[ 1951.048127] # Subtest: bitfields [ 1951.048139] 1..2 [ 1951.049662] ok 1 - test_bitfields_constants [ 1951.050311] ok 2 - test_bitfields_variables [ 1951.050904] ok 1 - bitfields [ 1951.502773] # Subtest: cmdline [ 1951.502783] 1..4 [ 1951.504239] ok 1 - cmdline_test_noint [ 1951.504844] ok 2 - cmdline_test_lead_int [ 1951.505982] ok 3 - cmdline_test_tail_int [ 1951.506688] ok 4 - cmdline_test_range [ 1951.507234] ok 2 - cmdline [ 1951.943118] # Subtest: ext4_inode_test [ 1951.943126] 1..1 [ 1951.943725] # inode_test_xtimestamp_decoding: ok 1 - 1901-12-13 Lower bound of 32bit < 0 timestamp, no extra bits [ 1951.944871] # inode_test_xtimestamp_decoding: ok 2 - 1969-12-31 Upper bound of 32bit < 0 timestamp, no extra bits [ 1951.946630] # inode_test_xtimestamp_decoding: ok 3 - 1970-01-01 Lower bound of 32bit >=0 timestamp, no extra bits [ 1951.948487] # inode_test_xtimestamp_decoding: ok 4 - 2038-01-19 Upper bound of 32bit >=0 timestamp, no extra bits [ 1951.949987] # inode_test_xtimestamp_decoding: ok 5 - 2038-01-19 Lower bound of 32bit <0 timestamp, lo extra sec bit on [ 1951.952513] # inode_test_xtimestamp_decoding: ok 6 - 2106-02-07 Upper bound of 32bit <0 timestamp, lo extra sec bit on [ 1951.954393] # inode_test_xtimestamp_decoding: ok 7 - 2106-02-07 Lower bound of 32bit >=0 timestamp, lo extra sec bit on [ 1951.955757] # inode_test_xtimestamp_decoding: ok 8 - 2174-02-25 Upper bound of 32bit >=0 timestamp, lo extra sec bit on [ 1951.958333] # inode_test_xtimestamp_decoding: ok 9 - 2174-02-25 Lower bound of 32bit <0 timestamp, hi extra sec bit on [ 1951.960367] # inode_test_xtimestamp_decoding: ok 10 - 2242-03-16 Upper bound of 32bit <0 timestamp, hi extra sec bit on [ 1951.961735] # inode_test_xtimestamp_decoding: ok 11 - 2242-03-16 Lower bound of 32bit >=0 timestamp, hi extra sec bit on [ 1951.963414] # inode_test_xtimestamp_decoding: ok 12 - 2310-04-04 Upper bound of 32bit >=0 timestamp, hi extra sec bit on [ 1951.964855] # inode_test_xtimestamp_decoding: ok 13 - 2310-04-04 Upper bound of 32bit>=0 timestamp, hi extra sec bit 1. 1 ns [ 1951.966857] # inode_test_xtimestamp_decoding: ok 14 - 2378-04-22 Lower bound of 32bit>= timestamp. Extra sec bits 1. Max ns [ 1951.968494] # inode_test_xtimestamp_decoding: ok 15 - 2378-04-22 Lower bound of 32bit >=0 timestamp. All extra sec bits on [ 1951.970246] # inode_test_xtimestamp_decoding: ok 16 - 2446-05-10 Upper bound of 32bit >=0 timestamp. All extra sec bits on [ 1951.971405] ok 1 - inode_test_xtimestamp_decoding [ 1951.972456] ok 3 - ext4_inode_test [ 1952.848332] # Subtest: kunit-try-catch-test [ 1952.848341] 1..2 [ 1952.849606] ok 1 - kunit_test_try_catch_successful_try_no_catch [ 1952.850760] ok 2 - kunit_test_try_catch_unsuccessful_try_does_catch [ 1952.851446] ok 4 - kunit-try-catch-test [ 1952.853635] # Subtest: kunit-resource-test [ 1952.853642] 1..7 [ 1952.854648] ok 1 - kunit_resource_test_init_resources [ 1952.855638] ok 2 - kunit_resource_test_alloc_resource [ 1952.856785] ok 3 - kunit_resource_test_destroy_resource [ 1952.858379] ok 4 - kunit_resource_test_cleanup_resources [ 1952.859399] ok 5 - kunit_resource_test_proper_free_ordering [ 1952.860628] ok 6 - kunit_resource_test_static [ 1952.861800] ok 7 - kunit_resource_test_named [ 1952.862397] ok 5 - kunit-resource-test [ 1952.863398] # Subtest: kunit-log-test [ 1952.863404] 1..1 [ 1952.864809] put this in log. [ 1952.865219] this too. [ 1952.865508] add to suite log. [ 1952.865734] along with this. [ 1952.866390] ok 1 - kunit_log_test [ 1952.867044] ok 6 - kunit-log-test [ 1952.868843] # Subtest: kunit_status [ 1952.868850] 1..2 [ 1952.870375] ok 1 - kunit_status_set_failure_test [ 1952.871118] ok 2 - kunit_status_mark_skipped_test [ 1952.871599] ok 7 - kunit_status [ 1952.990747] # Subtest: rtc_lib_test_cases [ 1952.990754] 1..1 [ 1956.595187] ok 1 - rtc_time64_to_tm_test_date_range [ 1956.595662] ok 8 - rtc_lib_test_cases [ 1956.768553] # Subtest: list-kunit-test [ 1956.768562] 1..36 [ 1956.769506] ok 1 - list_test_list_init [ 1956.770304] ok 2 - list_test_list_add [ 1956.771218] ok 3 - list_test_list_add_tail [ 1956.772158] ok 4 - list_test_list_del [ 1956.773206] ok 5 - list_test_list_replace [ 1956.774207] ok 6 - list_test_list_replace_init [ 1956.775499] ok 7 - list_test_list_swap [ 1956.776530] ok 8 - list_test_list_del_init [ 1956.777669] ok 9 - list_test_list_move [ 1956.778631] ok 10 - list_test_list_move_tail [ 1956.779678] ok 11 - list_test_list_bulk_move_tail [ 1956.780699] ok 12 - list_test_list_is_first [ 1956.781960] ok 13 - list_test_list_is_last [ 1956.783036] ok 14 - list_test_list_empty [ 1956.783776] ok 15 - list_test_list_empty_careful [ 1956.785059] ok 16 - list_test_list_rotate_left [ 1956.785795] ok 17 - list_test_list_rotate_to_front [ 1956.787023] ok 18 - list_test_list_is_singular [ 1956.787751] ok 19 - list_test_list_cut_position [ 1956.789468] ok 20 - list_test_list_cut_before [ 1956.790382] ok 21 - list_test_list_splice [ 1956.791504] ok 22 - list_test_list_splice_tail [ 1956.793430] ok 23 - list_test_list_splice_init [ 1956.794306] ok 24 - list_test_list_splice_tail_init [ 1956.795642] ok 25 - list_test_list_entry [ 1956.796528] ok 26 - list_test_list_first_entry [ 1956.797610] ok 27 - list_test_list_last_entry [ 1956.800191] ok 28 - list_test_list_first_entry_or_null [ 1956.801541] ok 29 - list_test_list_next_entry [ 1956.802895] ok 30 - list_test_list_prev_entry [ 1956.804233] ok 31 - list_test_list_for_each [ 1956.805340] ok 32 - list_test_list_for_each_prev [ 1956.806386] ok 33 - list_test_list_for_each_safe [ 1956.807284] ok 34 - list_test_list_for_each_prev_safe [ 1956.809116] ok 35 - list_test_list_for_each_entry [ 1956.810176] ok 36 - list_test_list_for_each_entry_reverse [ 1956.810685] ok 9 - list-kunit-test [ 1956.910992] # Subtest: memcpy [ 1956.910999] 1..4 [ 1956.911552] # memset_test: ok: memset() direct assignment [ 1956.912359] # memset_test: ok: memset() complete overwrite [ 1956.912923] # memset_test: ok: memset() middle overwrite [ 1956.913459] # memset_test: ok: memset() argument side-effects [ 1956.914050] # memset_test: ok: memset() memset_after() [ 1956.914557] # memset_test: ok: memset() memset_startat() [ 1956.916022] ok 1 - memset_test [ 1956.916594] # memcpy_test: ok: memcpy() static initializers [ 1956.917577] # memcpy_test: ok: memcpy() direct assignment [ 1956.918165] # memcpy_test: ok: memcpy() complete overwrite [ 1956.918707] # memcpy_test: ok: memcpy() middle overwrite [ 1956.919257] # memcpy_test: ok: memcpy() argument side-effects [ 1956.920195] ok 2 - memcpy_test [ 1956.921254] # memmove_test: ok: memmove() static initializers [ 1956.922251] # memmove_test: ok: memmove() direct assignment [ 1956.922808] # memmove_test: ok: memmove() complete overwrite [ 1956.923400] # memmove_test: ok: memmove() middle overwrite [ 1956.923967] # memmove_test: ok: memmove() argument side-effects [ 1956.924551] # memmove_test: ok: memmove() overlapping write [ 1956.925698] ok 3 - memmove_test [ 1956.927431] ok 4 - strtomem_test [ 1956.927803] ok 10 - memcpy [ 1957.034849] # Subtest: mptcp-crypto [ 1957.034856] 1..1 [ 1957.035572] ok 1 - mptcp_crypto_test_basic [ 1957.035940] ok 11 - mptcp-crypto [ 1957.157001] # Subtest: mptcp-token [ 1957.157009] 1..4 [ 1957.157726] ok 1 - mptcp_token_test_req_basic [ 1957.159061] ok 2 - mptcp_token_test_msk_basic [ 1957.160135] ok 3 - mptcp_token_test_accept [ 1957.161394] ok 4 - mptcp_token_test_destroyed [ 1957.162005] ok 12 - mptcp-token [ 1957.417600] # Subtest: rational [ 1957.417608] 1..1 [ 1957.420576] # rational_test: ok 1 - Exceeds bounds, semi-convergent term > 1/2 last term [ 1957.421491] # rational_test: ok 2 - Exceeds bounds, semi-convergent term < 1/2 last term [ 1957.423036] # rational_test: ok 3 - Closest to zero [ 1957.424685] # rational_test: ok 4 - Closest to smallest non-zero [ 1957.425524] # rational_test: ok 5 - Use convergent [ 1957.426795] # rational_test: ok 6 - Exact answer [ 1957.427983] # rational_test: ok 7 - Semiconvergent, numerator limit [ 1957.428699] # rational_test: ok 8 - Semiconvergent, denominator limit [ 1957.429431] ok 1 - rational_test [ 1957.430065] ok 13 - rational [ 1957.528489] # Subtest: resource [ 1957.528496] 1..2 [ 1957.529573] ok 1 - resource_test_union [ 1957.530387] ok 2 - resource_test_intersection [ 1957.530797] ok 14 - resource [ 1957.630295] # Subtest: slub_test [ 1957.630302] 1..2 [ 1957.641608] ok 1 - test_clobber_zone [ 1957.645573] ok 2 - test_clobber_redzone_free [ 1957.646055] ok 15 - slub_test [ 1958.056526] # Subtest: snd_soc_tplg_test [ 1958.056535] 1..11 [ 1958.059361] ok 1 - snd_soc_tplg_test_load_with_null_comp [ 1958.062336] ok 2 - snd_soc_tplg_test_load_with_null_ops [ 1958.065337] ok 3 - snd_soc_tplg_test_load_with_null_fw [ 1958.068338] ok 4 - snd_soc_tplg_test_load_empty_tplg [ 1958.072363] ok 5 - snd_soc_tplg_test_load_empty_tplg_bad_magic [ 1958.075405] ok 6 - snd_soc_tplg_test_load_empty_tplg_bad_abi [ 1958.079258] ok 7 - snd_soc_tplg_test_load_empty_tplg_bad_size [ 1958.080624] ok 8 - snd_soc_tplg_test_load_empty_tplg_bad_payload_size [ 1958.082359] ok 9 - snd_soc_tplg_test_load_pcm_tplg [ 1958.084973] ok 10 - snd_soc_tplg_test_load_pcm_tplg_reload_comp [ 1958.088991] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.092343] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.132332] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.135485] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.157758] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.161524] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.183166] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.186910] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.209078] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.213204] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.238655] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.248491] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.272583] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.276437] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.296035] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.299559] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.318767] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.320690] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.345739] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.349543] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.370078] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.373934] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.394188] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.397468] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.423187] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.427076] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.455575] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.459596] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.480115] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.483550] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.503768] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.507525] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.538896] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.542449] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.563795] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.568410] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.593020] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.596536] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.617995] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.622509] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.640645] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.644456] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.664764] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.673671] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.696576] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.700510] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.721212] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.724532] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.745941] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.749445] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.769774] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.773502] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.801765] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.806460] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.827136] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.830490] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.852070] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.855482] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.883518] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.887542] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.913063] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.918726] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.938274] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.942452] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.961711] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.965474] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1958.993116] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1958.996514] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.024484] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.028454] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.053749] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.058520] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.080047] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.083142] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.106125] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.109492] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.136985] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.141656] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.162037] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.165544] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.186044] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.189458] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.210586] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.214532] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.233686] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.237473] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.267084] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.269004] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.293235] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.296506] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.320584] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.324574] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.344720] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.350553] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.377241] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.380482] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.400663] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.404447] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.425121] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.428613] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.451198] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.454430] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.484057] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.487422] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.509631] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.513466] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.536320] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.539427] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.563407] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.566494] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.588013] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.591470] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.625526] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.629430] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.653069] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.656479] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.677137] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.681481] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.702178] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.706720] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.728900] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.732500] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.760036] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.763405] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.785710] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.789445] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.810706] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.812521] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.833960] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.835694] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.866108] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.869485] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.890013] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.893498] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.915056] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.918498] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.936828] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.941535] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.965268] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.971461] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1959.993393] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1959.996419] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.018289] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.021461] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.043260] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.048090] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.066812] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.068596] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.099352] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.102444] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.124659] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.128523] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.147292] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.151433] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.171933] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.178655] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.201718] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.205568] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.228463] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.231463] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.252981] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.256628] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.276235] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.280488] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.305432] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.308445] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.335236] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.338488] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.357530] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.362637] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.382426] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.386362] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.405636] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.409474] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.437704] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.439720] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.460976] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.464464] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.485174] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.488510] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.508427] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.512486] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.533442] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.536506] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.562655] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.566442] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.586460] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.590423] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.610911] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.612635] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.635854] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.639557] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.662603] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.664412] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.690137] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.693448] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.715249] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.718464] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.741543] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: Parent card not yet available, widget card binding deferred [ 1960.746425] sound-soc-topology-test-driver sound-soc-topology-test: ASoC: no DMI vendor name! [ 1960.767939] ok 11 - snd_soc_tplg_test_load_pcm_tplg_reload_card [ 1960.767957] ok 16 - snd_soc_tplg_test [ 1961.013378] # Subtest: soc-utils [ 1961.013388] 1..1 [ 1961.016986] ok 1 - test_tdm_params_to_bclk [ 1961.017298] ok 17 - soc-utils [ 1961.607976] # Subtest: sysctl_test [ 1961.607986] 1..10 [ 1961.617304] ok 1 - sysctl_test_api_dointvec_null_tbl_data [ 1961.621017] ok 2 - sysctl_test_api_dointvec_table_maxlen_unset [ 1961.622947] ok 3 - sysctl_test_api_dointvec_table_len_is_zero [ 1961.624987] ok 4 - sysctl_test_api_dointvec_table_read_but_position_set [ 1961.629996] ok 5 - sysctl_test_dointvec_read_happy_single_positive [ 1961.631928] ok 6 - sysctl_test_dointvec_read_happy_single_negative [ 1961.634993] ok 7 - sysctl_test_dointvec_write_happy_single_positive [ 1961.638147] ok 8 - sysctl_test_dointvec_write_happy_single_negative [ 1961.640925] ok 9 - sysctl_test_api_dointvec_write_single_less_int_min [ 1961.643069] ok 10 - sysctl_test_api_dointvec_write_single_greater_int_max [ 1961.643714] ok 18 - sysctl_test [ 1961.868397] # Subtest: bits-test [ 1961.868405] 1..3 [ 1961.871946] ok 1 - genmask_test [ 1961.875888] ok 2 - genmask_ull_test [ 1961.877929] ok 3 - genmask_input_check_test [ 1961.878388] ok 19 - bits-test [ 1962.853306] # Subtest: kasan [ 1962.853317] 1..55 [ 1962.855971] ================================================================== [ 1962.856868] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 1962.857586] Write of size 1 at addr ffff88810457dc73 by task kunit_try_catch/47831 [ 1962.858417] CPU: 0 PID: 47831 Comm: kunit_try_catch Kdump: loaded Not tainted 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1962.859437] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1962.859975] Call Trace: [ 1962.860225] [ 1962.860448] ? kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 1962.860939] dump_stack_lvl+0x57/0x81 [ 1962.861292] print_address_description.constprop.0+0x1f/0x1e0 [ 1962.861814] ? kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 1962.862302] print_report.cold+0x5c/0x237 [ 1962.862667] kasan_report+0xc9/0x100 [ 1962.863003] ? kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 1962.863483] kmalloc_oob_right+0x4ed/0x510 [test_kasan] [ 1962.863957] ? kmalloc_oob_left+0x2e0/0x2e0 [test_kasan] [ 1962.864431] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 1962.864950] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1962.865444] ? kunit_add_resource+0x197/0x280 [kunit] [ 1962.865897] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.866339] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1962.866791] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.867337] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1962.867795] kthread+0x2a7/0x350 [ 1962.868101] ? kthread_complete_and_exit+0x20/0x20 [ 1962.868530] ret_from_fork+0x22/0x30 [ 1962.868865] [ 1962.869240] Allocated by task 47831: [ 1962.869569] kasan_save_stack+0x1e/0x40 [ 1962.869919] __kasan_kmalloc+0x81/0xa0 [ 1962.870265] kmalloc_oob_right+0x98/0x510 [test_kasan] [ 1962.870723] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.871165] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.871702] kthread+0x2a7/0x350 [ 1962.872010] ret_from_fork+0x22/0x30 [ 1962.872494] The buggy address belongs to the object at ffff88810457dc00 which belongs to the cache kmalloc-128 of size 128 [ 1962.873620] The buggy address is located 115 bytes inside of 128-byte region [ffff88810457dc00, ffff88810457dc80) [ 1962.874810] The buggy address belongs to the physical page: [ 1962.875299] page:00000000350139c3 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10457d [ 1962.876152] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1962.876785] raw: 0017ffffc0000200 ffffea00007a3140 dead000000000002 ffff8881000418c0 [ 1962.877472] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1962.878142] page dumped because: kasan: bad access detected [ 1962.878823] Memory state around the buggy address: [ 1962.879252] ffff88810457db00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1962.879926] ffff88810457db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.880587] >ffff88810457dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 1962.881236] ^ [ 1962.881826] ffff88810457dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.882480] ffff88810457dd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 1962.883136] ================================================================== [ 1962.883828] Disabling lock debugging due to kernel taint [ 1962.884324] ================================================================== [ 1962.885004] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 1962.885700] Write of size 1 at addr ffff88810457dc78 by task kunit_try_catch/47831 [ 1962.886531] CPU: 0 PID: 47831 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1962.887719] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1962.888231] Call Trace: [ 1962.888460] [ 1962.888664] ? kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 1962.889145] dump_stack_lvl+0x57/0x81 [ 1962.889496] print_address_description.constprop.0+0x1f/0x1e0 [ 1962.890038] ? kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 1962.890554] print_report.cold+0x5c/0x237 [ 1962.890967] kasan_report+0xc9/0x100 [ 1962.891296] ? kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 1962.891771] kmalloc_oob_right+0x4e3/0x510 [test_kasan] [ 1962.892243] ? kmalloc_oob_left+0x2e0/0x2e0 [test_kasan] [ 1962.892713] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 1962.893228] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1962.893743] ? kunit_add_resource+0x197/0x280 [kunit] [ 1962.894221] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.894659] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1962.895117] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.895677] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1962.896162] kthread+0x2a7/0x350 [ 1962.896460] ? kthread_complete_and_exit+0x20/0x20 [ 1962.896886] ret_from_fork+0x22/0x30 [ 1962.897226] [ 1962.897592] Allocated by task 47831: [ 1962.897916] kasan_save_stack+0x1e/0x40 [ 1962.898269] __kasan_kmalloc+0x81/0xa0 [ 1962.898609] kmalloc_oob_right+0x98/0x510 [test_kasan] [ 1962.899070] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.899504] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.900047] kthread+0x2a7/0x350 [ 1962.900345] ret_from_fork+0x22/0x30 [ 1962.900825] The buggy address belongs to the object at ffff88810457dc00 which belongs to the cache kmalloc-128 of size 128 [ 1962.901883] The buggy address is located 120 bytes inside of 128-byte region [ffff88810457dc00, ffff88810457dc80) [ 1962.903050] The buggy address belongs to the physical page: [ 1962.903553] page:00000000350139c3 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10457d [ 1962.904383] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1962.904988] raw: 0017ffffc0000200 ffffea00007a3140 dead000000000002 ffff8881000418c0 [ 1962.905651] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1962.906318] page dumped because: kasan: bad access detected [ 1962.906959] Memory state around the buggy address: [ 1962.907409] ffff88810457db00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1962.908079] ffff88810457db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.908724] >ffff88810457dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 1962.909352] ^ [ 1962.909976] ffff88810457dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.910601] ffff88810457dd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 1962.911227] ================================================================== [ 1962.911863] ================================================================== [ 1962.912500] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 1962.913213] Read of size 1 at addr ffff88810457dc80 by task kunit_try_catch/47831 [ 1962.914024] CPU: 0 PID: 47831 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1962.915190] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1962.915696] Call Trace: [ 1962.915924] [ 1962.916137] ? kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 1962.916632] dump_stack_lvl+0x57/0x81 [ 1962.916996] print_address_description.constprop.0+0x1f/0x1e0 [ 1962.917509] ? kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 1962.918120] print_report.cold+0x5c/0x237 [ 1962.918483] kasan_report+0xc9/0x100 [ 1962.918811] ? kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 1962.919294] kmalloc_oob_right+0x4d9/0x510 [test_kasan] [ 1962.919757] ? kmalloc_oob_left+0x2e0/0x2e0 [test_kasan] [ 1962.920235] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 1962.920745] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1962.921244] ? kunit_add_resource+0x197/0x280 [kunit] [ 1962.921694] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.922135] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1962.922586] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.923131] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1962.923588] kthread+0x2a7/0x350 [ 1962.923889] ? kthread_complete_and_exit+0x20/0x20 [ 1962.924328] ret_from_fork+0x22/0x30 [ 1962.924660] [ 1962.925031] Allocated by task 47831: [ 1962.925354] kasan_save_stack+0x1e/0x40 [ 1962.925699] __kasan_kmalloc+0x81/0xa0 [ 1962.926042] kmalloc_oob_right+0x98/0x510 [test_kasan] [ 1962.926497] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.926937] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.927518] kthread+0x2a7/0x350 [ 1962.927818] ret_from_fork+0x22/0x30 [ 1962.928353] The buggy address belongs to the object at ffff88810457dc00 which belongs to the cache kmalloc-128 of size 128 [ 1962.929451] The buggy address is located 0 bytes to the right of 128-byte region [ffff88810457dc00, ffff88810457dc80) [ 1962.930634] The buggy address belongs to the physical page: [ 1962.931122] page:00000000350139c3 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10457d [ 1962.931923] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1962.932532] raw: 0017ffffc0000200 ffffea00007a3140 dead000000000002 ffff8881000418c0 [ 1962.933205] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1962.933869] page dumped because: kasan: bad access detected [ 1962.934513] Memory state around the buggy address: [ 1962.934940] ffff88810457db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.935566] ffff88810457dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 1962.936198] >ffff88810457dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.936823] ^ [ 1962.937125] ffff88810457dd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 1962.937751] ffff88810457dd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.938385] ================================================================== [ 1962.939062] ok 1 - kmalloc_oob_right [ 1962.940913] ================================================================== [ 1962.941948] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 1962.942650] Read of size 1 at addr ffff888014e90d5f by task kunit_try_catch/47832 [ 1962.943472] CPU: 0 PID: 47832 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1962.944651] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1962.945168] Call Trace: [ 1962.945401] [ 1962.945607] ? kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 