[-- MARK -- Mon Jan 16 11:20:00 2023] [ 3021.323424] Running test [R:13233633 T:8 - KUNIT - Kernel: 5.14.0-235.1887_748111148.el9.x86_64+debug] [ 3031.500351] # Subtest: bitfields [ 3031.500362] 1..2 [ 3031.502222] ok 1 - test_bitfields_constants [ 3031.503231] ok 2 - test_bitfields_variables [ 3031.503858] ok 1 - bitfields [ 3031.989758] # Subtest: cmdline [ 3031.989771] 1..4 [ 3031.990550] ok 1 - cmdline_test_noint [ 3031.991620] ok 2 - cmdline_test_lead_int [ 3031.992958] ok 3 - cmdline_test_tail_int [ 3031.994106] ok 4 - cmdline_test_range [ 3031.994788] ok 2 - cmdline [ 3032.467172] # Subtest: ext4_inode_test [ 3032.467184] 1..1 [ 3032.468066] # inode_test_xtimestamp_decoding: ok 1 - 1901-12-13 Lower bound of 32bit < 0 timestamp, no extra bits [ 3032.468721] # inode_test_xtimestamp_decoding: ok 2 - 1969-12-31 Upper bound of 32bit < 0 timestamp, no extra bits [ 3032.470266] # inode_test_xtimestamp_decoding: ok 3 - 1970-01-01 Lower bound of 32bit >=0 timestamp, no extra bits [ 3032.471916] # inode_test_xtimestamp_decoding: ok 4 - 2038-01-19 Upper bound of 32bit >=0 timestamp, no extra bits [ 3032.473561] # inode_test_xtimestamp_decoding: ok 5 - 2038-01-19 Lower bound of 32bit <0 timestamp, lo extra sec bit on [ 3032.475135] # inode_test_xtimestamp_decoding: ok 6 - 2106-02-07 Upper bound of 32bit <0 timestamp, lo extra sec bit on [ 3032.476942] # inode_test_xtimestamp_decoding: ok 7 - 2106-02-07 Lower bound of 32bit >=0 timestamp, lo extra sec bit on [ 3032.478836] # inode_test_xtimestamp_decoding: ok 8 - 2174-02-25 Upper bound of 32bit >=0 timestamp, lo extra sec bit on [ 3032.480525] # inode_test_xtimestamp_decoding: ok 9 - 2174-02-25 Lower bound of 32bit <0 timestamp, hi extra sec bit on [ 3032.482216] # inode_test_xtimestamp_decoding: ok 10 - 2242-03-16 Upper bound of 32bit <0 timestamp, hi extra sec bit on [ 3032.483960] # inode_test_xtimestamp_decoding: ok 11 - 2242-03-16 Lower bound of 32bit >=0 timestamp, hi extra sec bit on [ 3032.485670] # inode_test_xtimestamp_decoding: ok 12 - 2310-04-04 Upper bound of 32bit >=0 timestamp, hi extra sec bit on [ 3032.487334] # inode_test_xtimestamp_decoding: ok 13 - 2310-04-04 Upper bound of 32bit>=0 timestamp, hi extra sec bit 1. 1 ns [ 3032.489028] # inode_test_xtimestamp_decoding: ok 14 - 2378-04-22 Lower bound of 32bit>= timestamp. Extra sec bits 1. Max ns [ 3032.490759] # inode_test_xtimestamp_decoding: ok 15 - 2378-04-22 Lower bound of 32bit >=0 timestamp. All extra sec bits on [ 3032.492452] # inode_test_xtimestamp_decoding: ok 16 - 2446-05-10 Upper bound of 32bit >=0 timestamp. All extra sec bits on [ 3032.493871] ok 1 - inode_test_xtimestamp_decoding [ 3032.495257] ok 3 - ext4_inode_test [ 3033.537851] # Subtest: kunit-try-catch-test [ 3033.537862] 1..2 [ 3033.539130] ok 1 - kunit_test_try_catch_successful_try_no_catch [ 3033.540158] ok 2 - kunit_test_try_catch_unsuccessful_try_does_catch [ 3033.540977] ok 4 - kunit-try-catch-test [ 3033.542554] # Subtest: kunit-resource-test [ 3033.542561] 1..7 [ 3033.543446] ok 1 - kunit_resource_test_init_resources [ 3033.544104] ok 2 - kunit_resource_test_alloc_resource [ 3033.545136] ok 3 - kunit_resource_test_destroy_resource [ 3033.546266] ok 4 - kunit_resource_test_cleanup_resources [ 3033.547414] ok 5 - kunit_resource_test_proper_free_ordering [ 3033.548418] ok 6 - kunit_resource_test_static [ 3033.549593] ok 7 - kunit_resource_test_named [ 3033.550187] ok 5 - kunit-resource-test [ 3033.551686] # Subtest: kunit-log-test [ 3033.551693] 1..1 [ 3033.552474] put this in log. [ 3033.552833] this too. [ 3033.553213] add to suite log. [ 3033.553541] along with this. [ 3033.553966] ok 1 - kunit_log_test [ 3033.554351] ok 6 - kunit-log-test [ 3033.555427] # Subtest: kunit_status [ 3033.555433] 1..2 [ 3033.556340] ok 1 - kunit_status_set_failure_test [ 3033.556967] ok 2 - kunit_status_mark_skipped_test [ 3033.557646] ok 7 - kunit_status [ 3033.681057] # Subtest: rtc_lib_test_cases [ 3033.681069] 1..1 [ 3039.112388] ok 1 - rtc_time64_to_tm_test_date_range [ 3039.112816] ok 8 - rtc_lib_test_cases [ 3039.278280] # Subtest: list-kunit-test [ 3039.278292] 1..36 [ 3039.279327] ok 1 - list_test_list_init [ 3039.280304] ok 2 - list_test_list_add [ 3039.281383] ok 3 - list_test_list_add_tail [ 3039.282385] ok 4 - list_test_list_del [ 3039.283591] ok 5 - list_test_list_replace [ 3039.284551] ok 6 - list_test_list_replace_init [ 3039.285859] ok 7 - list_test_list_swap [ 3039.287419] ok 8 - list_test_list_del_init [ 3039.288523] ok 9 - list_test_list_move [ 3039.289686] ok 10 - list_test_list_move_tail [ 3039.290820] ok 11 - list_test_list_bulk_move_tail [ 3039.292158] ok 12 - list_test_list_is_first [ 3039.293570] ok 13 - list_test_list_is_last [ 3039.294799] ok 14 - list_test_list_empty [ 3039.296738] ok 15 - list_test_list_empty_careful [ 3039.297835] ok 16 - list_test_list_rotate_left [ 3039.299573] ok 17 - list_test_list_rotate_to_front [ 3039.300584] ok 18 - list_test_list_is_singular [ 3039.302206] ok 19 - list_test_list_cut_position [ 3039.303517] ok 20 - list_test_list_cut_before [ 3039.304546] ok 21 - list_test_list_splice [ 3039.306168] ok 22 - list_test_list_splice_tail [ 3039.307655] ok 23 - list_test_list_splice_init [ 3039.308730] ok 24 - list_test_list_splice_tail_init [ 3039.310195] ok 25 - list_test_list_entry [ 3039.313281] ok 26 - list_test_list_first_entry [ 3039.314575] ok 27 - list_test_list_last_entry [ 3039.315570] ok 28 - list_test_list_first_entry_or_null [ 3039.316985] ok 29 - list_test_list_next_entry [ 3039.318403] ok 30 - list_test_list_prev_entry [ 3039.319459] ok 31 - list_test_list_for_each [ 3039.320770] ok 32 - list_test_list_for_each_prev [ 3039.321934] ok 33 - list_test_list_for_each_safe [ 3039.323391] ok 34 - list_test_list_for_each_prev_safe [ 3039.324723] ok 35 - list_test_list_for_each_entry [ 3039.326455] ok 36 - list_test_list_for_each_entry_reverse [ 3039.327144] ok 9 - list-kunit-test [ 3039.469153] # Subtest: memcpy [ 3039.469164] 1..4 [ 3039.470089] # memset_test: ok: memset() direct assignment [ 3039.471444] # memset_test: ok: memset() complete overwrite [ 3039.472263] # memset_test: ok: memset() middle overwrite [ 3039.473241] # memset_test: ok: memset() argument side-effects [ 3039.474268] # memset_test: ok: memset() memset_after() [ 3039.475201] # memset_test: ok: memset() memset_startat() [ 3039.476573] ok 1 - memset_test [ 3039.478607] # memcpy_test: ok: memcpy() static initializers [ 3039.480235] # memcpy_test: ok: memcpy() direct assignment [ 3039.481252] # memcpy_test: ok: memcpy() complete overwrite [ 3039.482247] # memcpy_test: ok: memcpy() middle overwrite [ 3039.483319] # memcpy_test: ok: memcpy() argument side-effects [ 3039.486487] ok 2 - memcpy_test [ 3039.488205] # memmove_test: ok: memmove() static initializers [ 3039.489947] # memmove_test: ok: memmove() direct assignment [ 3039.491187] # memmove_test: ok: memmove() complete overwrite [ 3039.492344] # memmove_test: ok: memmove() middle overwrite [ 3039.493331] # memmove_test: ok: memmove() argument side-effects [ 3039.494386] # memmove_test: ok: memmove() overlapping write [ 3039.497411] ok 3 - memmove_test [ 3039.499172] ok 4 - strtomem_test [ 3039.499794] ok 10 - memcpy [ 3039.639581] # Subtest: mptcp-crypto [ 3039.639593] 1..1 [ 3039.641071] ok 1 - mptcp_crypto_test_basic [ 3039.641497] ok 11 - mptcp-crypto [ 3039.776462] # Subtest: mptcp-token [ 3039.776474] 1..4 [ 3039.777696] ok 1 - mptcp_token_test_req_basic [ 3039.779302] ok 2 - mptcp_token_test_msk_basic [ 3039.780729] ok 3 - mptcp_token_test_accept [ 3039.782244] ok 4 - mptcp_token_test_destroyed [ 3039.782861] ok 12 - mptcp-token [ 3040.134226] # Subtest: rational [ 3040.134238] 1..1 [ 3040.135431] # rational_test: ok 1 - Exceeds bounds, semi-convergent term > 1/2 last term [ 3040.136388] # rational_test: ok 2 - Exceeds bounds, semi-convergent term < 1/2 last term [ 3040.137855] # rational_test: ok 3 - Closest to zero [ 3040.139724] # rational_test: ok 4 - Closest to smallest non-zero [ 3040.141116] # rational_test: ok 5 - Use convergent [ 3040.142695] # rational_test: ok 6 - Exact answer [ 3040.143821] # rational_test: ok 7 - Semiconvergent, numerator limit [ 3040.145460] # rational_test: ok 8 - Semiconvergent, denominator limit [ 3040.146503] ok 1 - rational_test [ 3040.147422] ok 13 - rational [ 3040.281289] # Subtest: resource [ 3040.281299] 1..2 [ 3040.282377] ok 1 - resource_test_union [ 3040.283305] ok 2 - resource_test_intersection [ 3040.283831] ok 14 - resource [ 3040.420454] # Subtest: slub_test [ 3040.420464] 1..2 [ 3040.436217] ok 1 - test_clobber_zone [ 3040.444398] ok 2 - test_clobber_redzone_free [ 3040.444997] ok 15 - slub_test [ 3040.958114] # Subtest: snd_soc_tplg_test [ 3040.958126] 1..11 [ 3040.960584] ok 1 - snd_soc_tplg_test_load_with_null_comp [ 3040.962324] ok 2 - snd_soc_tplg_test_load_with_null_ops [ 3040.964409] ok 3 - snd_soc_tplg_test_load_with_null_fw [ 3040.966376] ok 4 - snd_soc_tplg_test_load_empty_tplg [ 3040.968457] ok 5 - snd_soc_tplg_test_load_empty_tplg_bad_magic [ 3040.970676] ok 6 - snd_soc_tplg_test_load_empty_tplg_bad_abi [ 3040.972791] ok 7 - snd_soc_tplg_test_load_empty_tplg_bad_size [ 3040.977699] ok 8 - snd_soc_tplg_test_load_empty_tplg_bad_payload_size [ 3040.979616] ok 9 - snd_soc_tplg_test_load_pcm_tplg [ 3040.983158] ok 10 - snd_soc_tplg_test_load_pcm_tplg_reload_comp [ 3040.987960] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3040.991666] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.056627] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.059254] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.094705] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.097086] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.121596] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.124073] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.166030] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.168606] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.196958] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.200122] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.236589] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.242592] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.262248] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.264612] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.290226] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.292904] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.320117] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.322809] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.348210] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.350535] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.372231] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.374534] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.397965] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.402536] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.435434] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.438138] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.466591] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.469253] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.497721] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.507181] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.522058] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.525076] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.563901] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.566869] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.592885] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.595601] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.618802] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.621524] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.648039] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.650594] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.665406] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.667831] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.703894] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.706542] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.728060] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.730353] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.757492] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.759785] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.798506] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.801013] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.827343] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.829700] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.858988] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.861317] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.886866] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.889456] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.919645] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.923667] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.967491] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.969951] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3041.995417] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3041.997988] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.025297] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.027743] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.046926] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.052321] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.081645] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.092199] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.114255] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.116972] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.155574] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.157881] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.173503] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.175898] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.204586] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.207011] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.231388] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.233652] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.259449] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.261734] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.282953] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.285568] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.313680] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.315984] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.336410] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.338778] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.360332] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.362617] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.403058] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.408454] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.430007] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.432351] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.453079] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.459261] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.476876] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.479190] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.514426] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.520064] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.541523] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.543838] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.566798] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.570688] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.585545] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.587845] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.603160] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.605477] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.635311] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.637577] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.659637] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.661993] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.679820] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.682125] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.707542] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.710552] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.741568] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.743861] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.764993] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.769181] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.801289] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.803571] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.825742] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.828412] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.848083] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.850381] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.873541] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.875968] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.902671] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.909078] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.942680] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.945113] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.960011] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.965690] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3042.983554] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3042.985981] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.007416] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.010242] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.045279] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.047891] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.073129] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.075564] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.090456] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.095949] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.113015] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.115540] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.131494] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.137292] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.153004] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.155296] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.187984] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.190608] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.214816] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.222400] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.254442] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.256779] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.276742] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.279458] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.305955] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.308660] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.324330] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.329947] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.350523] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.352972] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.379144] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.381469] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.411750] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.414103] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.442375] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.444925] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.467909] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.470283] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.494293] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.498688] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.548776] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.551135] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.569933] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.576567] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.596064] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.602039] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.617495] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.623079] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.637783] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.640121] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.661895] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.664202] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.688931] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.691271] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.718476] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.728830] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.746192] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.748508] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.769619] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.771933] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.793006] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.795395] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.823942] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.834555] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.850503] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 3043.852884] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 3043.895163] ok 11 - snd_soc_tplg_test_load_pcm_tplg_reload_card [ 3043.895187] ok 16 - snd_soc_tplg_test [ 3044.093452] # Subtest: soc-utils [ 3044.093464] 1..1 [ 3044.094510] ok 1 - test_tdm_params_to_bclk [ 3044.094878] ok 17 - soc-utils [ 3044.589960] # Subtest: sysctl_test [ 3044.589972] 1..10 [ 3044.592889] ok 1 - sysctl_test_api_dointvec_null_tbl_data [ 3044.593794] ok 2 - sysctl_test_api_dointvec_table_maxlen_unset [ 3044.594882] ok 3 - sysctl_test_api_dointvec_table_len_is_zero [ 3044.596679] ok 4 - sysctl_test_api_dointvec_table_read_but_position_set [ 3044.609123] ok 5 - sysctl_test_dointvec_read_happy_single_positive [ 3044.611707] ok 6 - sysctl_test_dointvec_read_happy_single_negative [ 3044.613226] ok 7 - sysctl_test_dointvec_write_happy_single_positive [ 3044.614534] ok 8 - sysctl_test_dointvec_write_happy_single_negative [ 3044.616189] ok 9 - sysctl_test_api_dointvec_write_single_less_int_min [ 3044.617421] ok 10 - sysctl_test_api_dointvec_write_single_greater_int_max [ 3044.618321] ok 18 - sysctl_test [ 3044.831082] # Subtest: bits-test [ 3044.831093] 1..3 [ 3044.832135] ok 1 - genmask_test [ 3044.835933] ok 2 - genmask_ull_test [ 3044.840228] ok 3 - genmask_input_check_test [ 3044.841029] ok 19 - bits-test [ 3045.674292] # Subtest: kasan [ 3045.674304] 1..55 [ 3045.675441] ================================================================== [ 3045.676626] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 3045.677595] Write of size 1 at addr ffff88804f7eb273 by task kunit_try_catch/118247 [ 3045.678510] [ 3045.678726] CPU: 1 PID: 118247 Comm: kunit_try_catch Kdump: loaded Not tainted 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3045.680058] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3045.680757] Call Trace: [ 3045.681073] [ 3045.681347] ? kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 3045.682006] dump_stack_lvl+0x57/0x81 [ 3045.682470] print_address_description.constprop.0+0x1f/0x1e0 [ 3045.683171] ? kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 3045.683821] print_report.cold+0x5c/0x237 [ 3045.684322] kasan_report+0xc9/0x100 [ 3045.684769] ? kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 3045.685427] kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 3045.686150] ? kmalloc_oob_left+0x2e0/0x2e0 [test_kasan] [ 3045.686824] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 3045.687529] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3045.688215] ? kunit_add_resource+0x197/0x280 [kunit] [ 3045.688839] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.689437] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3045.690058] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.690797] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3045.691423] kthread+0x2a4/0x350 [ 3045.691829] ? kthread_complete_and_exit+0x20/0x20 [ 3045.692421] ret_from_fork+0x1f/0x30 [ 3045.692886] [ 3045.693169] [ 3045.693376] Allocated by task 118247: [ 3045.693829] kasan_save_stack+0x1e/0x40 [ 3045.694313] __kasan_kmalloc+0x81/0xa0 [ 3045.694775] kmalloc_oob_right+0x98/0x510 [test_kasan] [ 3045.695401] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.695998] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.696730] kthread+0x2a4/0x350 [ 3045.697143] ret_from_fork+0x1f/0x30 [ 3045.697585] [ 3045.697791] Last potentially related work creation: [ 3045.698385] kasan_save_stack+0x1e/0x40 [ 3045.698858] __kasan_record_aux_stack+0x96/0xb0 [ 3045.699414] kvfree_call_rcu+0x7d/0x840 [ 3045.699894] drop_sysctl_table+0x338/0x460 [ 3045.700396] unregister_sysctl_table+0x9c/0x180 [ 3045.700956] sysctl_route_net_exit+0x58/0x80 [ 3045.701484] ops_exit_list+0x99/0x170 [ 3045.701941] cleanup_net+0x42b/0x9a0 [ 3045.702384] process_one_work+0x8e2/0x1520 [ 3045.702889] worker_thread+0x59e/0xf90 [ 3045.703352] kthread+0x2a4/0x350 [ 3045.703757] ret_from_fork+0x1f/0x30 [ 3045.704203] [ 3045.704410] The buggy address belongs to the object at ffff88804f7eb200 [ 3045.704410] which belongs to the cache kmalloc-128 of size 128 [ 3045.705881] The buggy address is located 115 bytes inside of [ 3045.705881] 128-byte region [ffff88804f7eb200, ffff88804f7eb280) [ 3045.707256] [ 3045.707463] The buggy address belongs to the physical page: [ 3045.708151] page:0000000002fcd5d9 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f7eb [ 3045.709268] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3045.710092] raw: 000fffffc0000200 ffffea00013bf040 dead000000000007 ffff8881000418c0 [ 3045.711017] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3045.711947] page dumped because: kasan: bad access detected [ 3045.712614] [ 3045.712822] Memory state around the buggy address: [ 3045.713419] ffff88804f7eb100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3045.714286] ffff88804f7eb180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.715148] >ffff88804f7eb200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 3045.716014] ^ [ 3045.716828] ffff88804f7eb280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.717695] ffff88804f7eb300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 3045.718557] ================================================================== [ 3045.719547] Disabling lock debugging due to kernel taint [ 3045.720217] ================================================================== [ 3045.721085] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 3045.722053] Write of size 1 at addr ffff88804f7eb278 by task kunit_try_catch/118247 [ 3045.722967] [ 3045.723176] CPU: 1 PID: 118247 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3045.724793] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3045.725497] Call Trace: [ 3045.725809] [ 3045.726090] ? kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 3045.726741] dump_stack_lvl+0x57/0x81 [ 3045.727200] print_address_description.constprop.0+0x1f/0x1e0 [ 3045.727899] ? kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 3045.728551] print_report.cold+0x5c/0x237 [ 3045.729052] kasan_report+0xc9/0x100 [ 3045.729496] ? kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 3045.730152] kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 3045.730784] ? kmalloc_oob_left+0x2e0/0x2e0 [test_kasan] [ 3045.731435] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 3045.732137] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3045.732812] ? kunit_add_resource+0x197/0x280 [kunit] [ 3045.733438] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.734038] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3045.734653] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.735391] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3045.736019] kthread+0x2a4/0x350 [ 3045.736425] ? kthread_complete_and_exit+0x20/0x20 [ 3045.737012] ret_from_fork+0x1f/0x30 [ 3045.737465] [ 3045.737748] [ 3045.737958] Allocated by task 118247: [ 3045.738408] kasan_save_stack+0x1e/0x40 [ 3045.738885] __kasan_kmalloc+0x81/0xa0 [ 3045.739345] kmalloc_oob_right+0x98/0x510 [test_kasan] [ 3045.739973] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.740570] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.741345] kthread+0x2a4/0x350 [ 3045.741749] ret_from_fork+0x1f/0x30 [ 3045.742194] [ 3045.742400] Last potentially related work creation: [ 3045.742990] kasan_save_stack+0x1e/0x40 [ 3045.743463] __kasan_record_aux_stack+0x96/0xb0 [ 3045.744022] kvfree_call_rcu+0x7d/0x840 [ 3045.744494] drop_sysctl_table+0x338/0x460 [ 3045.745000] unregister_sysctl_table+0x9c/0x180 [ 3045.745553] sysctl_route_net_exit+0x58/0x80 [ 3045.746080] ops_exit_list+0x99/0x170 [ 3045.746530] cleanup_net+0x42b/0x9a0 [ 3045.746974] process_one_work+0x8e2/0x1520 [ 3045.747475] worker_thread+0x59e/0xf90 [ 3045.747941] kthread+0x2a4/0x350 [ 3045.748346] ret_from_fork+0x1f/0x30 [ 3045.748791] [ 3045.749010] The buggy address belongs to the object at ffff88804f7eb200 [ 3045.749010] which belongs to the cache kmalloc-128 of size 128 [ 3045.750474] The buggy address is located 120 bytes inside of [ 3045.750474] 128-byte region [ffff88804f7eb200, ffff88804f7eb280) [ 3045.751865] [ 3045.752072] The buggy address belongs to the physical page: [ 3045.752739] page:0000000002fcd5d9 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f7eb [ 3045.753860] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3045.754682] raw: 000fffffc0000200 ffffea00013bf040 dead000000000007 ffff8881000418c0 [ 3045.755604] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3045.756530] page dumped because: kasan: bad access detected [ 3045.757210] [ 3045.757417] Memory state around the buggy address: [ 3045.758001] ffff88804f7eb100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3045.758864] ffff88804f7eb180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.759729] >ffff88804f7eb200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 3045.760591] ^ [ 3045.761456] ffff88804f7eb280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.762321] ffff88804f7eb300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 3045.763189] ================================================================== [ 3045.764079] ================================================================== [ 3045.764954] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 3045.765915] Read of size 1 at addr ffff88804f7eb280 by task kunit_try_catch/118247 [ 3045.766815] [ 3045.767028] CPU: 1 PID: 118247 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3045.768652] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3045.769345] Call Trace: [ 3045.769657] [ 3045.769937] ? kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 3045.770648] dump_stack_lvl+0x57/0x81 [ 3045.771126] print_address_description.constprop.0+0x1f/0x1e0 [ 3045.771834] ? kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 3045.772486] print_report.cold+0x5c/0x237 [ 3045.772987] kasan_report+0xc9/0x100 [ 3045.773433] ? kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 3045.774100] kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 3045.774756] ? kmalloc_oob_left+0x2e0/0x2e0 [test_kasan] [ 3045.775409] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 3045.776111] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3045.776785] ? kunit_add_resource+0x197/0x280 [kunit] [ 3045.777407] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.778009] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3045.778626] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.779368] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3045.780000] kthread+0x2a4/0x350 [ 3045.780413] ? kthread_complete_and_exit+0x20/0x20 [ 3045.781004] ret_from_fork+0x1f/0x30 [ 3045.781475] [ 3045.781759] [ 3045.781971] Allocated by task 118247: [ 3045.782424] kasan_save_stack+0x1e/0x40 [ 3045.782899] __kasan_kmalloc+0x81/0xa0 [ 3045.783401] kmalloc_oob_right+0x98/0x510 [test_kasan] [ 3045.784102] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.784743] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.785485] kthread+0x2a4/0x350 [ 3045.785924] ret_from_fork+0x1f/0x30 [ 3045.786418] [ 3045.786649] Last potentially related work creation: [ 3045.787279] kasan_save_stack+0x1e/0x40 [ 3045.787749] __kasan_record_aux_stack+0x96/0xb0 [ 3045.788309] kvfree_call_rcu+0x7d/0x840 [ 3045.788837] drop_sysctl_table+0x338/0x460 [ 3045.789395] unregister_sysctl_table+0x9c/0x180 [ 3045.789982] sysctl_route_net_exit+0x58/0x80 [ 3045.790511] ops_exit_list+0x99/0x170 [ 3045.790969] cleanup_net+0x42b/0x9a0 [ 3045.791413] process_one_work+0x8e2/0x1520 [ 3045.791919] worker_thread+0x59e/0xf90 [ 3045.792381] kthread+0x2a4/0x350 [ 3045.792787] ret_from_fork+0x1f/0x30 [ 3045.793235] [ 3045.793442] The buggy address belongs to the object at ffff88804f7eb200 [ 3045.793442] which belongs to the cache kmalloc-128 of size 128 [ 3045.794996] The buggy address is located 0 bytes to the right of [ 3045.794996] 128-byte region [ffff88804f7eb200, ffff88804f7eb280) [ 3045.796468] [ 3045.796675] The buggy address belongs to the physical page: [ 3045.797350] page:0000000002fcd5d9 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f7eb [ 3045.798457] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3045.799283] raw: 000fffffc0000200 ffffea00013bf040 dead000000000007 ffff8881000418c0 [ 3045.800215] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3045.801139] page dumped because: kasan: bad access detected [ 3045.801804] [ 3045.802016] Memory state around the buggy address: [ 3045.802598] ffff88804f7eb180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.803461] ffff88804f7eb200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 3045.804329] >ffff88804f7eb280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.805232] ^ [ 3045.805635] ffff88804f7eb300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 3045.806499] ffff88804f7eb380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.807393] ================================================================== [ 3045.809550] ok 1 - kmalloc_oob_right [ 3045.809821] ================================================================== [ 3045.811208] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 3045.812170] Read of size 1 at addr ffff88803539301f by task kunit_try_catch/118248 [ 3045.813080] [ 3045.813289] CPU: 1 PID: 118248 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3045.814914] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3045.815608] Call Trace: [ 3045.815925] [ 3045.816201] ? kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 3045.816852] dump_stack_lvl+0x57/0x81 [ 3045.817310] print_address_description.constprop.0+0x1f/0x1e0 [ 3045.818017] ? kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 3045.818662] print_report.cold+0x5c/0x237 [ 3045.819163] kasan_report+0xc9/0x100 [ 3045.819612] ? kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 3045.820262] kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 3045.820894] ? kmalloc_pagealloc_oob_right+0x290/0x290 [test_kasan] [ 3045.821706] ? do_raw_spin_trylock+0xb5/0x180 [ 