Date
July 18, 2025, 2:09 p.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 |
[ 16.617652] ================================================================== [ 16.617761] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.617834] Write of size 1 at addr fff00000c78c1f00 by task kunit_try_catch/144 [ 16.617898] [ 16.617957] CPU: 1 UID: 0 PID: 144 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.618041] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.618067] Hardware name: linux,dummy-virt (DT) [ 16.618116] Call trace: [ 16.618157] show_stack+0x20/0x38 (C) [ 16.618215] dump_stack_lvl+0x8c/0xd0 [ 16.618301] print_report+0x118/0x5d0 [ 16.618356] kasan_report+0xdc/0x128 [ 16.618418] __asan_report_store1_noabort+0x20/0x30 [ 16.618470] kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.618516] kunit_try_run_case+0x170/0x3f0 [ 16.618597] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.618648] kthread+0x328/0x630 [ 16.618949] ret_from_fork+0x10/0x20 [ 16.619014] [ 16.619033] Allocated by task 144: [ 16.619106] kasan_save_stack+0x3c/0x68 [ 16.619180] kasan_save_track+0x20/0x40 [ 16.619236] kasan_save_alloc_info+0x40/0x58 [ 16.619282] __kasan_kmalloc+0xd4/0xd8 [ 16.619336] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.619424] kmalloc_big_oob_right+0xb8/0x2f0 [ 16.619673] kunit_try_run_case+0x170/0x3f0 [ 16.619725] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.619767] kthread+0x328/0x630 [ 16.619799] ret_from_fork+0x10/0x20 [ 16.619902] [ 16.619965] The buggy address belongs to the object at fff00000c78c0000 [ 16.619965] which belongs to the cache kmalloc-8k of size 8192 [ 16.620107] The buggy address is located 0 bytes to the right of [ 16.620107] allocated 7936-byte region [fff00000c78c0000, fff00000c78c1f00) [ 16.620214] [ 16.620307] The buggy address belongs to the physical page: [ 16.620420] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078c0 [ 16.620505] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.620551] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.620876] page_type: f5(slab) [ 16.621006] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.621105] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.621153] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.621561] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.621640] head: 0bfffe0000000003 ffffc1ffc31e3001 00000000ffffffff 00000000ffffffff [ 16.621754] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 16.621836] page dumped because: kasan: bad access detected [ 16.621879] [ 16.621897] Memory state around the buggy address: [ 16.621974] fff00000c78c1e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.622307] fff00000c78c1e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.622405] >fff00000c78c1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.622486] ^ [ 16.622540] fff00000c78c1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.622579] fff00000c78c2000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.622786] ==================================================================
[ 16.309894] ================================================================== [ 16.310075] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.310220] Write of size 1 at addr fff00000c662df00 by task kunit_try_catch/144 [ 16.310467] [ 16.310500] CPU: 1 UID: 0 PID: 144 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.310647] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.310769] Hardware name: linux,dummy-virt (DT) [ 16.310844] Call trace: [ 16.310867] show_stack+0x20/0x38 (C) [ 16.310915] dump_stack_lvl+0x8c/0xd0 [ 16.310967] print_report+0x118/0x5d0 [ 16.311099] kasan_report+0xdc/0x128 [ 16.311234] __asan_report_store1_noabort+0x20/0x30 [ 16.311360] kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.311406] kunit_try_run_case+0x170/0x3f0 [ 16.311452] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.311502] kthread+0x328/0x630 [ 16.311544] ret_from_fork+0x10/0x20 [ 16.311695] [ 16.312050] Allocated by task 144: [ 16.312263] kasan_save_stack+0x3c/0x68 [ 16.312308] kasan_save_track+0x20/0x40 [ 16.312358] kasan_save_alloc_info+0x40/0x58 [ 16.312396] __kasan_kmalloc+0xd4/0xd8 [ 16.312593] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.312867] kmalloc_big_oob_right+0xb8/0x2f0 [ 