1962.946088] dump_stack_lvl+0x57/0x81 [ 1962.946428] print_address_description.constprop.0+0x1f/0x1e0 [ 1962.946948] ? kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 1962.947423] print_report.cold+0x5c/0x237 [ 1962.947788] kasan_report+0xc9/0x100 [ 1962.948127] ? kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 1962.948604] kmalloc_oob_left+0x2bf/0x2e0 [test_kasan] [ 1962.949070] ? kmalloc_pagealloc_oob_right+0x290/0x290 [test_kasan] [ 1962.949626] ? do_raw_spin_trylock+0xb5/0x180 [ 1962.950032] ? do_raw_spin_lock+0x270/0x270 [ 1962.950519] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1962.951134] ? kunit_add_resource+0x197/0x280 [kunit] [ 1962.951632] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.952103] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1962.952580] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.953154] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1962.953634] kthread+0x2a7/0x350 [ 1962.953957] ? kthread_complete_and_exit+0x20/0x20 [ 1962.954414] ret_from_fork+0x22/0x30 [ 1962.954749] [ 1962.955127] Allocated by task 0: [ 1962.955427] (stack is not available) [ 1962.955910] The buggy address belongs to the object at ffff888014e90d40 which belongs to the cache kmalloc-16 of size 16 [ 1962.956987] The buggy address is located 15 bytes to the right of 16-byte region [ffff888014e90d40, ffff888014e90d50) [ 1962.958200] The buggy address belongs to the physical page: [ 1962.958685] page:000000009a8c594a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14e90 [ 1962.959494] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1962.960126] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1962.960815] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1962.961491] page dumped because: kasan: bad access detected [ 1962.962136] Memory state around the buggy address: [ 1962.962563] ffff888014e90c00: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1962.963199] ffff888014e90c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1962.963827] >ffff888014e90d00: fb fb fc fc fa fb fc fc 00 00 fc fc 00 07 fc fc [ 1962.964502] ^ [ 1962.965043] ffff888014e90d80: 00 00 fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1962.965673] ffff888014e90e00: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1962.966307] ================================================================== [ 1962.967097] ok 2 - kmalloc_oob_left [ 1962.969846] ================================================================== [ 1962.970847] BUG: KASAN: slab-out-of-bounds in kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 1962.971596] Read of size 1 at addr ffff88801e617000 by task kunit_try_catch/47833 [ 1962.972409] CPU: 0 PID: 47833 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1962.973624] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1962.974182] Call Trace: [ 1962.974410] [ 1962.974613] ? kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 1962.975135] dump_stack_lvl+0x57/0x81 [ 1962.975468] print_address_description.constprop.0+0x1f/0x1e0 [ 1962.976023] ? kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 1962.976535] print_report.cold+0x5c/0x237 [ 1962.976922] kasan_report+0xc9/0x100 [ 1962.977275] ? kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 1962.977788] kmalloc_node_oob_right+0x2bf/0x2e0 [test_kasan] [ 1962.978297] ? pagealloc_uaf+0x2f0/0x2f0 [test_kasan] [ 1962.978763] ? do_raw_spin_trylock+0xb5/0x180 [ 1962.979188] ? do_raw_spin_lock+0x270/0x270 [ 1962.979581] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1962.980107] ? kunit_add_resource+0x197/0x280 [kunit] [ 1962.980575] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.981043] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1962.981490] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.982030] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1962.982482] kthread+0x2a7/0x350 [ 1962.982800] ? kthread_complete_and_exit+0x20/0x20 [ 1962.983251] ret_from_fork+0x22/0x30 [ 1962.983601] [ 1962.984016] Allocated by task 47833: [ 1962.984355] kasan_save_stack+0x1e/0x40 [ 1962.984701] __kasan_kmalloc+0x81/0xa0 [ 1962.985042] kmalloc_node_oob_right+0x9a/0x2e0 [test_kasan] [ 1962.985525] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1962.985960] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1962.986491] kthread+0x2a7/0x350 [ 1962.986806] ret_from_fork+0x22/0x30 [ 1962.987309] The buggy address belongs to the object at ffff88801e616000 which belongs to the cache kmalloc-4k of size 4096 [ 1962.988356] The buggy address is located 0 bytes to the right of 4096-byte region [ffff88801e616000, ffff88801e617000) [ 1962.989533] The buggy address belongs to the physical page: [ 1962.990059] page:00000000a6e919b5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1e610 [ 1962.990870] head:00000000a6e919b5 order:3 compound_mapcount:0 compound_pincount:0 [ 1962.991534] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 1962.992168] raw: 000fffffc0010200 ffffea0000c33600 dead000000000002 ffff888100042140 [ 1962.992827] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000 [ 1962.993489] page dumped because: kasan: bad access detected [ 1962.994172] Memory state around the buggy address: [ 1962.994592] ffff88801e616f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1962.995224] ffff88801e616f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1962.995847] >ffff88801e617000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.996472] ^ [ 1962.996768] ffff88801e617080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.997400] ffff88801e617100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1962.998027] ================================================================== [ 1962.998845] ok 3 - kmalloc_node_oob_right [ 1963.000894] ================================================================== [ 1963.001957] BUG: KASAN: slab-out-of-bounds in kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 1963.002740] Write of size 1 at addr ffff8880059ae00a by task kunit_try_catch/47835 [ 1963.003608] CPU: 0 PID: 47835 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.004782] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.005301] Call Trace: [ 1963.005534] [ 1963.005742] ? kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 1963.006303] dump_stack_lvl+0x57/0x81 [ 1963.006641] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.007164] ? kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 1963.007716] print_report.cold+0x5c/0x237 [ 1963.008088] kasan_report+0xc9/0x100 [ 1963.008418] ? kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 1963.008976] kmalloc_pagealloc_oob_right+0x27b/0x290 [test_kasan] [ 1963.009515] ? kmalloc_pagealloc_uaf+0x280/0x280 [test_kasan] [ 1963.010036] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.010432] ? do_raw_spin_lock+0x270/0x270 [ 1963.010809] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.011314] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.011770] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.012215] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.012672] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.013218] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.013678] kthread+0x2a7/0x350 [ 1963.013985] ? kthread_complete_and_exit+0x20/0x20 [ 1963.014413] ret_from_fork+0x22/0x30 [ 1963.014746] [ 1963.015119] The buggy address belongs to the physical page: [ 1963.015604] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.016401] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.017057] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.017655] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.018334] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.019008] page dumped because: kasan: bad access detected [ 1963.019648] Memory state around the buggy address: [ 1963.020085] ffff8880059adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.020716] ffff8880059adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.021355] >ffff8880059ae000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.022012] ^ [ 1963.022352] ffff8880059ae080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.023004] ffff8880059ae100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.023700] ================================================================== [ 1963.024435] ok 4 - kmalloc_pagealloc_oob_right [ 1963.028987] ================================================================== [ 1963.030098] BUG: KASAN: use-after-free in kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 1963.030801] Read of size 1 at addr ffff8880059ac000 by task kunit_try_catch/47836 [ 1963.031704] CPU: 0 PID: 47836 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.032969] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.033519] Call Trace: [ 1963.033749] [ 1963.033961] ? kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 1963.034517] dump_stack_lvl+0x57/0x81 [ 1963.034854] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.035376] ? kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 1963.035888] print_report.cold+0x5c/0x237 [ 1963.036260] kasan_report+0xc9/0x100 [ 1963.036591] ? kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 1963.037113] kmalloc_pagealloc_uaf+0x26b/0x280 [test_kasan] [ 1963.037605] ? kmalloc_pagealloc_invalid_free+0x250/0x250 [test_kasan] [ 1963.038183] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.038581] ? do_raw_spin_lock+0x270/0x270 [ 1963.038965] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.039498] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.039960] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.040399] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.040853] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.041424] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.041973] kthread+0x2a7/0x350 [ 1963.042388] ? kthread_complete_and_exit+0x20/0x20 [ 1963.043027] ret_from_fork+0x22/0x30 [ 1963.043469] [ 1963.043945] The buggy address belongs to the physical page: [ 1963.044554] page:00000000bd858cff refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.045430] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 1963.046058] raw: 000fffffc0000000 ffffea0000105808 ffff88810c1ff270 0000000000000000 [ 1963.046774] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 1963.047502] page dumped because: kasan: bad access detected [ 1963.048193] Memory state around the buggy address: [ 1963.048630] ffff8880059abf00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.049284] ffff8880059abf80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.049936] >ffff8880059ac000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1963.050586] ^ [ 1963.050894] ffff8880059ac080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1963.051548] ffff8880059ac100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1963.052200] ================================================================== [ 1963.052957] ok 5 - kmalloc_pagealloc_uaf [ 1963.056663] ================================================================== [ 1963.057751] BUG: KASAN: double-free or invalid-free in kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 1963.058816] CPU: 0 PID: 47837 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.060032] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.060557] Call Trace: [ 1963.060796] [ 1963.061013] dump_stack_lvl+0x57/0x81 [ 1963.061362] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.061889] print_report.cold+0x5c/0x237 [ 1963.062266] ? kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 1963.062860] ? kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 1963.063458] kasan_report_invalid_free+0x99/0xc0 [ 1963.063891] ? kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 1963.064528] kfree+0x2ab/0x3c0 [ 1963.064882] kmalloc_pagealloc_invalid_free+0x191/0x250 [test_kasan] [ 1963.065551] ? kmalloc_large_oob_right+0x2b0/0x2b0 [test_kasan] [ 1963.066163] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.066619] ? do_raw_spin_lock+0x270/0x270 [ 1963.067065] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.067595] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.068115] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.068609] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.069103] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.069658] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.070137] kthread+0x2a7/0x350 [ 1963.070446] ? kthread_complete_and_exit+0x20/0x20 [ 1963.070889] ret_from_fork+0x22/0x30 [ 1963.071240] [ 1963.071617] The buggy address belongs to the physical page: [ 1963.072124] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.072947] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.073664] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.074321] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.075040] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.075731] page dumped because: kasan: bad access detected [ 1963.076441] Memory state around the buggy address: [ 1963.076921] ffff8880059abf00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.077626] ffff8880059abf80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.078283] >ffff8880059ac000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.078951] ^ [ 1963.079282] ffff8880059ac080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.079951] ffff8880059ac100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.080623] ================================================================== [ 1963.081491] ok 6 - kmalloc_pagealloc_invalid_free [ 1963.083874] ok 7 - pagealloc_oob_right # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 1963.084986] ================================================================== [ 1963.086435] BUG: KASAN: use-after-free in pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 1963.087233] Read of size 1 at addr ffff888079fb0000 by task kunit_try_catch/47839 [ 1963.088187] CPU: 0 PID: 47839 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.089458] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.090049] Call Trace: [ 1963.090311] [ 1963.090541] ? pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 1963.091067] dump_stack_lvl+0x57/0x81 [ 1963.091437] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.091976] ? pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 1963.092444] print_report.cold+0x5c/0x237 [ 1963.092823] kasan_report+0xc9/0x100 [ 1963.093175] ? pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 1963.093644] pagealloc_uaf+0x2b5/0x2f0 [test_kasan] [ 1963.094127] ? krealloc_more_oob+0x10/0x10 [test_kasan] [ 1963.094633] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.095057] ? do_raw_spin_lock+0x270/0x270 [ 1963.095454] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.095973] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.096443] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.096896] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.097369] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.097933] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.098408] kthread+0x2a7/0x350 [ 1963.098721] ? kthread_complete_and_exit+0x20/0x20 [ 1963.099171] ret_from_fork+0x22/0x30 [ 1963.099517] [ 1963.099898] The buggy address belongs to the physical page: [ 1963.100406] page:00000000733bcb7d refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x79fb0 [ 1963.101265] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 1963.101848] raw: 000fffffc0000000 ffffea000053dc08 ffff88813ffd3aa0 0000000000000000 [ 1963.102591] raw: 0000000000000000 0000000000000004 00000000ffffff7f 0000000000000000 [ 1963.103300] page dumped because: kasan: bad access detected [ 1963.103965] Memory state around the buggy address: [ 1963.104405] ffff888079faff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1963.105061] ffff888079faff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1963.105710] >ffff888079fb0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1963.106363] ^ [ 1963.106670] ffff888079fb0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1963.107324] ffff888079fb0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1963.107975] ================================================================== [ 1963.108713] ok 8 - pagealloc_uaf [ 1963.109842] ================================================================== [ 1963.111103] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 1963.111982] Write of size 1 at addr ffff888002775f00 by task kunit_try_catch/47840 [ 1963.112944] CPU: 0 PID: 47840 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.114243] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.114751] Call Trace: [ 1963.114991] [ 1963.115196] ? kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 1963.115731] dump_stack_lvl+0x57/0x81 [ 1963.116080] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.116600] ? kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 1963.117156] print_report.cold+0x5c/0x237 [ 1963.117545] kasan_report+0xc9/0x100 [ 1963.117879] ? kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 1963.118487] kmalloc_large_oob_right+0x28c/0x2b0 [test_kasan] [ 1963.119065] ? kmalloc_oob_16+0x3b0/0x3b0 [test_kasan] [ 1963.119524] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.119922] ? do_raw_spin_lock+0x270/0x270 [ 1963.120311] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.120805] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.121271] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.121711] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.122172] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.122713] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.123177] kthread+0x2a7/0x350 [ 1963.123480] ? kthread_complete_and_exit+0x20/0x20 [ 1963.123910] ret_from_fork+0x22/0x30 [ 1963.124249] [ 1963.124615] Allocated by task 47840: [ 1963.124945] kasan_save_stack+0x1e/0x40 [ 1963.125293] __kasan_kmalloc+0x81/0xa0 [ 1963.125633] kmalloc_large_oob_right+0x98/0x2b0 [test_kasan] [ 1963.126144] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.126581] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.127125] kthread+0x2a7/0x350 [ 1963.127427] ret_from_fork+0x22/0x30 [ 1963.128010] The buggy address belongs to the object at ffff888002774000 which belongs to the cache kmalloc-8k of size 8192 [ 1963.129091] The buggy address is located 7936 bytes inside of 8192-byte region [ffff888002774000, ffff888002776000) [ 1963.130274] The buggy address belongs to the physical page: [ 1963.130760] page:000000005b0b40bb refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2770 [ 1963.131563] head:000000005b0b40bb order:3 compound_mapcount:0 compound_pincount:0 [ 1963.132224] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.132865] raw: 000fffffc0010200 ffffea000006dc00 dead000000000006 ffff888100042280 [ 1963.133542] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 1963.134215] page dumped because: kasan: bad access detected [ 1963.134856] Memory state around the buggy address: [ 1963.135314] ffff888002775e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.135965] ffff888002775e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.136685] >ffff888002775f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.137319] ^ [ 1963.137619] ffff888002775f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.138252] ffff888002776000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.138878] ================================================================== [ 1963.139609] ok 9 - kmalloc_large_oob_right [ 1963.140850] ================================================================== [ 1963.141913] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.142676] Write of size 1 at addr ffff8880013ccaeb by task kunit_try_catch/47841 [ 1963.143495] CPU: 0 PID: 47841 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.144661] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.145176] Call Trace: [ 1963.145407] [ 1963.145613] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.146151] dump_stack_lvl+0x57/0x81 [ 1963.146489] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.147009] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.147552] print_report.cold+0x5c/0x237 [ 1963.147919] kasan_report+0xc9/0x100 [ 1963.148258] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.148796] krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.149327] ? krealloc_less_oob+0x10/0x10 [test_kasan] [ 1963.149794] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.150225] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.150648] ? lock_acquire+0x4ea/0x620 [ 1963.151001] ? rcu_read_unlock+0x40/0x40 [ 1963.151356] ? rcu_read_unlock+0x40/0x40 [ 1963.151708] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.152137] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.152630] ? do_raw_spin_lock+0x270/0x270 [ 1963.153013] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.153554] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.154002] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.154454] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.154892] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.155349] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.155885] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.156348] kthread+0x2a7/0x350 [ 1963.156647] ? kthread_complete_and_exit+0x20/0x20 [ 1963.157083] ret_from_fork+0x22/0x30 [ 1963.157416] [ 1963.157780] Allocated by task 47841: [ 1963.158110] kasan_save_stack+0x1e/0x40 [ 1963.158454] __kasan_krealloc+0xee/0x160 [ 1963.158805] krealloc+0x50/0xe0 [ 1963.159102] krealloc_more_oob_helper+0x1d5/0x610 [test_kasan] [ 1963.159623] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.160070] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.160650] kthread+0x2a7/0x350 [ 1963.160953] ret_from_fork+0x22/0x30 [ 1963.161435] The buggy address belongs to the object at ffff8880013cca00 which belongs to the cache kmalloc-256 of size 256 [ 1963.162497] The buggy address is located 235 bytes inside of 256-byte region [ffff8880013cca00, ffff8880013ccb00) [ 1963.163655] The buggy address belongs to the physical page: [ 1963.164147] page:00000000317d3b98 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13cc [ 1963.164945] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.165542] raw: 000fffffc0000200 ffffea0000094480 dead000000000002 ffff888100041b40 [ 1963.166217] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.166885] page dumped because: kasan: bad access detected [ 1963.167528] Memory state around the buggy address: [ 1963.167957] ffff8880013cc980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.168586] ffff8880013cca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.169223] >ffff8880013cca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc [ 1963.169850] ^ [ 1963.170427] ffff8880013ccb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.171058] ffff8880013ccb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.171684] ================================================================== [ 1963.172425] ================================================================== [ 1963.173073] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.173874] Write of size 1 at addr ffff8880013ccaf0 by task kunit_try_catch/47841 [ 1963.174742] CPU: 0 PID: 47841 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.175909] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.176461] Call Trace: [ 1963.176691] [ 1963.176896] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.177461] dump_stack_lvl+0x57/0x81 [ 1963.177814] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.178332] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.178863] print_report.cold+0x5c/0x237 [ 1963.179249] kasan_report+0xc9/0x100 [ 1963.179602] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.180163] krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.180713] ? krealloc_less_oob+0x10/0x10 [test_kasan] [ 1963.181207] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.181654] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.182082] ? lock_acquire+0x4ea/0x620 [ 1963.182429] ? rcu_read_unlock+0x40/0x40 [ 1963.182785] ? rcu_read_unlock+0x40/0x40 [ 1963.183144] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.183610] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.184110] ? do_raw_spin_lock+0x270/0x270 [ 1963.184518] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.185084] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.185527] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.185984] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.186422] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.186870] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.187438] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.187912] kthread+0x2a7/0x350 [ 1963.188216] ? kthread_complete_and_exit+0x20/0x20 [ 1963.188646] ret_from_fork+0x22/0x30 [ 1963.188985] [ 1963.189350] Allocated by task 47841: [ 1963.189672] kasan_save_stack+0x1e/0x40 [ 1963.190025] __kasan_krealloc+0xee/0x160 [ 1963.190403] krealloc+0x50/0xe0 [ 1963.190713] krealloc_more_oob_helper+0x1d5/0x610 [test_kasan] [ 1963.191258] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.191714] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.192255] kthread+0x2a7/0x350 [ 1963.192553] ret_from_fork+0x22/0x30 [ 1963.193040] The buggy address belongs to the object at ffff8880013cca00 which belongs to the cache kmalloc-256 of size 256 [ 1963.194100] The buggy address is located 240 bytes inside of 256-byte region [ffff8880013cca00, ffff8880013ccb00) [ 1963.195298] The buggy address belongs to the physical page: [ 1963.195781] page:00000000317d3b98 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13cc [ 1963.196575] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.197177] raw: 000fffffc0000200 ffffea0000094480 dead000000000002 ffff888100041b40 [ 1963.197843] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.198518] page dumped because: kasan: bad access detected [ 1963.199165] Memory state around the buggy address: [ 1963.199589] ffff8880013cc980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.200224] ffff8880013cca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.200850] >ffff8880013cca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc [ 1963.201482] ^ [ 1963.202082] ffff8880013ccb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.202714] ffff8880013ccb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.203349] ================================================================== [ 1963.204033] ok 10 - krealloc_more_oob [ 1963.205868] ================================================================== [ 1963.206903] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.207699] Write of size 1 at addr ffff8880013ccec9 by task kunit_try_catch/47842 [ 1963.208549] CPU: 0 PID: 47842 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.209732] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.210252] Call Trace: [ 1963.210484] [ 1963.210690] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.211236] dump_stack_lvl+0x57/0x81 [ 1963.211577] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.212099] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.212634] print_report.cold+0x5c/0x237 [ 1963.213012] kasan_report+0xc9/0x100 [ 1963.213344] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.213882] krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.214413] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.214868] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.215302] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.215728] ? lock_acquire+0x4ea/0x620 [ 1963.216084] ? rcu_read_unlock+0x40/0x40 [ 1963.216442] ? rcu_read_unlock+0x40/0x40 [ 1963.216798] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.217232] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.217727] ? do_raw_spin_lock+0x270/0x270 [ 1963.218114] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.218657] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.219109] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.219565] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.220012] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.220466] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.221015] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.221475] kthread+0x2a7/0x350 [ 1963.221776] ? kthread_complete_and_exit+0x20/0x20 [ 1963.222214] ret_from_fork+0x22/0x30 [ 1963.222570] [ 1963.222968] Allocated by task 47842: [ 1963.223295] kasan_save_stack+0x1e/0x40 [ 1963.223684] __kasan_krealloc+0xee/0x160 [ 1963.224086] krealloc+0x50/0xe0 [ 1963.224380] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 1963.224900] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.225344] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.225882] kthread+0x2a7/0x350 [ 1963.226190] ret_from_fork+0x22/0x30 [ 1963.226675] The buggy address belongs to the object at ffff8880013cce00 which belongs to the cache kmalloc-256 of size 256 [ 1963.227741] The buggy address is located 201 bytes inside of 256-byte region [ffff8880013cce00, ffff8880013ccf00) [ 1963.228905] The buggy address belongs to the physical page: [ 1963.229399] page:00000000317d3b98 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13cc [ 1963.230200] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.230797] raw: 000fffffc0000200 ffffea0000094480 dead000000000002 ffff888100041b40 [ 1963.231474] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.232151] page dumped because: kasan: bad access detected [ 1963.232791] Memory state around the buggy address: [ 1963.233223] ffff8880013ccd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.233853] ffff8880013cce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.234486] >ffff8880013cce80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 1963.235121] ^ [ 1963.235604] ffff8880013ccf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.236236] ffff8880013ccf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.236861] ================================================================== [ 1963.237574] ================================================================== [ 1963.238224] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.238988] Write of size 1 at addr ffff8880013cced0 by task kunit_try_catch/47842 [ 1963.239846] CPU: 0 PID: 47842 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.241113] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.241620] Call Trace: [ 1963.241850] [ 1963.242063] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.242595] dump_stack_lvl+0x57/0x81 [ 1963.242935] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.243450] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.243986] print_report.cold+0x5c/0x237 [ 1963.244349] kasan_report+0xc9/0x100 [ 1963.244676] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.245217] krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.245734] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.246180] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.246604] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.247035] ? lock_acquire+0x4ea/0x620 [ 1963.247382] ? rcu_read_unlock+0x40/0x40 [ 1963.247738] ? rcu_read_unlock+0x40/0x40 [ 1963.248115] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.248564] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.249060] ? do_raw_spin_lock+0x270/0x270 [ 1963.249436] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.249981] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.250424] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.250878] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.251325] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.251775] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.252319] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.252776] kthread+0x2a7/0x350 [ 1963.253084] ? kthread_complete_and_exit+0x20/0x20 [ 1963.253512] ret_from_fork+0x22/0x30 [ 1963.253845] [ 1963.254216] Allocated by task 47842: [ 1963.254538] kasan_save_stack+0x1e/0x40 [ 1963.254885] __kasan_krealloc+0xee/0x160 [ 1963.255244] krealloc+0x50/0xe0 [ 1963.255536] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 1963.256062] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.256498] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.257044] kthread+0x2a7/0x350 [ 1963.257342] ret_from_fork+0x22/0x30 [ 1963.257823] The buggy address belongs to the object at ffff8880013cce00 which belongs to the cache kmalloc-256 of size 256 [ 1963.258881] The buggy address is located 208 bytes inside of 256-byte region [ffff8880013cce00, ffff8880013ccf00) [ 1963.260068] The buggy address belongs to the physical page: [ 1963.260575] page:00000000317d3b98 