Date
July 6, 2025, 11:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 | |
| x86 |
[ 20.223415] ================================================================== [ 20.223473] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x3c8/0xec8 [ 20.223526] Read of size 121 at addr fff00000c77ac300 by task kunit_try_catch/286 [ 20.223578] [ 20.223614] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 20.225209] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.225255] Hardware name: linux,dummy-virt (DT) [ 20.225288] Call trace: [ 20.225348] show_stack+0x20/0x38 (C) [ 20.225612] dump_stack_lvl+0x8c/0xd0 [ 20.225669] print_report+0x118/0x608 [ 20.225718] kasan_report+0xdc/0x128 [ 20.225762] kasan_check_range+0x100/0x1a8 [ 20.225811] __kasan_check_read+0x20/0x30 [ 20.226143] copy_user_test_oob+0x3c8/0xec8 [ 20.226206] kunit_try_run_case+0x170/0x3f0 [ 20.226701] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.226913] kthread+0x328/0x630 [ 20.226960] ret_from_fork+0x10/0x20 [ 20.227023] [ 20.227044] Allocated by task 286: [ 20.227592] kasan_save_stack+0x3c/0x68 [ 20.227659] kasan_save_track+0x20/0x40 [ 20.227699] kasan_save_alloc_info+0x40/0x58 [ 20.227749] __kasan_kmalloc+0xd4/0xd8 [ 20.227929] __kmalloc_noprof+0x198/0x4c8 [ 20.228299] kunit_kmalloc_array+0x34/0x88 [ 20.228408] copy_user_test_oob+0xac/0xec8 [ 20.228742] kunit_try_run_case+0x170/0x3f0 [ 20.229194] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.229440] kthread+0x328/0x630 [ 20.229482] ret_from_fork+0x10/0x20 [ 20.229521] [ 20.229543] The buggy address belongs to the object at fff00000c77ac300 [ 20.229543] which belongs to the cache kmalloc-128 of size 128 [ 20.229656] The buggy address is located 0 bytes inside of [ 20.229656] allocated 120-byte region [fff00000c77ac300, fff00000c77ac378) [ 20.230089] [ 20.230321] The buggy address belongs to the physical page: [ 20.230569] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077ac [ 20.230695] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.230748] page_type: f5(slab) [ 20.230962] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.231038] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.231084] page dumped because: kasan: bad access detected [ 20.231194] [ 20.231359] Memory state around the buggy address: [ 20.231400] fff00000c77ac200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.231470] fff00000c77ac280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.231858] >fff00000c77ac300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.232060] ^ [ 20.232121] fff00000c77ac380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.232206] fff00000c77ac400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.232248] ================================================================== [ 20.243668] ================================================================== [ 20.243722] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x4a0/0xec8 [ 20.243773] Read of size 121 at addr fff00000c77ac300 by task kunit_try_catch/286 [ 20.243827] [ 20.243859] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 20.244674] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.244730] Hardware name: linux,dummy-virt (DT) [ 20.244952] Call trace: [ 20.244987] show_stack+0x20/0x38 (C) [ 20.245268] dump_stack_lvl+0x8c/0xd0 [ 20.245439] print_report+0x118/0x608 [ 20.245734] kasan_report+0xdc/0x128 [ 20.245791] kasan_check_range+0x100/0x1a8 [ 20.245922] __kasan_check_read+0x20/0x30 [ 20.246132] copy_user_test_oob+0x4a0/0xec8 [ 20.246184] kunit_try_run_case+0x170/0x3f0 [ 20.246513] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.246568] kthread+0x328/0x630 [ 20.246851] ret_from_fork+0x10/0x20 [ 20.247340] [ 20.247448] Allocated by task 286: [ 20.247491] kasan_save_stack+0x3c/0x68 [ 20.247535] kasan_save_track+0x20/0x40 [ 20.247575] kasan_save_alloc_info+0x40/0x58 [ 20.247624] __kasan_kmalloc+0xd4/0xd8 [ 20.247663] __kmalloc_noprof+0x198/0x4c8 [ 20.247937] kunit_kmalloc_array+0x34/0x88 [ 20.247991] copy_user_test_oob+0xac/0xec8 [ 20.248608] kunit_try_run_case+0x170/0x3f0 [ 20.248895] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.249284] kthread+0x328/0x630 [ 20.249323] ret_from_fork+0x10/0x20 [ 20.249362] [ 20.249763] The buggy address belongs to the object at fff00000c77ac300 [ 20.249763] which belongs to the cache kmalloc-128 of size 128 [ 20.250036] The buggy address is located 0 bytes inside of [ 20.250036] allocated 120-byte region [fff00000c77ac300, fff00000c77ac378) [ 20.250106] [ 20.250129] The buggy address belongs to the physical page: [ 20.250160] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077ac [ 20.250220] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.250382] page_type: f5(slab) [ 20.250644] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.250994] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.251042] page dumped because: kasan: bad access detected [ 20.251076] [ 20.251096] Memory state around the buggy address: [ 20.251341] fff00000c77ac200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.251601] fff00000c77ac280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.251854] >fff00000c77ac300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.251900] ^ [ 20.252479] fff00000c77ac380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.252814] fff00000c77ac400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.252861] ================================================================== [ 20.234572] ================================================================== [ 20.234669] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x434/0xec8 [ 20.234723] Write of size 121 at addr fff00000c77ac300 by task kunit_try_catch/286 [ 20.234777] [ 20.234814] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 20.234895] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.234924] Hardware name: linux,dummy-virt (DT) [ 20.234987] Call trace: [ 20.235013] show_stack+0x20/0x38 (C) [ 20.235295] dump_stack_lvl+0x8c/0xd0 [ 20.235359] print_report+0x118/0x608 [ 20.235408] kasan_report+0xdc/0x128 [ 20.235493] kasan_check_range+0x100/0x1a8 [ 20.235602] __kasan_check_write+0x20/0x30 [ 20.235670] copy_user_test_oob+0x434/0xec8 [ 20.236336] kunit_try_run_case+0x170/0x3f0 [ 20.236395] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.236778] kthread+0x328/0x630 [ 20.237016] ret_from_fork+0x10/0x20 [ 20.237070] [ 20.237091] Allocated by task 286: [ 20.237484] kasan_save_stack+0x3c/0x68 [ 20.237541] kasan_save_track+0x20/0x40 [ 20.237582] kasan_save_alloc_info+0x40/0x58 [ 20.237649] __kasan_kmalloc+0xd4/0xd8 [ 20.237688] __kmalloc_noprof+0x198/0x4c8 [ 20.237726] kunit_kmalloc_array+0x34/0x88 [ 20.237765] copy_user_test_oob+0xac/0xec8 [ 20.238250] kunit_try_run_case+0x170/0x3f0 [ 20.238490] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.238631] kthread+0x328/0x630 [ 20.238669] ret_from_fork+0x10/0x20 [ 20.238708] [ 20.238729] The buggy address belongs to the object at fff00000c77ac300 [ 20.238729] which belongs to the cache kmalloc-128 of size 128 [ 20.238933] The buggy address is located 0 bytes inside of [ 20.238933] allocated 120-byte region [fff00000c77ac300, fff00000c77ac378) [ 20.239010] [ 20.239033] The buggy address belongs to the physical page: [ 20.239174] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077ac [ 20.239615] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.239676] page_type: f5(slab) [ 20.239716] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.239768] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.240140] page dumped because: kasan: bad access detected [ 20.240183] [ 20.240203] Memory state around the buggy address: [ 20.240241] fff00000c77ac200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.240507] fff00000c77ac280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.240860] >fff00000c77ac300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.240967] ^ [ 20.241190] fff00000c77ac380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.241236] fff00000c77ac400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.241277] ================================================================== [ 20.168789] ================================================================== [ 20.168892] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x234/0xec8 [ 20.169714] Write of size 121 at addr fff00000c77ac300 by task kunit_try_catch/286 [ 20.170319] [ 20.170385] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 20.170824] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.171223] Hardware name: linux,dummy-virt (DT) [ 20.171264] Call trace: [ 20.171303] show_stack+0x20/0x38 (C) [ 20.171920] dump_stack_lvl+0x8c/0xd0 [ 20.172002] print_report+0x118/0x608 [ 20.172280] kasan_report+0xdc/0x128 [ 20.172469] kasan_check_range+0x100/0x1a8 [ 20.172639] __kasan_check_write+0x20/0x30 [ 20.172724] copy_user_test_oob+0x234/0xec8 [ 20.172970] kunit_try_run_case+0x170/0x3f0 [ 20.173060] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.173358] kthread+0x328/0x630 [ 20.173410] ret_from_fork+0x10/0x20 [ 20.173683] [ 20.173745] Allocated by task 286: [ 20.173810] kasan_save_stack+0x3c/0x68 [ 20.174222] kasan_save_track+0x20/0x40 [ 20.174281] kasan_save_alloc_info+0x40/0x58 [ 20.174997] __kasan_kmalloc+0xd4/0xd8 [ 20.175054] __kmalloc_noprof+0x198/0x4c8 [ 20.175098] kunit_kmalloc_array+0x34/0x88 [ 20.177221] copy_user_test_oob+0xac/0xec8 [ 20.177320] kunit_try_run_case+0x170/0x3f0 [ 20.177373] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.177555] kthread+0x328/0x630 [ 20.177941] ret_from_fork+0x10/0x20 [ 20.178002] [ 20.178133] The buggy address belongs to the object at fff00000c77ac300 [ 20.178133] which belongs to the cache kmalloc-128 of size 128 [ 20.178521] The buggy address is located 0 bytes inside of [ 20.178521] allocated 120-byte region [fff00000c77ac300, fff00000c77ac378) [ 20.178719] [ 20.178747] The buggy address belongs to the physical page: [ 20.178996] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077ac [ 20.179082] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.179177] page_type: f5(slab) [ 20.179246] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.179528] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.179574] page dumped because: kasan: bad access detected [ 20.179611] [ 20.179633] Memory state around the buggy address: [ 20.179671] fff00000c77ac200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.179717] fff00000c77ac280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.179762] >fff00000c77ac300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.179803] ^ [ 20.179845] fff00000c77ac380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.179890] fff00000c77ac400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.179932] ================================================================== [ 20.212527] ================================================================== [ 20.213091] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x35c/0xec8 [ 20.213151] Write of size 121 at addr fff00000c77ac300 by task kunit_try_catch/286 [ 20.213204] [ 20.213765] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 20.213865] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.213893] Hardware name: linux,dummy-virt (DT) [ 20.214202] Call trace: [ 20.214503] show_stack+0x20/0x38 (C) [ 20.214830] dump_stack_lvl+0x8c/0xd0 [ 20.214879] print_report+0x118/0x608 [ 20.215073] kasan_report+0xdc/0x128 [ 20.215122] kasan_check_range+0x100/0x1a8 [ 20.215173] __kasan_check_write+0x20/0x30 [ 20.215390] copy_user_test_oob+0x35c/0xec8 [ 20.215967] kunit_try_run_case+0x170/0x3f0 [ 20.216039] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.216518] kthread+0x328/0x630 [ 20.216564] ret_from_fork+0x10/0x20 [ 20.217021] [ 20.217048] Allocated by task 286: [ 20.217079] kasan_save_stack+0x3c/0x68 [ 20.217126] kasan_save_track+0x20/0x40 [ 20.217166] kasan_save_alloc_info+0x40/0x58 [ 20.217208] __kasan_kmalloc+0xd4/0xd8 [ 20.217725] __kmalloc_noprof+0x198/0x4c8 [ 20.217766] kunit_kmalloc_array+0x34/0x88 [ 20.217902] copy_user_test_oob+0xac/0xec8 [ 20.217941] kunit_try_run_case+0x170/0x3f0 [ 20.218458] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.218508] kthread+0x328/0x630 [ 20.218541] ret_from_fork+0x10/0x20 [ 20.219159] [ 20.219189] The buggy address belongs to the object at fff00000c77ac300 [ 20.219189] which belongs to the cache kmalloc-128 of size 128 [ 20.219361] The buggy address is located 0 bytes inside of [ 20.219361] allocated 120-byte region [fff00000c77ac300, fff00000c77ac378) [ 20.219431] [ 20.219452] The buggy address belongs to the physical page: [ 20.219494] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077ac [ 20.219553] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.219972] page_type: f5(slab) [ 20.220034] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.220416] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.220464] page dumped because: kasan: bad access detected [ 20.220499] [ 20.220552] Memory state around the buggy address: [ 20.220664] fff00000c77ac200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.220744] fff00000c77ac280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.221157] >fff00000c77ac300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.221204] ^ [ 20.221249] fff00000c77ac380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.221472] fff00000c77ac400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.221821] ================================================================== [ 20.189854] ================================================================== [ 20.189916] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x728/0xec8 [ 20.191897] Read of size 121 at addr fff00000c77ac300 by task kunit_try_catch/286 [ 20.192051] [ 20.192092] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 20.192200] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.192227] Hardware name: linux,dummy-virt (DT) [ 20.192259] Call trace: [ 20.192283] show_stack+0x20/0x38 (C) [ 20.192798] dump_stack_lvl+0x8c/0xd0 [ 20.192863] print_report+0x118/0x608 [ 20.192947] kasan_report+0xdc/0x128 [ 20.193424] kasan_check_range+0x100/0x1a8 [ 20.193806] __kasan_check_read+0x20/0x30 [ 20.193870] copy_user_test_oob+0x728/0xec8 [ 20.194187] kunit_try_run_case+0x170/0x3f0 [ 20.194308] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.194365] kthread+0x328/0x630 [ 20.194407] ret_from_fork+0x10/0x20 [ 20.194878] [ 20.194903] Allocated by task 286: [ 20.194934] kasan_save_stack+0x3c/0x68 [ 20.195165] kasan_save_track+0x20/0x40 [ 20.195440] kasan_save_alloc_info+0x40/0x58 [ 20.195867] __kasan_kmalloc+0xd4/0xd8 [ 20.195919] __kmalloc_noprof+0x198/0x4c8 [ 20.196075] kunit_kmalloc_array+0x34/0x88 [ 20.196151] copy_user_test_oob+0xac/0xec8 [ 20.196288] kunit_try_run_case+0x170/0x3f0 [ 20.196779] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.197315] kthread+0x328/0x630 [ 20.197372] ret_from_fork+0x10/0x20 [ 20.197413] [ 20.197758] The buggy address belongs to the object at fff00000c77ac300 [ 20.197758] which belongs to the cache kmalloc-128 of size 128 [ 20.197918] The buggy address is located 0 bytes inside of [ 20.197918] allocated 120-byte region [fff00000c77ac300, fff00000c77ac378) [ 20.198001] [ 20.198129] The buggy address belongs to the physical page: [ 20.198164] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077ac [ 20.198239] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.198903] page_type: f5(slab) [ 20.199070] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.199124] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.199372] page dumped because: kasan: bad access detected [ 20.199413] [ 20.199433] Memory state around the buggy address: [ 20.199602] fff00000c77ac200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.199713] fff00000c77ac280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.199759] >fff00000c77ac300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.200126] ^ [ 20.200518] fff00000c77ac380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.201032] fff00000c77ac400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.201528] ==================================================================
[ 19.816740] ================================================================== [ 19.816831] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x3c8/0xec8 [ 19.816895] Read of size 121 at addr fff00000c76c9300 by task kunit_try_catch/286 [ 19.816957] [ 19.816989] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.817076] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.817105] Hardware name: linux,dummy-virt (DT) [ 19.817136] Call trace: [ 19.817160] show_stack+0x20/0x38 (C) [ 19.817207] dump_stack_lvl+0x8c/0xd0 [ 19.817255] print_report+0x118/0x608 [ 19.817301] kasan_report+0xdc/0x128 [ 19.817348] kasan_check_range+0x100/0x1a8 [ 19.817402] __kasan_check_read+0x20/0x30 [ 19.817447] copy_user_test_oob+0x3c8/0xec8 [ 19.817495] kunit_try_run_case+0x170/0x3f0 [ 19.817543] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.817597] kthread+0x328/0x630 [ 19.817638] ret_from_fork+0x10/0x20 [ 19.817685] [ 19.817706] Allocated by task 286: [ 19.817735] kasan_save_stack+0x3c/0x68 [ 19.817778] kasan_save_track+0x20/0x40 [ 19.817816] kasan_save_alloc_info+0x40/0x58 [ 19.817865] __kasan_kmalloc+0xd4/0xd8 [ 19.817904] __kmalloc_noprof+0x198/0x4c8 [ 19.817952] kunit_kmalloc_array+0x34/0x88 [ 19.817992] copy_user_test_oob+0xac/0xec8 [ 19.818030] kunit_try_run_case+0x170/0x3f0 [ 19.818069] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.818115] kthread+0x328/0x630 [ 19.818148] ret_from_fork+0x10/0x20 [ 19.818186] [ 19.818206] The buggy address belongs to the object at fff00000c76c9300 [ 19.818206] which belongs to the cache kmalloc-128 of size 128 [ 19.820961] The buggy address is located 0 bytes inside of [ 19.820961] allocated 120-byte region [fff00000c76c9300, fff00000c76c9378) [ 19.821032] [ 19.821058] The buggy address belongs to the physical page: [ 19.821091] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c9 [ 19.821145] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.821191] page_type: f5(slab) [ 19.821230] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.821282] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.821325] page dumped because: kasan: bad access detected [ 19.821359] [ 19.821379] Memory state around the buggy address: [ 19.821420] fff00000c76c9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.821464] fff00000c76c9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.821508] >fff00000c76c9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.821548] ^ [ 19.821592] fff00000c76c9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.821636] fff00000c76c9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.821676] ================================================================== [ 19.835060] ================================================================== [ 19.835225] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x4a0/0xec8 [ 19.835280] Read of size 121 at addr fff00000c76c9300 by task kunit_try_catch/286 [ 19.835361] [ 19.835574] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.835761] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.835808] Hardware name: linux,dummy-virt (DT) [ 19.835839] Call trace: [ 19.835863] show_stack+0x20/0x38 (C) [ 19.836032] dump_stack_lvl+0x8c/0xd0 [ 19.836088] print_report+0x118/0x608 [ 19.836136] kasan_report+0xdc/0x128 [ 19.836182] kasan_check_range+0x100/0x1a8 [ 19.836232] __kasan_check_read+0x20/0x30 [ 19.836291] copy_user_test_oob+0x4a0/0xec8 [ 19.836342] kunit_try_run_case+0x170/0x3f0 [ 19.836410] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.836464] kthread+0x328/0x630 [ 19.836505] ret_from_fork+0x10/0x20 [ 19.836556] [ 19.836819] Allocated by task 286: [ 19.836863] kasan_save_stack+0x3c/0x68 [ 19.836908] kasan_save_track+0x20/0x40 [ 19.836963] kasan_save_alloc_info+0x40/0x58 [ 19.837005] __kasan_kmalloc+0xd4/0xd8 [ 19.837042] __kmalloc_noprof+0x198/0x4c8 [ 19.838345] kunit_kmalloc_array+0x34/0x88 [ 19.838530] copy_user_test_oob+0xac/0xec8 [ 19.838731] kunit_try_run_case+0x170/0x3f0 [ 19.838933] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.839064] kthread+0x328/0x630 [ 19.839122] ret_from_fork+0x10/0x20 [ 19.839204] [ 19.839319] The buggy address belongs to the object at fff00000c76c9300 [ 19.839319] which belongs to the cache kmalloc-128 of size 128 [ 19.839402] The buggy address is located 0 bytes inside of [ 19.839402] allocated 120-byte region [fff00000c76c9300, fff00000c76c9378) [ 19.839550] [ 19.839622] The buggy address belongs to the physical page: [ 19.839690] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c9 [ 19.839774] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.839823] page_type: f5(slab) [ 19.839887] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.840245] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.840321] page dumped because: kasan: bad access detected [ 19.840483] [ 19.840643] Memory state around the buggy address: [ 19.840699] fff00000c76c9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.840874] fff00000c76c9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.840938] >fff00000c76c9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.841026] ^ [ 19.841126] fff00000c76c9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.841289] fff00000c76c9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.841338] ================================================================== [ 19.795992] ================================================================== [ 19.796057] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x728/0xec8 [ 19.796112] Read of size 121 at addr fff00000c76c9300 by task kunit_try_catch/286 [ 19.796167] [ 19.796201] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.796314] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.796351] Hardware name: linux,dummy-virt (DT) [ 19.796399] Call trace: [ 19.796438] show_stack+0x20/0x38 (C) [ 19.796706] dump_stack_lvl+0x8c/0xd0 [ 19.797154] print_report+0x118/0x608 [ 19.797223] kasan_report+0xdc/0x128 [ 19.797346] kasan_check_range+0x100/0x1a8 [ 19.797399] __kasan_check_read+0x20/0x30 [ 19.797446] copy_user_test_oob+0x728/0xec8 [ 19.797525] kunit_try_run_case+0x170/0x3f0 [ 19.797604] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.797676] kthread+0x328/0x630 [ 19.797718] ret_from_fork+0x10/0x20 [ 19.797952] [ 19.798022] Allocated by task 286: [ 19.798119] kasan_save_stack+0x3c/0x68 [ 19.798185] kasan_save_track+0x20/0x40 [ 19.798242] kasan_save_alloc_info+0x40/0x58 [ 19.798437] __kasan_kmalloc+0xd4/0xd8 [ 19.798553] __kmalloc_noprof+0x198/0x4c8 [ 19.798631] kunit_kmalloc_array+0x34/0x88 [ 19.798705] copy_user_test_oob+0xac/0xec8 [ 19.798777] kunit_try_run_case+0x170/0x3f0 [ 19.798819] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.798864] kthread+0x328/0x630 [ 19.798919] ret_from_fork+0x10/0x20 [ 19.798961] [ 19.798985] The buggy address belongs to the object at fff00000c76c9300 [ 19.798985] which belongs to the cache kmalloc-128 of size 128 [ 19.799168] The buggy address is located 0 bytes inside of [ 19.799168] allocated 120-byte region [fff00000c76c9300, fff00000c76c9378) [ 19.799302] [ 19.799341] The buggy address belongs to the physical page: [ 19.799459] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c9 [ 19.799533] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.799620] page_type: f5(slab) [ 19.799799] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.799906] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.799986] page dumped because: kasan: bad access detected [ 19.800099] [ 19.800151] Memory state around the buggy address: [ 19.800223] fff00000c76c9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.800335] fff00000c76c9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.800423] >fff00000c76c9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.800520] ^ [ 19.800565] fff00000c76c9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.800610] fff00000c76c9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.800879] ================================================================== [ 19.828288] ================================================================== [ 19.828665] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x434/0xec8 [ 19.828761] Write of size 121 at addr fff00000c76c9300 by task kunit_try_catch/286 [ 19.828869] [ 19.828905] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.829101] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.829150] Hardware name: linux,dummy-virt (DT) [ 19.829198] Call trace: [ 19.829276] show_stack+0x20/0x38 (C) [ 19.829349] dump_stack_lvl+0x8c/0xd0 [ 19.829404] print_report+0x118/0x608 [ 19.829650] kasan_report+0xdc/0x128 [ 19.829718] kasan_check_range+0x100/0x1a8 [ 19.829769] __kasan_check_write+0x20/0x30 [ 19.829814] copy_user_test_oob+0x434/0xec8 [ 19.829924] kunit_try_run_case+0x170/0x3f0 [ 19.829977] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.830095] kthread+0x328/0x630 [ 19.830147] ret_from_fork+0x10/0x20 [ 19.830200] [ 19.830222] Allocated by task 286: [ 19.830530] kasan_save_stack+0x3c/0x68 [ 19.830620] kasan_save_track+0x20/0x40 [ 19.830730] kasan_save_alloc_info+0x40/0x58 [ 19.830807] __kasan_kmalloc+0xd4/0xd8 [ 19.831088] __kmalloc_noprof+0x198/0x4c8 [ 19.831186] kunit_kmalloc_array+0x34/0x88 [ 19.831314] copy_user_test_oob+0xac/0xec8 [ 19.831390] kunit_try_run_case+0x170/0x3f0 [ 19.831496] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.831545] kthread+0x328/0x630 [ 19.831579] ret_from_fork+0x10/0x20 [ 19.831850] [ 19.831903] The buggy address belongs to the object at fff00000c76c9300 [ 19.831903] which belongs to the cache kmalloc-128 of size 128 [ 19.832046] The buggy address is located 0 bytes inside of [ 19.832046] allocated 120-byte region [fff00000c76c9300, fff00000c76c9378) [ 19.832140] [ 19.832375] The buggy address belongs to the physical page: [ 19.832439] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c9 [ 19.832496] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.832570] page_type: f5(slab) [ 19.832610] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.832675] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.832719] page dumped because: kasan: bad access detected [ 19.832753] [ 19.832775] Memory state around the buggy address: [ 19.832819] fff00000c76c9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.832864] fff00000c76c9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.833284] >fff00000c76c9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.833506] ^ [ 19.833557] fff00000c76c9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.833767] fff00000c76c9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.833884] ================================================================== [ 19.784188] ================================================================== [ 19.784300] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x234/0xec8 [ 19.784391] Write of size 121 at addr fff00000c76c9300 by task kunit_try_catch/286 [ 19.784447] [ 19.784490] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.784578] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.784608] Hardware name: linux,dummy-virt (DT) [ 19.784642] Call trace: [ 19.784668] show_stack+0x20/0x38 (C) [ 19.784720] dump_stack_lvl+0x8c/0xd0 [ 19.784784] print_report+0x118/0x608 [ 19.784832] kasan_report+0xdc/0x128 [ 19.784879] kasan_check_range+0x100/0x1a8 [ 19.784941] __kasan_check_write+0x20/0x30 [ 19.785287] copy_user_test_oob+0x234/0xec8 [ 19.785377] kunit_try_run_case+0x170/0x3f0 [ 19.785448] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.785502] kthread+0x328/0x630 [ 19.785559] ret_from_fork+0x10/0x20 [ 19.785762] [ 19.785828] Allocated by task 286: [ 19.785865] kasan_save_stack+0x3c/0x68 [ 19.785929] kasan_save_track+0x20/0x40 [ 19.786264] kasan_save_alloc_info+0x40/0x58 [ 19.786494] __kasan_kmalloc+0xd4/0xd8 [ 19.786621] __kmalloc_noprof+0x198/0x4c8 [ 19.786694] kunit_kmalloc_array+0x34/0x88 [ 19.786741] copy_user_test_oob+0xac/0xec8 [ 19.786789] kunit_try_run_case+0x170/0x3f0 [ 19.787086] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.787182] kthread+0x328/0x630 [ 19.787243] ret_from_fork+0x10/0x20 [ 19.787322] [ 19.787387] The buggy address belongs to the object at fff00000c76c9300 [ 19.787387] which belongs to the cache kmalloc-128 of size 128 [ 19.787463] The buggy address is located 0 bytes inside of [ 19.787463] allocated 120-byte region [fff00000c76c9300, fff00000c76c9378) [ 19.787756] [ 19.787802] The buggy address belongs to the physical page: [ 19.787907] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c9 [ 19.788005] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.788278] page_type: f5(slab) [ 19.788356] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.788475] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.788519] page dumped because: kasan: bad access detected [ 19.788673] [ 19.788826] Memory state around the buggy address: [ 19.788893] fff00000c76c9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.789010] fff00000c76c9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.789089] >fff00000c76c9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.789419] ^ [ 19.789482] fff00000c76c9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.789646] fff00000c76c9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.789837] ================================================================== [ 19.808780] ================================================================== [ 19.808966] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x35c/0xec8 [ 19.809042] Write of size 121 at addr fff00000c76c9300 by task kunit_try_catch/286 [ 19.809156] [ 19.809193] CPU: 1 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 19.809413] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.809468] Hardware name: linux,dummy-virt (DT) [ 19.809540] Call