Date
July 9, 2025, 12:11 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.735624] ================================================================== [ 19.735868] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0 [ 19.735952] Read of size 18446744073709551614 at addr fff00000c76c5f84 by task kunit_try_catch/181 [ 19.736152] [ 19.736187] CPU: 1 UID: 0 PID: 181 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.736605] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.736665] Hardware name: linux,dummy-virt (DT) [ 19.736733] Call trace: [ 19.736826] show_stack+0x20/0x38 (C) [ 19.736930] dump_stack_lvl+0x8c/0xd0 [ 19.737007] print_report+0x118/0x608 [ 19.737147] kasan_report+0xdc/0x128 [ 19.737208] kasan_check_range+0x100/0x1a8 [ 19.737578] __asan_memmove+0x3c/0x98 [ 19.737788] kmalloc_memmove_negative_size+0x154/0x2e0 [ 19.738027] kunit_try_run_case+0x170/0x3f0 [ 19.738102] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.738202] kthread+0x328/0x630 [ 19.738325] ret_from_fork+0x10/0x20 [ 19.738463] [ 19.738512] Allocated by task 181: [ 19.738564] kasan_save_stack+0x3c/0x68 [ 19.738871] kasan_save_track+0x20/0x40 [ 19.738956] kasan_save_alloc_info+0x40/0x58 [ 19.739066] __kasan_kmalloc+0xd4/0xd8 [ 19.739155] __kmalloc_cache_noprof+0x16c/0x3c0 [ 19.739283] kmalloc_memmove_negative_size+0xb0/0x2e0 [ 19.739362] kunit_try_run_case+0x170/0x3f0 [ 19.739486] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.739639] kthread+0x328/0x630 [ 19.739827] ret_from_fork+0x10/0x20 [ 19.739991] [ 19.740043] The buggy address belongs to the object at fff00000c76c5f80 [ 19.740043] which belongs to the cache kmalloc-64 of size 64 [ 19.740111] The buggy address is located 4 bytes inside of [ 19.740111] 64-byte region [fff00000c76c5f80, fff00000c76c5fc0) [ 19.740260] [ 19.740309] The buggy address belongs to the physical page: [ 19.740366] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c5 [ 19.740527] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.740578] page_type: f5(slab) [ 19.740616] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000 [ 19.740672] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 19.740844] page dumped because: kasan: bad access detected [ 19.741043] [ 19.741102] Memory state around the buggy address: [ 19.741250] fff00000c76c5e80: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 19.742152] fff00000c76c5f00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 19.742303] >fff00000c76c5f80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 19.742391] ^ [ 19.742461] fff00000c76c6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.742570] fff00000c76c6080: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.742641] ==================================================================
[ 12.808360] ================================================================== [ 12.808941] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x171/0x330 [ 12.809574] Read of size 18446744073709551614 at addr ffff8881026a6d84 by task kunit_try_catch/197 [ 12.810161] [ 12.810288] CPU: 0 UID: 0 PID: 197 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.810334] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.810346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.810367] Call Trace: [ 12.810380] <TASK> [ 12.810400] dump_stack_lvl+0x73/0xb0 [ 12.810434] print_report+0xd1/0x650 [ 12.810458] ? __virt_addr_valid+0x1db/0x2d0 [ 12.810481] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.810508] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.810531] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.810578] kasan_report+0x141/0x180 [ 12.810600] ? kmalloc_memmove_negative_size+0x171/0x330 [ 12.810630] kasan_check_range+0x10c/0x1c0 [ 12.810653] __asan_memmove+0x27/0x70 [ 12.810673] kmalloc_memmove_negative_size+0x171/0x330 [ 12.810696] ? __kasan_check_write+0x18/0x20 [ 12.810723] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10 [ 12.810749] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 12.810776] ? trace_hardirqs_on+0x37/0xe0 [ 12.810800] ? __pfx_read_tsc+0x10/0x10 [ 12.810821] ? ktime_get_ts64+0x86/0x230 [ 12.810846] kunit_try_run_case+0x1a5/0x480 [ 12.810872] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.810896] ? queued_spin_lock_slowpath+0x116/0xb40 [ 12.810922] ? __kthread_parkme+0x82/0x180 [ 12.811092] ? preempt_count_sub+0x50/0x80 [ 12.811120] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.811145] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.811170] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.811195] kthread+0x337/0x6f0 [ 12.811214] ? trace_preempt_on+0x20/0xc0 [ 12.811236] ? __pfx_kthread+0x10/0x10 [ 12.811466] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.811492] ? calculate_sigpending+0x7b/0xa0 [ 12.811516] ? __pfx_kthread+0x10/0x10 [ 12.811537] ret_from_fork+0x116/0x1d0 [ 12.811555] ? __pfx_kthread+0x10/0x10 [ 12.811575] ret_from_fork_asm+0x1a/0x30 [ 12.811606] </TASK> [ 12.811617] [ 12.824872] Allocated by task 197: [ 12.825332] kasan_save_stack+0x45/0x70 [ 12.825796] kasan_save_track+0x18/0x40 [ 12.826226] kasan_save_alloc_info+0x3b/0x50 [ 12.826850] __kasan_kmalloc+0xb7/0xc0 [ 12.827332] __kmalloc_cache_noprof+0x189/0x420 [ 12.827561] kmalloc_memmove_negative_size+0xac/0x330 [ 12.827782] kunit_try_run_case+0x1a5/0x480 [ 12.828223] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.829000] kthread+0x337/0x6f0 [ 12.829427] ret_from_fork+0x116/0x1d0 [ 12.829753] ret_from_fork_asm+0x1a/0x30 [ 12.830212] [ 12.830333] The buggy address belongs to the object at ffff8881026a6d80 [ 12.830333] which belongs to the cache kmalloc-64 of size 64 [ 12.830824] The buggy address is located 4 bytes inside of [ 12.830824] 64-byte region [ffff8881026a6d80, ffff8881026a6dc0) [ 12.831588] [ 12.831688] The buggy address belongs to the physical page: [ 12.831919] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1026a6 [ 12.832248] flags: 0x200000000000000(node=0|zone=2) [ 12.833263] page_type: f5(slab) [ 12.833631] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 12.834504] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 12.834822] page dumped because: kasan: bad access detected [ 12.835493] [ 12.835818] Memory state around the buggy address: [ 12.836485] ffff8881026a6c80: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc [ 12.836888] ffff8881026a6d00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 12.837759] >ffff8881026a6d80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 12.838425] ^ [ 12.838803] ffff8881026a6e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.839403] ffff8881026a6e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.839698] ==================================================================