Date
July 12, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.661508] ================================================================== [ 19.661568] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 19.661618] Write of size 1 at addr fff00000c7897b78 by task kunit_try_catch/285 [ 19.661672] [ 19.661704] CPU: 1 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.661789] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.661816] Hardware name: linux,dummy-virt (DT) [ 19.661847] Call trace: [ 19.661872] show_stack+0x20/0x38 (C) [ 19.661920] dump_stack_lvl+0x8c/0xd0 [ 19.661973] print_report+0x118/0x5d0 [ 19.662019] kasan_report+0xdc/0x128 [ 19.662067] __asan_report_store1_noabort+0x20/0x30 [ 19.662118] strncpy_from_user+0x270/0x2a0 [ 19.662168] copy_user_test_oob+0x5c0/0xec8 [ 19.662260] kunit_try_run_case+0x170/0x3f0 [ 19.662337] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.662529] kthread+0x328/0x630 [ 19.662655] ret_from_fork+0x10/0x20 [ 19.662711] [ 19.662796] Allocated by task 285: [ 19.662873] kasan_save_stack+0x3c/0x68 [ 19.662970] kasan_save_track+0x20/0x40 [ 19.663016] kasan_save_alloc_info+0x40/0x58 [ 19.663060] __kasan_kmalloc+0xd4/0xd8 [ 19.663098] __kmalloc_noprof+0x198/0x4c8 [ 19.663138] kunit_kmalloc_array+0x34/0x88 [ 19.663318] copy_user_test_oob+0xac/0xec8 [ 19.663367] kunit_try_run_case+0x170/0x3f0 [ 19.663955] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.664070] kthread+0x328/0x630 [ 19.664240] ret_from_fork+0x10/0x20 [ 19.664358] [ 19.664491] The buggy address belongs to the object at fff00000c7897b00 [ 19.664491] which belongs to the cache kmalloc-128 of size 128 [ 19.664591] The buggy address is located 0 bytes to the right of [ 19.664591] allocated 120-byte region [fff00000c7897b00, fff00000c7897b78) [ 19.664688] [ 19.664709] The buggy address belongs to the physical page: [ 19.664744] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107897 [ 19.665095] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.665233] page_type: f5(slab) [ 19.665435] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.665649] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.665698] page dumped because: kasan: bad access detected [ 19.665732] [ 19.666068] Memory state around the buggy address: [ 19.666198] fff00000c7897a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.666304] fff00000c7897a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.666497] >fff00000c7897b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.666696] ^ [ 19.666761] fff00000c7897b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.666883] fff00000c7897c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.666940] ================================================================== [ 19.656011] ================================================================== [ 19.656111] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 19.656190] Write of size 121 at addr fff00000c7897b00 by task kunit_try_catch/285 [ 19.656454] [ 19.656511] CPU: 1 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.656628] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.656684] Hardware name: linux,dummy-virt (DT) [ 19.656720] Call trace: [ 19.656742] show_stack+0x20/0x38 (C) [ 19.656793] dump_stack_lvl+0x8c/0xd0 [ 19.657040] print_report+0x118/0x5d0 [ 19.657107] kasan_report+0xdc/0x128 [ 19.657154] kasan_check_range+0x100/0x1a8 [ 19.657257] __kasan_check_write+0x20/0x30 [ 19.657323] strncpy_from_user+0x3c/0x2a0 [ 19.657375] copy_user_test_oob+0x5c0/0xec8 [ 19.657424] kunit_try_run_case+0x170/0x3f0 [ 19.657621] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.657688] kthread+0x328/0x630 [ 19.657731] ret_from_fork+0x10/0x20 [ 19.657779] [ 19.658033] Allocated by task 285: [ 19.658096] kasan_save_stack+0x3c/0x68 [ 19.658149] kasan_save_track+0x20/0x40 [ 19.658201] kasan_save_alloc_info+0x40/0x58 [ 19.658389] __kasan_kmalloc+0xd4/0xd8 [ 19.658443] __kmalloc_noprof+0x198/0x4c8 [ 19.658525] kunit_kmalloc_array+0x34/0x88 [ 19.658639] copy_user_test_oob+0xac/0xec8 [ 19.658696] kunit_try_run_case+0x170/0x3f0 [ 19.658775] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.658827] kthread+0x328/0x630 [ 19.658927] ret_from_fork+0x10/0x20 [ 19.658984] [ 19.659023] The buggy address belongs to the object at fff00000c7897b00 [ 19.659023] which belongs to the cache kmalloc-128 of size 128 [ 19.659086] The buggy address is located 0 bytes