trace: [ 19.809568] show_stack+0x20/0x38 (C) [ 19.809875] dump_stack_lvl+0x8c/0xd0 [ 19.809947] print_report+0x118/0x608 [ 19.810135] kasan_report+0xdc/0x128 [ 19.810220] kasan_check_range+0x100/0x1a8 [ 19.810335] __kasan_check_write+0x20/0x30 [ 19.810384] copy_user_test_oob+0x35c/0xec8 [ 19.810432] kunit_try_run_case+0x170/0x3f0 [ 19.810623] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.810770] kthread+0x328/0x630 [ 19.810845] ret_from_fork+0x10/0x20 [ 19.810985] [ 19.811032] Allocated by task 286: [ 19.811088] kasan_save_stack+0x3c/0x68 [ 19.811368] kasan_save_track+0x20/0x40 [ 19.811547] kasan_save_alloc_info+0x40/0x58 [ 19.811694] __kasan_kmalloc+0xd4/0xd8 [ 19.811762] __kmalloc_noprof+0x198/0x4c8 [ 19.811940] kunit_kmalloc_array+0x34/0x88 [ 19.812017] copy_user_test_oob+0xac/0xec8 [ 19.812274] kunit_try_run_case+0x170/0x3f0 [ 19.812332] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.812412] kthread+0x328/0x630 [ 19.812503] ret_from_fork+0x10/0x20 [ 19.812603] [ 19.812842] The buggy address belongs to the object at fff00000c76c9300 [ 19.812842] which belongs to the cache kmalloc-128 of size 128 [ 19.813020] The buggy address is located 0 bytes inside of [ 19.813020] allocated 120-byte region [fff00000c76c9300, fff00000c76c9378) [ 19.813126] [ 19.813281] The buggy address belongs to the physical page: [ 19.813401] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c9 [ 19.813504] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.813635] page_type: f5(slab) [ 19.813703] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.813812] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.813889] page dumped because: kasan: bad access detected [ 19.813967] [ 19.814005] Memory state around the buggy address: [ 19.814101] fff00000c76c9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.814147] fff00000c76c9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.814192] >fff00000c76c9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 19.814238] ^ [ 19.814281] fff00000c76c9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.814564] fff00000c76c9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.814688] ==================================================================
[ 18.063751] ================================================================== [ 18.064163] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x3fd/0x10f0 [ 18.064683] Write of size 121 at addr ffff88810254dc00 by task kunit_try_catch/303 [ 18.065189] [ 18.065396] CPU: 1 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 18.065466] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.065484] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.065513] Call Trace: [ 18.065534] <TASK> [ 18.065557] dump_stack_lvl+0x73/0xb0 [ 18.065601] print_report+0xd1/0x650 [ 18.065660] ? __virt_addr_valid+0x1db/0x2d0 [ 18.065700] ? copy_user_test_oob+0x3fd/0x10f0 [ 18.065743] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.065785] ? copy_user_test_oob+0x3fd/0x10f0 [ 18.065825] kasan_report+0x141/0x180 [ 18.065868] ? copy_user_test_oob+0x3fd/0x10f0 [ 18.065930] kasan_check_range+0x10c/0x1c0 [ 18.065979] __kasan_check_write+0x18/0x20 [ 18.066021] copy_user_test_oob+0x3fd/0x10f0 [ 18.066092] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.066188] ? finish_task_switch.isra.0+0x153/0x700 [ 18.066239] ? __switch_to+0x47/0xf50 [ 18.066293] ? __schedule+0x10cc/0x2b60 [ 18.066339] ? __pfx_read_tsc+0x10/0x10 [ 18.066381] ? ktime_get_ts64+0x86/0x230 [ 18.066424] kunit_try_run_case+0x1a5/0x480 [ 18.066472] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.066505] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.066534] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.066557] ? __kthread_parkme+0x82/0x180 [ 18.066577] ? preempt_count_sub+0x50/0x80 [ 18.066598] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.066642] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.066669] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.066690] kthread+0x337/0x6f0 [ 18.066709] ? trace_preempt_on+0x20/0xc0 [ 18.066733] ? __pfx_kthread+0x10/0x10 [ 18.066753] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.066773] ? calculate_sigpending+0x7b/0xa0 [ 18.066795] ? __pfx_kthread+0x10/0x10 [ 18.066816] ret_from_fork+0x116/0x1d0 [ 18.066833] ? __pfx_kthread+0x10/0x10 [ 18.066853] ret_from_fork_asm+0x1a/0x30 [ 18.066882] </TASK> [ 18.066896] [ 18.076905] Allocated by task 303: [ 18.077263] kasan_save_stack+0x45/0x70 [ 18.077661] kasan_save_track+0x18/0x40 [ 18.078023] kasan_save_alloc_info+0x3b/0x50 [ 18.078393] __kasan_kmalloc+0xb7/0xc0 [ 18.078629] __kmalloc_noprof+0x1c9/0x500 [ 18.078783] kunit_kmalloc_array+0x25/0x60 [ 18.079064] copy_user_test_oob+0xab/0x10f0 [ 18.079513] kunit_try_run_case+0x1a5/0x480 [ 18.079747] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.079971] kthread+0x337/0x6f0 [ 18.080518] ret_from_fork+0x116/0x1d0 [ 18.080818] ret_from_fork_asm+0x1a/0x30 [ 18.081041] [ 18.081388] The buggy address belongs to the object at ffff88810254dc00 [ 18.081388] which belongs to the cache kmalloc-128 of size 128 [ 18.082138] The buggy address is located 0 bytes inside of [ 18.082138] allocated 120-byte region [ffff88810254dc00, ffff88810254dc78) [ 18.082777] [ 18.082956] The buggy address belongs to the physical page: [ 18.083306] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10254d [ 18.083682] flags: 0x200000000000000(node=0|zone=2) [ 18.084014] page_type: f5(slab) [ 18.084311] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.084579] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.085012] page dumped because: kasan: bad access detected [ 18.085589] [ 18.085901] Memory state around the buggy address: [ 18.086100] ffff88810254db00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.086914] ffff88810254db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.087474] >ffff88810254dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.087713] ^ [ 18.088535] ffff88810254dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.088853] ffff88810254dd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.089691] ================================================================== [ 18.090352] ================================================================== [ 18.090766] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x4aa/0x10f0 [ 18.091095] Read of size 121 at addr ffff88810254dc00 by task kunit_try_catch/303 [ 18.091601] [ 18.091857] CPU: 1 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 18.091949] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.091977] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.092019] Call Trace: [ 18.092052] <TASK> [ 18.092084] dump_stack_lvl+0x73/0xb0 [ 18.092185] print_report+0xd1/0x650 [ 18.092249] ? __virt_addr_valid+0x1db/0x2d0 [ 18.092295] ? copy_user_test_oob+0x4aa/0x10f0 [ 18.092375] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.092420] ? copy_user_test_oob+0x4aa/0x10f0 [ 18.092459] kasan_report+0x141/0x180 [ 18.092498] ? copy_user_test_oob+0x4aa/0x10f0 [ 18.092572] kasan_check_range+0x10c/0x1c0 [ 18.092632] __kasan_check_read+0x15/0x20 [ 18.092681] copy_user_test_oob+0x4aa/0x10f0 [ 18.092731] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.092792] ? finish_task_switch.isra.0+0x153/0x700 [ 18.092833] ? __switch_to+0x47/0xf50 [ 18.092896] ? __schedule+0x10cc/0x2b60 [ 18.092943] ? __pfx_read_tsc+0x10/0x10 [ 18.092984] ? ktime_get_ts64+0x86/0x230 [ 18.093033] kunit_try_run_case+0x1a5/0x480 [ 18.093081] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.093139] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.093165] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.093187] ? __kthread_parkme+0x82/0x180 [ 18.093207] ? preempt_count_sub+0x50/0x80 [ 18.093228] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.093250] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.093273] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.093294] kthread+0x337/0x6f0 [ 18.093313] ? trace_preempt_on+0x20/0xc0 [ 18.093336] ? __pfx_kthread+0x10/0x10 [ 18.093355] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.093375] ? calculate_sigpending+0x7b/0xa0 [ 18.093398] ? __pfx_kthread+0x10/0x10 [ 18.093418] ret_from_fork+0x116/0x1d0 [ 18.093435] ? __pfx_kthread+0x10/0x10 [ 18.093455] ret_from_fork_asm+0x1a/0x30 [ 18.093483] </TASK> [ 18.093498] [ 18.102962] Allocated by task 303: [ 18.103312] kasan_save_stack+0x45/0x70 [ 18.103647] kasan_save_track+0x18/0x40 [ 18.103935] kasan_save_alloc_info+0x3b/0x50 [ 18.104289] __kasan_kmalloc+0xb7/0xc0 [ 18.104597] __kmalloc_noprof+0x1c9/0x500 [ 18.104786] kunit_kmalloc_array+0x25/0x60 [ 18.105173] copy_user_test_oob+0xab/0x10f0 [ 18.105542] kunit_try_run_case+0x1a5/0x480 [ 18.105839] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.106291] kthread+0x337/0x6f0 [ 18.106559] ret_from_fork+0x116/0x1d0 [ 18.106890] ret_from_fork_asm+0x1a/0x30 [ 18.107212] [ 18.107415] The buggy address belongs to the object at ffff88810254dc00 [ 18.107415] which belongs to the cache kmalloc-128 of size 128 [ 18.108003] The buggy address is located 0 bytes inside of [ 18.108003] allocated 120-byte region [ffff88810254dc00, ffff88810254dc78) [ 18.108797] [ 18.108946] The buggy address belongs to the physical page: [ 18.109366] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10254d [ 18.110012] flags: 0x200000000000000(node=0|zone=2) [ 18.110415] page_type: f5(slab) [ 18.110599] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.110872] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.111297] page dumped because: kasan: bad access detected [ 18.111752] [ 18.111914] Memory state around the buggy address: [ 18.112378] ffff88810254db00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.112940] ffff88810254db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.113330] >ffff88810254dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.113815] ^ [ 