Date
July 17, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.589351] ================================================================== [ 18.589413] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 18.589473] Write of size 1 at addr fff00000c65eec78 by task kunit_try_catch/286 [ 18.589695] [ 18.589808] CPU: 0 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 18.590002] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.590033] Hardware name: linux,dummy-virt (DT) [ 18.590065] Call trace: [ 18.590088] show_stack+0x20/0x38 (C) [ 18.590140] dump_stack_lvl+0x8c/0xd0 [ 18.590283] print_report+0x118/0x5d0 [ 18.590336] kasan_report+0xdc/0x128 [ 18.590383] __asan_report_store1_noabort+0x20/0x30 [ 18.590601] strncpy_from_user+0x270/0x2a0 [ 18.590653] copy_user_test_oob+0x5c0/0xec8 [ 18.590704] kunit_try_run_case+0x170/0x3f0 [ 18.590750] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.590807] kthread+0x328/0x630 [ 18.590849] ret_from_fork+0x10/0x20 [ 18.590898] [ 18.590918] Allocated by task 286: [ 18.590955] kasan_save_stack+0x3c/0x68 [ 18.591162] kasan_save_track+0x20/0x40 [ 18.591204] kasan_save_alloc_info+0x40/0x58 [ 18.591321] __kasan_kmalloc+0xd4/0xd8 [ 18.591535] __kmalloc_noprof+0x198/0x4c8 [ 18.591744] kunit_kmalloc_array+0x34/0x88 [ 18.591969] copy_user_test_oob+0xac/0xec8 [ 18.592030] kunit_try_run_case+0x170/0x3f0 [ 18.592071] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.592119] kthread+0x328/0x630 [ 18.592152] ret_from_fork+0x10/0x20 [ 18.592424] [ 18.592448] The buggy address belongs to the object at fff00000c65eec00 [ 18.592448] which belongs to the cache kmalloc-128 of size 128 [ 18.592697] The buggy address is located 0 bytes to the right of [ 18.592697] allocated 120-byte region [fff00000c65eec00, fff00000c65eec78) [ 18.592969] [ 18.593003] The buggy address belongs to the physical page: [ 18.593040] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065ee [ 18.593383] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.593442] page_type: f5(slab) [ 18.593534] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 18.593642] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.593724] page dumped because: kasan: bad access detected [ 18.593759] [ 18.593779] Memory state around the buggy address: [ 18.593869] fff00000c65eeb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.593929] fff00000c65eeb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.593975] >fff00000c65eec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.594026] ^ [ 18.594071] fff00000c65eec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.594116] fff00000c65eed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.594158] ================================================================== [ 18.582716] ================================================================== [ 18.582766] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 18.582819] Write of size 121 at addr fff00000c65eec00 by task kunit_try_catch/286 [ 18.583050] [ 18.583191] CPU: 0 UID: 0 PID: 286 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT [ 18.583278] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.583326] Hardware name: linux,dummy-virt (DT) [ 18.583357] Call trace: [ 18.583379] show_stack+0x20/0x38 (C) [ 18.583433] dump_stack_lvl+0x8c/0xd0 [ 18.583480] print_report+0x118/0x5d0 [ 18.583533] kasan_report+0xdc/0x128 [ 18.584038] kasan_check_range+0x100/0x1a8 [ 18.584597] __kasan_check_write+0x20/0x30 [ 18.584857] strncpy_from_user+0x3c/0x2a0 [ 18.584911] copy_user_test_oob+0x5c0/0xec8 [ 18.584959] kunit_try_run_case+0x170/0x3f0 [ 18.585020] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.585075] kthread+0x328/0x630 [ 18.585120] ret_from_fork+0x10/0x20 [ 18.585169] [ 18.585188] Allocated by task 286: [ 18.585357] kasan_save_stack+0x3c/0x68 [ 18.585442] kasan_save_track+0x20/0x40 [ 18.585513] kasan_save_alloc_info+0x40/0x58 [ 18.585571] __kasan_kmalloc+0xd4/0xd8 [ 18.585609] __kmalloc_noprof+0x198/0x4c8 [ 18.585707] kunit_kmalloc_array+0x34/0x88 [ 18.585790] copy_user_test_oob+0xac/0xec8 [ 18.585830] kunit_try_run_case+0x170/0x3f0 [ 18.585869] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.585916] kthread+0x328/0x630 [ 18.585963] ret_from_fork+0x10/0x20 [ 18.586099] [ 18.586384] The buggy address belongs to the object at fff00000c65eec00 [ 18.586384] which belongs to the cache kmalloc-128 of size 128 [ 18.586613] The buggy address is located 0 bytes inside of [ 18.586613] allocated 120-byte region [fff00000c65eec00, fff00000c65eec78) [ 