Hay
Date
June 17, 2025, 3:39 p.m.

Environment
qemu-arm64
qemu-x86_64

[   92.929823] ==================================================================
[   92.930575] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0xe0/0x1f0
[   92.931969] Read of size 18446744073709551614 at addr ffff0000c5f06504 by task kunit_try_catch/159
[   92.932844] 
[   92.933185] CPU: 1 PID: 159 Comm: kunit_try_catch Tainted: G    B            N 6.6.94-rc1 #1
[   92.934039] Hardware name: linux,dummy-virt (DT)
[   92.934524] Call trace:
[   92.934887]  dump_backtrace+0x9c/0x128
[   92.935246]  show_stack+0x20/0x38
[   92.935564]  dump_stack_lvl+0x60/0xb0
[   92.935965]  print_report+0xf8/0x5e8
[   92.936394]  kasan_report+0xdc/0x128
[   92.937100]  kasan_check_range+0xe8/0x190
[   92.937718]  __asan_memmove+0x3c/0x98
[   92.938225]  kmalloc_memmove_negative_size+0xe0/0x1f0
[   92.938984]  kunit_try_run_case+0x114/0x298
[   92.939610]  kunit_generic_run_threadfn_adapter+0x38/0x60
[   92.940235]  kthread+0x18c/0x1a8
[   92.940678]  ret_from_fork+0x10/0x20
[   92.941141] 
[   92.941349] Allocated by task 159:
[   92.941723]  kasan_save_stack+0x3c/0x68
[   92.942246]  kasan_set_track+0x2c/0x40
[   92.942696]  kasan_save_alloc_info+0x24/0x38
[   92.943453]  __kasan_kmalloc+0xd4/0xd8
[   92.943999]  kmalloc_trace+0x68/0x130
[   92.944360]  kmalloc_memmove_negative_size+0xa0/0x1f0
[   92.944968]  kunit_try_run_case+0x114/0x298
[   92.945515]  kunit_generic_run_threadfn_adapter+0x38/0x60
[   92.946136]  kthread+0x18c/0x1a8
[   92.946543]  ret_from_fork+0x10/0x20
[   92.946936] 
[   92.947310] The buggy address belongs to the object at ffff0000c5f06500
[   92.947310]  which belongs to the cache kmalloc-64 of size 64
[   92.948337] The buggy address is located 4 bytes inside of
[   92.948337]  64-byte region [ffff0000c5f06500, ffff0000c5f06540)
[   92.949472] 
[   92.949747] The buggy address belongs to the physical page:
[   92.950307] page:0000000083b08542 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f06
[   92.951314] flags: 0xbfffc0000000800(slab|node=0|zone=2|lastcpupid=0xffff)
[   92.951794] page_type: 0xffffffff()
[   92.952341] raw: 0bfffc0000000800 ffff0000c0001640 dead000000000122 0000000000000000
[   92.953137] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[   92.953836] page dumped because: kasan: bad access detected
[   92.954329] 
[   92.954521] Memory state around the buggy address:
[   92.955278]  ffff0000c5f06400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   92.955986]  ffff0000c5f06480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   92.956664] >ffff0000c5f06500: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   92.957346]                    ^
[   92.957689]  ffff0000c5f06580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   92.958329]  ffff0000c5f06600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   92.959082] ==================================================================


[   34.092532] ==================================================================
[   34.093778] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0xeb/0x1f0
[   34.094755] Read of size 18446744073709551614 at addr ffff888102864084 by task kunit_try_catch/174
[   34.096017] 
[   34.096161] CPU: 0 PID: 174 Comm: kunit_try_catch Tainted: G    B            N 6.6.94-rc1 #1
[   34.097074] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   34.098141] Call Trace:
[   34.098449]  <TASK>
[   34.098877]  dump_stack_lvl+0x4e/0x90
[   34.099330]  print_report+0xd2/0x650
[   34.099871]  ? __virt_addr_valid+0x156/0x1e0
[   34.100353]  ? kmalloc_memmove_negative_size+0xeb/0x1f0
[   34.100721]  ? kasan_complete_mode_report_info+0x2a/0x200
[   34.101031]  ? kmalloc_memmove_negative_size+0xeb/0x1f0
[   34.101308]  kasan_report+0x147/0x180
[   34.101824]  ? kmalloc_memmove_negative_size+0xeb/0x1f0
[   34.102456]  kasan_check_range+0x10c/0x1c0
[   34.103477]  __asan_memmove+0x27/0x70
[   34.103968]  kmalloc_memmove_negative_size+0xeb/0x1f0
[   34.104604]  ? __pfx_kmalloc_memmove_negative_size+0x10/0x10
[   34.105261]  ? __schedule+0x715/0x11a0
[   34.105776]  ? ktime_get_ts64+0x118/0x140
[   34.106332]  kunit_try_run_case+0x120/0x290
[   34.106929]  ? __pfx_kunit_try_run_case+0x10/0x10
[   34.107557]  ? __kasan_check_write+0x18/0x20
[   34.108590]  ? trace_preempt_on+0x20/0xa0
[   34.108876]  ? __kthread_parkme+0x4f/0xd0
[   34.109105]  ? preempt_count_sub+0x50/0x80
[   34.109333]  ? __pfx_kunit_try_run_case+0x10/0x10
[   34.110225]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   34.111290]  kunit_generic_run_threadfn_adapter+0x33/0x50
[   34.112089]  kthread+0x19e/0x1e0
[   34.112748]  ? __pfx_kthread+0x10/0x10
[   34.113395]  ret_from_fork+0x41/0x70
[   34.113964]  ? __pfx_kthread+0x10/0x10
[   34.114647]  ret_from_fork_asm+0x1b/0x30
[   34.115245]  </TASK>
[   34.115541] 
[   34.115906] Allocated by task 174:
[   34.116470]  kasan_save_stack+0x44/0x70
[   34.117078]  kasan_set_track+0x29/0x40
[   34.117295]  kasan_save_alloc_info+0x22/0x30
[   34.118185]  __kasan_kmalloc+0xb7/0xc0
[   34.118822]  kmalloc_trace+0x4c/0xb0
[   34.119309]  kmalloc_memmove_negative_size+0x9f/0x1f0
[   34.119986]  kunit_try_run_case+0x120/0x290
[   34.120227]  kunit_generic_run_threadfn_adapter+0x33/0x50
[   34.120647]  kthread+0x19e/0x1e0
[   34.121087]  ret_from_fork+0x41/0x70
[   34.121480]  ret_from_fork_asm+0x1b/0x30
[   34.121996] 
[   34.122213] The buggy address belongs to the object at ffff888102864080
[   34.122213]  which belongs to the cache kmalloc-64 of size 64
[   34.123598] The buggy address is located 4 bytes inside of
[   34.123598]  64-byte region [ffff888102864080, ffff8881028640c0)
[   34.124164] 
[   34.124273] The buggy address belongs to the physical page:
[   34.124536] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102864
[   34.125114] flags: 0x200000000000800(slab|node=0|zone=2)
[   34.125833] page_type: 0xffffffff()
[   34.126213] raw: 0200000000000800 ffff888100041640 dead000000000122 0000000000000000
[   34.126759] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[   34.127311] page dumped because: kasan: bad access detected
[   34.127762] 
[   34.128004] Memory state around the buggy address:
[   34.128386]  ffff888102863f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.128716]  ffff888102864000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   34.129577] >ffff888102864080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   34.130342]                    ^
[   34.130753]  ffff888102864100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.131617]  ffff888102864180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.132216] ==================================================================