Date
July 18, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 16.541272] ================================================================== [ 16.541378] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 16.541442] Read of size 1 at addr fff00000c5acc05f by task kunit_try_catch/138 [ 16.541502] [ 16.541542] CPU: 1 UID: 0 PID: 138 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.541622] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.541650] Hardware name: linux,dummy-virt (DT) [ 16.541684] Call trace: [ 16.541706] show_stack+0x20/0x38 (C) [ 16.541959] dump_stack_lvl+0x8c/0xd0 [ 16.542045] print_report+0x118/0x5d0 [ 16.542094] kasan_report+0xdc/0x128 [ 16.542359] __asan_report_load1_noabort+0x20/0x30 [ 16.542414] kmalloc_oob_left+0x2ec/0x320 [ 16.542460] kunit_try_run_case+0x170/0x3f0 [ 16.542508] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.542559] kthread+0x328/0x630 [ 16.542811] ret_from_fork+0x10/0x20 [ 16.542903] [ 16.543009] Allocated by task 24: [ 16.543188] kasan_save_stack+0x3c/0x68 [ 16.543333] kasan_save_track+0x20/0x40 [ 16.543500] kasan_save_alloc_info+0x40/0x58 [ 16.543561] __kasan_kmalloc+0xd4/0xd8 [ 16.543597] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 16.543656] kvasprintf+0xe0/0x180 [ 16.543692] __kthread_create_on_node+0x16c/0x350 [ 16.543995] kthread_create_on_node+0xe4/0x130 [ 16.544206] create_worker+0x380/0x6b8 [ 16.544380] worker_thread+0x808/0xf38 [ 16.544462] kthread+0x328/0x630 [ 16.544531] ret_from_fork+0x10/0x20 [ 16.544627] [ 16.544728] The buggy address belongs to the object at fff00000c5acc040 [ 16.544728] which belongs to the cache kmalloc-16 of size 16 [ 16.544890] The buggy address is located 19 bytes to the right of [ 16.544890] allocated 12-byte region [fff00000c5acc040, fff00000c5acc04c) [ 16.544975] [ 16.545026] The buggy address belongs to the physical page: [ 16.545058] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105acc [ 16.545473] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.545622] page_type: f5(slab) [ 16.545737] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 16.545880] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 16.546012] page dumped because: kasan: bad access detected [ 16.546110] [ 16.546128] Memory state around the buggy address: [ 16.546160] fff00000c5acbf00: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 16.546344] fff00000c5acbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.546741] >fff00000c5acc000: fa fb fc fc fa fb fc fc 00 04 fc fc 00 07 fc fc [ 16.546806] ^ [ 16.547175] fff00000c5acc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.547262] fff00000c5acc100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.547364] ==================================================================
[ 16.264028] ================================================================== [ 16.264220] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 16.264406] Read of size 1 at addr fff00000c5a02b7f by task kunit_try_catch/138 [ 16.264675] [ 16.264721] CPU: 1 UID: 0 PID: 138 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.264810] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.264907] Hardware name: linux,dummy-virt (DT) [ 16.264982] Call trace: [ 16.265004] show_stack+0x20/0x38 (C) [ 16.265053] dump_stack_lvl+0x8c/0xd0 [ 16.265099] print_report+0x118/0x5d0 [ 16.265144] kasan_report+0xdc/0x128 [ 16.265190] __asan_report_load1_noabort+0x20/0x30 [ 16.265241] kmalloc_oob_left+0x2ec/0x320 [ 16.265286] kunit_try_run_case+0x170/0x3f0 [ 16.265344] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.265396] kthread+0x328/0x630 [ 16.265661] ret_from_fork+0x10/0x20 [ 16.265734] [ 16.265752] Allocated by task 24: [ 16.265790] kasan_save_stack+0x3c/0x68 [ 16.265831] kasan_save_track+0x20/0x40 [ 16.265868] kasan_save_alloc_info+0x40/0x58 [ 16.265910] __kasan_kmalloc+0xd4/0xd8 [ 16.265946] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 16.266006] kvasprintf+0xe0/0x180 [ 16.266041] __kthread_create_on_node+0x16c/0x350 [ 16.266180] kthread_create_on_node+0xe4/0x130 [ 16.266219] create_worker+0x380/0x6b8 [ 16.266254] worker_thread+0x808/0xf38 [ 16.266317] kthread+0x328/0x630 [ 16.266518] ret_from_fork+0x10/0x20 [ 16.266653] [ 16.266672] The buggy address belongs to the object at fff00000c5a02b60 [ 16.266672] which belongs to the cache kmalloc-16 of size 16 [ 16.266745] The buggy address is located 19 bytes to the right of [ 16.266745] allocated 12-byte region [fff00000c5a02b60, fff00000c5a02b6c) [ 16.266827] [ 16.266908] The buggy address belongs to the physical page: [ 16.266955] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105a02 [ 16.267068] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.267136] page_type: f5(slab) [ 16.267202] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 16.267780] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 16.267827] page dumped because: kasan: bad access detected [ 16.267858] [ 16.267875] Memory state around the buggy address: [ 16.267907] fff00000c5a02a00: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 05 fc fc [ 16.268250] fff00000c5a02a80: fa fb fc fc 00 02 fc fc fa fb fc fc fa fb fc fc [ 16.268348] >fff00000c5a02b00: fa fb fc fc fa fb fc fc fa fb fc fc 00 04 fc fc [ 16.268385] ^ [ 16.268424] fff00000c5a02b80: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.268519] fff00000c5a02c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.268738] ==================================================================
[ 16.275011] ================================================================== [ 16.275069] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2ec/0x320 [ 16.275150] Read of size 1 at addr fff00000c5755ddf by task kunit_try_catch/138 [ 16.275199] [ 16.275245] CPU: 0 UID: 0 PID: 138 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 16.275324] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.275349] Hardware name: linux,dummy-virt (DT) [ 16.275380] Call trace: [ 16.275402] show_stack+0x20/0x38 (C) [ 16.275554] dump_stack_lvl+0x8c/0xd0 [ 16.275608] print_report+0x118/0x5d0 [ 16.275653] kasan_report+0xdc/0x128 [ 16.275697] __asan_report_load1_noabort+0x20/0x30 [ 16.275757] kmalloc_oob_left+0x2ec/0x320 [ 16.275801] kunit_try_run_case+0x170/0x3f0 [ 16.275849] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 16.275900] kthread+0x328/0x630 [ 16.275951] ret_from_fork+0x10/0x20 [ 16.275997] [ 16.276014] Allocated by task 10: [ 16.276042] kasan_save_stack+0x3c/0x68 [ 16.276081] kasan_save_track+0x20/0x40 [ 16.276127] kasan_save_alloc_info+0x40/0x58 [ 16.276176] __kasan_kmalloc+0xd4/0xd8 [ 16.276297] __kmalloc_node_track_caller_noprof+0x194/0x4b8 [ 16.276489] kvasprintf+0xe0/0x180 [ 16.276596] __kthread_create_on_node+0x16c/0x350 [ 16.276639] kthread_create_on_node+0xe4/0x130 [ 16.276675] create_worker+0x380/0x6b8 [ 16.277036] worker_thread+0x808/0xf38 [ 16.277299] kthread+0x328/0x630 [ 16.277349] ret_from_fork+0x10/0x20 [ 16.277401] [ 16.277421] The buggy address belongs to the object at fff00000c5755dc0 [ 16.277421] which belongs to the cache kmalloc-16 of size 16 [ 16.277479] The buggy address is located 19 bytes to the right of [ 16.277479] allocated 12-byte region [fff00000c5755dc0, fff00000c5755dcc) [ 16.277879] [ 16.277903] The buggy address belongs to the physical page: [ 16.277932] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105755 [ 16.277985] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 