Date
May 29, 2025, 7:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 26.114161] ================================================================== [ 26.114302] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 26.114436] Write of size 1 at addr fff00000c7883378 by task kunit_try_catch/285 [ 26.114590] [ 26.114695] CPU: 1 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250529 #1 PREEMPT [ 26.114928] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.115001] Hardware name: linux,dummy-virt (DT) [ 26.115092] Call trace: [ 26.115189] show_stack+0x20/0x38 (C) [ 26.115348] dump_stack_lvl+0x8c/0xd0 [ 26.115524] print_report+0x118/0x608 [ 26.115669] kasan_report+0xdc/0x128 [ 26.115814] __asan_report_store1_noabort+0x20/0x30 [ 26.115937] strncpy_from_user+0x270/0x2a0 [ 26.116083] copy_user_test_oob+0x5c0/0xec8 [ 26.116195] kunit_try_run_case+0x170/0x3f0 [ 26.116312] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.116434] kthread+0x328/0x630 [ 26.116530] ret_from_fork+0x10/0x20 [ 26.116649] [ 26.116706] Allocated by task 285: [ 26.116827] kasan_save_stack+0x3c/0x68 [ 26.116947] kasan_save_track+0x20/0x40 [ 26.117049] kasan_save_alloc_info+0x40/0x58 [ 26.117189] __kasan_kmalloc+0xd4/0xd8 [ 26.117313] __kmalloc_noprof+0x190/0x4d0 [ 26.117435] kunit_kmalloc_array+0x34/0x88 [ 26.117534] copy_user_test_oob+0xac/0xec8 [ 26.117652] kunit_try_run_case+0x170/0x3f0 [ 26.117751] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.117863] kthread+0x328/0x630 [ 26.117988] ret_from_fork+0x10/0x20 [ 26.118097] [ 26.118183] The buggy address belongs to the object at fff00000c7883300 [ 26.118183] which belongs to the cache kmalloc-128 of size 128 [ 26.118425] The buggy address is located 0 bytes to the right of [ 26.118425] allocated 120-byte region [fff00000c7883300, fff00000c7883378) [ 26.118601] [ 26.118659] The buggy address belongs to the physical page: [ 26.118747] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107883 [ 26.118902] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 26.119014] page_type: f5(slab) [ 26.119097] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 26.119227] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.119336] page dumped because: kasan: bad access detected [ 26.119439] [ 26.119506] Memory state around the buggy address: [ 26.119592] fff00000c7883200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.119728] fff00000c7883280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.119846] >fff00000c7883300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 26.119949] ^ [ 26.120063] fff00000c7883380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.120290] fff00000c7883400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.120441] ================================================================== [ 26.105188] ================================================================== [ 26.105378] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 26.105550] Write of size 121 at addr fff00000c7883300 by task kunit_try_catch/285 [ 26.105722] [ 26.105839] CPU: 1 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250529 #1 PREEMPT [ 26.106057] Tainted: [B]=BAD_PAGE, [N]=TEST [ 26.106133] Hardware name: linux,dummy-virt (DT) [ 26.106216] Call trace: [ 26.106279] show_stack+0x20/0x38 (C) [ 26.106453] dump_stack_lvl+0x8c/0xd0 [ 26.106575] print_report+0x118/0x608 [ 26.106743] kasan_report+0xdc/0x128 [ 26.106902] kasan_check_range+0x100/0x1a8 [ 26.107385] __kasan_check_write+0x20/0x30 [ 26.107541] strncpy_from_user+0x3c/0x2a0 [ 26.107659] copy_user_test_oob+0x5c0/0xec8 [ 26.108046] kunit_try_run_case+0x170/0x3f0 [ 26.108245] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.108489] kthread+0x328/0x630 [ 26.109657] ret_from_fork+0x10/0x20 [ 26.109771] [ 26.109799] Allocated by task 285: [ 26.109838] kasan_save_stack+0x3c/0x68 [ 26.109891] kasan_save_track+0x20/0x40 [ 26.109938] kasan_save_alloc_info+0x40/0x58 [ 26.109980] __kasan_kmalloc+0xd4/0xd8 [ 26.110025] __kmalloc_noprof+0x190/0x4d0 [ 26.110073] kunit_kmalloc_array+0x34/0x88 [ 26.110120] copy_user_test_oob+0xac/0xec8 [ 26.110163] kunit_try_run_case+0x170/0x3f0 [ 