inside of [ 19.659086] allocated 120-byte region [fff00000c7897b00, fff00000c7897b78) [ 19.659154] [ 19.659300] The buggy address belongs to the physical page: [ 19.659338] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107897 [ 19.659499] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.659644] page_type: f5(slab) [ 19.659726] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.659975] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.660131] page dumped because: kasan: bad access detected [ 19.660300] [ 19.660395] Memory state around the buggy address: [ 19.660531] fff00000c7897a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.660675] fff00000c7897a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.660804] >fff00000c7897b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.660871] ^ [ 19.660916] fff00000c7897b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.660990] fff00000c7897c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.661033] ==================================================================
[ 16.921372] ================================================================== [ 16.921814] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 16.922134] Write of size 121 at addr ffff888103a67500 by task kunit_try_catch/302 [ 16.922383] [ 16.922465] CPU: 0 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 16.922505] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.922518] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.922539] Call Trace: [ 16.922556] <TASK> [ 16.922570] dump_stack_lvl+0x73/0xb0 [ 16.922597] print_report+0xd1/0x610 [ 16.922620] ? __virt_addr_valid+0x1db/0x2d0 [ 16.922644] ? strncpy_from_user+0x2e/0x1d0 [ 16.922669] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.922694] ? strncpy_from_user+0x2e/0x1d0 [ 16.922722] kasan_report+0x141/0x180 [ 16.922745] ? strncpy_from_user+0x2e/0x1d0 [ 16.922787] kasan_check_range+0x10c/0x1c0 [ 16.922812] __kasan_check_write+0x18/0x20 [ 16.922833] strncpy_from_user+0x2e/0x1d0 [ 16.922869] ? __kasan_check_read+0x15/0x20 [ 16.922892] copy_user_test_oob+0x760/0x10f0 [ 16.922920] ? __pfx_copy_user_test_oob+0x10/0x10 [ 16.922945] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 16.922977] ? __pfx_copy_user_test_oob+0x10/0x10 [ 16.923006] kunit_try_run_case+0x1a5/0x480 [ 16.923032] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.923056] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.923081] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.923107] ? __kthread_parkme+0x82/0x180 [ 16.923128] ? preempt_count_sub+0x50/0x80 [ 16.923153] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.923179] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.923204] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.923233] kthread+0x337/0x6f0 [ 16.923253] ? trace_preempt_on+0x20/0xc0 [ 16.923287] ? __pfx_kthread+0x10/0x10 [ 16.923309] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.923333] ? calculate_sigpending+0x7b/0xa0 [ 16.923358] ? __pfx_kthread+0x10/0x10 [ 16.923381] ret_from_fork+0x116/0x1d0 [ 16.923400] ? __pfx_kthread+0x10/0x10 [ 16.923432] ret_from_fork_asm+0x1a/0x30 [ 16.923464] </TASK> [ 16.923475] [ 16.930816] Allocated by task 302: [ 16.930978] kasan_save_stack+0x45/0x70 [ 16.931184] kasan_save_track+0x18/0x40 [ 16.931387] kasan_save_alloc_info+0x3b/0x50 [ 16.931565] __kasan_kmalloc+0xb7/0xc0 [ 16.931702] __kmalloc_noprof+0x1c9/0x500 [ 16.931844] kunit_kmalloc_array+0x25/0x60 [ 16.931989] copy_user_test_oob+0xab/0x10f0 [ 16.932138] kunit_try_run_case+0x1a5/0x480 [ 16.932305] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.932559] kthread+0x337/0x6f0 [ 16.932749] ret_from_fork+0x116/0x1d0 [ 16.932934] ret_from_fork_asm+0x1a/0x30 [ 16.933131] [ 16.933225] The buggy address belongs to the object at ffff888103a67500 [ 16.933225] which belongs to the cache kmalloc-128 of size 128 [ 16.933727] The buggy address is located 0 bytes inside of [ 16.933727] allocated 120-byte region [ffff888103a67500, ffff888103a67578) [ 16.934087] [ 16.934159] The buggy address belongs to the physical page: [ 16.934341] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a67 [ 16.934721] flags: 0x200000000000000(node=0|zone=2) [ 16.934981] page_type: f5(slab) [ 16.935149] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 16.935523] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.935859] page dumped because: kasan: bad access detected [ 16.936135] [ 16.936228] Memory state around the buggy address: [ 16.936489] ffff888103a67400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.936806] ffff888103a67480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.937054] >ffff888103a67500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.937403] ^ [ 16.937620] ffff888103a67580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.937939] ffff888103a67600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.938234] ================================================================== [ 16.938880] ================================================================== [ 16.939276] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 16.939618] Write of size 1 at addr ffff888103a67578 by task kunit_try_catch/302 [ 16.939946] [ 16.940059] CPU: 0 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 16.940112] Tainted: [B]=BAD_PAGE, [N]=TEST [ 16.940125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 16.940147] Call Trace: [ 16.940171] <TASK> [ 16.940186] dump_stack_lvl+0x73/0xb0 [ 16.940213] print_report+0xd1/0x610 [ 16.940238] ? __virt_addr_valid+0x1db/0x2d0 [ 16.940272] ? strncpy_from_user+0x1a5/0x1d0 [ 16.940297] ? kasan_complete_mode_report_info+0x2a/0x200 [ 16.940322] ? strncpy_from_user+0x1a5/0x1d0 [ 16.940347] kasan_report+0x141/0x180 [ 16.940370] ? strncpy_from_user+0x1a5/0x1d0 [ 16.940399] __asan_report_store1_noabort+0x1b/0x30 [ 16.940426] strncpy_from_user+0x1a5/0x1d0 [ 16.940453] copy_user_test_oob+0x760/0x10f0 [ 16.940481] ? __pfx_copy_user_test_oob+0x10/0x10 [ 16.940506] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 16.940538] ? __pfx_copy_user_test_oob+0x10/0x10 [ 16.940568] kunit_try_run_case+0x1a5/0x480 [ 16.940594] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.940618] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 16.940644] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 16.940669] ? __kthread_parkme+0x82/0x180 [ 16.940691] ? preempt_count_sub+0x50/0x80 [ 16.940716] ? __pfx_kunit_try_run_case+0x10/0x10 [ 16.940742] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.940768] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 16.940795] kthread+0x337/0x6f0 [ 16.940816] ? trace_preempt_on+0x20/0xc0 [ 16.940840] ? __pfx_kthread+0x10/0x10 [ 16.940872] ? _raw_spin_unlock_irq+0x47/0x80 [ 16.940895] ? calculate_sigpending+0x7b/0xa0 [ 16.940921] ? __pfx_kthread+0x10/0x10 [ 16.940958] ret_from_fork+0x116/0x1d0 [ 16.940978] ? __pfx_kthread+0x10/0x10 [ 16.941000] ret_from_fork_asm+0x1a/0x30 [ 16.941045] </TASK> [ 16.941056] [ 16.947730] Allocated by task 302: [ 16.947866] kasan_save_stack+0x45/0x70 [ 16.948010] kasan_save_track+0x18/0x40 [ 16.948229] kasan_save_alloc_info+0x3b/0x50 [ 16.948449] __kasan_kmalloc+0xb7/0xc0 [ 16.948637] __kmalloc_noprof+0x1c9/0x500 [ 16.948839] kunit_kmalloc_array+0x25/0x60 [ 16.949042] copy_user_test_oob+0xab/0x10f0 [ 16.949271] kunit_try_run_case+0x1a5/0x480 [ 16.949490] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 16.949745] kthread+0x337/0x6f0 [ 16.949893] ret_from_fork+0x116/0x1d0 [ 16.950028] ret_from_fork_asm+0x1a/0x30 [ 16.950171] [ 16.950242] The buggy address belongs to the object at ffff888103a67500 [ 16.950242] which belongs to the cache kmalloc-128 of size 128 [ 16.950614] The buggy address is located 0 bytes to the right of [ 16.950614] allocated 120-byte region [ffff888103a67500, ffff888103a67578) [ 16.951226] [ 16.951347] The buggy address belongs to the physical page: [ 16.951632] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a67 [ 16.952005] flags: 0x200000000000000(node=0|zone=2) [ 16.952280] page_type: f5(slab) [ 16.952451] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 16.952802] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 16.953073] page dumped because: kasan: bad access detected [ 16.953298] [ 16.953396] Memory state around the buggy address: [ 16.953643] ffff888103a67400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 16.953940] ffff888103a67480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.954248] >ffff888103a67500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 16.954519] ^ [ 16.954801] ffff888103a67580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.955088] ffff888103a67600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 16.955374] ==================================================================