18.114315] ffff88810254dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.114577] ffff88810254dd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.115095] ================================================================== [ 18.115861] ================================================================== [ 18.116372] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x557/0x10f0 [ 18.116889] Write of size 121 at addr ffff88810254dc00 by task kunit_try_catch/303 [ 18.117380] [ 18.117578] CPU: 1 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 18.117694] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.117722] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.117789] Call Trace: [ 18.117821] <TASK> [ 18.117868] dump_stack_lvl+0x73/0xb0 [ 18.117907] print_report+0xd1/0x650 [ 18.117940] ? __virt_addr_valid+0x1db/0x2d0 [ 18.117963] ? copy_user_test_oob+0x557/0x10f0 [ 18.117986] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.118014] ? copy_user_test_oob+0x557/0x10f0 [ 18.118052] kasan_report+0x141/0x180 [ 18.118088] ? copy_user_test_oob+0x557/0x10f0 [ 18.118171] kasan_check_range+0x10c/0x1c0 [ 18.118242] __kasan_check_write+0x18/0x20 [ 18.118283] copy_user_test_oob+0x557/0x10f0 [ 18.118348] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.118390] ? finish_task_switch.isra.0+0x153/0x700 [ 18.118455] ? __switch_to+0x47/0xf50 [ 18.118509] ? __schedule+0x10cc/0x2b60 [ 18.118567] ? __pfx_read_tsc+0x10/0x10 [ 18.118606] ? ktime_get_ts64+0x86/0x230 [ 18.118688] kunit_try_run_case+0x1a5/0x480 [ 18.118750] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.118791] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.118835] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.118878] ? __kthread_parkme+0x82/0x180 [ 18.118918] ? preempt_count_sub+0x50/0x80 [ 18.118964] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.119010] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.119053] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.119076] kthread+0x337/0x6f0 [ 18.119106] ? trace_preempt_on+0x20/0xc0 [ 18.119175] ? __pfx_kthread+0x10/0x10 [ 18.119229] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.119277] ? calculate_sigpending+0x7b/0xa0 [ 18.119337] ? __pfx_kthread+0x10/0x10 [ 18.119398] ret_from_fork+0x116/0x1d0 [ 18.119436] ? __pfx_kthread+0x10/0x10 [ 18.119470] ret_from_fork_asm+0x1a/0x30 [ 18.119501] </TASK> [ 18.119516] [ 18.130722] Allocated by task 303: [ 18.130875] kasan_save_stack+0x45/0x70 [ 18.131039] kasan_save_track+0x18/0x40 [ 18.131183] kasan_save_alloc_info+0x3b/0x50 [ 18.131349] __kasan_kmalloc+0xb7/0xc0 [ 18.131501] __kmalloc_noprof+0x1c9/0x500 [ 18.131672] kunit_kmalloc_array+0x25/0x60 [ 18.131822] copy_user_test_oob+0xab/0x10f0 [ 18.131982] kunit_try_run_case+0x1a5/0x480 [ 18.132121] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.132665] kthread+0x337/0x6f0 [ 18.132852] ret_from_fork+0x116/0x1d0 [ 18.133022] ret_from_fork_asm+0x1a/0x30 [ 18.133189] [ 18.133342] The buggy address belongs to the object at ffff88810254dc00 [ 18.133342] which belongs to the cache kmalloc-128 of size 128 [ 18.134136] The buggy address is located 0 bytes inside of [ 18.134136] allocated 120-byte region [ffff88810254dc00, ffff88810254dc78) [ 18.135761] [ 18.135883] The buggy address belongs to the physical page: [ 18.136052] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10254d [ 18.136791] flags: 0x200000000000000(node=0|zone=2) [ 18.138780] page_type: f5(slab) [ 18.138974] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.139684] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.139915] page dumped because: kasan: bad access detected [ 18.140095] [ 18.140210] Memory state around the buggy address: [ 18.140377] ffff88810254db00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.140737] ffff88810254db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.141177] >ffff88810254dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.141657] ^ [ 18.142109] ffff88810254dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.142532] ffff88810254dd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.142968] ================================================================== [ 18.144687] ================================================================== [ 18.145005] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x604/0x10f0 [ 18.145764] Read of size 121 at addr ffff88810254dc00 by task kunit_try_catch/303 [ 18.146132] [ 18.146581] CPU: 1 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 18.146666] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.146693] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.146733] Call Trace: [ 18.146765] <TASK> [ 18.146902] dump_stack_lvl+0x73/0xb0 [ 18.146965] print_report+0xd1/0x650 [ 18.146991] ? __virt_addr_valid+0x1db/0x2d0 [ 18.147013] ? copy_user_test_oob+0x604/0x10f0 [ 18.147036] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.147060] ? copy_user_test_oob+0x604/0x10f0 [ 18.147081] kasan_report+0x141/0x180 [ 18.147114] ? copy_user_test_oob+0x604/0x10f0 [ 18.147147] kasan_check_range+0x10c/0x1c0 [ 18.147169] __kasan_check_read+0x15/0x20 [ 18.147188] copy_user_test_oob+0x604/0x10f0 [ 18.147212] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.147233] ? finish_task_switch.isra.0+0x153/0x700 [ 18.147255] ? __switch_to+0x47/0xf50 [ 18.147280] ? __schedule+0x10cc/0x2b60 [ 18.147301] ? __pfx_read_tsc+0x10/0x10 [ 18.147321] ? ktime_get_ts64+0x86/0x230 [ 18.147344] kunit_try_run_case+0x1a5/0x480 [ 18.147367] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.147387] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.147408] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.147429] ? __kthread_parkme+0x82/0x180 [ 18.147449] ? preempt_count_sub+0x50/0x80 [ 18.147470] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.147492] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.147514] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.147535] kthread+0x337/0x6f0 [ 18.147554] ? trace_preempt_on+0x20/0xc0 [ 18.147576] ? __pfx_kthread+0x10/0x10 [ 18.147596] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.147632] ? calculate_sigpending+0x7b/0xa0 [ 18.147658] ? __pfx_kthread+0x10/0x10 [ 18.147679] ret_from_fork+0x116/0x1d0 [ 18.147698] ? __pfx_kthread+0x10/0x10 [ 18.147717] ret_from_fork_asm+0x1a/0x30 [ 18.147746] </TASK> [ 18.147760] [ 18.158681] Allocated by task 303: [ 18.158971] kasan_save_stack+0x45/0x70 [ 18.159300] kasan_save_track+0x18/0x40 [ 18.159572] kasan_save_alloc_info+0x3b/0x50 [ 18.159791] __kasan_kmalloc+0xb7/0xc0 [ 18.160060] __kmalloc_noprof+0x1c9/0x500 [ 18.160403] kunit_kmalloc_array+0x25/0x60 [ 18.160731] copy_user_test_oob+0xab/0x10f0 [ 18.161060] kunit_try_run_case+0x1a5/0x480 [ 18.161319] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.161597] kthread+0x337/0x6f0 [ 18.161985] ret_from_fork+0x116/0x1d0 [ 18.162346] ret_from_fork_asm+0x1a/0x30 [ 18.162661] [ 18.162771] The buggy address belongs to the object at ffff88810254dc00 [ 18.162771] which belongs to the cache kmalloc-128 of size 128 [ 18.163625] The buggy address is located 0 bytes inside of [ 18.163625] allocated 120-byte region [ffff88810254dc00, ffff88810254dc78) [ 18.164319] [ 18.164450] The buggy address belongs to the physical page: [ 18.164700] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10254d [ 18.165225] flags: 0x200000000000000(node=0|zone=2) [ 18.165714] page_type: f5(slab) [ 18.165979] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.166378] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.166903] page dumped because: kasan: bad access detected [ 18.167196] [ 18.167350] Memory state around the buggy address: [ 18.167553] ffff88810254db00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.167991] ffff88810254db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.168500] >ffff88810254dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.168829] ^ [ 18.169255] ffff88810254dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.169573] ffff88810254dd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.169904] ==================================================================
[ 18.013712] ================================================================== [ 18.014905] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x4aa/0x10f0 [ 18.015252] Read of size 121 at addr ffff8881031c0b00 by task kunit_try_catch/302 [ 18.015560] [ 18.015686] CPU: 1 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 18.015733] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.016139] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.016164] Call Trace: [ 18.016184] <TASK> [ 18.016204] dump_stack_lvl+0x73/0xb0 [ 18.016337] print_report+0xd1/0x650 [ 18.016364] ? __virt_addr_valid+0x1db/0x2d0 [ 18.016391] ? copy_user_test_oob+0x4aa/0x10f0 [ 18.016418] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.016449] ? copy_user_test_oob+0x4aa/0x10f0 [ 18.016477] kasan_report+0x141/0x180 [ 18.016503] ? copy_user_test_oob+0x4aa/0x10f0 [ 18.016536] kasan_check_range+0x10c/0x1c0 [ 18.016564] __kasan_check_read+0x15/0x20 [ 18.016586] copy_user_test_oob+0x4aa/0x10f0 [ 18.016617] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.016646] ? __kasan_check_write+0x18/0x20 [ 18.016669] ? queued_spin_lock_slowpath+0x116/0xb40 [ 18.016696] ? irqentry_exit+0x2a/0x60 [ 18.016721] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 18.016751] ? trace_hardirqs_on+0x37/0xe0 [ 18.016777] ? __pfx_read_tsc+0x10/0x10 [ 18.016803] ? ktime_get_ts64+0x86/0x230 [ 18.016834] kunit_try_run_case+0x1a5/0x480 [ 18.016863] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.016892] ? queued_spin_lock_slowpath+0x116/0xb40 [ 18.016919] ? __kthread_parkme+0x82/0x180 [ 18.016943] ? preempt_count_sub+0x50/0x80 [ 18.016970] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.016998] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.017025] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.017064] kthread+0x337/0x6f0 [ 18.017088] ? trace_preempt_on+0x20/0xc0 [ 18.017115] ? __pfx_kthread+0x10/0x10 [ 