Date
July 16, 2025, 3:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.434193] ================================================================== [ 16.434296] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x278/0x2b8 [ 16.434435] Write of size 1 at addr fff00000c789200a by task kunit_try_catch/146 [ 16.434487] [ 16.434860] CPU: 1 UID: 0 PID: 146 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.434965] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.434992] Hardware name: linux,dummy-virt (DT) [ 16.435118] Call trace: [ 16.435144] show_stack+0x20/0x38 (C) [ 16.435235] dump_stack_lvl+0x8c/0xd0 [ 16.435407] print_report+0x118/0x5d0 [ 16.435476] kasan_report+0xdc/0x128 [ 16.435559] __asan_report_store1_noabort+0x20/0x30 [ 16.436049] kmalloc_large_oob_right+0x278/0x2b8 [ 16.436139] kunit_try_run_case+0x170/0x3f0 [ 16.436305] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.436409] kthread+0x328/0x630 [ 16.436539] ret_from_fork+0x10/0x20 [ 16.436614] [ 16.436651] The buggy address belongs to the physical page: [ 16.437009] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107890 [ 16.437092] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.437147] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.437268] page_type: f8(unknown) [ 16.437309] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.437358] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.437408] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 16.437467] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 16.437525] head: 0bfffe0000000002 ffffc1ffc31e2401 00000000ffffffff 00000000ffffffff [ 16.437582] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 16.437632] page dumped because: kasan: bad access detected [ 16.437671] [ 16.437688] Memory state around the buggy address: [ 16.437861] fff00000c7891f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.437903] fff00000c7891f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.437944] >fff00000c7892000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.437981] ^ [ 16.438008] fff00000c7892080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.438066] fff00000c7892100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 16.438103] ==================================================================
[ 12.068801] ================================================================== [ 12.070057] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x2e9/0x330 [ 12.070589] Write of size 1 at addr ffff888102a3200a by task kunit_try_catch/163 [ 12.070831] [ 12.070931] CPU: 0 UID: 0 PID: 163 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 12.070976] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.070988] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.071009] Call Trace: [ 12.071022] <TASK> [ 12.071039] dump_stack_lvl+0x73/0xb0 [ 12.071069] print_report+0xd1/0x610 [ 12.071091] ? __virt_addr_valid+0x1db/0x2d0 [ 12.071115] ? kmalloc_large_oob_right+0x2e9/0x330 [ 12.071137] ? kasan_addr_to_slab+0x11/0xa0 [ 12.071157] ? kmalloc_large_oob_right+0x2e9/0x330 [ 12.071185] kasan_report+0x141/0x180 [ 12.071207] ? kmalloc_large_oob_right+0x2e9/0x330 [ 12.071235] __asan_report_store1_noabort+0x1b/0x30 [ 12.071261] kmalloc_large_oob_right+0x2e9/0x330 [ 12.071284] ? __pfx_kmalloc_large_oob_right+0x10/0x10 [ 12.071308] ? __schedule+0x10cc/0x2b60 [ 12.071331] ? __pfx_read_tsc+0x10/0x10 [ 12.071352] ? ktime_get_ts64+0x86/0x230 [ 12.071377] kunit_try_run_case+0x1a5/0x480 [ 12.071401] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.071424] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.071448] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.071472] ? __kthread_parkme+0x82/0x180 [ 12.071552] ? preempt_count_sub+0x50/0x80 [ 12.071592] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.071617] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.071642] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.071667] kthread+0x337/0x6f0 [ 12.071686] ? trace_preempt_on+0x20/0xc0 [ 12.071710] ? __pfx_kthread+0x10/0x10 [ 12.071731] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.071764] ? calculate_sigpending+0x7b/0xa0 [ 12.071789] ? __pfx_kthread+0x10/0x10 [ 12.071810] ret_from_fork+0x116/0x1d0 [ 12.071828] ? __pfx_kthread+0x10/0x10 [ 12.071849] ret_from_fork_asm+0x1a/0x30 [ 12.071880] </TASK> [ 12.071890] [ 12.078950] The buggy address belongs to the physical page: [ 12.079204] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a30 [ 12.079564] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.079815] flags: 0x200000000000040(head|node=0|zone=2) [ 12.080006] page_type: f8(unknown) [ 12.080183] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 12.080520] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 12.080830] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 12.081063] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 12.081419] head: 0200000000000002 ffffea00040a8c01 00000000ffffffff 00000000ffffffff [ 12.081775] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 12.082093] page dumped because: kasan: bad access detected [ 12.082314] [ 12.082407] Memory state around the buggy address: [ 12.082624] ffff888102a31f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.082923] ffff888102a31f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.083190] >ffff888102a32000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 12.083528] ^ [ 12.083684] ffff888102a32080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 12.083930] ffff888102a32100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 12.084143] ==================================================================