Date
May 15, 2025, 10:38 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 20.864821] ================================================================== [ 20.864884] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 20.864950] Write of size 1 at addr fff00000c1729a78 by task kunit_try_catch/285 [ 20.865013] [ 20.865054] CPU: 0 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT [ 20.865305] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.865431] Hardware name: linux,dummy-virt (DT) [ 20.865582] Call trace: [ 20.865606] show_stack+0x20/0x38 (C) [ 20.865657] dump_stack_lvl+0x8c/0xd0 [ 20.866002] print_report+0x118/0x608 [ 20.866060] kasan_report+0xdc/0x128 [ 20.866170] __asan_report_store1_noabort+0x20/0x30 [ 20.866262] strncpy_from_user+0x270/0x2a0 [ 20.866310] copy_user_test_oob+0x5c0/0xec8 [ 20.866359] kunit_try_run_case+0x170/0x3f0 [ 20.866416] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.866481] kthread+0x328/0x630 [ 20.866639] ret_from_fork+0x10/0x20 [ 20.866794] [ 20.866818] Allocated by task 285: [ 20.866873] kasan_save_stack+0x3c/0x68 [ 20.867052] kasan_save_track+0x20/0x40 [ 20.867097] kasan_save_alloc_info+0x40/0x58 [ 20.867140] __kasan_kmalloc+0xd4/0xd8 [ 20.867441] __kmalloc_noprof+0x190/0x4d0 [ 20.867487] kunit_kmalloc_array+0x34/0x88 [ 20.867527] copy_user_test_oob+0xac/0xec8 [ 20.867566] kunit_try_run_case+0x170/0x3f0 [ 20.867621] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.867836] kthread+0x328/0x630 [ 20.867873] ret_from_fork+0x10/0x20 [ 20.867956] [ 20.868328] The buggy address belongs to the object at fff00000c1729a00 [ 20.868328] which belongs to the cache kmalloc-128 of size 128 [ 20.868464] The buggy address is located 0 bytes to the right of [ 20.868464] allocated 120-byte region [fff00000c1729a00, fff00000c1729a78) [ 20.868530] [ 20.868604] The buggy address belongs to the physical page: [ 20.868748] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101729 [ 20.868845] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.868912] page_type: f5(slab) [ 20.869020] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.869145] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.869269] page dumped because: kasan: bad access detected [ 20.869390] [ 20.869432] Memory state around the buggy address: [ 20.869474] fff00000c1729900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.869553] fff00000c1729980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.869628] >fff00000c1729a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.869669] ^ [ 20.869711] fff00000c1729a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.869755] fff00000c1729b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.869797] ================================================================== [ 20.858859] ================================================================== [ 20.859039] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 20.859181] Write of size 121 at addr fff00000c1729a00 by task kunit_try_catch/285 [ 20.859418] [ 20.859578] CPU: 0 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT [ 20.859954] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.859984] Hardware name: linux,dummy-virt (DT) [ 20.860062] Call trace: [ 20.860803] show_stack+0x20/0x38 (C) [ 20.860979] dump_stack_lvl+0x8c/0xd0 [ 20.861232] print_report+0x118/0x608 [ 20.861319] kasan_report+0xdc/0x128 [ 20.861510] kasan_check_range+0x100/0x1a8 [ 20.861676] __kasan_check_write+0x20/0x30 [ 20.861793] strncpy_from_user+0x3c/0x2a0 [ 20.861894] copy_user_test_oob+0x5c0/0xec8 [ 20.862001] kunit_try_run_case+0x170/0x3f0 [ 20.862051] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.862105] kthread+0x328/0x630 [ 20.862152] ret_from_fork+0x10/0x20 [ 20.862210] [ 20.862230] Allocated by task 285: [ 20.862258] kasan_save_stack+0x3c/0x68 [ 20.862316] kasan_save_track+0x20/0x40 [ 20.862358] kasan_save_alloc_info+0x40/0x58 [ 20.862405] __kasan_kmalloc+0xd4/0xd8 [ 20.862443] __kmalloc_noprof+0x190/0x4d0 [ 20.862480] kunit_kmalloc_array+0x34/0x88 [ 20.862542] copy_user_test_oob+0xac/0xec8 [ 20.862583] kunit_try_run_case+0x170/0x3f0 [ 20.862621] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.862735] kthread+0x328/0x630 [ 20.862812] ret_from_fork+0x10/0x20 [ 20.862894] [ 20.862915] The buggy address belongs to the object at fff00000c1729a00 [ 20.862915] which belongs to the cache kmalloc-128 of size 128 [ 20.862975] The buggy address is located 0 bytes inside of [ 20.862975] allocated 120-byte