16.312913] kunit_try_run_case+0x170/0x3f0 [ 16.312951] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.312993] kthread+0x328/0x630 [ 16.313025] ret_from_fork+0x10/0x20 [ 16.313063] [ 16.313084] The buggy address belongs to the object at fff00000c662c000 [ 16.313084] which belongs to the cache kmalloc-8k of size 8192 [ 16.313150] The buggy address is located 0 bytes to the right of [ 16.313150] allocated 7936-byte region [fff00000c662c000, fff00000c662df00) [ 16.313211] [ 16.313253] The buggy address belongs to the physical page: [ 16.313357] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106628 [ 16.313646] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.313729] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.314037] page_type: f5(slab) [ 16.314222] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.314311] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.314370] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.314417] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.314464] head: 0bfffe0000000003 ffffc1ffc3198a01 00000000ffffffff 00000000ffffffff [ 16.314719] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 16.314761] page dumped because: kasan: bad access detected [ 16.314791] [ 16.314820] Memory state around the buggy address: [ 16.314929] fff00000c662de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.314971] fff00000c662de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.315011] >fff00000c662df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.315047] ^ [ 16.315096] fff00000c662df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.315241] fff00000c662e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.315508] ==================================================================
[ 16.339290] ================================================================== [ 16.339360] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.339422] Write of size 1 at addr fff00000c649df00 by task kunit_try_catch/144 [ 16.339469] [ 16.339508] CPU: 0 UID: 0 PID: 144 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.340298] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.340330] Hardware name: linux,dummy-virt (DT) [ 16.340765] Call trace: [ 16.340865] show_stack+0x20/0x38 (C) [ 16.341096] dump_stack_lvl+0x8c/0xd0 [ 16.341513] print_report+0x118/0x5d0 [ 16.341624] kasan_report+0xdc/0x128 [ 16.341834] __asan_report_store1_noabort+0x20/0x30 [ 16.342062] kmalloc_big_oob_right+0x2a4/0x2f0 [ 16.342158] kunit_try_run_case+0x170/0x3f0 [ 16.342373] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.342487] kthread+0x328/0x630 [ 16.342647] ret_from_fork+0x10/0x20 [ 16.342727] [ 16.342746] Allocated by task 144: [ 16.342783] kasan_save_stack+0x3c/0x68 [ 16.343071] kasan_save_track+0x20/0x40 [ 16.343309] kasan_save_alloc_info+0x40/0x58 [ 16.343398] __kasan_kmalloc+0xd4/0xd8 [ 16.343435] __kmalloc_cache_noprof+0x16c/0x3c0 [ 16.343830] kmalloc_big_oob_right+0xb8/0x2f0 [ 16.343945] kunit_try_run_case+0x170/0x3f0 [ 16.344046] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.344229] kthread+0x328/0x630 [ 16.344299] ret_from_fork+0x10/0x20 [ 16.344437] [ 16.344754] The buggy address belongs to the object at fff00000c649c000 [ 16.344754] which belongs to the cache kmalloc-8k of size 8192 [ 16.345055] The buggy address is located 0 bytes to the right of [ 16.345055] allocated 7936-byte region [fff00000c649c000, fff00000c649df00) [ 16.345287] [ 16.345317] The buggy address belongs to the physical page: [ 16.345399] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106498 [ 16.345651] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 16.346066] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 16.346352] page_type: f5(slab) [ 16.346410] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.346655] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.346848] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000 [ 16.346970] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 16.347027] head: 0bfffe0000000003 ffffc1ffc3192601 00000000ffffffff 00000000ffffffff [ 16.347075] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 16.347115] page dumped because: kasan: bad access detected [ 16.347322] [ 16.347407] Memory state around the buggy address: [ 16.347535] fff00000c649de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.347586] fff00000c649de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 16.347627] >fff00000c649df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.347665] ^ [ 16.347708] fff00000c649df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.347771] fff00000c649e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.347824] ==================================================================
