Hay
Date
July 23, 2025, 2:10 a.m.

Environment
qemu-arm64
qemu-x86_64

[   15.099441] ==================================================================
[   15.099514] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x418/0x488
[   15.099564] Write of size 1 at addr fff00000c3f39378 by task kunit_try_catch/142
[   15.099614] 
[   15.099642] CPU: 1 UID: 0 PID: 142 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc7 #1 PREEMPT 
[   15.099720] Tainted: [B]=BAD_PAGE, [N]=TEST
[   15.099747] Hardware name: linux,dummy-virt (DT)
[   15.099785] Call trace:
[   15.099808]  show_stack+0x20/0x38 (C)
[   15.099868]  dump_stack_lvl+0x8c/0xd0
[   15.099913]  print_report+0x118/0x5d0
[   15.099959]  kasan_report+0xdc/0x128
[   15.100004]  __asan_report_store1_noabort+0x20/0x30
[   15.100055]  kmalloc_track_caller_oob_right+0x418/0x488
[   15.100105]  kunit_try_run_case+0x170/0x3f0
[   15.100152]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.100203]  kthread+0x328/0x630
[   15.100244]  ret_from_fork+0x10/0x20
[   15.100290] 
[   15.100308] Allocated by task 142:
[   15.100334]  kasan_save_stack+0x3c/0x68
[   15.100379]  kasan_save_track+0x20/0x40
[   15.100416]  kasan_save_alloc_info+0x40/0x58
[   15.100465]  __kasan_kmalloc+0xd4/0xd8
[   15.100501]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   15.100544]  kmalloc_track_caller_oob_right+0x184/0x488
[   15.100585]  kunit_try_run_case+0x170/0x3f0
[   15.100621]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.100673]  kthread+0x328/0x630
[   15.100705]  ret_from_fork+0x10/0x20
[   15.100745] 
[   15.100763] The buggy address belongs to the object at fff00000c3f39300
[   15.100763]  which belongs to the cache kmalloc-128 of size 128
[   15.100827] The buggy address is located 0 bytes to the right of
[   15.100827]  allocated 120-byte region [fff00000c3f39300, fff00000c3f39378)
[   15.101404] 
[   15.101430] The buggy address belongs to the physical page:
[   15.101459] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103f39
[   15.101512] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   15.101559] page_type: f5(slab)
[   15.101597] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   15.102041] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   15.102123] page dumped because: kasan: bad access detected
[   15.102156] 
[   15.102173] Memory state around the buggy address:
[   15.102205]  fff00000c3f39200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   15.102249]  fff00000c3f39280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.102291] >fff00000c3f39300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   15.102477]                                                                 ^
[   15.102591]  fff00000c3f39380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.102807]  fff00000c3f39400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.102845] ==================================================================
[   15.094015] ==================================================================
[   15.094099] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x40c/0x488
[   15.094365] Write of size 1 at addr fff00000c3f39278 by task kunit_try_catch/142
[   15.094417] 
[   15.094455] CPU: 1 UID: 0 PID: 142 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc7 #1 PREEMPT 
[   15.094648] Tainted: [B]=BAD_PAGE, [N]=TEST
[   15.094682] Hardware name: linux,dummy-virt (DT)
[   15.094725] Call trace:
[   15.094763]  show_stack+0x20/0x38 (C)
[   15.094972]  dump_stack_lvl+0x8c/0xd0
[   15.095156]  print_report+0x118/0x5d0
[   15.095346]  kasan_report+0xdc/0x128
[   15.095572]  __asan_report_store1_noabort+0x20/0x30
[   15.095628]  kmalloc_track_caller_oob_right+0x40c/0x488
[   15.095691]  kunit_try_run_case+0x170/0x3f0
[   15.095898]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.095958]  kthread+0x328/0x630
[   15.096000]  ret_from_fork+0x10/0x20
[   15.096188] 
[   15.096228] Allocated by task 142:
[   15.096317]  kasan_save_stack+0x3c/0x68
[   15.096430]  kasan_save_track+0x20/0x40
[   15.096519]  kasan_save_alloc_info+0x40/0x58
[   15.096640]  __kasan_kmalloc+0xd4/0xd8
[   15.096697]  __kmalloc_node_track_caller_noprof+0x194/0x4b8
[   15.096787]  kmalloc_track_caller_oob_right+0xa8/0x488
[   15.096864]  kunit_try_run_case+0x170/0x3f0
[   15.096901]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   15.096944]  kthread+0x328/0x630
[   15.097015]  ret_from_fork+0x10/0x20
[   15.097219] 
[   15.097278] The buggy address belongs to the object at fff00000c3f39200
[   15.097278]  which belongs to the cache kmalloc-128 of size 128
[   15.097338] The buggy address is located 0 bytes to the right of
[   15.097338]  allocated 120-byte region [fff00000c3f39200, fff00000c3f39278)
[   15.097578] 
[   15.097634] The buggy address belongs to the physical page:
[   15.097719] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103f39
[   15.097863] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   15.097961] page_type: f5(slab)
[   15.098048] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   15.098149] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   15.098225] page dumped because: kasan: bad access detected
[   15.098297] 
[   15.098346] Memory state around the buggy address:
[   15.098424]  fff00000c3f39100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   15.098587]  fff00000c3f39180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.098650] >fff00000c3f39200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   15.098689]                                                                 ^
[   15.098731]  fff00000c3f39280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.098772]  fff00000c3f39300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   15.098810] ==================================================================

