Date
July 4, 2025, 11:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 21.148061] ================================================================== [ 21.148115] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 21.148170] Write of size 1 at addr fff00000c6f35278 by task kunit_try_catch/285 [ 21.148220] [ 21.149614] CPU: 1 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 21.149733] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.149873] Hardware name: linux,dummy-virt (DT) [ 21.150199] Call trace: [ 21.150243] show_stack+0x20/0x38 (C) [ 21.150296] dump_stack_lvl+0x8c/0xd0 [ 21.150349] print_report+0x118/0x608 [ 21.150452] kasan_report+0xdc/0x128 [ 21.150787] __asan_report_store1_noabort+0x20/0x30 [ 21.150866] strncpy_from_user+0x270/0x2a0 [ 21.150918] copy_user_test_oob+0x5c0/0xec8 [ 21.151313] kunit_try_run_case+0x170/0x3f0 [ 21.151469] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.151762] kthread+0x328/0x630 [ 21.152153] ret_from_fork+0x10/0x20 [ 21.152409] [ 21.152561] Allocated by task 285: [ 21.152909] kasan_save_stack+0x3c/0x68 [ 21.153164] kasan_save_track+0x20/0x40 [ 21.153565] kasan_save_alloc_info+0x40/0x58 [ 21.154055] __kasan_kmalloc+0xd4/0xd8 [ 21.154305] __kmalloc_noprof+0x198/0x4c8 [ 21.154417] kunit_kmalloc_array+0x34/0x88 [ 21.154458] copy_user_test_oob+0xac/0xec8 [ 21.154964] kunit_try_run_case+0x170/0x3f0 [ 21.155182] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.155266] kthread+0x328/0x630 [ 21.155371] ret_from_fork+0x10/0x20 [ 21.155412] [ 21.155444] The buggy address belongs to the object at fff00000c6f35200 [ 21.155444] which belongs to the cache kmalloc-128 of size 128 [ 21.155525] The buggy address is located 0 bytes to the right of [ 21.155525] allocated 120-byte region [fff00000c6f35200, fff00000c6f35278) [ 21.155596] [ 21.155975] The buggy address belongs to the physical page: [ 21.156048] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106f35 [ 21.156480] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.156561] page_type: f5(slab) [ 21.156902] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 21.157014] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.157303] page dumped because: kasan: bad access detected [ 21.157376] [ 21.157482] Memory state around the buggy address: [ 21.157529] fff00000c6f35100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.157840] fff00000c6f35180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.158266] >fff00000c6f35200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 21.158382] ^ [ 21.158890] fff00000c6f35280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.159024] fff00000c6f35300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.159067] ================================================================== [ 21.140655] ================================================================== [ 21.140708] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 21.140765] Write of size 121 at addr fff00000c6f35200 by task kunit_try_catch/285 [ 21.140835] [ 21.140866] CPU: 1 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 21.140945] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.140973] Hardware name: linux,dummy-virt (DT) [ 21.141005] Call trace: [ 21.141056] show_stack+0x20/0x38 (C) [ 21.141107] dump_stack_lvl+0x8c/0xd0 [ 21.141156] print_report+0x118/0x608 [ 21.141204] kasan_report+0xdc/0x128 [ 21.141252] kasan_check_range+0x100/0x1a8 [ 21.141301] __kasan_check_write+0x20/0x30 [ 21.141427] strncpy_from_user+0x3c/0x2a0 [ 21.141479] copy_user_test_oob+0x5c0/0xec8 [ 21.141528] kunit_try_run_case+0x170/0x3f0 [ 21.141576] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.141630] kthread+0x328/0x630 [ 21.141675] ret_from_fork+0x10/0x20 [ 21.141724] [ 21.141744] Allocated by task 285: [ 21.141790] kasan_save_stack+0x3c/0x68 [ 21.141851] kasan_save_track+0x20/0x40 [ 21.141997] kasan_save_alloc_info+0x40/0x58 [ 21.142039] __kasan_kmalloc+0xd4/0xd8 [ 21.142078] __kmalloc_noprof+0x198/0x4c8 [ 21.142792] kunit_kmalloc_array+0x34/0x88 [ 21.142871] copy_user_test_oob+0xac/0xec8 [ 21.142912] kunit_try_run_case+0x170/0x3f0 [ 21.143479] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.143531] kthread+0x328/0x630 [ 21.143565] ret_from_fork+0x10/0x20 [ 21.143604] [ 21.143625] The buggy address belongs to the object at fff00000c6f35200 [ 21.143625] which belongs to the cache kmalloc-128 of size 128 [ 21.143685] The buggy address is located 0 bytes inside of [ 21.143685] allocated 120-byte region [fff00000c6f35200, fff00000c6f35278) [ 21.144538] [ 21.144616] The buggy address belongs to the physical page: [ 21.144652] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106f35 [ 21.145083] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.145190] page_type: f5(slab) [ 21.145260] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 21.145576] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.145630] page dumped because: kasan: bad access detected [ 21.145895] [ 21.146086] Memory state around the buggy address: [ 21.146153] fff00000c6f35100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.146238] fff00000c6f35180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.146318] >fff00000c6f35200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 21.146636] ^ [ 21.146695] fff00000c6f35280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.147083] fff00000c6f35300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.147344] ==================================================================
[ 16.256971] ================================================================== [ 16.257385] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 16.257688] Write of size 1 at addr ffff888103980f78 by task kunit_try_catch/302 [ 16.257976] [ 16.258095] CPU: 1 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 16.258144] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.258158] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.258183] Call Trace: [ 16.258205] <TASK> [ 16.258238] dump_stack_lvl+0x73/0xb0 [ 16.258281] print_report+0xd1/0x650 [ 16.258306] ? __virt_addr_valid+0x1db/0x2d0 [ 16.258329] ? strncpy_from_user+0x1a5/0x1d0 [ 16.258351] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.258374] ? strncpy_from_user+0x1a5/0x1d0 [ 16.258397] kasan_report+0x141/0x180 [ 16.258420] ? strncpy_from_user+0x1a5/0x1d0 [ 16.258448] __asan_report_store1_noabort+0x1b/0x30 [ 16.258468] strncpy_from_user+0x1a5/0x1d0 [ 16.258494] copy_user_test_oob+0x760/0x10f0 [ 16.258520] ? __pfx_copy_user_test_oob+0x10/0x10 [ 16.258543] ? finish_task_switch.isra.0+0x153/0x700 [ 16.258566] ? __switch_to+0x47/0xf50 [ 16.258592] ? __schedule+0x10cc/0x2b60 [ 16.258614] ? __pfx_read_tsc+0x10/0x10 [ 16.258636] ? ktime_get_ts64+0x86/0x230 [ 16.258661] kunit_try_run_case+0x1a5/0x480 [ 16.258686] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.258709] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.258733] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.258756] ? __kthread_parkme+0x82/0x180 [ 16.258778] ? preempt_count_sub+0x50/0x80 [ 16.258801] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.258824] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.258847] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.258870] kthread+0x337/0x6f0 [ 16.258890] ? trace_preempt_on+0x20/0xc0 [ 16.258914] ? __pfx_kthread+0x10/0x10 [ 16.258935] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.258956] ? calculate_sigpending+0x7b/0xa0 [ 16.258981] ? __pfx_kthread+0x10/0x10 [ 16.259002] ret_from_fork+0x116/0x1d0 [ 16.259021] ? __pfx_kthread+0x10/0x10 [ 16.259042] ret_from_fork_asm+0x1a/0x30 [ 16.259073] </TASK> [ 16.259085] [ 16.266177] Allocated by task 302: [ 16.266389] kasan_save_stack+0x45/0x70 [ 16.266594] kasan_save_track+0x18/0x40 [ 16.266791] kasan_save_alloc_info+0x3b/0x50 [ 16.267006] __kasan_kmalloc+0xb7/0xc0 [ 16.267140] __kmalloc_noprof+0x1c9/0x500 [ 16.267354] kunit_kmalloc_array+0x25/0x60 [ 16.267564] copy_user_test_oob+0xab/0x10f0 [ 16.267779] kunit_try_run_case+0x1a5/0x480 [ 16.267970] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.268196] kthread+0x337/0x6f0 [ 16.268411] ret_from_fork+0x116/0x1d0 [ 16.268595] ret_from_fork_asm+0x1a/0x30 [ 16.268764] [ 16.268880] The buggy address belongs to the object at ffff888103980f00 [ 16.268880] which belongs to the cache kmalloc-128 of size 128 [ 16.269256] The buggy address is located 0 bytes to the right of [ 16.269256] allocated 120-byte region [ffff888103980f00, ffff888103980f78) [ 16.269881] [ 16.269983] The buggy address belongs to the physical page: [ 16.270247] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103980 [ 16.270620] flags: 0x200000000000000(node=0|zone=2) [ 16.270913] page_type: f5(slab) [ 16.271059] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 16.271305] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.271533] page dumped because: kasan: bad access detected [ 16.271746] [ 16.271849] Memory state around the buggy address: [ 