Date
July 5, 2025, 5:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.382597] ================================================================== [ 18.382654] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x150/0x2f8 [ 18.382706] Write of size 16 at addr fff00000c5cbbe69 by task kunit_try_catch/178 [ 18.382762] [ 18.382796] CPU: 1 UID: 0 PID: 178 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.382917] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.382943] Hardware name: linux,dummy-virt (DT) [ 18.382972] Call trace: [ 18.382994] show_stack+0x20/0x38 (C) [ 18.383041] dump_stack_lvl+0x8c/0xd0 [ 18.383086] print_report+0x118/0x608 [ 18.383210] kasan_report+0xdc/0x128 [ 18.383339] kasan_check_range+0x100/0x1a8 [ 18.383406] __asan_memset+0x34/0x78 [ 18.383511] kmalloc_oob_memset_16+0x150/0x2f8 [ 18.383556] kunit_try_run_case+0x170/0x3f0 [ 18.383603] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.383814] kthread+0x328/0x630 [ 18.383884] ret_from_fork+0x10/0x20 [ 18.383934] [ 18.383951] Allocated by task 178: [ 18.383979] kasan_save_stack+0x3c/0x68 [ 18.384020] kasan_save_track+0x20/0x40 [ 18.384056] kasan_save_alloc_info+0x40/0x58 [ 18.384122] __kasan_kmalloc+0xd4/0xd8 [ 18.384197] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.384247] kmalloc_oob_memset_16+0xb0/0x2f8 [ 18.384353] kunit_try_run_case+0x170/0x3f0 [ 18.384396] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.384568] kthread+0x328/0x630 [ 18.384600] ret_from_fork+0x10/0x20 [ 18.384678] [ 18.384698] The buggy address belongs to the object at fff00000c5cbbe00 [ 18.384698] which belongs to the cache kmalloc-128 of size 128 [ 18.384778] The buggy address is located 105 bytes inside of [ 18.384778] allocated 120-byte region [fff00000c5cbbe00, fff00000c5cbbe78) [ 18.385269] [ 18.385295] The buggy address belongs to the physical page: [ 18.385324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105cbb [ 18.385402] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.385447] page_type: f5(slab) [ 18.385483] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 18.385552] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.385591] page dumped because: kasan: bad access detected [ 18.385620] [ 18.385638] Memory state around the buggy address: [ 18.385668] fff00000c5cbbd00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.385819] fff00000c5cbbd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.385961] >fff00000c5cbbe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.386009] ^ [ 18.386046] fff00000c5cbbe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.386086] fff00000c5cbbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.386122] ==================================================================
[ 11.747202] ================================================================== [ 11.747755] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x166/0x330 [ 11.748008] Write of size 16 at addr ffff8881031d4769 by task kunit_try_catch/196 [ 11.748246] [ 11.748337] CPU: 1 UID: 0 PID: 196 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.748380] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.748392] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.748414] Call Trace: [ 11.748428] <TASK> [ 11.748444] dump_stack_lvl+0x73/0xb0 [ 11.749082] print_report+0xd1/0x650 [ 11.749121] ? __virt_addr_valid+0x1db/0x2d0 [ 11.749145] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.749168] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.749615] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.749644] kasan_report+0x141/0x180 [ 11.749736] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.749766] kasan_check_range+0x10c/0x1c0 [ 11.749790] __asan_memset+0x27/0x50 [ 11.749809] kmalloc_oob_memset_16+0x166/0x330 [ 11.749831] ? __pfx_kmalloc_oob_memset_16+0x10/0x10 [ 11.749853] ? __schedule+0x10cc/0x2b60 [ 11.749875] ? __pfx_read_tsc+0x10/0x10 [ 11.749896] ? ktime_get_ts64+0x86/0x230 [ 11.749919] kunit_try_run_case+0x1a5/0x480 [ 11.749943] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.749964] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.749988] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.750010] ? __kthread_parkme+0x82/0x180 [ 11.750030] ? preempt_count_sub+0x50/0x80 [ 11.750052] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.750074] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.750096] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.750118] kthread+0x337/0x6f0 [ 11.750136] ? trace_preempt_on+0x20/0xc0 [ 11.750159] ? __pfx_kthread+0x10/0x10 [ 11.750201] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.750223] ? calculate_sigpending+0x7b/0xa0 [ 11.750247] ? __pfx_kthread+0x10/0x10 [ 11.750267] ret_from_fork+0x116/0x1d0 [ 11.750284] ? __pfx_kthread+0x10/0x10 [ 11.750304] ret_from_fork_asm+0x1a/0x30 [ 11.750333] </TASK> [ 11.750344] [ 11.766671] Allocated by task 196: [ 11.767482] kasan_save_stack+0x45/0x70 [ 11.768027] kasan_save_track+0x18/0x40 [ 11.768474] kasan_save_alloc_info+0x3b/0x50 [ 11.768926] __kasan_kmalloc+0xb7/0xc0 [ 11.769415] __kmalloc_cache_noprof+0x189/0x420 [ 11.769906] kmalloc_oob_memset_16+0xac/0x330 [ 11.770108] kunit_try_run_case+0x1a5/0x480 [ 11.770566] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.771118] kthread+0x337/0x6f0 [ 11.771239] ret_from_fork+0x116/0x1d0 [ 11.771367] ret_from_fork_asm+0x1a/0x30 [ 11.771582] [ 11.771775] The buggy address belongs to the object at ffff8881031d4700 [ 11.771775] which belongs to the cache kmalloc-128 of size 128 [ 11.772972] The buggy address is located 105 bytes inside of [ 11.772972] allocated 120-byte region [ffff8881031d4700, ffff8881031d4778) [ 11.775032] [ 11.775273] The buggy address belongs to the physical page: [ 11.775677] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1031d4 [ 11.776142] flags: 0x200000000000000(node=0|zone=2) [ 11.776599] page_type: f5(slab) [ 11.776939] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 11.777559] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.778022] page dumped because: kasan: bad access detected [ 11.778481] [ 11.778672] Memory state around the buggy address: [ 11.779054] ffff8881031d4600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.779610] ffff8881031d4680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.780429] >ffff8881031d4700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 11.780891] ^ [ 11.781388] ffff8881031d4780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.781804] ffff8881031d4800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.782014] ==================================================================