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13cc [ 1963.261368] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.261974] raw: 000fffffc0000200 ffffea0000094480 dead000000000002 ffff888100041b40 [ 1963.262643] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.263341] page dumped because: kasan: bad access detected [ 1963.264001] Memory state around the buggy address: [ 1963.264425] ffff8880013ccd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.265056] ffff8880013cce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.265682] >ffff8880013cce80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 1963.266313] ^ [ 1963.266828] ffff8880013ccf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.267464] ffff8880013ccf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.268097] ================================================================== [ 1963.268737] ================================================================== [ 1963.269377] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.270144] Write of size 1 at addr ffff8880013cceda by task kunit_try_catch/47842 [ 1963.270962] CPU: 0 PID: 47842 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.272127] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.272631] Call Trace: [ 1963.272860] [ 1963.273073] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.273626] dump_stack_lvl+0x57/0x81 [ 1963.273987] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.274519] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.275083] print_report.cold+0x5c/0x237 [ 1963.275448] kasan_report+0xc9/0x100 [ 1963.275779] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.276375] krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.276921] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.277435] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.277885] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.278315] ? lock_acquire+0x4ea/0x620 [ 1963.278662] ? rcu_read_unlock+0x40/0x40 [ 1963.279022] ? rcu_read_unlock+0x40/0x40 [ 1963.279379] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.279846] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.280363] ? do_raw_spin_lock+0x270/0x270 [ 1963.280754] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.281366] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.281854] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.282336] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.282794] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.283273] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.283876] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.284364] kthread+0x2a7/0x350 [ 1963.284707] ? kthread_complete_and_exit+0x20/0x20 [ 1963.285165] ret_from_fork+0x22/0x30 [ 1963.285496] [ 1963.285862] Allocated by task 47842: [ 1963.286193] kasan_save_stack+0x1e/0x40 [ 1963.286540] __kasan_krealloc+0xee/0x160 [ 1963.286892] krealloc+0x50/0xe0 [ 1963.287190] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 1963.287773] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.288231] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.288771] kthread+0x2a7/0x350 [ 1963.289076] ret_from_fork+0x22/0x30 [ 1963.289559] The buggy address belongs to the object at ffff8880013cce00 which belongs to the cache kmalloc-256 of size 256 [ 1963.290647] The buggy address is located 218 bytes inside of 256-byte region [ffff8880013cce00, ffff8880013ccf00) [ 1963.291912] The buggy address belongs to the physical page: [ 1963.292446] page:00000000317d3b98 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13cc [ 1963.293242] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.293841] raw: 000fffffc0000200 ffffea0000094480 dead000000000002 ffff888100041b40 [ 1963.294534] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.295232] page dumped because: kasan: bad access detected [ 1963.295872] Memory state around the buggy address: [ 1963.296326] ffff8880013ccd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.296981] ffff8880013cce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.297610] >ffff8880013cce80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 1963.298241] ^ [ 1963.298776] ffff8880013ccf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.299410] ffff8880013ccf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.300042] ================================================================== [ 1963.300681] ================================================================== [ 1963.301517] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.302399] Write of size 1 at addr ffff8880013cceea by task kunit_try_catch/47842 [ 1963.303368] CPU: 0 PID: 47842 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.304749] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.305263] Call Trace: [ 1963.305494] [ 1963.305698] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.306237] dump_stack_lvl+0x57/0x81 [ 1963.306572] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.307090] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.307621] print_report.cold+0x5c/0x237 [ 1963.307991] kasan_report+0xc9/0x100 [ 1963.308321] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.308854] krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.309380] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.309847] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.310394] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.310946] ? lock_acquire+0x4ea/0x620 [ 1963.311371] ? rcu_read_unlock+0x40/0x40 [ 1963.311852] ? rcu_read_unlock+0x40/0x40 [ 1963.312276] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.312789] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.313382] ? do_raw_spin_lock+0x270/0x270 [ 1963.313794] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.314342] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.314783] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.315244] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.315682] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.316139] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.316679] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.317165] kthread+0x2a7/0x350 [ 1963.317484] ? kthread_complete_and_exit+0x20/0x20 [ 1963.317941] ret_from_fork+0x22/0x30 [ 1963.318291] [ 1963.318656] Allocated by task 47842: [ 1963.319061] kasan_save_stack+0x1e/0x40 [ 1963.319448] __kasan_krealloc+0xee/0x160 [ 1963.319799] krealloc+0x50/0xe0 [ 1963.320099] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 1963.320615] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.321055] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.321593] kthread+0x2a7/0x350 [ 1963.321895] ret_from_fork+0x22/0x30 [ 1963.322385] The buggy address belongs to the object at ffff8880013cce00 which belongs to the cache kmalloc-256 of size 256 [ 1963.323450] The buggy address is located 234 bytes inside of 256-byte region [ffff8880013cce00, ffff8880013ccf00) [ 1963.324614] The buggy address belongs to the physical page: [ 1963.325108] page:00000000317d3b98 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13cc [ 1963.325897] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.326500] raw: 000fffffc0000200 ffffea0000094480 dead000000000002 ffff888100041b40 [ 1963.327177] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.327845] page dumped because: kasan: bad access detected [ 1963.328492] Memory state around the buggy address: [ 1963.328916] ffff8880013ccd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.329548] ffff8880013cce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.330181] >ffff8880013cce80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 1963.330805] ^ [ 1963.331384] ffff8880013ccf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.332021] ffff8880013ccf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.332648] ================================================================== [ 1963.333303] ================================================================== [ 1963.333950] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.334705] Write of size 1 at addr ffff8880013cceeb by task kunit_try_catch/47842 [ 1963.335523] CPU: 0 PID: 47842 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.336729] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.337240] Call Trace: [ 1963.337470] [ 1963.337674] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.338212] dump_stack_lvl+0x57/0x81 [ 1963.338547] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.339063] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.339597] print_report.cold+0x5c/0x237 [ 1963.339964] kasan_report+0xc9/0x100 [ 1963.340295] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.340826] krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.341353] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.341796] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.342225] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.342648] ? lock_acquire+0x4ea/0x620 [ 1963.343002] ? rcu_read_unlock+0x40/0x40 [ 1963.343399] ? rcu_read_unlock+0x40/0x40 [ 1963.343753] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.344226] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.344783] ? do_raw_spin_lock+0x270/0x270 [ 1963.345164] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.345703] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.346150] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.346606] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.347053] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.347503] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.348046] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.348504] kthread+0x2a7/0x350 [ 1963.348803] ? kthread_complete_and_exit+0x20/0x20 [ 1963.349236] ret_from_fork+0x22/0x30 [ 1963.349570] [ 1963.349940] Allocated by task 47842: [ 1963.350264] kasan_save_stack+0x1e/0x40 [ 1963.350611] __kasan_krealloc+0xee/0x160 [ 1963.350975] krealloc+0x50/0xe0 [ 1963.351269] krealloc_less_oob_helper+0x1d9/0xa20 [test_kasan] [ 1963.351785] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.352249] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.352807] kthread+0x2a7/0x350 [ 1963.353114] ret_from_fork+0x22/0x30 [ 1963.353597] The buggy address belongs to the object at ffff8880013cce00 which belongs to the cache kmalloc-256 of size 256 [ 1963.354661] The buggy address is located 235 bytes inside of 256-byte region [ffff8880013cce00, ffff8880013ccf00) [ 1963.355864] The buggy address belongs to the physical page: [ 1963.356354] page:00000000317d3b98 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13cc [ 1963.357148] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.357744] raw: 000fffffc0000200 ffffea0000094480 dead000000000002 ffff888100041b40 [ 1963.358419] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.359094] page dumped because: kasan: bad access detected [ 1963.359734] Memory state around the buggy address: [ 1963.360163] ffff8880013ccd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.360791] ffff8880013cce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.361426] >ffff8880013cce80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 1963.362060] ^ [ 1963.362634] ffff8880013ccf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.363267] ffff8880013ccf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.363894] ================================================================== [ 1963.364714] ok 11 - krealloc_less_oob [ 1963.366870] ================================================================== [ 1963.367899] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.368669] Write of size 1 at addr ffff8880059ae0eb by task kunit_try_catch/47843 [ 1963.369494] CPU: 0 PID: 47843 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.370671] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.371190] Call Trace: [ 1963.371423] [ 1963.371629] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.372181] dump_stack_lvl+0x57/0x81 [ 1963.372525] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.373059] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.373603] print_report.cold+0x5c/0x237 [ 1963.374003] kasan_report+0xc9/0x100 [ 1963.374354] ? krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.374918] krealloc_more_oob_helper+0x5c3/0x610 [test_kasan] [ 1963.375475] ? krealloc_less_oob+0x10/0x10 [test_kasan] [ 1963.375950] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.376375] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.376825] ? lock_acquire+0x4ea/0x620 [ 1963.377202] ? rcu_read_unlock+0x40/0x40 [ 1963.377577] ? rcu_read_unlock+0x40/0x40 [ 1963.377953] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.378399] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.378899] ? do_raw_spin_lock+0x270/0x270 [ 1963.379284] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.379855] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.380336] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.380820] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.381311] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.381793] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.382365] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.382828] kthread+0x2a7/0x350 [ 1963.383136] ? kthread_complete_and_exit+0x20/0x20 [ 1963.383567] ret_from_fork+0x22/0x30 [ 1963.383933] [ 1963.384320] The buggy address belongs to the physical page: [ 1963.384830] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.385655] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.386315] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.386918] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.387595] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.388316] page dumped because: kasan: bad access detected [ 1963.388968] Memory state around the buggy address: [ 1963.389396] ffff8880059adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.390033] ffff8880059ae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.390666] >ffff8880059ae080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fe fe [ 1963.391344] ^ [ 1963.391970] ffff8880059ae100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.392601] ffff8880059ae180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.393238] ================================================================== [ 1963.393917] ================================================================== [ 1963.394564] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.395375] Write of size 1 at addr ffff8880059ae0f0 by task kunit_try_catch/47843 [ 1963.396197] CPU: 0 PID: 47843 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.397365] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.397871] Call Trace: [ 1963.398108] [ 1963.398313] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.398847] dump_stack_lvl+0x57/0x81 [ 1963.399191] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.399703] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.400244] print_report.cold+0x5c/0x237 [ 1963.400608] kasan_report+0xc9/0x100 [ 1963.400943] ? krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.401478] krealloc_more_oob_helper+0x5b6/0x610 [test_kasan] [ 1963.402008] ? krealloc_less_oob+0x10/0x10 [test_kasan] [ 1963.402472] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.402897] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.403327] ? lock_acquire+0x4ea/0x620 [ 1963.403677] ? rcu_read_unlock+0x40/0x40 [ 1963.404039] ? rcu_read_unlock+0x40/0x40 [ 1963.404395] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.404820] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.405321] ? do_raw_spin_lock+0x270/0x270 [ 1963.405698] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.406249] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.406692] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.407154] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.407615] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.408096] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.408637] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.409102] kthread+0x2a7/0x350 [ 1963.409403] ? kthread_complete_and_exit+0x20/0x20 [ 1963.409833] ret_from_fork+0x22/0x30 [ 1963.410173] [ 1963.410538] The buggy address belongs to the physical page: [ 1963.411029] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.411822] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.412523] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.413127] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.413838] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.414513] page dumped because: kasan: bad access detected [ 1963.415160] Memory state around the buggy address: [ 1963.415609] ffff8880059adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.416269] ffff8880059ae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.416895] >ffff8880059ae080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fe fe [ 1963.417533] ^ [ 1963.418135] ffff8880059ae100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.418762] ffff8880059ae180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.419396] ================================================================== [ 1963.420066] ok 12 - krealloc_pagealloc_more_oob [ 1963.421850] ================================================================== [ 1963.422970] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.423779] Write of size 1 at addr ffff8880059ae0c9 by task kunit_try_catch/47844 [ 1963.424690] CPU: 0 PID: 47844 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.425867] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.426388] Call Trace: [ 1963.426619] [ 1963.426826] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.427368] dump_stack_lvl+0x57/0x81 [ 1963.427705] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.428227] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.428760] print_report.cold+0x5c/0x237 [ 1963.429131] kasan_report+0xc9/0x100 [ 1963.429463] ? krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.430007] krealloc_less_oob_helper+0x9f1/0xa20 [test_kasan] [ 1963.430529] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.430984] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.431408] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.431832] ? lock_acquire+0x4ea/0x620 [ 1963.432189] ? rcu_read_unlock+0x40/0x40 [ 1963.432547] ? rcu_read_unlock+0x40/0x40 [ 1963.432904] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.433337] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.433831] ? do_raw_spin_lock+0x270/0x270 [ 1963.434221] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.434766] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.435219] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.435674] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.436123] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.436580] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.437130] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.437589] kthread+0x2a7/0x350 [ 1963.437891] ? kthread_complete_and_exit+0x20/0x20 [ 1963.438328] ret_from_fork+0x22/0x30 [ 1963.438663] [ 1963.439035] The buggy address belongs to the physical page: [ 1963.439522] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.440327] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.440987] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.441589] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.442267] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.442944] page dumped because: kasan: bad access detected [ 1963.443589] Memory state around the buggy address: [ 1963.444027] ffff8880059adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.444658] ffff8880059ae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.445297] >ffff8880059ae080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 1963.445933] ^ [ 1963.446423] ffff8880059ae100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.447080] ffff8880059ae180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.447734] ================================================================== [ 1963.448514] ================================================================== [ 1963.449163] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.449920] Write of size 1 at addr ffff8880059ae0d0 by task kunit_try_catch/47844 [ 1963.450742] CPU: 0 PID: 47844 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.451922] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.452437] Call Trace: [ 1963.452670] [ 1963.452874] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.453410] dump_stack_lvl+0x57/0x81 [ 1963.453745] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.454262] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.454793] print_report.cold+0x5c/0x237 [ 1963.455161] kasan_report+0xc9/0x100 [ 1963.455491] ? krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.456029] krealloc_less_oob_helper+0x9e0/0xa20 [test_kasan] [ 1963.456547] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.456999] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.457421] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.457845] ? lock_acquire+0x4ea/0x620 [ 1963.458199] ? rcu_read_unlock+0x40/0x40 [ 1963.458578] ? rcu_read_unlock+0x40/0x40 [ 1963.458954] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.459377] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.459868] ? do_raw_spin_lock+0x270/0x270 [ 1963.460250] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.460789] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.461235] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.461702] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.462157] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.462608] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.463151] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.463608] kthread+0x2a7/0x350 [ 1963.463907] ? kthread_complete_and_exit+0x20/0x20 [ 1963.464340] ret_from_fork+0x22/0x30 [ 1963.464672] [ 1963.465046] The buggy address belongs to the physical page: [ 1963.465533] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.466331] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.466984] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.467578] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.468253] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.468917] page dumped because: kasan: bad access detected [ 1963.469561] Memory state around the buggy address: [ 1963.469990] ffff8880059adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.470617] ffff8880059ae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.471254] >ffff8880059ae080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 1963.471880] ^ [ 1963.472396] ffff8880059ae100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.473029] ffff8880059ae180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.473652] ================================================================== [ 1963.474347] ================================================================== [ 1963.475012] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.475796] Write of size 1 at addr ffff8880059ae0da by task kunit_try_catch/47844 [ 1963.476618] CPU: 0 PID: 47844 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.477848] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.478391] Call Trace: [ 1963.478620] [ 1963.478824] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.479369] dump_stack_lvl+0x57/0x81 [ 1963.479731] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.480311] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.480862] print_report.cold+0x5c/0x237 [ 1963.481243] kasan_report+0xc9/0x100 [ 1963.481587] ? krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.482156] krealloc_less_oob_helper+0x9cf/0xa20 [test_kasan] [ 1963.482693] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.483140] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.483562] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.484013] ? lock_acquire+0x4ea/0x620 [ 1963.484385] ? rcu_read_unlock+0x40/0x40 [ 1963.484740] ? rcu_read_unlock+0x40/0x40 [ 1963.485126] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.485573] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.486074] ? do_raw_spin_lock+0x270/0x270 [ 1963.486451] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.487000] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.487445] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.487918] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.488392] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.488844] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.489389] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.489848] kthread+0x2a7/0x350 [ 1963.490157] ? kthread_complete_and_exit+0x20/0x20 [ 1963.490588] ret_from_fork+0x22/0x30 [ 1963.490923] [ 1963.491338] The buggy address belongs to the physical page: [ 1963.491823] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.492661] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.493315] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.493910] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.494581] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.495280] page dumped because: kasan: bad access detected [ 1963.495937] Memory state around the buggy address: [ 1963.496363] ffff8880059adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.496999] ffff8880059ae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.497626] >ffff8880059ae080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 1963.498257] ^ [ 1963.498788] ffff8880059ae100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.499420] ffff8880059ae180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.500053] ================================================================== [ 1963.500689] ================================================================== [ 1963.501473] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.502375] Write of size 1 at addr ffff8880059ae0ea by task kunit_try_catch/47844 [ 1963.503364] CPU: 0 PID: 47844 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.504719] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.505235] Call Trace: [ 1963.505466] [ 1963.505670] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.506209] dump_stack_lvl+0x57/0x81 [ 1963.506542] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.507060] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.507589] print_report.cold+0x5c/0x237 [ 1963.507957] kasan_report+0xc9/0x100 [ 1963.508287] ? krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.508819] krealloc_less_oob_helper+0x9c2/0xa20 [test_kasan] [ 1963.509344] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.509786] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.510216] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.510636] ? lock_acquire+0x4ea/0x620 [ 1963.510987] ? rcu_read_unlock+0x40/0x40 [ 1963.511343] ? rcu_read_unlock+0x40/0x40 [ 1963.511697] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.512146] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.512662] ? do_raw_spin_lock+0x270/0x270 [ 1963.513048] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.513587] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.514034] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.514485] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.514930] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.515382] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.515920] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.516383] kthread+0x2a7/0x350 [ 1963.516682] ? kthread_complete_and_exit+0x20/0x20 [ 1963.517118] ret_from_fork+0x22/0x30 [ 1963.517449] [ 1963.517814] The buggy address belongs to the physical page: [ 1963.518324] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.519138] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.519957] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.520551] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.521223] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.521890] page dumped because: kasan: bad access detected [ 1963.522535] Memory state around the buggy address: [ 1963.522967] ffff8880059adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.523594] ffff8880059ae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.524228] >ffff8880059ae080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 1963.524854] ^ [ 1963.525434] ffff8880059ae100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.526065] ffff8880059ae180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.526690] ================================================================== [ 1963.527396] ================================================================== [ 1963.528043] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.528795] Write of size 1 at addr ffff8880059ae0eb by task kunit_try_catch/47844 [ 1963.529613] CPU: 0 PID: 47844 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.530777] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.531315] Call Trace: [ 1963.531562] [ 1963.531766] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.532326] dump_stack_lvl+0x57/0x81 [ 1963.532679] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.533215] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.533768] print_report.cold+0x5c/0x237 [ 1963.534154] kasan_report+0xc9/0x100 [ 1963.534506] ? krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.535042] krealloc_less_oob_helper+0x9b5/0xa20 [test_kasan] [ 1963.535560] ? krealloc_uaf+0x450/0x450 [test_kasan] [ 1963.536012] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.536442] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.536864] ? lock_acquire+0x4ea/0x620 [ 1963.537215] ? rcu_read_unlock+0x40/0x40 [ 1963.537570] ? rcu_read_unlock+0x40/0x40 [ 1963.537921] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.538350] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.538840] ? do_raw_spin_lock+0x270/0x270 [ 1963.539220] ? kunit_binary_str_assert_format+0x3e0/0x3e0 [kunit] [ 1963.539758] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.540208] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.540660] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.541101] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.541551] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.542093] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.542546] kthread+0x2a7/0x350 [ 1963.542844] ? kthread_complete_and_exit+0x20/0x20 [ 1963.543301] ret_from_fork+0x22/0x30 [ 1963.543649] [ 1963.544019] The buggy address belongs to the physical page: [ 1963.544501] page:00000000bd858cff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59ac [ 1963.545297] head:00000000bd858cff order:2 compound_mapcount:0 compound_pincount:0 [ 1963.545944] flags: 0xfffffc0010000(head|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.546547] raw: 000fffffc0010000 0000000000000000 dead000000000122 0000000000000000 [ 1963.547219] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1963.547884] page dumped because: kasan: bad access detected [ 1963.548529] Memory state around the buggy address: [ 1963.548956] ffff8880059adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.549582] ffff8880059ae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.550214] >ffff8880059ae080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe [ 1963.550838] ^ [ 1963.551457] ffff8880059ae100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.552125] ffff8880059ae180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 1963.552800] ================================================================== [ 1963.553473] ok 13 - krealloc_pagealloc_less_oob [ 1963.554847] ================================================================== [ 1963.555974] BUG: KASAN: use-after-free in krealloc_uaf+0x1c7/0x450 [test_kasan] [ 1963.556618] Read of size 1 at addr ffff888002bc4c00 by task kunit_try_catch/47846 [ 1963.557429] CPU: 0 PID: 47846 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.558595] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.559108] Call Trace: [ 1963.559336] [ 1963.559540] ? krealloc_uaf+0x1c7/0x450 [test_kasan] [ 1963.559991] dump_stack_lvl+0x57/0x81 [ 1963.560328] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.560838] ? krealloc_uaf+0x1c7/0x450 [test_kasan] [ 1963.561290] print_report.cold+0x5c/0x237 [ 1963.561652] kasan_report+0xc9/0x100 [ 1963.561988] ? krealloc_uaf+0x1c7/0x450 [test_kasan] [ 1963.562430] ? krealloc_uaf+0x1c7/0x450 [test_kasan] [ 1963.562872] __kasan_check_byte+0x36/0x50 [ 1963.563240] krealloc+0x2e/0xe0 [ 1963.563535] krealloc_uaf+0x1c7/0x450 [test_kasan] [ 1963.563971] ? kmalloc_memmove_negative_size+0x290/0x290 [test_kasan] [ 1963.564533] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.564961] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.565381] ? lock_acquire+0x4ea/0x620 [ 1963.565729] ? rcu_read_unlock+0x40/0x40 [ 1963.566088] ? rcu_read_unlock+0x40/0x40 [ 1963.566440] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.566862] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.567360] ? do_raw_spin_lock+0x270/0x270 [ 1963.567737] ? trace_hardirqs_on+0x2d/0x160 [ 1963.568119] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.568560] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.569020] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.569456] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.569906] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.570448] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.570905] kthread+0x2a7/0x350 [ 1963.571207] ? kthread_complete_and_exit+0x20/0x20 [ 1963.571635] ret_from_fork+0x22/0x30 [ 1963.571976] [ 1963.572340] Allocated by task 47846: [ 1963.572663] kasan_save_stack+0x1e/0x40 [ 1963.573011] __kasan_kmalloc+0x81/0xa0 [ 1963.573349] krealloc_uaf+0xaa/0x450 [test_kasan] [ 1963.573771] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.574231] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.574790] kthread+0x2a7/0x350 [ 1963.575094] ret_from_fork+0x22/0x30 [ 1963.575622] Freed by task 47846: [ 1963.575920] kasan_save_stack+0x1e/0x40 [ 1963.576273] kasan_set_track+0x21/0x30 [ 1963.576611] kasan_set_free_info+0x20/0x40 [ 1963.576984] __kasan_slab_free+0x108/0x170 [ 1963.577376] slab_free_freelist_hook+0x11d/0x1d0 [ 1963.577805] kfree+0xe2/0x3c0 [ 1963.578112] krealloc_uaf+0x147/0x450 [test_kasan] [ 1963.578570] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.579012] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.579545] kthread+0x2a7/0x350 [ 1963.579843] ret_from_fork+0x22/0x30 [ 1963.580354] The buggy address belongs to the object at ffff888002bc4c00 which belongs to the cache kmalloc-256 of size 256 [ 1963.581466] The buggy address is located 0 bytes inside of 256-byte region [ffff888002bc4c00, ffff888002bc4d00) [ 1963.582676] The buggy address belongs to the physical page: [ 1963.583167] page:00000000460feabb refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bc4 [ 1963.583960] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.584598] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff888100041b40 [ 1963.585292] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.585986] page dumped because: kasan: bad access detected [ 1963.586644] Memory state around the buggy address: [ 1963.587096] ffff888002bc4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.587744] ffff888002bc4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.588441] >ffff888002bc4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.589112] ^ [ 1963.589409] ffff888002bc4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.590080] ffff888002bc4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.590705] ================================================================== [ 1963.591393] ================================================================== [ 1963.592055] BUG: KASAN: use-after-free in krealloc_uaf+0x42e/0x450 [test_kasan] [ 1963.592736] Read of size 1 at addr ffff888002bc4c00 by task kunit_try_catch/47846 [ 1963.593544] CPU: 0 PID: 47846 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.594712] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.595240] Call Trace: [ 1963.595480] [ 1963.595701] ? krealloc_uaf+0x42e/0x450 [test_kasan] [ 1963.596159] dump_stack_lvl+0x57/0x81 [ 1963.596497] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.597015] ? krealloc_uaf+0x42e/0x450 [test_kasan] [ 1963.597459] print_report.cold+0x5c/0x237 [ 1963.597819] kasan_report+0xc9/0x100 [ 1963.598156] ? krealloc_uaf+0x42e/0x450 [test_kasan] [ 1963.598599] krealloc_uaf+0x42e/0x450 [test_kasan] [ 1963.599038] ? kmalloc_memmove_negative_size+0x290/0x290 [test_kasan] [ 1963.599598] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.600023] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.600445] ? lock_acquire+0x4ea/0x620 [ 1963.600792] ? rcu_read_unlock+0x40/0x40 [ 1963.601152] ? rcu_read_unlock+0x40/0x40 [ 1963.601505] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.601932] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.602421] ? do_raw_spin_lock+0x270/0x270 [ 1963.602796] ? kunit_ptr_not_err_assert_format+0x210/0x210 [kunit] [ 1963.603350] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.603790] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.604248] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.604685] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.605141] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.605676] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.606138] kthread+0x2a7/0x350 [ 1963.606437] ? kthread_complete_and_exit+0x20/0x20 [ 1963.606864] ret_from_fork+0x22/0x30 [ 1963.607207] [ 1963.607572] Allocated by task 47846: [ 1963.607895] kasan_save_stack+0x1e/0x40 [ 1963.608249] __kasan_kmalloc+0x81/0xa0 [ 1963.608588] krealloc_uaf+0xaa/0x450 [test_kasan] [ 1963.609014] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.609449] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.609990] kthread+0x2a7/0x350 [ 1963.610289] ret_from_fork+0x22/0x30 [ 1963.610772] Freed by task 47846: [ 1963.611077] kasan_save_stack+0x1e/0x40 [ 1963.611424] kasan_set_track+0x21/0x30 [ 1963.611771] kasan_set_free_info+0x20/0x40 [ 1963.612133] __kasan_slab_free+0x108/0x170 [ 1963.612485] slab_free_freelist_hook+0x11d/0x1d0 [ 1963.612887] kfree+0xe2/0x3c0 [ 1963.613186] krealloc_uaf+0x147/0x450 [test_kasan] [ 1963.613613] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.614053] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.614587] kthread+0x2a7/0x350 [ 1963.614884] ret_from_fork+0x22/0x30 [ 1963.615372] The buggy address belongs to the object at ffff888002bc4c00 which belongs to the cache kmalloc-256 of size 256 [ 1963.616478] The buggy address is located 0 bytes inside of 256-byte region [ffff888002bc4c00, ffff888002bc4d00) [ 1963.617621] The buggy address belongs to the physical page: [ 1963.618109] page:00000000460feabb refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bc4 [ 1963.618897] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.619497] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff888100041b40 [ 1963.620173] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1963.620840] page dumped because: kasan: bad access detected [ 1963.621489] Memory state around the buggy address: [ 1963.622076] ffff888002bc4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.622736] ffff888002bc4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.623368] >ffff888002bc4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.624084] ^ [ 1963.624381] ffff888002bc4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.625098] ffff888002bc4d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.625724] ================================================================== [ 1963.626432] ok 14 - krealloc_uaf [ 1963.627851] ================================================================== [ 1963.628850] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 1963.629544] Write of size 16 at addr ffff888014e90460 by task kunit_try_catch/47847 [ 1963.630374] CPU: 0 PID: 47847 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.631552] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.632069] Call Trace: [ 1963.632300] [ 1963.632505] ? kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 1963.632976] dump_stack_lvl+0x57/0x81 [ 1963.633313] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.633828] ? kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 1963.634296] print_report.cold+0x5c/0x237 [ 1963.634664] kasan_report+0xc9/0x100 [ 1963.635002] ? kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 1963.635463] kmalloc_oob_16+0x399/0x3b0 [test_kasan] [ 1963.635911] ? kmalloc_uaf_16+0x3b0/0x3b0 [test_kasan] [ 1963.636374] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.636773] ? do_raw_spin_lock+0x270/0x270 [ 1963.637158] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.637656] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.638107] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.638565] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.639011] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.639465] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.640012] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.640473] kthread+0x2a7/0x350 [ 1963.640776] ? kthread_complete_and_exit+0x20/0x20 [ 1963.641218] ret_from_fork+0x22/0x30 [ 1963.641553] [ 1963.641922] Allocated by task 47847: [ 1963.642255] kasan_save_stack+0x1e/0x40 [ 1963.642604] __kasan_kmalloc+0x81/0xa0 [ 1963.642951] kmalloc_oob_16+0xa4/0x3b0 [test_kasan] [ 1963.643390] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.643830] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.644376] kthread+0x2a7/0x350 [ 1963.644677] ret_from_fork+0x22/0x30 [ 1963.645168] The buggy address belongs to the object at ffff888014e90460 which belongs to the cache kmalloc-16 of size 16 [ 1963.646232] The buggy address is located 0 bytes inside of 16-byte region [ffff888014e90460, ffff888014e90470) [ 1963.647384] The buggy address belongs to the physical page: [ 1963.647875] page:000000009a8c594a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14e90 [ 1963.648684] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.649289] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1963.649971] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1963.650644] page dumped because: kasan: bad access detected [ 1963.651295] Memory state around the buggy address: [ 1963.651722] ffff888014e90300: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1963.652357] ffff888014e90380: 00 00 fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1963.652994] >ffff888014e90400: 00 00 fc fc fa fb fc fc fa fb fc fc 00 05 fc fc [ 1963.653623] ^ [ 1963.654209] ffff888014e90480: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1963.654838] ffff888014e90500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1963.655516] ================================================================== [ 1963.656225] ok 15 - kmalloc_oob_16 [ 1963.657849] ================================================================== [ 1963.658874] BUG: KASAN: use-after-free in kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 1963.659546] Read of size 16 at addr ffff888014d6fea0 by task kunit_try_catch/47848 [ 1963.660373] CPU: 0 PID: 47848 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.661553] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.662070] Call Trace: [ 1963.662302] [ 1963.662508] ? kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 1963.662975] dump_stack_lvl+0x57/0x81 [ 1963.663314] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.663828] ? kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 1963.664322] print_report.cold+0x5c/0x237 [ 1963.664708] kasan_report+0xc9/0x100 [ 1963.665048] ? kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 1963.665507] kmalloc_uaf_16+0x38a/0x3b0 [test_kasan] [ 1963.665959] ? kmalloc_uaf+0x2b0/0x2b0 [test_kasan] [ 1963.666399] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.666796] ? do_raw_spin_lock+0x270/0x270 [ 1963.667185] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.667679] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.668130] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.668586] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.669034] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.669487] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.670033] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.670490] kthread+0x2a7/0x350 [ 1963.670791] ? kthread_complete_and_exit+0x20/0x20 [ 1963.671226] ret_from_fork+0x22/0x30 [ 1963.671561] [ 1963.671931] Allocated by task 47848: [ 1963.672256] kasan_save_stack+0x1e/0x40 [ 1963.672604] __kasan_kmalloc+0x81/0xa0 [ 1963.672950] kmalloc_uaf_16+0x15d/0x3b0 [test_kasan] [ 1963.673393] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.673831] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.674375] kthread+0x2a7/0x350 [ 1963.674700] ret_from_fork+0x22/0x30 [ 1963.675206] Freed by task 47848: [ 1963.675526] kasan_save_stack+0x1e/0x40 [ 1963.675900] kasan_set_track+0x21/0x30 [ 1963.676247] kasan_set_free_info+0x20/0x40 [ 1963.676615] __kasan_slab_free+0x108/0x170 [ 1963.676990] slab_free_freelist_hook+0x11d/0x1d0 [ 1963.677427] kfree+0xe2/0x3c0 [ 1963.677729] kmalloc_uaf_16+0x1e8/0x3b0 [test_kasan] [ 1963.678180] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.678647] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.679208] kthread+0x2a7/0x350 [ 1963.679507] ret_from_fork+0x22/0x30 [ 1963.679995] The buggy address belongs to the object at ffff888014d6fea0 which belongs to the cache kmalloc-16 of size 16 [ 1963.681092] The buggy address is located 0 bytes inside of 16-byte region [ffff888014d6fea0, ffff888014d6feb0) [ 1963.682298] The buggy address belongs to the physical page: [ 1963.682811] page:0000000052e331e7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d6f [ 1963.683618] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.684220] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 1963.684933] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1963.685627] page dumped because: kasan: bad access detected [ 1963.686292] Memory state around the buggy address: [ 1963.686716] ffff888014d6fd80: fb fb fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc [ 1963.687348] ffff888014d6fe00: fb fb fc fc 00 00 fc fc fb fb fc fc 00 00 fc fc [ 1963.687981] >ffff888014d6fe80: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1963.688636] ^ [ 1963.689046] ffff888014d6ff00: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc [ 1963.689675] ffff888014d6ff80: fb fb fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc [ 1963.690307] ================================================================== [ 1963.691024] ok 16 - kmalloc_uaf_16 [ 1963.692989] ================================================================== [ 1963.694210] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 1963.695099] Write of size 128 at addr ffff888003cfcc00 by task kunit_try_catch/47849 [ 1963.696038] CPU: 0 PID: 47849 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.697209] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.697715] Call Trace: [ 1963.697950] [ 1963.698155] ? kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 1963.698677] dump_stack_lvl+0x57/0x81 [ 1963.699022] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.699540] ? kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 1963.700064] print_report.cold+0x5c/0x237 [ 1963.700431] kasan_report+0xc9/0x100 [ 1963.700764] ? kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 1963.701286] kasan_check_range+0xfd/0x1e0 [ 1963.701658] memset+0x20/0x50 [ 1963.701937] kmalloc_oob_in_memset+0x1b3/0x280 [test_kasan] [ 1963.702413] ? kmalloc_oob_memset_2+0x290/0x290 [test_kasan] [ 1963.702937] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.703359] ? do_raw_spin_lock+0x270/0x270 [ 1963.703754] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.704276] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.704740] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.705202] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.705640] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.706100] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.706637] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.707102] kthread+0x2a7/0x350 [ 1963.707402] ? kthread_complete_and_exit+0x20/0x20 [ 1963.707858] ret_from_fork+0x22/0x30 [ 1963.708208] [ 1963.708595] Allocated by task 47849: [ 1963.708920] kasan_save_stack+0x1e/0x40 [ 1963.709297] __kasan_kmalloc+0x81/0xa0 [ 1963.709657] kmalloc_oob_in_memset+0x9c/0x280 [test_kasan] [ 1963.710164] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.710784] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.711369] kthread+0x2a7/0x350 [ 1963.711692] ret_from_fork+0x22/0x30 [ 1963.712201] The buggy address belongs to the object at ffff888003cfcc00 which belongs to the cache kmalloc-128 of size 128 [ 1963.713312] The buggy address is located 0 bytes inside of 128-byte region [ffff888003cfcc00, ffff888003cfcc80) [ 1963.714505] The buggy address belongs to the physical page: [ 1963.714998] page:00000000b66b41ff refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3cfc [ 1963.715790] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.716395] raw: 000fffffc0000200 ffffea00007a3140 dead000000000002 ffff8881000418c0 [ 1963.717095] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1963.717784] page dumped because: kasan: bad access detected [ 1963.718430] Memory state around the buggy address: [ 1963.718874] ffff888003cfcb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.719530] ffff888003cfcb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.720277] >ffff888003cfcc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 1963.720906] ^ [ 1963.721538] ffff888003cfcc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.722171] ffff888003cfcd00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.722797] ================================================================== [ 1963.723690] ok 17 - kmalloc_oob_in_memset [ 1963.725843] ================================================================== [ 1963.726912] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 1963.727661] Write of size 2 at addr ffff88810ad62477 by task kunit_try_catch/47850 [ 1963.728492] CPU: 0 PID: 47850 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.729649] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.730183] Call Trace: [ 1963.730419] [ 1963.730627] ? kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 1963.731150] dump_stack_lvl+0x57/0x81 [ 1963.731492] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.732051] ? kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 1963.732581] print_report.cold+0x5c/0x237 [ 1963.732971] kasan_report+0xc9/0x100 [ 1963.733323] ? kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 1963.733829] kasan_check_range+0xfd/0x1e0 [ 1963.734223] memset+0x20/0x50 [ 1963.734521] kmalloc_oob_memset_2+0x1b6/0x290 [test_kasan] [ 1963.735037] ? kmalloc_oob_memset_4+0x290/0x290 [test_kasan] [ 1963.735566] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.735970] ? do_raw_spin_lock+0x270/0x270 [ 1963.736349] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.736844] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.737296] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.737750] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.738194] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.738645] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.739193] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.739652] kthread+0x2a7/0x350 [ 1963.739959] ? kthread_complete_and_exit+0x20/0x20 [ 1963.740386] ret_from_fork+0x22/0x30 [ 1963.740719] [ 1963.741090] Allocated by task 47850: [ 1963.741415] kasan_save_stack+0x1e/0x40 [ 1963.741761] __kasan_kmalloc+0x81/0xa0 [ 1963.742107] kmalloc_oob_memset_2+0x9c/0x290 [test_kasan] [ 1963.742581] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.743019] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.743556] kthread+0x2a7/0x350 [ 1963.743854] ret_from_fork+0x22/0x30 [ 1963.744342] The buggy address belongs to the object at ffff88810ad62400 which belongs to the cache kmalloc-128 of size 128 [ 1963.745406] The buggy address is located 119 bytes inside of 128-byte region [ffff88810ad62400, ffff88810ad62480) [ 1963.746564] The buggy address belongs to the physical page: [ 1963.747052] page:000000007159befd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ad62 [ 1963.747855] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1963.748466] raw: 0017ffffc0000200 dead000000000100 dead000000000122 ffff8881000418c0 [ 1963.749139] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1963.749806] page dumped because: kasan: bad access detected [ 1963.750454] Memory state around the buggy address: [ 1963.750881] ffff88810ad62300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.751517] ffff88810ad62380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.752171] >ffff88810ad62400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 1963.752819] ^ [ 1963.753448] ffff88810ad62480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.754080] ffff88810ad62500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.754710] ================================================================== [ 1963.755691] ok 18 - kmalloc_oob_memset_2 [ 1963.756867] ================================================================== [ 1963.757936] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 1963.758661] Write of size 4 at addr ffff88810ad62275 by task kunit_try_catch/47851 [ 1963.759531] CPU: 0 PID: 47851 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.760798] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.761314] Call Trace: [ 1963.761546] [ 1963.761750] ? kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 1963.762267] dump_stack_lvl+0x57/0x81 [ 1963.762604] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.763124] ? kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 1963.763630] print_report.cold+0x5c/0x237 [ 1963.764022] kasan_report+0xc9/0x100 [ 1963.764376] ? kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 1963.764903] kasan_check_range+0xfd/0x1e0 [ 1963.765297] memset+0x20/0x50 [ 1963.765580] kmalloc_oob_memset_4+0x1b6/0x290 [test_kasan] [ 1963.766074] ? kmalloc_oob_memset_8+0x290/0x290 [test_kasan] [ 1963.766582] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.766985] ? do_raw_spin_lock+0x270/0x270 [ 1963.767407] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.767902] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.768351] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.768810] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.769255] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.769709] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.770256] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.770717] kthread+0x2a7/0x350 [ 1963.771025] ? kthread_complete_and_exit+0x20/0x20 [ 1963.771455] ret_from_fork+0x22/0x30 [ 1963.771790] [ 1963.772164] Allocated by task 47851: [ 1963.772490] kasan_save_stack+0x1e/0x40 [ 1963.772838] __kasan_kmalloc+0x81/0xa0 [ 1963.773186] kmalloc_oob_memset_4+0x9c/0x290 [test_kasan] [ 1963.773663] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.774106] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.774645] kthread+0x2a7/0x350 [ 1963.774979] ret_from_fork+0x22/0x30 [ 1963.775479] The buggy address belongs to the object at ffff88810ad62200 which belongs to the cache kmalloc-128 of size 128 [ 1963.776596] The buggy address is located 117 bytes inside of 128-byte region [ffff88810ad62200, ffff88810ad62280) [ 1963.777786] The buggy address belongs to the physical page: [ 1963.778298] page:000000007159befd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ad62 [ 1963.779157] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1963.779761] raw: 0017ffffc0000200 dead000000000100 dead000000000122 ffff8881000418c0 [ 1963.780438] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1963.781180] page dumped because: kasan: bad access detected [ 1963.781872] Memory state around the buggy address: [ 1963.782351] ffff88810ad62100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.783054] ffff88810ad62180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.783724] >ffff88810ad62200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 1963.784383] ^ [ 1963.785070] ffff88810ad62280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.785720] ffff88810ad62300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1963.786380] ================================================================== [ 1963.787064] ok 19 - kmalloc_oob_memset_4 [ 1963.789059] ================================================================== [ 1963.790136] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 1963.790864] Write of size 8 at addr ffff88810ad62f71 by task kunit_try_catch/47852 [ 1963.791705] CPU: 0 PID: 47852 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.792951] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.793464] Call Trace: [ 1963.793697] [ 1963.793902] ? kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 1963.794414] dump_stack_lvl+0x57/0x81 [ 1963.794750] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.795265] ? kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 1963.795790] print_report.cold+0x5c/0x237 [ 1963.796177] kasan_report+0xc9/0x100 [ 1963.796523] ? kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 1963.797038] kasan_check_range+0xfd/0x1e0 [ 1963.797403] memset+0x20/0x50 [ 1963.797687] kmalloc_oob_memset_8+0x1b6/0x290 [test_kasan] [ 1963.798182] ? kmalloc_oob_memset_16+0x290/0x290 [test_kasan] [ 1963.798695] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.799101] ? do_raw_spin_lock+0x270/0x270 [ 1963.799480] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.799979] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.800467] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.800927] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.801368] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.801821] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.802371] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.802831] kthread+0x2a7/0x350 [ 1963.803138] ? kthread_complete_and_exit+0x20/0x20 [ 1963.803570] ret_from_fork+0x22/0x30 [ 1963.803904] [ 1963.804275] Allocated by task 47852: [ 1963.804601] kasan_save_stack+0x1e/0x40 [ 1963.804961] __kasan_kmalloc+0x81/0xa0 [ 1963.805310] kmalloc_oob_memset_8+0x9c/0x290 [test_kasan] [ 1963.805792] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.806223] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.806745] kthread+0x2a7/0x350 [ 1963.807061] ret_from_fork+0x22/0x30 [ 1963.807549] The buggy address belongs to the object at ffff88810ad62f00 which belongs to the cache kmalloc-128 of size 128 [ 1963.808660] The buggy address is located 113 bytes inside of 128-byte region [ffff88810ad62f00, ffff88810ad62f80) [ 1963.809818] The buggy address belongs to the physical page: [ 1963.810307] page:000000007159befd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ad62 [ 1963.811118] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1963.811723] raw: 0017ffffc0000200 dead000000000100 dead000000000122 ffff8881000418c0 [ 1963.812403] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1963.813079] page dumped because: kasan: bad access detected [ 1963.813726] Memory state around the buggy address: [ 1963.814157] ffff88810ad62e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 1963.814786] ffff88810ad62e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.815423] >ffff88810ad62f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 1963.816059] ^ [ 1963.816682] ffff88810ad62f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.817320] ffff88810ad63000: 00 00 00 00 00 00 00 00 fc fc fc fc 00 00 00 00 [ 1963.817953] ================================================================== [ 1963.818635] ok 20 - kmalloc_oob_memset_8 [ 1963.820817] ================================================================== [ 1963.821890] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 1963.822640] Write of size 16 at addr ffff88810ad62869 by task kunit_try_catch/47853 [ 1963.823468] CPU: 0 PID: 47853 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.824681] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.825214] Call Trace: [ 1963.825494] [ 1963.825717] ? kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 1963.826239] dump_stack_lvl+0x57/0x81 [ 1963.826576] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.827096] ? kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 1963.827609] print_report.cold+0x5c/0x237 [ 1963.827980] kasan_report+0xc9/0x100 [ 1963.828309] ? kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 1963.828823] kasan_check_range+0xfd/0x1e0 [ 1963.829194] memset+0x20/0x50 [ 1963.829478] kmalloc_oob_memset_16+0x1b6/0x290 [test_kasan] [ 1963.829978] ? kmalloc_uaf_memset+0x280/0x280 [test_kasan] [ 1963.830464] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.830859] ? do_raw_spin_lock+0x270/0x270 [ 1963.831244] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.831762] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.832227] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.832683] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.833131] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.833584] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.834132] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.834590] kthread+0x2a7/0x350 [ 1963.834890] ? kthread_complete_and_exit+0x20/0x20 [ 1963.835330] ret_from_fork+0x22/0x30 [ 1963.835664] [ 1963.836037] Allocated by task 47853: [ 1963.836364] kasan_save_stack+0x1e/0x40 [ 1963.836712] __kasan_kmalloc+0x81/0xa0 [ 1963.837058] kmalloc_oob_memset_16+0x9c/0x290 [test_kasan] [ 1963.837543] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.837987] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.838529] kthread+0x2a7/0x350 [ 1963.838829] ret_from_fork+0x22/0x30 [ 1963.839319] The buggy address belongs to the object at ffff88810ad62800 which belongs to the cache kmalloc-128 of size 128 [ 1963.840388] The buggy address is located 105 bytes inside of 128-byte region [ffff88810ad62800, ffff88810ad62880) [ 1963.841551] The buggy address belongs to the physical page: [ 1963.842045] page:000000007159befd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ad62 [ 1963.842854] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1963.843468] raw: 0017ffffc0000200 dead000000000100 dead000000000122 ffff8881000418c0 [ 1963.844147] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1963.844818] page dumped because: kasan: bad access detected [ 1963.845466] Memory state around the buggy address: [ 1963.845892] ffff88810ad62700: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 1963.846530] ffff88810ad62780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.847165] >ffff88810ad62800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 1963.847793] ^ [ 1963.848465] ffff88810ad62880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1963.849101] ffff88810ad62900: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 1963.849729] ================================================================== [ 1963.850569] ok 21 - kmalloc_oob_memset_16 [ 1963.851856] ================================================================== [ 1963.852943] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 1963.853707] Read of size 18446744073709551614 at addr ffff88810a126b84 by task kunit_try_catch/47854 [ 1963.854663] CPU: 0 PID: 47854 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.855836] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.856351] Call Trace: [ 1963.856581] [ 1963.856786] ? kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 1963.857362] dump_stack_lvl+0x57/0x81 [ 1963.857698] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.858219] ? kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 1963.858785] print_report.cold+0x5c/0x237 [ 1963.859155] kasan_report+0xc9/0x100 [ 1963.859484] ? kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 1963.860059] kasan_check_range+0xfd/0x1e0 [ 1963.860422] memmove+0x20/0x60 [ 1963.860711] kmalloc_memmove_negative_size+0x1c4/0x290 [test_kasan] [ 1963.861269] ? kmalloc_memmove_invalid_size+0x2a0/0x2a0 [test_kasan] [ 1963.861830] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.862234] ? do_raw_spin_lock+0x270/0x270 [ 1963.862613] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.863138] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.863604] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.864067] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.864594] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.865052] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.865593] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.866058] kthread+0x2a7/0x350 [ 1963.866359] ? kthread_complete_and_exit+0x20/0x20 [ 1963.866790] ret_from_fork+0x22/0x30 [ 1963.867129] [ 1963.867496] Allocated by task 47854: [ 1963.867822] kasan_save_stack+0x1e/0x40 [ 1963.868179] __kasan_kmalloc+0x81/0xa0 [ 1963.868521] kmalloc_memmove_negative_size+0x9c/0x290 [test_kasan] [ 1963.869077] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.869516] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.870061] kthread+0x2a7/0x350 [ 1963.870362] ret_from_fork+0x22/0x30 [ 1963.870844] The buggy address belongs to the object at ffff88810a126b80 which belongs to the cache kmalloc-64 of size 64 [ 1963.871898] The buggy address is located 4 bytes inside of 64-byte region [ffff88810a126b80, ffff88810a126bc0) [ 1963.873045] The buggy address belongs to the physical page: [ 1963.873530] page:00000000e9bd166a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a126 [ 1963.874375] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1963.875006] raw: 0017ffffc0000200 ffffea00041de580 dead000000000003 ffff888100041640 [ 1963.875702] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 1963.876425] page dumped because: kasan: bad access detected [ 1963.877076] Memory state around the buggy address: [ 1963.877504] ffff88810a126a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.878190] ffff88810a126b00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 1963.878841] >ffff88810a126b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 1963.879502] ^ [ 1963.879801] ffff88810a126c00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.880436] ffff88810a126c80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.881096] ================================================================== [ 1963.881975] ok 22 - kmalloc_memmove_negative_size [ 1963.884029] ================================================================== [ 1963.885357] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 1963.886172] Read of size 64 at addr ffff888014df1084 by task kunit_try_catch/47855 [ 1963.887010] CPU: 0 PID: 47855 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.888177] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.888684] Call Trace: [ 1963.888942] [ 1963.889155] ? kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 1963.889730] dump_stack_lvl+0x57/0x81 [ 1963.890071] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.890603] ? kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 1963.891191] print_report.cold+0x5c/0x237 [ 1963.891558] kasan_report+0xc9/0x100 [ 1963.891886] ? kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 1963.892496] kasan_check_range+0xfd/0x1e0 [ 1963.892877] memmove+0x20/0x60 [ 1963.893199] kmalloc_memmove_invalid_size+0x1cf/0x2a0 [test_kasan] [ 1963.893743] ? kmalloc_oob_in_memset+0x280/0x280 [test_kasan] [ 1963.894260] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.894655] ? do_raw_spin_lock+0x270/0x270 [ 1963.895038] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.895529] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.896007] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.896468] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.896917] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.897462] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.897917] kthread+0x2a7/0x350 [ 1963.898223] ? kthread_complete_and_exit+0x20/0x20 [ 1963.898652] ret_from_fork+0x22/0x30 [ 1963.898989] [ 1963.899355] Allocated by task 47855: [ 1963.899679] kasan_save_stack+0x1e/0x40 [ 1963.900051] __kasan_kmalloc+0x81/0xa0 [ 1963.900415] kmalloc_memmove_invalid_size+0xac/0x2a0 [test_kasan] [ 1963.900962] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.901396] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.901935] kthread+0x2a7/0x350 [ 1963.902235] ret_from_fork+0x22/0x30 [ 1963.902715] The buggy address belongs to the object at ffff888014df1080 which belongs to the cache kmalloc-64 of size 64 [ 1963.903763] The buggy address is located 4 bytes inside of 64-byte region [ffff888014df1080, ffff888014df10c0) [ 1963.904901] The buggy address belongs to the physical page: [ 1963.905391] page:000000005259431d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14df1 [ 1963.906193] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.906786] raw: 000fffffc0000200 ffffea00041de580 dead000000000003 ffff888100041640 [ 1963.907461] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 1963.908162] page dumped because: kasan: bad access detected [ 1963.908821] Memory state around the buggy address: [ 1963.909255] ffff888014df0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1963.909880] ffff888014df1000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.910517] >ffff888014df1080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 1963.911150] ^ [ 1963.911638] ffff888014df1100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.912293] ffff888014df1180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.912926] ================================================================== [ 1963.913677] ok 23 - kmalloc_memmove_invalid_size [ 1963.915889] ================================================================== [ 1963.917019] BUG: KASAN: use-after-free in kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 1963.917654] Read of size 1 at addr ffff888014d6f548 by task kunit_try_catch/47856 [ 1963.918470] CPU: 0 PID: 47856 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.919681] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.920193] Call Trace: [ 1963.920440] [ 1963.920698] ? kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 1963.921200] dump_stack_lvl+0x57/0x81 [ 1963.921536] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.922055] ? kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 1963.922500] print_report.cold+0x5c/0x237 [ 1963.922870] kasan_report+0xc9/0x100 [ 1963.923210] ? kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 1963.923655] kmalloc_uaf+0x286/0x2b0 [test_kasan] [ 1963.924091] ? kmalloc_uaf2+0x430/0x430 [test_kasan] [ 1963.924540] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.924949] ? do_raw_spin_lock+0x270/0x270 [ 1963.925329] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.925821] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.926280] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.926718] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.927179] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.927719] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.928184] kthread+0x2a7/0x350 [ 1963.928486] ? kthread_complete_and_exit+0x20/0x20 [ 1963.928916] ret_from_fork+0x22/0x30 [ 1963.929256] [ 1963.929624] Allocated by task 47856: [ 1963.929956] kasan_save_stack+0x1e/0x40 [ 1963.930307] __kasan_kmalloc+0x81/0xa0 [ 1963.930647] kmalloc_uaf+0x98/0x2b0 [test_kasan] [ 1963.931072] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.931510] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.932074] kthread+0x2a7/0x350 [ 1963.932395] ret_from_fork+0x22/0x30 [ 1963.932879] Freed by task 47856: [ 1963.933182] kasan_save_stack+0x1e/0x40 [ 1963.933530] kasan_set_track+0x21/0x30 [ 1963.933870] kasan_set_free_info+0x20/0x40 [ 1963.934242] __kasan_slab_free+0x108/0x170 [ 1963.934610] slab_free_freelist_hook+0x11d/0x1d0 [ 1963.935031] kfree+0xe2/0x3c0 [ 1963.935323] kmalloc_uaf+0x12b/0x2b0 [test_kasan] [ 1963.935786] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.936244] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.936781] kthread+0x2a7/0x350 [ 1963.937086] ret_from_fork+0x22/0x30 [ 1963.937569] The buggy address belongs to the object at ffff888014d6f540 which belongs to the cache kmalloc-16 of size 16 [ 1963.938618] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d6f540, ffff888014d6f550) [ 1963.939758] The buggy address belongs to the physical page: [ 1963.940251] page:0000000052e331e7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d6f [ 1963.941055] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1963.941652] raw: 000fffffc0000200 dead000000000100 dead000000000122 ffff8881000413c0 [ 1963.942327] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1963.943000] page dumped because: kasan: bad access detected [ 1963.943644] Memory state around the buggy address: [ 1963.944077] ffff888014d6f400: fb fb fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc [ 1963.944706] ffff888014d6f480: fa fb fc fc 00 00 fc fc fb fb fc fc fb fb fc fc [ 1963.945340] >ffff888014d6f500: 00 00 fc fc 00 00 fc fc fa fb fc fc fb fb fc fc [ 1963.945971] ^ [ 1963.946456] ffff888014d6f580: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc [ 1963.947086] ffff888014d6f600: 00 00 fc fc fb fb fc fc fb fb fc fc 00 00 fc fc [ 1963.947712] ================================================================== [ 1963.948455] ok 24 - kmalloc_uaf [ 1963.949877] ================================================================== [ 1963.950869] BUG: KASAN: use-after-free in kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 1963.951554] Write of size 33 at addr ffff888107796200 by task kunit_try_catch/47857 [ 1963.952377] CPU: 0 PID: 47857 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.953543] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.954056] Call Trace: [ 1963.954287] [ 1963.954492] ? kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 1963.954982] dump_stack_lvl+0x57/0x81 [ 1963.955317] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.955827] ? kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 1963.956314] print_report.cold+0x5c/0x237 [ 1963.956676] kasan_report+0xc9/0x100 [ 1963.957008] ? kmalloc_uaf_memset+0xc1/0x280 [test_kasan] [ 1963.957484] ? kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 1963.957972] kasan_check_range+0xfd/0x1e0 [ 1963.958332] memset+0x20/0x50 [ 1963.958613] kmalloc_uaf_memset+0x1b4/0x280 [test_kasan] [ 1963.959089] ? kmem_cache_accounted+0x170/0x170 [test_kasan] [ 1963.959600] ? do_raw_spin_trylock+0xb5/0x180 [ 1963.960025] ? do_raw_spin_lock+0x270/0x270 [ 1963.960427] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.960917] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.961379] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.961813] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.962269] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.962806] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1963.963265] kthread+0x2a7/0x350 [ 1963.963564] ? kthread_complete_and_exit+0x20/0x20 [ 1963.963995] ret_from_fork+0x22/0x30 [ 1963.964329] [ 1963.964692] Allocated by task 47857: [ 1963.965021] kasan_save_stack+0x1e/0x40 [ 1963.965366] __kasan_kmalloc+0x81/0xa0 [ 1963.965706] kmalloc_uaf_memset+0x9a/0x280 [test_kasan] [ 1963.966178] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.966614] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.967177] kthread+0x2a7/0x350 [ 1963.967498] ret_from_fork+0x22/0x30 [ 1963.967985] Freed by task 47857: [ 1963.968331] kasan_save_stack+0x1e/0x40 [ 1963.968716] kasan_set_track+0x21/0x30 [ 1963.969062] kasan_set_free_info+0x20/0x40 [ 1963.969428] __kasan_slab_free+0x108/0x170 [ 1963.969796] slab_free_freelist_hook+0x11d/0x1d0 [ 1963.970217] kfree+0xe2/0x3c0 [ 1963.970495] kmalloc_uaf_memset+0x137/0x280 [test_kasan] [ 1963.970970] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.971405] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1963.971948] kthread+0x2a7/0x350 [ 1963.972247] ret_from_fork+0x22/0x30 [ 1963.972726] The buggy address belongs to the object at ffff888107796200 which belongs to the cache kmalloc-64 of size 64 [ 1963.973773] The buggy address is located 0 bytes inside of 64-byte region [ffff888107796200, ffff888107796240) [ 1963.974908] The buggy address belongs to the physical page: [ 1963.975423] page:000000008d716eca refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107796 [ 1963.976273] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1963.976901] raw: 0017ffffc0000200 ffffea0000240500 dead000000000002 ffff888100041640 [ 1963.977572] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 1963.978274] page dumped because: kasan: bad access detected [ 1963.978937] Memory state around the buggy address: [ 1963.979420] ffff888107796100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.980051] ffff888107796180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.980688] >ffff888107796200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.981351] ^ [ 1963.981668] ffff888107796280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.982322] ffff888107796300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1963.982976] ================================================================== [ 1963.983718] ok 25 - kmalloc_uaf_memset [ 1963.986026] ================================================================== [ 1963.987102] BUG: KASAN: use-after-free in kmalloc_uaf2+0x402/0x430 [test_kasan] [ 1963.987743] Read of size 1 at addr ffff8881077964a8 by task kunit_try_catch/47858 [ 1963.988555] CPU: 0 PID: 47858 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1963.989766] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1963.990278] Call Trace: [ 1963.990509] [ 1963.990714] ? kmalloc_uaf2+0x402/0x430 [test_kasan] [ 1963.991167] dump_stack_lvl+0x57/0x81 [ 1963.991503] print_address_description.constprop.0+0x1f/0x1e0 [ 1963.992022] ? kmalloc_uaf2+0x402/0x430 [test_kasan] [ 1963.992492] print_report.cold+0x5c/0x237 [ 1963.992872] kasan_report+0xc9/0x100 [ 1963.993208] ? kmalloc_uaf2+0x402/0x430 [test_kasan] [ 1963.993695] kmalloc_uaf2+0x402/0x430 [test_kasan] [ 1963.994133] ? kfree_via_page+0x290/0x290 [test_kasan] [ 1963.994590] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.995020] ? lock_acquire+0x4ea/0x620 [ 1963.995367] ? rcu_read_unlock+0x40/0x40 [ 1963.995719] ? rcu_read_unlock+0x40/0x40 [ 1963.996081] ? rcu_read_lock_sched_held+0x12/0x80 [ 1963.996548] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1963.997045] ? do_raw_spin_lock+0x270/0x270 [ 1963.997420] ? trace_hardirqs_on+0x2d/0x160 [ 1963.997795] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1963.998242] ? kunit_add_resource+0x197/0x280 [kunit] [ 1963.998695] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1963.999138] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1963.999589] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.000133] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.000590] kthread+0x2a7/0x350 [ 1964.000890] ? kthread_complete_and_exit+0x20/0x20 [ 1964.001326] ret_from_fork+0x22/0x30 [ 1964.001659] [ 1964.002033] Allocated by task 47858: [ 1964.002359] kasan_save_stack+0x1e/0x40 [ 1964.002705] __kasan_kmalloc+0x81/0xa0 [ 1964.003051] kmalloc_uaf2+0xad/0x430 [test_kasan] [ 1964.003473] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.003908] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.004537] kthread+0x2a7/0x350 [ 1964.004836] ret_from_fork+0x22/0x30 [ 1964.005324] Freed by task 47858: [ 1964.005621] kasan_save_stack+0x1e/0x40 [ 1964.005975] kasan_set_track+0x21/0x30 [ 1964.006314] kasan_set_free_info+0x20/0x40 [ 1964.006679] __kasan_slab_free+0x108/0x170 [ 1964.007050] slab_free_freelist_hook+0x11d/0x1d0 [ 1964.007464] kfree+0xe2/0x3c0 [ 1964.007740] kmalloc_uaf2+0x144/0x430 [test_kasan] [ 1964.008174] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.008609] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.009153] kthread+0x2a7/0x350 [ 1964.009452] ret_from_fork+0x22/0x30 [ 1964.009938] The buggy address belongs to the object at ffff888107796480 which belongs to the cache kmalloc-64 of size 64 [ 1964.010989] The buggy address is located 40 bytes inside of 64-byte region [ffff888107796480, ffff8881077964c0) [ 1964.012137] The buggy address belongs to the physical page: [ 1964.012621] page:000000008d716eca refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107796 [ 1964.013479] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1964.014088] raw: 0017ffffc0000200 ffffea0000240500 dead000000000002 ffff888100041640 [ 1964.014757] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 1964.015435] page dumped because: kasan: bad access detected [ 1964.016083] Memory state around the buggy address: [ 1964.016510] ffff888107796380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1964.017145] ffff888107796400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1964.017773] >ffff888107796480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1964.018405] ^ [ 1964.018813] ffff888107796500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1964.019449] ffff888107796580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1964.020081] ================================================================== [ 1964.020897] ok 26 - kmalloc_uaf2 [ 1964.025965] ok 27 - kfree_via_page [ 1964.027877] ok 28 - kfree_via_phys [ 1964.031048] ================================================================== [ 1964.032134] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 1964.032850] Read of size 1 at addr ffff888014ccd6f8 by task kunit_try_catch/47861 [ 1964.033718] CPU: 0 PID: 47861 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.034988] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.035497] Call Trace: [ 1964.035730] [ 1964.035942] ? kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 1964.036405] dump_stack_lvl+0x57/0x81 [ 1964.036744] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.037271] ? kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 1964.037737] print_report.cold+0x5c/0x237 [ 1964.038111] kasan_report+0xc9/0x100 [ 1964.038446] ? kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 1964.038910] kmem_cache_oob+0x2d4/0x2e0 [test_kasan] [ 1964.039366] ? kmem_cache_double_free+0x280/0x280 [test_kasan] [ 1964.039938] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.040339] ? do_raw_spin_lock+0x270/0x270 [ 1964.040720] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.041225] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.041683] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.042132] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.042589] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.043139] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.043601] kthread+0x2a7/0x350 [ 1964.043904] ? kthread_complete_and_exit+0x20/0x20 [ 1964.044342] ret_from_fork+0x22/0x30 [ 1964.044678] [ 1964.045051] Allocated by task 47861: [ 1964.045378] kasan_save_stack+0x1e/0x40 [ 1964.045728] __kasan_slab_alloc+0x66/0x80 [ 1964.046097] kmem_cache_alloc+0x161/0x310 [ 1964.046461] kmem_cache_oob+0x121/0x2e0 [test_kasan] [ 1964.046907] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.047395] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.047948] kthread+0x2a7/0x350 [ 1964.048250] ret_from_fork+0x22/0x30 [ 1964.048736] The buggy address belongs to the object at ffff888014ccd630 which belongs to the cache test_cache of size 200 [ 1964.049806] The buggy address is located 0 bytes to the right of 200-byte region [ffff888014ccd630, ffff888014ccd6f8) [ 1964.051010] The buggy address belongs to the physical page: [ 1964.051500] page:00000000b9baa71d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14ccd [ 1964.052310] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1964.052911] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff888004220c80 [ 1964.053591] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 1964.054271] page dumped because: kasan: bad access detected [ 1964.054917] Memory state around the buggy address: [ 1964.055355] ffff888014ccd580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.056081] ffff888014ccd600: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00 [ 1964.056885] >ffff888014ccd680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 1964.057682] ^ [ 1964.058450] ffff888014ccd700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.059149] ffff888014ccd780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.059780] ================================================================== [ 1964.107126] ok 29 - kmem_cache_oob [ 1964.632990] ok 30 - kmem_cache_accounted [ 1964.641025] ok 31 - kmem_cache_bulk [ 1964.643956] ================================================================== [ 1964.644988] BUG: KASAN: global-out-of-bounds in kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 1964.645755] Read of size 1 at addr ffffffffc167e90d by task kunit_try_catch/47864 [ 1964.646579] CPU: 0 PID: 47864 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.647793] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.648309] Call Trace: [ 1964.648541] [ 1964.648747] ? kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 1964.649276] dump_stack_lvl+0x57/0x81 [ 1964.649618] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.650167] ? kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 1964.650708] print_report.cold+0x5c/0x237 [ 1964.651080] kasan_report+0xc9/0x100 [ 1964.651412] ? kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 1964.651940] kasan_global_oob_right+0x1df/0x1f0 [test_kasan] [ 1964.652449] ? kasan_stack_oob+0x200/0x200 [test_kasan] [ 1964.652924] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.653326] ? do_raw_spin_lock+0x270/0x270 [ 1964.653705] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.654206] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.654661] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.655105] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.655557] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.656102] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.656558] kthread+0x2a7/0x350 [ 1964.656859] ? kthread_complete_and_exit+0x20/0x20 [ 1964.657294] ret_from_fork+0x22/0x30 [ 1964.657628] [ 1964.658001] The buggy address belongs to the variable: [ 1964.658453] global_array+0xd/0xfffffffffffe5700 [test_kasan] [ 1964.659124] Memory state around the buggy address: [ 1964.659550] ffffffffc167e800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.660187] ffffffffc167e880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.660817] >ffffffffc167e900: 00 02 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 [ 1964.661449] ^ [ 1964.661768] ffffffffc167e980: 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 [ 1964.662403] ffffffffc167ea00: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 1964.663039] ================================================================== [ 1964.663848] ok 32 - kasan_global_oob_right [ 1964.666959] ok 33 - kasan_global_oob_left # SKIP Test requires CONFIG_CC_IS_CLANG=y [ 1964.671295] ================================================================== [ 1964.672708] BUG: KASAN: stack-out-of-bounds in kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 1964.673417] Read of size 1 at addr ffffc90000eb7e7a by task kunit_try_catch/47866 [ 1964.674235] CPU: 0 PID: 47866 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.675407] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.675914] Call Trace: [ 1964.676152] [ 1964.676357] ? kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 1964.676841] dump_stack_lvl+0x57/0x81 [ 1964.677209] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.677722] ? kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 1964.678238] print_report.cold+0x5c/0x237 [ 1964.678603] kasan_report+0xc9/0x100 [ 1964.678939] ? kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 1964.679414] kasan_stack_oob+0x1eb/0x200 [test_kasan] [ 1964.679893] ? match_all_mem_tag+0x20/0x20 [test_kasan] [ 1964.680384] ? rcu_read_unlock+0x40/0x40 [ 1964.680762] ? rcu_read_lock_sched_held+0x12/0x80 [ 1964.681223] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.681620] ? do_raw_spin_lock+0x270/0x270 [ 1964.682006] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.682502] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1964.682975] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.683449] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.683911] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.684397] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.684966] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.685444] kthread+0x2a7/0x350 [ 1964.685742] ? kthread_complete_and_exit+0x20/0x20 [ 1964.686176] ret_from_fork+0x22/0x30 [ 1964.686508] [ 1964.686894] The buggy address belongs to stack of task kunit_try_catch/47866 [ 1964.687537] and is located at offset 266 in frame: [ 1964.688013] kasan_stack_oob+0x0/0x200 [test_kasan] [ 1964.688624] This frame has 4 objects: [ 1964.688964] [48, 56) 'array' [ 1964.688967] [80, 128) '__assertion' [ 1964.689243] [160, 224) '__assertion' [ 1964.689568] [256, 266) 'stack_array' [ 1964.690384] The buggy address belongs to the virtual mapping at [ffffc90000eb0000, ffffc90000eb9000) created by: dup_task_struct+0x5e/0x5a0 [ 1964.691895] The buggy address belongs to the physical page: [ 1964.692383] page:00000000a664ac91 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1e98a [ 1964.693184] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 1964.693747] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 1964.694464] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1964.695200] page dumped because: kasan: bad access detected [ 1964.695859] Memory state around the buggy address: [ 1964.696338] ffffc90000eb7d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 1964.697011] ffffc90000eb7d80: f1 f1 f1 f1 00 f2 f2 f2 00 00 00 00 00 00 f2 f2 [ 1964.697642] >ffffc90000eb7e00: f2 f2 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 02 [ 1964.698316] ^ [ 1964.698942] ffffc90000eb7e80: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.699569] ffffc90000eb7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.700199] ================================================================== [ 1964.701020] ok 34 - kasan_stack_oob [ 1964.704967] ================================================================== [ 1964.706001] BUG: KASAN: alloca-out-of-bounds in kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 1964.706759] Read of size 1 at addr ffffc90000ec7d1f by task kunit_try_catch/47867 [ 1964.707577] CPU: 0 PID: 47867 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.708752] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.709270] Call Trace: [ 1964.709502] [ 1964.709710] ? kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 1964.710238] dump_stack_lvl+0x57/0x81 [ 1964.710576] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.711098] ? kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 1964.711613] print_report.cold+0x5c/0x237 [ 1964.711984] kasan_report+0xc9/0x100 [ 1964.712315] ? kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 1964.712833] kasan_alloca_oob_left+0x27d/0x2a0 [test_kasan] [ 1964.713334] ? rcu_read_lock_sched_held+0x12/0x80 [ 1964.713760] ? rcu_read_lock_sched_held+0x12/0x80 [ 1964.714194] ? lock_acquire+0x4ea/0x620 [ 1964.714547] ? kasan_alloca_oob_right+0x290/0x290 [test_kasan] [ 1964.715075] ? rcu_read_lock_sched_held+0x12/0x80 [ 1964.715500] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.715898] ? do_raw_spin_lock+0x270/0x270 [ 1964.716283] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.716778] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1964.717229] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.717685] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.718133] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.718587] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.719135] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.719595] kthread+0x2a7/0x350 [ 1964.719898] ? kthread_complete_and_exit+0x20/0x20 [ 1964.720335] ret_from_fork+0x22/0x30 [ 1964.720670] [ 1964.721044] The buggy address belongs to stack of task kunit_try_catch/47867 [ 1964.721838] The buggy address belongs to the virtual mapping at [ffffc90000ec0000, ffffc90000ec9000) created by: dup_task_struct+0x5e/0x5a0 [ 1964.723475] The buggy address belongs to the physical page: [ 1964.723970] page:0000000019643dcf refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c53 [ 1964.724765] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 1964.725338] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 1964.726020] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1964.726694] page dumped because: kasan: bad access detected [ 1964.727386] Memory state around the buggy address: [ 1964.727811] ffffc90000ec7c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.728447] ffffc90000ec7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.729084] >ffffc90000ec7d00: ca ca ca ca 00 02 cb cb cb cb cb cb 00 00 00 00 [ 1964.729712] ^ [ 1964.730080] ffffc90000ec7d80: f1 f1 f1 f1 04 f2 00 f2 f2 f2 00 00 00 00 00 00 [ 1964.730714] ffffc90000ec7e00: f2 f2 f2 f2 00 00 00 00 00 00 00 00 f3 f3 f3 f3 [ 1964.731354] ================================================================== [ 1964.732056] ok 35 - kasan_alloca_oob_left [ 1964.734945] ================================================================== [ 1964.736006] BUG: KASAN: alloca-out-of-bounds in kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 1964.736761] Read of size 1 at addr ffffc90001237d2a by task kunit_try_catch/47868 [ 1964.737565] CPU: 0 PID: 47868 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.738722] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.739232] Call Trace: [ 1964.739459] [ 1964.739663] ? kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 1964.740185] dump_stack_lvl+0x57/0x81 [ 1964.740517] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.741032] ? kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 1964.741543] print_report.cold+0x5c/0x237 [ 1964.741902] kasan_report+0xc9/0x100 [ 1964.742236] ? kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 1964.742757] kasan_alloca_oob_right+0x275/0x290 [test_kasan] [ 1964.743269] ? rcu_read_lock_sched_held+0x12/0x80 [ 1964.743689] ? rcu_read_lock_sched_held+0x12/0x80 [ 1964.744118] ? lock_acquire+0x4ea/0x620 [ 1964.744465] ? ksize_unpoisons_memory+0x300/0x300 [test_kasan] [ 1964.744984] ? rcu_read_lock_sched_held+0x12/0x80 [ 1964.745402] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.745794] ? do_raw_spin_lock+0x270/0x270 [ 1964.746172] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.746658] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1964.747100] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.747548] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.747984] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.748430] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.748967] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.749419] kthread+0x2a7/0x350 [ 1964.749715] ? kthread_complete_and_exit+0x20/0x20 [ 1964.750143] ret_from_fork+0x22/0x30 [ 1964.750471] [ 1964.750833] The buggy address belongs to stack of task kunit_try_catch/47868 [ 1964.751604] The buggy address belongs to the virtual mapping at [ffffc90001230000, ffffc90001239000) created by: dup_task_struct+0x5e/0x5a0 [ 1964.753066] The buggy address belongs to the physical page: [ 1964.753544] page:00000000a9648ca6 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14cc1 [ 1964.754339] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 1964.754894] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 1964.755561] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1964.756224] page dumped because: kasan: bad access detected [ 1964.756855] Memory state around the buggy address: [ 1964.757280] ffffc90001237c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.757900] ffffc90001237c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.758525] >ffffc90001237d00: ca ca ca ca 00 02 cb cb cb cb cb cb 00 00 00 00 [ 1964.759153] ^ [ 1964.759557] ffffc90001237d80: f1 f1 f1 f1 04 f2 00 f2 f2 f2 00 00 00 00 00 00 [ 1964.760203] ffffc90001237e00: f2 f2 f2 f2 00 00 00 00 00 00 00 00 f3 f3 f3 f3 [ 1964.760847] ================================================================== [ 1964.761524] ok 36 - kasan_alloca_oob_right [ 1964.762828] ================================================================== [ 1964.763893] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 1964.764640] Read of size 1 at addr ffff8881062c9280 by task kunit_try_catch/47869 [ 1964.765449] CPU: 0 PID: 47869 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.766660] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.767193] Call Trace: [ 1964.767443] [ 1964.767670] ? ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 1964.768214] dump_stack_lvl+0x57/0x81 [ 1964.768549] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.769065] ? ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 1964.769582] print_report.cold+0x5c/0x237 [ 1964.769952] kasan_report+0xc9/0x100 [ 1964.770281] ? ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 1964.770798] ksize_unpoisons_memory+0x2cf/0x300 [test_kasan] [ 1964.771308] ? ksize_uaf+0x4a0/0x4a0 [test_kasan] [ 1964.771736] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.772165] ? do_raw_spin_lock+0x270/0x270 [ 1964.772559] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.773065] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.773533] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.773998] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.774450] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.774993] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.775451] kthread+0x2a7/0x350 [ 1964.775750] ? kthread_complete_and_exit+0x20/0x20 [ 1964.776186] ret_from_fork+0x22/0x30 [ 1964.776519] [ 1964.776883] Allocated by task 47869: [ 1964.777234] kasan_save_stack+0x1e/0x40 [ 1964.777600] __kasan_kmalloc+0x81/0xa0 [ 1964.777943] ksize_unpoisons_memory+0x9a/0x300 [test_kasan] [ 1964.778477] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.778909] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.779450] kthread+0x2a7/0x350 [ 1964.779747] ret_from_fork+0x22/0x30 [ 1964.780277] The buggy address belongs to the object at ffff8881062c9200 which belongs to the cache kmalloc-128 of size 128 [ 1964.781412] The buggy address is located 0 bytes to the right of 128-byte region [ffff8881062c9200, ffff8881062c9280) [ 1964.782649] The buggy address belongs to the physical page: [ 1964.783179] page:00000000817f77ad refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062c9 [ 1964.784043] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1964.784731] raw: 0017ffffc0000200 dead000000000100 dead000000000122 ffff8881000418c0 [ 1964.785467] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1964.786134] page dumped because: kasan: bad access detected [ 1964.786766] Memory state around the buggy address: [ 1964.787214] ffff8881062c9180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.787857] ffff8881062c9200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1964.788530] >ffff8881062c9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.789157] ^ [ 1964.789452] ffff8881062c9300: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 1964.790080] ffff8881062c9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.790699] ================================================================== [ 1964.791458] ok 37 - ksize_unpoisons_memory [ 1964.793059] ================================================================== [ 1964.794147] BUG: KASAN: use-after-free in ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 1964.794785] Read of size 1 at addr ffff8881062c9b00 by task kunit_try_catch/47870 [ 1964.795633] CPU: 0 PID: 47870 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.796788] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.797292] Call Trace: [ 1964.797520] [ 1964.797722] ? ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 1964.798171] dump_stack_lvl+0x57/0x81 [ 1964.798531] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.799063] ? ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 1964.799508] print_report.cold+0x5c/0x237 [ 1964.799869] kasan_report+0xc9/0x100 [ 1964.800248] ? ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 1964.800709] ? ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 1964.801212] __kasan_check_byte+0x36/0x50 [ 1964.801675] ksize+0x1b/0x50 [ 1964.801974] ksize_uaf+0x1ad/0x4a0 [test_kasan] [ 1964.802527] ? kmem_cache_oob+0x2e0/0x2e0 [test_kasan] [ 1964.803009] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.803548] ? do_raw_spin_lock+0x270/0x270 [ 1964.803953] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.804574] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.805026] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.805458] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.805903] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.806439] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.806940] kthread+0x2a7/0x350 [ 1964.807237] ? kthread_complete_and_exit+0x20/0x20 [ 1964.807659] ret_from_fork+0x22/0x30 [ 1964.807992] [ 1964.808351] Allocated by task 47870: [ 1964.808670] kasan_save_stack+0x1e/0x40 [ 1964.809016] __kasan_kmalloc+0x81/0xa0 [ 1964.809351] ksize_uaf+0x9a/0x4a0 [test_kasan] [ 1964.809749] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.810186] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.810715] kthread+0x2a7/0x350 [ 1964.811016] ret_from_fork+0x22/0x30 [ 1964.811490] Freed by task 47870: [ 1964.811783] kasan_save_stack+0x1e/0x40 [ 1964.812128] kasan_set_track+0x21/0x30 [ 1964.812464] kasan_set_free_info+0x20/0x40 [ 1964.812868] __kasan_slab_free+0x108/0x170 [ 1964.813231] slab_free_freelist_hook+0x11d/0x1d0 [ 1964.813667] kfree+0xe2/0x3c0 [ 1964.813948] ksize_uaf+0x137/0x4a0 [test_kasan] [ 1964.814353] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.814784] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.815319] kthread+0x2a7/0x350 [ 1964.815614] ret_from_fork+0x22/0x30 [ 1964.816095] The buggy address belongs to the object at ffff8881062c9b00 which belongs to the cache kmalloc-128 of size 128 [ 1964.817146] The buggy address is located 0 bytes inside of 128-byte region [ffff8881062c9b00, ffff8881062c9b80) [ 1964.818282] The buggy address belongs to the physical page: [ 1964.818759] page:00000000817f77ad refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062c9 [ 1964.819558] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1964.820160] raw: 0017ffffc0000200 dead000000000100 dead000000000122 ffff8881000418c0 [ 1964.820821] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1964.821484] page dumped because: kasan: bad access detected [ 1964.822119] Memory state around the buggy address: [ 1964.822538] ffff8881062c9a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 1964.823166] ffff8881062c9a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.823787] >ffff8881062c9b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1964.824411] ^ [ 1964.824704] ffff8881062c9b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.825327] ffff8881062c9c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1964.825949] ================================================================== [ 1964.826599] ================================================================== [ 1964.827264] BUG: KASAN: use-after-free in ksize_uaf+0x47d/0x4a0 [test_kasan] [ 1964.827891] Read of size 1 at addr ffff8881062c9b00 by task kunit_try_catch/47870 [ 1964.828777] CPU: 0 PID: 47870 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.829929] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.830427] Call Trace: [ 1964.830654] [ 1964.830856] ? ksize_uaf+0x47d/0x4a0 [test_kasan] [ 1964.831279] dump_stack_lvl+0x57/0x81 [ 1964.831609] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.832138] ? ksize_uaf+0x47d/0x4a0 [test_kasan] [ 1964.832580] print_report.cold+0x5c/0x237 [ 1964.832944] kasan_report+0xc9/0x100 [ 1964.833268] ? ksize_uaf+0x47d/0x4a0 [test_kasan] [ 1964.833687] ksize_uaf+0x47d/0x4a0 [test_kasan] [ 1964.834096] ? kmem_cache_oob+0x2e0/0x2e0 [test_kasan] [ 1964.834545] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.834939] ? do_raw_spin_lock+0x270/0x270 [ 1964.835313] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.835796] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.836293] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.836725] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.837175] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.837702] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.838161] kthread+0x2a7/0x350 [ 1964.838456] ? kthread_complete_and_exit+0x20/0x20 [ 1964.838879] ret_from_fork+0x22/0x30 [ 1964.839211] [ 1964.839571] Allocated by task 47870: [ 1964.839889] kasan_save_stack+0x1e/0x40 [ 1964.840234] __kasan_kmalloc+0x81/0xa0 [ 1964.840569] ksize_uaf+0x9a/0x4a0 [test_kasan] [ 1964.840968] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.841396] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.841930] kthread+0x2a7/0x350 [ 1964.842224] ret_from_fork+0x22/0x30 [ 1964.842698] Freed by task 47870: [ 1964.842996] kasan_save_stack+0x1e/0x40 [ 1964.843336] kasan_set_track+0x21/0x30 [ 1964.843670] kasan_set_free_info+0x20/0x40 [ 1964.844036] __kasan_slab_free+0x108/0x170 [ 1964.844396] slab_free_freelist_hook+0x11d/0x1d0 [ 1964.844805] kfree+0xe2/0x3c0 [ 1964.845088] ksize_uaf+0x137/0x4a0 [test_kasan] [ 1964.845493] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.845929] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.846458] kthread+0x2a7/0x350 [ 1964.846753] ret_from_fork+0x22/0x30 [ 1964.847236] The buggy address belongs to the object at ffff8881062c9b00 which belongs to the cache kmalloc-128 of size 128 [ 1964.848306] The buggy address is located 0 bytes inside of 128-byte region [ffff8881062c9b00, ffff8881062c9b80) [ 1964.849451] The buggy address belongs to the physical page: [ 1964.849937] page:00000000817f77ad refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062c9 [ 1964.850731] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1964.851333] raw: 0017ffffc0000200 dead000000000100 dead000000000122 ffff8881000418c0 [ 1964.851994] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1964.852650] page dumped because: kasan: bad access detected [ 1964.853285] Memory state around the buggy address: [ 1964.853702] ffff8881062c9a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 1964.854324] ffff8881062c9a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.854947] >ffff8881062c9b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1964.855565] ^ [ 1964.855858] ffff8881062c9b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.856481] ffff8881062c9c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1964.857108] ================================================================== [ 1964.857738] ================================================================== [ 1964.858368] BUG: KASAN: use-after-free in ksize_uaf+0x470/0x4a0 [test_kasan] [ 1964.858982] Read of size 1 at addr ffff8881062c9b78 by task kunit_try_catch/47870 [ 1964.859772] CPU: 0 PID: 47870 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.860920] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.861416] Call Trace: [ 1964.861642] [ 1964.861842] ? ksize_uaf+0x470/0x4a0 [test_kasan] [ 1964.862267] dump_stack_lvl+0x57/0x81 [ 1964.862598] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.863108] ? ksize_uaf+0x470/0x4a0 [test_kasan] [ 1964.863525] print_report.cold+0x5c/0x237 [ 1964.863881] kasan_report+0xc9/0x100 [ 1964.864210] ? ksize_uaf+0x470/0x4a0 [test_kasan] [ 1964.864626] ksize_uaf+0x470/0x4a0 [test_kasan] [ 1964.865037] ? kmem_cache_oob+0x2e0/0x2e0 [test_kasan] [ 1964.865488] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.865876] ? do_raw_spin_lock+0x270/0x270 [ 1964.866252] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.866734] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.867187] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.867617] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.868068] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.868598] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.869056] kthread+0x2a7/0x350 [ 1964.869351] ? kthread_complete_and_exit+0x20/0x20 [ 1964.869771] ret_from_fork+0x22/0x30 [ 1964.870103] [ 1964.870462] Allocated by task 47870: [ 1964.870780] kasan_save_stack+0x1e/0x40 [ 1964.871127] __kasan_kmalloc+0x81/0xa0 [ 1964.871476] ksize_uaf+0x9a/0x4a0 [test_kasan] [ 1964.871896] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.872330] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.872858] kthread+0x2a7/0x350 [ 1964.873162] ret_from_fork+0x22/0x30 [ 1964.873637] Freed by task 47870: [ 1964.873938] kasan_save_stack+0x1e/0x40 [ 1964.874278] kasan_set_track+0x21/0x30 [ 1964.874612] kasan_set_free_info+0x20/0x40 [ 1964.875009] __kasan_slab_free+0x108/0x170 [ 1964.875371] slab_free_freelist_hook+0x11d/0x1d0 [ 1964.875779] kfree+0xe2/0x3c0 [ 1964.876058] ksize_uaf+0x137/0x4a0 [test_kasan] [ 1964.876460] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.876889] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.877447] kthread+0x2a7/0x350 [ 1964.877764] ret_from_fork+0x22/0x30 [ 1964.878265] The buggy address belongs to the object at ffff8881062c9b00 which belongs to the cache kmalloc-128 of size 128 [ 1964.879388] The buggy address is located 120 bytes inside of 128-byte region [ffff8881062c9b00, ffff8881062c9b80) [ 1964.880575] The buggy address belongs to the physical page: [ 1964.881060] page:00000000817f77ad refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062c9 [ 1964.881900] flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 1964.882503] raw: 0017ffffc0000200 dead000000000100 dead000000000122 ffff8881000418c0 [ 1964.883168] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 1964.883867] page dumped because: kasan: bad access detected [ 1964.884534] Memory state around the buggy address: [ 1964.884980] ffff8881062c9a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 1964.885645] ffff8881062c9a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.886266] >ffff8881062c9b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1964.886883] ^ [ 1964.887530] ffff8881062c9b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.888172] ffff8881062c9c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1964.888838] ================================================================== [ 1964.889555] ok 38 - ksize_uaf [ 1964.891069] ================================================================== [ 1964.892096] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x152/0x400 [ 1964.892912] CPU: 0 PID: 47871 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.894090] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.894624] Call Trace: [ 1964.894872] [ 1964.895082] dump_stack_lvl+0x57/0x81 [ 1964.895439] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.895978] print_report.cold+0x5c/0x237 [ 1964.896338] ? kmem_cache_free+0x152/0x400 [ 1964.896702] ? kmem_cache_free+0x152/0x400 [ 1964.897077] kasan_report_invalid_free+0x99/0xc0 [ 1964.897492] ? kmem_cache_free+0x152/0x400 [ 1964.897858] ? kmem_cache_free+0x152/0x400 [ 1964.898229] __kasan_slab_free+0x152/0x170 [ 1964.898626] slab_free_freelist_hook+0x11d/0x1d0 [ 1964.899066] ? kmem_cache_double_free+0x1bd/0x280 [test_kasan] [ 1964.899584] kmem_cache_free+0x152/0x400 [ 1964.899945] kmem_cache_double_free+0x1bd/0x280 [test_kasan] [ 1964.900443] ? kmem_cache_invalid_free+0x280/0x280 [test_kasan] [ 1964.901061] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.901581] ? do_raw_spin_lock+0x270/0x270 [ 1964.901983] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.902620] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1964.903163] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.903734] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.904236] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.904725] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.905264] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.905717] kthread+0x2a7/0x350 [ 1964.906023] ? kthread_complete_and_exit+0x20/0x20 [ 1964.906446] ret_from_fork+0x22/0x30 [ 1964.906774] [ 1964.907138] Allocated by task 47871: [ 1964.907457] kasan_save_stack+0x1e/0x40 [ 1964.907799] __kasan_slab_alloc+0x66/0x80 [ 1964.908184] kmem_cache_alloc+0x161/0x310 [ 1964.908555] kmem_cache_double_free+0x123/0x280 [test_kasan] [ 1964.909056] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.909483] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.910021] kthread+0x2a7/0x350 [ 1964.910315] ret_from_fork+0x22/0x30 [ 1964.910790] Freed by task 47871: [ 1964.911090] kasan_save_stack+0x1e/0x40 [ 1964.911432] kasan_set_track+0x21/0x30 [ 1964.911765] kasan_set_free_info+0x20/0x40 [ 1964.912131] __kasan_slab_free+0x108/0x170 [ 1964.912491] slab_free_freelist_hook+0x11d/0x1d0 [ 1964.912900] kmem_cache_free+0x152/0x400 [ 1964.913254] kmem_cache_double_free+0x144/0x280 [test_kasan] [ 1964.913750] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.914210] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.914759] kthread+0x2a7/0x350 [ 1964.915058] ret_from_fork+0x22/0x30 [ 1964.915550] The buggy address belongs to the object at ffff888005388738 which belongs to the cache test_cache of size 200 [ 1964.916616] The buggy address is located 0 bytes inside of 200-byte region [ffff888005388738, ffff888005388800) [ 1964.917741] The buggy address belongs to the physical page: [ 1964.918226] page:0000000040ef63a9 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5388 [ 1964.919014] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1964.919627] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff888004220000 [ 1964.920311] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 1964.920976] page dumped because: kasan: bad access detected [ 1964.921607] Memory state around the buggy address: [ 1964.922032] ffff888005388600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.922691] ffff888005388680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.923332] >ffff888005388700: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb [ 1964.924064] ^ [ 1964.924502] ffff888005388780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1964.925128] ffff888005388800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1964.925746] ================================================================== [ 1964.976115] ok 39 - kmem_cache_double_free [ 1964.978043] ================================================================== [ 1964.979172] BUG: KASAN: double-free or invalid-free in kmem_cache_free+0x152/0x400 [ 1964.979999] CPU: 0 PID: 47872 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1964.981224] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1964.981763] Call Trace: [ 1964.982016] [ 1964.982222] dump_stack_lvl+0x57/0x81 [ 1964.982560] print_address_description.constprop.0+0x1f/0x1e0 [ 1964.983081] print_report.cold+0x5c/0x237 [ 1964.983446] ? kmem_cache_free+0x152/0x400 [ 1964.983901] ? kmem_cache_free+0x152/0x400 [ 1964.984274] kasan_report_invalid_free+0x99/0xc0 [ 1964.984718] ? kmem_cache_free+0x152/0x400 [ 1964.985116] ? kmem_cache_free+0x152/0x400 [ 1964.985505] __kasan_slab_free+0x152/0x170 [ 1964.985903] slab_free_freelist_hook+0x11d/0x1d0 [ 1964.986329] ? kmem_cache_invalid_free+0x1b6/0x280 [test_kasan] [ 1964.986858] kmem_cache_free+0x152/0x400 [ 1964.987222] kmem_cache_invalid_free+0x1b6/0x280 [test_kasan] [ 1964.987764] ? kmem_cache_double_destroy+0x250/0x250 [test_kasan] [ 1964.988328] ? do_raw_spin_trylock+0xb5/0x180 [ 1964.988773] ? do_raw_spin_lock+0x270/0x270 [ 1964.989310] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1964.989899] ? _raw_spin_unlock_irqrestore+0x42/0x70 [ 1964.990482] ? kunit_add_resource+0x197/0x280 [kunit] [ 1964.990971] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.991547] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1964.992053] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.992594] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1964.993060] kthread+0x2a7/0x350 [ 1964.993360] ? kthread_complete_and_exit+0x20/0x20 [ 1964.993789] ret_from_fork+0x22/0x30 [ 1964.994129] [ 1964.994497] Allocated by task 47872: [ 1964.994848] kasan_save_stack+0x1e/0x40 [ 1964.995217] __kasan_slab_alloc+0x66/0x80 [ 1964.995596] kmem_cache_alloc+0x161/0x310 [ 1964.995989] kmem_cache_invalid_free+0x126/0x280 [test_kasan] [ 1964.996501] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1964.996945] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1964.997484] kthread+0x2a7/0x350 [ 1964.997783] ret_from_fork+0x22/0x30 [ 1964.998270] The buggy address belongs to the object at ffff888079f2b000 which belongs to the cache test_cache of size 200 [ 1964.999373] The buggy address is located 1 bytes inside of 200-byte region [ffff888079f2b000, ffff888079f2b0c8) [ 1965.000524] The buggy address belongs to the physical page: [ 1965.001014] page:0000000037bda8bc refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79f2b [ 1965.001818] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.002423] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff888004220780 [ 1965.003098] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 1965.003767] page dumped because: kasan: bad access detected [ 1965.004412] Memory state around the buggy address: [ 1965.004838] ffff888079f2af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1965.005497] ffff888079f2af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 1965.006153] >ffff888079f2b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1965.006780] ^ [ 1965.007102] ffff888079f2b080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 1965.007752] ffff888079f2b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1965.008473] ================================================================== [ 1965.056544] ok 40 - kmem_cache_invalid_free [ 1965.060263] ================================================================== [ 1965.061357] BUG: KASAN: use-after-free in kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 1965.062108] Read of size 1 at addr ffff888004220640 by task kunit_try_catch/47873 [ 1965.062928] CPU: 0 PID: 47873 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.064108] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.064619] Call Trace: [ 1965.064852] [ 1965.065066] ? kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 1965.065611] dump_stack_lvl+0x57/0x81 [ 1965.065958] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.066473] ? kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 1965.067044] print_report.cold+0x5c/0x237 [ 1965.067435] kasan_report+0xc9/0x100 [ 1965.067767] ? kmem_cache_free+0x110/0x400 [ 1965.068142] ? kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 1965.068686] ? kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 1965.069237] __kasan_check_byte+0x36/0x50 [ 1965.069601] kmem_cache_destroy+0x21/0x170 [ 1965.069980] kmem_cache_double_destroy+0x1a0/0x250 [test_kasan] [ 1965.070512] ? kmalloc_oob_right+0x510/0x510 [test_kasan] [ 1965.071001] ? do_raw_spin_trylock+0xb5/0x180 [ 1965.071401] ? do_raw_spin_lock+0x270/0x270 [ 1965.071782] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.072289] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.072747] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.073195] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.073650] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.074200] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.074688] kthread+0x2a7/0x350 [ 1965.075023] ? kthread_complete_and_exit+0x20/0x20 [ 1965.075459] ret_from_fork+0x22/0x30 [ 1965.075795] [ 1965.076174] Allocated by task 47873: [ 1965.076505] kasan_save_stack+0x1e/0x40 [ 1965.076857] __kasan_slab_alloc+0x66/0x80 [ 1965.077226] kmem_cache_alloc+0x161/0x310 [ 1965.077591] kmem_cache_create_usercopy+0x1b9/0x310 [ 1965.078063] kmem_cache_create+0x12/0x20 [ 1965.078437] kmem_cache_double_destroy+0x8d/0x250 [test_kasan] [ 1965.078991] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.079472] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.080052] kthread+0x2a7/0x350 [ 1965.080353] ret_from_fork+0x22/0x30 [ 1965.080891] Freed by task 47873: [ 1965.081227] kasan_save_stack+0x1e/0x40 [ 1965.081604] kasan_set_track+0x21/0x30 [ 1965.081978] kasan_set_free_info+0x20/0x40 [ 1965.082378] __kasan_slab_free+0x108/0x170 [ 1965.082758] slab_free_freelist_hook+0x11d/0x1d0 [ 1965.083197] kmem_cache_free+0x152/0x400 [ 1965.083564] kobject_cleanup+0x104/0x390 [ 1965.083964] kmem_cache_double_destroy+0x12a/0x250 [test_kasan] [ 1965.084531] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.085023] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.085606] kthread+0x2a7/0x350 [ 1965.085950] ret_from_fork+0x22/0x30 [ 1965.086484] The buggy address belongs to the object at ffff888004220640 which belongs to the cache kmem_cache of size 240 [ 1965.087589] The buggy address is located 0 bytes inside of 240-byte region [ffff888004220640, ffff888004220730) [ 1965.088851] The buggy address belongs to the physical page: [ 1965.089411] page:000000009ded45e8 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4220 [ 1965.090253] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.090852] raw: 000fffffc0000200 0000000000000000 dead000000000122 ffff888100041000 [ 1965.091572] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 1965.092291] page dumped because: kasan: bad access detected [ 1965.092940] Memory state around the buggy address: [ 1965.093365] ffff888004220500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1965.094000] ffff888004220580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 1965.094629] >ffff888004220600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 1965.095307] ^ [ 1965.095791] ffff888004220680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1965.096453] ffff888004220700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 1965.097091] ================================================================== [ 1965.097832] ok 41 - kmem_cache_double_destroy [ 1965.099850] ok 42 - kasan_memchr # SKIP Test requires CONFIG_AMD_MEM_ENCRYPT=n [ 1965.101955] ok 43 - kasan_memcmp # SKIP Test requires CONFIG_AMD_MEM_ENCRYPT=n [ 1965.103884] ok 44 - kasan_strings # SKIP Test requires CONFIG_AMD_MEM_ENCRYPT=n [ 1965.105897] ================================================================== [ 1965.107247] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 1965.108056] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.108870] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.110055] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.110564] Call Trace: [ 1965.110796] [ 1965.111009] ? kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 1965.111646] dump_stack_lvl+0x57/0x81 [ 1965.112011] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.112612] ? kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 1965.113192] print_report.cold+0x5c/0x237 [ 1965.113556] kasan_report+0xc9/0x100 [ 1965.113888] ? kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 1965.114466] kasan_check_range+0xfd/0x1e0 [ 1965.114828] kasan_bitops_modify.constprop.0+0xff/0x850 [test_kasan] [ 1965.115393] ? kasan_test_init+0x50/0x50 [test_kasan] [ 1965.115846] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.116260] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.116688] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.117186] ? rcu_read_lock_held+0x30/0x50 [ 1965.117560] ? trace_kmalloc+0x3c/0x100 [ 1965.117909] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.118342] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 1965.118820] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.119475] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.119988] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.120441] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.120879] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.121338] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.121877] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.122340] kthread+0x2a7/0x350 [ 1965.122639] ? kthread_complete_and_exit+0x20/0x20 [ 1965.123119] ret_from_fork+0x22/0x30 [ 1965.123453] [ 1965.123818] Allocated by task 47877: [ 1965.124245] kasan_save_stack+0x1e/0x40 [ 1965.124629] __kasan_kmalloc+0x81/0xa0 [ 1965.124977] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.125457] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.125896] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.126441] kthread+0x2a7/0x350 [ 1965.126742] ret_from_fork+0x22/0x30 [ 1965.127230] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.128283] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.129425] The buggy address belongs to the physical page: [ 1965.129910] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.130719] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.131326] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.132002] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.132670] page dumped because: kasan: bad access detected [ 1965.133316] Memory state around the buggy address: [ 1965.133745] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.134385] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.135051] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.135679] ^ [ 1965.136171] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.136801] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.137435] ================================================================== [ 1965.138145] ================================================================== [ 1965.138789] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 1965.139598] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.140418] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.141585] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.142101] Call Trace: [ 1965.142331] [ 1965.142535] ? kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 1965.143125] dump_stack_lvl+0x57/0x81 [ 1965.143460] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.143976] ? kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 1965.144553] print_report.cold+0x5c/0x237 [ 1965.144922] kasan_report+0xc9/0x100 [ 1965.145252] ? kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 1965.145832] kasan_check_range+0xfd/0x1e0 [ 1965.146197] kasan_bitops_modify.constprop.0+0x1a4/0x850 [test_kasan] [ 1965.146763] ? kasan_test_init+0x50/0x50 [test_kasan] [ 1965.147219] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.147622] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.148075] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.148588] ? rcu_read_lock_held+0x30/0x50 [ 1965.148967] ? trace_kmalloc+0x3c/0x100 [ 1965.149313] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.149736] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 1965.150217] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.150862] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.151373] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.151822] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.152265] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.152715] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.153259] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.153715] kthread+0x2a7/0x350 [ 1965.154021] ? kthread_complete_and_exit+0x20/0x20 [ 1965.154450] ret_from_fork+0x22/0x30 [ 1965.154790] [ 1965.155161] Allocated by task 47877: [ 1965.155484] kasan_save_stack+0x1e/0x40 [ 1965.155831] __kasan_kmalloc+0x81/0xa0 [ 1965.156176] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.156660] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.157106] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.157650] kthread+0x2a7/0x350 [ 1965.157959] ret_from_fork+0x22/0x30 [ 1965.158443] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.159621] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.161010] The buggy address belongs to the physical page: [ 1965.161629] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.162581] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.163184] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.163854] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.164524] page dumped because: kasan: bad access detected [ 1965.165170] Memory state around the buggy address: [ 1965.165595] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.166230] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.166857] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.167491] ^ [ 1965.167983] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.168609] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.169243] ================================================================== [ 1965.169942] ================================================================== [ 1965.170581] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 1965.171388] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.172206] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.173368] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.173875] Call Trace: [ 1965.174114] [ 1965.174319] ? kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 1965.174895] dump_stack_lvl+0x57/0x81 [ 1965.175262] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.175798] ? kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 1965.176428] print_report.cold+0x5c/0x237 [ 1965.176791] kasan_report+0xc9/0x100 [ 1965.177127] ? kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 1965.177708] kasan_check_range+0xfd/0x1e0 [ 1965.178095] kasan_bitops_modify.constprop.0+0x24d/0x850 [test_kasan] [ 1965.178685] ? kasan_test_init+0x50/0x50 [test_kasan] [ 1965.179168] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.179596] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.180030] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.180521] ? rcu_read_lock_held+0x30/0x50 [ 1965.180921] ? trace_kmalloc+0x3c/0x100 [ 