Date
July 10, 2025, 6:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.903545] ================================================================== [ 16.903601] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300 [ 16.903652] Write of size 4 at addr fff00000c5a20175 by task kunit_try_catch/174 [ 16.903718] [ 16.903751] CPU: 1 UID: 0 PID: 174 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 16.903839] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.903875] Hardware name: linux,dummy-virt (DT) [ 16.903904] Call trace: [ 16.903935] show_stack+0x20/0x38 (C) [ 16.903988] dump_stack_lvl+0x8c/0xd0 [ 16.904044] print_report+0x118/0x608 [ 16.904090] kasan_report+0xdc/0x128 [ 16.904144] kasan_check_range+0x100/0x1a8 [ 16.904199] __asan_memset+0x34/0x78 [ 16.904241] kmalloc_oob_memset_4+0x150/0x300 [ 16.904287] kunit_try_run_case+0x170/0x3f0 [ 16.904334] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.904399] kthread+0x328/0x630 [ 16.904449] ret_from_fork+0x10/0x20 [ 16.904496] [ 16.904514] Allocated by task 174: [ 16.904548] kasan_save_stack+0x3c/0x68 [ 16.904603] kasan_save_track+0x20/0x40 [ 16.904640] kasan_save_alloc_info+0x40/0x58 [ 16.904679] __kasan_kmalloc+0xd4/0xd8 [ 16.904715] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.904754] kmalloc_oob_memset_4+0xb0/0x300 [ 16.904791] kunit_try_run_case+0x170/0x3f0 [ 16.904828] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.904871] kthread+0x328/0x630 [ 16.904902] ret_from_fork+0x10/0x20 [ 16.904936] [ 16.904955] The buggy address belongs to the object at fff00000c5a20100 [ 16.904955] which belongs to the cache kmalloc-128 of size 128 [ 16.905008] The buggy address is located 117 bytes inside of [ 16.905008] allocated 120-byte region [fff00000c5a20100, fff00000c5a20178) [ 16.905066] [ 16.905085] The buggy address belongs to the physical page: [ 16.905113] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105a20 [ 16.905162] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.905213] page_type: f5(slab) [ 16.905250] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 16.905297] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.905334] page dumped because: kasan: bad access detected [ 16.905619] [ 16.905645] Memory state around the buggy address: [ 16.905781] fff00000c5a20000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.906416] fff00000c5a20080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.906479] >fff00000c5a20100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.906517] ^ [ 16.906558] fff00000c5a20180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.906621] fff00000c5a20200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.907078] ==================================================================
[ 12.610299] ================================================================== [ 12.611364] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x166/0x330 [ 12.611679] Write of size 4 at addr ffff888102b0c575 by task kunit_try_catch/191 [ 12.612104] [ 12.612201] CPU: 0 UID: 0 PID: 191 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 12.612244] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.612255] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.612296] Call Trace: [ 12.612308] <TASK> [ 12.612337] dump_stack_lvl+0x73/0xb0 [ 12.612368] print_report+0xd1/0x650 [ 12.612390] ? __virt_addr_valid+0x1db/0x2d0 [ 12.612426] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.612462] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.612485] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.612508] kasan_report+0x141/0x180 [ 12.612531] ? kmalloc_oob_memset_4+0x166/0x330 [ 12.612559] kasan_check_range+0x10c/0x1c0 [ 12.612584] __asan_memset+0x27/0x50 [ 12.612605] kmalloc_oob_memset_4+0x166/0x330 [ 12.612629] ? __pfx_kmalloc_oob_memset_4+0x10/0x10 [ 12.612653] ? __schedule+0x10cc/0x2b60 [ 12.612676] ? __pfx_read_tsc+0x10/0x10 [ 12.612696] ? ktime_get_ts64+0x86/0x230 [ 12.612721] kunit_try_run_case+0x1a5/0x480 [ 12.612746] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.612769] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.612794] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.612874] ? __kthread_parkme+0x82/0x180 [ 12.612901] ? preempt_count_sub+0x50/0x80 [ 12.612928] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.612955] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.612981] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.613006] kthread+0x337/0x6f0 [ 12.613025] ? trace_preempt_on+0x20/0xc0 [ 12.613061] ? __pfx_kthread+0x10/0x10 [ 12.613081] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.613103] ? calculate_sigpending+0x7b/0xa0 [ 12.613127] ? __pfx_kthread+0x10/0x10 [ 12.613149] ret_from_fork+0x116/0x1d0 [ 12.613167] ? __pfx_kthread+0x10/0x10 [ 12.613188] ret_from_fork_asm+0x1a/0x30 [ 12.613220] </TASK> [ 12.613230] [ 12.621580] Allocated by task 191: [ 12.621778] kasan_save_stack+0x45/0x70 [ 12.622025] kasan_save_track+0x18/0x40 [ 12.622423] kasan_save_alloc_info+0x3b/0x50 [ 12.622634] __kasan_kmalloc+0xb7/0xc0 [ 12.622831] __kmalloc_cache_noprof+0x189/0x420 [ 12.623122] kmalloc_oob_memset_4+0xac/0x330 [ 12.623348] kunit_try_run_case+0x1a5/0x480 [ 12.623516] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.623692] kthread+0x337/0x6f0 [ 12.623971] ret_from_fork+0x116/0x1d0 [ 12.624179] ret_from_fork_asm+0x1a/0x30 [ 12.624374] [ 12.624470] The buggy address belongs to the object at ffff888102b0c500 [ 12.624470] which belongs to the cache kmalloc-128 of size 128 [ 12.625114] The buggy address is located 117 bytes inside of [ 12.625114] allocated 120-byte region [ffff888102b0c500, ffff888102b0c578) [ 12.625749] [ 12.625875] The buggy address belongs to the physical page: [ 12.626244] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b0c [ 12.626603] flags: 0x200000000000000(node=0|zone=2) [ 12.626832] page_type: f5(slab) [ 12.626973] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.627634] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.628173] page dumped because: kasan: bad access detected [ 12.628388] [ 12.628459] Memory state around the buggy address: [ 12.628684] ffff888102b0c400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.629038] ffff888102b0c480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.629420] >ffff888102b0c500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 12.629905] ^ [ 12.630305] ffff888102b0c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.630553] ffff888102b0c600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.630763] ==================================================================