[ 11.464499] ================================================================== [ 11.465007] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 11.465342] Write of size 1 at addr ffff888102bb5f00 by task kunit_try_catch/162 [ 11.465822] [ 11.465940] CPU: 1 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 11.465983] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.465994] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.466015] Call Trace: [ 11.466028] <TASK> [ 11.466042] dump_stack_lvl+0x73/0xb0 [ 11.466071] print_report+0xd1/0x610 [ 11.466093] ? __virt_addr_valid+0x1db/0x2d0 [ 11.466116] ? kmalloc_big_oob_right+0x316/0x370 [ 11.466138] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.466161] ? kmalloc_big_oob_right+0x316/0x370 [ 11.466183] kasan_report+0x141/0x180 [ 11.466205] ? kmalloc_big_oob_right+0x316/0x370 [ 11.466233] __asan_report_store1_noabort+0x1b/0x30 [ 11.466257] kmalloc_big_oob_right+0x316/0x370 [ 11.466280] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 11.466303] ? __schedule+0x10cc/0x2b60 [ 11.466325] ? __pfx_read_tsc+0x10/0x10 [ 11.466345] ? ktime_get_ts64+0x86/0x230 [ 11.466370] kunit_try_run_case+0x1a5/0x480 [ 11.466394] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.466774] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.466801] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.466824] ? __kthread_parkme+0x82/0x180 [ 11.466845] ? preempt_count_sub+0x50/0x80 [ 11.466870] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.466893] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.466917] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.466941] kthread+0x337/0x6f0 [ 11.466960] ? trace_preempt_on+0x20/0xc0 [ 11.466983] ? __pfx_kthread+0x10/0x10 [ 11.467003] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.467024] ? calculate_sigpending+0x7b/0xa0 [ 11.467048] ? __pfx_kthread+0x10/0x10 [ 11.467069] ret_from_fork+0x116/0x1d0 [ 11.467087] ? __pfx_kthread+0x10/0x10 [ 11.467106] ret_from_fork_asm+0x1a/0x30 [ 11.467139] </TASK> [ 11.467149] [ 11.473755] Allocated by task 162: [ 11.473932] kasan_save_stack+0x45/0x70 [ 11.474134] kasan_save_track+0x18/0x40 [ 11.474318] kasan_save_alloc_info+0x3b/0x50 [ 11.474521] __kasan_kmalloc+0xb7/0xc0 [ 11.474710] __kmalloc_cache_noprof+0x189/0x420 [ 11.474917] kmalloc_big_oob_right+0xa9/0x370 [ 11.475080] kunit_try_run_case+0x1a5/0x480 [ 11.475228] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.475503] kthread+0x337/0x6f0 [ 11.475692] ret_from_fork+0x116/0x1d0 [ 11.475878] ret_from_fork_asm+0x1a/0x30 [ 11.476078] [ 11.476173] The buggy address belongs to the object at ffff888102bb4000 [ 11.476173] which belongs to the cache kmalloc-8k of size 8192 [ 11.476754] The buggy address is located 0 bytes to the right of [ 11.476754] allocated 7936-byte region [ffff888102bb4000, ffff888102bb5f00) [ 11.477135] [ 11.477209] The buggy address belongs to the physical page: [ 11.477385] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bb0 [ 11.477747] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.478077] flags: 0x200000000000040(head|node=0|zone=2) [ 11.478404] page_type: f5(slab) [ 11.478543] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.478874] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.479113] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.479347] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.479878] head: 0200000000000003 ffffea00040aec01 00000000ffffffff 00000000ffffffff [ 11.480222] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 11.480775] page dumped because: kasan: bad access detected [ 11.481042] [ 11.481143] Memory state around the buggy address: [ 11.481358] ffff888102bb5e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.482031] ffff888102bb5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.482497] >ffff888102bb5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.482978] ^ [ 11.483123] ffff888102bb5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.483339] ffff888102bb6000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.484127] ==================================================================
