48.148556] [ 48.148818] The buggy address belongs to the object at ffff888102844a00 [ 48.148818] which belongs to the cache kmalloc-128 of size 128 [ 48.150062] The buggy address is located 119 bytes inside of [ 48.150062] allocated 120-byte region [ffff888102844a00, ffff888102844a78) [ 48.151005] [ 48.151307] The buggy address belongs to the physical page: [ 48.152008] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102844 [ 48.152993] flags: 0x200000000000800(slab|node=0|zone=2) [ 48.153620] page_type: 0xffffffff() [ 48.154187] raw: 0200000000000800 ffff8881000418c0 dead000000000122 0000000000000000 [ 48.155082] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 48.156056] page dumped because: kasan: bad access detected [ 48.156673] [ 48.157579] Memory state around the buggy address: [ 48.158542] ffff888102844900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 48.159303] ffff888102844980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.160636] >ffff888102844a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 48.161458] ^ [ 48.162479] ffff888102844a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.164204] ffff888102844b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.164926] ==================================================================