18.017139] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.017163] ? calculate_sigpending+0x7b/0xa0 [ 18.017190] ? __pfx_kthread+0x10/0x10 [ 18.017215] ret_from_fork+0x116/0x1d0 [ 18.017237] ? __pfx_kthread+0x10/0x10 [ 18.017262] ret_from_fork_asm+0x1a/0x30 [ 18.017298] </TASK> [ 18.017313] [ 18.027410] Allocated by task 302: [ 18.027612] kasan_save_stack+0x45/0x70 [ 18.027833] kasan_save_track+0x18/0x40 [ 18.028205] kasan_save_alloc_info+0x3b/0x50 [ 18.028493] __kasan_kmalloc+0xb7/0xc0 [ 18.028647] __kmalloc_noprof+0x1c9/0x500 [ 18.028979] kunit_kmalloc_array+0x25/0x60 [ 18.029150] copy_user_test_oob+0xab/0x10f0 [ 18.029375] kunit_try_run_case+0x1a5/0x480 [ 18.029595] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.030116] kthread+0x337/0x6f0 [ 18.030292] ret_from_fork+0x116/0x1d0 [ 18.030448] ret_from_fork_asm+0x1a/0x30 [ 18.030780] [ 18.030877] The buggy address belongs to the object at ffff8881031c0b00 [ 18.030877] which belongs to the cache kmalloc-128 of size 128 [ 18.031601] The buggy address is located 0 bytes inside of [ 18.031601] allocated 120-byte region [ffff8881031c0b00, ffff8881031c0b78) [ 18.032315] [ 18.032419] The buggy address belongs to the physical page: [ 18.032752] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1031c0 [ 18.033230] flags: 0x200000000000000(node=0|zone=2) [ 18.033487] page_type: f5(slab) [ 18.033666] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.034185] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.034585] page dumped because: kasan: bad access detected [ 18.034902] [ 18.035000] Memory state around the buggy address: [ 18.035337] ffff8881031c0a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.035706] ffff8881031c0a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.036225] >ffff8881031c0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.036526] ^ [ 18.036933] ffff8881031c0b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.037310] ffff8881031c0c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.037693] ================================================================== [ 17.994128] ================================================================== [ 17.994466] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x3fd/0x10f0 [ 17.994792] Write of size 121 at addr ffff8881031c0b00 by task kunit_try_catch/302 [ 17.995149] [ 17.995247] CPU: 1 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 17.995297] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.995310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.995334] Call Trace: [ 17.995349] <TASK> [ 17.995369] dump_stack_lvl+0x73/0xb0 [ 17.995403] print_report+0xd1/0x650 [ 17.995429] ? __virt_addr_valid+0x1db/0x2d0 [ 17.995456] ? copy_user_test_oob+0x3fd/0x10f0 [ 17.995483] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.995513] ? copy_user_test_oob+0x3fd/0x10f0 [ 17.995540] kasan_report+0x141/0x180 [ 17.995566] ? copy_user_test_oob+0x3fd/0x10f0 [ 17.995599] kasan_check_range+0x10c/0x1c0 [ 17.995626] __kasan_check_write+0x18/0x20 [ 17.995648] copy_user_test_oob+0x3fd/0x10f0 [ 17.995678] ? __pfx_copy_user_test_oob+0x10/0x10 [ 17.995707] ? __kasan_check_write+0x18/0x20 [ 17.995729] ? queued_spin_lock_slowpath+0x116/0xb40 [ 17.995756] ? irqentry_exit+0x2a/0x60 [ 17.995782] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 17.995810] ? trace_hardirqs_on+0x37/0xe0 [ 17.995838] ? __pfx_read_tsc+0x10/0x10 [ 17.995864] ? ktime_get_ts64+0x86/0x230 [ 17.995893] kunit_try_run_case+0x1a5/0x480 [ 17.995933] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.995962] ? queued_spin_lock_slowpath+0x116/0xb40 [ 17.995989] ? __kthread_parkme+0x82/0x180 [ 17.996013] ? preempt_count_sub+0x50/0x80 [ 17.996042] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.996081] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.996108] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.996135] kthread+0x337/0x6f0 [ 17.996159] ? trace_preempt_on+0x20/0xc0 [ 17.996185] ? __pfx_kthread+0x10/0x10 [ 17.996210] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.996236] ? calculate_sigpending+0x7b/0xa0 [ 17.996262] ? __pfx_kthread+0x10/0x10 [ 17.996288] ret_from_fork+0x116/0x1d0 [ 17.996310] ? __pfx_kthread+0x10/0x10 [ 17.996334] ret_from_fork_asm+0x1a/0x30 [ 17.996369] </TASK> [ 17.996383] [ 18.004429] Allocated by task 302: [ 18.004631] kasan_save_stack+0x45/0x70 [ 18.004854] kasan_save_track+0x18/0x40 [ 18.005036] kasan_save_alloc_info+0x3b/0x50 [ 18.005209] __kasan_kmalloc+0xb7/0xc0 [ 18.005404] __kmalloc_noprof+0x1c9/0x500 [ 18.005621] kunit_kmalloc_array+0x25/0x60 [ 18.005836] copy_user_test_oob+0xab/0x10f0 [ 18.006106] kunit_try_run_case+0x1a5/0x480 [ 18.006262] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.006544] kthread+0x337/0x6f0 [ 18.006737] ret_from_fork+0x116/0x1d0 [ 18.006928] ret_from_fork_asm+0x1a/0x30 [ 18.007088] [ 18.007167] The buggy address belongs to the object at ffff8881031c0b00 [ 18.007167] which belongs to the cache kmalloc-128 of size 128 [ 18.007580] The buggy address is located 0 bytes inside of [ 18.007580] allocated 120-byte region [ffff8881031c0b00, ffff8881031c0b78) [ 18.008153] [ 18.008256] The buggy address belongs to the physical page: [ 18.008527] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1031c0 [ 18.008784] flags: 0x200000000000000(node=0|zone=2) [ 18.008960] page_type: f5(slab) [ 18.009113] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.009487] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.009851] page dumped because: kasan: bad access detected [ 18.010139] [ 18.010244] Memory state around the buggy address: [ 18.010523] ffff8881031c0a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.010895] ffff8881031c0a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.011207] >ffff8881031c0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.011498] ^ [ 18.011766] ffff8881031c0b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.012081] ffff8881031c0c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.012498] ================================================================== [ 18.062348] ================================================================== [ 18.062636] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x604/0x10f0 [ 18.063144] Read of size 121 at addr ffff8881031c0b00 by task kunit_try_catch/302 [ 18.063960] [ 18.064159] CPU: 1 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 18.064209] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.064222] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.064355] Call Trace: [ 18.064375] <TASK> [ 18.064393] dump_stack_lvl+0x73/0xb0 [ 18.064427] print_report+0xd1/0x650 [ 18.064455] ? __virt_addr_valid+0x1db/0x2d0 [ 18.064480] ? copy_user_test_oob+0x604/0x10f0 [ 18.064506] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.064536] ? copy_user_test_oob+0x604/0x10f0 [ 18.064562] kasan_report+0x141/0x180 [ 18.064588] ? copy_user_test_oob+0x604/0x10f0 [ 18.064620] kasan_check_range+0x10c/0x1c0 [ 18.064646] __kasan_check_read+0x15/0x20 [ 18.064668] copy_user_test_oob+0x604/0x10f0 [ 18.064697] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.064740] ? __kasan_check_write+0x18/0x20 [ 18.064763] ? queued_spin_lock_slowpath+0x116/0xb40 [ 18.064789] ? irqentry_exit+0x2a/0x60 [ 18.064814] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 18.064841] ? trace_hardirqs_on+0x37/0xe0 [ 18.064867] ? __pfx_read_tsc+0x10/0x10 [ 18.064891] ? ktime_get_ts64+0x86/0x230 [ 18.064919] kunit_try_run_case+0x1a5/0x480 [ 18.064947] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.064975] ? queued_spin_lock_slowpath+0x116/0xb40 [ 18.065000] ? __kthread_parkme+0x82/0x180 [ 18.065024] ? preempt_count_sub+0x50/0x80 [ 18.065063] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.065090] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.065116] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.065141] kthread+0x337/0x6f0 [ 18.065164] ? trace_preempt_on+0x20/0xc0 [ 18.065188] ? __pfx_kthread+0x10/0x10 [ 18.065212] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.065236] ? calculate_sigpending+0x7b/0xa0 [ 18.065262] ? __pfx_kthread+0x10/0x10 [ 18.065287] ret_from_fork+0x116/0x1d0 [ 18.065308] ? __pfx_kthread+0x10/0x10 [ 18.065332] ret_from_fork_asm+0x1a/0x30 [ 18.065367] </TASK> [ 18.065381] [ 18.075407] Allocated by task 302: [ 18.075769] kasan_save_stack+0x45/0x70 [ 18.075949] kasan_save_track+0x18/0x40 [ 18.076157] kasan_save_alloc_info+0x3b/0x50 [ 18.076362] __kasan_kmalloc+0xb7/0xc0 [ 18.076532] __kmalloc_noprof+0x1c9/0x500 [ 18.076719] kunit_kmalloc_array+0x25/0x60 [ 18.077204] copy_user_test_oob+0xab/0x10f0 [ 18.077382] kunit_try_run_case+0x1a5/0x480 [ 18.077723] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.077925] kthread+0x337/0x6f0 [ 18.078237] ret_from_fork+0x116/0x1d0 [ 18.078390] ret_from_fork_asm+0x1a/0x30 [ 18.078696] [ 18.078829] The buggy address belongs to the object at ffff8881031c0b00 [ 18.078829] which belongs to the cache kmalloc-128 of size 128 [ 18.079515] The buggy address is located 0 bytes inside of [ 18.079515] allocated 120-byte region [ffff8881031c0b00, ffff8881031c0b78) [ 18.080146] [ 18.080366] The buggy address belongs to the physical page: [ 18.080639] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1031c0 [ 18.081087] flags: 0x200000000000000(node=0|zone=2) [ 18.081394] page_type: f5(slab) [ 18.081581] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.082044] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.082366] page dumped because: kasan: bad access detected [ 18.082697] [ 18.082832] Memory state around the buggy address: [ 18.083163] ffff8881031c0a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.083463] ffff8881031c0a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.083909] >ffff8881031c0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.084231] ^ [ 18.084615] ffff8881031c0b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.084944] ffff8881031c0c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.085399] ================================================================== [ 