[ 11.567456] ================================================================== [ 11.567944] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 11.568258] Write of size 1 at addr ffff888103959f00 by task kunit_try_catch/161 [ 11.568892] [ 11.568994] CPU: 1 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 11.569055] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.569067] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.569089] Call Trace: [ 11.569100] <TASK> [ 11.569119] dump_stack_lvl+0x73/0xb0 [ 11.569152] print_report+0xd1/0x610 [ 11.569175] ? __virt_addr_valid+0x1db/0x2d0 [ 11.569198] ? kmalloc_big_oob_right+0x316/0x370 [ 11.569220] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.569242] ? kmalloc_big_oob_right+0x316/0x370 [ 11.569265] kasan_report+0x141/0x180 [ 11.569286] ? kmalloc_big_oob_right+0x316/0x370 [ 11.569312] __asan_report_store1_noabort+0x1b/0x30 [ 11.569336] kmalloc_big_oob_right+0x316/0x370 [ 11.569358] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 11.569381] ? __schedule+0x10cc/0x2b60 [ 11.569403] ? __pfx_read_tsc+0x10/0x10 [ 11.569423] ? ktime_get_ts64+0x86/0x230 [ 11.569447] kunit_try_run_case+0x1a5/0x480 [ 11.569473] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.569494] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.569518] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.569541] ? __kthread_parkme+0x82/0x180 [ 11.569561] ? preempt_count_sub+0x50/0x80 [ 11.569585] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.569608] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.569631] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.569654] kthread+0x337/0x6f0 [ 11.569673] ? trace_preempt_on+0x20/0xc0 [ 11.569695] ? __pfx_kthread+0x10/0x10 [ 11.569715] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.569735] ? calculate_sigpending+0x7b/0xa0 [ 11.569759] ? __pfx_kthread+0x10/0x10 [ 11.569779] ret_from_fork+0x116/0x1d0 [ 11.569797] ? __pfx_kthread+0x10/0x10 [ 11.569817] ret_from_fork_asm+0x1a/0x30 [ 11.569847] </TASK> [ 11.569857] [ 11.577894] Allocated by task 161: [ 11.578097] kasan_save_stack+0x45/0x70 [ 11.578324] kasan_save_track+0x18/0x40 [ 11.578585] kasan_save_alloc_info+0x3b/0x50 [ 11.578916] __kasan_kmalloc+0xb7/0xc0 [ 11.579122] __kmalloc_cache_noprof+0x189/0x420 [ 11.579435] kmalloc_big_oob_right+0xa9/0x370 [ 11.579632] kunit_try_run_case+0x1a5/0x480 [ 11.579775] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.579943] kthread+0x337/0x6f0 [ 11.580539] ret_from_fork+0x116/0x1d0 [ 11.580942] ret_from_fork_asm+0x1a/0x30 [ 11.581150] [ 11.581260] The buggy address belongs to the object at ffff888103958000 [ 11.581260] which belongs to the cache kmalloc-8k of size 8192 [ 11.581630] The buggy address is located 0 bytes to the right of [ 11.581630] allocated 7936-byte region [ffff888103958000, ffff888103959f00) [ 11.582064] [ 11.582163] The buggy address belongs to the physical page: [ 11.582414] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103958 [ 11.582757] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.583142] flags: 0x200000000000040(head|node=0|zone=2) [ 11.583546] page_type: f5(slab) [ 11.583688] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.583922] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.584475] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.584808] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.585153] head: 0200000000000003 ffffea00040e5601 00000000ffffffff 00000000ffffffff [ 11.585509] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 11.586157] page dumped because: kasan: bad access detected [ 11.586504] [ 11.586592] Memory state around the buggy address: [ 11.586755] ffff888103959e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.586964] ffff888103959e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.587612] >ffff888103959f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.587936] ^ [ 11.588132] ffff888103959f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.588358] ffff88810395a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.588665] ==================================================================