16.278181] page_type: f5(slab) [ 16.278290] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000 [ 16.278339] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 16.278429] page dumped because: kasan: bad access detected [ 16.278477] [ 16.278494] Memory state around the buggy address: [ 16.278637] fff00000c5755c80: 00 02 fc fc 00 02 fc fc 00 02 fc fc 00 05 fc fc [ 16.278751] fff00000c5755d00: fa fb fc fc 00 02 fc fc fa fb fc fc fa fb fc fc [ 16.278822] >fff00000c5755d80: fa fb fc fc fa fb fc fc 00 04 fc fc 00 07 fc fc [ 16.278858] ^ [ 16.278896] fff00000c5755e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.278937] fff00000c5755e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.278973] ==================================================================
[ 11.355224] ================================================================== [ 11.355905] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x361/0x3c0 [ 11.356200] Read of size 1 at addr ffff8881016842bf by task kunit_try_catch/156 [ 11.356923] [ 11.357053] CPU: 1 UID: 0 PID: 156 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 11.357103] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.357115] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.357141] Call Trace: [ 11.357154] <TASK> [ 11.357171] dump_stack_lvl+0x73/0xb0 [ 11.357203] print_report+0xd1/0x610 [ 11.357225] ? __virt_addr_valid+0x1db/0x2d0 [ 11.357248] ? kmalloc_oob_left+0x361/0x3c0 [ 11.357268] ? kasan_complete_mode_report_info+0x64/0x200 [ 11.357291] ? kmalloc_oob_left+0x361/0x3c0 [ 11.357312] kasan_report+0x141/0x180 [ 11.357333] ? kmalloc_oob_left+0x361/0x3c0 [ 11.357360] __asan_report_load1_noabort+0x18/0x20 [ 11.357384] kmalloc_oob_left+0x361/0x3c0 [ 11.357405] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 11.357465] ? __schedule+0x10cc/0x2b60 [ 11.357488] ? __pfx_read_tsc+0x10/0x10 [ 11.357509] ? ktime_get_ts64+0x86/0x230 [ 11.357534] kunit_try_run_case+0x1a5/0x480 [ 11.357559] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.357581] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.357604] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.357645] ? __kthread_parkme+0x82/0x180 [ 11.357665] ? preempt_count_sub+0x50/0x80 [ 11.357690] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.357713] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.357736] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.357760] kthread+0x337/0x6f0 [ 11.357779] ? trace_preempt_on+0x20/0xc0 [ 11.357801] ? __pfx_kthread+0x10/0x10 [ 11.357821] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.357842] ? calculate_sigpending+0x7b/0xa0 [ 11.357866] ? __pfx_kthread+0x10/0x10 [ 11.357886] ret_from_fork+0x116/0x1d0 [ 11.357904] ? __pfx_kthread+0x10/0x10 [ 11.357924] ret_from_fork_asm+0x1a/0x30 [ 11.357956] </TASK> [ 11.357967] [ 11.365811] Allocated by task 41: [ 11.366025] kasan_save_stack+0x45/0x70 [ 11.366224] kasan_save_track+0x18/0x40 [ 11.366398] kasan_save_alloc_info+0x3b/0x50 [ 11.366788] __kasan_kmalloc+0xb7/0xc0 [ 11.366932] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 11.367195] kvasprintf+0xc5/0x150 [ 11.367392] kasprintf+0xb6/0xf0 [ 11.367702] input_devnode+0x46/0x80 [ 11.367904] device_get_devnode+0x145/0x2a0 [ 11.368110] dev_uevent+0x41c/0x730 [ 11.368301] kobject_uevent_env+0x50d/0xff0 [ 11.368587] kobject_uevent+0xf/0x20 [ 11.368775] device_add+0xe4c/0x1820 [ 11.368905] cdev_device_add+0xab/0x1c0 [ 11.369190] evdev_connect+0x356/0x480 [ 11.369408] input_attach_handler.isra.0+0x117/0x1f0 [ 11.369667] input_register_device+0x722/0xe10 [ 11.369875] psmouse_connect+0x6ed/0xe30 [ 11.370119] serio_driver_probe+0x7a/0xb0 [ 11.370377] really_probe+0x1d4/0x920 [ 11.370575] __driver_probe_device+0x18f/0x3e0 [ 11.370757] driver_probe_device+0x4f/0x130 [ 11.370895] __driver_attach+0x1eb/0x4b0 [ 11.371026] bus_for_each_dev+0x10f/0x1a0 [ 11.371376] driver_attach+0x41/0x60 [ 11.371713] serio_handle_event+0x254/0x940 [ 11.371944] process_one_work+0x5ee/0xf60 [ 11.372166] worker_thread+0x758/0x1220 [ 11.372376] kthread+0x337/0x6f0 [ 11.372625] ret_from_fork+0x116/0x1d0 [ 11.372758] ret_from_fork_asm+0x1a/0x30 [ 11.372935] [ 11.373076] Freed by task 41: [ 11.373255] kasan_save_stack+0x45/0x70 [ 11.373480] kasan_save_track+0x18/0x40 [ 11.373713] kasan_save_free_info+0x3f/0x60 [ 11.373922] __kasan_slab_free+0x56/0x70 [ 11.374097] kfree+0x222/0x3f0 [ 11.374255] dev_uevent+0x466/0x730 [ 11.374481] kobject_uevent_env+0x50d/0xff0 [ 11.374715] kobject_uevent+0xf/0x20 [ 11.374865] device_add+0xe4c/0x1820 [ 11.375041] cdev_device_add+0xab/0x1c0 [ 11.375246] evdev_connect+0x356/0x480 [ 11.375493] input_attach_handler.isra.0+0x117/0x1f0 [ 11.375731] input_register_device+0x722/0xe10 [ 11.375933] psmouse_connect+0x6ed/0xe30 [ 11.376116] serio_driver_probe+0x7a/0xb0 [ 11.376321] really_probe+0x1d4/0x920 [ 11.376560] __driver_probe_device+0x18f/0x3e0 [ 11.376795] driver_probe_device+0x4f/0x130 [ 11.376982] __driver_attach+0x1eb/0x4b0 [ 11.377166] bus_for_each_dev+0x10f/0x1a0 [ 11.377372] driver_attach+0x41/0x60 [ 11.377631] serio_handle_event+0x254/0x940 [ 11.377836] process_one_work+0x5ee/0xf60 [ 11.378014] worker_thread+0x758/0x1220 [ 11.378203] kthread+0x337/0x6f0 [ 11.378367] ret_from_fork+0x116/0x1d0 [ 11.378805] ret_from_fork_asm+0x1a/0x30 [ 11.378987] [ 11.379076] The buggy address belongs to the object at ffff8881016842a0 [ 11.379076] which belongs to the cache kmalloc-16 of size 16 [ 11.379684] The buggy address is located 15 bytes to the right of [ 11.379684] allocated 16-byte region [ffff8881016842a0, ffff8881016842b0) [ 11.380220] [ 11.380319] The buggy address belongs to the physical page: [ 11.380680] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101684 [ 11.380996] flags: 0x200000000000000(node=0|zone=2) [ 11.381206] page_type: f5(slab) [ 11.381382] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 11.381851] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 11.382131] page dumped because: kasan: bad access detected [ 11.382387] [ 11.382493] Memory state around the buggy address: [ 11.382717] ffff888101684180: 00 04 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 11.383023] ffff888101684200: 00 02 fc fc 00 02 fc fc 00 06 fc fc 00 06 fc fc [ 11.383355] >ffff888101684280: fa fb fc fc fa fb fc fc 00 07 fc fc fc fc fc fc [ 11.383847] ^ [ 11.384101] ffff888101684300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.384399] ffff888101684380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.384724] ==================================================================
[ 11.461510] ================================================================== [ 11.462453] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x361/0x3c0 [ 11.462860] Read of size 1 at addr ffff888101be2e3f by task kunit_try_catch/155 [ 11.463719] [ 11.463855] CPU: 0 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 11.463904] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.463916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.463938] Call Trace: [ 11.463952] <TASK> [ 11.463971] dump_stack_lvl+0x73/0xb0 [ 11.464182] print_report+0xd1/0x610 [ 11.464210] ? __virt_addr_valid+0x1db/0x2d0 [ 11.464309] ? kmalloc_oob_left+0x361/0x3c0 [ 11.464333] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.464358] ? kmalloc_oob_left+0x361/0x3c0 [ 11.464391] kasan_report+0x141/0x180 [ 11.464475] ? kmalloc_oob_left+0x361/0x3c0 [ 11.464505] __asan_report_load1_noabort+0x18/0x20 [ 11.464531] kmalloc_oob_left+0x361/0x3c0 [ 11.464552] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 11.464574] ? __schedule+0x10cc/0x2b60 [ 11.464598] ? __pfx_read_tsc+0x10/0x10 [ 11.464618] ? ktime_get_ts64+0x86/0x230 [ 11.464642] kunit_try_run_case+0x1a5/0x480 [ 11.464668] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.464692] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.464718] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.464740] ? __kthread_parkme+0x82/0x180 [ 11.464761] ? preempt_count_sub+0x50/0x80 [ 11.464785] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.464808] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.464831] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.464859] kthread+0x337/0x6f0 [ 11.464877] ? trace_preempt_on+0x20/0xc0 [ 11.464900] ? __pfx_kthread+0x10/0x10 [ 11.464919] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.464940] ? calculate_sigpending+0x7b/0xa0 [ 11.464963] ? __pfx_kthread+0x10/0x10 [ 11.464983] ret_from_fork+0x116/0x1d0 [ 11.465041] ? __pfx_kthread+0x10/0x10 [ 11.465062] ret_from_fork_asm+0x1a/0x30 [ 11.465092] </TASK> [ 11.465103] [ 11.474699] Allocated by task 1: [ 11.474930] kasan_save_stack+0x45/0x70 [ 11.475123] kasan_save_track+0x18/0x40 [ 11.475259] kasan_save_alloc_info+0x3b/0x50 [ 11.475408] __kasan_kmalloc+0xb7/0xc0 [ 11.475540] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 11.475799] kvasprintf+0xc5/0x150 [ 11.476049] __kthread_create_on_node+0x18b/0x3a0 [ 11.476284] kthread_create_on_node+0xab/0xe0 [ 11.476492] create_worker+0x3e5/0x7b0 [ 11.476642] alloc_unbound_pwq+0x8ea/0xdb0 [ 11.476791] apply_wqattrs_prepare+0x332/0xd20 [ 11.476953] apply_workqueue_attrs_locked+0x4d/0xa0 [ 11.477450] alloc_workqueue+0xcc7/0x1ad0 [ 11.477788] latency_fsnotify_init+0x1b/0x50 [ 11.477946] do_one_initcall+0xd8/0x370 [ 11.478149] kernel_init_freeable+0x420/0x6f0 [ 11.478302] kernel_init+0x23/0x1e0 [ 11.478427] ret_from_fork+0x116/0x1d0 [ 11.478559] ret_from_fork_asm+0x1a/0x30 [ 11.478717] [ 11.478851] The buggy address belongs to the object at ffff888101be2e20 [ 11.478851] which belongs to the cache kmalloc-16 of size 16 [ 11.479653] The buggy address is located 18 bytes to the right of [ 11.479653] allocated 13-byte region [ffff888101be2e20, ffff888101be2e2d) [ 11.481763] [ 11.482000] The buggy address belongs to the physical page: [ 11.482333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101be2 [ 11.483302] flags: 0x200000000000000(node=0|zone=2) [ 11.483551] page_type: f5(slab) [ 11.483717] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 11.484039] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 11.484744] page dumped because: kasan: bad access detected [ 11.485125] [ 11.485217] Memory state around the buggy address: [ 11.485428] ffff888101be2d00: 00 02 fc fc 00 05 fc fc 00 02 fc fc 00 02 fc fc [ 11.485716] ffff888101be2d80: 00 02 fc fc 00 02 fc fc fa fb fc fc fa fb fc fc [ 11.486004] >ffff888101be2e00: fa fb fc fc 00 05 fc fc 00 07 fc fc fc fc fc fc [ 11.486843] ^ [ 11.487599] ffff888101be2e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.488091] ffff888101be2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.488707] ==================================================================