18.038441] ================================================================== [ 18.039110] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x557/0x10f0 [ 18.039445] Write of size 121 at addr ffff8881031c0b00 by task kunit_try_catch/302 [ 18.039973] [ 18.040105] CPU: 1 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 18.040154] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.040168] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.040191] Call Trace: [ 18.040212] <TASK> [ 18.040381] dump_stack_lvl+0x73/0xb0 [ 18.040417] print_report+0xd1/0x650 [ 18.040442] ? __virt_addr_valid+0x1db/0x2d0 [ 18.040468] ? copy_user_test_oob+0x557/0x10f0 [ 18.040495] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.040524] ? copy_user_test_oob+0x557/0x10f0 [ 18.040552] kasan_report+0x141/0x180 [ 18.040578] ? copy_user_test_oob+0x557/0x10f0 [ 18.040610] kasan_check_range+0x10c/0x1c0 [ 18.040637] __kasan_check_write+0x18/0x20 [ 18.040659] copy_user_test_oob+0x557/0x10f0 [ 18.040688] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.040716] ? __kasan_check_write+0x18/0x20 [ 18.040751] ? queued_spin_lock_slowpath+0x116/0xb40 [ 18.040779] ? irqentry_exit+0x2a/0x60 [ 18.040804] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 18.040831] ? trace_hardirqs_on+0x37/0xe0 [ 18.040858] ? __pfx_read_tsc+0x10/0x10 [ 18.040882] ? ktime_get_ts64+0x86/0x230 [ 18.040912] kunit_try_run_case+0x1a5/0x480 [ 18.040939] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.040967] ? queued_spin_lock_slowpath+0x116/0xb40 [ 18.040993] ? __kthread_parkme+0x82/0x180 [ 18.041016] ? preempt_count_sub+0x50/0x80 [ 18.041043] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.041081] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.041107] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.041133] kthread+0x337/0x6f0 [ 18.041155] ? trace_preempt_on+0x20/0xc0 [ 18.041180] ? __pfx_kthread+0x10/0x10 [ 18.041203] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.041227] ? calculate_sigpending+0x7b/0xa0 [ 18.041253] ? __pfx_kthread+0x10/0x10 [ 18.041281] ret_from_fork+0x116/0x1d0 [ 18.041302] ? __pfx_kthread+0x10/0x10 [ 18.041325] ret_from_fork_asm+0x1a/0x30 [ 18.041359] </TASK> [ 18.041374] [ 18.051222] Allocated by task 302: [ 18.051417] kasan_save_stack+0x45/0x70 [ 18.051757] kasan_save_track+0x18/0x40 [ 18.052075] kasan_save_alloc_info+0x3b/0x50 [ 18.052407] __kasan_kmalloc+0xb7/0xc0 [ 18.052585] __kmalloc_noprof+0x1c9/0x500 [ 18.052892] kunit_kmalloc_array+0x25/0x60 [ 18.053179] copy_user_test_oob+0xab/0x10f0 [ 18.053375] kunit_try_run_case+0x1a5/0x480 [ 18.053595] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.054064] kthread+0x337/0x6f0 [ 18.054242] ret_from_fork+0x116/0x1d0 [ 18.054497] ret_from_fork_asm+0x1a/0x30 [ 18.054654] [ 18.054759] The buggy address belongs to the object at ffff8881031c0b00 [ 18.054759] which belongs to the cache kmalloc-128 of size 128 [ 18.055605] The buggy address is located 0 bytes inside of [ 18.055605] allocated 120-byte region [ffff8881031c0b00, ffff8881031c0b78) [ 18.056208] [ 18.056424] The buggy address belongs to the physical page: [ 18.056629] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1031c0 [ 18.057201] flags: 0x200000000000000(node=0|zone=2) [ 18.057443] page_type: f5(slab) [ 18.057721] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.058171] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.058514] page dumped because: kasan: bad access detected [ 18.058983] [ 18.059092] Memory state around the buggy address: [ 18.059287] ffff8881031c0a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.059755] ffff8881031c0a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.060037] >ffff8881031c0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.060467] ^ [ 18.060889] ffff8881031c0b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.061290] ffff8881031c0c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.061678] ==================================================================
[ 78.275945] ================================================================== [ 78.283177] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x557/0x10f0 [ 78.290317] Write of size 121 at addr ffff8881066e9300 by task kunit_try_catch/326 [ 78.297919] [ 78.299420] CPU: 3 UID: 0 PID: 326 Comm: kunit_try_catch Tainted: G S B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 78.299429] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST [ 78.299432] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021 [ 78.299435] Call Trace: [ 78.299437] <TASK> [ 78.299439] dump_stack_lvl+0x73/0xb0 [ 78.299443] print_report+0xd1/0x650 [ 78.299448] ? __virt_addr_valid+0x1db/0x2d0 [ 78.299452] ? copy_user_test_oob+0x557/0x10f0 [ 78.299456] ? kasan_complete_mode_report_info+0x2a/0x200 [ 78.299461] ? copy_user_test_oob+0x557/0x10f0 [ 78.299466] kasan_report+0x141/0x180 [ 78.299470] ? copy_user_test_oob+0x557/0x10f0 [ 78.299476] kasan_check_range+0x10c/0x1c0 [ 78.299480] __kasan_check_write+0x18/0x20 [ 78.299484] copy_user_test_oob+0x557/0x10f0 [ 78.299489] ? __pfx_copy_user_test_oob+0x10/0x10 [ 78.299493] ? finish_task_switch.isra.0+0x153/0x700 [ 78.299498] ? __switch_to+0x544/0xf50 [ 78.299502] ? __schedule+0x10cc/0x2b60 [ 78.299507] ? ktime_get_ts64+0x83/0x230 [ 78.299511] kunit_try_run_case+0x1a2/0x480 [ 78.299516] ? __pfx_kunit_try_run_case+0x10/0x10 [ 78.299520] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 78.299525] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 78.299529] ? __kthread_parkme+0x82/0x180 [ 78.299533] ? preempt_count_sub+0x50/0x80 [ 78.299537] ? __pfx_kunit_try_run_case+0x10/0x10 [ 78.299542] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 78.299546] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 78.299550] kthread+0x334/0x6f0 [ 78.299554] ? trace_preempt_on+0x20/0xc0 [ 78.299558] ? __pfx_kthread+0x10/0x10 [ 78.299562] ? _raw_spin_unlock_irq+0x47/0x80 [ 78.299566] ? calculate_sigpending+0x7b/0xa0 [ 78.299571] ? __pfx_kthread+0x10/0x10 [ 78.299575] ret_from_fork+0x113/0x1d0 [ 78.299578] ? __pfx_kthread+0x10/0x10 [ 78.299582] ret_from_fork_asm+0x1a/0x30 [ 78.299588] </TASK> [ 78.299590] [ 78.477467] Allocated by task 326: [ 78.480872] kasan_save_stack+0x45/0x70 [ 78.484712] kasan_save_track+0x18/0x40 [ 78.488558] kasan_save_alloc_info+0x3b/0x50 [ 78.492832] __kasan_kmalloc+0xb7/0xc0 [ 78.496584] __kmalloc_noprof+0x1c9/0x500 [ 78.500595] kunit_kmalloc_array+0x25/0x60 [ 78.504694] copy_user_test_oob+0xab/0x10f0 [ 78.508882] kunit_try_run_case+0x1a2/0x480 [ 78.513067] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 78.518466] kthread+0x334/0x6f0 [ 78.521699] ret_from_fork+0x113/0x1d0 [ 78.525451] ret_from_fork_asm+0x1a/0x30 [ 78.529399] [ 78.530904] The buggy address belongs to the object at ffff8881066e9300 [ 78.530904] which belongs to the cache kmalloc-128 of size 128 [ 78.543420] The buggy address is located 0 bytes inside of [ 78.543420] allocated 120-byte region [ffff8881066e9300, ffff8881066e9378) [ 78.555856] [ 78.557376] The buggy address belongs to the physical page: [ 78.562980] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1066e9 [ 78.570986] flags: 0x200000000000000(node=0|zone=2) [ 78.575867] page_type: f5(slab) [ 78.579012] raw: 0200000000000000 ffff888100042a00 dead000000000122 0000000000000000 [ 78.586753] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 78.594501] page dumped because: kasan: bad access detected [ 78.600072] [ 78.601570] Memory state around the buggy address: [ 78.606377] ffff8881066e9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.613626] ffff8881066e9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.620846] >ffff8881066e9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 78.628067] ^ [ 78.635199] ffff8881066e9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.642421] ffff8881066e9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.649646] ================================================================== [ 78.656888] ================================================================== [ 78.664120] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x604/0x10f0 [ 78.671261] Read of size 121 at addr ffff8881066e9300 by task kunit_try_catch/326 [ 78.678746] [ 78.680248] CPU: 3 UID: 0 PID: 326 Comm: kunit_try_catch Tainted: G S B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 78.680257] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST [ 78.680260] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021 [ 78.680263] Call Trace: [ 78.680265] <TASK> [ 78.680267] dump_stack_lvl+0x73/0xb0 [ 78.680271] print_report+0xd1/0x650 [ 78.680275] ? __virt_addr_valid+0x1db/0x2d0 [ 78.680279] ? copy_user_test_oob+0x604/0x10f0 [ 78.680284] ? kasan_complete_mode_report_info+0x2a/0x200 [ 78.680289] ? copy_user_test_oob+0x604/0x10f0 [ 78.680294] kasan_report+0x141/0x180 [ 78.680298] ? copy_user_test_oob+0x604/0x10f0 [ 78.680304] kasan_check_range+0x10c/0x1c0 [ 78.680308] __kasan_check_read+0x15/0x20 [ 78.680312] copy_user_test_oob+0x604/0x10f0 [ 78.680317] ? __pfx_copy_user_test_oob+0x10/0x10 [ 78.680321] ? finish_task_switch.isra.0+0x153/0x700 [ 78.680346] ? __switch_to+0x544/0xf50 [ 78.680351] ? __schedule+0x10cc/0x2b60 [ 78.680355] ? ktime_get_ts64+0x83/0x230 [ 78.680360] kunit_try_run_case+0x1a2/0x480 [ 78.680365] ? __pfx_kunit_try_run_case+0x10/0x10 [ 78.680382] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 78.680386] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 78.680391] ? __kthread_parkme+0x82/0x180 [ 78.680394] ? preempt_count_sub+0x50/0x80 [ 78.680399] ? __pfx_kunit_try_run_case+0x10/0x10 [ 78.680403] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 78.680408] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 78.680412] kthread+0x334/0x6f0 [ 78.680416] ? trace_preempt_on+0x20/0xc0 [ 78.680420] ? __pfx_kthread+0x10/0x10 [ 78.680424] ? _raw_spin_unlock_irq+0x47/0x80 [ 