1965.181295] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.181717] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 1965.182237] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.182909] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.183423] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.183924] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.184405] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.184858] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.185459] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.185953] kthread+0x2a7/0x350 [ 1965.186261] ? kthread_complete_and_exit+0x20/0x20 [ 1965.186709] ret_from_fork+0x22/0x30 [ 1965.187050] [ 1965.187414] Allocated by task 47877: [ 1965.187736] kasan_save_stack+0x1e/0x40 [ 1965.188109] __kasan_kmalloc+0x81/0xa0 [ 1965.188470] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.188970] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.189436] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.189982] kthread+0x2a7/0x350 [ 1965.190281] ret_from_fork+0x22/0x30 [ 1965.190786] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.191866] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.193055] The buggy address belongs to the physical page: [ 1965.193549] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.194355] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.194961] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.195675] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.196393] page dumped because: kasan: bad access detected [ 1965.197040] Memory state around the buggy address: [ 1965.197466] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.198141] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.198769] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.199445] ^ [ 1965.199940] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.200570] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.201211] ================================================================== [ 1965.201866] ================================================================== [ 1965.202509] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 1965.203321] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.204148] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.205318] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.205826] Call Trace: [ 1965.206086] [ 1965.206310] ? kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 1965.206896] dump_stack_lvl+0x57/0x81 [ 1965.207242] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.207760] ? kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 1965.208354] print_report.cold+0x5c/0x237 [ 1965.208721] kasan_report+0xc9/0x100 [ 1965.209061] ? kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 1965.209644] kasan_check_range+0xfd/0x1e0 [ 1965.210120] kasan_bitops_modify.constprop.0+0x2f2/0x850 [test_kasan] [ 1965.210837] ? kasan_test_init+0x50/0x50 [test_kasan] [ 1965.211375] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.211872] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.212400] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.212962] ? rcu_read_lock_held+0x30/0x50 [ 1965.213338] ? trace_kmalloc+0x3c/0x100 [ 1965.213686] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.214112] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 1965.214591] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.215310] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.215831] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.216342] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.216817] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.217276] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.217817] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.218277] kthread+0x2a7/0x350 [ 1965.218577] ? kthread_complete_and_exit+0x20/0x20 [ 1965.219010] ret_from_fork+0x22/0x30 [ 1965.219343] [ 1965.219708] Allocated by task 47877: [ 1965.220038] kasan_save_stack+0x1e/0x40 [ 1965.220386] __kasan_kmalloc+0x81/0xa0 [ 1965.220762] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.221428] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.221906] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.222599] kthread+0x2a7/0x350 [ 1965.222925] ret_from_fork+0x22/0x30 [ 1965.223555] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.224642] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.225775] The buggy address belongs to the physical page: [ 1965.226265] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.227076] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.227673] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.228375] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.229066] page dumped because: kasan: bad access detected [ 1965.229792] Memory state around the buggy address: [ 1965.230222] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.230850] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.231484] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.232117] ^ [ 1965.232604] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.233237] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.233864] ================================================================== [ 1965.234585] ================================================================== [ 1965.235232] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 1965.236039] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.236849] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.238018] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.238523] Call Trace: [ 1965.238754] [ 1965.238967] ? kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 1965.239545] dump_stack_lvl+0x57/0x81 [ 1965.239879] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.240397] ? kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 1965.240978] print_report.cold+0x5c/0x237 [ 1965.241341] kasan_report+0xc9/0x100 [ 1965.241668] ? kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 1965.242248] kasan_check_range+0xfd/0x1e0 [ 1965.242610] kasan_bitops_modify.constprop.0+0x39b/0x850 [test_kasan] [ 1965.243182] ? kasan_test_init+0x50/0x50 [test_kasan] [ 1965.243634] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.244043] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.244465] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.244966] ? rcu_read_lock_held+0x30/0x50 [ 1965.245341] ? trace_kmalloc+0x3c/0x100 [ 1965.245690] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.246120] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 1965.246598] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.247251] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.247756] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.248217] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.248653] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.249109] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.249648] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.250113] kthread+0x2a7/0x350 [ 1965.250412] ? kthread_complete_and_exit+0x20/0x20 [ 1965.250840] ret_from_fork+0x22/0x30 [ 1965.251178] [ 1965.251543] Allocated by task 47877: [ 1965.251867] kasan_save_stack+0x1e/0x40 [ 1965.252262] __kasan_kmalloc+0x81/0xa0 [ 1965.252601] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.253085] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.253519] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.254060] kthread+0x2a7/0x350 [ 1965.254359] ret_from_fork+0x22/0x30 [ 1965.254839] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.255893] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.257075] The buggy address belongs to the physical page: [ 1965.257578] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.258401] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.259001] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.259665] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.260351] page dumped because: kasan: bad access detected [ 1965.261017] Memory state around the buggy address: [ 1965.261441] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.262073] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.262699] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.263371] ^ [ 1965.263855] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.264527] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.265159] ================================================================== [ 1965.265803] ================================================================== [ 1965.266447] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 1965.267254] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.268070] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.269235] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.269743] Call Trace: [ 1965.269977] [ 1965.270183] ? kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 1965.270761] dump_stack_lvl+0x57/0x81 [ 1965.271105] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.271616] ? kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 1965.272202] print_report.cold+0x5c/0x237 [ 1965.272564] kasan_report+0xc9/0x100 [ 1965.272893] ? kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 1965.273477] kasan_check_range+0xfd/0x1e0 [ 1965.273841] kasan_bitops_modify.constprop.0+0x440/0x850 [test_kasan] [ 1965.274413] ? kasan_test_init+0x50/0x50 [test_kasan] [ 1965.274865] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.275273] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.275696] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.276217] ? rcu_read_lock_held+0x30/0x50 [ 1965.276607] ? trace_kmalloc+0x3c/0x100 [ 1965.276961] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.277384] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 1965.277860] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.278538] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.279067] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.279546] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.280009] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.280461] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.281048] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.281562] kthread+0x2a7/0x350 [ 1965.281862] ? kthread_complete_and_exit+0x20/0x20 [ 1965.282347] ret_from_fork+0x22/0x30 [ 1965.282718] [ 1965.283105] Allocated by task 47877: [ 1965.283454] kasan_save_stack+0x1e/0x40 [ 1965.283799] __kasan_kmalloc+0x81/0xa0 [ 1965.284163] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.284705] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.285148] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.285732] kthread+0x2a7/0x350 [ 1965.286037] ret_from_fork+0x22/0x30 [ 1965.286547] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.287634] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.288834] The buggy address belongs to the physical page: [ 1965.289349] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.290175] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.290770] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.291442] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.292115] page dumped because: kasan: bad access detected [ 1965.292797] Memory state around the buggy address: [ 1965.293229] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.293855] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.294490] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.295124] ^ [ 1965.295652] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.296308] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.296966] ================================================================== [ 1965.297606] ================================================================== [ 1965.298249] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 1965.299054] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.299909] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.301084] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.301589] Call Trace: [ 1965.301820] [ 1965.302028] ? kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 1965.302606] dump_stack_lvl+0x57/0x81 [ 1965.302948] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.303461] ? kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 1965.304047] print_report.cold+0x5c/0x237 [ 1965.304410] kasan_report+0xc9/0x100 [ 1965.304738] ? kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 1965.305321] kasan_check_range+0xfd/0x1e0 [ 1965.305682] kasan_bitops_modify.constprop.0+0x4e9/0x850 [test_kasan] [ 1965.306253] ? kasan_test_init+0x50/0x50 [test_kasan] [ 1965.306706] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.307115] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.307538] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.308031] ? rcu_read_lock_held+0x30/0x50 [ 1965.308405] ? trace_kmalloc+0x3c/0x100 [ 1965.308753] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.309181] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 1965.309656] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.310406] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.311047] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.311634] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.312152] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.312698] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.313334] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.313843] kthread+0x2a7/0x350 [ 1965.314144] ? kthread_complete_and_exit+0x20/0x20 [ 1965.314570] ret_from_fork+0x22/0x30 [ 1965.314901] [ 1965.315271] Allocated by task 47877: [ 1965.315594] kasan_save_stack+0x1e/0x40 [ 1965.315944] __kasan_kmalloc+0x81/0xa0 [ 1965.316284] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.316758] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.317200] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.317736] kthread+0x2a7/0x350 [ 1965.318042] ret_from_fork+0x22/0x30 [ 1965.318522] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.319610] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.320831] The buggy address belongs to the physical page: [ 1965.321321] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.322119] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.322714] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.323390] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.324103] page dumped because: kasan: bad access detected [ 1965.324803] Memory state around the buggy address: [ 1965.325294] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.325928] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.326556] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.327185] ^ [ 1965.327672] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.328307] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.328938] ================================================================== [ 1965.329620] ================================================================== [ 1965.330268] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 1965.331078] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.331889] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.333057] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.333566] Call Trace: [ 1965.333795] [ 1965.334008] ? kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 1965.334588] dump_stack_lvl+0x57/0x81 [ 1965.334928] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.335439] ? kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 1965.336026] print_report.cold+0x5c/0x237 [ 1965.336390] kasan_report+0xc9/0x100 [ 1965.336720] ? kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 1965.337307] kasan_check_range+0xfd/0x1e0 [ 1965.337669] kasan_bitops_modify.constprop.0+0x58e/0x850 [test_kasan] [ 1965.338241] ? kasan_test_init+0x50/0x50 [test_kasan] [ 1965.338696] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.339108] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.339532] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.340050] ? rcu_read_lock_held+0x30/0x50 [ 1965.340447] ? trace_kmalloc+0x3c/0x100 [ 1965.340795] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.341225] kasan_bitops_generic+0xfa/0x164 [test_kasan] [ 1965.341704] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.342358] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.342863] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.343320] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.343758] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.344215] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.344757] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.345220] kthread+0x2a7/0x350 [ 1965.345520] ? kthread_complete_and_exit+0x20/0x20 [ 1965.345955] ret_from_fork+0x22/0x30 [ 1965.346287] [ 1965.346654] Allocated by task 47877: [ 1965.346982] kasan_save_stack+0x1e/0x40 [ 1965.347330] __kasan_kmalloc+0x81/0xa0 [ 1965.347669] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.348152] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.348589] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.349135] kthread+0x2a7/0x350 [ 1965.349434] ret_from_fork+0x22/0x30 [ 1965.349924] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.350978] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.352135] The buggy address belongs to the physical page: [ 1965.352644] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.353453] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.354057] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.354725] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.355403] page dumped because: kasan: bad access detected [ 1965.356068] Memory state around the buggy address: [ 1965.356515] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.357148] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.357777] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.358412] ^ [ 1965.358899] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.359536] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.360168] ================================================================== [ 1965.360815] ================================================================== [ 1965.361457] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 1965.362329] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.363150] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.364315] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.364821] Call Trace: [ 1965.365061] [ 1965.365267] ? kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 1965.365906] dump_stack_lvl+0x57/0x81 [ 1965.366250] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.366764] ? kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 1965.367410] print_report.cold+0x5c/0x237 [ 1965.367773] kasan_report+0xc9/0x100 [ 1965.368109] ? kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 1965.368750] kasan_check_range+0xfd/0x1e0 [ 1965.369122] kasan_bitops_test_and_modify.constprop.0+0xff/0x990 [test_kasan] [ 1965.369750] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.370454] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.370971] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.371528] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.372084] ? rcu_read_lock_held+0x30/0x50 [ 1965.372574] ? trace_kmalloc+0x3c/0x100 [ 1965.372952] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.373506] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.373997] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.374645] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.375157] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.375610] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.376054] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.376503] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.377048] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.377505] kthread+0x2a7/0x350 [ 1965.377807] ? kthread_complete_and_exit+0x20/0x20 [ 1965.378241] ret_from_fork+0x22/0x30 [ 1965.378593] [ 1965.378988] Allocated by task 47877: [ 1965.379312] kasan_save_stack+0x1e/0x40 [ 1965.379683] __kasan_kmalloc+0x81/0xa0 [ 1965.380051] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.380530] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.380972] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.381535] kthread+0x2a7/0x350 [ 1965.381855] ret_from_fork+0x22/0x30 [ 1965.382363] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.383442] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.384611] The buggy address belongs to the physical page: [ 1965.385165] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.386063] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.386729] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.387487] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.388183] page dumped because: kasan: bad access detected [ 1965.388910] Memory state around the buggy address: [ 1965.389375] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.390089] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.390781] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.391495] ^ [ 1965.392057] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.392790] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.393488] ================================================================== [ 1965.394211] ================================================================== [ 1965.394920] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 1965.395942] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.396869] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.398170] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.398716] Call Trace: [ 1965.398981] [ 1965.399193] ? kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 1965.399954] dump_stack_lvl+0x57/0x81 [ 1965.400326] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.400889] ? kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 1965.401600] print_report.cold+0x5c/0x237 [ 1965.402004] kasan_report+0xc9/0x100 [ 1965.402362] ? kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 1965.403058] kasan_check_range+0xfd/0x1e0 [ 1965.403474] kasan_bitops_test_and_modify.constprop.0+0x1a9/0x990 [test_kasan] [ 1965.404178] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.404801] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.405240] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.405720] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.406255] ? rcu_read_lock_held+0x30/0x50 [ 1965.406660] ? trace_kmalloc+0x3c/0x100 [ 1965.407046] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.407503] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.408057] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.408766] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.409317] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.409804] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.410304] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.410790] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.411369] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.411882] kthread+0x2a7/0x350 [ 1965.412257] ? kthread_complete_and_exit+0x20/0x20 [ 1965.412723] ret_from_fork+0x22/0x30 [ 1965.413093] [ 1965.413490] Allocated by task 47877: [ 1965.413844] kasan_save_stack+0x1e/0x40 [ 1965.414226] __kasan_kmalloc+0x81/0xa0 [ 1965.414597] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.415115] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.415607] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.416190] kthread+0x2a7/0x350 [ 1965.416516] ret_from_fork+0x22/0x30 [ 1965.417062] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.418213] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.419500] The buggy address belongs to the physical page: [ 1965.420042] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.420923] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.421563] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.422296] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.423032] page dumped because: kasan: bad access detected [ 1965.423771] Memory state around the buggy address: [ 1965.424299] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.425037] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.425727] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.426426] ^ [ 1965.426969] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.427653] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.428348] ================================================================== [ 1965.429038] ================================================================== [ 1965.429731] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 1965.430740] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.431646] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.432906] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.433456] Call Trace: [ 1965.433715] [ 1965.433952] ? kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 1965.434662] dump_stack_lvl+0x57/0x81 [ 1965.435017] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.435586] ? kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 1965.436301] print_report.cold+0x5c/0x237 [ 1965.436696] kasan_report+0xc9/0x100 [ 1965.437064] ? kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 1965.437772] kasan_check_range+0xfd/0x1e0 [ 1965.438170] kasan_bitops_test_and_modify.constprop.0+0x252/0x990 [test_kasan] [ 1965.438862] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.439489] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.439967] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.440427] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.440966] ? rcu_read_lock_held+0x30/0x50 [ 1965.441379] ? trace_kmalloc+0x3c/0x100 [ 1965.441753] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.442237] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.442761] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.443478] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.444026] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.444533] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.445014] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.445502] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.446107] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.446604] kthread+0x2a7/0x350 [ 1965.446938] ? kthread_complete_and_exit+0x20/0x20 [ 1965.447423] ret_from_fork+0x22/0x30 [ 1965.447769] [ 1965.448196] Allocated by task 47877: [ 1965.448531] kasan_save_stack+0x1e/0x40 [ 1965.448946] __kasan_kmalloc+0x81/0xa0 [ 1965.449296] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.449829] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.450308] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.450882] kthread+0x2a7/0x350 [ 1965.451247] ret_from_fork+0x22/0x30 [ 1965.451775] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.452926] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.454168] The buggy address belongs to the physical page: [ 1965.454701] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.455576] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.456236] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.456977] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.457705] page dumped because: kasan: bad access detected [ 1965.458414] Memory state around the buggy address: [ 1965.458878] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.459585] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.460325] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.461023] ^ [ 1965.461544] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.462235] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.462904] ================================================================== [ 1965.463614] ================================================================== [ 1965.464316] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 1965.465274] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.466160] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.467422] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.467993] Call Trace: [ 1965.468250] [ 1965.468470] ? kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 1965.469186] dump_stack_lvl+0x57/0x81 [ 1965.469548] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.470124] ? kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 1965.470832] print_report.cold+0x5c/0x237 [ 1965.471235] kasan_report+0xc9/0x100 [ 1965.471594] ? kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 1965.472309] kasan_check_range+0xfd/0x1e0 [ 1965.472706] kasan_bitops_test_and_modify.constprop.0+0x2fc/0x990 [test_kasan] [ 1965.473407] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.474050] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.474488] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.474977] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.475509] ? rcu_read_lock_held+0x30/0x50 [ 1965.475919] ? trace_kmalloc+0x3c/0x100 [ 1965.476305] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.476775] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.477316] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.478034] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.478597] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.479136] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.479627] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.480209] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.480933] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.481425] kthread+0x2a7/0x350 [ 1965.481778] ? kthread_complete_and_exit+0x20/0x20 [ 1965.482274] ret_from_fork+0x22/0x30 [ 1965.482658] [ 1965.483109] Allocated by task 47877: [ 1965.483443] kasan_save_stack+0x1e/0x40 [ 1965.483843] __kasan_kmalloc+0x81/0xa0 [ 1965.484202] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.484754] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.485259] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.485876] kthread+0x2a7/0x350 [ 1965.486238] ret_from_fork+0x22/0x30 [ 1965.486799] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.487975] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.489273] The buggy address belongs to the physical page: [ 1965.489840] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.490733] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.491398] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.492135] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.492887] page dumped because: kasan: bad access detected [ 1965.493610] Memory state around the buggy address: [ 1965.494078] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.494752] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.495473] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.496201] ^ [ 1965.496760] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.497480] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.498177] ================================================================== [ 1965.498863] ================================================================== [ 1965.499561] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 1965.500571] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.501622] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.503044] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.503709] Call Trace: [ 1965.503997] [ 1965.504207] ? kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 1965.504921] dump_stack_lvl+0x57/0x81 [ 1965.505286] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.505839] ? kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 1965.506552] print_report.cold+0x5c/0x237 [ 1965.507018] kasan_report+0xc9/0x100 [ 1965.507416] ? kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 1965.508171] kasan_check_range+0xfd/0x1e0 [ 1965.508588] kasan_bitops_test_and_modify.constprop.0+0x3a6/0x990 [test_kasan] [ 1965.509311] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.509982] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.510443] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.510902] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.511434] ? rcu_read_lock_held+0x30/0x50 [ 1965.511863] ? trace_kmalloc+0x3c/0x100 [ 1965.512230] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.512707] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.513233] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.513949] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.514488] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.515003] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.515477] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.515965] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.516570] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.517080] kthread+0x2a7/0x350 [ 1965.517434] ? kthread_complete_and_exit+0x20/0x20 [ 1965.517921] ret_from_fork+0x22/0x30 [ 1965.518264] [ 1965.518681] Allocated by task 47877: [ 1965.519023] kasan_save_stack+0x1e/0x40 [ 1965.519422] __kasan_kmalloc+0x81/0xa0 [ 1965.519818] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.520339] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.520813] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.521408] kthread+0x2a7/0x350 [ 1965.521737] ret_from_fork+0x22/0x30 [ 1965.522262] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.523402] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.524660] The buggy address belongs to the physical page: [ 1965.525205] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.526101] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.526753] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.527492] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.528274] page dumped because: kasan: bad access detected [ 1965.529017] Memory state around the buggy address: [ 1965.529481] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.530181] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.530871] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.531614] ^ [ 1965.532160] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.532872] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.533592] ================================================================== [ 1965.534335] ================================================================== [ 1965.535056] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 1965.536022] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.536943] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.538207] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.538752] Call Trace: [ 1965.539018] [ 1965.539249] ? kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 1965.539968] dump_stack_lvl+0x57/0x81 [ 1965.540316] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.540884] ? kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 1965.541601] print_report.cold+0x5c/0x237 [ 1965.542006] kasan_report+0xc9/0x100 [ 1965.542366] ? kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 1965.543082] kasan_check_range+0xfd/0x1e0 [ 1965.543480] kasan_bitops_test_and_modify.constprop.0+0x44f/0x990 [test_kasan] [ 1965.544166] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.544809] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.545257] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.545713] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.546270] ? rcu_read_lock_held+0x30/0x50 [ 1965.546677] ? trace_kmalloc+0x3c/0x100 [ 1965.547063] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.547525] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.548068] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.548780] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.549363] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.549875] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.550351] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.550841] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.551446] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.551949] kthread+0x2a7/0x350 [ 1965.552277] ? kthread_complete_and_exit+0x20/0x20 [ 1965.552760] ret_from_fork+0x22/0x30 [ 1965.553108] [ 1965.553527] Allocated by task 47877: [ 1965.553866] kasan_save_stack+0x1e/0x40 [ 1965.554272] __kasan_kmalloc+0x81/0xa0 [ 1965.554640] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.555160] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.555651] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.556233] kthread+0x2a7/0x350 [ 1965.556561] ret_from_fork+0x22/0x30 [ 1965.557110] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.558256] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.559496] The buggy address belongs to the physical page: [ 1965.560045] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.560917] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.561572] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.562312] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.563051] page dumped because: kasan: bad access detected [ 1965.563769] Memory state around the buggy address: [ 1965.564281] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.564976] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.565665] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.566361] ^ [ 1965.566885] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.567579] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.568277] ================================================================== [ 1965.568986] ================================================================== [ 1965.569681] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 1965.570625] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.571528] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.572794] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.573362] Call Trace: [ 1965.573599] [ 1965.573832] ? kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 1965.574557] dump_stack_lvl+0x57/0x81 [ 1965.574928] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.575498] ? kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 1965.576214] print_report.cold+0x5c/0x237 [ 1965.576589] kasan_report+0xc9/0x100 [ 1965.576977] ? kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 1965.577687] kasan_check_range+0xfd/0x1e0 [ 1965.578067] kasan_bitops_test_and_modify.constprop.0+0x4f9/0x990 [test_kasan] [ 1965.578762] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.579454] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.579899] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.580388] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.580962] ? rcu_read_lock_held+0x30/0x50 [ 1965.581373] ? trace_kmalloc+0x3c/0x100 [ 1965.581748] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.582277] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.582820] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.583563] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.584112] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.584623] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.585129] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.585638] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.586279] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.586795] kthread+0x2a7/0x350 [ 1965.587154] ? kthread_complete_and_exit+0x20/0x20 [ 1965.587662] ret_from_fork+0x22/0x30 [ 1965.588012] [ 1965.588430] Allocated by task 47877: [ 1965.588764] kasan_save_stack+0x1e/0x40 [ 1965.589194] __kasan_kmalloc+0x81/0xa0 [ 1965.589562] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.590128] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.590625] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.591222] kthread+0x2a7/0x350 [ 1965.591554] ret_from_fork+0x22/0x30 [ 1965.592081] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.593276] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.594539] The buggy address belongs to the physical page: [ 1965.595069] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.595960] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.596645] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.597426] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.598163] page dumped because: kasan: bad access detected [ 1965.598868] Memory state around the buggy address: [ 1965.599330] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.600089] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.600806] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.601503] ^ [ 1965.602051] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.602728] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.603427] ================================================================== [ 1965.604134] ================================================================== [ 1965.604829] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 1965.605795] Read of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.606675] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.607984] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.608530] Call Trace: [ 1965.608789] [ 1965.609010] ? kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 1965.609722] dump_stack_lvl+0x57/0x81 [ 1965.610101] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.610667] ? kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 1965.611381] print_report.cold+0x5c/0x237 [ 1965.611783] kasan_report+0xc9/0x100 [ 1965.612147] ? kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 1965.612856] kasan_check_range+0xfd/0x1e0 [ 1965.613260] kasan_bitops_test_and_modify.constprop.0+0x5a2/0x990 [test_kasan] [ 1965.613965] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.614607] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.615047] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.615511] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.616050] ? rcu_read_lock_held+0x30/0x50 [ 1965.616452] ? trace_kmalloc+0x3c/0x100 [ 1965.616852] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.617314] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.617839] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.618555] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.619125] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.619613] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.620091] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.620603] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.621190] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.621682] kthread+0x2a7/0x350 [ 1965.622038] ? kthread_complete_and_exit+0x20/0x20 [ 1965.622495] ret_from_fork+0x22/0x30 [ 1965.622864] [ 1965.623264] Allocated by task 47877: [ 1965.623623] kasan_save_stack+0x1e/0x40 [ 1965.624005] __kasan_kmalloc+0x81/0xa0 [ 1965.624378] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.624894] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.625371] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.625973] kthread+0x2a7/0x350 [ 1965.626303] ret_from_fork+0x22/0x30 [ 1965.626820] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.627993] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.629228] The buggy address belongs to the physical page: [ 1965.629751] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.630682] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.631331] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.632086] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.632889] page dumped because: kasan: bad access detected [ 1965.633555] Memory state around the buggy address: [ 1965.634038] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.634730] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.635426] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.636119] ^ [ 1965.636643] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.637340] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.638043] ================================================================== [ 1965.638741] ================================================================== [ 1965.639441] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 1965.640406] Read of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.641284] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.642570] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.643122] Call Trace: [ 1965.643377] [ 1965.643588] ? kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 1965.644299] dump_stack_lvl+0x57/0x81 [ 1965.644688] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.645243] ? kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 1965.645959] print_report.cold+0x5c/0x237 [ 1965.646352] kasan_report+0xc9/0x100 [ 1965.646717] ? kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 1965.647431] kasan_bitops_test_and_modify.constprop.0+0x984/0x990 [test_kasan] [ 1965.648130] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.648768] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.649211] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.649689] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.650222] ? rcu_read_lock_held+0x30/0x50 [ 1965.650629] ? trace_kmalloc+0x3c/0x100 [ 1965.651017] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.651469] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.652021] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.652729] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.653298] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.653786] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.654268] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.654776] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.655366] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.655871] kthread+0x2a7/0x350 [ 1965.656210] ? kthread_complete_and_exit+0x20/0x20 [ 1965.656671] ret_from_fork+0x22/0x30 [ 1965.657048] [ 1965.657444] Allocated by task 47877: [ 1965.657800] kasan_save_stack+0x1e/0x40 [ 1965.658165] __kasan_kmalloc+0x81/0xa0 [ 1965.658517] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.659015] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.659505] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.660107] kthread+0x2a7/0x350 [ 1965.660414] ret_from_fork+0x22/0x30 [ 1965.660958] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.662110] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.663328] The buggy address belongs to the physical page: [ 1965.663855] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.664737] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.665399] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.666133] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.666861] page dumped because: kasan: bad access detected [ 1965.667567] Memory state around the buggy address: [ 1965.668055] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.668766] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.669461] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.670152] ^ [ 1965.670675] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.671369] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.672064] ================================================================== [ 1965.672768] ================================================================== [ 1965.673471] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 1965.674436] Write of size 8 at addr ffff888014d71c48 by task kunit_try_catch/47877 [ 1965.675326] CPU: 0 PID: 47877 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.676607] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.677153] Call Trace: [ 1965.677414] [ 1965.677640] ? kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 1965.678358] dump_stack_lvl+0x57/0x81 [ 1965.678725] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.679302] ? kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 1965.680042] print_report.cold+0x5c/0x237 [ 1965.680530] kasan_report+0xc9/0x100 [ 1965.680907] ? kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 1965.681623] kasan_check_range+0xfd/0x1e0 [ 1965.682025] kasan_bitops_test_and_modify.constprop.0+0x66e/0x990 [test_kasan] [ 1965.682762] ? kasan_bitops_modify.constprop.0+0x850/0x850 [test_kasan] [ 1965.683436] ? kunit_kfree+0x200/0x200 [kunit] [ 1965.683891] ? rcu_read_lock_sched_held+0x12/0x80 [ 1965.684355] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.684903] ? rcu_read_lock_held+0x30/0x50 [ 1965.685337] ? trace_kmalloc+0x3c/0x100 [ 1965.685742] ? kmem_cache_alloc_trace+0x1af/0x320 [ 1965.686227] kasan_bitops_generic+0x105/0x164 [test_kasan] [ 1965.686792] ? kasan_bitops_test_and_modify.constprop.0+0x990/0x990 [test_kasan] [ 1965.687518] ? kunit_unary_assert_format+0x1e0/0x1e0 [kunit] [ 1965.688091] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.688576] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.689077] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.689609] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.690226] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.690772] kthread+0x2a7/0x350 [ 1965.691129] ? kthread_complete_and_exit+0x20/0x20 [ 1965.691589] ret_from_fork+0x22/0x30 [ 1965.691980] [ 1965.692375] Allocated by task 47877: [ 1965.692735] kasan_save_stack+0x1e/0x40 [ 1965.693120] __kasan_kmalloc+0x81/0xa0 [ 1965.693537] kasan_bitops_generic+0x86/0x164 [test_kasan] [ 1965.694058] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.694525] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.695124] kthread+0x2a7/0x350 [ 1965.695455] ret_from_fork+0x22/0x30 [ 1965.695977] The buggy address belongs to the object at ffff888014d71c40 which belongs to the cache kmalloc-16 of size 16 [ 1965.697193] The buggy address is located 8 bytes inside of 16-byte region [ffff888014d71c40, ffff888014d71c50) [ 1965.698478] The buggy address belongs to the physical page: [ 1965.699018] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.699887] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.700573] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.701492] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.702300] page dumped because: kasan: bad access detected [ 1965.703062] Memory state around the buggy address: [ 1965.703651] ffff888014d71b00: 00 00 fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc [ 1965.704358] ffff888014d71b80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.705058] >ffff888014d71c00: fb fb fc fc 00 00 fc fc 00 01 fc fc fa fb fc fc [ 1965.705747] ^ [ 1965.706299] ffff888014d71c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.706996] ffff888014d71d00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.707666] ================================================================== [ 1965.709002] ok 45 - kasan_bitops_generic [ 1965.710927] ok 46 - kasan_bitops_tags # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 1965.713261] ================================================================== [ 1965.714754] BUG: KASAN: use-after-free in kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 1965.715536] Read of size 1 at addr ffff888014d71ea0 by task kunit_try_catch/47879 [ 1965.716443] CPU: 0 PID: 47879 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.717739] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.718293] Call Trace: [ 1965.718552] [ 1965.718763] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 1965.719343] dump_stack_lvl+0x57/0x81 [ 1965.719714] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.720287] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 1965.720841] print_report.cold+0x5c/0x237 [ 1965.721250] kasan_report+0xc9/0x100 [ 1965.721606] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 1965.722186] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 1965.722758] __kasan_check_byte+0x36/0x50 [ 1965.723158] kfree_sensitive+0x1b/0x60 [ 1965.723538] kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 1965.724079] ? vmalloc_oob+0x5e0/0x5e0 [test_kasan] [ 1965.724570] ? do_raw_spin_trylock+0xb5/0x180 [ 1965.725014] ? do_raw_spin_lock+0x270/0x270 [ 1965.725449] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.726007] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.726519] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.727003] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.727504] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.728092] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.728607] kthread+0x2a7/0x350 [ 1965.728941] ? kthread_complete_and_exit+0x20/0x20 [ 1965.729408] ret_from_fork+0x22/0x30 [ 1965.729774] [ 1965.730178] Allocated by task 47879: [ 1965.730537] kasan_save_stack+0x1e/0x40 [ 1965.730921] __kasan_kmalloc+0x81/0xa0 [ 1965.731296] kmalloc_double_kzfree+0x9a/0x270 [test_kasan] [ 1965.731832] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.732315] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.732917] kthread+0x2a7/0x350 [ 1965.733246] ret_from_fork+0x22/0x30 [ 1965.733765] Freed by task 47879: [ 1965.734099] kasan_save_stack+0x1e/0x40 [ 1965.734477] kasan_set_track+0x21/0x30 [ 1965.734852] kasan_set_free_info+0x20/0x40 [ 1965.735256] __kasan_slab_free+0x108/0x170 [ 1965.735660] slab_free_freelist_hook+0x11d/0x1d0 [ 1965.736166] kfree+0xe2/0x3c0 [ 1965.736512] kmalloc_double_kzfree+0x137/0x270 [test_kasan] [ 1965.737045] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.737515] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.738118] kthread+0x2a7/0x350 [ 1965.738446] ret_from_fork+0x22/0x30 [ 1965.738972] The buggy address belongs to the object at ffff888014d71ea0 which belongs to the cache kmalloc-16 of size 16 [ 1965.740144] The buggy address is located 0 bytes inside of 16-byte region [ffff888014d71ea0, ffff888014d71eb0) [ 1965.741386] The buggy address belongs to the physical page: [ 1965.741929] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.742801] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.743465] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.744205] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.744940] page dumped because: kasan: bad access detected [ 1965.745646] Memory state around the buggy address: [ 1965.746112] ffff888014d71d80: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 1965.746802] ffff888014d71e00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.747500] >ffff888014d71e80: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.748193] ^ [ 1965.748634] ffff888014d71f00: 00 00 fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.749330] ffff888014d71f80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.750010] ================================================================== [ 1965.750802] ================================================================== [ 1965.751512] BUG: KASAN: double-free or invalid-free in kfree+0xe2/0x3c0 [ 1965.752320] CPU: 0 PID: 47879 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.753613] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.754166] Call Trace: [ 1965.754425] [ 1965.754637] dump_stack_lvl+0x57/0x81 [ 1965.755013] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.755576] print_report.cold+0x5c/0x237 [ 1965.755977] ? kfree+0xe2/0x3c0 [ 1965.756303] ? kfree+0xe2/0x3c0 [ 1965.756626] kasan_report_invalid_free+0x99/0xc0 [ 1965.757086] ? kfree+0xe2/0x3c0 [ 1965.757406] ? kfree+0xe2/0x3c0 [ 1965.757729] __kasan_slab_free+0x152/0x170 [ 1965.758136] slab_free_freelist_hook+0x11d/0x1d0 [ 1965.758611] ? kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 1965.759169] kfree+0xe2/0x3c0 [ 1965.759477] ? __kasan_check_byte+0x36/0x50 [ 1965.759889] kmalloc_double_kzfree+0x1ad/0x270 [test_kasan] [ 1965.760435] ? vmalloc_oob+0x5e0/0x5e0 [test_kasan] [ 1965.760917] ? do_raw_spin_trylock+0xb5/0x180 [ 1965.761348] ? do_raw_spin_lock+0x270/0x270 [ 1965.761757] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.762314] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.762806] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.763280] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.763791] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.764394] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.764891] kthread+0x2a7/0x350 [ 1965.765227] ? kthread_complete_and_exit+0x20/0x20 [ 1965.765701] ret_from_fork+0x22/0x30 [ 1965.766068] [ 1965.766488] Allocated by task 47879: [ 1965.766824] kasan_save_stack+0x1e/0x40 [ 1965.767253] __kasan_kmalloc+0x81/0xa0 [ 1965.767627] kmalloc_double_kzfree+0x9a/0x270 [test_kasan] [ 1965.768196] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.768696] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.769301] kthread+0x2a7/0x350 [ 1965.769632] ret_from_fork+0x22/0x30 [ 1965.770179] Freed by task 47879: [ 1965.770488] kasan_save_stack+0x1e/0x40 [ 1965.770889] kasan_set_track+0x21/0x30 [ 1965.771246] kasan_set_free_info+0x20/0x40 [ 1965.771665] __kasan_slab_free+0x108/0x170 [ 1965.772088] slab_free_freelist_hook+0x11d/0x1d0 [ 1965.772564] kfree+0xe2/0x3c0 [ 1965.772873] kmalloc_double_kzfree+0x137/0x270 [test_kasan] [ 1965.773408] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.773904] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.774495] kthread+0x2a7/0x350 [ 1965.774821] ret_from_fork+0x22/0x30 [ 1965.775387] The buggy address belongs to the object at ffff888014d71ea0 which belongs to the cache kmalloc-16 of size 16 [ 1965.776511] The buggy address is located 0 bytes inside of 16-byte region [ffff888014d71ea0, ffff888014d71eb0) [ 1965.777755] The buggy address belongs to the physical page: [ 1965.778299] page:00000000270c53ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14d71 [ 1965.779171] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 1965.779877] raw: 000fffffc0000200 0000000000000000 dead000000000001 ffff8881000413c0 [ 1965.780721] raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 [ 1965.781531] page dumped because: kasan: bad access detected [ 1965.782263] Memory state around the buggy address: [ 1965.782788] ffff888014d71d80: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 1965.783559] ffff888014d71e00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.784305] >ffff888014d71e80: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 1965.785005] ^ [ 1965.785424] ffff888014d71f00: 00 00 fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.786180] ffff888014d71f80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 1965.786924] ================================================================== [ 1965.787720] ok 47 - kmalloc_double_kzfree [ 1965.789889] ok 48 - vmalloc_helpers_tags # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 1965.791034] ================================================================== [ 1965.792535] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x596/0x5e0 [test_kasan] [ 1965.793294] Read of size 1 at addr ffffc900000637f3 by task kunit_try_catch/47881 [ 1965.794222] CPU: 0 PID: 47881 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.795515] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.796075] Call Trace: [ 1965.796330] [ 1965.796559] ? vmalloc_oob+0x596/0x5e0 [test_kasan] [ 1965.797070] dump_stack_lvl+0x57/0x81 [ 1965.797440] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.798060] ? vmalloc_oob+0x596/0x5e0 [test_kasan] [ 1965.798540] print_report.cold+0x5c/0x237 [ 1965.798949] kasan_report+0xc9/0x100 [ 1965.799311] ? vmalloc_oob+0x596/0x5e0 [test_kasan] [ 1965.799794] vmalloc_oob+0x596/0x5e0 [test_kasan] [ 1965.800299] ? kasan_global_oob_right+0x1f0/0x1f0 [test_kasan] [ 1965.800929] ? do_raw_spin_trylock+0xb5/0x180 [ 1965.801382] ? do_raw_spin_lock+0x270/0x270 [ 1965.801796] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.802336] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.802848] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.803332] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.803820] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.804429] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.804953] kthread+0x2a7/0x350 [ 1965.805265] ? kthread_complete_and_exit+0x20/0x20 [ 1965.805751] ret_from_fork+0x22/0x30 [ 1965.806120] [ 1965.806521] The buggy address belongs to the virtual mapping at [ffffc90000063000, ffffc90000065000) created by: vmalloc_oob+0x78/0x5e0 [test_kasan] [ 1965.808249] The buggy address belongs to the physical page: [ 1965.808750] page:000000000da0be5b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2582 [ 1965.809640] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 1965.810270] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 1965.811200] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1965.812028] page dumped because: kasan: bad access detected [ 1965.812832] Memory state around the buggy address: [ 1965.813373] ffffc90000063680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1965.814108] ffffc90000063700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1965.814848] >ffffc90000063780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8 [ 1965.815530] ^ [ 1965.816190] ffffc90000063800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1965.816882] ffffc90000063880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1965.817578] ================================================================== [ 1965.818346] ================================================================== [ 1965.819058] BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 1965.819806] Read of size 1 at addr ffffc900000637f8 by task kunit_try_catch/47881 [ 1965.820708] CPU: 0 PID: 47881 Comm: kunit_try_catch Kdump: loaded Tainted: G B --------- --- 5.14.0-253.1995_764580423.el9.x86_64+debug #1 [ 1965.821993] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1965.822555] Call Trace: [ 1965.822814] [ 1965.823032] ? vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 1965.823527] dump_stack_lvl+0x57/0x81 [ 1965.823876] print_address_description.constprop.0+0x1f/0x1e0 [ 1965.824451] ? vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 1965.824951] print_report.cold+0x5c/0x237 [ 1965.825328] kasan_report+0xc9/0x100 [ 1965.825711] ? vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 1965.826195] vmalloc_oob+0x58c/0x5e0 [test_kasan] [ 1965.826674] ? kasan_global_oob_right+0x1f0/0x1f0 [test_kasan] [ 1965.827264] ? do_raw_spin_trylock+0xb5/0x180 [ 1965.827697] ? do_raw_spin_lock+0x270/0x270 [ 1965.828116] ? kunit_fail_assert_format+0x100/0x100 [kunit] [ 1965.828668] ? kunit_add_resource+0x197/0x280 [kunit] [ 1965.829170] kunit_try_run_case+0x10b/0x1a0 [kunit] [ 1965.829644] ? kunit_catch_run_case+0xe0/0xe0 [kunit] [ 1965.830158] kunit_generic_run_threadfn_adapter+0x4d/0x90 [kunit] [ 1965.830802] ? kunit_try_catch_throw+0x80/0x80 [kunit] [ 1965.831308] kthread+0x2a7/0x350 [ 1965.831638] ? kthread_complete_and_exit+0x20/0x20 [ 1965.832117] ret_from_fork+0x22/0x30 [ 1965.832477] [ 1965.832899] The buggy address belongs to the virtual mapping at [ffffc90000063000, ffffc90000065000) created by: vmalloc_oob+0x78/0x5e0 [test_kasan] [ 1965.834580] The buggy address belongs to the physical page: [ 1965.835129] page:000000000da0be5b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2582 [ 1965.835996] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 1965.836618] raw: 000fffffc0000000 0000000000000000 dead000000000122 0000000000000000 [ 1965.837355] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1965.838093] page dumped because: kasan: bad access detected [ 1965.838796] Memory state around the buggy address: [ 1965.839268] ffffc90000063680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1965.839962] ffffc90000063700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1965.840703] >ffffc90000063780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8 [ 1965.841398] ^ [ 1965.842084] ffffc90000063800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1965.842772] ffffc90000063880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1965.843462] ================================================================== [ 1965.913983] ok 49 - vmalloc_oob [ 1965.914845] ok 50 - vmap_tags # SKIP Test requires CONFIG_KASAN_SW_TAGS=y [ 1965.916009] ok 51 - vm_map_ram_tags # SKIP Test requires CONFIG_KASAN_SW_TAGS=y [ 1965.918843] ok 52 - vmalloc_percpu # SKIP Test requires CONFIG_KASAN_SW_TAGS=y [ 1965.920158] ok 53 - match_all_not_assigned # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 1965.922822] ok 54 - match_all_ptr_tag # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 1965.924999] ok 55 - match_all_mem_tag # SKIP Test requires CONFIG_KASAN_GENERIC=n [ 1965.925843] ok 20 - kasan [ 1966.167851] # Subtest: linear-ranges-test [ 1966.167858] 1..4 [ 1966.171030] ok 1 - range_test_get_value_amount [ 1966.172887] ok 2 - range_test_get_selector_high [ 1966.174977] ok 3 - range_test_get_selector_low [ 1966.177827] ok 4 - range_test_get_value [ 1966.178310] ok 21 - linear-ranges-test [ 1966.270668] # Subtest: list_sort [ 1966.270673] 1..1 [ 1966.282095] ok 1 - list_sort_test [ 1966.282361] ok 22 - list_sort [ 1966.508998] systemd-journald[564]: Data hash table of /run/log/journal/ed2acc9453d44c2a88e8e35173ed2323/system.journal has a fill level at 75.0 (7003 of 9336 items, 5378048 file size, 767 bytes per hash table item), suggesting rotation. [ 1966.517082] # Subtest: time_test_cases [ 1966.517088] 1..1 [ 1970.045968] ok 1 - time64_to_tm_test_date_range [ 1970.046237] ok 23 - time_test_cases [ 1970.060205] systemd-journald[564]: /run/log/journal/ed2acc9453d44c2a88e8e35173ed2323/system.journal: Journal header limits reached or header out-of-date, rotating.