16.272075] ffff888103980e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.272399] ffff888103980e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.272865] >ffff888103980f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.273106] ^ [ 16.273553] ffff888103980f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.273883] ffff888103981000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.274161] ================================================================== [ 16.234786] ================================================================== [ 16.235150] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 16.235506] Write of size 121 at addr ffff888103980f00 by task kunit_try_catch/302 [ 16.235848] [ 16.235960] CPU: 1 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 16.236008] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.236023] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.236061] Call Trace: [ 16.236084] <TASK> [ 16.236106] dump_stack_lvl+0x73/0xb0 [ 16.236138] print_report+0xd1/0x650 [ 16.236163] ? __virt_addr_valid+0x1db/0x2d0 [ 16.236189] ? strncpy_from_user+0x2e/0x1d0 [ 16.236211] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.236246] ? strncpy_from_user+0x2e/0x1d0 [ 16.236278] kasan_report+0x141/0x180 [ 16.236300] ? strncpy_from_user+0x2e/0x1d0 [ 16.236328] kasan_check_range+0x10c/0x1c0 [ 16.236354] __kasan_check_write+0x18/0x20 [ 16.236377] strncpy_from_user+0x2e/0x1d0 [ 16.236401] ? __kasan_check_read+0x15/0x20 [ 16.236423] copy_user_test_oob+0x760/0x10f0 [ 16.236449] ? __pfx_copy_user_test_oob+0x10/0x10 [ 16.236472] ? finish_task_switch.isra.0+0x153/0x700 [ 16.236495] ? __switch_to+0x47/0xf50 [ 16.236522] ? __schedule+0x10cc/0x2b60 [ 16.236545] ? __pfx_read_tsc+0x10/0x10 [ 16.236568] ? ktime_get_ts64+0x86/0x230 [ 16.236594] kunit_try_run_case+0x1a5/0x480 [ 16.236621] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.236643] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.236667] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.236690] ? __kthread_parkme+0x82/0x180 [ 16.236712] ? preempt_count_sub+0x50/0x80 [ 16.236735] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.236759] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.236782] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.236813] kthread+0x337/0x6f0 [ 16.236832] ? trace_preempt_on+0x20/0xc0 [ 16.236856] ? __pfx_kthread+0x10/0x10 [ 16.236877] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.236898] ? calculate_sigpending+0x7b/0xa0 [ 16.236923] ? __pfx_kthread+0x10/0x10 [ 16.236945] ret_from_fork+0x116/0x1d0 [ 16.236964] ? __pfx_kthread+0x10/0x10 [ 16.236986] ret_from_fork_asm+0x1a/0x30 [ 16.237018] </TASK> [ 16.237031] [ 16.244398] Allocated by task 302: [ 16.244638] kasan_save_stack+0x45/0x70 [ 16.244852] kasan_save_track+0x18/0x40 [ 16.245039] kasan_save_alloc_info+0x3b/0x50 [ 16.245258] __kasan_kmalloc+0xb7/0xc0 [ 16.245612] __kmalloc_noprof+0x1c9/0x500 [ 16.245812] kunit_kmalloc_array+0x25/0x60 [ 16.245968] copy_user_test_oob+0xab/0x10f0 [ 16.246116] kunit_try_run_case+0x1a5/0x480 [ 16.247457] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.247743] kthread+0x337/0x6f0 [ 16.247917] ret_from_fork+0x116/0x1d0 [ 16.248105] ret_from_fork_asm+0x1a/0x30 [ 16.248676] [ 16.248808] The buggy address belongs to the object at ffff888103980f00 [ 16.248808] which belongs to the cache kmalloc-128 of size 128 [ 16.249488] The buggy address is located 0 bytes inside of [ 16.249488] allocated 120-byte region [ffff888103980f00, ffff888103980f78) [ 16.250229] [ 16.250469] The buggy address belongs to the physical page: [ 16.250744] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103980 [ 16.251084] flags: 0x200000000000000(node=0|zone=2) [ 16.251527] page_type: f5(slab) [ 16.251842] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 16.252526] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.252933] page dumped because: kasan: bad access detected [ 16.253181] [ 16.253469] Memory state around the buggy address: [ 16.253844] ffff888103980e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.254522] ffff888103980e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.254914] >ffff888103980f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.255211] ^ [ 16.255440] ffff888103980f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.255977] ffff888103981000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.256233] ==================================================================