Date
July 1, 2025, 3:08 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.719378] ================================================================== [ 16.720461] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.720650] Write of size 1 at addr fff00000c7ad9f00 by task kunit_try_catch/145 [ 16.720701] [ 16.720739] CPU: 1 UID: 0 PID: 145 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 16.720894] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.721248] Hardware name: linux,dummy-virt (DT) [ 16.721924] Call trace: [ 16.721953] show_stack+0x20/0x38 (C) [ 16.722007] dump_stack_lvl+0x8c/0xd0 [ 16.722156] print_report+0x118/0x608 [ 16.722257] kasan_report+0xdc/0x128 [ 16.722401] __asan_report_store1_noabort+0x20/0x30 [ 16.722630] kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.722875] kunit_try_run_case+0x170/0x3f0 [ 16.722989] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.723536] kthread+0x328/0x630 [ 16.723806] ret_from_fork+0x10/0x20 [ 16.724036] [ 16.724057] Allocated by task 145: [ 16.724626] kasan_save_stack+0x3c/0x68 [ 16.724680] kasan_save_track+0x20/0x40 [ 16.724718] kasan_save_alloc_info+0x40/0x58 [ 16.724756] __kasan_kmalloc+0xd4/0xd8 [ 16.724888] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.725045] kmalloc_big_oob_right+0xb8/0x2f0 [ 16.725082] kunit_try_run_case+0x170/0x3f0 [ 16.725664] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.725716] kthread+0x328/0x630 [ 16.725750] ret_from_fork+0x10/0x20 [ 16.725948] [ 16.725971] The buggy address belongs to the object at fff00000c7ad8000 [ 16.725971] which belongs to the cache kmalloc-8k of size 8192 [ 16.726071] The buggy address is located 0 bytes to the right of [ 16.726071] allocated 7936-byte region [fff00000c7ad8000, fff00000c7ad9f00) [ 16.726522] [ 16.726620] The buggy address belongs to the physical page: [ 16.726704] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107ad8 [ 16.727086] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.727177] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.727663] page_type: f5(slab) [ 16.727719] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.727777] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.727826] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.727874] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.727925] head: 0bfffe0000000003 ffffc1ffc31eb601 00000000ffffffff 00000000ffffffff [ 16.727975] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 16.728734] page dumped because: kasan: bad access detected [ 16.729033] [ 16.729071] Memory state around the buggy address: [ 16.729207] fff00000c7ad9e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.729252] fff00000c7ad9e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.729298] >fff00000c7ad9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.729752] ^ [ 16.729784] fff00000c7ad9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.729834] fff00000c7ada000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.729917] ==================================================================
[ 10.986603] ================================================================== [ 10.987134] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 10.987488] Write of size 1 at addr ffff8881038a1f00 by task kunit_try_catch/161 [ 10.987773] [ 10.987927] CPU: 0 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 10.987976] Tainted: [B]=BAD_PAGE, [N]=TEST [ 10.987988] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 10.988011] Call Trace: [ 10.988036] <TASK> [ 10.988058] dump_stack_lvl+0x73/0xb0 [ 10.988091] print_report+0xd1/0x650 [ 10.988114] ? __virt_addr_valid+0x1db/0x2d0 [ 10.988139] ? kmalloc_big_oob_right+0x316/0x370 [ 10.988167] ? kasan_complete_mode_report_info+0x2a/0x200 [ 10.988188] ? kmalloc_big_oob_right+0x316/0x370 [ 10.988209] kasan_report+0x141/0x180 [ 10.988231] ? kmalloc_big_oob_right+0x316/0x370 [ 10.988258] __asan_report_store1_noabort+0x1b/0x30 [ 10.988279] kmalloc_big_oob_right+0x316/0x370 [ 10.988301] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 10.988323] ? __schedule+0x10cc/0x2b60 [ 10.988345] ? __pfx_read_tsc+0x10/0x10 [ 10.988366] ? ktime_get_ts64+0x86/0x230 [ 10.988392] kunit_try_run_case+0x1a5/0x480 [ 10.988418] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.988438] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 10.988475] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 10.988497] ? __kthread_parkme+0x82/0x180 [ 10.988518] ? preempt_count_sub+0x50/0x80 [ 10.988554] ? __pfx_kunit_try_run_case+0x10/0x10 [ 10.988577] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 10.988598] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 10.988620] kthread+0x337/0x6f0 [ 10.988638] ? trace_preempt_on+0x20/0xc0 [ 10.988661] ? __pfx_kthread+0x10/0x10 [ 10.988681] ? _raw_spin_unlock_irq+0x47/0x80 [ 10.988700] ? calculate_sigpending+0x7b/0xa0 [ 10.988724] ? __pfx_kthread+0x10/0x10 [ 10.988745] ret_from_fork+0x116/0x1d0 [ 10.988762] ? __pfx_kthread+0x10/0x10 [ 10.988781] ret_from_fork_asm+0x1a/0x30 [ 10.988812] </TASK> [ 10.988824] [ 10.997618] Allocated by task 161: [ 10.998242] kasan_save_stack+0x45/0x70 [ 10.998565] kasan_save_track+0x18/0x40 [ 10.999048] kasan_save_alloc_info+0x3b/0x50 [ 10.999371] __kasan_kmalloc+0xb7/0xc0 [ 10.999565] __kmalloc_cache_noprof+0x189/0x420 [ 11.000193] kmalloc_big_oob_right+0xa9/0x370 [ 11.000410] kunit_try_run_case+0x1a5/0x480 [ 11.000605] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.001102] kthread+0x337/0x6f0 [ 11.001273] ret_from_fork+0x116/0x1d0 [ 11.001446] ret_from_fork_asm+0x1a/0x30 [ 11.001628] [ 11.002000] The buggy address belongs to the object at ffff8881038a0000 [ 11.002000] which belongs to the cache kmalloc-8k of size 8192 [ 11.002733] The buggy address is located 0 bytes to the right of [ 11.002733] allocated 7936-byte region [ffff8881038a0000, ffff8881038a1f00) [ 11.003262] [ 11.003354] The buggy address belongs to the physical page: [ 11.003589] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1038a0 [ 11.004257] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.004572] flags: 0x200000000000040(head|node=0|zone=2) [ 11.005365] page_type: f5(slab) [ 11.005559] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.006262] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.006965] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.007319] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.007869] head: 0200000000000003 ffffea00040e2801 00000000ffffffff 00000000ffffffff [ 11.008340] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 11.008877] page dumped because: kasan: bad access detected [ 11.009129] [ 11.009217] Memory state around the buggy address: [ 11.009428] ffff8881038a1e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.010095] ffff8881038a1e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.010563] >ffff8881038a1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.011168] ^ [ 11.011324] ffff8881038a1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.011615] ffff8881038a2000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.012295] ==================================================================