[ 11.658852] ================================================================== [ 11.660128] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370 [ 11.660871] Write of size 1 at addr ffff888102bc1f00 by task kunit_try_catch/161 [ 11.661567] [ 11.661778] CPU: 0 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 11.661839] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.661849] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.661872] Call Trace: [ 11.661884] <TASK> [ 11.661912] dump_stack_lvl+0x73/0xb0 [ 11.661943] print_report+0xd1/0x610 [ 11.661984] ? __virt_addr_valid+0x1db/0x2d0 [ 11.662009] ? kmalloc_big_oob_right+0x316/0x370 [ 11.662031] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.662053] ? kmalloc_big_oob_right+0x316/0x370 [ 11.662075] kasan_report+0x141/0x180 [ 11.662097] ? kmalloc_big_oob_right+0x316/0x370 [ 11.662124] __asan_report_store1_noabort+0x1b/0x30 [ 11.662149] kmalloc_big_oob_right+0x316/0x370 [ 11.662171] ? __pfx_kmalloc_big_oob_right+0x10/0x10 [ 11.662194] ? __schedule+0x10cc/0x2b60 [ 11.662217] ? __pfx_read_tsc+0x10/0x10 [ 11.662238] ? ktime_get_ts64+0x86/0x230 [ 11.662264] kunit_try_run_case+0x1a5/0x480 [ 11.662289] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.662311] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.662335] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.662358] ? __kthread_parkme+0x82/0x180 [ 11.662379] ? preempt_count_sub+0x50/0x80 [ 11.662404] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.662427] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.662450] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.662474] kthread+0x337/0x6f0 [ 11.662492] ? trace_preempt_on+0x20/0xc0 [ 11.662531] ? __pfx_kthread+0x10/0x10 [ 11.662553] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.662575] ? calculate_sigpending+0x7b/0xa0 [ 11.662600] ? __pfx_kthread+0x10/0x10 [ 11.662620] ret_from_fork+0x116/0x1d0 [ 11.662638] ? __pfx_kthread+0x10/0x10 [ 11.662659] ret_from_fork_asm+0x1a/0x30 [ 11.662692] </TASK> [ 11.662703] [ 11.673382] Allocated by task 161: [ 11.673736] kasan_save_stack+0x45/0x70 [ 11.674223] kasan_save_track+0x18/0x40 [ 11.674653] kasan_save_alloc_info+0x3b/0x50 [ 11.675212] __kasan_kmalloc+0xb7/0xc0 [ 11.675608] __kmalloc_cache_noprof+0x189/0x420 [ 11.676054] kmalloc_big_oob_right+0xa9/0x370 [ 11.676556] kunit_try_run_case+0x1a5/0x480 [ 11.677063] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.677644] kthread+0x337/0x6f0 [ 11.678033] ret_from_fork+0x116/0x1d0 [ 11.678384] ret_from_fork_asm+0x1a/0x30 [ 11.678778] [ 11.679007] The buggy address belongs to the object at ffff888102bc0000 [ 11.679007] which belongs to the cache kmalloc-8k of size 8192 [ 11.680500] The buggy address is located 0 bytes to the right of [ 11.680500] allocated 7936-byte region [ffff888102bc0000, ffff888102bc1f00) [ 11.681755] [ 11.681949] The buggy address belongs to the physical page: [ 11.682509] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bc0 [ 11.683016] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.683812] flags: 0x200000000000040(head|node=0|zone=2) [ 11.684067] page_type: f5(slab) [ 11.684372] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.685057] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.685462] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000 [ 11.685966] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 11.686548] head: 0200000000000003 ffffea00040af001 00000000ffffffff 00000000ffffffff [ 11.686951] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 11.687788] page dumped because: kasan: bad access detected [ 11.688365] [ 11.688565] Memory state around the buggy address: [ 11.688727] ffff888102bc1e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.688948] ffff888102bc1e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 11.689573] >ffff888102bc1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.690320] ^ [ 11.690646] ffff888102bc1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.691394] ffff888102bc2000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.692300] ==================================================================