78.680428] ? calculate_sigpending+0x7b/0xa0 [ 78.680433] ? __pfx_kthread+0x10/0x10 [ 78.680437] ret_from_fork+0x113/0x1d0 [ 78.680440] ? __pfx_kthread+0x10/0x10 [ 78.680444] ret_from_fork_asm+0x1a/0x30 [ 78.680450] </TASK> [ 78.680452] [ 78.858103] Allocated by task 326: [ 78.861510] kasan_save_stack+0x45/0x70 [ 78.865364] kasan_save_track+0x18/0x40 [ 78.869248] kasan_save_alloc_info+0x3b/0x50 [ 78.873522] __kasan_kmalloc+0xb7/0xc0 [ 78.877273] __kmalloc_noprof+0x1c9/0x500 [ 78.881287] kunit_kmalloc_array+0x25/0x60 [ 78.885393] copy_user_test_oob+0xab/0x10f0 [ 78.889581] kunit_try_run_case+0x1a2/0x480 [ 78.893767] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 78.899166] kthread+0x334/0x6f0 [ 78.902399] ret_from_fork+0x113/0x1d0 [ 78.906178] ret_from_fork_asm+0x1a/0x30 [ 78.910113] [ 78.911610] The buggy address belongs to the object at ffff8881066e9300 [ 78.911610] which belongs to the cache kmalloc-128 of size 128 [ 78.924119] The buggy address is located 0 bytes inside of [ 78.924119] allocated 120-byte region [ffff8881066e9300, ffff8881066e9378) [ 78.936555] [ 78.938052] The buggy address belongs to the physical page: [ 78.943627] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1066e9 [ 78.951634] flags: 0x200000000000000(node=0|zone=2) [ 78.956512] page_type: f5(slab) [ 78.959660] raw: 0200000000000000 ffff888100042a00 dead000000000122 0000000000000000 [ 78.967430] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 78.975173] page dumped because: kasan: bad access detected [ 78.980746] [ 78.982245] Memory state around the buggy address: [ 78.987038] ffff8881066e9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.994266] ffff8881066e9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.001494] >ffff8881066e9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 79.008714] ^ [ 79.015853] ffff8881066e9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.023073] ffff8881066e9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 79.030292] ================================================================== [ 77.895457] ================================================================== [ 77.902685] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x4aa/0x10f0 [ 77.909819] Read of size 121 at addr ffff8881066e9300 by task kunit_try_catch/326 [ 77.917307] [ 77.918808] CPU: 3 UID: 0 PID: 326 Comm: kunit_try_catch Tainted: G S B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 77.918817] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST [ 77.918820] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021 [ 77.918823] Call Trace: [ 77.918825] <TASK> [ 77.918827] dump_stack_lvl+0x73/0xb0 [ 77.918831] print_report+0xd1/0x650 [ 77.918835] ? __virt_addr_valid+0x1db/0x2d0 [ 77.918840] ? copy_user_test_oob+0x4aa/0x10f0 [ 77.918844] ? kasan_complete_mode_report_info+0x2a/0x200 [ 77.918849] ? copy_user_test_oob+0x4aa/0x10f0 [ 77.918854] kasan_report+0x141/0x180 [ 77.918858] ? copy_user_test_oob+0x4aa/0x10f0 [ 77.918864] kasan_check_range+0x10c/0x1c0 [ 77.918869] __kasan_check_read+0x15/0x20 [ 77.918872] copy_user_test_oob+0x4aa/0x10f0 [ 77.918877] ? __pfx_copy_user_test_oob+0x10/0x10 [ 77.918882] ? finish_task_switch.isra.0+0x153/0x700 [ 77.918886] ? __switch_to+0x544/0xf50 [ 77.918891] ? __schedule+0x10cc/0x2b60 [ 77.918895] ? ktime_get_ts64+0x83/0x230 [ 77.918899] kunit_try_run_case+0x1a2/0x480 [ 77.918904] ? __pfx_kunit_try_run_case+0x10/0x10 [ 77.918908] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 77.918913] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 77.918917] ? __kthread_parkme+0x82/0x180 [ 77.918921] ? preempt_count_sub+0x50/0x80 [ 77.918925] ? __pfx_kunit_try_run_case+0x10/0x10 [ 77.918930] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 77.918934] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 77.918939] kthread+0x334/0x6f0 [ 77.918942] ? trace_preempt_on+0x20/0xc0 [ 77.918947] ? __pfx_kthread+0x10/0x10 [ 77.918951] ? _raw_spin_unlock_irq+0x47/0x80 [ 77.918955] ? calculate_sigpending+0x7b/0xa0 [ 77.918959] ? __pfx_kthread+0x10/0x10 [ 77.918963] ret_from_fork+0x113/0x1d0 [ 77.918967] ? __pfx_kthread+0x10/0x10 [ 77.918971] ret_from_fork_asm+0x1a/0x30 [ 77.918977] </TASK> [ 77.918978] [ 78.096618] Allocated by task 326: [ 78.100026] kasan_save_stack+0x45/0x70 [ 78.103874] kasan_save_track+0x18/0x40 [ 78.107720] kasan_save_alloc_info+0x3b/0x50 [ 78.111994] __kasan_kmalloc+0xb7/0xc0 [ 78.115746] __kmalloc_noprof+0x1c9/0x500 [ 78.119760] kunit_kmalloc_array+0x25/0x60 [ 78.123866] copy_user_test_oob+0xab/0x10f0 [ 78.128053] kunit_try_run_case+0x1a2/0x480 [ 78.132238] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 78.137639] kthread+0x334/0x6f0 [ 78.140872] ret_from_fork+0x113/0x1d0 [ 78.144623] ret_from_fork_asm+0x1a/0x30 [ 78.148549] [ 78.150048] The buggy address belongs to the object at ffff8881066e9300 [ 78.150048] which belongs to the cache kmalloc-128 of size 128 [ 78.162562] The buggy address is located 0 bytes inside of [ 78.162562] allocated 120-byte region [ffff8881066e9300, ffff8881066e9378) [ 78.174990] [ 78.176491] The buggy address belongs to the physical page: [ 78.182062] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1066e9 [ 78.190063] flags: 0x200000000000000(node=0|zone=2) [ 78.194942] page_type: f5(slab) [ 78.198090] raw: 0200000000000000 ffff888100042a00 dead000000000122 0000000000000000 [ 78.205836] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 78.213575] page dumped because: kasan: bad access detected [ 78.219147] [ 78.220648] Memory state around the buggy address: [ 78.225439] ffff8881066e9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.232659] ffff8881066e9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.239878] >ffff8881066e9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 78.247097] ^ [ 78.254231] ffff8881066e9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.261451] ffff8881066e9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.268678] ================================================================== [ 77.514557] ================================================================== [ 77.521788] BUG: KASAN: slab-out-of-bounds in copy_user_test_oob+0x3fd/0x10f0 [ 77.528930] Write of size 121 at addr ffff8881066e9300 by task kunit_try_catch/326 [ 77.536503] [ 77.538004] CPU: 3 UID: 0 PID: 326 Comm: kunit_try_catch Tainted: G S B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 77.538013] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST [ 77.538016] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021 [ 77.538019] Call Trace: [ 77.538021] <TASK> [ 77.538023] dump_stack_lvl+0x73/0xb0 [ 77.538028] print_report+0xd1/0x650 [ 77.538032] ? __virt_addr_valid+0x1db/0x2d0 [ 77.538036] ? copy_user_test_oob+0x3fd/0x10f0 [ 77.538041] ? kasan_complete_mode_report_info+0x2a/0x200 [ 77.538046] ? copy_user_test_oob+0x3fd/0x10f0 [ 77.538051] kasan_report+0x141/0x180 [ 77.538055] ? copy_user_test_oob+0x3fd/0x10f0 [ 77.538061] kasan_check_range+0x10c/0x1c0 [ 77.538065] __kasan_check_write+0x18/0x20 [ 77.538069] copy_user_test_oob+0x3fd/0x10f0 [ 77.538074] ? __pfx_copy_user_test_oob+0x10/0x10 [ 77.538078] ? finish_task_switch.isra.0+0x153/0x700 [ 77.538083] ? __switch_to+0x544/0xf50 [ 77.538088] ? __schedule+0x10cc/0x2b60 [ 77.538092] ? ktime_get_ts64+0x83/0x230 [ 77.538096] kunit_try_run_case+0x1a2/0x480 [ 77.538101] ? __pfx_kunit_try_run_case+0x10/0x10 [ 77.538106] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 77.538110] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 77.538114] ? __kthread_parkme+0x82/0x180 [ 77.538118] ? preempt_count_sub+0x50/0x80 [ 77.538122] ? __pfx_kunit_try_run_case+0x10/0x10 [ 77.538127] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 77.538131] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 77.538136] kthread+0x334/0x6f0 [ 77.538140] ? trace_preempt_on+0x20/0xc0 [ 77.538144] ? __pfx_kthread+0x10/0x10 [ 77.538148] ? _raw_spin_unlock_irq+0x47/0x80 [ 77.538152] ? calculate_sigpending+0x7b/0xa0 [ 77.538157] ? __pfx_kthread+0x10/0x10 [ 77.538161] ret_from_fork+0x113/0x1d0 [ 77.538164] ? __pfx_kthread+0x10/0x10 [ 77.538168] ret_from_fork_asm+0x1a/0x30 [ 77.538174] </TASK> [ 77.538176] [ 77.715980] Allocated by task 326: [ 77.719393] kasan_save_stack+0x45/0x70 [ 77.723236] kasan_save_track+0x18/0x40 [ 77.727072] kasan_save_alloc_info+0x3b/0x50 [ 77.731364] __kasan_kmalloc+0xb7/0xc0 [ 77.735167] __kmalloc_noprof+0x1c9/0x500 [ 77.739180] kunit_kmalloc_array+0x25/0x60 [ 77.743282] copy_user_test_oob+0xab/0x10f0 [ 77.747476] kunit_try_run_case+0x1a2/0x480 [ 77.751661] kunit_generic_run_threadfn_adapter+0x82/0xf0 [ 77.757062] kthread+0x334/0x6f0 [ 77.760294] ret_from_fork+0x113/0x1d0 [ 77.764045] ret_from_fork_asm+0x1a/0x30 [ 77.767971] [ 77.769473] The buggy address belongs to the object at ffff8881066e9300 [ 77.769473] which belongs to the cache kmalloc-128 of size 128 [ 77.781986] The buggy address is located 0 bytes inside of [ 77.781986] allocated 120-byte region [ffff8881066e9300, ffff8881066e9378) [ 77.794419] [ 77.795921] The buggy address belongs to the physical page: [ 77.801493] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1066e9 [ 77.809494] flags: 0x200000000000000(node=0|zone=2) [ 77.814386] page_type: f5(slab) [ 77.817564] raw: 0200000000000000 ffff888100042a00 dead000000000122 0000000000000000 [ 77.825312] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 77.833059] page dumped because: kasan: bad access detected [ 77.838631] [ 77.840131] Memory state around the buggy address: [ 77.844922] ffff8881066e9200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.852144] ffff8881066e9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.859382] >ffff8881066e9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 77.866633] ^ [ 77.873764] ffff8881066e9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.880984] ffff8881066e9400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.888203] ==================================================================