26.110209] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 26.110260] kthread+0x328/0x630 [ 26.110300] ret_from_fork+0x10/0x20 [ 26.110354] [ 26.110412] The buggy address belongs to the object at fff00000c7883300 [ 26.110412] which belongs to the cache kmalloc-128 of size 128 [ 26.110563] The buggy address is located 0 bytes inside of [ 26.110563] allocated 120-byte region [fff00000c7883300, fff00000c7883378) [ 26.110731] [ 26.110844] The buggy address belongs to the physical page: [ 26.110991] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107883 [ 26.111135] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 26.111268] page_type: f5(slab) [ 26.111376] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 26.111527] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 26.111697] page dumped because: kasan: bad access detected [ 26.111825] [ 26.111893] Memory state around the buggy address: [ 26.111987] fff00000c7883200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.112079] fff00000c7883280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.112177] >fff00000c7883300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 26.112256] ^ [ 26.112339] fff00000c7883380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.112443] fff00000c7883400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.112541] ==================================================================
[ 14.975872] ================================================================== [ 14.976252] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 14.976668] Write of size 121 at addr ffff888102f96900 by task kunit_try_catch/302 [ 14.977026] [ 14.977312] CPU: 0 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250529 #1 PREEMPT(voluntary) [ 14.977362] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.977377] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.977401] Call Trace: [ 14.977418] <TASK> [ 14.977434] dump_stack_lvl+0x73/0xb0 [ 14.977538] print_report+0xd1/0x650 [ 14.977563] ? __virt_addr_valid+0x1db/0x2d0 [ 14.977587] ? strncpy_from_user+0x2e/0x1d0 [ 14.977621] ? kasan_complete_mode_report_info+0x2a/0x200 [ 14.977647] ? strncpy_from_user+0x2e/0x1d0 [ 14.977668] kasan_report+0x141/0x180 [ 14.977693] ? strncpy_from_user+0x2e/0x1d0 [ 14.977719] kasan_check_range+0x10c/0x1c0 [ 14.977745] __kasan_check_write+0x18/0x20 [ 14.977766] strncpy_from_user+0x2e/0x1d0 [ 14.977795] ? __kasan_check_read+0x15/0x20 [ 14.977819] copy_user_test_oob+0x760/0x10f0 [ 14.977842] ? __pfx_copy_user_test_oob+0x10/0x10 [ 14.977862] ? finish_task_switch.isra.0+0x153/0x700 [ 14.977887] ? __switch_to+0x47/0xf50 [ 14.977913] ? __schedule+0x10cc/0x2b60 [ 14.977938] ? __pfx_read_tsc+0x10/0x10 [ 14.977960] ? ktime_get_ts64+0x86/0x230 [ 14.977985] kunit_try_run_case+0x1a5/0x480 [ 14.978008] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.978028] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.978053] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.978078] ? __kthread_parkme+0x82/0x180 [ 14.978100] ? preempt_count_sub+0x50/0x80 [ 14.978124] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.978147] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.978172] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.978198] kthread+0x337/0x6f0 [ 14.978219] ? trace_preempt_on+0x20/0xc0 [ 14.978241] ? __pfx_kthread+0x10/0x10 [ 14.978263] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.978287] ? calculate_sigpending+0x7b/0xa0 [ 14.978311] ? __pfx_kthread+0x10/0x10 [ 14.978334] ret_from_fork+0x116/0x1d0 [ 14.978353] ? __pfx_kthread+0x10/0x10 [ 14.978375] ret_from_fork_asm+0x1a/0x30 [ 14.978406] </TASK> [ 14.978418] [ 14.988527] Allocated by task 302: [ 14.988706] kasan_save_stack+0x45/0x70 [ 14.988927] kasan_save_track+0x18/0x40 [ 14.989333] kasan_save_alloc_info+0x3b/0x50 [ 14.989600] __kasan_kmalloc+0xb7/0xc0 [ 14.989891] __kmalloc_noprof+0x1c9/0x500 [ 14.990170] kunit_kmalloc_array+0x25/0x60 [ 14.990331] copy_user_test_oob+0xab/0x10f0 [ 14.990668] kunit_try_run_case+0x1a5/0x480 [ 14.990958] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.991264] kthread+0x337/0x6f0 [ 