region [fff00000c1729a00, fff00000c1729a78) [ 20.863048] [ 20.863069] The buggy address belongs to the physical page: [ 20.863121] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101729 [ 20.863223] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.863361] page_type: f5(slab) [ 20.863430] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.863483] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.863525] page dumped because: kasan: bad access detected [ 20.863559] [ 20.863580] Memory state around the buggy address: [ 20.863624] fff00000c1729900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.863678] fff00000c1729980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.863722] >fff00000c1729a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 20.863773] ^ [ 20.863814] fff00000c1729a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.863893] fff00000c1729b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.863991] ==================================================================
[ 18.065615] ================================================================== [ 18.065791] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 18.066087] Write of size 121 at addr ffff888102b5b800 by task kunit_try_catch/303 [ 18.066468] [ 18.066605] CPU: 0 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT(voluntary) [ 18.066658] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.066672] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.066695] Call Trace: [ 18.066712] <TASK> [ 18.066729] dump_stack_lvl+0x73/0xb0 [ 18.066758] print_report+0xd1/0x650 [ 18.066783] ? __virt_addr_valid+0x1db/0x2d0 [ 18.066807] ? strncpy_from_user+0x2e/0x1d0 [ 18.066831] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.066856] ? strncpy_from_user+0x2e/0x1d0 [ 18.066880] kasan_report+0x141/0x180 [ 18.066904] ? strncpy_from_user+0x2e/0x1d0 [ 18.066934] kasan_check_range+0x10c/0x1c0 [ 18.066959] __kasan_check_write+0x18/0x20 [ 18.066981] strncpy_from_user+0x2e/0x1d0 [ 18.067009] copy_user_test_oob+0x760/0x10f0 [ 18.067036] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.067061] ? finish_task_switch.isra.0+0x153/0x700 [ 18.067083] ? __switch_to+0x47/0xf50 [ 18.067109] ? __schedule+0x10cc/0x2b60 [ 18.067133] ? __pfx_read_tsc+0x10/0x10 [ 18.067155] ? ktime_get_ts64+0x86/0x230 [ 18.067181] kunit_try_run_case+0x1a5/0x480 [ 18.067205] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.067238] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.067264] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.067289] ? __kthread_parkme+0x82/0x180 [ 18.067311] ? preempt_count_sub+0x50/0x80 [ 18.067335] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.067360] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.067385] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.067409] kthread+0x337/0x6f0 [ 18.067430] ? trace_preempt_on+0x20/0xc0 [ 18.067455] ? __pfx_kthread+0x10/0x10 [ 18.067477] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.067499] ? calculate_sigpending+0x7b/0xa0 [ 18.067524] ? __pfx_kthread+0x10/0x10 [ 18.067547] ret_from_fork+0x116/0x1d0 [ 18.067567] ? __pfx_kthread+0x10/0x10 [ 18.067589] ret_from_fork_asm+0x1a/0x30 [ 18.067623] </TASK> [ 18.067635] [ 18.074366] Allocated by task 303: [ 18.074453] kasan_save_stack+0x45/0x70 [ 18.074543] kasan_save_track+0x18/0x40 [ 18.074631] kasan_save_alloc_info+0x3b/0x50 [ 18.074719] __kasan_kmalloc+0xb7/0xc0 [ 18.074803] __kmalloc_noprof+0x1c9/0x500 [ 18.075011] kunit_kmalloc_array+0x25/0x60 [ 18.075267] copy_user_test_oob+0xab/0x10f0 [ 18.075527] kunit_try_run_case+0x1a5/0x480 [ 18.075792] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.075991] kthread+0x337/0x6f0 [ 18.076073] ret_from_fork+0x116/0x1d0 [ 18.076156] ret_from_fork_asm+0x1a/0x30 [ 18.076254] [ 18.076371] The buggy address belongs to the object at ffff888102b5b800 [ 18.076371] which belongs to the cache kmalloc-128 of size 128 [ 18.076993] The buggy address is located 0 bytes inside of [ 18.076993] allocated 120-byte region [ffff888102b5b800, ffff888102b5b878) [ 18.077302] [ 18.077402] The buggy address belongs to the physical page: [ 18.077569] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b5b [ 18.077806] flags: 0x200000000000000(node=0|zone=2) [ 18.077911] page_type: f5(slab) [ 18.077999] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.078134] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.078273] page dumped because: kasan: bad access detected [ 18.078387] [ 