[   12.102288] ==================================================================
[   12.102706] BUG: KASAN: slab-out-of-bounds in kmalloc_track_caller_oob_right+0x4c8/0x520
[   12.103539] Write of size 1 at addr ffff8881025bdd78 by task kunit_try_catch/159
[   12.104922] 
[   12.105412] CPU: 1 UID: 0 PID: 159 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc7 #1 PREEMPT(voluntary) 
[   12.105463] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.105475] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.105496] Call Trace:
[   12.105519]  <TASK>
[   12.105534]  dump_stack_lvl+0x73/0xb0
[   12.105564]  print_report+0xd1/0x610
[   12.105585]  ? __virt_addr_valid+0x1db/0x2d0
[   12.105606]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   12.105630]  ? kasan_complete_mode_report_info+0x2a/0x200
[   12.105651]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   12.105675]  kasan_report+0x141/0x180
[   12.105696]  ? kmalloc_track_caller_oob_right+0x4c8/0x520
[   12.105724]  __asan_report_store1_noabort+0x1b/0x30
[   12.105748]  kmalloc_track_caller_oob_right+0x4c8/0x520
[   12.105771]  ? __pfx_kmalloc_track_caller_oob_right+0x10/0x10
[   12.105796]  ? __schedule+0x10c6/0x2b60
[   12.105827]  ? __pfx_read_tsc+0x10/0x10
[   12.105847]  ? ktime_get_ts64+0x86/0x230
[   12.105869]  kunit_try_run_case+0x1a5/0x480
[   12.105894]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.105916]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.105938]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.105961]  ? __kthread_parkme+0x82/0x180
[   12.105980]  ? preempt_count_sub+0x50/0x80
[   12.106003]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.106026]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.106048]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.106070]  kthread+0x337/0x6f0
[   12.106232]  ? trace_preempt_on+0x20/0xc0
[   12.106406]  ? __pfx_kthread+0x10/0x10
[   12.106427]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.106448]  ? calculate_sigpending+0x7b/0xa0
[   12.106471]  ? __pfx_kthread+0x10/0x10
[   12.106492]  ret_from_fork+0x116/0x1d0
[   12.106510]  ? __pfx_kthread+0x10/0x10
[   12.106529]  ret_from_fork_asm+0x1a/0x30
[   12.106558]  </TASK>
[   12.106569] 
[   12.120547] Allocated by task 159:
[   12.120936]  kasan_save_stack+0x45/0x70
[   12.121253]  kasan_save_track+0x18/0x40
[   12.121648]  kasan_save_alloc_info+0x3b/0x50
[   12.122013]  __kasan_kmalloc+0xb7/0xc0
[   12.122440]  __kmalloc_node_track_caller_noprof+0x1cb/0x500
[   12.122790]  kmalloc_track_caller_oob_right+0x99/0x520
[   12.123154]  kunit_try_run_case+0x1a5/0x480
[   12.123659]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.124041]  kthread+0x337/0x6f0
[   12.124397]  ret_from_fork+0x116/0x1d0
[   12.124896]  ret_from_fork_asm+0x1a/0x30
[   12.125078] 
[   12.125384] The buggy address belongs to the object at ffff8881025bdd00
[   12.125384]  which belongs to the cache kmalloc-128 of size 128
[   12.126191] The buggy address is located 0 bytes to the right of
[   12.126191]  allocated 120-byte region [ffff8881025bdd00, ffff8881025bdd78)
[   12.127026] 
[   12.127240] The buggy address belongs to the physical page:
[   12.127732] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1025bd
[   12.128067] flags: 0x200000000000000(node=0|zone=2)
[   12.128452] page_type: f5(slab)
[   12.128633] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   12.128973] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   12.129722] page dumped because: kasan: bad access detected
[   12.130257] 
[   12.130439] Memory state around the buggy address:
[   12.130707]  ffff8881025bdc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   12.131317]  ffff8881025bdc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.131714] >ffff8881025bdd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   12.132092]                                                                 ^
[   12.132647]  ffff8881025bdd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.133075]  ffff8881025bde00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.133625] ==================================================================