3045.822337] ? do_raw_spin_lock+0x270/0x270 [ 3045.822865] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3045.823538] ? kunit_add_resource+0x197/0x280 [kunit] [ 3045.824164] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.824762] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3045.825382] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.826124] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3045.826748] kthread+0x2a4/0x350 [ 3045.827163] ? kthread_complete_and_exit+0x20/0x20 [ 3045.827745] ret_from_fork+0x1f/0x30 [ 3045.828204] [ 3045.828486] [ 3045.828693] Allocated by task 0: [ 3045.829102] (stack is not available) [ 3045.829545] [ 3045.829753] The buggy address belongs to the object at ffff888035393000 [ 3045.829753] which belongs to the cache kmalloc-16 of size 16 [ 3045.831203] The buggy address is located 15 bytes to the right of [ 3045.831203] 16-byte region [ffff888035393000, ffff888035393010) [ 3045.832618] [ 3045.832831] The buggy address belongs to the physical page: [ 3045.833501] page:0000000010100da3 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888035393b60 pfn:0x35393 [ 3045.834753] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3045.835581] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 3045.836567] raw: ffff888035393b60 000000008080007f 00000001ffffffff 0000000000000000 [ 3045.837564] page dumped because: kasan: bad access detected [ 3045.838236] [ 3045.838443] Memory state around the buggy address: [ 3045.839030] ffff888035392f00: 00 fc fc 00 00 00 00 00 fc fc 00 00 00 00 00 fc [ 3045.839898] ffff888035392f80: fc 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc fc [ 3045.840784] >ffff888035393000: fb fb fc fc 00 07 fc fc 00 00 fc fc 00 00 fc fc [ 3045.841653] ^ [ 3045.842149] ffff888035393080: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 3045.843020] ffff888035393100: fa fb fc fc 00 00 fc fc fb fb fc fc fa fb fc fc [ 3045.843887] ================================================================== [ 3045.845487] ok 2 - kmalloc_oob_left [ 3045.858591] ================================================================== [ 3045.859984] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 3045.861004] Read of size 1 at addr ffff88805fa35000 by task kunit_try_catch/118249 [ 3045.861916] [ 3045.862126] CPU: 0 PID: 118249 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3045.863745] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3045.864445] Call Trace: [ 3045.864756] [ 3045.865033] ? kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 3045.865737] dump_stack_lvl+0x57/0x81 [ 3045.866196] print_address_description.constprop.0+0x1f/0x1e0 [ 3045.866897] ? kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 3045.867600] print_report.cold+0x5c/0x237 [ 3045.868098] kasan_report+0xc9/0x100 [ 3045.868542] ? kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 3045.869253] kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 3045.869949] ? pagealloc_uaf+0x2f0/0x2f0 [test_kasan] [ 3045.870562] ? do_raw_spin_trylock+0xb5/0x180 [ 3045.871105] ? do_raw_spin_lock+0x270/0x270 [ 3045.871618] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3045.872293] ? kunit_add_resource+0x197/0x280 [kunit] [ 3045.872917] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.873513] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3045.874133] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.874871] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3045.875495] kthread+0x2a4/0x350 [ 3045.875905] ? kthread_complete_and_exit+0x20/0x20 [ 3045.876487] ret_from_fork+0x1f/0x30 [ 3045.876946] [ 3045.877227] [ 3045.877432] Allocated by task 118249: [ 3045.877886] kasan_save_stack+0x1e/0x40 [ 3045.878358] __kasan_kmalloc+0x81/0xa0 [ 3045.878817] kmalloc_node_oob_right+0x9a/0x2e0 [test_kasan] [ 3045.879489] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.880084] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.880817] kthread+0x2a4/0x350 [ 3045.881225] ret_from_fork+0x1f/0x30 [ 3045.881667] [ 3045.881876] The buggy address belongs to the object at ffff88805fa34000 [ 3045.881876] which belongs to the cache kmalloc-4k of size 4096 [ 3045.883330] The buggy address is located 0 bytes to the right of [ 3045.883330] 4096-byte region [ffff88805fa34000, ffff88805fa35000) [ 3045.884748] [ 3045.884957] The buggy address belongs to the physical page: [ 3045.885618] page:000000008af48225 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5fa30 [ 3045.886784] head:000000008af48225 order:3 compound_mapcount:0 compound_pincount:0 [ 3045.887774] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3045.888649] raw: 000fffffc0010200 0000000000000000 dead000000000001 ffff888100042140 [ 3045.889566] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000 [ 3045.890479] page dumped because: kasan: bad access detected [ 3045.891145] [ 3045.891352] Memory state around the buggy address: [ 3045.891936] ffff88805fa34f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3045.892794] ffff88805fa34f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3045.893655] >ffff88805fa35000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.894516] ^ [ 3045.894963] ffff88805fa35080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.895925] ffff88805fa35100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3045.896779] ================================================================== [ 3045.897725] ok 3 - kmalloc_node_oob_right [ 3045.904982] ================================================================== [ 3045.906419] BUG: KASAN: slab-out-of-bounds in kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 3045.907490] Write of size 1 at addr ffff8880609de00a by task kunit_try_catch/118250 [ 3045.908397] [ 3045.908604] CPU: 0 PID: 118250 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3045.910213] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3045.910915] Call Trace: [ 3045.911225] [ 3045.911543] ? kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 3045.912390] dump_stack_lvl+0x57/0x81 [ 3045.912893] print_address_description.constprop.0+0x1f/0x1e0 [ 3045.913588] ? kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 3045.914339] print_report.cold+0x5c/0x237 [ 3045.914836] kasan_report+0xc9/0x100 [ 3045.915288] ? kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 3045.916043] kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 3045.916776] ? kmalloc_pagealloc_uaf+0x280/0x280 [test_kasan] [ 3045.917474] ? do_raw_spin_trylock+0xb5/0x180 [ 3045.918012] ? do_raw_spin_lock+0x270/0x270 [ 3045.918523] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3045.919210] ? kunit_add_resource+0x197/0x280 [kunit] [ 3045.919830] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.920422] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3045.921042] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.921772] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3045.922397] kthread+0x2a4/0x350 [ 3045.922800] ? kthread_complete_and_exit+0x20/0x20 [ 3045.923397] ret_from_fork+0x1f/0x30 [ 3045.923850] [ 3045.924131] [ 3045.924336] The buggy address belongs to the physical page: [ 3045.925002] page:00000000a4a92d50 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x609dc [ 3045.926097] head:00000000a4a92d50 order:2 compound_mapcount:0 compound_pincount:0 [ 3045.926997] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3045.927808] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3045.928723] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3045.929638] page dumped because: kasan: bad access detected [ 3045.930303] [ 3045.930507] Memory state around the buggy address: [ 3045.931088] ffff8880609ddf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3045.931949] ffff8880609ddf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3045.932800] >ffff8880609de000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3045.933657] ^ [ 3045.934092] ffff8880609de080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3045.934951] ffff8880609de100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3045.935803] ================================================================== [ 3045.936844] ok 4 - kmalloc_pagealloc_oob_right [ 3045.943561] ================================================================== [ 3045.945055] BUG: KASAN: use-after-free in kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 3045.946141] Read of size 1 at addr ffff888006614000 by task kunit_try_catch/118251 [ 3045.947046] [ 3045.947255] CPU: 1 PID: 118251 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3045.948877] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3045.949569] Call Trace: [ 3045.949884] [ 3045.950161] ? kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 3045.950865] dump_stack_lvl+0x57/0x81 [ 3045.951322] print_address_description.constprop.0+0x1f/0x1e0 [ 3045.952021] ? kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 3045.952720] print_report.cold+0x5c/0x237 [ 3045.953221] kasan_report+0xc9/0x100 [ 3045.953669] ? kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 3045.954376] kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 3045.955056] ? kmalloc_pagealloc_invalid_free+0x250/0x250 [test_kasan] [ 3045.955843] ? do_raw_spin_trylock+0xb5/0x180 [ 3045.956384] ? do_raw_spin_lock+0x270/0x270 [ 3045.956906] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3045.957581] ? kunit_add_resource+0x197/0x280 [kunit] [ 3045.958207] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.958805] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3045.959431] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.960170] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3045.960796] kthread+0x2a4/0x350 [ 3045.961209] ? kthread_complete_and_exit+0x20/0x20 [ 3045.961797] ret_from_fork+0x1f/0x30 [ 3045.962256] [ 3045.962539] [ 3045.962747] The buggy address belongs to the physical page: [ 3045.963424] page:00000000279e38d5 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3045.964514] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 3045.965291] raw: 000fffffc0000000 ffffea0001956908 ffff888104800270 0000000000000000 [ 3045.966213] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 3045.967133] page dumped because: kasan: bad access detected [ 3045.967799] [ 3045.968013] Memory state around the buggy address: [ 3045.968595] ffff888006613f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3045.969464] ffff888006613f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3045.970332] >ffff888006614000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3045.971297] ^ [ 3045.971749] ffff888006614080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3045.972650] ffff888006614100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3045.973516] ================================================================== [ 3045.977524] ok 5 - kmalloc_pagealloc_uaf [ 3045.978185] ================================================================== [ 3045.979624] BUG: KASAN: double-free or invalid-free in kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 3045.980822] [ 3045.981031] CPU: 1 PID: 118252 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3045.982647] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3045.983343] Call Trace: [ 3045.983654] [ 3045.983933] dump_stack_lvl+0x57/0x81 [ 3045.984389] print_address_description.constprop.0+0x1f/0x1e0 [ 3045.985107] print_report.cold+0x5c/0x237 [ 3045.985601] ? kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 3045.986392] ? kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 3045.987232] kasan_report_invalid_free+0x99/0xc0 [ 3045.987870] ? kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 3045.988696] kfree+0x2ab/0x3c0 [ 3045.989094] kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 3045.989869] ? kmalloc_large_oob_right+0x2b0/0x2b0 [test_kasan] [ 3045.990588] ? do_raw_spin_trylock+0xb5/0x180 [ 3045.991131] ? do_raw_spin_lock+0x270/0x270 [ 3045.991649] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3045.992329] ? kunit_add_resource+0x197/0x280 [kunit] [ 3045.992955] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3045.993554] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3045.994179] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3045.994934] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3045.995631] kthread+0x2a4/0x350 [ 3045.996088] ? kthread_complete_and_exit+0x20/0x20 [ 3045.996694] ret_from_fork+0x1f/0x30 [ 3045.997152] [ 3045.997435] [ 3045.997643] The buggy address belongs to the physical page: [ 3045.998313] page:00000000279e38d5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3045.999400] head:00000000279e38d5 order:2 compound_mapcount:0 compound_pincount:0 [ 3046.000297] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.001120] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3046.002043] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3046.002968] page dumped because: kasan: bad access detected [ 3046.003634] [ 3046.003845] Memory state around the buggy address: [ 3046.004457] ffff888006613f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.005324] ffff888006613f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.006191] >ffff888006614000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.007055] ^ [ 3046.007458] ffff888006614080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.008321] ffff888006614100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.009185] ================================================================== [ 3046.013254] ok 6 - kmalloc_pagealloc_invalid_free [ 3046.020009] ok 7 - pagealloc_oob_right # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 3046.024585] ================================================================== [ 3046.026523] BUG: KASAN: use-after-free in pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 3046.027418] Read of size 1 at addr ffff888034700000 by task kunit_try_catch/118254 [ 3046.028322] [ 3046.028529] CPU: 1 PID: 118254 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.030147] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.030846] Call Trace: [ 3046.031159] [ 3046.031434] ? pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 3046.032056] dump_stack_lvl+0x57/0x81 [ 3046.032514] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.033220] ? pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 3046.033840] print_report.cold+0x5c/0x237 [ 3046.034337] kasan_report+0xc9/0x100 [ 3046.034786] ? pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 3046.035410] pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 3046.036011] ? krealloc_more_oob+0x10/0x10 [test_kasan] [ 3046.036646] ? do_raw_spin_trylock+0xb5/0x180 [ 3046.037235] ? do_raw_spin_lock+0x270/0x270 [ 3046.037820] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.038567] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.039206] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.039810] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.040426] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.041168] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.041793] kthread+0x2a4/0x350 [ 3046.042206] ? kthread_complete_and_exit+0x20/0x20 [ 3046.042818] ret_from_fork+0x1f/0x30 [ 3046.043328] [ 3046.043643] [ 3046.043878] The buggy address belongs to the physical page: [ 3046.044565] page:00000000fbff1c03 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x34700 [ 3046.045762] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 3046.046611] raw: 000fffffc0000000 ffffea0000905c08 ffff88813ffd5aa0 0000000000000000 [ 3046.047530] raw: 0000000000000000 0000000000000004 00000000ffffff7f 0000000000000000 [ 3046.048451] page dumped because: kasan: bad access detected [ 3046.049118] [ 3046.049325] Memory state around the buggy address: [ 3046.049906] ffff8880346fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.050772] ffff8880346fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.051647] >ffff888034700000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3046.052515] ^ [ 3046.052923] ffff888034700080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3046.053783] ffff888034700100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3046.054654] ================================================================== [ 3046.057741] ok 8 - pagealloc_uaf [ 3046.069598] ================================================================== [ 3046.070953] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 3046.071981] Write of size 1 at addr ffff88810165df00 by task kunit_try_catch/118255 [ 3046.072889] [ 3046.073097] CPU: 0 PID: 118255 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.074713] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.075420] Call Trace: [ 3046.075732] [ 3046.076013] ? kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 3046.076730] dump_stack_lvl+0x57/0x81 [ 3046.077188] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.077889] ? kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 3046.078600] print_report.cold+0x5c/0x237 [ 3046.079098] kasan_report+0xc9/0x100 [ 3046.079544] ? kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 3046.080264] kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 3046.080965] ? kmalloc_oob_16+0x3b0/0x3b0 [test_kasan] [ 3046.081587] ? do_raw_spin_trylock+0xb5/0x180 [ 3046.082130] ? do_raw_spin_lock+0x270/0x270 [ 3046.082642] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.083318] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.083999] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.084658] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.085279] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.086112] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.086813] kthread+0x2a4/0x350 [ 3046.087274] ? kthread_complete_and_exit+0x20/0x20 [ 3046.087929] ret_from_fork+0x1f/0x30 [ 3046.088436] [ 3046.088750] [ 3046.088959] Allocated by task 118255: [ 3046.089407] kasan_save_stack+0x1e/0x40 [ 3046.089882] __kasan_kmalloc+0x81/0xa0 [ 3046.090343] kmalloc_large_oob_right+0x98/0x2b0 [test_kasan] [ 3046.091041] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.091631] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.092365] kthread+0x2a4/0x350 [ 3046.092766] ret_from_fork+0x1f/0x30 [ 3046.093214] [ 3046.093419] The buggy address belongs to the object at ffff88810165c000 [ 3046.093419] which belongs to the cache kmalloc-8k of size 8192 [ 3046.094877] The buggy address is located 7936 bytes inside of [ 3046.094877] 8192-byte region [ffff88810165c000, ffff88810165e000) [ 3046.096396] [ 3046.096639] The buggy address belongs to the physical page: [ 3046.097306] page:00000000fd2f4cf2 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101658 [ 3046.098410] head:00000000fd2f4cf2 order:3 compound_mapcount:0 compound_pincount:0 [ 3046.099309] flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) [ 3046.100192] raw: 0017ffffc0010200 ffffea00012e3200 dead000000000003 ffff888100042280 [ 3046.101112] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 3046.102029] page dumped because: kasan: bad access detected [ 3046.102786] [ 3046.103023] Memory state around the buggy address: [ 3046.103635] ffff88810165de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.104503] ffff88810165de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.105363] >ffff88810165df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.106221] ^ [ 3046.106623] ffff88810165df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.107485] ffff88810165e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.108404] ================================================================== [ 3046.109462] ok 9 - kmalloc_large_oob_right [ 3046.109761] ================================================================== [ 3046.111360] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.112512] Write of size 1 at addr ffff888026a020eb by task kunit_try_catch/118256 [ 3046.113527] [ 3046.113757] CPU: 0 PID: 118256 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.115566] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.116339] Call Trace: [ 3046.116686] [ 3046.116997] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.117809] dump_stack_lvl+0x57/0x81 [ 3046.118284] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.118980] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.119709] print_report.cold+0x5c/0x237 [ 3046.120210] kasan_report+0xc9/0x100 [ 3046.120657] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.121387] krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.122097] ? krealloc_less_oob+0x10/0x10 [test_kasan] [ 3046.122727] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.123306] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.123884] ? lock_acquire+0x4ea/0x620 [ 3046.124356] ? rcu_read_unlock+0x40/0x40 [ 3046.124845] ? rcu_read_unlock+0x40/0x40 [ 3046.125327] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.125905] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.126578] ? do_raw_spin_lock+0x270/0x270 [ 3046.127097] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.127841] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.128449] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.129069] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.129663] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.130285] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.131026] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.131646] kthread+0x2a4/0x350 [ 3046.132055] ? kthread_complete_and_exit+0x20/0x20 [ 3046.132639] ret_from_fork+0x1f/0x30 [ 3046.133097] [ 3046.133378] [ 3046.133584] Allocated by task 118256: [ 3046.134039] kasan_save_stack+0x1e/0x40 [ 3046.134510] __kasan_krealloc+0xee/0x160 [ 3046.134998] krealloc+0x50/0xe0 [ 3046.135397] krealloc_more_oob_helper+0x1d5/0x610 [test_kasan] [ 3046.136107] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.136698] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.137430] kthread+0x2a4/0x350 [ 3046.137876] ret_from_fork+0x1f/0x30 [ 3046.138370] [ 3046.138602] The buggy address belongs to the object at ffff888026a02000 [ 3046.138602] which belongs to the cache kmalloc-256 of size 256 [ 3046.140100] The buggy address is located 235 bytes inside of [ 3046.140100] 256-byte region [ffff888026a02000, ffff888026a02100) [ 3046.141478] [ 3046.141685] The buggy address belongs to the physical page: [ 3046.142350] page:00000000db96b08c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26a02 [ 3046.143445] head:00000000db96b08c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.144329] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.145203] raw: 000fffffc0010200 ffffea00009ac500 dead000000000004 ffff888100041b40 [ 3046.146184] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3046.147184] page dumped because: kasan: bad access detected [ 3046.147850] [ 3046.148055] Memory state around the buggy address: [ 3046.148634] ffff888026a01f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3046.149493] ffff888026a02000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.150352] >ffff888026a02080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc [ 3046.151212] ^ [ 3046.151997] ffff888026a02100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.152857] ffff888026a02180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.153717] ================================================================== [ 3046.154705] ================================================================== [ 3046.155574] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.156609] Write of size 1 at addr ffff888026a020f0 by task kunit_try_catch/118256 [ 3046.157515] [ 3046.157721] CPU: 0 PID: 118256 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.159326] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.160019] Call Trace: [ 3046.160328] [ 3046.160601] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.161329] dump_stack_lvl+0x57/0x81 [ 3046.161781] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.162476] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.163205] print_report.cold+0x5c/0x237 [ 3046.163696] kasan_report+0xc9/0x100 [ 3046.164160] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.164892] krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.165598] ? krealloc_less_oob+0x10/0x10 [test_kasan] [ 3046.166232] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.166810] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.167383] ? lock_acquire+0x4ea/0x620 [ 3046.167859] ? rcu_read_unlock+0x40/0x40 [ 3046.168338] ? rcu_read_unlock+0x40/0x40 [ 3046.168821] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.169393] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.170070] ? do_raw_spin_lock+0x270/0x270 [ 3046.170580] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.171317] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.171925] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.172542] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.173141] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.173755] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.174491] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.175115] kthread+0x2a4/0x350 [ 3046.175517] ? kthread_complete_and_exit+0x20/0x20 [ 3046.176102] ret_from_fork+0x1f/0x30 [ 3046.176556] [ 3046.176843] [ 3046.177049] Allocated by task 118256: [ 3046.177500] kasan_save_stack+0x1e/0x40 [ 3046.177977] __kasan_krealloc+0xee/0x160 [ 3046.178457] krealloc+0x50/0xe0 [ 3046.178857] krealloc_more_oob_helper+0x1d5/0x610 [test_kasan] [ 3046.179560] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.180156] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.180898] kthread+0x2a4/0x350 [ 3046.181306] ret_from_fork+0x1f/0x30 [ 3046.181749] [ 3046.181960] The buggy address belongs to the object at ffff888026a02000 [ 3046.181960] which belongs to the cache kmalloc-256 of size 256 [ 3046.183420] The buggy address is located 240 bytes inside of [ 3046.183420] 256-byte region [ffff888026a02000, ffff888026a02100) [ 3046.184791] [ 3046.185005] The buggy address belongs to the physical page: [ 3046.185666] page:00000000db96b08c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26a02 [ 3046.186763] head:00000000db96b08c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.187652] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.188615] raw: 000fffffc0010200 ffffea00009ac500 dead000000000004 ffff888100041b40 [ 3046.189604] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3046.190522] page dumped because: kasan: bad access detected [ 3046.191190] [ 3046.191395] Memory state around the buggy address: [ 3046.191977] ffff888026a01f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3046.192837] ffff888026a02000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.193695] >ffff888026a02080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc [ 3046.194557] ^ [ 3046.195377] ffff888026a02100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.196288] ffff888026a02180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.197234] ================================================================== [ 3046.198161] ok 10 - krealloc_more_oob [ 3046.203004] ================================================================== [ 3046.204398] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.205447] Write of size 1 at addr ffff888003c556c9 by task kunit_try_catch/118257 [ 3046.206364] [ 3046.206574] CPU: 1 PID: 118257 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.208193] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.208895] Call Trace: [ 3046.209207] [ 3046.209481] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.210218] dump_stack_lvl+0x57/0x81 [ 3046.210673] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.211376] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.212103] print_report.cold+0x5c/0x237 [ 3046.212596] kasan_report+0xc9/0x100 [ 3046.213048] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.213779] krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.214493] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.215105] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.215679] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.216268] ? lock_acquire+0x4ea/0x620 [ 3046.216740] ? rcu_read_unlock+0x40/0x40 [ 3046.217227] ? rcu_read_unlock+0x40/0x40 [ 3046.217710] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.218293] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.218973] ? do_raw_spin_lock+0x270/0x270 [ 3046.219486] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.220241] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.220850] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.221470] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.222070] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.222688] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.223427] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.224055] kthread+0x2a4/0x350 [ 3046.224459] ? kthread_complete_and_exit+0x20/0x20 [ 3046.225048] ret_from_fork+0x1f/0x30 [ 3046.225501] [ 3046.225784] [ 3046.225996] Allocated by task 118257: [ 3046.226449] kasan_save_stack+0x1e/0x40 [ 3046.226922] __kasan_krealloc+0xee/0x160 [ 3046.227406] krealloc+0x50/0xe0 [ 3046.227807] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 3046.228509] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.229120] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.229904] kthread+0x2a4/0x350 [ 3046.230332] ret_from_fork+0x1f/0x30 [ 3046.230779] [ 3046.230992] The buggy address belongs to the object at ffff888003c55600 [ 3046.230992] which belongs to the cache kmalloc-256 of size 256 [ 3046.232461] The buggy address is located 201 bytes inside of [ 3046.232461] 256-byte region [ffff888003c55600, ffff888003c55700) [ 3046.233842] [ 3046.234050] The buggy address belongs to the physical page: [ 3046.234719] page:0000000059ec380c refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888003c54e00 pfn:0x3c54 [ 3046.235991] head:0000000059ec380c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.236884] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.237761] raw: 000fffffc0010200 ffffea000133a200 dead000000000005 ffff888100041b40 [ 3046.238760] raw: ffff888003c54e00 000000008010000d 00000001ffffffff 0000000000000000 [ 3046.239767] page dumped because: kasan: bad access detected [ 3046.240450] [ 3046.240657] Memory state around the buggy address: [ 3046.241241] ffff888003c55580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.242103] ffff888003c55600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.242966] >ffff888003c55680: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 3046.243828] ^ [ 3046.244496] ffff888003c55700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.245358] ffff888003c55780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.246222] ================================================================== [ 3046.247350] ================================================================== [ 3046.248235] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.249276] Write of size 1 at addr ffff888003c556d0 by task kunit_try_catch/118257 [ 3046.250193] [ 3046.250402] CPU: 1 PID: 118257 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.252026] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.252727] Call Trace: [ 3046.253045] [ 3046.253321] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.254056] dump_stack_lvl+0x57/0x81 [ 3046.254512] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.255215] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.255947] print_report.cold+0x5c/0x237 [ 3046.256443] kasan_report+0xc9/0x100 [ 3046.256896] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.257626] krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.258344] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.258957] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.259534] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.260123] ? lock_acquire+0x4ea/0x620 [ 3046.260599] ? rcu_read_unlock+0x40/0x40 [ 3046.261088] ? rcu_read_unlock+0x40/0x40 [ 3046.261571] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.262155] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.262836] ? do_raw_spin_lock+0x270/0x270 [ 3046.263353] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.264104] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.264711] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.265342] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.265943] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.266563] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.267305] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.267948] kthread+0x2a4/0x350 [ 3046.268378] ? kthread_complete_and_exit+0x20/0x20 [ 3046.268971] ret_from_fork+0x1f/0x30 [ 3046.269427] [ 3046.269711] [ 3046.269924] Allocated by task 118257: [ 3046.270378] kasan_save_stack+0x1e/0x40 [ 3046.270854] __kasan_krealloc+0xee/0x160 [ 3046.271336] krealloc+0x50/0xe0 [ 3046.271734] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 3046.272479] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.273080] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.273819] kthread+0x2a4/0x350 [ 3046.274226] ret_from_fork+0x1f/0x30 [ 3046.274668] [ 3046.274878] The buggy address belongs to the object at ffff888003c55600 [ 3046.274878] which belongs to the cache kmalloc-256 of size 256 [ 3046.276347] The buggy address is located 208 bytes inside of [ 3046.276347] 256-byte region [ffff888003c55600, ffff888003c55700) [ 3046.277731] [ 3046.277941] The buggy address belongs to the physical page: [ 3046.278609] page:0000000059ec380c refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888003c54e00 pfn:0x3c54 [ 3046.279856] head:0000000059ec380c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.280798] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.281696] raw: 000fffffc0010200 ffffea000133a200 dead000000000005 ffff888100041b40 [ 3046.282619] raw: ffff888003c54e00 000000008010000d 00000001ffffffff 0000000000000000 [ 3046.283542] page dumped because: kasan: bad access detected [ 3046.284213] [ 3046.284419] Memory state around the buggy address: [ 3046.285074] ffff888003c55580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.286018] ffff888003c55600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.286886] >ffff888003c55680: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 3046.287748] ^ [ 3046.288498] ffff888003c55700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.289467] ffff888003c55780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.290356] ================================================================== [ 3046.291246] ================================================================== [ 3046.292116] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.293159] Write of size 1 at addr ffff888003c556da by task kunit_try_catch/118257 [ 3046.294072] [ 3046.294279] CPU: 1 PID: 118257 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.296049] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.296791] Call Trace: [ 3046.297142] [ 3046.297449] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.298211] dump_stack_lvl+0x57/0x81 [ 3046.298668] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.299371] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.300101] print_report.cold+0x5c/0x237 [ 3046.300597] kasan_report+0xc9/0x100 [ 