Hay
Date
May 15, 2025, 10:38 a.m.

Environment
e850-96

[   66.613638] ==================================================================
[   66.620736] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0
[   66.627592] Write of size 121 at addr ffff000803cf7000 by task kunit_try_catch/330
[   66.635142] 
[   66.636627] CPU: 1 UID: 0 PID: 330 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc6-next-20250515 #1 PREEMPT 
[   66.636683] Tainted: [B]=BAD_PAGE, [N]=TEST
[   66.636699] Hardware name: WinLink E850-96 board (DT)
[   66.636719] Call trace:
[   66.636733]  show_stack+0x20/0x38 (C)
[   66.636768]  dump_stack_lvl+0x8c/0xd0
[   66.636798]  print_report+0x118/0x608
[   66.636835]  kasan_report+0xdc/0x128
[   66.636866]  kasan_check_range+0x100/0x1a8
[   66.636900]  __kasan_check_write+0x20/0x30
[   66.636936]  strncpy_from_user+0x3c/0x2a0
[   66.636974]  copy_user_test_oob+0x5c0/0xec8
[   66.637006]  kunit_try_run_case+0x170/0x3f0
[   66.637039]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   66.637074]  kthread+0x328/0x630
[   66.637108]  ret_from_fork+0x10/0x20
[   66.637140] 
[   66.708059] Allocated by task 330:
[   66.711445]  kasan_save_stack+0x3c/0x68
[   66.715262]  kasan_save_track+0x20/0x40
[   66.719083]  kasan_save_alloc_info+0x40/0x58
[   66.723335]  __kasan_kmalloc+0xd4/0xd8
[   66.727068]  __kmalloc_noprof+0x190/0x4d0
[   66.731061]  kunit_kmalloc_array+0x34/0x88
[   66.735141]  copy_user_test_oob+0xac/0xec8
[   66.739220]  kunit_try_run_case+0x170/0x3f0
[   66.743387]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   66.748856]  kthread+0x328/0x630
[   66.752068]  ret_from_fork+0x10/0x20
[   66.755627] 
[   66.757104] The buggy address belongs to the object at ffff000803cf7000
[   66.757104]  which belongs to the cache kmalloc-128 of size 128
[   66.769604] The buggy address is located 0 bytes inside of
[   66.769604]  allocated 120-byte region [ffff000803cf7000, ffff000803cf7078)
[   66.782015] 
[   66.783491] The buggy address belongs to the physical page:
[   66.789052] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883cf6
[   66.797036] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   66.804673] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   66.811616] page_type: f5(slab)
[   66.814751] raw: 0bfffe0000000040 ffff000800002a00 dead000000000122 0000000000000000
[   66.822472] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   66.830199] head: 0bfffe0000000040 ffff000800002a00 dead000000000122 0000000000000000
[   66.838010] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   66.845823] head: 0bfffe0000000001 fffffdffe00f3d81 00000000ffffffff 00000000ffffffff
[   66.853635] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   66.861441] page dumped because: kasan: bad access detected
[   66.866996] 
[   66.868472] Memory state around the buggy address:
[   66.873254]  ffff000803cf6f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   66.880455]  ffff000803cf6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   66.887659] >ffff000803cf7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   66.894860]                                                                 ^
[   66.901982]  ffff000803cf7080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   66.909187]  ffff000803cf7100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   66.916388] ==================================================================
[   66.923850] ==================================================================
[   66.930804] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0
[   66.937742] Write of size 1 at addr ffff000803cf7078 by task kunit_try_catch/330
[   66.945120] 
[   66.946604] CPU: 1 UID: 0 PID: 330 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc6-next-20250515 #1 PREEMPT 
[   66.946661] Tainted: [B]=BAD_PAGE, [N]=TEST
[   66.946678] Hardware name: WinLink E850-96 board (DT)
[   66.946697] Call trace:
[   66.946711]  show_stack+0x20/0x38 (C)
[   66.946745]  dump_stack_lvl+0x8c/0xd0
[   66.946778]  print_report+0x118/0x608
[   66.946811]  kasan_report+0xdc/0x128
[   66.946844]  __asan_report_store1_noabort+0x20/0x30
[   66.946884]  strncpy_from_user+0x270/0x2a0
[   66.946917]  copy_user_test_oob+0x5c0/0xec8
[   66.946949]  kunit_try_run_case+0x170/0x3f0
[   66.946980]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   66.947017]  kthread+0x328/0x630
[   66.947051]  ret_from_fork+0x10/0x20
[   66.947085] 
[   67.014824] Allocated by task 330:
[   67.018211]  kasan_save_stack+0x3c/0x68
[   67.022029]  kasan_save_track+0x20/0x40
[   67.025849]  kasan_save_alloc_info+0x40/0x58
[   67.030101]  __kasan_kmalloc+0xd4/0xd8
[   67.033834]  __kmalloc_noprof+0x190/0x4d0
[   67.037827]  kunit_kmalloc_array+0x34/0x88
[   67.041907]  copy_user_test_oob+0xac/0xec8
[   67.045987]  kunit_try_run_case+0x170/0x3f0
[   67.050153]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   67.055622]  kthread+0x328/0x630
[   67.058834]  ret_from_fork+0x10/0x20
[   67.062393] 
[   67.063870] The buggy address belongs to the object at ffff000803cf7000
[   67.063870]  which belongs to the cache kmalloc-128 of size 128
[   67.076371] The buggy address is located 0 bytes to the right of
[   67.076371]  allocated 120-byte region [ffff000803cf7000, ffff000803cf7078)
[   67.089302] 
[   67.090778] The buggy address belongs to the physical page:
[   67.096336] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883cf6
[   67.104321] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   67.111960] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   67.118902] page_type: f5(slab)
[   67.122038] raw: 0bfffe0000000040 ffff000800002a00 dead000000000122 0000000000000000
[   67.129760] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   67.137486] head: 0bfffe0000000040 ffff000800002a00 dead000000000122 0000000000000000
[   67.145297] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   67.153110] head: 0bfffe0000000001 fffffdffe00f3d81 00000000ffffffff 00000000ffffffff
[   67.160922] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   67.168728] page dumped because: kasan: bad access detected
[   67.174283] 
[   67.175759] Memory state around the buggy address:
[   67.180540]  ffff000803cf6f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   67.187742]  ffff000803cf6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   67.194946] >ffff000803cf7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   67.202148]                                                                 ^
[   67.209269]  ffff000803cf7080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   67.216474]  ffff000803cf7100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   67.223675] ==================================================================