18.586779] [ 18.586851] The buggy address belongs to the physical page: [ 18.586915] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065ee [ 18.587050] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.587134] page_type: f5(slab) [ 18.587209] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 18.587295] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.587342] page dumped because: kasan: bad access detected [ 18.587377] [ 18.587396] Memory state around the buggy address: [ 18.587436] fff00000c65eeb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.587482] fff00000c65eeb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.587528] >fff00000c65eec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.587632] ^ [ 18.587678] fff00000c65eec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.587774] fff00000c65eed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.587989] ==================================================================
[ 17.274119] ================================================================== [ 17.274422] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 17.274757] Write of size 121 at addr ffff8881025ccc00 by task kunit_try_catch/302 [ 17.274991] [ 17.275085] CPU: 1 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 17.275128] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.275142] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.275163] Call Trace: [ 17.275177] <TASK> [ 17.275190] dump_stack_lvl+0x73/0xb0 [ 17.275218] print_report+0xd1/0x610 [ 17.275242] ? __virt_addr_valid+0x1db/0x2d0 [ 17.275266] ? strncpy_from_user+0x2e/0x1d0 [ 17.275291] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.275317] ? strncpy_from_user+0x2e/0x1d0 [ 17.275343] kasan_report+0x141/0x180 [ 17.275367] ? strncpy_from_user+0x2e/0x1d0 [ 17.275396] kasan_check_range+0x10c/0x1c0 [ 17.275432] __kasan_check_write+0x18/0x20 [ 17.275453] strncpy_from_user+0x2e/0x1d0 [ 17.275477] ? __kasan_check_read+0x15/0x20 [ 17.275501] copy_user_test_oob+0x760/0x10f0 [ 17.275528] ? __pfx_copy_user_test_oob+0x10/0x10 [ 17.275568] ? __kasan_check_write+0x18/0x20 [ 17.275590] ? queued_spin_lock_slowpath+0x116/0xb40 [ 17.275615] ? irqentry_exit+0x2a/0x60 [ 17.275638] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 17.275664] ? trace_hardirqs_on+0x37/0xe0 [ 17.275689] ? __pfx_read_tsc+0x10/0x10 [ 17.275711] ? ktime_get_ts64+0x86/0x230 [ 17.275735] kunit_try_run_case+0x1a5/0x480 [ 17.275761] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.275788] ? queued_spin_lock_slowpath+0x116/0xb40 [ 17.275814] ? __kthread_parkme+0x82/0x180 [ 17.275836] ? preempt_count_sub+0x50/0x80 [ 17.275860] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.275886] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.275913] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.275940] kthread+0x337/0x6f0 [ 17.275960] ? trace_preempt_on+0x20/0xc0 [ 17.275984] ? __pfx_kthread+0x10/0x10 [ 17.276005] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.276028] ? calculate_sigpending+0x7b/0xa0 [ 17.276054] ? __pfx_kthread+0x10/0x10 [ 17.276080] ret_from_fork+0x116/0x1d0 [ 17.276100] ? __pfx_kthread+0x10/0x10 [ 17.276122] ret_from_fork_asm+0x1a/0x30 [ 17.276154] </TASK> [ 17.276165] [ 17.287038] Allocated by task 302: [ 17.287222] kasan_save_stack+0x45/0x70 [ 17.287418] kasan_save_track+0x18/0x40 [ 17.287779] kasan_save_alloc_info+0x3b/0x50 [ 17.287987] __kasan_kmalloc+0xb7/0xc0 [ 17.288166] __kmalloc_noprof+0x1c9/0x500 [ 17.288357] kunit_kmalloc_array+0x25/0x60 [ 17.288761] copy_user_test_oob+0xab/0x10f0 [ 17.288950] kunit_try_run_case+0x1a5/0x480 [ 17.289167] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.289618] kthread+0x337/0x6f0 [ 17.289789] ret_from_fork+0x116/0x1d0 [ 17.290118] ret_from_fork_asm+0x1a/0x30 [ 17.290276] [ 17.290380] The buggy address belongs to the object at ffff8881025ccc00 [ 17.290380] which belongs to the cache kmalloc-128 of size 128 [ 17.291148] The buggy address is located 0 bytes inside of [ 17.291148] allocated 120-byte region [ffff8881025ccc00, ffff8881025ccc78) [ 17.291798] [ 17.292012] The buggy address belongs to the physical page: [ 17.292276] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1025cc [ 17.292751] flags: 0x200000000000000(node=0|zone=2) [ 17.292965] page_type: f5(slab) [ 17.293241] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 17.293648] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.293942] page dumped because: kasan: bad access detected [ 17.294189] [ 