3046.301050] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.301778] krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.302499] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.303113] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.303689] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.304271] ? lock_acquire+0x4ea/0x620 [ 3046.304747] ? rcu_read_unlock+0x40/0x40 [ 3046.305261] ? rcu_read_unlock+0x40/0x40 [ 3046.305746] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.306327] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.307013] ? do_raw_spin_lock+0x270/0x270 [ 3046.307526] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.308275] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.308883] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.309502] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.310104] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.310722] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.311462] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.312092] kthread+0x2a4/0x350 [ 3046.312499] ? kthread_complete_and_exit+0x20/0x20 [ 3046.313088] ret_from_fork+0x1f/0x30 [ 3046.313543] [ 3046.313832] [ 3046.314041] Allocated by task 118257: [ 3046.314494] kasan_save_stack+0x1e/0x40 [ 3046.314969] __kasan_krealloc+0xee/0x160 [ 3046.315450] krealloc+0x50/0xe0 [ 3046.315857] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 3046.316563] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.317162] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.317906] kthread+0x2a4/0x350 [ 3046.318311] ret_from_fork+0x1f/0x30 [ 3046.318755] [ 3046.318966] The buggy address belongs to the object at ffff888003c55600 [ 3046.318966] which belongs to the cache kmalloc-256 of size 256 [ 3046.320434] The buggy address is located 218 bytes inside of [ 3046.320434] 256-byte region [ffff888003c55600, ffff888003c55700) [ 3046.321821] [ 3046.322028] The buggy address belongs to the physical page: [ 3046.322694] page:0000000059ec380c refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888003c54a00 pfn:0x3c54 [ 3046.323950] head:0000000059ec380c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.324848] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.325725] raw: 000fffffc0010200 ffffea000133a200 dead000000000005 ffff888100041b40 [ 3046.326649] raw: ffff888003c54a00 000000008010000a 00000001ffffffff 0000000000000000 [ 3046.327571] page dumped because: kasan: bad access detected [ 3046.328250] [ 3046.328457] Memory state around the buggy address: [ 3046.329042] ffff888003c55580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.329908] ffff888003c55600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.330772] >ffff888003c55680: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 3046.331683] ^ [ 3046.332441] ffff888003c55700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.333312] ffff888003c55780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.334177] ================================================================== [ 3046.335074] ================================================================== [ 3046.335944] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.336983] Write of size 1 at addr ffff888003c556ea by task kunit_try_catch/118257 [ 3046.337896] [ 3046.338127] CPU: 1 PID: 118257 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.339892] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.340604] Call Trace: [ 3046.340923] [ 3046.341198] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.341929] dump_stack_lvl+0x57/0x81 [ 3046.342385] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.343088] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.343815] print_report.cold+0x5c/0x237 [ 3046.344311] kasan_report+0xc9/0x100 [ 3046.344758] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.345520] krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.346319] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.347013] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.347660] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.348298] ? lock_acquire+0x4ea/0x620 [ 3046.348772] ? rcu_read_unlock+0x40/0x40 [ 3046.349260] ? rcu_read_unlock+0x40/0x40 [ 3046.349740] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.350319] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.351089] ? do_raw_spin_lock+0x270/0x270 [ 3046.351664] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.352409] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.353044] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.353737] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.354389] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.355011] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.355747] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.356390] kthread+0x2a4/0x350 [ 3046.356801] ? kthread_complete_and_exit+0x20/0x20 [ 3046.357386] ret_from_fork+0x1f/0x30 [ 3046.357847] [ 3046.358130] [ 3046.358336] Allocated by task 118257: [ 3046.358802] kasan_save_stack+0x1e/0x40 [ 3046.359274] __kasan_krealloc+0xee/0x160 [ 3046.359755] krealloc+0x50/0xe0 [ 3046.360153] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 3046.360867] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.361460] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.362200] kthread+0x2a4/0x350 [ 3046.362606] ret_from_fork+0x1f/0x30 [ 3046.363054] [ 3046.363262] The buggy address belongs to the object at ffff888003c55600 [ 3046.363262] which belongs to the cache kmalloc-256 of size 256 [ 3046.364724] The buggy address is located 234 bytes inside of [ 3046.364724] 256-byte region [ffff888003c55600, ffff888003c55700) [ 3046.366107] [ 3046.366314] The buggy address belongs to the physical page: [ 3046.366987] page:0000000059ec380c refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888003c55000 pfn:0x3c54 [ 3046.368242] head:0000000059ec380c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.369140] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.370094] raw: 000fffffc0010200 ffffea000133a200 dead000000000005 ffff888100041b40 [ 3046.371154] raw: ffff888003c55000 0000000080100009 00000001ffffffff 0000000000000000 [ 3046.372179] page dumped because: kasan: bad access detected [ 3046.372931] [ 3046.373161] Memory state around the buggy address: [ 3046.373815] ffff888003c55580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.374711] ffff888003c55600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.375576] >ffff888003c55680: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 3046.376442] ^ [ 3046.377280] ffff888003c55700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.378255] ffff888003c55780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.379122] ================================================================== [ 3046.380005] ================================================================== [ 3046.380874] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.381913] Write of size 1 at addr ffff888003c556eb by task kunit_try_catch/118257 [ 3046.382880] [ 3046.383111] CPU: 1 PID: 118257 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.384732] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.385477] Call Trace: [ 3046.385832] [ 3046.386140] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.386910] dump_stack_lvl+0x57/0x81 [ 3046.387368] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.388071] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.388801] print_report.cold+0x5c/0x237 [ 3046.389362] kasan_report+0xc9/0x100 [ 3046.389867] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.390628] krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.391347] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.391961] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.392537] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.393119] ? lock_acquire+0x4ea/0x620 [ 3046.393593] ? rcu_read_unlock+0x40/0x40 [ 3046.394080] ? rcu_read_unlock+0x40/0x40 [ 3046.394561] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.395145] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.395828] ? do_raw_spin_lock+0x270/0x270 [ 3046.396341] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.397112] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.397796] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.398485] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.399089] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.399705] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.400531] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.401185] kthread+0x2a4/0x350 [ 3046.401635] ? kthread_complete_and_exit+0x20/0x20 [ 3046.402296] ret_from_fork+0x1f/0x30 [ 3046.402796] [ 3046.403081] [ 3046.403326] Allocated by task 118257: [ 3046.403844] kasan_save_stack+0x1e/0x40 [ 3046.404400] __kasan_krealloc+0xee/0x160 [ 3046.404887] krealloc+0x50/0xe0 [ 3046.405282] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 3046.405994] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.406589] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.407326] kthread+0x2a4/0x350 [ 3046.407729] ret_from_fork+0x1f/0x30 [ 3046.408193] [ 3046.408401] The buggy address belongs to the object at ffff888003c55600 [ 3046.408401] which belongs to the cache kmalloc-256 of size 256 [ 3046.409867] The buggy address is located 235 bytes inside of [ 3046.409867] 256-byte region [ffff888003c55600, ffff888003c55700) [ 3046.411250] [ 3046.411458] The buggy address belongs to the physical page: [ 3046.412131] page:0000000059ec380c refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888003c55000 pfn:0x3c54 [ 3046.413368] head:0000000059ec380c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.414262] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.415136] raw: 000fffffc0010200 ffffea000133a200 dead000000000005 ffff888100041b40 [ 3046.416058] raw: ffff888003c55000 0000000080100009 00000001ffffffff 0000000000000000 [ 3046.416978] page dumped because: kasan: bad access detected [ 3046.417645] [ 3046.417853] Memory state around the buggy address: [ 3046.418436] ffff888003c55580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.419303] ffff888003c55600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.420168] >ffff888003c55680: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 3046.421031] ^ [ 3046.421826] ffff888003c55700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.422686] ffff888003c55780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.423549] ================================================================== [ 3046.424608] ok 11 - krealloc_less_oob [ 3046.429261] ================================================================== [ 3046.430656] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.431700] Write of size 1 at addr ffff8880066160eb by task kunit_try_catch/118260 [ 3046.432615] [ 3046.432826] CPU: 1 PID: 118260 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.434654] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.435395] Call Trace: [ 3046.435707] [ 3046.435988] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.436714] dump_stack_lvl+0x57/0x81 [ 3046.437196] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.437901] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.438628] print_report.cold+0x5c/0x237 [ 3046.439154] kasan_report+0xc9/0x100 [ 3046.439652] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.440456] krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 3046.441171] ? krealloc_less_oob+0x10/0x10 [test_kasan] [ 3046.441810] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.442387] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.442970] ? lock_acquire+0x4ea/0x620 [ 3046.443445] ? rcu_read_unlock+0x40/0x40 [ 3046.443937] ? rcu_read_unlock+0x40/0x40 [ 3046.444419] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.445000] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.445672] ? do_raw_spin_lock+0x270/0x270 [ 3046.446193] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.446932] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.447575] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.448274] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.448928] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.449542] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.450283] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.450911] kthread+0x2a4/0x350 [ 3046.451316] ? kthread_complete_and_exit+0x20/0x20 [ 3046.451916] ret_from_fork+0x1f/0x30 [ 3046.452370] [ 3046.452655] [ 3046.452869] The buggy address belongs to the physical page: [ 3046.453579] page:00000000279e38d5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3046.454782] head:00000000279e38d5 order:2 compound_mapcount:0 compound_pincount:0 [ 3046.455670] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.456494] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3046.457418] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3046.458340] page dumped because: kasan: bad access detected [ 3046.459011] [ 3046.459217] Memory state around the buggy address: [ 3046.459825] ffff888006615f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.460982] ffff888006616000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.461950] >ffff888006616080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fe fe [ 3046.462840] ^ [ 3046.463656] ffff888006616100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.464567] ffff888006616180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.465484] ================================================================== [ 3046.466439] ================================================================== [ 3046.467337] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.468386] Write of size 1 at addr ffff8880066160f0 by task kunit_try_catch/118260 [ 3046.469299] [ 3046.469506] CPU: 1 PID: 118260 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.471125] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.471826] Call Trace: [ 3046.472142] [ 3046.472417] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.473153] dump_stack_lvl+0x57/0x81 [ 3046.473611] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.474316] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.475047] print_report.cold+0x5c/0x237 [ 3046.475542] kasan_report+0xc9/0x100 [ 3046.475995] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.476723] krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 3046.477443] ? krealloc_less_oob+0x10/0x10 [test_kasan] [ 3046.478080] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.478654] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.479237] ? lock_acquire+0x4ea/0x620 [ 3046.479711] ? rcu_read_unlock+0x40/0x40 [ 3046.480201] ? rcu_read_unlock+0x40/0x40 [ 3046.480683] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.481266] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.481942] ? do_raw_spin_lock+0x270/0x270 [ 3046.482456] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.483199] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.483809] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.484570] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.485279] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.485901] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.486635] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.487265] kthread+0x2a4/0x350 [ 3046.487670] ? kthread_complete_and_exit+0x20/0x20 [ 3046.488266] ret_from_fork+0x1f/0x30 [ 3046.488722] [ 3046.489049] [ 3046.489283] The buggy address belongs to the physical page: [ 3046.490034] page:00000000279e38d5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3046.491172] head:00000000279e38d5 order:2 compound_mapcount:0 compound_pincount:0 [ 3046.492080] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.492907] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3046.493835] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3046.494750] page dumped because: kasan: bad access detected [ 3046.495420] [ 3046.495626] Memory state around the buggy address: [ 3046.496211] ffff888006615f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.497074] ffff888006616000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.498001] >ffff888006616080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fe fe [ 3046.498960] ^ [ 3046.499784] ffff888006616100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.500674] ffff888006616180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.501542] ================================================================== [ 3046.502484] ok 12 - krealloc_pagealloc_more_oob [ 3046.502710] ================================================================== [ 3046.504305] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.505407] Write of size 1 at addr ffff8880066160c9 by task kunit_try_catch/118261 [ 3046.506321] [ 3046.506529] CPU: 1 PID: 118261 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.508155] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.508853] Call Trace: [ 3046.509166] [ 3046.509442] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.510176] dump_stack_lvl+0x57/0x81 [ 3046.510631] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.511334] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.512071] print_report.cold+0x5c/0x237 [ 3046.512567] kasan_report+0xc9/0x100 [ 3046.513018] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.513748] krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 3046.514477] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.515087] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.515663] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.516243] ? lock_acquire+0x4ea/0x620 [ 3046.516716] ? rcu_read_unlock+0x40/0x40 [ 3046.517205] ? rcu_read_unlock+0x40/0x40 [ 3046.517688] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.518269] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.518949] ? do_raw_spin_lock+0x270/0x270 [ 3046.519465] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.520211] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.520820] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.521442] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.522046] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.522666] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.523411] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.524053] kthread+0x2a4/0x350 [ 3046.524461] ? kthread_complete_and_exit+0x20/0x20 [ 3046.525051] ret_from_fork+0x1f/0x30 [ 3046.525507] [ 3046.525793] [ 3046.526000] The buggy address belongs to the physical page: [ 3046.526667] page:00000000279e38d5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3046.527760] head:00000000279e38d5 order:2 compound_mapcount:0 compound_pincount:0 [ 3046.528661] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.529489] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3046.530418] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3046.531340] page dumped because: kasan: bad access detected [ 3046.532015] [ 3046.532222] Memory state around the buggy address: [ 3046.532809] ffff888006615f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.533710] ffff888006616000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.534640] >ffff888006616080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 3046.535661] ^ [ 3046.536364] ffff888006616100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.537230] ffff888006616180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.538104] ================================================================== [ 3046.539034] ================================================================== [ 3046.539987] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.541096] Write of size 1 at addr ffff8880066160d0 by task kunit_try_catch/118261 [ 3046.542009] [ 3046.542216] CPU: 1 PID: 118261 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.543840] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.544534] Call Trace: [ 3046.544852] [ 3046.545127] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.545865] dump_stack_lvl+0x57/0x81 [ 3046.546318] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.547019] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.547744] print_report.cold+0x5c/0x237 [ 3046.548300] kasan_report+0xc9/0x100 [ 3046.548805] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.549590] krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 3046.550305] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.550915] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.551490] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.552071] ? lock_acquire+0x4ea/0x620 [ 3046.552546] ? rcu_read_unlock+0x40/0x40 [ 3046.553032] ? rcu_read_unlock+0x40/0x40 [ 3046.553513] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.554161] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.554939] ? do_raw_spin_lock+0x270/0x270 [ 3046.555452] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.556196] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.556804] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.557427] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.558029] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.558647] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.559386] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.560017] kthread+0x2a4/0x350 [ 3046.560517] ? kthread_complete_and_exit+0x20/0x20 [ 3046.561208] ret_from_fork+0x1f/0x30 [ 3046.561718] [ 3046.562039] [ 3046.562269] The buggy address belongs to the physical page: [ 3046.563016] page:00000000279e38d5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3046.564245] head:00000000279e38d5 order:2 compound_mapcount:0 compound_pincount:0 [ 3046.565171] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.566041] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3046.567089] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3046.568104] page dumped because: kasan: bad access detected [ 3046.568776] [ 3046.568983] Memory state around the buggy address: [ 3046.569564] ffff888006615f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.570526] ffff888006616000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.571459] >ffff888006616080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 3046.572325] ^ [ 3046.573032] ffff888006616100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.573941] ffff888006616180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.574921] ================================================================== [ 3046.575927] ================================================================== [ 3046.576799] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.577862] Write of size 1 at addr ffff8880066160da by task kunit_try_catch/118261 [ 3046.578906] [ 3046.579114] CPU: 1 PID: 118261 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.580738] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.581435] Call Trace: [ 3046.581747] [ 3046.582027] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.582754] dump_stack_lvl+0x57/0x81 [ 3046.583214] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.583916] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.584659] print_report.cold+0x5c/0x237 [ 3046.585221] kasan_report+0xc9/0x100 [ 3046.585731] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.586516] krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 3046.587257] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.587868] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.588448] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.589027] ? lock_acquire+0x4ea/0x620 [ 3046.589502] ? rcu_read_unlock+0x40/0x40 [ 3046.590033] ? rcu_read_unlock+0x40/0x40 [ 3046.590572] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.591179] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.591857] ? do_raw_spin_lock+0x270/0x270 [ 3046.592373] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.593115] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.593718] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.594341] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.594957] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.595573] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.596316] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.596945] kthread+0x2a4/0x350 [ 3046.597350] ? kthread_complete_and_exit+0x20/0x20 [ 3046.597942] ret_from_fork+0x1f/0x30 [ 3046.598436] [ 3046.598753] [ 3046.598989] The buggy address belongs to the physical page: [ 3046.599719] page:00000000279e38d5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3046.600820] head:00000000279e38d5 order:2 compound_mapcount:0 compound_pincount:0 [ 3046.601710] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.602537] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3046.603460] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3046.604389] page dumped because: kasan: bad access detected [ 3046.605059] [ 3046.605266] Memory state around the buggy address: [ 3046.605849] ffff888006615f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.606711] ffff888006616000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.607575] >ffff888006616080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 3046.608440] ^ [ 3046.609177] ffff888006616100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.610042] ffff888006616180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.610906] ================================================================== [ 3046.611789] ================================================================== [ 3046.612659] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.613700] Write of size 1 at addr ffff8880066160ea by task kunit_try_catch/118261 [ 3046.614613] [ 3046.614833] CPU: 1 PID: 118261 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.616450] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.617165] Call Trace: [ 3046.617478] [ 3046.617753] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.618486] dump_stack_lvl+0x57/0x81 [ 3046.618947] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.619645] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.620377] print_report.cold+0x5c/0x237 [ 3046.620877] kasan_report+0xc9/0x100 [ 3046.621323] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.622095] krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 3046.622894] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.623517] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.624098] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.624674] ? lock_acquire+0x4ea/0x620 [ 3046.625198] ? rcu_read_unlock+0x40/0x40 [ 3046.625738] ? rcu_read_unlock+0x40/0x40 [ 3046.626265] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.626849] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.627523] ? do_raw_spin_lock+0x270/0x270 [ 3046.628045] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.628786] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.629391] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.630016] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.630613] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.631234] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.631975] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.632626] kthread+0x2a4/0x350 [ 3046.633039] ? kthread_complete_and_exit+0x20/0x20 [ 3046.633625] ret_from_fork+0x1f/0x30 [ 3046.634133] [ 3046.634451] [ 3046.634683] The buggy address belongs to the physical page: [ 3046.635446] page:00000000279e38d5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3046.636603] head:00000000279e38d5 order:2 compound_mapcount:0 compound_pincount:0 [ 3046.637562] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.638496] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3046.639479] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3046.640397] page dumped because: kasan: bad access detected [ 3046.641066] [ 3046.641274] Memory state around the buggy address: [ 3046.641858] ffff888006615f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.642717] ffff888006616000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.643596] >ffff888006616080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 3046.644463] ^ [ 3046.645258] ffff888006616100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.646122] ffff888006616180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.646988] ================================================================== [ 3046.647875] ================================================================== [ 3046.648767] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.649933] Write of size 1 at addr ffff8880066160eb by task kunit_try_catch/118261 [ 3046.650846] [ 3046.651055] CPU: 1 PID: 118261 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.652675] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.653379] Call Trace: [ 3046.653693] [ 3046.653977] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.654798] dump_stack_lvl+0x57/0x81 [ 3046.655276] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.655986] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.656769] print_report.cold+0x5c/0x237 [ 3046.657290] kasan_report+0xc9/0x100 [ 3046.657741] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.658569] krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 3046.659340] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 3046.659948] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.660524] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.661100] ? lock_acquire+0x4ea/0x620 [ 3046.661574] ? rcu_read_unlock+0x40/0x40 [ 3046.662059] ? rcu_read_unlock+0x40/0x40 [ 3046.662540] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.663133] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.663809] ? do_raw_spin_lock+0x270/0x270 [ 3046.664324] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 3046.665091] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.665698] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.666327] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.666929] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.667545] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.668292] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.668920] kthread+0x2a4/0x350 [ 3046.669329] ? kthread_complete_and_exit+0x20/0x20 [ 3046.669918] ret_from_fork+0x1f/0x30 [ 3046.670372] [ 3046.670657] [ 3046.670871] The buggy address belongs to the physical page: [ 3046.671540] page:00000000279e38d5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6614 [ 3046.672632] head:00000000279e38d5 order:2 compound_mapcount:0 compound_pincount:0 [ 3046.673527] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.674347] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 3046.675271] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3046.676195] page dumped because: kasan: bad access detected [ 3046.676864] [ 3046.677071] Memory state around the buggy address: [ 3046.677653] ffff888006615f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.678518] ffff888006616000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.679389] >ffff888006616080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 3046.680256] ^ [ 3046.681052] ffff888006616100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.681926] ffff888006616180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 3046.682810] ================================================================== [ 3046.683732] ok 13 - krealloc_pagealloc_less_oob [ 3046.683983] ================================================================== [ 3046.685510] BUG: KASAN: use-after-free in krealloc_uaf+0x1c7/0x450 [test_kasan] [ 3046.686483] Read of size 1 at addr ffff888003c54000 by task kunit_try_catch/118262 [ 3046.687390] [ 3046.687598] CPU: 1 PID: 118262 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.689294] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.690027] Call Trace: [ 3046.690376] [ 3046.690683] ? krealloc_uaf+0x1c7/0x450 [test_kasan] [ 3046.691330] dump_stack_lvl+0x57/0x81 [ 3046.691791] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.692487] ? krealloc_uaf+0x1c7/0x450 [test_kasan] [ 3046.693096] print_report.cold+0x5c/0x237 [ 3046.693594] kasan_report+0xc9/0x100 [ 3046.694042] ? krealloc_uaf+0x1c7/0x450 [test_kasan] [ 3046.694648] ? krealloc_uaf+0x1c7/0x450 [test_kasan] [ 3046.695309] __kasan_check_byte+0x36/0x50 [ 3046.695804] krealloc+0x2e/0xe0 [ 3046.696203] krealloc_uaf+0x1c7/0x450 [test_kasan] [ 3046.696796] ? kmalloc_memmove_negative_size+0x290/0x290 [test_kasan] [ 3046.697566] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.698170] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.698744] ? lock_acquire+0x4ea/0x620 [ 3046.699297] ? rcu_read_unlock+0x40/0x40 [ 3046.699842] ? rcu_read_unlock+0x40/0x40 [ 3046.700366] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.700955] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.701628] ? do_raw_spin_lock+0x270/0x270 [ 3046.702148] ? trace_hardirqs_on+0x2d/0x160 [ 3046.702664] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.703272] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.703896] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.704497] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.705122] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.705865] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.706489] kthread+0x2a4/0x350 [ 3046.706898] ? kthread_complete_and_exit+0x20/0x20 [ 3046.707482] ret_from_fork+0x1f/0x30 [ 3046.707943] [ 3046.708227] [ 3046.708434] Allocated by task 118262: [ 3046.708898] kasan_save_stack+0x1e/0x40 [ 3046.709369] __kasan_kmalloc+0x81/0xa0 [ 3046.709834] krealloc_uaf+0xaa/0x450 [test_kasan] [ 3046.710412] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.711013] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.711757] kthread+0x2a4/0x350 [ 3046.712165] ret_from_fork+0x1f/0x30 [ 3046.712610] [ 3046.712823] Freed by task 118262: [ 3046.713234] kasan_save_stack+0x1e/0x40 [ 3046.713703] kasan_set_track+0x21/0x30 [ 3046.714171] kasan_set_free_info+0x20/0x40 [ 3046.714672] __kasan_slab_free+0x108/0x170 [ 3046.715177] slab_free_freelist_hook+0x11d/0x1d0 [ 3046.715741] kfree+0xe2/0x3c0 [ 3046.716123] krealloc_uaf+0x147/0x450 [test_kasan] [ 3046.716706] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.717305] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.718048] kthread+0x2a4/0x350 [ 3046.718451] ret_from_fork+0x1f/0x30 [ 3046.718898] [ 3046.719107] The buggy address belongs to the object at ffff888003c54000 [ 3046.719107] which belongs to the cache kmalloc-256 of size 256 [ 3046.720570] The buggy address is located 0 bytes inside of [ 3046.720570] 256-byte region [ffff888003c54000, ffff888003c54100) [ 3046.721933] [ 3046.722140] The buggy address belongs to the physical page: [ 3046.722816] page:0000000059ec380c refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888003c55000 pfn:0x3c54 [ 3046.724165] head:0000000059ec380c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.725061] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.725944] raw: 000fffffc0010200 ffffea000133a200 dead000000000005 ffff888100041b40 [ 3046.726866] raw: ffff888003c55000 0000000080100009 00000001ffffffff 0000000000000000 [ 3046.727792] page dumped because: kasan: bad access detected [ 3046.728461] [ 3046.728668] Memory state around the buggy address: [ 