18.078443] Memory state around the buggy address: [ 18.078540] ffff888102b5b700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.078666] ffff888102b5b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.078791] >ffff888102b5b800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.078912] ^ [ 18.079031] ffff888102b5b880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.079151] ffff888102b5b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.079332] ================================================================== [ 18.079763] ================================================================== [ 18.079907] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 18.080044] Write of size 1 at addr ffff888102b5b878 by task kunit_try_catch/303 [ 18.080176] [ 18.080254] CPU: 0 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT(voluntary) [ 18.080302] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.080315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 18.080337] Call Trace: [ 18.080351] <TASK> [ 18.080366] dump_stack_lvl+0x73/0xb0 [ 18.080392] print_report+0xd1/0x650 [ 18.080416] ? __virt_addr_valid+0x1db/0x2d0 [ 18.080439] ? strncpy_from_user+0x1a5/0x1d0 [ 18.080462] ? kasan_complete_mode_report_info+0x2a/0x200 [ 18.080485] ? strncpy_from_user+0x1a5/0x1d0 [ 18.080508] kasan_report+0x141/0x180 [ 18.080531] ? strncpy_from_user+0x1a5/0x1d0 [ 18.080559] __asan_report_store1_noabort+0x1b/0x30 [ 18.080581] strncpy_from_user+0x1a5/0x1d0 [ 18.080606] copy_user_test_oob+0x760/0x10f0 [ 18.080631] ? __pfx_copy_user_test_oob+0x10/0x10 [ 18.080655] ? finish_task_switch.isra.0+0x153/0x700 [ 18.080676] ? __switch_to+0x47/0xf50 [ 18.080700] ? __schedule+0x10cc/0x2b60 [ 18.080723] ? __pfx_read_tsc+0x10/0x10 [ 18.080743] ? ktime_get_ts64+0x86/0x230 [ 18.080767] kunit_try_run_case+0x1a5/0x480 [ 18.080791] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.080813] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 18.080836] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 18.080858] ? __kthread_parkme+0x82/0x180 [ 18.080878] ? preempt_count_sub+0x50/0x80 [ 18.080901] ? __pfx_kunit_try_run_case+0x10/0x10 [ 18.080925] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.080948] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 18.080971] kthread+0x337/0x6f0 [ 18.080991] ? trace_preempt_on+0x20/0xc0 [ 18.081014] ? __pfx_kthread+0x10/0x10 [ 18.081062] ? _raw_spin_unlock_irq+0x47/0x80 [ 18.081084] ? calculate_sigpending+0x7b/0xa0 [ 18.081108] ? __pfx_kthread+0x10/0x10 [ 18.081130] ret_from_fork+0x116/0x1d0 [ 18.081149] ? __pfx_kthread+0x10/0x10 [ 18.081170] ret_from_fork_asm+0x1a/0x30 [ 18.081202] </TASK> [ 18.081213] [ 18.088191] Allocated by task 303: [ 18.088376] kasan_save_stack+0x45/0x70 [ 18.088512] kasan_save_track+0x18/0x40 [ 18.088682] kasan_save_alloc_info+0x3b/0x50 [ 18.088796] __kasan_kmalloc+0xb7/0xc0 [ 18.088962] __kmalloc_noprof+0x1c9/0x500 [ 18.089130] kunit_kmalloc_array+0x25/0x60 [ 18.089268] copy_user_test_oob+0xab/0x10f0 [ 18.089473] kunit_try_run_case+0x1a5/0x480 [ 18.089619] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 18.089790] kthread+0x337/0x6f0 [ 18.089962] ret_from_fork+0x116/0x1d0 [ 18.090069] ret_from_fork_asm+0x1a/0x30 [ 18.090292] [ 18.090395] The buggy address belongs to the object at ffff888102b5b800 [ 18.090395] which belongs to the cache kmalloc-128 of size 128 [ 18.090660] The buggy address is located 0 bytes to the right of [ 18.090660] allocated 120-byte region [ffff888102b5b800, ffff888102b5b878) [ 18.090988] [ 18.091108] The buggy address belongs to the physical page: [ 18.091331] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b5b [ 18.091577] flags: 0x200000000000000(node=0|zone=2) [ 18.091736] page_type: f5(slab) [ 18.091918] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 18.092186] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.092445] page dumped because: kasan: bad access detected [ 18.092634] [ 18.092686] Memory state around the buggy address: [ 18.092896] ffff888102b5b700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.093040] ffff888102b5b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.093308] >ffff888102b5b800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.093542] ^ [ 18.093727] ffff888102b5b880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.093901] ffff888102b5b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.094023] ==================================================================