Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 145.432148] ================================================================== [ 145.433201] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0xdc/0x1e8 [ 145.434017] Write of size 8 at addr c4fd0371 by task kunit_try_catch/149 [ 145.435132] [ 145.435482] CPU: 0 PID: 149 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 145.436837] Hardware name: Generic DT based system [ 145.437398] unwind_backtrace from show_stack+0x18/0x1c [ 145.438167] show_stack from dump_stack_lvl+0x58/0x70 [ 145.438840] dump_stack_lvl from print_report+0x164/0x51c [ 145.439588] print_report from kasan_report+0xc8/0x104 [ 145.440371] kasan_report from kasan_check_range+0x14c/0x198 [ 145.441190] kasan_check_range from __asan_memset+0x20/0x3c [ 145.441920] __asan_memset from kmalloc_oob_memset_8+0xdc/0x1e8 [ 145.442676] kmalloc_oob_memset_8 from kunit_try_run_case+0x11c/0x2e4 [ 145.443653] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.444581] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 145.445431] kthread from ret_from_fork+0x14/0x30 [ 145.446140] Exception stack(0xf9fa3fb0 to 0xf9fa3ff8) [ 145.446724] 3fa0: 00000000 00000000 00000000 00000000 [ 145.447926] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 145.448824] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 145.449670] [ 145.449913] Allocated by task 149: [ 145.450384] kasan_set_track+0x3c/0x5c [ 145.450886] __kasan_kmalloc+0x8c/0x94 [ 145.451483] kmalloc_oob_memset_8+0xa0/0x1e8 [ 145.452145] kunit_try_run_case+0x11c/0x2e4 [ 145.452656] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 145.453469] kthread+0x184/0x1a8 [ 145.453918] ret_from_fork+0x14/0x30 [ 145.454362] [ 145.454700] The buggy address belongs to the object at c4fd0300 [ 145.454700] which belongs to the cache kmalloc-128 of size 128 [ 145.456164] The buggy address is located 113 bytes inside of [ 145.456164] allocated 120-byte region [c4fd0300, c4fd0378) [ 145.457298] [ 145.457571] The buggy address belongs to the physical page: [ 145.458269] page:c1b69563 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x44fd0 [ 145.459187] flags: 0x800(slab|zone=0) [ 145.459806] page_type: 0xffffffff() [ 145.460337] raw: 00000800 c4801300 00000122 00000000 00000000 80100010 ffffffff 00000001 [ 145.461278] raw: 00000000 [ 145.461599] page dumped because: kasan: bad access detected [ 145.462334] [ 145.462568] Memory state around the buggy address: [ 145.463211] c4fd0200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 145.463948] c4fd0280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.464628] >c4fd0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 145.466077] ^ [ 145.466755] c4fd0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.467484] c4fd0400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.468170] ==================================================================
[ 48.236661] ================================================================== [ 48.237623] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0xdd/0x1e0 [ 48.238366] Write of size 8 at addr ffff888102944071 by task kunit_try_catch/172 [ 48.239669] [ 48.240391] CPU: 1 PID: 172 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 48.241396] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 48.242225] Call Trace: [ 48.242650] <TASK> [ 48.243045] dump_stack_lvl+0x4e/0x90 [ 48.243655] print_report+0xd2/0x660 [ 48.244378] ? __virt_addr_valid+0x156/0x1e0 [ 48.245266] ? kasan_complete_mode_report_info+0x2a/0x200 [ 48.245932] kasan_report+0xff/0x140 [ 48.246707] ? kmalloc_oob_memset_8+0xdd/0x1e0 [ 48.247634] ? kmalloc_oob_memset_8+0xdd/0x1e0 [ 48.248563] kasan_check_range+0x10c/0x1c0 [ 48.249414] __asan_memset+0x27/0x50 [ 48.250060] kmalloc_oob_memset_8+0xdd/0x1e0 [ 48.250617] ? __pfx_kmalloc_oob_memset_8+0x10/0x10 [ 48.251504] ? __schedule+0x70b/0x1190 [ 48.252408] ? ktime_get_ts64+0x118/0x140 [ 48.253189] kunit_try_run_case+0x126/0x290 [ 48.254092] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.254608] ? __kasan_check_write+0x18/0x20 [ 48.255427] ? trace_preempt_on+0x20/0xa0 [ 48.256205] ? __kthread_parkme+0x4f/0xd0 [ 48.256470] ? preempt_count_sub+0x50/0x80 [ 48.256756] ? __pfx_kunit_try_run_case+0x10/0x10 [ 48.257789] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 48.258605] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.259362] kthread+0x19e/0x1e0 [ 48.259957] ? __pfx_kthread+0x10/0x10 [ 48.260541] ret_from_fork+0x41/0x70 [ 48.261334] ? __pfx_kthread+0x10/0x10 [ 48.261851] ret_from_fork_asm+0x1b/0x30 [ 48.262752] </TASK> [ 48.263159] [ 48.263653] Allocated by task 172: [ 48.264240] kasan_save_stack+0x3c/0x60 [ 48.264698] kasan_set_track+0x29/0x40 [ 48.265302] kasan_save_alloc_info+0x22/0x30 [ 48.265834] __kasan_kmalloc+0xb7/0xc0 [ 48.266654] kmalloc_trace+0x4c/0xb0 [ 48.267440] kmalloc_oob_memset_8+0x9f/0x1e0 [ 48.268263] kunit_try_run_case+0x126/0x290 [ 48.268956] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 48.270250] kthread+0x19e/0x1e0 [ 48.270929] ret_from_fork+0x41/0x70 [ 48.271678] ret_from_fork_asm+0x1b/0x30 [ 48.272423] [ 48.272932] The buggy address belongs to the object at ffff888102944000 [ 48.272932] which belongs to the cache kmalloc-128 of size 128 [ 48.274545] The buggy address is located 113 bytes inside of [ 48.274545] allocated 120-byte region [ffff888102944000, ffff888102944078) [ 48.275828] [ 48.276325] The buggy address belongs to the physical page: [ 48.277199] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102944 [ 48.278104] flags: 0x200000000000800(slab|node=0|zone=2) [ 48.278922] page_type: 0xffffffff() [ 48.279567] raw: 0200000000000800 ffff8881000418c0 dead000000000122 0000000000000000 [ 48.280725] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 48.281769] page dumped because: kasan: bad access detected [ 48.282429] [ 48.282730] Memory state around the buggy address: [ 48.283307] ffff888102943f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.284106] ffff888102943f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.284890] >ffff888102944000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 48.285525] ^ [ 48.286254] ffff888102944080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.287039] ffff888102944100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.287832] ==================================================================