Date
May 15, 2025, 10:38 a.m.
Environment | |
---|---|
e850-96 |
[ 66.613638] ================================================================== [ 66.620736] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 66.627592] Write of size 121 at addr ffff000803cf7000 by task kunit_try_catch/330 [ 66.635142] [ 66.636627] CPU: 1 UID: 0 PID: 330 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT [ 66.636683] Tainted: [B]=BAD_PAGE, [N]=TEST [ 66.636699] Hardware name: WinLink E850-96 board (DT) [ 66.636719] Call trace: [ 66.636733] show_stack+0x20/0x38 (C) [ 66.636768] dump_stack_lvl+0x8c/0xd0 [ 66.636798] print_report+0x118/0x608 [ 66.636835] kasan_report+0xdc/0x128 [ 66.636866] kasan_check_range+0x100/0x1a8 [ 66.636900] __kasan_check_write+0x20/0x30 [ 66.636936] strncpy_from_user+0x3c/0x2a0 [ 66.636974] copy_user_test_oob+0x5c0/0xec8 [ 66.637006] kunit_try_run_case+0x170/0x3f0 [ 66.637039] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.637074] kthread+0x328/0x630 [ 66.637108] ret_from_fork+0x10/0x20 [ 66.637140] [ 66.708059] Allocated by task 330: [ 66.711445] kasan_save_stack+0x3c/0x68 [ 66.715262] kasan_save_track+0x20/0x40 [ 66.719083] kasan_save_alloc_info+0x40/0x58 [ 66.723335] __kasan_kmalloc+0xd4/0xd8 [ 66.727068] __kmalloc_noprof+0x190/0x4d0 [ 66.731061] kunit_kmalloc_array+0x34/0x88 [ 66.735141] copy_user_test_oob+0xac/0xec8 [ 66.739220] kunit_try_run_case+0x170/0x3f0 [ 66.743387] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.748856] kthread+0x328/0x630 [ 66.752068] ret_from_fork+0x10/0x20 [ 66.755627] [ 66.757104] The buggy address belongs to the object at ffff000803cf7000 [ 66.757104] which belongs to the cache kmalloc-128 of size 128 [ 66.769604] The buggy address is located 0 bytes inside of [ 66.769604] allocated 120-byte region [ffff000803cf7000, ffff000803cf7078) [ 66.782015] [ 66.783491] The buggy address belongs to the physical page: [ 66.789052] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883cf6 [ 66.797036] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 66.804673] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 66.811616] page_type: f5(slab) [ 66.814751] raw: 0bfffe0000000040 ffff000800002a00 dead000000000122 0000000000000000 [ 66.822472] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 66.830199] head: 0bfffe0000000040 ffff000800002a00 dead000000000122 0000000000000000 [ 66.838010] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 66.845823] head: 0bfffe0000000001 fffffdffe00f3d81 00000000ffffffff 00000000ffffffff [ 66.853635] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 66.861441] page dumped because: kasan: bad access detected [ 66.866996] [ 66.868472] Memory state around the buggy address: [ 66.873254] ffff000803cf6f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.880455] ffff000803cf6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.887659] >ffff000803cf7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 66.894860] ^ [ 66.901982] ffff000803cf7080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.909187] ffff000803cf7100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 66.916388] ================================================================== [ 66.923850] ================================================================== [ 66.930804] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 66.937742] Write of size 1 at addr ffff000803cf7078 by task kunit_try_catch/330 [ 66.945120] [ 66.946604] CPU: 1 UID: 0 PID: 330 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT [ 66.946661] Tainted: [B]=BAD_PAGE, [N]=TEST [ 66.946678] Hardware name: WinLink E850-96 board (DT) [ 66.946697] Call trace: [ 66.946711] show_stack+0x20/0x38 (C) [ 66.946745] dump_stack_lvl+0x8c/0xd0 [ 66.946778] print_report+0x118/0x608 [ 66.946811] kasan_report+0xdc/0x128 [ 66.946844] __asan_report_store1_noabort+0x20/0x30 [ 66.946884] strncpy_from_user+0x270/0x2a0 [ 66.946917] copy_user_test_oob+0x5c0/0xec8 [ 66.946949] kunit_try_run_case+0x170/0x3f0 [ 66.946980] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 66.947017] kthread+0x328/0x630 [ 66.947051] ret_from_fork+0x10/0x20 [ 66.947085] [ 67.014824] Allocated by task 330: [ 67.018211] kasan_save_stack+0x3c/0x68 [ 67.022029] kasan_save_track+0x20/0x40 [ 67.025849] kasan_save_alloc_info+0x40/0x58 [ 67.030101] __kasan_kmalloc+0xd4/0xd8 [ 67.033834] __kmalloc_noprof+0x190/0x4d0 [ 67.037827] kunit_kmalloc_array+0x34/0x88 [ 67.041907] copy_user_test_oob+0xac/0xec8 [ 67.045987] kunit_try_run_case+0x170/0x3f0 [ 67.050153] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 67.055622] kthread+0x328/0x630 [ 67.058834] ret_from_fork+0x10/0x20 [ 67.062393] [ 67.063870] The buggy address belongs to the object at ffff000803cf7000 [ 67.063870] which belongs to the cache kmalloc-128 of size 128 [ 67.076371] The buggy address is located 0 bytes to the right of [ 67.076371] allocated 120-byte region [ffff000803cf7000, ffff000803cf7078) [ 67.089302] [ 67.090778] The buggy address belongs to the physical page: [ 67.096336] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x883cf6 [ 67.104321] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 67.111960] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 67.118902] page_type: f5(slab) [ 67.122038] raw: 0bfffe0000000040 ffff000800002a00 dead000000000122 0000000000000000 [ 67.129760] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 67.137486] head: 0bfffe0000000040 ffff000800002a00 dead000000000122 0000000000000000 [ 67.145297] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 67.153110] head: 0bfffe0000000001 fffffdffe00f3d81 00000000ffffffff 00000000ffffffff [ 67.160922] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 67.168728] page dumped because: kasan: bad access detected [ 67.174283] [ 67.175759] Memory state around the buggy address: [ 67.180540] ffff000803cf6f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 67.187742] ffff000803cf6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.194946] >ffff000803cf7000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 67.202148] ^ [ 67.209269] ffff000803cf7080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.216474] ffff000803cf7100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.223675] ==================================================================