[ 11.529827] ================================================================== [ 11.531171] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x361/0x3c0 [ 11.531875] Read of size 1 at addr ffff88810283717f by task kunit_try_catch/155 [ 11.532541] [ 11.532643] CPU: 1 UID: 0 PID: 155 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 11.532690] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.532701] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.532724] Call Trace: [ 11.532738] <TASK> [ 11.532757] dump_stack_lvl+0x73/0xb0 [ 11.532790] print_report+0xd1/0x610 [ 11.532813] ? __virt_addr_valid+0x1db/0x2d0 [ 11.532838] ? kmalloc_oob_left+0x361/0x3c0 [ 11.532858] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.532881] ? kmalloc_oob_left+0x361/0x3c0 [ 11.532916] kasan_report+0x141/0x180 [ 11.532938] ? kmalloc_oob_left+0x361/0x3c0 [ 11.532965] __asan_report_load1_noabort+0x18/0x20 [ 11.532999] kmalloc_oob_left+0x361/0x3c0 [ 11.533020] ? __pfx_kmalloc_oob_left+0x10/0x10 [ 11.533042] ? __schedule+0x10cc/0x2b60 [ 11.533065] ? __pfx_read_tsc+0x10/0x10 [ 11.533087] ? ktime_get_ts64+0x86/0x230 [ 11.533114] kunit_try_run_case+0x1a5/0x480 [ 11.533163] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.533185] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.533210] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.533233] ? __kthread_parkme+0x82/0x180 [ 11.533254] ? preempt_count_sub+0x50/0x80 [ 11.533279] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.533302] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.533326] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.533349] kthread+0x337/0x6f0 [ 11.533368] ? trace_preempt_on+0x20/0xc0 [ 11.533392] ? __pfx_kthread+0x10/0x10 [ 11.533412] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.533433] ? calculate_sigpending+0x7b/0xa0 [ 11.533457] ? __pfx_kthread+0x10/0x10 [ 11.533478] ret_from_fork+0x116/0x1d0 [ 11.533497] ? __pfx_kthread+0x10/0x10 [ 11.533516] ret_from_fork_asm+0x1a/0x30 [ 11.533549] </TASK> [ 11.533560] [ 11.548740] Allocated by task 1: [ 11.548886] kasan_save_stack+0x45/0x70 [ 11.549061] kasan_save_track+0x18/0x40 [ 11.549196] kasan_save_alloc_info+0x3b/0x50 [ 11.549345] __kasan_kmalloc+0xb7/0xc0 [ 11.549477] __kmalloc_node_track_caller_noprof+0x1cb/0x500 [ 11.549659] kvasprintf+0xc5/0x150 [ 11.549783] __kthread_create_on_node+0x18b/0x3a0 [ 11.550073] kthread_create_on_node+0xab/0xe0 [ 11.550444] create_worker+0x3e5/0x7b0 [ 11.550782] alloc_unbound_pwq+0x8ea/0xdb0 [ 11.551167] apply_wqattrs_prepare+0x332/0xd20 [ 11.551564] apply_workqueue_attrs_locked+0x4d/0xa0 [ 11.552006] alloc_workqueue+0xcc7/0x1ad0 [ 11.552424] latency_fsnotify_init+0x1b/0x50 [ 11.552819] do_one_initcall+0xd8/0x370 [ 11.553223] kernel_init_freeable+0x420/0x6f0 [ 11.553710] kernel_init+0x23/0x1e0 [ 11.554079] ret_from_fork+0x116/0x1d0 [ 11.554428] ret_from_fork_asm+0x1a/0x30 [ 11.554779] [ 11.554948] The buggy address belongs to the object at ffff888102837160 [ 11.554948] which belongs to the cache kmalloc-16 of size 16 [ 11.555978] The buggy address is located 18 bytes to the right of [ 11.555978] allocated 13-byte region [ffff888102837160, ffff88810283716d) [ 11.556420] [ 11.556499] The buggy address belongs to the physical page: [ 11.556680] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102837 [ 11.556959] flags: 0x200000000000000(node=0|zone=2) [ 11.557423] page_type: f5(slab) [ 11.557774] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000 [ 11.558266] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 [ 11.558496] page dumped because: kasan: bad access detected [ 11.558667] [ 11.558735] Memory state around the buggy address: [ 11.558905] ffff888102837000: 00 04 fc fc 00 04 fc fc 00 01 fc fc 00 01 fc fc [ 11.559242] ffff888102837080: 00 04 fc fc 00 04 fc fc 00 05 fc fc 00 05 fc fc [ 11.559506] >ffff888102837100: 00 05 fc fc 00 02 fc fc fa fb fc fc 00 05 fc fc [ 11.559789] ^ [ 11.560119] ffff888102837180: 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.560435] ffff888102837200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.560718] ==================================================================