3046.729260] ffff888003c53f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.730125] ffff888003c53f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.730989] >ffff888003c54000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3046.731879] ^ [ 3046.732287] ffff888003c54080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3046.733153] ffff888003c54100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.734017] ================================================================== [ 3046.734966] ================================================================== [ 3046.735923] BUG: KASAN: use-after-free in krealloc_uaf+0x42e/0x450 [test_kasan] [ 3046.736882] Read of size 1 at addr ffff888003c54000 by task kunit_try_catch/118262 [ 3046.737784] [ 3046.737991] CPU: 1 PID: 118262 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.739655] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.740378] Call Trace: [ 3046.740693] [ 3046.740973] ? krealloc_uaf+0x42e/0x450 [test_kasan] [ 3046.741581] dump_stack_lvl+0x57/0x81 [ 3046.742042] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.742742] ? krealloc_uaf+0x42e/0x450 [test_kasan] [ 3046.743353] print_report.cold+0x5c/0x237 [ 3046.743856] kasan_report+0xc9/0x100 [ 3046.744303] ? krealloc_uaf+0x42e/0x450 [test_kasan] [ 3046.744916] krealloc_uaf+0x42e/0x450 [test_kasan] [ 3046.745503] ? kmalloc_memmove_negative_size+0x290/0x290 [test_kasan] [ 3046.746280] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.746863] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.747437] ? lock_acquire+0x4ea/0x620 [ 3046.747921] ? rcu_read_unlock+0x40/0x40 [ 3046.748403] ? rcu_read_unlock+0x40/0x40 [ 3046.748892] ? rcu_read_lock_sched_held+0x12/0x80 [ 3046.749502] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.750261] ? do_raw_spin_lock+0x270/0x270 [ 3046.750815] ? kunit_ptr_not_err_assert_format+0x210/0x210 [kunit] [ 3046.751562] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.752170] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.752797] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.753394] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.754017] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.754816] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.755458] kthread+0x2a4/0x350 [ 3046.755875] ? kthread_complete_and_exit+0x20/0x20 [ 3046.756462] ret_from_fork+0x1f/0x30 [ 3046.756920] [ 3046.757203] [ 3046.757409] Allocated by task 118262: [ 3046.757864] kasan_save_stack+0x1e/0x40 [ 3046.758334] __kasan_kmalloc+0x81/0xa0 [ 3046.758803] krealloc_uaf+0xaa/0x450 [test_kasan] [ 3046.759379] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.759980] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.760717] kthread+0x2a4/0x350 [ 3046.761125] ret_from_fork+0x1f/0x30 [ 3046.761567] [ 3046.761779] Freed by task 118262: [ 3046.762194] kasan_save_stack+0x1e/0x40 [ 3046.762664] kasan_set_track+0x21/0x30 [ 3046.763131] kasan_set_free_info+0x20/0x40 [ 3046.763631] __kasan_slab_free+0x108/0x170 [ 3046.764157] slab_free_freelist_hook+0x11d/0x1d0 [ 3046.764724] kfree+0xe2/0x3c0 [ 3046.765106] krealloc_uaf+0x147/0x450 [test_kasan] [ 3046.765694] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.766293] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.767037] kthread+0x2a4/0x350 [ 3046.767440] ret_from_fork+0x1f/0x30 [ 3046.767894] [ 3046.768103] The buggy address belongs to the object at ffff888003c54000 [ 3046.768103] which belongs to the cache kmalloc-256 of size 256 [ 3046.769572] The buggy address is located 0 bytes inside of [ 3046.769572] 256-byte region [ffff888003c54000, ffff888003c54100) [ 3046.770939] [ 3046.771146] The buggy address belongs to the physical page: [ 3046.771820] page:0000000059ec380c refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888003c55000 pfn:0x3c54 [ 3046.773062] head:0000000059ec380c order:1 compound_mapcount:0 compound_pincount:0 [ 3046.773956] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.774883] raw: 000fffffc0010200 ffffea000133a200 dead000000000005 ffff888100041b40 [ 3046.775810] raw: ffff888003c55000 0000000080100009 00000001ffffffff 0000000000000000 [ 3046.776733] page dumped because: kasan: bad access detected [ 3046.777404] [ 3046.777610] Memory state around the buggy address: [ 3046.778196] ffff888003c53f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.779063] ffff888003c53f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.779927] >ffff888003c54000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3046.780799] ^ [ 3046.781205] ffff888003c54080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3046.782078] ffff888003c54100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.782944] ================================================================== [ 3046.783944] ok 14 - krealloc_uaf [ 3046.784183] ================================================================== [ 3046.785509] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 3046.786551] Write of size 16 at addr ffff88800986a1e0 by task kunit_try_catch/118263 [ 3046.787515] [ 3046.787725] CPU: 1 PID: 118263 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.789470] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.790253] Call Trace: [ 3046.790612] [ 3046.790955] ? kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 3046.791661] dump_stack_lvl+0x57/0x81 [ 3046.792123] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.792825] ? kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 3046.793448] print_report.cold+0x5c/0x237 [ 3046.793949] kasan_report+0xc9/0x100 [ 3046.794397] ? kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 3046.795031] kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 3046.795640] ? kmalloc_uaf_16+0x3b0/0x3b0 [test_kasan] [ 3046.796266] ? do_raw_spin_trylock+0xb5/0x180 [ 3046.796810] ? do_raw_spin_lock+0x270/0x270 [ 3046.797348] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.798029] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.798637] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.799326] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.800001] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.800691] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.801452] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.802083] kthread+0x2a4/0x350 [ 3046.802491] ? kthread_complete_and_exit+0x20/0x20 [ 3046.803082] ret_from_fork+0x1f/0x30 [ 3046.803537] [ 3046.803828] [ 3046.804035] Allocated by task 118263: [ 3046.804487] kasan_save_stack+0x1e/0x40 [ 3046.804973] __kasan_kmalloc+0x81/0xa0 [ 3046.805435] kmalloc_oob_16+0xa4/0x3b0 [test_kasan] [ 3046.806041] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.806639] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.807380] kthread+0x2a4/0x350 [ 3046.807792] ret_from_fork+0x1f/0x30 [ 3046.808236] [ 3046.808444] The buggy address belongs to the object at ffff88800986a1e0 [ 3046.808444] which belongs to the cache kmalloc-16 of size 16 [ 3046.809903] The buggy address is located 0 bytes inside of [ 3046.809903] 16-byte region [ffff88800986a1e0, ffff88800986a1f0) [ 3046.811261] [ 3046.811469] The buggy address belongs to the physical page: [ 3046.812145] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a6c0 pfn:0x986a [ 3046.813547] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.814428] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3046.815359] raw: ffff88800986a6c0 000000008080007e 00000001ffffffff 0000000000000000 [ 3046.816282] page dumped because: kasan: bad access detected [ 3046.816952] [ 3046.817161] Memory state around the buggy address: [ 3046.817750] ffff88800986a080: fa fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3046.818614] ffff88800986a100: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3046.819481] >ffff88800986a180: fb fb fc fc fa fb fc fc fa fb fc fc 00 05 fc fc [ 3046.820345] ^ [ 3046.821137] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3046.822005] ffff88800986a280: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3046.822872] ================================================================== [ 3046.823811] ok 15 - kmalloc_oob_16 [ 3046.824027] ================================================================== [ 3046.825374] BUG: KASAN: use-after-free in kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 3046.826274] Read of size 16 at addr ffff88800986a2c0 by task kunit_try_catch/118264 [ 3046.827192] [ 3046.827399] CPU: 1 PID: 118264 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.829018] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.829714] Call Trace: [ 3046.830046] [ 3046.830335] ? kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 3046.830966] dump_stack_lvl+0x57/0x81 [ 3046.831424] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.832125] ? kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 3046.832751] print_report.cold+0x5c/0x237 [ 3046.833248] kasan_report+0xc9/0x100 [ 3046.833696] ? kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 3046.834324] kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 3046.834935] ? kmalloc_uaf+0x2b0/0x2b0 [test_kasan] [ 3046.835533] ? do_raw_spin_trylock+0xb5/0x180 [ 3046.836138] ? do_raw_spin_lock+0x270/0x270 [ 3046.836716] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.837445] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.838066] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.838682] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.839282] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.839903] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.840641] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.841317] kthread+0x2a4/0x350 [ 3046.841725] ? kthread_complete_and_exit+0x20/0x20 [ 3046.842338] ret_from_fork+0x1f/0x30 [ 3046.842800] [ 3046.843085] [ 3046.843293] Allocated by task 118264: [ 3046.843748] kasan_save_stack+0x1e/0x40 [ 3046.844223] __kasan_kmalloc+0x81/0xa0 [ 3046.844685] kmalloc_uaf_16+0x15d/0x3b0 [test_kasan] [ 3046.845294] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.845895] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.846630] kthread+0x2a4/0x350 [ 3046.847038] ret_from_fork+0x1f/0x30 [ 3046.847482] [ 3046.847689] Freed by task 118264: [ 3046.848109] kasan_save_stack+0x1e/0x40 [ 3046.848579] kasan_set_track+0x21/0x30 [ 3046.849047] kasan_set_free_info+0x20/0x40 [ 3046.849549] __kasan_slab_free+0x108/0x170 [ 3046.850082] slab_free_freelist_hook+0x11d/0x1d0 [ 3046.850716] kfree+0xe2/0x3c0 [ 3046.851146] kmalloc_uaf_16+0x1e8/0x3b0 [test_kasan] [ 3046.851756] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.852352] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.853094] kthread+0x2a4/0x350 [ 3046.853500] ret_from_fork+0x1f/0x30 [ 3046.853949] [ 3046.854157] The buggy address belongs to the object at ffff88800986a2c0 [ 3046.854157] which belongs to the cache kmalloc-16 of size 16 [ 3046.855709] The buggy address is located 0 bytes inside of [ 3046.855709] 16-byte region [ffff88800986a2c0, ffff88800986a2d0) [ 3046.857100] [ 3046.857306] The buggy address belongs to the physical page: [ 3046.857976] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a6c0 pfn:0x986a [ 3046.859221] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.860047] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3046.860970] raw: ffff88800986a6c0 000000008080007e 00000001ffffffff 0000000000000000 [ 3046.861895] page dumped because: kasan: bad access detected [ 3046.862561] [ 3046.862771] Memory state around the buggy address: [ 3046.863375] ffff88800986a180: fb fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 3046.864243] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3046.865112] >ffff88800986a280: fb fb fc fc fb fb fc fc fa fb fc fc fb fb fc fc [ 3046.865980] ^ [ 3046.866621] ffff88800986a300: fb fb fc fc fa fb fc fc fb fb fc fc fb fb fc fc [ 3046.867487] ffff88800986a380: fa fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3046.868350] ================================================================== [ 3046.869347] ok 16 - kmalloc_uaf_16 [ 3046.869540] ================================================================== [ 3046.870886] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 3046.871903] Write of size 128 at addr ffff8880061be900 by task kunit_try_catch/118265 [ 3046.872835] [ 3046.873043] CPU: 1 PID: 118265 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.874660] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.875355] Call Trace: [ 3046.875668] [ 3046.875947] ? kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 3046.876643] dump_stack_lvl+0x57/0x81 [ 3046.877100] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.877801] ? kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 3046.878499] print_report.cold+0x5c/0x237 [ 3046.879001] kasan_report+0xc9/0x100 [ 3046.879448] ? kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 3046.880151] kasan_check_range+0xfd/0x1e0 [ 3046.880646] memset+0x20/0x50 [ 3046.881032] kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 3046.881707] ? kmalloc_oob_memset_2+0x290/0x290 [test_kasan] [ 3046.882402] ? do_raw_spin_trylock+0xb5/0x180 [ 3046.882943] ? do_raw_spin_lock+0x270/0x270 [ 3046.883458] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.884136] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.884748] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.885460] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.886136] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.886831] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.887616] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.888242] kthread+0x2a4/0x350 [ 3046.888650] ? kthread_complete_and_exit+0x20/0x20 [ 3046.889241] ret_from_fork+0x1f/0x30 [ 3046.889694] [ 3046.889982] [ 3046.890188] Allocated by task 118265: [ 3046.890641] kasan_save_stack+0x1e/0x40 [ 3046.891176] __kasan_kmalloc+0x81/0xa0 [ 3046.891703] kmalloc_oob_in_memset+0x9c/0x280 [test_kasan] [ 3046.892417] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.893033] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.893788] kthread+0x2a4/0x350 [ 3046.894192] ret_from_fork+0x1f/0x30 [ 3046.894636] [ 3046.894848] Last potentially related work creation: [ 3046.895436] kasan_save_stack+0x1e/0x40 [ 3046.895912] __kasan_record_aux_stack+0x96/0xb0 [ 3046.896489] insert_work+0x47/0x310 [ 3046.896932] __queue_work+0x4dd/0xd60 [ 3046.897384] rcu_work_rcufn+0x42/0x70 [ 3046.897839] rcu_do_batch+0x3c2/0xdc0 [ 3046.898293] rcu_core+0x3de/0x5a0 [ 3046.898708] __do_softirq+0x2d0/0x9a8 [ 3046.899164] [ 3046.899371] Second to last potentially related work creation: [ 3046.900153] kasan_save_stack+0x1e/0x40 [ 3046.900680] __kasan_record_aux_stack+0x96/0xb0 [ 3046.901310] call_rcu+0xee/0x890 [ 3046.901717] queue_rcu_work+0x5a/0x70 [ 3046.902174] writeback_sb_inodes+0x373/0xd00 [ 3046.902704] __writeback_inodes_wb+0xb7/0x210 [ 3046.903291] wb_writeback+0x686/0xa10 [ 3046.903803] wb_do_writeback+0x539/0x8a0 [ 3046.904303] wb_workfn+0x12c/0x670 [ 3046.904729] process_one_work+0x8e2/0x1520 [ 3046.905232] worker_thread+0x59e/0xf90 [ 3046.905692] kthread+0x2a4/0x350 [ 3046.906102] ret_from_fork+0x1f/0x30 [ 3046.906544] [ 3046.906754] The buggy address belongs to the object at ffff8880061be900 [ 3046.906754] which belongs to the cache kmalloc-128 of size 128 [ 3046.908217] The buggy address is located 0 bytes inside of [ 3046.908217] 128-byte region [ffff8880061be900, ffff8880061be980) [ 3046.909574] [ 3046.909786] The buggy address belongs to the physical page: [ 3046.910451] page:00000000ce5db6c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61be [ 3046.911546] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.912370] raw: 000fffffc0000200 ffffea00001b2f40 dead000000000003 ffff8881000418c0 [ 3046.913291] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3046.914210] page dumped because: kasan: bad access detected [ 3046.914880] [ 3046.915088] Memory state around the buggy address: [ 3046.915667] ffff8880061be800: 00 00 00 00 00 00 00 00 00 00 04 fc fc fc fc fc [ 3046.916533] ffff8880061be880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.917401] >ffff8880061be900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 3046.918272] ^ [ 3046.919128] ffff8880061be980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.919996] ffff8880061bea00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.920869] ================================================================== [ 3046.921876] ok 17 - kmalloc_oob_in_memset [ 3046.922050] ================================================================== [ 3046.923463] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 3046.924458] Write of size 2 at addr ffff8880061be177 by task kunit_try_catch/118266 [ 3046.925371] [ 3046.925579] CPU: 1 PID: 118266 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.927199] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.927948] Call Trace: [ 3046.928296] [ 3046.928602] ? kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 3046.929356] dump_stack_lvl+0x57/0x81 [ 3046.929818] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.930515] ? kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 3046.931206] print_report.cold+0x5c/0x237 [ 3046.931700] kasan_report+0xc9/0x100 [ 3046.932150] ? kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 3046.932843] kasan_check_range+0xfd/0x1e0 [ 3046.933337] memset+0x20/0x50 [ 3046.933715] kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 3046.934385] ? kmalloc_oob_memset_4+0x290/0x290 [test_kasan] [ 3046.935077] ? do_raw_spin_trylock+0xb5/0x180 [ 3046.935618] ? do_raw_spin_lock+0x270/0x270 [ 3046.936139] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.936918] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.937525] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.938193] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.938867] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.939520] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.940322] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.940998] kthread+0x2a4/0x350 [ 3046.941405] ? kthread_complete_and_exit+0x20/0x20 [ 3046.941996] ret_from_fork+0x1f/0x30 [ 3046.942452] [ 3046.942739] [ 3046.942945] Allocated by task 118266: [ 3046.943446] kasan_save_stack+0x1e/0x40 [ 3046.943924] __kasan_kmalloc+0x81/0xa0 [ 3046.944408] kmalloc_oob_memset_2+0x9c/0x290 [test_kasan] [ 3046.945069] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.945665] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.946402] kthread+0x2a4/0x350 [ 3046.946812] ret_from_fork+0x1f/0x30 [ 3046.947256] [ 3046.947462] Last potentially related work creation: [ 3046.948058] kasan_save_stack+0x1e/0x40 [ 3046.948530] __kasan_record_aux_stack+0x96/0xb0 [ 3046.949090] insert_work+0x47/0x310 [ 3046.949524] __queue_work+0x4dd/0xd60 [ 3046.949984] rcu_work_rcufn+0x42/0x70 [ 3046.950435] rcu_do_batch+0x3c2/0xdc0 [ 3046.950919] rcu_core+0x3de/0x5a0 [ 3046.951384] __do_softirq+0x2d0/0x9a8 [ 3046.951897] [ 3046.952129] Second to last potentially related work creation: [ 3046.952913] kasan_save_stack+0x1e/0x40 [ 3046.953441] __kasan_record_aux_stack+0x96/0xb0 [ 3046.954070] call_rcu+0xee/0x890 [ 3046.954521] queue_rcu_work+0x5a/0x70 [ 3046.955032] writeback_sb_inodes+0x373/0xd00 [ 3046.955621] __writeback_inodes_wb+0xb7/0x210 [ 3046.956229] wb_writeback+0x686/0xa10 [ 3046.956738] wb_do_writeback+0x539/0x8a0 [ 3046.957276] wb_workfn+0x12c/0x670 [ 3046.957755] process_one_work+0x8e2/0x1520 [ 3046.958315] worker_thread+0x59e/0xf90 [ 3046.958834] kthread+0x2a4/0x350 [ 3046.959287] ret_from_fork+0x1f/0x30 [ 3046.959817] [ 3046.960047] The buggy address belongs to the object at ffff8880061be100 [ 3046.960047] which belongs to the cache kmalloc-128 of size 128 [ 3046.961608] The buggy address is located 119 bytes inside of [ 3046.961608] 128-byte region [ffff8880061be100, ffff8880061be180) [ 3046.963025] [ 3046.963233] The buggy address belongs to the physical page: [ 3046.963906] page:00000000ce5db6c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61be [ 3046.965001] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3046.965828] raw: 000fffffc0000200 ffffea00001b2f40 dead000000000003 ffff8881000418c0 [ 3046.966753] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3046.967670] page dumped because: kasan: bad access detected [ 3046.968341] [ 3046.968548] Memory state around the buggy address: [ 3046.969133] ffff8880061be000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.970003] ffff8880061be080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.970876] >ffff8880061be100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 3046.971743] ^ [ 3046.972593] ffff8880061be180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3046.973459] ffff8880061be200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3046.974322] ================================================================== [ 3046.975247] ok 18 - kmalloc_oob_memset_2 [ 3046.975530] ================================================================== [ 3046.976944] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 3046.977938] Write of size 4 at addr ffff8880061bef75 by task kunit_try_catch/118267 [ 3046.978850] [ 3046.979060] CPU: 1 PID: 118267 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3046.980681] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3046.981378] Call Trace: [ 3046.981688] [ 3046.981966] ? kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 3046.982655] dump_stack_lvl+0x57/0x81 [ 3046.983116] print_address_description.constprop.0+0x1f/0x1e0 [ 3046.983819] ? kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 3046.984509] print_report.cold+0x5c/0x237 [ 3046.985022] kasan_report+0xc9/0x100 [ 3046.985468] ? kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 3046.986160] kasan_check_range+0xfd/0x1e0 [ 3046.986653] memset+0x20/0x50 [ 3046.987039] kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 3046.987700] ? kmalloc_oob_memset_8+0x290/0x290 [test_kasan] [ 3046.988396] ? do_raw_spin_trylock+0xb5/0x180 [ 3046.988949] ? do_raw_spin_lock+0x270/0x270 [ 3046.989466] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3046.990143] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3046.990753] ? kunit_add_resource+0x197/0x280 [kunit] [ 3046.991372] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.991976] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3046.992591] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.993337] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3046.993963] kthread+0x2a4/0x350 [ 3046.994424] ? kthread_complete_and_exit+0x20/0x20 [ 3046.995037] ret_from_fork+0x1f/0x30 [ 3046.995497] [ 3046.995785] [ 3046.995993] Allocated by task 118267: [ 3046.996445] kasan_save_stack+0x1e/0x40 [ 3046.996934] __kasan_kmalloc+0x81/0xa0 [ 3046.997398] kmalloc_oob_memset_4+0x9c/0x290 [test_kasan] [ 3046.998055] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3046.998654] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3046.999393] kthread+0x2a4/0x350 [ 3046.999803] ret_from_fork+0x1f/0x30 [ 3047.000247] [ 3047.000454] Last potentially related work creation: [ 3047.001047] kasan_save_stack+0x1e/0x40 [ 3047.001518] __kasan_record_aux_stack+0x96/0xb0 [ 3047.002078] insert_work+0x47/0x310 [ 3047.002513] __queue_work+0x4dd/0xd60 [ 3047.002970] rcu_work_rcufn+0x42/0x70 [ 3047.003422] rcu_do_batch+0x3c2/0xdc0 [ 3047.003879] rcu_core+0x3de/0x5a0 [ 3047.004297] __do_softirq+0x2d0/0x9a8 [ 3047.004754] [ 3047.004968] Second to last potentially related work creation: [ 3047.005659] kasan_save_stack+0x1e/0x40 [ 3047.006136] __kasan_record_aux_stack+0x96/0xb0 [ 3047.006692] call_rcu+0xee/0x890 [ 3047.007102] queue_rcu_work+0x5a/0x70 [ 3047.007552] writeback_sb_inodes+0x373/0xd00 [ 3047.008083] __writeback_inodes_wb+0xb7/0x210 [ 3047.008619] wb_writeback+0x686/0xa10 [ 3047.009076] wb_do_writeback+0x539/0x8a0 [ 3047.009557] wb_workfn+0x12c/0x670 [ 3047.009984] process_one_work+0x8e2/0x1520 [ 3047.010483] worker_thread+0x59e/0xf90 [ 3047.010952] kthread+0x2a4/0x350 [ 3047.011356] ret_from_fork+0x1f/0x30 [ 3047.011804] [ 3047.012011] The buggy address belongs to the object at ffff8880061bef00 [ 3047.012011] which belongs to the cache kmalloc-128 of size 128 [ 3047.013489] The buggy address is located 117 bytes inside of [ 3047.013489] 128-byte region [ffff8880061bef00, ffff8880061bef80) [ 3047.014876] [ 3047.015084] The buggy address belongs to the physical page: [ 3047.015755] page:00000000ce5db6c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61be [ 3047.016859] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3047.017681] raw: 000fffffc0000200 ffffea00001b2f40 dead000000000003 ffff8881000418c0 [ 3047.018605] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3047.019529] page dumped because: kasan: bad access detected [ 3047.020200] [ 3047.020408] Memory state around the buggy address: [ 3047.020993] ffff8880061bee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.021858] ffff8880061bee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.022719] >ffff8880061bef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 3047.023584] ^ [ 3047.024441] ffff8880061bef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.025307] ffff8880061bf000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.026173] ================================================================== [ 3047.027121] ok 19 - kmalloc_oob_memset_4 [ 3047.027302] ================================================================== [ 3047.028701] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 3047.029691] Write of size 8 at addr ffff8880061be471 by task kunit_try_catch/118268 [ 3047.030603] [ 3047.030814] CPU: 1 PID: 118268 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.032431] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.033129] Call Trace: [ 3047.033442] [ 3047.033719] ? kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 3047.034414] dump_stack_lvl+0x57/0x81 [ 3047.034872] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.035571] ? kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 3047.036266] print_report.cold+0x5c/0x237 [ 3047.036767] kasan_report+0xc9/0x100 [ 3047.037214] ? kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 3047.037909] kasan_check_range+0xfd/0x1e0 [ 3047.038401] memset+0x20/0x50 [ 3047.038785] kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 3047.039450] ? kmalloc_oob_memset_16+0x290/0x290 [test_kasan] [ 3047.040152] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.040690] ? do_raw_spin_lock+0x270/0x270 [ 3047.041217] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.041895] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3047.042502] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.043126] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.043721] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.044345] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.045116] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.045767] kthread+0x2a4/0x350 [ 3047.046197] ? kthread_complete_and_exit+0x20/0x20 [ 3047.046786] ret_from_fork+0x1f/0x30 [ 3047.047242] [ 3047.047525] [ 3047.047737] Allocated by task 118268: [ 3047.048191] kasan_save_stack+0x1e/0x40 [ 3047.048662] __kasan_kmalloc+0x81/0xa0 [ 3047.049127] kmalloc_oob_memset_8+0x9c/0x290 [test_kasan] [ 3047.049787] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.050386] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.051137] kthread+0x2a4/0x350 [ 3047.051544] ret_from_fork+0x1f/0x30 [ 3047.051989] [ 3047.052197] Last potentially related work creation: [ 3047.052795] kasan_save_stack+0x1e/0x40 [ 3047.053268] __kasan_record_aux_stack+0x96/0xb0 [ 3047.053828] insert_work+0x47/0x310 [ 3047.054263] __queue_work+0x4dd/0xd60 [ 3047.054714] rcu_work_rcufn+0x42/0x70 [ 3047.055169] rcu_do_batch+0x3c2/0xdc0 [ 3047.055623] rcu_core+0x3de/0x5a0 [ 3047.056063] __do_softirq+0x2d0/0x9a8 [ 3047.056516] [ 3047.056728] Second to last potentially related work creation: [ 3047.057419] kasan_save_stack+0x1e/0x40 [ 3047.057895] __kasan_record_aux_stack+0x96/0xb0 [ 3047.058447] call_rcu+0xee/0x890 [ 3047.058856] queue_rcu_work+0x5a/0x70 [ 3047.059310] writeback_sb_inodes+0x373/0xd00 [ 3047.059841] __writeback_inodes_wb+0xb7/0x210 [ 3047.060379] wb_writeback+0x686/0xa10 [ 3047.060838] wb_do_writeback+0x539/0x8a0 [ 3047.061319] wb_workfn+0x12c/0x670 [ 3047.061747] process_one_work+0x8e2/0x1520 [ 3047.062249] worker_thread+0x59e/0xf90 [ 3047.062711] kthread+0x2a4/0x350 [ 3047.063119] ret_from_fork+0x1f/0x30 [ 3047.063561] [ 3047.063773] The buggy address belongs to the object at ffff8880061be400 [ 3047.063773] which belongs to the cache kmalloc-128 of size 128 [ 3047.065306] The buggy address is located 113 bytes inside of [ 3047.065306] 128-byte region [ffff8880061be400, ffff8880061be480) [ 3047.066689] [ 3047.066901] The buggy address belongs to the physical page: [ 3047.067568] page:00000000ce5db6c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61be [ 3047.068660] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3047.069488] raw: 000fffffc0000200 ffffea00001b2f40 dead000000000003 ffff8881000418c0 [ 3047.070411] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3047.071337] page dumped because: kasan: bad access detected [ 3047.072007] [ 3047.072214] Memory state around the buggy address: [ 3047.072804] ffff8880061be300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.073667] ffff8880061be380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.074536] >ffff8880061be400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 3047.075398] ^ [ 3047.076250] ffff8880061be480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.077117] ffff8880061be500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.077983] ================================================================== [ 3047.079043] ok 20 - kmalloc_oob_memset_8 [ 3047.079232] ================================================================== [ 3047.080638] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 3047.081649] Write of size 16 at addr ffff8880061bec69 by task kunit_try_catch/118269 [ 3047.082570] [ 3047.082780] CPU: 1 PID: 118269 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.084397] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.085094] Call Trace: [ 3047.085405] [ 3047.085679] ? kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 3047.086381] dump_stack_lvl+0x57/0x81 [ 3047.086846] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.087547] ? kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 3047.088248] print_report.cold+0x5c/0x237 [ 3047.088748] kasan_report+0xc9/0x100 [ 3047.089284] ? kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 3047.090076] kasan_check_range+0xfd/0x1e0 [ 3047.090570] memset+0x20/0x50 [ 3047.090952] kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 3047.091687] ? kmalloc_uaf_memset+0x280/0x280 [test_kasan] [ 3047.092356] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.092901] ? do_raw_spin_lock+0x270/0x270 [ 3047.093417] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.094093] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3047.094697] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.095319] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.095923] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.096586] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.097353] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.097983] kthread+0x2a4/0x350 [ 3047.098391] ? kthread_complete_and_exit+0x20/0x20 [ 3047.098979] ret_from_fork+0x1f/0x30 [ 3047.099432] [ 3047.099716] [ 3047.099930] Allocated by task 118269: [ 3047.100384] kasan_save_stack+0x1e/0x40 [ 3047.100858] __kasan_kmalloc+0x81/0xa0 [ 3047.101323] kmalloc_oob_memset_16+0x9c/0x290 [test_kasan] [ 3047.101992] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.102590] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.103329] kthread+0x2a4/0x350 [ 3047.103739] ret_from_fork+0x1f/0x30 [ 3047.104185] [ 3047.104394] Last potentially related work creation: [ 3047.104992] kasan_save_stack+0x1e/0x40 [ 3047.105466] __kasan_record_aux_stack+0x96/0xb0 [ 3047.106028] insert_work+0x47/0x310 [ 3047.106462] __queue_work+0x4dd/0xd60 [ 3047.106920] rcu_work_rcufn+0x42/0x70 [ 3047.107372] rcu_do_batch+0x3c2/0xdc0 [ 3047.107829] rcu_core+0x3de/0x5a0 [ 3047.108245] __do_softirq+0x2d0/0x9a8 [ 3047.108699] [ 3047.108909] Second to last potentially related work creation: [ 3047.109606] kasan_save_stack+0x1e/0x40 [ 3047.110082] __kasan_record_aux_stack+0x96/0xb0 [ 3047.110636] call_rcu+0xee/0x890 [ 3047.111045] queue_rcu_work+0x5a/0x70 [ 3047.111498] writeback_sb_inodes+0x373/0xd00 [ 3047.112031] __writeback_inodes_wb+0xb7/0x210 [ 3047.112568] wb_writeback+0x686/0xa10 [ 3047.113028] wb_do_writeback+0x539/0x8a0 [ 3047.113510] wb_workfn+0x12c/0x670 [ 3047.113938] process_one_work+0x8e2/0x1520 [ 3047.114439] worker_thread+0x59e/0xf90 [ 3047.114905] kthread+0x2a4/0x350 [ 3047.115313] ret_from_fork+0x1f/0x30 [ 3047.115758] [ 3047.115965] The buggy address belongs to the object at ffff8880061bec00 [ 3047.115965] which belongs to the cache kmalloc-128 of size 128 [ 3047.117430] The buggy address is located 105 bytes inside of [ 3047.117430] 128-byte region [ffff8880061bec00, ffff8880061bec80) [ 3047.118814] [ 3047.119022] The buggy address belongs to the physical page: [ 3047.119690] page:00000000ce5db6c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61be [ 3047.120788] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3047.121608] raw: 000fffffc0000200 ffffea00001b2f40 dead000000000003 ffff8881000418c0 [ 3047.122555] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3047.123476] page dumped because: kasan: bad access detected [ 3047.124150] [ 3047.124357] Memory state around the buggy address: [ 3047.124955] ffff8880061beb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.125820] ffff8880061beb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.126678] >ffff8880061bec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 3047.127542] ^ [ 3047.128399] ffff8880061bec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.129263] ffff8880061bed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.130130] ================================================================== [ 3047.131077] ok 21 - kmalloc_oob_memset_16 [ 3047.131297] ================================================================== [ 3047.132708] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 3047.133752] Read of size 18446744073709551614 at addr ffff888139ecdf84 by task kunit_try_catch/118270 [ 3047.134841] [ 3047.135048] CPU: 1 PID: 118270 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.136664] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.137394] Call Trace: [ 3047.137750] [ 3047.138058] ? kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 3047.138878] dump_stack_lvl+0x57/0x81 [ 3047.139333] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.140032] ? kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 3047.140811] print_report.cold+0x5c/0x237 [ 3047.141309] kasan_report+0xc9/0x100 [ 3047.141761] ? kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 3047.142638] kasan_check_range+0xfd/0x1e0 [ 3047.143134] memmove+0x20/0x60 [ 3047.143524] kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 3047.144284] ? kmalloc_memmove_invalid_size+0x2a0/0x2a0 [test_kasan] [ 3047.145050] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.145589] ? do_raw_spin_lock+0x270/0x270 [ 