Date
Feb. 5, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-armv7 | |
| qemu-x86_64 |
[ 147.072556] ================================================================== [ 147.073669] BUG: KASAN: slab-out-of-bounds in memcmp+0x30/0xa0 [ 147.074402] Read of size 1 at addr c8fba198 by task kunit_try_catch/197 [ 147.075236] [ 147.075514] CPU: 1 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 147.076506] Hardware name: Generic DT based system [ 147.076991] unwind_backtrace from show_stack+0x18/0x1c [ 147.078170] show_stack from dump_stack_lvl+0x58/0x70 [ 147.078812] dump_stack_lvl from print_report+0x164/0x51c [ 147.079555] print_report from kasan_report+0xc8/0x104 [ 147.080250] kasan_report from memcmp+0x30/0xa0 [ 147.080961] memcmp from kasan_memcmp+0x100/0x210 [ 147.081633] kasan_memcmp from kunit_try_run_case+0x11c/0x2e4 [ 147.082526] kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 147.083438] kunit_generic_run_threadfn_adapter from kthread+0x184/0x1a8 [ 147.084380] kthread from ret_from_fork+0x14/0x30 [ 147.084985] Exception stack(0xfa0ebfb0 to 0xfa0ebff8) [ 147.085805] bfa0: 00000000 00000000 00000000 00000000 [ 147.086829] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 147.087788] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 147.088679] [ 147.088976] Allocated by task 197: [ 147.089439] kasan_set_track+0x3c/0x5c [ 147.089970] __kasan_kmalloc+0x8c/0x94 [ 147.090581] kasan_memcmp+0xb4/0x210 [ 147.091085] kunit_try_run_case+0x11c/0x2e4 [ 147.091743] kunit_generic_run_threadfn_adapter+0x2c/0x48 [ 147.092303] kthread+0x184/0x1a8 [ 147.092857] ret_from_fork+0x14/0x30 [ 147.093288] [ 147.093587] The buggy address belongs to the object at c8fba180 [ 147.093587] which belongs to the cache kmalloc-64 of size 64 [ 147.094851] The buggy address is located 0 bytes to the right of [ 147.094851] allocated 24-byte region [c8fba180, c8fba198) [ 147.096338] [ 147.096565] The buggy address belongs to the physical page: [ 147.097350] page:3fba6f39 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x48fba [ 147.098129] flags: 0x800(slab|zone=0) [ 147.098679] page_type: 0xffffffff() [ 147.099147] raw: 00000800 c4801200 00000122 00000000 00000000 80200020 ffffffff 00000001 [ 147.100008] raw: 00000000 [ 147.100525] page dumped because: kasan: bad access detected [ 147.101216] [ 147.101441] Memory state around the buggy address: [ 147.102087] c8fba080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 147.102838] c8fba100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 147.103548] >c8fba180: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 147.104363] ^ [ 147.104929] c8fba200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 147.105800] c8fba280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 147.106656] ==================================================================
[ 50.165756] ================================================================== [ 50.166700] BUG: KASAN: slab-out-of-bounds in memcmp+0x3d/0xb0 [ 50.167484] Read of size 1 at addr ffff8881028ced58 by task kunit_try_catch/220 [ 50.168912] [ 50.169321] CPU: 1 PID: 220 Comm: kunit_try_catch Tainted: G B N 6.6.76-rc1 #1 [ 50.170331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 50.171369] Call Trace: [ 50.171635] <TASK> [ 50.172050] dump_stack_lvl+0x4e/0x90 [ 50.172643] print_report+0xd2/0x660 [ 50.173336] ? __virt_addr_valid+0x156/0x1e0 [ 50.173919] ? kasan_complete_mode_report_info+0x2a/0x200 [ 50.174656] kasan_report+0xff/0x140 [ 50.175169] ? memcmp+0x3d/0xb0 [ 50.175871] ? memcmp+0x3d/0xb0 [ 50.176540] __asan_load1+0x66/0x70 [ 50.177524] memcmp+0x3d/0xb0 [ 50.178103] kasan_memcmp+0x100/0x230 [ 50.178794] ? __pfx_kasan_memcmp+0x10/0x10 [ 50.179607] ? finish_task_switch.isra.0+0xc8/0x3e0 [ 50.180441] ? ktime_get_ts64+0x118/0x140 [ 50.181160] kunit_try_run_case+0x126/0x290 [ 50.181758] ? __pfx_kunit_try_run_case+0x10/0x10 [ 50.182853] ? __kasan_check_write+0x18/0x20 [ 50.183430] ? trace_preempt_on+0x20/0xa0 [ 50.184174] ? __kthread_parkme+0x4f/0xd0 [ 50.184816] ? preempt_count_sub+0x50/0x80 [ 50.185310] ? __pfx_kunit_try_run_case+0x10/0x10 [ 50.185842] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 50.186685] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 50.187333] kthread+0x19e/0x1e0 [ 50.187836] ? __pfx_kthread+0x10/0x10 [ 50.188495] ret_from_fork+0x41/0x70 [ 50.189178] ? __pfx_kthread+0x10/0x10 [ 50.189968] ret_from_fork_asm+0x1b/0x30 [ 50.190555] </TASK> [ 50.190947] [ 50.191673] Allocated by task 220: [ 50.192474] kasan_save_stack+0x3c/0x60 [ 50.193234] kasan_set_track+0x29/0x40 [ 50.193715] kasan_save_alloc_info+0x22/0x30 [ 50.194530] __kasan_kmalloc+0xb7/0xc0 [ 50.194931] kmalloc_trace+0x4c/0xb0 [ 50.195494] kasan_memcmp+0xb0/0x230 [ 50.196121] kunit_try_run_case+0x126/0x290 [ 50.196879] kunit_generic_run_threadfn_adapter+0x33/0x50 [ 50.197830] kthread+0x19e/0x1e0 [ 50.198483] ret_from_fork+0x41/0x70 [ 50.199309] ret_from_fork_asm+0x1b/0x30 [ 50.199851] [ 50.200090] The buggy address belongs to the object at ffff8881028ced40 [ 50.200090] which belongs to the cache kmalloc-32 of size 32 [ 50.201039] The buggy address is located 0 bytes to the right of [ 50.201039] allocated 24-byte region [ffff8881028ced40, ffff8881028ced58) [ 50.202111] [ 50.202448] The buggy address belongs to the physical page: [ 50.203438] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1028ce [ 50.204576] flags: 0x200000000000800(slab|node=0|zone=2) [ 50.205633] page_type: 0xffffffff() [ 50.206406] raw: 0200000000000800 ffff888100041500 dead000000000122 0000000000000000 [ 50.207440] raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000 [ 50.208137] page dumped because: kasan: bad access detected [ 50.209043] [ 50.209177] Memory state around the buggy address: [ 50.209413] ffff8881028cec00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 50.209722] ffff8881028cec80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 50.210862] >ffff8881028ced00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 50.212228] ^ [ 50.212935] ffff8881028ced80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.214334] ffff8881028cee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.215240] ==================================================================