17.294269] Memory state around the buggy address: [ 17.294481] ffff8881025ccb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.295024] ffff8881025ccb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.295384] >ffff8881025ccc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.295713] ^ [ 17.296112] ffff8881025ccc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.296517] ffff8881025ccd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.296899] ================================================================== [ 17.297518] ================================================================== [ 17.297839] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 17.298127] Write of size 1 at addr ffff8881025ccc78 by task kunit_try_catch/302 [ 17.298930] [ 17.299044] CPU: 1 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6 #1 PREEMPT(voluntary) [ 17.299090] Tainted: [B]=BAD_PAGE, [N]=TEST [ 17.299103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 17.299126] Call Trace: [ 17.299144] <TASK> [ 17.299161] dump_stack_lvl+0x73/0xb0 [ 17.299305] print_report+0xd1/0x610 [ 17.299335] ? __virt_addr_valid+0x1db/0x2d0 [ 17.299360] ? strncpy_from_user+0x1a5/0x1d0 [ 17.299385] ? kasan_complete_mode_report_info+0x2a/0x200 [ 17.299418] ? strncpy_from_user+0x1a5/0x1d0 [ 17.299443] kasan_report+0x141/0x180 [ 17.299466] ? strncpy_from_user+0x1a5/0x1d0 [ 17.299494] __asan_report_store1_noabort+0x1b/0x30 [ 17.299522] strncpy_from_user+0x1a5/0x1d0 [ 17.299563] copy_user_test_oob+0x760/0x10f0 [ 17.299591] ? __pfx_copy_user_test_oob+0x10/0x10 [ 17.299617] ? __kasan_check_write+0x18/0x20 [ 17.299639] ? queued_spin_lock_slowpath+0x116/0xb40 [ 17.299664] ? irqentry_exit+0x2a/0x60 [ 17.299686] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 17.299713] ? trace_hardirqs_on+0x37/0xe0 [ 17.299738] ? __pfx_read_tsc+0x10/0x10 [ 17.299760] ? ktime_get_ts64+0x86/0x230 [ 17.299786] kunit_try_run_case+0x1a5/0x480 [ 17.299811] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.299837] ? queued_spin_lock_slowpath+0x116/0xb40 [ 17.299863] ? __kthread_parkme+0x82/0x180 [ 17.299885] ? preempt_count_sub+0x50/0x80 [ 17.299910] ? __pfx_kunit_try_run_case+0x10/0x10 [ 17.299936] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.299962] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 17.299989] kthread+0x337/0x6f0 [ 17.300009] ? trace_preempt_on+0x20/0xc0 [ 17.300032] ? __pfx_kthread+0x10/0x10 [ 17.300054] ? _raw_spin_unlock_irq+0x47/0x80 [ 17.300085] ? calculate_sigpending+0x7b/0xa0 [ 17.300111] ? __pfx_kthread+0x10/0x10 [ 17.300134] ret_from_fork+0x116/0x1d0 [ 17.300155] ? __pfx_kthread+0x10/0x10 [ 17.300176] ret_from_fork_asm+0x1a/0x30 [ 17.300209] </TASK> [ 17.300220] [ 17.310020] Allocated by task 302: [ 17.310395] kasan_save_stack+0x45/0x70 [ 17.310660] kasan_save_track+0x18/0x40 [ 17.310977] kasan_save_alloc_info+0x3b/0x50 [ 17.311237] __kasan_kmalloc+0xb7/0xc0 [ 17.311442] __kmalloc_noprof+0x1c9/0x500 [ 17.311641] kunit_kmalloc_array+0x25/0x60 [ 17.311822] copy_user_test_oob+0xab/0x10f0 [ 17.312015] kunit_try_run_case+0x1a5/0x480 [ 17.312207] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 17.312428] kthread+0x337/0x6f0 [ 17.312961] ret_from_fork+0x116/0x1d0 [ 17.313134] ret_from_fork_asm+0x1a/0x30 [ 17.313276] [ 17.313378] The buggy address belongs to the object at ffff8881025ccc00 [ 17.313378] which belongs to the cache kmalloc-128 of size 128 [ 17.314103] The buggy address is located 0 bytes to the right of [ 17.314103] allocated 120-byte region [ffff8881025ccc00, ffff8881025ccc78) [ 17.314767] [ 17.314949] The buggy address belongs to the physical page: [ 17.315319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1025cc [ 17.315763] flags: 0x200000000000000(node=0|zone=2) [ 17.316085] page_type: f5(slab) [ 17.316223] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 17.316670] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 17.317028] page dumped because: kasan: bad access detected [ 17.317261] [ 17.317339] Memory state around the buggy address: [ 17.317661] ffff8881025ccb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.317935] ffff8881025ccb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.318208] >ffff8881025ccc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 17.318521] ^ [ 17.318806] ffff8881025ccc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.319051] ffff8881025ccd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.319331] ==================================================================