3047.146110] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.146790] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3047.147451] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.148100] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.148698] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.149319] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.150059] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.150683] kthread+0x2a4/0x350 [ 3047.151093] ? kthread_complete_and_exit+0x20/0x20 [ 3047.151739] ret_from_fork+0x1f/0x30 [ 3047.152247] [ 3047.152569] [ 3047.152780] Allocated by task 118270: [ 3047.153230] kasan_save_stack+0x1e/0x40 [ 3047.153699] __kasan_kmalloc+0x81/0xa0 [ 3047.154165] kmalloc_memmove_negative_size+0x9c/0x290 [test_kasan] [ 3047.154911] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.155531] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.156279] kthread+0x2a4/0x350 [ 3047.156686] ret_from_fork+0x1f/0x30 [ 3047.157135] [ 3047.157341] The buggy address belongs to the object at ffff888139ecdf80 [ 3047.157341] which belongs to the cache kmalloc-64 of size 64 [ 3047.158791] The buggy address is located 4 bytes inside of [ 3047.158791] 64-byte region [ffff888139ecdf80, ffff888139ecdfc0) [ 3047.160143] [ 3047.160350] The buggy address belongs to the physical page: [ 3047.161019] page:00000000844a0993 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x139ecd [ 3047.162128] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 3047.162964] raw: 0017ffffc0000200 ffffea0000046440 dead000000000005 ffff888100041640 [ 3047.163889] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 3047.164810] page dumped because: kasan: bad access detected [ 3047.165477] [ 3047.165683] Memory state around the buggy address: [ 3047.166270] ffff888139ecde80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 3047.167139] ffff888139ecdf00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.168001] >ffff888139ecdf80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 3047.168868] ^ [ 3047.169272] ffff888139ece000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3047.170139] ffff888139ece080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 3047.170999] ================================================================== [ 3047.171993] ok 22 - kmalloc_memmove_negative_size [ 3047.172195] ================================================================== [ 3047.173686] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 3047.174767] Read of size 64 at addr ffff888139ecdb04 by task kunit_try_catch/118271 [ 3047.175677] [ 3047.175889] CPU: 1 PID: 118271 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.177506] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.178204] Call Trace: [ 3047.178517] [ 3047.178797] ? kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 3047.179564] dump_stack_lvl+0x57/0x81 [ 3047.180023] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.180726] ? kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 3047.181488] print_report.cold+0x5c/0x237 [ 3047.181992] kasan_report+0xc9/0x100 [ 3047.182438] ? kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 3047.183307] kasan_check_range+0xfd/0x1e0 [ 3047.183852] memmove+0x20/0x60 [ 3047.184243] kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 3047.184996] ? kmalloc_oob_in_memset+0x280/0x280 [test_kasan] [ 3047.185693] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.186238] ? do_raw_spin_lock+0x270/0x270 [ 3047.186760] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.187432] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.188174] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.188838] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.189457] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.190199] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.190829] kthread+0x2a4/0x350 [ 3047.191233] ? kthread_complete_and_exit+0x20/0x20 [ 3047.191822] ret_from_fork+0x1f/0x30 [ 3047.192274] [ 3047.192556] [ 3047.192774] Allocated by task 118271: [ 3047.193226] kasan_save_stack+0x1e/0x40 [ 3047.193698] __kasan_kmalloc+0x81/0xa0 [ 3047.194166] kmalloc_memmove_invalid_size+0xac/0x2a0 [test_kasan] [ 3047.194908] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.195505] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.196244] kthread+0x2a4/0x350 [ 3047.196648] ret_from_fork+0x1f/0x30 [ 3047.197097] [ 3047.197303] The buggy address belongs to the object at ffff888139ecdb00 [ 3047.197303] which belongs to the cache kmalloc-64 of size 64 [ 3047.198810] The buggy address is located 4 bytes inside of [ 3047.198810] 64-byte region [ffff888139ecdb00, ffff888139ecdb40) [ 3047.200184] [ 3047.200392] The buggy address belongs to the physical page: [ 3047.201134] page:00000000844a0993 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x139ecd [ 3047.202312] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 3047.203147] raw: 0017ffffc0000200 ffffea0000046440 dead000000000005 ffff888100041640 [ 3047.204068] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 3047.204991] page dumped because: kasan: bad access detected [ 3047.205655] [ 3047.205865] Memory state around the buggy address: [ 3047.206446] ffff888139ecda00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.207312] ffff888139ecda80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.208177] >ffff888139ecdb00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 3047.209058] ^ [ 3047.209695] ffff888139ecdb80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.210557] ffff888139ecdc00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.211422] ================================================================== [ 3047.212346] ok 23 - kmalloc_memmove_invalid_size [ 3047.212720] ================================================================== [ 3047.214214] BUG: KASAN: use-after-free in kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 3047.215084] Read of size 1 at addr ffff88800986aec8 by task kunit_try_catch/118272 [ 3047.215988] [ 3047.216198] CPU: 1 PID: 118272 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.217816] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.218507] Call Trace: [ 3047.218824] [ 3047.219099] ? kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 3047.219698] dump_stack_lvl+0x57/0x81 [ 3047.220156] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.220859] ? kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 3047.221486] print_report.cold+0x5c/0x237 [ 3047.221989] kasan_report+0xc9/0x100 [ 3047.222437] ? kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 3047.223039] kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 3047.223619] ? kmalloc_uaf2+0x430/0x430 [test_kasan] [ 3047.224226] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.224767] ? do_raw_spin_lock+0x270/0x270 [ 3047.225284] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.225963] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.226584] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.227184] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.227807] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.228545] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.229170] kthread+0x2a4/0x350 [ 3047.229577] ? kthread_complete_and_exit+0x20/0x20 [ 3047.230168] ret_from_fork+0x1f/0x30 [ 3047.230623] [ 3047.230912] [ 3047.231120] Allocated by task 118272: [ 3047.231570] kasan_save_stack+0x1e/0x40 [ 3047.232042] __kasan_kmalloc+0x81/0xa0 [ 3047.232503] kmalloc_uaf+0x98/0x2b0 [test_kasan] [ 3047.233075] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.233668] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.234403] kthread+0x2a4/0x350 [ 3047.234811] ret_from_fork+0x1f/0x30 [ 3047.235256] [ 3047.235462] Freed by task 118272: [ 3047.235878] kasan_save_stack+0x1e/0x40 [ 3047.236349] kasan_set_track+0x21/0x30 [ 3047.236816] kasan_set_free_info+0x20/0x40 [ 3047.237316] __kasan_slab_free+0x108/0x170 [ 3047.237819] slab_free_freelist_hook+0x11d/0x1d0 [ 3047.238384] kfree+0xe2/0x3c0 [ 3047.238768] kmalloc_uaf+0x12b/0x2b0 [test_kasan] [ 3047.239346] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.239947] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.240682] kthread+0x2a4/0x350 [ 3047.241091] ret_from_fork+0x1f/0x30 [ 3047.241535] [ 3047.241747] The buggy address belongs to the object at ffff88800986aec0 [ 3047.241747] which belongs to the cache kmalloc-16 of size 16 [ 3047.243192] The buggy address is located 8 bytes inside of [ 3047.243192] 16-byte region [ffff88800986aec0, ffff88800986aed0) [ 3047.244546] [ 3047.244760] The buggy address belongs to the physical page: [ 3047.245426] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a460 pfn:0x986a [ 3047.246671] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3047.247491] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3047.248416] raw: ffff88800986a460 0000000080800077 00000001ffffffff 0000000000000000 [ 3047.249385] page dumped because: kasan: bad access detected [ 3047.250078] [ 3047.250285] Memory state around the buggy address: [ 3047.250870] ffff88800986ad80: fb fb fc fc fb fb fc fc fa fb fc fc fb fb fc fc [ 3047.251737] ffff88800986ae00: fa fb fc fc fb fb fc fc fa fb fc fc fb fb fc fc [ 3047.252595] >ffff88800986ae80: fb fb fc fc fa fb fc fc fa fb fc fc fb fb fc fc [ 3047.253461] ^ [ 3047.254154] ffff88800986af00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3047.255022] ffff88800986af80: fa fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3047.255887] ================================================================== [ 3047.256808] ok 24 - kmalloc_uaf [ 3047.257012] ================================================================== [ 3047.258328] BUG: KASAN: use-after-free in kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 3047.259265] Write of size 33 at addr ffff888139ecd800 by task kunit_try_catch/118273 [ 3047.260187] [ 3047.260395] CPU: 1 PID: 118273 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.262016] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.262712] Call Trace: [ 3047.263025] [ 3047.263300] ? kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 3047.263968] dump_stack_lvl+0x57/0x81 [ 3047.264424] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.265122] ? kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 3047.265792] print_report.cold+0x5c/0x237 [ 3047.266288] kasan_report+0xc9/0x100 [ 3047.266741] ? kmalloc_uaf_memset+0xc1/0x280 [test_kasan] [ 3047.267396] ? kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 3047.268062] kasan_check_range+0xfd/0x1e0 [ 3047.268556] memset+0x20/0x50 [ 3047.268939] kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 3047.269583] ? kmem_cache_accounted+0x170/0x170 [test_kasan] [ 3047.270273] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.270819] ? do_raw_spin_lock+0x270/0x270 [ 3047.271336] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.272017] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.272635] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.273246] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.273869] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.274607] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.275237] kthread+0x2a4/0x350 [ 3047.275645] ? kthread_complete_and_exit+0x20/0x20 [ 3047.276237] ret_from_fork+0x1f/0x30 [ 3047.276690] [ 3047.276984] [ 3047.277190] Allocated by task 118273: [ 3047.277719] kasan_save_stack+0x1e/0x40 [ 3047.278247] __kasan_kmalloc+0x81/0xa0 [ 3047.278738] kmalloc_uaf_memset+0x9a/0x280 [test_kasan] [ 3047.279373] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.279971] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.280715] kthread+0x2a4/0x350 [ 3047.281122] ret_from_fork+0x1f/0x30 [ 3047.281566] [ 3047.281777] Freed by task 118273: [ 3047.282231] kasan_save_stack+0x1e/0x40 [ 3047.282764] kasan_set_track+0x21/0x30 [ 3047.283276] kasan_set_free_info+0x20/0x40 [ 3047.283781] __kasan_slab_free+0x108/0x170 [ 3047.284281] slab_free_freelist_hook+0x11d/0x1d0 [ 3047.284936] kfree+0xe2/0x3c0 [ 3047.285359] kmalloc_uaf_memset+0x137/0x280 [test_kasan] [ 3047.286030] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.286624] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.287396] kthread+0x2a4/0x350 [ 3047.287806] ret_from_fork+0x1f/0x30 [ 3047.288249] [ 3047.288455] The buggy address belongs to the object at ffff888139ecd800 [ 3047.288455] which belongs to the cache kmalloc-64 of size 64 [ 3047.289983] The buggy address is located 0 bytes inside of [ 3047.289983] 64-byte region [ffff888139ecd800, ffff888139ecd840) [ 3047.291407] [ 3047.291615] The buggy address belongs to the physical page: [ 3047.292290] page:00000000844a0993 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x139ecd [ 3047.293403] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 3047.294241] raw: 0017ffffc0000200 ffffea0000046440 dead000000000005 ffff888100041640 [ 3047.295163] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 3047.296111] page dumped because: kasan: bad access detected [ 3047.296783] [ 3047.296992] Memory state around the buggy address: [ 3047.297575] ffff888139ecd700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.298443] ffff888139ecd780: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 3047.299311] >ffff888139ecd800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.300220] ^ [ 3047.300627] ffff888139ecd880: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 3047.301514] ffff888139ecd900: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 3047.302442] ================================================================== [ 3047.303568] ok 25 - kmalloc_uaf_memset [ 3047.303787] ================================================================== [ 3047.305165] BUG: KASAN: use-after-free in kmalloc_uaf2+0x402/0x430 [test_kasan] [ 3047.306047] Read of size 1 at addr ffff888139ecdd28 by task kunit_try_catch/118274 [ 3047.306952] [ 3047.307159] CPU: 1 PID: 118274 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.308780] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.309470] Call Trace: [ 3047.309789] [ 3047.310063] ? kmalloc_uaf2+0x402/0x430 [test_kasan] [ 3047.310673] dump_stack_lvl+0x57/0x81 [ 3047.311132] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.311835] ? kmalloc_uaf2+0x402/0x430 [test_kasan] [ 3047.312437] print_report.cold+0x5c/0x237 [ 3047.312975] kasan_report+0xc9/0x100 [ 3047.313473] ? kmalloc_uaf2+0x402/0x430 [test_kasan] [ 3047.314145] kmalloc_uaf2+0x402/0x430 [test_kasan] [ 3047.314739] ? kfree_via_page+0x290/0x290 [test_kasan] [ 3047.315364] ? rcu_read_lock_sched_held+0x12/0x80 [ 3047.315947] ? lock_acquire+0x4ea/0x620 [ 3047.316421] ? rcu_read_unlock+0x40/0x40 [ 3047.316969] ? rcu_read_unlock+0x40/0x40 [ 3047.317539] ? rcu_read_lock_sched_held+0x12/0x80 [ 3047.318187] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.318865] ? do_raw_spin_lock+0x270/0x270 [ 3047.319381] ? trace_hardirqs_on+0x2d/0x160 [ 3047.319899] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3047.320505] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.321132] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.321738] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.322356] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.323098] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.323729] kthread+0x2a4/0x350 [ 3047.324137] ? kthread_complete_and_exit+0x20/0x20 [ 3047.324725] ret_from_fork+0x1f/0x30 [ 3047.325181] [ 3047.325465] [ 3047.325672] Allocated by task 118274: [ 3047.326127] kasan_save_stack+0x1e/0x40 [ 3047.326598] __kasan_kmalloc+0x81/0xa0 [ 3047.327063] kmalloc_uaf2+0xad/0x430 [test_kasan] [ 3047.327638] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.328242] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.328981] kthread+0x2a4/0x350 [ 3047.329385] ret_from_fork+0x1f/0x30 [ 3047.329835] [ 3047.330043] Freed by task 118274: [ 3047.330458] kasan_save_stack+0x1e/0x40 [ 3047.330933] kasan_set_track+0x21/0x30 [ 3047.331395] kasan_set_free_info+0x20/0x40 [ 3047.331899] __kasan_slab_free+0x108/0x170 [ 3047.332399] slab_free_freelist_hook+0x11d/0x1d0 [ 3047.332968] kfree+0xe2/0x3c0 [ 3047.333345] kmalloc_uaf2+0x144/0x430 [test_kasan] [ 3047.333932] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.334528] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.335270] kthread+0x2a4/0x350 [ 3047.335675] ret_from_fork+0x1f/0x30 [ 3047.336125] [ 3047.336331] The buggy address belongs to the object at ffff888139ecdd00 [ 3047.336331] which belongs to the cache kmalloc-64 of size 64 [ 3047.337780] The buggy address is located 40 bytes inside of [ 3047.337780] 64-byte region [ffff888139ecdd00, ffff888139ecdd40) [ 3047.339266] [ 3047.339492] The buggy address belongs to the physical page: [ 3047.340161] page:00000000844a0993 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x139ecd [ 3047.341277] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 3047.342150] raw: 0017ffffc0000200 ffffea0000046440 dead000000000005 ffff888100041640 [ 3047.343184] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 3047.344127] page dumped because: kasan: bad access detected [ 3047.344796] [ 3047.345003] Memory state around the buggy address: [ 3047.345585] ffff888139ecdc00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.346448] ffff888139ecdc80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.347315] >ffff888139ecdd00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.348182] ^ [ 3047.348736] ffff888139ecdd80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.349593] ffff888139ecde00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 3047.350481] ================================================================== [ 3047.351454] ok 26 - kmalloc_uaf2 [ 3047.351672] ok 27 - kfree_via_page [ 3047.352330] ok 28 - kfree_via_phys [ 3047.353480] ================================================================== [ 3047.354830] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 3047.355772] Read of size 1 at addr ffff888052205b18 by task kunit_try_catch/118277 [ 3047.356671] [ 3047.356884] CPU: 1 PID: 118277 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.358503] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.359204] Call Trace: [ 3047.359517] [ 3047.359797] ? kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 3047.360425] dump_stack_lvl+0x57/0x81 [ 3047.360888] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.361588] ? kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 3047.362215] print_report.cold+0x5c/0x237 [ 3047.362715] kasan_report+0xc9/0x100 [ 3047.363161] ? kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 3047.363791] kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 3047.364396] ? kmem_cache_double_free+0x280/0x280 [test_kasan] [ 3047.365113] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.365651] ? do_raw_spin_lock+0x270/0x270 [ 3047.366174] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.366852] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.367472] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.368076] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.368692] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.369437] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.370094] kthread+0x2a4/0x350 [ 3047.370548] ? kthread_complete_and_exit+0x20/0x20 [ 3047.371212] ret_from_fork+0x1f/0x30 [ 3047.371667] [ 3047.371957] [ 3047.372163] Allocated by task 118277: [ 3047.372615] kasan_save_stack+0x1e/0x40 [ 3047.373090] __kasan_slab_alloc+0x66/0x80 [ 3047.373580] kmem_cache_alloc+0x161/0x310 [ 3047.374073] kmem_cache_oob+0x121/0x2e0 [test_kasan] [ 3047.374678] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.375276] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.376015] kthread+0x2a4/0x350 [ 3047.376420] ret_from_fork+0x1f/0x30 [ 3047.376867] [ 3047.377075] The buggy address belongs to the object at ffff888052205a50 [ 3047.377075] which belongs to the cache test_cache of size 200 [ 3047.378529] The buggy address is located 0 bytes to the right of [ 3047.378529] 200-byte region [ffff888052205a50, ffff888052205b18) [ 3047.379956] [ 3047.380164] The buggy address belongs to the physical page: [ 3047.380838] page:00000000122eb088 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52205 [ 3047.381943] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3047.382771] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff888002d6a000 [ 3047.383726] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 3047.384644] page dumped because: kasan: bad access detected [ 3047.385315] [ 3047.385523] Memory state around the buggy address: [ 3047.386111] ffff888052205a00: fc fc fc fc fc fc fc fc fc fc 00 00 00 00 00 00 [ 3047.386980] ffff888052205a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.387842] >ffff888052205b00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.388711] ^ [ 3047.389211] ffff888052205b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.390077] ffff888052205c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3047.390942] ================================================================== [ 3047.396652] ok 29 - kmem_cache_oob [ 3047.919642] ok 30 - kmem_cache_accounted [ 3047.925289] ok 31 - kmem_cache_bulk [ 3047.926057] ================================================================== [ 3047.927425] BUG: KASAN: global-out-of-bounds in kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 3047.928461] Read of size 1 at addr ffffffffc15aa90d by task kunit_try_catch/118280 [ 3047.929362] [ 3047.929570] CPU: 0 PID: 118280 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.931188] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.931880] Call Trace: [ 3047.932189] [ 3047.932462] ? kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 3047.933171] dump_stack_lvl+0x57/0x81 [ 3047.933625] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.934328] ? kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 3047.935038] print_report.cold+0x5c/0x237 [ 3047.935531] kasan_report+0xc9/0x100 [ 3047.935980] ? kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 3047.936688] kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 3047.937374] ? kasan_stack_oob+0x200/0x200 [test_kasan] [ 3047.938007] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.938546] ? do_raw_spin_lock+0x270/0x270 [ 3047.939063] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.939736] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.940351] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.940949] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.941563] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.942301] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.942931] kthread+0x2a4/0x350 [ 3047.943337] ? kthread_complete_and_exit+0x20/0x20 [ 3047.943982] ret_from_fork+0x1f/0x30 [ 3047.944433] [ 3047.944718] [ 3047.944923] The buggy address belongs to the variable: [ 3047.945564] global_array+0xd/0xfffffffffffe5700 [test_kasan] [ 3047.946294] [ 3047.946501] Memory state around the buggy address: [ 3047.947083] ffffffffc15aa800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.947954] ffffffffc15aa880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.948821] >ffffffffc15aa900: 00 02 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 [ 3047.949684] ^ [ 3047.950115] ffffffffc15aa980: 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 [ 3047.950978] ffffffffc15aaa00: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 3047.951836] ================================================================== [ 3047.952766] ok 32 - kasan_global_oob_right [ 3047.953035] ok 33 - kasan_global_oob_left # SKIP Test requires CONFIG_CC_IS_CLANG=y [ 3047.954142] ================================================================== [ 3047.956576] BUG: KASAN: stack-out-of-bounds in kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 3047.957621] Read of size 1 at addr ffffc900010e7e7a by task kunit_try_catch/118282 [ 3047.958557] [ 3047.958771] CPU: 1 PID: 118282 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.960479] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3047.961232] Call Trace: [ 3047.961544] [ 3047.961825] ? kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 3047.962482] dump_stack_lvl+0x57/0x81 [ 3047.962968] print_address_description.constprop.0+0x1f/0x1e0 [ 3047.963695] ? kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 3047.964350] print_report.cold+0x5c/0x237 [ 3047.964850] kasan_report+0xc9/0x100 [ 3047.965299] ? kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 3047.965939] kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 3047.966553] ? match_all_mem_tag+0x20/0x20 [test_kasan] [ 3047.967192] ? rcu_read_unlock+0x40/0x40 [ 3047.967677] ? rcu_read_lock_sched_held+0x12/0x80 [ 3047.968254] ? do_raw_spin_trylock+0xb5/0x180 [ 3047.968795] ? do_raw_spin_lock+0x270/0x270 [ 3047.969309] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3047.969987] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3047.970591] ? kunit_add_resource+0x197/0x280 [kunit] [ 3047.971228] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3047.971833] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3047.972447] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3047.973185] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3047.973813] kthread+0x2a4/0x350 [ 3047.974219] ? kthread_complete_and_exit+0x20/0x20 [ 3047.974809] ret_from_fork+0x1f/0x30 [ 3047.975262] [ 3047.975545] [ 3047.975754] The buggy address belongs to stack of task kunit_try_catch/118282 [ 3047.976607] and is located at offset 266 in frame: [ 3047.977203] kasan_stack_oob+0x0/0x200 [test_kasan] [ 3047.977800] [ 3047.978007] This frame has 4 objects: [ 3047.978460] [48, 56) 'array' [ 3047.978463] [80, 128) '__assertion' [ 3047.978845] [160, 224) '__assertion' [ 3047.979286] [256, 266) 'stack_array' [ 3047.979739] [ 3047.980396] The buggy address belongs to the virtual mapping at [ 3047.980396] [ffffc900010e0000, ffffc900010e9000) created by: [ 3047.980396] dup_task_struct+0x5e/0x5a0 [ 3047.982214] [ 3047.982422] The buggy address belongs to the physical page: [ 3047.983097] page:00000000078b05b0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2923e [ 3047.984200] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 3047.984984] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 3047.985907] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3047.986825] page dumped because: kasan: bad access detected [ 3047.987490] [ 3047.987700] Memory state around the buggy address: [ 3047.988280] ffffc900010e7d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 3047.989146] ffffc900010e7d80: f1 f1 f1 f1 00 f2 f2 f2 00 00 00 00 00 00 f2 f2 [ 3047.990011] >ffffc900010e7e00: f2 f2 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 02 [ 3047.990877] ^ [ 3047.991732] ffffc900010e7e80: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.992591] ffffc900010e7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3047.993453] ================================================================== [ 3047.994428] ok 34 - kasan_stack_oob [ 3047.994603] ================================================================== [ 3047.995999] BUG: KASAN: alloca-out-of-bounds in kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 3047.997030] Read of size 1 at addr ffffc900010d7d1f by task kunit_try_catch/118283 [ 3047.997941] [ 3047.998150] CPU: 1 PID: 118283 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3047.999772] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.000462] Call Trace: [ 3048.000779] [ 3048.001053] ? kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 3048.001761] dump_stack_lvl+0x57/0x81 [ 3048.002214] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.002919] ? kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 3048.003619] print_report.cold+0x5c/0x237 [ 3048.004119] kasan_report+0xc9/0x100 [ 3048.004565] ? kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 3048.005267] kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 3048.005958] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.006534] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.007113] ? lock_acquire+0x4ea/0x620 [ 3048.007588] ? kasan_alloca_oob_right+0x290/0x290 [test_kasan] [ 3048.008305] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.008883] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.009419] ? do_raw_spin_lock+0x270/0x270 [ 3048.009941] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.010613] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3048.011224] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.011847] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.012442] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.013062] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.013803] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.014474] kthread+0x2a4/0x350 [ 3048.014885] ? kthread_complete_and_exit+0x20/0x20 [ 3048.015489] ret_from_fork+0x1f/0x30 [ 3048.015949] [ 3048.016231] [ 3048.016439] The buggy address belongs to stack of task kunit_try_catch/118283 [ 3048.017297] [ 3048.017506] The buggy address belongs to the virtual mapping at [ 3048.017506] [ffffc900010d0000, ffffc900010d9000) created by: [ 3048.017506] dup_task_struct+0x5e/0x5a0 [ 3048.019319] [ 3048.019528] The buggy address belongs to the physical page: [ 3048.020196] page:000000002ce11fe0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4eef0 [ 3048.021296] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 3048.022076] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 3048.022998] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3048.023920] page dumped because: kasan: bad access detected [ 3048.024586] [ 3048.024797] Memory state around the buggy address: [ 3048.025378] ffffc900010d7c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.026242] ffffc900010d7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.027118] >ffffc900010d7d00: ca ca ca ca 00 02 cb cb cb cb cb cb 00 00 00 00 [ 3048.028003] ^ [ 3048.028491] ffffc900010d7d80: f1 f1 f1 f1 04 f2 00 f2 f2 f2 00 00 00 00 00 00 [ 3048.029355] ffffc900010d7e00: f2 f2 f2 f2 00 00 00 00 00 00 00 00 f3 f3 f3 f3 [ 3048.030219] ================================================================== [ 3048.031136] ok 35 - kasan_alloca_oob_left [ 3048.031307] ================================================================== [ 3048.032719] BUG: KASAN: alloca-out-of-bounds in kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 3048.033759] Read of size 1 at addr ffffc900010e7d2a by task kunit_try_catch/118284 [ 3048.034660] [ 3048.034881] CPU: 1 PID: 118284 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.036498] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.037195] Call Trace: [ 3048.037506] [ 3048.037787] ? kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 3048.038495] dump_stack_lvl+0x57/0x81 [ 3048.038961] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.039658] ? kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 3048.040363] print_report.cold+0x5c/0x237 [ 3048.040862] kasan_report+0xc9/0x100 [ 3048.041309] ? kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 3048.042023] kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 3048.042720] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.043296] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.043876] ? lock_acquire+0x4ea/0x620 [ 3048.044353] ? ksize_unpoisons_memory+0x300/0x300 [test_kasan] [ 3048.045059] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.045633] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.046177] ? do_raw_spin_lock+0x270/0x270 [ 3048.046698] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.047372] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3048.047980] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.048597] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.049196] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.049817] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.050551] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.051183] kthread+0x2a4/0x350 [ 3048.051589] ? kthread_complete_and_exit+0x20/0x20 [ 3048.052176] ret_from_fork+0x1f/0x30 [ 3048.052676] [ 3048.053016] [ 3048.053248] The buggy address belongs to stack of task kunit_try_catch/118284 [ 3048.054149] [ 3048.054357] The buggy address belongs to the virtual mapping at [ 3048.054357] [ffffc900010e0000, ffffc900010e9000) created by: [ 3048.054357] dup_task_struct+0x5e/0x5a0 [ 3048.056209] [ 3048.056415] The buggy address belongs to the physical page: [ 3048.057085] page:00000000078b05b0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2923e [ 3048.058185] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 3048.058962] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 3048.059881] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3048.060803] page dumped because: kasan: bad access detected [ 3048.061469] [ 3048.061681] Memory state around the buggy address: [ 3048.062262] ffffc900010e7c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.063126] ffffc900010e7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.063992] >ffffc900010e7d00: ca ca ca ca 00 02 cb cb cb cb cb cb 00 00 00 00 [ 3048.064856] ^ [ 3048.065459] ffffc900010e7d80: f1 f1 f1 f1 04 f2 00 f2 f2 f2 00 00 00 00 00 00 [ 3048.066345] ffffc900010e7e00: f2 f2 f2 f2 00 00 00 00 00 00 00 00 f3 f3 f3 f3 [ 3048.067216] ================================================================== [ 3048.068121] ok 36 - kasan_alloca_oob_right [ 3048.068297] ================================================================== [ 3048.069726] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 3048.070741] Read of size 1 at addr ffff888006cbda80 by task kunit_try_catch/118285 [ 3048.071648] [ 3048.071856] CPU: 1 PID: 118285 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.073536] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.074233] Call Trace: [ 3048.074546] [ 3048.074823] ? ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 3048.075532] dump_stack_lvl+0x57/0x81 [ 3048.075991] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.076694] ? ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 3048.077398] print_report.cold+0x5c/0x237 [ 3048.077896] kasan_report+0xc9/0x100 [ 3048.078343] ? ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 3048.079058] ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 3048.079751] ? ksize_uaf+0x4a0/0x4a0 [test_kasan] [ 3048.080327] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.080870] ? do_raw_spin_lock+0x270/0x270 [ 3048.081384] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.082062] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.082686] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.083281] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.083900] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.084632] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.085262] kthread+0x2a4/0x350 [ 3048.085675] ? kthread_complete_and_exit+0x20/0x20 [ 3048.086261] ret_from_fork+0x1f/0x30 [ 3048.086719] [ 3048.087029] [ 3048.087260] Allocated by task 118285: [ 3048.087768] kasan_save_stack+0x1e/0x40 [ 3048.088279] __kasan_kmalloc+0x81/0xa0 [ 3048.088743] ksize_unpoisons_memory+0x9a/0x300 [test_kasan] [ 3048.089437] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.090039] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.090782] kthread+0x2a4/0x350 [ 3048.091189] ret_from_fork+0x1f/0x30 [ 3048.091634] [ 3048.091846] Last potentially related work creation: [ 3048.092481] kasan_save_stack+0x1e/0x40 [ 3048.093015] __kasan_record_aux_stack+0x96/0xb0 [ 3048.093605] insert_work+0x47/0x310 [ 3048.094048] __queue_work+0x4dd/0xd60 [ 3048.094500] rcu_work_rcufn+0x42/0x70 [ 3048.094954] rcu_do_batch+0x3c2/0xdc0 [ 3048.095409] rcu_core+0x3de/0x5a0 [ 3048.095829] __do_softirq+0x2d0/0x9a8 [ 3048.096284] [ 3048.096492] Second to last potentially related work creation: [ 3048.097189] kasan_save_stack+0x1e/0x40 [ 3048.097664] __kasan_record_aux_stack+0x96/0xb0 [ 3048.098221] call_rcu+0xee/0x890 [ 3048.098626] queue_rcu_work+0x5a/0x70 [ 3048.099084] writeback_sb_inodes+0x373/0xd00 [ 3048.099612] wb_writeback+0x25a/0xa10 [ 3048.100071] wb_do_writeback+0x1dd/0x8a0 [ 3048.100553] wb_workfn+0x12c/0x670 [ 3048.100983] process_one_work+0x8e2/0x1520 [ 3048.101486] worker_thread+0x59e/0xf90 [ 3048.102011] kthread+0x2a4/0x350 [ 3048.102464] ret_from_fork+0x1f/0x30 [ 3048.102955] [ 3048.103163] The buggy address belongs to the object at ffff888006cbda00 [ 3048.103163] which belongs to the cache kmalloc-128 of size 128 [ 3048.104629] The buggy address is located 0 bytes to the right of [ 3048.104629] 128-byte region [ffff888006cbda00, ffff888006cbda80) [ 3048.106050] [ 3048.106257] The buggy address belongs to the physical page: [ 3048.106930] page:00000000ca120960 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6cbd [ 3048.108021] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.108848] raw: 000fffffc0000200 ffffea00013a6d80 dead000000000002 ffff8881000418c0 [ 3048.109775] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3048.110699] page dumped because: kasan: bad access detected [ 3048.111368] [ 3048.111574] Memory state around the buggy address: [ 3048.112166] ffff888006cbd980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.113034] ffff888006cbda00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.113898] >ffff888006cbda80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.114762] ^ [ 3048.115168] ffff888006cbdb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.116068] ffff888006cbdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.116980] ================================================================== [ 3048.117944] ok 37 - ksize_unpoisons_memory [ 3048.118186] ================================================================== [ 3048.119697] BUG: KASAN: use-after-free in ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 3048.120651] Read of size 1 at addr ffff888006cbd100 by task kunit_try_catch/118286 [ 3048.121664] [ 3048.121904] CPU: 1 PID: 118286 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.123738] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.124516] Call Trace: [ 3048.124870] [ 3048.125178] ? ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 3048.125829] dump_stack_lvl+0x57/0x81 [ 3048.126339] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.127132] ? ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 3048.127781] print_report.cold+0x5c/0x237 [ 3048.128335] kasan_report+0xc9/0x100 [ 3048.128839] ? ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 3048.129488] ? ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 3048.130137] __kasan_check_byte+0x36/0x50 [ 3048.130705] ksize+0x1b/0x50 [ 3048.131122] ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 3048.131752] ? kmem_cache_oob+0x2e0/0x2e0 [test_kasan] [ 3048.132449] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.133070] ? do_raw_spin_lock+0x270/0x270 [ 3048.133654] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.134410] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.135110] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.135780] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.136474] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.137301] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.138015] kthread+0x2a4/0x350 [ 3048.138471] ? kthread_complete_and_exit+0x20/0x20 [ 3048.139129] ret_from_fork+0x1f/0x30 [ 3048.139642] [ 3048.139959] [ 3048.140190] Allocated by task 118286: [ 3048.140701] kasan_save_stack+0x1e/0x40 [ 3048.141226] __kasan_kmalloc+0x81/0xa0 [ 3048.141747] ksize_uaf+0x9a/0x4a0 [test_kasan] [ 3048.142356] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.143026] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.143849] kthread+0x2a4/0x350 [ 3048.144300] ret_from_fork+0x1f/0x30 [ 3048.144801] [ 3048.145033] Freed by task 118286: [ 3048.145494] kasan_save_stack+0x1e/0x40 [ 3048.146023] kasan_set_track+0x21/0x30 [ 3048.146539] kasan_set_free_info+0x20/0x40 [ 3048.147099] __kasan_slab_free+0x108/0x170 [ 3048.147661] slab_free_freelist_hook+0x11d/0x1d0 [ 3048.148293] kfree+0xe2/0x3c0 [ 3048.148718] ksize_uaf+0x137/0x4a0 [test_kasan] [ 3048.149337] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.150005] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.150827] kthread+0x2a4/0x350 [ 3048.151278] ret_from_fork+0x1f/0x30 [ 3048.151779] [ 3048.152010] Last potentially related work creation: [ 3048.152674] kasan_save_stack+0x1e/0x40 [ 3048.153206] __kasan_record_aux_stack+0x96/0xb0 [ 3048.153841] insert_work+0x47/0x310 [ 3048.154276] __queue_work+0x4dd/0xd60 [ 3048.154733] rcu_work_rcufn+0x42/0x70 [ 3048.155218] rcu_do_batch+0x3c2/0xdc0 [ 3048.155679] rcu_core+0x3de/0x5a0 [ 3048.156114] __do_softirq+0x2d0/0x9a8 [ 3048.156619] [ 3048.156855] Second to last potentially related work creation: [ 3048.157599] kasan_save_stack+0x1e/0x40 [ 3048.158071] __kasan_record_aux_stack+0x96/0xb0 [ 3048.158627] call_rcu+0xee/0x890 [ 3048.159036] queue_rcu_work+0x5a/0x70 [ 3048.159491] writeback_sb_inodes+0x373/0xd00 [ 3048.160025] wb_writeback+0x25a/0xa10 [ 3048.160477] wb_do_writeback+0x1dd/0x8a0 [ 3048.160963] wb_workfn+0x12c/0x670 [ 3048.161387] process_one_work+0x8e2/0x1520 [ 3048.161896] worker_thread+0x59e/0xf90 [ 3048.162358] kthread+0x2a4/0x350 [ 3048.162792] ret_from_fork+0x1f/0x30 [ 3048.163292] [ 3048.163524] The buggy address belongs to the object at ffff888006cbd100 [ 3048.163524] which belongs to the cache kmalloc-128 of size 128 [ 3048.165034] The buggy address is located 0 bytes inside of [ 3048.165034] 128-byte region [ffff888006cbd100, ffff888006cbd180) [ 3048.166401] [ 3048.166609] The buggy address belongs to the physical page: [ 3048.167327] page:00000000ca120960 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6cbd [ 3048.168440] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.169265] raw: 000fffffc0000200 ffffea00013a6d80 dead000000000002 ffff8881000418c0 [ 3048.170190] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3048.171114] page dumped because: kasan: bad access detected [ 3048.171784] [ 3048.171992] Memory state around the buggy address: [ 3048.172572] ffff888006cbd000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.173436] ffff888006cbd080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.174298] >ffff888006cbd100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3048.175163] ^ [ 3048.175566] ffff888006cbd180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.176429] ffff888006cbd200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.177296] ================================================================== [ 3048.178359] ================================================================== [ 3048.179230] BUG: KASAN: use-after-free in ksize_uaf+0x47d/0x4a0 [test_kasan] [ 3048.180081] Read of size 1 at addr ffff888006cbd100 by task kunit_try_catch/118286 [ 3048.180984] [ 3048.181193] CPU: 1 PID: 118286 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.182818] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.183511] Call Trace: [ 3048.183827] [ 3048.184101] ? ksize_uaf+0x47d/0x4a0 [test_kasan] [ 3048.184685] dump_stack_lvl+0x57/0x81 [ 3048.185142] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.185843] ? ksize_uaf+0x47d/0x4a0 [test_kasan] [ 3048.186422] print_report.cold+0x5c/0x237 [ 3048.186922] kasan_report+0xc9/0x100 [ 3048.187371] ? ksize_uaf+0x47d/0x4a0 [test_kasan] [ 3048.187980] ksize_uaf+0x47d/0x4a0 [test_kasan] [ 3048.188543] ? kmem_cache_oob+0x2e0/0x2e0 [test_kasan] [ 3048.189172] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.189715] ? do_raw_spin_lock+0x270/0x270 [ 3048.190231] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.190907] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.191526] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.192134] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.192753] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.193496] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.194137] kthread+0x2a4/0x350 [ 3048.194543] ? kthread_complete_and_exit+0x20/0x20 [ 3048.195133] ret_from_fork+0x1f/0x30 [ 3048.195590] [ 3048.195877] [ 3048.196084] Allocated by task 118286: [ 3048.196535] kasan_save_stack+0x1e/0x40 [ 3048.197012] __kasan_kmalloc+0x81/0xa0 [ 3048.197476] ksize_uaf+0x9a/0x4a0 [test_kasan] [ 3048.198028] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.198625] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.199365] kthread+0x2a4/0x350 [ 3048.199775] ret_from_fork+0x1f/0x30 [ 3048.200217] [ 3048.200424] Freed by task 118286: [ 3048.200842] kasan_save_stack+0x1e/0x40 [ 3048.201313] kasan_set_track+0x21/0x30 [ 3048.201783] kasan_set_free_info+0x20/0x40 [ 3048.202284] __kasan_slab_free+0x108/0x170 [ 3048.202790] slab_free_freelist_hook+0x11d/0x1d0 [ 3048.203415] kfree+0xe2/0x3c0 [ 3048.203842] ksize_uaf+0x137/0x4a0 [test_kasan] [ 3048.204435] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.205034] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.205772] kthread+0x2a4/0x350 [ 3048.206175] ret_from_fork+0x1f/0x30 [ 3048.206619] [ 3048.206833] Last potentially related work creation: [ 3048.207425] kasan_save_stack+0x1e/0x40 [ 3048.207900] __kasan_record_aux_stack+0x96/0xb0 [ 3048.208453] insert_work+0x47/0x310 [ 3048.208894] __queue_work+0x4dd/0xd60 [ 3048.209348] rcu_work_rcufn+0x42/0x70 [ 3048.209810] rcu_do_batch+0x3c2/0xdc0 [ 3048.210266] rcu_core+0x3de/0x5a0 [ 3048.210703] __do_softirq+0x2d0/0x9a8 [ 3048.211209] [ 3048.211440] Second to last potentially related work creation: [ 3048.212179] kasan_save_stack+0x1e/0x40 [ 3048.212653] __kasan_record_aux_stack+0x96/0xb0 [ 3048.213208] call_rcu+0xee/0x890 [ 3048.213616] queue_rcu_work+0x5a/0x70 [ 3048.214073] writeback_sb_inodes+0x373/0xd00 [ 3048.214599] wb_writeback+0x25a/0xa10 [ 3048.215056] wb_do_writeback+0x1dd/0x8a0 [ 3048.215537] wb_workfn+0x12c/0x670 [ 3048.215963] process_one_work+0x8e2/0x1520 [ 3048.216463] worker_thread+0x59e/0xf90 [ 3048.216929] kthread+0x2a4/0x350 [ 3048.217333] ret_from_fork+0x1f/0x30 [ 3048.217785] [ 3048.218012] The buggy address belongs to the object at ffff888006cbd100 [ 3048.218012] which belongs to the cache kmalloc-128 of size 128 [ 3048.219528] The buggy address is located 0 bytes inside of [ 3048.219528] 128-byte region [ffff888006cbd100, ffff888006cbd180) [ 3048.220900] [ 3048.221118] The buggy address belongs to the physical page: [ 3048.221793] page:00000000ca120960 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6cbd [ 3048.222887] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.223713] raw: 000fffffc0000200 ffffea00013a6d80 dead000000000002 ffff8881000418c0 [ 3048.224637] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3048.225549] page dumped because: kasan: bad access detected [ 3048.226220] [ 3048.226426] Memory state around the buggy address: [ 3048.227010] ffff888006cbd000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.227878] ffff888006cbd080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.228747] >ffff888006cbd100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3048.229607] ^ [ 3048.230013] ffff888006cbd180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.230883] ffff888006cbd200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.231749] ================================================================== [ 3048.232654] ================================================================== [ 3048.233522] BUG: KASAN: use-after-free in ksize_uaf+0x470/0x4a0 [test_kasan] [ 3048.234373] Read of size 1 at addr ffff888006cbd178 by task kunit_try_catch/118286 [ 3048.235282] [ 3048.235489] CPU: 1 PID: 118286 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.237108] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.237842] Call Trace: [ 3048.238191] [ 3048.238499] ? ksize_uaf+0x470/0x4a0 [test_kasan] [ 3048.239115] dump_stack_lvl+0x57/0x81 [ 3048.239573] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.240273] ? ksize_uaf+0x470/0x4a0 [test_kasan] [ 3048.240856] print_report.cold+0x5c/0x237 [ 3048.241352] kasan_report+0xc9/0x100 [ 3048.241812] ? ksize_uaf+0x470/0x4a0 [test_kasan] [ 3048.242388] ksize_uaf+0x470/0x4a0 [test_kasan] [ 3048.242951] ? kmem_cache_oob+0x2e0/0x2e0 [test_kasan] [ 3048.243575] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.244116] ? do_raw_spin_lock+0x270/0x270 [ 3048.244637] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.245312] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.245944] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.246541] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.247162] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.247905] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.248531] kthread+0x2a4/0x350 [ 3048.248953] ? kthread_complete_and_exit+0x20/0x20 [ 3048.249538] ret_from_fork+0x1f/0x30 [ 3048.249997] [ 3048.250281] [ 3048.250489] Allocated by task 118286: [ 3048.250945] kasan_save_stack+0x1e/0x40 [ 3048.251416] __kasan_kmalloc+0x81/0xa0 [ 3048.251883] ksize_uaf+0x9a/0x4a0 [test_kasan] [ 3048.252430] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.253027] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.253842] kthread+0x2a4/0x350 [ 3048.254322] ret_from_fork+0x1f/0x30 [ 3048.254789] [ 3048.254997] Freed by task 118286: [ 3048.255408] kasan_save_stack+0x1e/0x40 [ 3048.255885] kasan_set_track+0x21/0x30 [ 3048.256348] kasan_set_free_info+0x20/0x40 [ 3048.256853] __kasan_slab_free+0x108/0x170 [ 3048.257355] slab_free_freelist_hook+0x11d/0x1d0 [ 3048.257923] kfree+0xe2/0x3c0 [ 3048.258300] ksize_uaf+0x137/0x4a0 [test_kasan] [ 3048.258863] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.259461] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.260200] kthread+0x2a4/0x350 [ 3048.260605] ret_from_fork+0x1f/0x30 [ 3048.261053] [ 3048.261258] Last potentially related work creation: [ 3048.261855] kasan_save_stack+0x1e/0x40 [ 3048.262328] __kasan_record_aux_stack+0x96/0xb0 [ 3048.262886] insert_work+0x47/0x310 [ 3048.263356] __queue_work+0x4dd/0xd60 [ 3048.263865] rcu_work_rcufn+0x42/0x70 [ 3048.264380] rcu_do_batch+0x3c2/0xdc0 [ 3048.264838] rcu_core+0x3de/0x5a0 [ 3048.265254] __do_softirq+0x2d0/0x9a8 [ 3048.265713] [ 3048.265920] Second to last potentially related work creation: [ 3048.266614] kasan_save_stack+0x1e/0x40 [ 3048.267094] __kasan_record_aux_stack+0x96/0xb0 [ 3048.267654] call_rcu+0xee/0x890 [ 3048.268059] queue_rcu_work+0x5a/0x70 [ 3048.268514] writeback_sb_inodes+0x373/0xd00 [ 3048.269093] wb_writeback+0x25a/0xa10 [ 3048.269547] wb_do_writeback+0x1dd/0x8a0 [ 3048.270055] wb_workfn+0x12c/0x670 [ 3048.270481] process_one_work+0x8e2/0x1520 [ 3048.270984] worker_thread+0x59e/0xf90 [ 3048.271444] kthread+0x2a4/0x350 [ 3048.271855] ret_from_fork+0x1f/0x30 [ 3048.272298] [ 3048.272505] The buggy address belongs to the object at ffff888006cbd100 [ 3048.272505] which belongs to the cache kmalloc-128 of size 128 [ 3048.273974] The buggy address is located 120 bytes inside of [ 3048.273974] 128-byte region [ffff888006cbd100, ffff888006cbd180) [ 3048.275394] [ 3048.275641] The buggy address belongs to the physical page: [ 3048.276394] page:00000000ca120960 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6cbd [ 3048.277486] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.278309] raw: 000fffffc0000200 ffffea00013a6d80 dead000000000002 ffff8881000418c0 [ 3048.279241] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 3048.280163] page dumped because: kasan: bad access detected [ 3048.280831] [ 3048.281038] Memory state around the buggy address: [ 3048.281619] ffff888006cbd000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.282486] ffff888006cbd080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.283348] >ffff888006cbd100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3048.284211] ^ [ 3048.285065] ffff888006cbd180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.285931] ffff888006cbd200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.286792] ================================================================== [ 3048.287781] ok 38 - ksize_uaf [ 3048.288382] ================================================================== [ 3048.289752] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x152/0x400 [ 3048.290655] [ 3048.290862] CPU: 1 PID: 118287 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.292476] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.293218] Call Trace: [ 3048.293566] [ 3048.293880] dump_stack_lvl+0x57/0x81 [ 3048.294357] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.295058] print_report.cold+0x5c/0x237 [ 3048.295551] ? kmem_cache_free+0x152/0x400 [ 3048.296056] ? kmem_cache_free+0x152/0x400 [ 3048.296557] kasan_report_invalid_free+0x99/0xc0 [ 3048.297127] ? kmem_cache_free+0x152/0x400 [ 3048.297632] ? kmem_cache_free+0x152/0x400 [ 3048.298132] __kasan_slab_free+0x152/0x170 [ 3048.298639] slab_free_freelist_hook+0x11d/0x1d0 [ 3048.299213] ? kmem_cache_double_free+0x1bd/0x280 [test_kasan] [ 3048.299997] kmem_cache_free+0x152/0x400 [ 3048.300539] kmem_cache_double_free+0x1bd/0x280 [test_kasan] [ 3048.301266] ? kmem_cache_invalid_free+0x280/0x280 [test_kasan] [ 3048.301987] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.302525] ? do_raw_spin_lock+0x270/0x270 [ 3048.303048] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.303772] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3048.304445] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.305094] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.305695] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.306314] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.307052] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.307693] kthread+0x2a4/0x350 [ 3048.308100] ? kthread_complete_and_exit+0x20/0x20 [ 3048.308691] ret_from_fork+0x1f/0x30 [ 3048.309143] [ 3048.309426] [ 3048.309637] Allocated by task 118287: [ 3048.310089] kasan_save_stack+0x1e/0x40 [ 3048.310562] __kasan_slab_alloc+0x66/0x80 [ 3048.311058] kmem_cache_alloc+0x161/0x310 [ 3048.311549] kmem_cache_double_free+0x123/0x280 [test_kasan] [ 3048.312302] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.312971] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.313726] kthread+0x2a4/0x350 [ 3048.314133] ret_from_fork+0x1f/0x30 [ 3048.314575] [ 3048.314793] Freed by task 118287: [ 3048.315206] kasan_save_stack+0x1e/0x40 [ 3048.315681] kasan_set_track+0x21/0x30 [ 3048.316142] kasan_set_free_info+0x20/0x40 [ 3048.316644] __kasan_slab_free+0x108/0x170 [ 3048.317145] slab_free_freelist_hook+0x11d/0x1d0 [ 3048.317715] kmem_cache_free+0x152/0x400 [ 3048.318193] kmem_cache_double_free+0x144/0x280 [test_kasan] [ 3048.318885] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.319479] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.320280] kthread+0x2a4/0x350 [ 3048.320690] ret_from_fork+0x1f/0x30 [ 3048.321158] [ 3048.321366] The buggy address belongs to the object at ffff888006af8e70 [ 3048.321366] which belongs to the cache test_cache of size 200 [ 3048.322829] The buggy address is located 0 bytes inside of [ 3048.322829] 200-byte region [ffff888006af8e70, ffff888006af8f38) [ 3048.324285] [ 3048.324518] The buggy address belongs to the physical page: [ 3048.325218] page:0000000082f13571 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af8 [ 3048.326307] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.327130] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff888002d6a280 [ 3048.328052] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 3048.328977] page dumped because: kasan: bad access detected [ 3048.329649] [ 3048.329854] Memory state around the buggy address: [ 3048.330436] ffff888006af8d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.331307] ffff888006af8d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.332172] >ffff888006af8e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fa fb [ 3048.333041] ^ [ 3048.333858] ffff888006af8e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3048.334728] ffff888006af8f00: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 3048.335591] ================================================================== [ 3048.341533] ok 39 - kmem_cache_double_free [ 3048.342021] ================================================================== [ 3048.343452] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x152/0x400 [ 3048.344360] [ 3048.344566] CPU: 0 PID: 118288 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.346194] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.346971] Call Trace: [ 3048.347316] [ 3048.347590] dump_stack_lvl+0x57/0x81 [ 3048.348085] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.348862] print_report.cold+0x5c/0x237 [ 3048.349382] ? kmem_cache_free+0x152/0x400 [ 3048.349883] ? kmem_cache_free+0x152/0x400 [ 3048.350381] kasan_report_invalid_free+0x99/0xc0 [ 3048.350948] ? kmem_cache_free+0x152/0x400 [ 3048.351443] ? kmem_cache_free+0x152/0x400 [ 3048.351942] __kasan_slab_free+0x152/0x170 [ 3048.352440] slab_free_freelist_hook+0x11d/0x1d0 [ 3048.353012] ? kmem_cache_invalid_free+0x1b6/0x280 [test_kasan] [ 3048.353749] kmem_cache_free+0x152/0x400 [ 3048.354290] kmem_cache_invalid_free+0x1b6/0x280 [test_kasan] [ 3048.355051] ? kmem_cache_double_destroy+0x250/0x250 [test_kasan] [ 3048.355795] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.356328] ? do_raw_spin_lock+0x270/0x270 [ 3048.356844] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.357512] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 3048.358116] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.358732] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.359322] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.359934] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.360671] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.361292] kthread+0x2a4/0x350 [ 3048.361701] ? kthread_complete_and_exit+0x20/0x20 [ 3048.362280] ret_from_fork+0x1f/0x30 [ 3048.362734] [ 3048.363015] [ 3048.363222] Allocated by task 118288: [ 3048.363677] kasan_save_stack+0x1e/0x40 [ 3048.364144] __kasan_slab_alloc+0x66/0x80 [ 3048.364633] kmem_cache_alloc+0x161/0x310 [ 3048.365119] kmem_cache_invalid_free+0x126/0x280 [test_kasan] [ 3048.365816] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.366407] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.367140] kthread+0x2a4/0x350 [ 3048.367540] ret_from_fork+0x1f/0x30 [ 3048.367984] [ 3048.368189] The buggy address belongs to the object at ffff88800666a738 [ 3048.368189] which belongs to the cache test_cache of size 200 [ 3048.369636] The buggy address is located 1 bytes inside of [ 3048.369636] 200-byte region [ffff88800666a738, ffff88800666a800) [ 3048.371078] [ 3048.371283] The buggy address belongs to the physical page: [ 3048.371953] page:000000006a0c1b76 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x666a [ 3048.373035] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.373958] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff8880042b0140 [ 3048.374924] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 3048.375840] page dumped because: kasan: bad access detected [ 3048.376502] [ 3048.376711] Memory state around the buggy address: [ 3048.377293] ffff88800666a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.378152] ffff88800666a680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.379014] >ffff88800666a700: fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 [ 3048.379877] ^ [ 3048.380485] ffff88800666a780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.381342] ffff88800666a800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3048.382198] ================================================================== [ 3048.390871] ok 40 - kmem_cache_invalid_free [ 3048.391750] ================================================================== [ 3048.393198] BUG: KASAN: use-after-free in kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 3048.394204] Read of size 1 at addr ffff8880042b0000 by task kunit_try_catch/118289 [ 3048.395104] [ 3048.395311] CPU: 0 PID: 118289 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.396923] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.397610] Call Trace: [ 3048.397923] [ 3048.398196] ? kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 3048.398998] dump_stack_lvl+0x57/0x81 [ 3048.399506] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.400232] ? kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 3048.400969] print_report.cold+0x5c/0x237 [ 3048.401462] kasan_report+0xc9/0x100 [ 3048.401912] ? kmem_cache_free+0x140/0x400 [ 3048.402408] ? kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 3048.403142] ? kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 3048.403895] __kasan_check_byte+0x36/0x50 [ 3048.404446] kmem_cache_destroy+0x21/0x170 [ 3048.405014] kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 3048.405731] ? kmalloc_oob_right+0x510/0x510 [test_kasan] [ 3048.406379] ? do_raw_spin_trylock+0xb5/0x180 [ 3048.406917] ? do_raw_spin_lock+0x270/0x270 [ 3048.407432] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.408109] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.408731] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.409327] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.409947] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.410682] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.411300] kthread+0x2a4/0x350 [ 3048.411766] ? kthread_complete_and_exit+0x20/0x20 [ 3048.412429] ret_from_fork+0x1f/0x30 [ 3048.412885] [ 3048.413167] [ 3048.413373] Allocated by task 118289: [ 3048.413825] kasan_save_stack+0x1e/0x40 [ 3048.414293] __kasan_slab_alloc+0x66/0x80 [ 3048.414784] kmem_cache_alloc+0x161/0x310 [ 3048.415271] kmem_cache_create_usercopy+0x1b9/0x310 [ 3048.415861] kmem_cache_create+0x12/0x20 [ 3048.416338] kmem_cache_double_destroy+0x8d/0x250 [test_kasan] [ 3048.417042] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.417639] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.418373] kthread+0x2a4/0x350 [ 3048.418781] ret_from_fork+0x1f/0x30 [ 3048.419222] [ 3048.419426] Freed by task 118289: [ 3048.419841] kasan_save_stack+0x1e/0x40 [ 3048.420308] kasan_set_track+0x21/0x30 [ 3048.420836] kasan_set_free_info+0x20/0x40 [ 3048.421405] __kasan_slab_free+0x108/0x170 [ 3048.421906] slab_free_freelist_hook+0x11d/0x1d0 [ 3048.422467] kmem_cache_free+0x152/0x400 [ 3048.422948] kobject_cleanup+0x101/0x390 [ 3048.423427] kmem_cache_double_destroy+0x12a/0x250 [test_kasan] [ 3048.424140] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.424734] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.425465] kthread+0x2a4/0x350 [ 3048.425869] ret_from_fork+0x1f/0x30 [ 3048.426309] [ 3048.426513] The buggy address belongs to the object at ffff8880042b0000 [ 3048.426513] which belongs to the cache kmem_cache of size 240 [ 3048.427959] The buggy address is located 0 bytes inside of [ 3048.427959] 240-byte region [ffff8880042b0000, ffff8880042b00f0) [ 3048.429309] [ 3048.429514] The buggy address belongs to the physical page: [ 3048.430185] page:00000000ebd86453 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42b0 [ 3048.431273] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.432090] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff888100041000 [ 3048.433004] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 3048.433920] page dumped because: kasan: bad access detected [ 3048.434585] [ 3048.434817] Memory state around the buggy address: [ 3048.435467] ffff8880042aff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3048.436431] ffff8880042aff80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 3048.437391] >ffff8880042b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3048.438352] ^ [ 3048.438810] ffff8880042b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 3048.439773] ffff8880042b0100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 3048.440740] ================================================================== [ 3048.441856] ok 41 - kmem_cache_double_destroy [ 3048.442039] ok 42 - kasan_memchr # SKIP Test requires CONFIG_AMD_MEM_ENCRYPT=n [ 3048.442987] ok 43 - kasan_memcmp # SKIP Test requires CONFIG_AMD_MEM_ENCRYPT=n [ 3048.444200] ok 44 - kasan_strings # SKIP Test requires CONFIG_AMD_MEM_ENCRYPT=n [ 3048.445436] ================================================================== [ 3048.447432] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 3048.448670] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.449697] [ 3048.449930] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.451740] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.452555] Call Trace: [ 3048.452910] [ 3048.453217] ? kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 3048.454103] dump_stack_lvl+0x57/0x81 [ 3048.454616] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.455396] ? kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 3048.456272] print_report.cold+0x5c/0x237 [ 3048.456831] kasan_report+0xc9/0x100 [ 3048.457329] ? kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 3048.458215] kasan_check_range+0xfd/0x1e0 [ 3048.458774] kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 3048.459634] ? kasan_test_init+0x50/0x50 [test_kasan] [ 3048.460324] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.460945] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.461589] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.462354] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.462968] ? trace_kmalloc+0x3c/0x100 [ 3048.463498] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.464158] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 3048.464893] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.465889] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.466660] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.467298] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.467900] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.468518] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.469256] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.469884] kthread+0x2a4/0x350 [ 3048.470290] ? kthread_complete_and_exit+0x20/0x20 [ 3048.470877] ret_from_fork+0x1f/0x30 [ 3048.471332] [ 3048.471622] [ 3048.471830] Allocated by task 118293: [ 3048.472317] kasan_save_stack+0x1e/0x40 [ 3048.472848] __kasan_kmalloc+0x81/0xa0 [ 3048.473410] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.474101] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.474701] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.475436] kthread+0x2a4/0x350 [ 3048.475847] ret_from_fork+0x1f/0x30 [ 3048.476291] [ 3048.476497] The buggy address belongs to the object at ffff88800986a140 [ 3048.476497] which belongs to the cache kmalloc-16 of size 16 [ 3048.477949] The buggy address is located 8 bytes inside of [ 3048.477949] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.479322] [ 3048.479555] The buggy address belongs to the physical page: [ 3048.480325] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.481719] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.482651] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.483694] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.484721] page dumped because: kasan: bad access detected [ 3048.485496] [ 3048.485733] Memory state around the buggy address: [ 3048.486387] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.487373] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.488342] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.489315] ^ [ 3048.490064] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.491029] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.491991] ================================================================== [ 3048.493115] ================================================================== [ 3048.494088] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 3048.495259] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.496279] [ 3048.496510] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.498281] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.499070] Call Trace: [ 3048.499420] [ 3048.499745] ? kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 3048.500640] dump_stack_lvl+0x57/0x81 [ 3048.501154] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.501948] ? kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 3048.502839] print_report.cold+0x5c/0x237 [ 3048.503396] kasan_report+0xc9/0x100 [ 3048.503902] ? kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 3048.504797] kasan_check_range+0xfd/0x1e0 [ 3048.505350] kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 3048.506225] ? kasan_test_init+0x50/0x50 [test_kasan] [ 3048.506920] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.507534] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.508189] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.508952] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.509563] ? trace_kmalloc+0x3c/0x100 [ 3048.510096] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.510753] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 3048.511484] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.512479] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.513255] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.513953] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.514624] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.515314] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.516141] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.516843] kthread+0x2a4/0x350 [ 3048.517297] ? kthread_complete_and_exit+0x20/0x20 [ 3048.517996] ret_from_fork+0x1f/0x30 [ 3048.518509] [ 3048.518833] [ 3048.519064] Allocated by task 118293: [ 3048.519570] kasan_save_stack+0x1e/0x40 [ 3048.520102] __kasan_kmalloc+0x81/0xa0 [ 3048.520627] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.521356] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.522028] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.522855] kthread+0x2a4/0x350 [ 3048.523308] ret_from_fork+0x1f/0x30 [ 3048.523805] [ 3048.524089] The buggy address belongs to the object at ffff88800986a140 [ 3048.524089] which belongs to the cache kmalloc-16 of size 16 [ 3048.525807] The buggy address is located 8 bytes inside of [ 3048.525807] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.527324] [ 3048.527555] The buggy address belongs to the physical page: [ 3048.528307] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.529712] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.530635] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.531672] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.532706] page dumped because: kasan: bad access detected [ 3048.533453] [ 3048.533690] Memory state around the buggy address: [ 3048.534343] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.535316] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.536289] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.537264] ^ [ 3048.538017] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.538991] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.539958] ================================================================== [ 3048.540980] ================================================================== [ 3048.541956] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 3048.543192] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.544210] [ 3048.544443] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.546256] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.547033] Call Trace: [ 3048.547383] [ 3048.547697] ? kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 3048.548584] dump_stack_lvl+0x57/0x81 [ 3048.549097] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.549878] ? kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 3048.550769] print_report.cold+0x5c/0x237 [ 3048.551352] kasan_report+0xc9/0x100 [ 3048.551861] ? kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 3048.552755] kasan_check_range+0xfd/0x1e0 [ 3048.553309] kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 3048.554179] ? kasan_test_init+0x50/0x50 [test_kasan] [ 3048.554872] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.555486] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.556137] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.556897] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.557506] ? trace_kmalloc+0x3c/0x100 [ 3048.558041] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.558689] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 3048.559420] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.560462] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.561268] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.561965] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.562637] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.563327] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.564153] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.564857] kthread+0x2a4/0x350 [ 3048.565310] ? kthread_complete_and_exit+0x20/0x20 [ 3048.565970] ret_from_fork+0x1f/0x30 [ 3048.566480] [ 3048.566790] [ 3048.566997] Allocated by task 118293: [ 3048.567450] kasan_save_stack+0x1e/0x40 [ 3048.567925] __kasan_kmalloc+0x81/0xa0 [ 3048.568387] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.569047] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.569653] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.570387] kthread+0x2a4/0x350 [ 3048.570799] ret_from_fork+0x1f/0x30 [ 3048.571242] [ 3048.571449] The buggy address belongs to the object at ffff88800986a140 [ 3048.571449] which belongs to the cache kmalloc-16 of size 16 [ 3048.572899] The buggy address is located 8 bytes inside of [ 3048.572899] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.574253] [ 3048.574460] The buggy address belongs to the physical page: [ 3048.575177] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.576467] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.577317] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.578241] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.579164] page dumped because: kasan: bad access detected [ 3048.579834] [ 3048.580041] Memory state around the buggy address: [ 3048.580629] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.581492] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.582357] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.583221] ^ [ 3048.583910] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.584839] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.585801] ================================================================== [ 3048.586690] ================================================================== [ 3048.587554] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 3048.588667] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.589576] [ 3048.589789] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.591407] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.592103] Call Trace: [ 3048.592417] [ 3048.592697] ? kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 3048.593487] dump_stack_lvl+0x57/0x81 [ 3048.593948] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.594650] ? kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 3048.595439] print_report.cold+0x5c/0x237 [ 3048.595940] kasan_report+0xc9/0x100 [ 3048.596389] ? kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 3048.597195] kasan_check_range+0xfd/0x1e0 [ 3048.597693] kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 3048.598466] ? kasan_test_init+0x50/0x50 [test_kasan] [ 3048.599090] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.599641] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.600222] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.600900] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.601450] ? trace_kmalloc+0x3c/0x100 [ 3048.601926] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.602567] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 3048.603224] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.604116] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.604859] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.605550] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.606168] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.606788] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.607524] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.608153] kthread+0x2a4/0x350 [ 3048.608561] ? kthread_complete_and_exit+0x20/0x20 [ 3048.609151] ret_from_fork+0x1f/0x30 [ 3048.609613] [ 3048.609895] [ 3048.610101] Allocated by task 118293: [ 3048.610552] kasan_save_stack+0x1e/0x40 [ 3048.611029] __kasan_kmalloc+0x81/0xa0 [ 3048.611489] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.612175] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.612847] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.613621] kthread+0x2a4/0x350 [ 3048.614027] ret_from_fork+0x1f/0x30 [ 3048.614471] [ 3048.614684] The buggy address belongs to the object at ffff88800986a140 [ 3048.614684] which belongs to the cache kmalloc-16 of size 16 [ 3048.616127] The buggy address is located 8 bytes inside of [ 3048.616127] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.617511] [ 3048.617724] The buggy address belongs to the physical page: [ 3048.618392] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.619636] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.620456] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.621378] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.622298] page dumped because: kasan: bad access detected [ 3048.622966] [ 3048.623173] Memory state around the buggy address: [ 3048.623758] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.624622] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.625487] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.626394] ^ [ 3048.627098] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.627964] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.628830] ================================================================== [ 3048.629726] ================================================================== [ 3048.630589] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 3048.631698] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.632612] [ 3048.632827] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.634440] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.635195] Call Trace: [ 3048.635543] [ 3048.635870] ? kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 3048.636670] dump_stack_lvl+0x57/0x81 [ 3048.637126] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.637829] ? kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 3048.638626] print_report.cold+0x5c/0x237 [ 3048.639121] kasan_report+0xc9/0x100 [ 3048.639567] ? kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 3048.640365] kasan_check_range+0xfd/0x1e0 [ 3048.640862] kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 3048.641638] ? kasan_test_init+0x50/0x50 [test_kasan] [ 3048.642254] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.642811] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.643389] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.644065] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.644616] ? trace_kmalloc+0x3c/0x100 [ 3048.645091] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.645676] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 3048.646329] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.647221] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.647913] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.648530] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.649132] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.649754] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.650509] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.651138] kthread+0x2a4/0x350 [ 3048.651547] ? kthread_complete_and_exit+0x20/0x20 [ 3048.652134] ret_from_fork+0x1f/0x30 [ 3048.652590] [ 3048.652876] [ 3048.653082] Allocated by task 118293: [ 3048.653532] kasan_save_stack+0x1e/0x40 [ 3048.654008] __kasan_kmalloc+0x81/0xa0 [ 3048.654470] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.655195] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.655867] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.656606] kthread+0x2a4/0x350 [ 3048.657023] ret_from_fork+0x1f/0x30 [ 3048.657467] [ 3048.657678] The buggy address belongs to the object at ffff88800986a140 [ 3048.657678] which belongs to the cache kmalloc-16 of size 16 [ 3048.659126] The buggy address is located 8 bytes inside of [ 3048.659126] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.660479] [ 3048.660689] The buggy address belongs to the physical page: [ 3048.661354] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.662600] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.663418] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.664341] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.665261] page dumped because: kasan: bad access detected [ 3048.665930] [ 3048.666137] Memory state around the buggy address: [ 3048.666721] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.667581] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.668447] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.669311] ^ [ 3048.669981] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.670847] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.671709] ================================================================== [ 3048.672591] ================================================================== [ 3048.673459] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 3048.674559] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.675469] [ 3048.675680] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.677341] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.678065] Call Trace: [ 3048.678380] [ 3048.678659] ? kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 3048.679453] dump_stack_lvl+0x57/0x81 [ 3048.679913] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.680612] ? kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 3048.681410] print_report.cold+0x5c/0x237 [ 3048.681909] kasan_report+0xc9/0x100 [ 3048.682358] ? kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 3048.683179] kasan_check_range+0xfd/0x1e0 [ 3048.683676] kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 3048.684448] ? kasan_test_init+0x50/0x50 [test_kasan] [ 3048.685091] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.685709] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.686339] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.687017] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.687567] ? trace_kmalloc+0x3c/0x100 [ 3048.688043] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.688625] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 3048.689280] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.690176] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.690874] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.691496] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.692102] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.692725] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.693461] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.694091] kthread+0x2a4/0x350 [ 3048.694531] ? kthread_complete_and_exit+0x20/0x20 [ 3048.695188] ret_from_fork+0x1f/0x30 [ 3048.695682] [ 3048.695965] [ 3048.696172] Allocated by task 118293: [ 3048.696629] kasan_save_stack+0x1e/0x40 [ 3048.697102] __kasan_kmalloc+0x81/0xa0 [ 3048.697563] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.698219] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.699035] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.699875] kthread+0x2a4/0x350 [ 3048.700279] ret_from_fork+0x1f/0x30 [ 3048.700738] [ 3048.700945] The buggy address belongs to the object at ffff88800986a140 [ 3048.700945] which belongs to the cache kmalloc-16 of size 16 [ 3048.702388] The buggy address is located 8 bytes inside of [ 3048.702388] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.703739] [ 3048.703973] The buggy address belongs to the physical page: [ 3048.704668] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.706069] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.706894] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.707815] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.708740] page dumped because: kasan: bad access detected [ 3048.709407] [ 3048.709620] Memory state around the buggy address: [ 3048.710203] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.711067] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.711931] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.712799] ^ [ 3048.713466] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.714329] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.715196] ================================================================== [ 3048.716182] ================================================================== [ 3048.717052] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 3048.718161] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.719078] [ 3048.719284] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.720898] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.721594] Call Trace: [ 3048.721907] [ 3048.722180] ? kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 3048.722976] dump_stack_lvl+0x57/0x81 [ 3048.723429] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.724127] ? kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 3048.724921] print_report.cold+0x5c/0x237 [ 3048.725418] kasan_report+0xc9/0x100 [ 3048.725867] ? kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 3048.726663] kasan_check_range+0xfd/0x1e0 [ 3048.727154] kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 3048.727965] ? kasan_test_init+0x50/0x50 [test_kasan] [ 3048.728602] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.729181] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.729782] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.730533] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.731135] ? trace_kmalloc+0x3c/0x100 [ 3048.731613] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.732192] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 3048.732851] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.733741] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.734436] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.735062] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.735663] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.736280] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.737026] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.737655] kthread+0x2a4/0x350 [ 3048.738061] ? kthread_complete_and_exit+0x20/0x20 [ 3048.738650] ret_from_fork+0x1f/0x30 [ 3048.739112] [ 3048.739395] [ 3048.739605] Allocated by task 118293: [ 3048.740055] kasan_save_stack+0x1e/0x40 [ 3048.740573] __kasan_kmalloc+0x81/0xa0 [ 3048.741097] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.741827] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.742479] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.743217] kthread+0x2a4/0x350 [ 3048.743625] ret_from_fork+0x1f/0x30 [ 3048.744071] [ 3048.744278] The buggy address belongs to the object at ffff88800986a140 [ 3048.744278] which belongs to the cache kmalloc-16 of size 16 [ 3048.745817] The buggy address is located 8 bytes inside of [ 3048.745817] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.747338] [ 3048.747546] The buggy address belongs to the physical page: [ 3048.748299] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.749620] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.750440] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.751362] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.752284] page dumped because: kasan: bad access detected [ 3048.753014] [ 3048.753246] Memory state around the buggy address: [ 3048.753897] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.754839] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.755707] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.756566] ^ [ 3048.757237] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.758104] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.758970] ================================================================== [ 3048.759863] ================================================================== [ 3048.760733] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 3048.761837] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.762748] [ 3048.762957] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.764575] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.765274] Call Trace: [ 3048.765593] [ 3048.765868] ? kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 3048.766666] dump_stack_lvl+0x57/0x81 [ 3048.767120] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.767821] ? kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 3048.768618] print_report.cold+0x5c/0x237 [ 3048.769112] kasan_report+0xc9/0x100 [ 3048.769560] ? kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 3048.770357] kasan_check_range+0xfd/0x1e0 [ 3048.770853] kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 3048.771633] ? kasan_test_init+0x50/0x50 [test_kasan] [ 3048.772252] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.772805] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.773381] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.774057] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.774610] ? trace_kmalloc+0x3c/0x100 [ 3048.775082] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.775664] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 3048.776318] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.777210] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.777902] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.778523] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.779168] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.779788] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.780544] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.781176] kthread+0x2a4/0x350 [ 3048.781588] ? kthread_complete_and_exit+0x20/0x20 [ 3048.782192] ret_from_fork+0x1f/0x30 [ 3048.782651] [ 3048.782933] [ 3048.783141] Allocated by task 118293: [ 3048.783596] kasan_save_stack+0x1e/0x40 [ 3048.784068] __kasan_kmalloc+0x81/0xa0 [ 3048.784528] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.785185] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.785847] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.786661] kthread+0x2a4/0x350 [ 3048.787067] ret_from_fork+0x1f/0x30 [ 3048.787513] [ 3048.787724] The buggy address belongs to the object at ffff88800986a140 [ 3048.787724] which belongs to the cache kmalloc-16 of size 16 [ 3048.789293] The buggy address is located 8 bytes inside of [ 3048.789293] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.790658] [ 3048.790866] The buggy address belongs to the physical page: [ 3048.791534] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.792775] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.793598] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.794511] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.795431] page dumped because: kasan: bad access detected [ 3048.796099] [ 3048.796307] Memory state around the buggy address: [ 3048.796889] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.797753] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.798615] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.799477] ^ [ 3048.800148] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.801010] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.801878] ================================================================== [ 3048.802770] ================================================================== [ 3048.803639] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 3048.804828] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.805823] [ 3048.806055] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.807734] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.808509] Call Trace: [ 3048.808861] [ 3048.809136] ? kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 3048.810018] dump_stack_lvl+0x57/0x81 [ 3048.810472] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.811172] ? kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 3048.812055] print_report.cold+0x5c/0x237 [ 3048.812551] kasan_report+0xc9/0x100 [ 3048.813129] ? kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 3048.814110] kasan_check_range+0xfd/0x1e0 [ 3048.814609] kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 3048.815492] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3048.816293] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.816849] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.817427] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.818106] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.818660] ? trace_kmalloc+0x3c/0x100 [ 3048.819134] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.819716] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3048.820378] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.821266] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.821963] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.822589] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.823187] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.823807] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.824542] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.825171] kthread+0x2a4/0x350 [ 3048.825577] ? kthread_complete_and_exit+0x20/0x20 [ 3048.826172] ret_from_fork+0x1f/0x30 [ 3048.826632] [ 3048.826916] [ 3048.827124] Allocated by task 118293: [ 3048.827577] kasan_save_stack+0x1e/0x40 [ 3048.828055] __kasan_kmalloc+0x81/0xa0 [ 3048.828517] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.829173] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.829774] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.830560] kthread+0x2a4/0x350 [ 3048.830993] ret_from_fork+0x1f/0x30 [ 3048.831440] [ 3048.831651] The buggy address belongs to the object at ffff88800986a140 [ 3048.831651] which belongs to the cache kmalloc-16 of size 16 [ 3048.833100] The buggy address is located 8 bytes inside of [ 3048.833100] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.834451] [ 3048.834661] The buggy address belongs to the physical page: [ 3048.835329] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.836708] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.837527] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.838452] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.839373] page dumped because: kasan: bad access detected [ 3048.840044] [ 3048.840249] Memory state around the buggy address: [ 3048.840835] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.841700] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.842564] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.843430] ^ [ 3048.844104] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.844972] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.845835] ================================================================== [ 3048.846722] ================================================================== [ 3048.847588] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 3048.848812] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.849738] [ 3048.849946] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.851565] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.852263] Call Trace: [ 3048.852583] [ 3048.852859] ? kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 3048.853748] dump_stack_lvl+0x57/0x81 [ 3048.854272] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.855038] ? kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 3048.856010] print_report.cold+0x5c/0x237 [ 3048.856560] kasan_report+0xc9/0x100 [ 3048.857013] ? kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 3048.857905] kasan_check_range+0xfd/0x1e0 [ 3048.858397] kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 3048.859270] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3048.860072] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.860626] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.861204] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.861883] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.862433] ? trace_kmalloc+0x3c/0x100 [ 3048.862909] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.863488] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3048.864156] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.865045] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.865739] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.866357] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.866957] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.867574] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.868316] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.868944] kthread+0x2a4/0x350 [ 3048.869349] ? kthread_complete_and_exit+0x20/0x20 [ 3048.869939] ret_from_fork+0x1f/0x30 [ 3048.870393] [ 3048.870681] [ 3048.870889] Allocated by task 118293: [ 3048.871341] kasan_save_stack+0x1e/0x40 [ 3048.871817] __kasan_kmalloc+0x81/0xa0 [ 3048.872280] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.872935] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.873530] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.874270] kthread+0x2a4/0x350 [ 3048.874678] ret_from_fork+0x1f/0x30 [ 3048.875123] [ 3048.875330] The buggy address belongs to the object at ffff88800986a140 [ 3048.875330] which belongs to the cache kmalloc-16 of size 16 [ 3048.876776] The buggy address is located 8 bytes inside of [ 3048.876776] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.878137] [ 3048.878344] The buggy address belongs to the physical page: [ 3048.879014] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.880443] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.881425] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.882535] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.883570] page dumped because: kasan: bad access detected [ 3048.884319] [ 3048.884550] Memory state around the buggy address: [ 3048.885225] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.886197] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.887176] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.888144] ^ [ 3048.888897] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.889873] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.890839] ================================================================== [ 3048.891850] ================================================================== [ 3048.892853] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 3048.894194] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.895228] [ 3048.895460] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.897283] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.898064] Call Trace: [ 3048.898413] [ 3048.898725] ? kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 3048.899718] dump_stack_lvl+0x57/0x81 [ 3048.900225] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.901007] ? kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 3048.902010] print_report.cold+0x5c/0x237 [ 3048.902564] kasan_report+0xc9/0x100 [ 3048.903076] ? kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 3048.904073] kasan_check_range+0xfd/0x1e0 [ 3048.904629] kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 3048.905601] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3048.906492] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.907111] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.907761] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.908514] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.909127] ? trace_kmalloc+0x3c/0x100 [ 3048.909668] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.910312] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3048.911057] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.912052] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.912825] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.913517] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.914224] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.914925] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.915753] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.916449] kthread+0x2a4/0x350 [ 3048.916909] ? kthread_complete_and_exit+0x20/0x20 [ 3048.917563] ret_from_fork+0x1f/0x30 [ 3048.918076] [ 3048.918394] [ 3048.918629] Allocated by task 118293: [ 3048.919135] kasan_save_stack+0x1e/0x40 [ 3048.919665] __kasan_kmalloc+0x81/0xa0 [ 3048.920184] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.920916] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.921585] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.922408] kthread+0x2a4/0x350 [ 3048.922866] ret_from_fork+0x1f/0x30 [ 3048.923361] [ 3048.923596] The buggy address belongs to the object at ffff88800986a140 [ 3048.923596] which belongs to the cache kmalloc-16 of size 16 [ 3048.925208] The buggy address is located 8 bytes inside of [ 3048.925208] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.926720] [ 3048.926951] The buggy address belongs to the physical page: [ 3048.927700] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.929090] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.930007] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.931038] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.932118] page dumped because: kasan: bad access detected [ 3048.932887] [ 3048.933126] Memory state around the buggy address: [ 3048.933783] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.934753] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.935714] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.936677] ^ [ 3048.937403] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.938295] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.939257] ================================================================== [ 3048.940185] ================================================================== [ 3048.941054] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 3048.942261] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.943174] [ 3048.943381] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.945001] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.945696] Call Trace: [ 3048.946009] [ 3048.946284] ? kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 3048.947195] dump_stack_lvl+0x57/0x81 [ 3048.947656] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.948354] ? kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 3048.949242] print_report.cold+0x5c/0x237 [ 3048.949742] kasan_report+0xc9/0x100 [ 3048.950192] ? kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 3048.951078] kasan_check_range+0xfd/0x1e0 [ 3048.951575] kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 3048.952440] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3048.953241] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.953795] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.954373] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.955050] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.955600] ? trace_kmalloc+0x3c/0x100 [ 3048.956075] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3048.956658] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3048.957321] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3048.958230] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3048.958927] ? kunit_add_resource+0x197/0x280 [kunit] [ 3048.959544] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.960220] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3048.960856] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.961609] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3048.962239] kthread+0x2a4/0x350 [ 3048.962650] ? kthread_complete_and_exit+0x20/0x20 [ 3048.963235] ret_from_fork+0x1f/0x30 [ 3048.963696] [ 3048.963979] [ 3048.964186] Allocated by task 118293: [ 3048.964642] kasan_save_stack+0x1e/0x40 [ 3048.965115] __kasan_kmalloc+0x81/0xa0 [ 3048.965578] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3048.966241] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3048.966840] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3048.967581] kthread+0x2a4/0x350 [ 3048.967986] ret_from_fork+0x1f/0x30 [ 3048.968429] [ 3048.968640] The buggy address belongs to the object at ffff88800986a140 [ 3048.968640] which belongs to the cache kmalloc-16 of size 16 [ 3048.970090] The buggy address is located 8 bytes inside of [ 3048.970090] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3048.971438] [ 3048.971649] The buggy address belongs to the physical page: [ 3048.972319] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3048.973562] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3048.974386] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3048.975310] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3048.976227] page dumped because: kasan: bad access detected [ 3048.976897] [ 3048.977104] Memory state around the buggy address: [ 3048.977688] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.978554] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.979417] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3048.980306] ^ [ 3048.980980] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3048.981844] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3048.982708] ================================================================== [ 3048.983655] ================================================================== [ 3048.984542] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 3048.985750] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3048.986663] [ 3048.986871] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3048.988482] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3048.989185] Call Trace: [ 3048.989498] [ 3048.989777] ? kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 3048.990662] dump_stack_lvl+0x57/0x81 [ 3048.991117] print_address_description.constprop.0+0x1f/0x1e0 [ 3048.991817] ? kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 3048.992702] print_report.cold+0x5c/0x237 [ 3048.993197] kasan_report+0xc9/0x100 [ 3048.993646] ? kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 3048.994533] kasan_check_range+0xfd/0x1e0 [ 3048.995029] kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 3048.995902] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3048.996702] ? kunit_kfree+0x200/0x200 [kunit] [ 3048.997251] ? rcu_read_lock_sched_held+0x12/0x80 [ 3048.997832] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3048.998503] ? rcu_read_lock_bh_held+0x40/0x70 [ 3048.999054] ? trace_kmalloc+0x3c/0x100 [ 3048.999525] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3049.000107] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3049.000772] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3049.001666] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3049.002354] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.003037] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.003708] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.004351] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.005092] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.005722] kthread+0x2a4/0x350 [ 3049.006126] ? kthread_complete_and_exit+0x20/0x20 [ 3049.006713] ret_from_fork+0x1f/0x30 [ 3049.007167] [ 3049.007451] [ 3049.007661] Allocated by task 118293: [ 3049.008110] kasan_save_stack+0x1e/0x40 [ 3049.008588] __kasan_kmalloc+0x81/0xa0 [ 3049.009050] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3049.009705] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.010304] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.011045] kthread+0x2a4/0x350 [ 3049.011451] ret_from_fork+0x1f/0x30 [ 3049.011898] [ 3049.012105] The buggy address belongs to the object at ffff88800986a140 [ 3049.012105] which belongs to the cache kmalloc-16 of size 16 [ 3049.013577] The buggy address is located 8 bytes inside of [ 3049.013577] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3049.014928] [ 3049.015135] The buggy address belongs to the physical page: [ 3049.015809] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3049.017053] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3049.017878] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3049.018803] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3049.019728] page dumped because: kasan: bad access detected [ 3049.020394] [ 3049.020604] Memory state around the buggy address: [ 3049.021187] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.022051] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.022914] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3049.023777] ^ [ 3049.024443] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.025309] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.026174] ================================================================== [ 3049.027071] ================================================================== [ 3049.027940] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 3049.029130] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3049.030044] [ 3049.030253] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.031876] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.032572] Call Trace: [ 3049.032885] [ 3049.033159] ? kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 3049.034096] dump_stack_lvl+0x57/0x81 [ 3049.034554] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.035276] ? kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 3049.036166] print_report.cold+0x5c/0x237 [ 3049.036664] kasan_report+0xc9/0x100 [ 3049.037113] ? kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 3049.038039] kasan_check_range+0xfd/0x1e0 [ 3049.038531] kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 3049.039399] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3049.040197] ? kunit_kfree+0x200/0x200 [kunit] [ 3049.040751] ? rcu_read_lock_sched_held+0x12/0x80 [ 3049.041331] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.042006] ? rcu_read_lock_bh_held+0x40/0x70 [ 3049.042554] ? trace_kmalloc+0x3c/0x100 [ 3049.043029] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3049.043614] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3049.044277] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3049.045171] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3049.045884] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.046506] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.047108] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.047727] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.048467] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.049094] kthread+0x2a4/0x350 [ 3049.049503] ? kthread_complete_and_exit+0x20/0x20 [ 3049.050093] ret_from_fork+0x1f/0x30 [ 3049.050550] [ 3049.050837] [ 3049.051044] Allocated by task 118293: [ 3049.051497] kasan_save_stack+0x1e/0x40 [ 3049.051971] __kasan_kmalloc+0x81/0xa0 [ 3049.052433] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3049.053089] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.053690] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.054427] kthread+0x2a4/0x350 [ 3049.054834] ret_from_fork+0x1f/0x30 [ 3049.055278] [ 3049.055484] The buggy address belongs to the object at ffff88800986a140 [ 3049.055484] which belongs to the cache kmalloc-16 of size 16 [ 3049.056953] The buggy address is located 8 bytes inside of [ 3049.056953] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3049.058309] [ 3049.058516] The buggy address belongs to the physical page: [ 3049.059189] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3049.060427] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3049.061259] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3049.062181] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3049.063103] page dumped because: kasan: bad access detected [ 3049.063771] [ 3049.063978] Memory state around the buggy address: [ 3049.064564] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.065427] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.066290] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3049.067156] ^ [ 3049.067828] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.068687] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.069549] ================================================================== [ 3049.070445] ================================================================== [ 3049.071312] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 3049.072509] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3049.073428] [ 3049.073639] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.075253] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.075958] Call Trace: [ 3049.076271] [ 3049.076546] ? kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 3049.077445] dump_stack_lvl+0x57/0x81 [ 3049.077904] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.078608] ? kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 3049.079490] print_report.cold+0x5c/0x237 [ 3049.080036] kasan_report+0xc9/0x100 [ 3049.080492] ? kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 3049.081406] kasan_check_range+0xfd/0x1e0 [ 3049.081906] kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 3049.082782] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3049.083580] ? kunit_kfree+0x200/0x200 [kunit] [ 3049.084134] ? rcu_read_lock_sched_held+0x12/0x80 [ 3049.084719] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.085432] ? rcu_read_lock_bh_held+0x40/0x70 [ 3049.086004] ? trace_kmalloc+0x3c/0x100 [ 3049.086479] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3049.087116] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3049.087860] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3049.088753] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3049.089463] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.090086] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.090687] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.091304] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.092043] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.092673] kthread+0x2a4/0x350 [ 3049.093080] ? kthread_complete_and_exit+0x20/0x20 [ 3049.093670] ret_from_fork+0x1f/0x30 [ 3049.094126] [ 3049.094410] [ 3049.094621] Allocated by task 118293: [ 3049.095071] kasan_save_stack+0x1e/0x40 [ 3049.095543] __kasan_kmalloc+0x81/0xa0 [ 3049.096053] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3049.096802] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.097419] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.098155] kthread+0x2a4/0x350 [ 3049.098565] ret_from_fork+0x1f/0x30 [ 3049.099011] [ 3049.099219] The buggy address belongs to the object at ffff88800986a140 [ 3049.099219] which belongs to the cache kmalloc-16 of size 16 [ 3049.100664] The buggy address is located 8 bytes inside of [ 3049.100664] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3049.102013] [ 3049.102221] The buggy address belongs to the physical page: [ 3049.102912] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3049.104278] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3049.105119] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3049.106045] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3049.106970] page dumped because: kasan: bad access detected [ 3049.107642] [ 3049.107851] Memory state around the buggy address: [ 3049.108433] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.109305] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.110171] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3049.111043] ^ [ 3049.111795] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.112670] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.113531] ================================================================== [ 3049.114418] ================================================================== [ 3049.115285] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 3049.116482] Read of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3049.117380] [ 3049.117596] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.119210] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.119908] Call Trace: [ 3049.120221] [ 3049.120495] ? kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 3049.121383] dump_stack_lvl+0x57/0x81 [ 3049.121855] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.122569] ? kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 3049.123450] print_report.cold+0x5c/0x237 [ 3049.123952] kasan_report+0xc9/0x100 [ 3049.124397] ? kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 3049.125283] kasan_check_range+0xfd/0x1e0 [ 3049.125781] kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 3049.126651] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3049.127446] ? kunit_kfree+0x200/0x200 [kunit] [ 3049.127998] ? rcu_read_lock_sched_held+0x12/0x80 [ 3049.128582] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.129255] ? rcu_read_lock_bh_held+0x40/0x70 [ 3049.129808] ? trace_kmalloc+0x3c/0x100 [ 3049.130281] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3049.130863] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3049.131525] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3049.132415] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3049.133117] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.133742] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.134340] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.134959] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.135698] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.136369] kthread+0x2a4/0x350 [ 3049.136827] ? kthread_complete_and_exit+0x20/0x20 [ 3049.137504] ret_from_fork+0x1f/0x30 [ 3049.138018] [ 3049.138319] [ 3049.138526] Allocated by task 118293: [ 3049.138983] kasan_save_stack+0x1e/0x40 [ 3049.139456] __kasan_kmalloc+0x81/0xa0 [ 3049.139921] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3049.140579] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.141179] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.141919] kthread+0x2a4/0x350 [ 3049.142323] ret_from_fork+0x1f/0x30 [ 3049.142769] [ 3049.142977] The buggy address belongs to the object at ffff88800986a140 [ 3049.142977] which belongs to the cache kmalloc-16 of size 16 [ 3049.144424] The buggy address is located 8 bytes inside of [ 3049.144424] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3049.145787] [ 3049.145994] The buggy address belongs to the physical page: [ 3049.146665] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3049.147903] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3049.148830] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3049.149851] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3049.150816] page dumped because: kasan: bad access detected [ 3049.151482] [ 3049.151695] Memory state around the buggy address: [ 3049.152279] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.153161] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.154138] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3049.155039] ^ [ 3049.155712] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.156582] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.157446] ================================================================== [ 3049.158341] ================================================================== [ 3049.159208] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 3049.159492] systemd-journald[574]: Data hash table of /run/log/journal/cc3df9652e7846c69b664a0aecfebca2/system.journal has a fill level at 75.0 (6997 of 9329 items, 5373952 file size, 768 bytes per hash table item), suggesting rotation. [ 3049.160409] Read of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3049.160413] [ 3049.160415] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.160420] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.160422] Call Trace: [ 3049.162918] systemd-journald[574]: /run/log/journal/cc3df9652e7846c69b664a0aecfebca2/system.journal: Journal header limits reached or header out-of-date, rotating. [ 3049.163795] [ 3049.163798] ? kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 3049.169495] dump_stack_lvl+0x57/0x81 [ 3049.169954] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.170661] ? kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 3049.171548] print_report.cold+0x5c/0x237 [ 3049.172049] kasan_report+0xc9/0x100 [ 3049.172497] ? kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 3049.173400] kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 3049.174273] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3049.175070] ? kunit_kfree+0x200/0x200 [kunit] [ 3049.175628] ? rcu_read_lock_sched_held+0x12/0x80 [ 3049.176206] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.176884] ? rcu_read_lock_bh_held+0x40/0x70 [ 3049.177430] ? trace_kmalloc+0x3c/0x100 [ 3049.177908] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3049.178487] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3049.179155] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3049.180046] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3049.180741] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.181360] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.181959] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.182579] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.183312] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.183940] kthread+0x2a4/0x350 [ 3049.184348] ? kthread_complete_and_exit+0x20/0x20 [ 3049.184950] ret_from_fork+0x1f/0x30 [ 3049.185403] [ 3049.185693] [ 3049.185902] Allocated by task 118293: [ 3049.186354] kasan_save_stack+0x1e/0x40 [ 3049.186828] __kasan_kmalloc+0x81/0xa0 [ 3049.187368] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3049.188127] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.188770] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.189505] kthread+0x2a4/0x350 [ 3049.189915] ret_from_fork+0x1f/0x30 [ 3049.190357] [ 3049.190570] The buggy address belongs to the object at ffff88800986a140 [ 3049.190570] which belongs to the cache kmalloc-16 of size 16 [ 3049.192020] The buggy address is located 8 bytes inside of [ 3049.192020] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3049.193374] [ 3049.193589] The buggy address belongs to the physical page: [ 3049.194256] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3049.195495] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3049.196318] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3049.197250] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3049.198171] page dumped because: kasan: bad access detected [ 3049.198842] [ 3049.199049] Memory state around the buggy address: [ 3049.199635] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.200496] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.201362] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3049.202227] ^ [ 3049.202899] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.203830] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.204785] ================================================================== [ 3049.205669] ================================================================== [ 3049.206534] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 3049.207736] Write of size 8 at addr ffff88800986a148 by task kunit_try_catch/118293 [ 3049.208649] [ 3049.208858] CPU: 1 PID: 118293 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.210473] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.211170] Call Trace: [ 3049.211484] [ 3049.211764] ? kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 3049.212653] dump_stack_lvl+0x57/0x81 [ 3049.213108] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.213810] ? kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 3049.214755] print_report.cold+0x5c/0x237 [ 3049.215310] kasan_report+0xc9/0x100 [ 3049.215782] ? kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 3049.216675] kasan_check_range+0xfd/0x1e0 [ 3049.217168] kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 3049.218041] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 3049.218842] ? kunit_kfree+0x200/0x200 [kunit] [ 3049.219391] ? rcu_read_lock_sched_held+0x12/0x80 [ 3049.219998] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.220680] ? rcu_read_lock_bh_held+0x40/0x70 [ 3049.221230] ? trace_kmalloc+0x3c/0x100 [ 3049.221706] ? kmem_cache_alloc_trace+0x1af/0x320 [ 3049.222286] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 3049.222953] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 3049.223841] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 3049.224530] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.225211] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.225889] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.226532] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.227275] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.227905] kthread+0x2a4/0x350 [ 3049.228312] ? kthread_complete_and_exit+0x20/0x20 [ 3049.228905] ret_from_fork+0x1f/0x30 [ 3049.229359] [ 3049.229648] [ 3049.229856] Allocated by task 118293: [ 3049.230309] kasan_save_stack+0x1e/0x40 [ 3049.230785] __kasan_kmalloc+0x81/0xa0 [ 3049.231244] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 3049.231896] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.232490] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.233230] kthread+0x2a4/0x350 [ 3049.233640] ret_from_fork+0x1f/0x30 [ 3049.234082] [ 3049.234289] The buggy address belongs to the object at ffff88800986a140 [ 3049.234289] which belongs to the cache kmalloc-16 of size 16 [ 3049.235740] The buggy address is located 8 bytes inside of [ 3049.235740] 16-byte region [ffff88800986a140, ffff88800986a150) [ 3049.237090] [ 3049.237298] The buggy address belongs to the physical page: [ 3049.238025] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3049.239295] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3049.240124] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3049.241046] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3049.241972] page dumped because: kasan: bad access detected [ 3049.242645] [ 3049.242851] Memory state around the buggy address: [ 3049.243431] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.244301] ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.245166] >ffff88800986a100: fb fb fc fc fb fb fc fc 00 01 fc fc fb fb fc fc [ 3049.246040] ^ [ 3049.246713] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.247578] ffff88800986a200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.248440] ================================================================== [ 3049.249503] ok 45 - kasan_bitops_generic [ 3049.263183] ok 46 - kasan_bitops_tags # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 3049.264381] ================================================================== [ 3049.266195] BUG: KASAN: use-after-free in kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 3049.267160] Read of size 1 at addr ffff88800986a0e0 by task kunit_try_catch/118296 [ 3049.268064] [ 3049.268274] CPU: 1 PID: 118296 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.269891] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.270590] Call Trace: [ 3049.270902] [ 3049.271176] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 3049.271879] dump_stack_lvl+0x57/0x81 [ 3049.272336] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.273037] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 3049.273739] print_report.cold+0x5c/0x237 [ 3049.274236] kasan_report+0xc9/0x100 [ 3049.274687] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 3049.275385] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 3049.276085] __kasan_check_byte+0x36/0x50 [ 3049.276583] kfree_sensitive+0x1b/0x60 [ 3049.277049] kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 3049.277727] ? vmalloc_oob+0x5e0/0x5e0 [test_kasan] [ 3049.278322] ? do_raw_spin_trylock+0xb5/0x180 [ 3049.278867] ? do_raw_spin_lock+0x270/0x270 [ 3049.279385] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.280100] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.280729] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.281324] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.281950] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.282694] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.283319] kthread+0x2a4/0x350 [ 3049.283726] ? kthread_complete_and_exit+0x20/0x20 [ 3049.284311] ret_from_fork+0x1f/0x30 [ 3049.284770] [ 3049.285055] [ 3049.285262] Allocated by task 118296: [ 3049.285717] kasan_save_stack+0x1e/0x40 [ 3049.286188] __kasan_kmalloc+0x81/0xa0 [ 3049.286653] kmalloc_double_kzfree+0x9a/0x270 [test_kasan] [ 3049.287312] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.287912] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.288655] kthread+0x2a4/0x350 [ 3049.289122] ret_from_fork+0x1f/0x30 [ 3049.289573] [ 3049.289781] Freed by task 118296: [ 3049.290215] kasan_save_stack+0x1e/0x40 [ 3049.290694] kasan_set_track+0x21/0x30 [ 3049.291153] kasan_set_free_info+0x20/0x40 [ 3049.291657] __kasan_slab_free+0x108/0x170 [ 3049.292154] slab_free_freelist_hook+0x11d/0x1d0 [ 3049.292724] kfree+0xe2/0x3c0 [ 3049.293103] kmalloc_double_kzfree+0x137/0x270 [test_kasan] [ 3049.293788] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.294382] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.295124] kthread+0x2a4/0x350 [ 3049.295529] ret_from_fork+0x1f/0x30 [ 3049.295980] [ 3049.296187] The buggy address belongs to the object at ffff88800986a0e0 [ 3049.296187] which belongs to the cache kmalloc-16 of size 16 [ 3049.297641] The buggy address is located 0 bytes inside of [ 3049.297641] 16-byte region [ffff88800986a0e0, ffff88800986a0f0) [ 3049.298998] [ 3049.299205] The buggy address belongs to the physical page: [ 3049.299877] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3049.301117] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3049.301943] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3049.302867] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3049.303785] page dumped because: kasan: bad access detected [ 3049.304532] [ 3049.304768] Memory state around the buggy address: [ 3049.305385] ffff888009869f80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 3049.306250] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.307120] >ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.307986] ^ [ 3049.308749] ffff88800986a100: fb fb fc fc fb fb fc fc fa fb fc fc fb fb fc fc [ 3049.309631] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.310490] ================================================================== [ 3049.311508] ================================================================== [ 3049.312447] BUG: KASAN: double-free or invalid-free in kfree+0xe2/0x3c0 [ 3049.313350] [ 3049.313564] CPU: 1 PID: 118296 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.315179] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.315880] Call Trace: [ 3049.316193] [ 3049.316470] dump_stack_lvl+0x57/0x81 [ 3049.316929] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.317642] print_report.cold+0x5c/0x237 [ 3049.318137] ? kfree+0xe2/0x3c0 [ 3049.318538] ? kfree+0xe2/0x3c0 [ 3049.318945] kasan_report_invalid_free+0x99/0xc0 [ 3049.319511] ? kfree+0xe2/0x3c0 [ 3049.319911] ? kfree+0xe2/0x3c0 [ 3049.320306] __kasan_slab_free+0x152/0x170 [ 3049.320815] slab_free_freelist_hook+0x11d/0x1d0 [ 3049.321384] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 3049.322087] kfree+0xe2/0x3c0 [ 3049.322467] ? __kasan_check_byte+0x36/0x50 [ 3049.322984] kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 3049.323661] ? vmalloc_oob+0x5e0/0x5e0 [test_kasan] [ 3049.324256] ? do_raw_spin_trylock+0xb5/0x180 [ 3049.324797] ? do_raw_spin_lock+0x270/0x270 [ 3049.325316] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.325993] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.326616] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.327211] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.327834] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.328579] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.329207] kthread+0x2a4/0x350 [ 3049.329619] ? kthread_complete_and_exit+0x20/0x20 [ 3049.330208] ret_from_fork+0x1f/0x30 [ 3049.330665] [ 3049.330950] [ 3049.331158] Allocated by task 118296: [ 3049.331621] kasan_save_stack+0x1e/0x40 [ 3049.332091] __kasan_kmalloc+0x81/0xa0 [ 3049.332557] kmalloc_double_kzfree+0x9a/0x270 [test_kasan] [ 3049.333220] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.333821] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.334557] kthread+0x2a4/0x350 [ 3049.334963] ret_from_fork+0x1f/0x30 [ 3049.335408] [ 3049.335618] Freed by task 118296: [ 3049.336033] kasan_save_stack+0x1e/0x40 [ 3049.336505] kasan_set_track+0x21/0x30 [ 3049.336970] kasan_set_free_info+0x20/0x40 [ 3049.337467] __kasan_slab_free+0x108/0x170 [ 3049.337972] slab_free_freelist_hook+0x11d/0x1d0 [ 3049.338536] kfree+0xe2/0x3c0 [ 3049.338917] kmalloc_double_kzfree+0x137/0x270 [test_kasan] [ 3049.339590] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.340234] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.341003] kthread+0x2a4/0x350 [ 3049.341409] ret_from_fork+0x1f/0x30 [ 3049.341859] [ 3049.342066] The buggy address belongs to the object at ffff88800986a0e0 [ 3049.342066] which belongs to the cache kmalloc-16 of size 16 [ 3049.343518] The buggy address is located 0 bytes inside of [ 3049.343518] 16-byte region [ffff88800986a0e0, ffff88800986a0f0) [ 3049.344866] [ 3049.345073] The buggy address belongs to the physical page: [ 3049.345740] page:000000006927e0c7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800986a160 pfn:0x986a [ 3049.347000] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 3049.347825] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 3049.348744] raw: ffff88800986a160 000000008080005b 00000001ffffffff 0000000000000000 [ 3049.349664] page dumped because: kasan: bad access detected [ 3049.350328] [ 3049.350535] Memory state around the buggy address: [ 3049.351124] ffff888009869f80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 3049.351998] ffff88800986a000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 3049.352864] >ffff88800986a080: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.353727] ^ [ 3049.354534] ffff88800986a100: fb fb fc fc fb fb fc fc fa fb fc fc fb fb fc fc [ 3049.355488] ffff88800986a180: fb fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 3049.356355] ================================================================== [ 3049.357311] ok 47 - kmalloc_double_kzfree [ 3049.357562] ok 48 - vmalloc_helpers_tags # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 3049.358358] ================================================================== [ 3049.360200] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x596/0x5e0 [test_kasan] [ 3049.361139] Read of size 1 at addr ffffc900000787f3 by task kunit_try_catch/118298 [ 3049.362044] [ 3049.362251] CPU: 1 PID: 118298 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.363868] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.364567] Call Trace: [ 3049.364880] [ 3049.365154] ? vmalloc_oob+0x596/0x5e0 [test_kasan] [ 3049.365754] dump_stack_lvl+0x57/0x81 [ 3049.366210] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.366911] ? vmalloc_oob+0x596/0x5e0 [test_kasan] [ 3049.367505] print_report.cold+0x5c/0x237 [ 3049.368003] kasan_report+0xc9/0x100 [ 3049.368450] ? vmalloc_oob+0x596/0x5e0 [test_kasan] [ 3049.369051] vmalloc_oob+0x596/0x5e0 [test_kasan] [ 3049.369632] ? kasan_global_oob_right+0x1f0/0x1f0 [test_kasan] [ 3049.370341] ? do_raw_spin_trylock+0xb5/0x180 [ 3049.370885] ? do_raw_spin_lock+0x270/0x270 [ 3049.371402] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.372081] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.372706] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.373303] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.373925] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.374718] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.375417] kthread+0x2a4/0x350 [ 3049.375855] ? kthread_complete_and_exit+0x20/0x20 [ 3049.376445] ret_from_fork+0x1f/0x30 [ 3049.376904] [ 3049.377186] [ 3049.377393] The buggy address belongs to the virtual mapping at [ 3049.377393] [ffffc90000078000, ffffc9000007a000) created by: [ 3049.377393] vmalloc_oob+0x78/0x5e0 [test_kasan] [ 3049.379336] [ 3049.379549] The buggy address belongs to the physical page: [ 3049.380215] page:00000000f0d6e73b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f6b6 [ 3049.381316] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 3049.382093] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 3049.383016] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3049.383937] page dumped because: kasan: bad access detected [ 3049.384610] [ 3049.384817] Memory state around the buggy address: [ 3049.385396] ffffc90000078680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3049.386261] ffffc90000078700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3049.387124] >ffffc90000078780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8 [ 3049.387988] ^ [ 3049.388807] ffffc90000078800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 3049.389672] ffffc90000078880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 3049.390540] ================================================================== [ 3049.391496] ================================================================== [ 3049.392390] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 3049.393328] Read of size 1 at addr ffffc900000787f8 by task kunit_try_catch/118298 [ 3049.394232] [ 3049.394440] CPU: 1 PID: 118298 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-235.1887_748111148.el9.x86_64+debug #1 [ 3049.396067] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3049.396766] Call Trace: [ 3049.397079] [ 3049.397354] ? vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 3049.397954] dump_stack_lvl+0x57/0x81 [ 3049.398410] print_address_description.constprop.0+0x1f/0x1e0 [ 3049.399111] ? vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 3049.399712] print_report.cold+0x5c/0x237 [ 3049.400207] kasan_report+0xc9/0x100 [ 3049.400658] ? vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 3049.401257] vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 3049.401848] ? kasan_global_oob_right+0x1f0/0x1f0 [test_kasan] [ 3049.402559] ? do_raw_spin_trylock+0xb5/0x180 [ 3049.403099] ? do_raw_spin_lock+0x270/0x270 [ 3049.403619] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 3049.404292] ? kunit_add_resource+0x197/0x280 [kunit] [ 3049.405000] kunit_try_run_case+0x108/0x1a0 [kunit] [ 3049.405663] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 3049.406279] kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit] [ 3049.407020] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 3049.407648] kthread+0x2a4/0x350 [ 3049.408053] ? kthread_complete_and_exit+0x20/0x20 [ 3049.408643] ret_from_fork+0x1f/0x30 [ 3049.409098] [ 3049.409381] [ 3049.409595] The buggy address belongs to the virtual mapping at [ 3049.409595] [ffffc90000078000, ffffc9000007a000) created by: [ 3049.409595] vmalloc_oob+0x78/0x5e0 [test_kasan] [ 3049.411495] [ 3049.411705] The buggy address belongs to the physical page: [ 3049.412395] page:00000000f0d6e73b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f6b6 [ 3049.413496] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 3049.414273] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 3049.415200] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 3049.416121] page dumped because: kasan: bad access detected [ 3049.416791] [ 3049.416998] Memory state around the buggy address: [ 3049.417592] ffffc90000078680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3049.418457] ffffc90000078700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3049.419329] >ffffc90000078780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8 [ 3049.420195] ^ [ 3049.421050] ffffc90000078800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 3049.421917] ffffc90000078880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 3049.422784] ================================================================== [ 3049.423758] ok 49 - vmalloc_oob [ 3049.423980] ok 50 - vmap_tags # SKIP Test requires CONFIG_KASAN_SW_TAGS=y [ 3049.424635] ok 51 - vm_map_ram_tags # SKIP Test requires CONFIG_KASAN_SW_TAGS=y [ 3049.428154] ok 52 - vmalloc_percpu # SKIP Test requires CONFIG_KASAN_SW_TAGS=y [ 3049.429660] ok 53 - match_all_not_assigned # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 3049.430860] ok 54 - match_all_ptr_tag # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 3049.432267] ok 55 - match_all_mem_tag # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 3049.433306] ok 20 - kasan [ 3049.571513] # Subtest: linear-ranges-test [ 3049.571531] 1..4 [ 3049.572442] ok 1 - range_test_get_value_amount [ 3049.572892] ok 2 - range_test_get_selector_high [ 3049.573747] ok 3 - range_test_get_selector_low [ 3049.574540] ok 4 - range_test_get_value [ 3049.575130] ok 21 - linear-ranges-test [ 3049.626913] # Subtest: list_sort [ 3049.626930] 1..1 [ 3049.637041] ok 1 - list_sort_test [ 3049.637393] ok 22 - list_sort [ 3049.760394] # Subtest: time_test_cases [ 3049.760403] 1..1 [ 3054.634604] ok 1 - time64_to_tm_test_date_range [ 3054.634985] ok 23 - time_test_cases