14.991497] ret_from_fork+0x116/0x1d0 [ 14.991670] ret_from_fork_asm+0x1a/0x30 [ 14.991912] [ 14.992006] The buggy address belongs to the object at ffff888102f96900 [ 14.992006] which belongs to the cache kmalloc-128 of size 128 [ 14.992496] The buggy address is located 0 bytes inside of [ 14.992496] allocated 120-byte region [ffff888102f96900, ffff888102f96978) [ 14.993388] [ 14.993493] The buggy address belongs to the physical page: [ 14.993710] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102f96 [ 14.994394] flags: 0x200000000000000(node=0|zone=2) [ 14.994719] page_type: f5(slab) [ 14.994898] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.995330] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 14.995727] page dumped because: kasan: bad access detected [ 14.996088] [ 14.996173] Memory state around the buggy address: [ 14.996404] ffff888102f96800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.996932] ffff888102f96880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.997317] >ffff888102f96900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 14.997600] ^ [ 14.998148] ffff888102f96980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.998471] ffff888102f96a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.998930] ================================================================== [ 14.999578] ================================================================== [ 15.000205] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 15.000595] Write of size 1 at addr ffff888102f96978 by task kunit_try_catch/302 [ 15.001027] [ 15.001149] CPU: 0 UID: 0 PID: 302 Comm: kunit_try_catch Tainted: G B N 6.15.0-next-20250529 #1 PREEMPT(voluntary) [ 15.001198] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.001211] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.001235] Call Trace: [ 15.001251] <TASK> [ 15.001269] dump_stack_lvl+0x73/0xb0 [ 15.001296] print_report+0xd1/0x650 [ 15.001320] ? __virt_addr_valid+0x1db/0x2d0 [ 15.001344] ? strncpy_from_user+0x1a5/0x1d0 [ 15.001364] ? kasan_complete_mode_report_info+0x2a/0x200 [ 15.001389] ? strncpy_from_user+0x1a5/0x1d0 [ 15.001411] kasan_report+0x141/0x180 [ 15.001436] ? strncpy_from_user+0x1a5/0x1d0 [ 15.001462] __asan_report_store1_noabort+0x1b/0x30 [ 15.001483] strncpy_from_user+0x1a5/0x1d0 [ 15.001508] copy_user_test_oob+0x760/0x10f0 [ 15.001531] ? __pfx_copy_user_test_oob+0x10/0x10 [ 15.001553] ? finish_task_switch.isra.0+0x153/0x700 [ 15.001576] ? __switch_to+0x47/0xf50 [ 15.001603] ? __schedule+0x10cc/0x2b60 [ 15.001641] ? __pfx_read_tsc+0x10/0x10 [ 15.001663] ? ktime_get_ts64+0x86/0x230 [ 15.001690] kunit_try_run_case+0x1a5/0x480 [ 15.001713] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.001733] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 15.001758] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 15.001797] ? __kthread_parkme+0x82/0x180 [ 15.001821] ? preempt_count_sub+0x50/0x80 [ 15.001847] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.001870] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.001896] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 15.001922] kthread+0x337/0x6f0 [ 15.001943] ? trace_preempt_on+0x20/0xc0 [ 15.001967] ? __pfx_kthread+0x10/0x10 [ 15.001989] ? _raw_spin_unlock_irq+0x47/0x80 [ 15.002012] ? calculate_sigpending+0x7b/0xa0 [ 15.002037] ? __pfx_kthread+0x10/0x10 [ 15.002060] ret_from_fork+0x116/0x1d0 [ 15.002080] ? __pfx_kthread+0x10/0x10 [ 15.002101] ret_from_fork_asm+0x1a/0x30 [ 15.002133] </TASK> [ 15.002145] [ 15.009618] Allocated by task 302: [ 15.009805] kasan_save_stack+0x45/0x70 [ 15.010043] kasan_save_track+0x18/0x40 [ 15.010243] kasan_save_alloc_info+0x3b/0x50 [ 15.010455] __kasan_kmalloc+0xb7/0xc0 [ 15.010625] __kmalloc_noprof+0x1c9/0x500 [ 15.010786] kunit_kmalloc_array+0x25/0x60 [ 15.010989] copy_user_test_oob+0xab/0x10f0 [ 15.011341] kunit_try_run_case+0x1a5/0x480 [ 15.011524] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.011717] kthread+0x337/0x6f0 [ 15.011844] ret_from_fork+0x116/0x1d0 [ 15.011983] ret_from_fork_asm+0x1a/0x30 [ 15.012169] [ 15.012267] The buggy address belongs to the object at ffff888102f96900 [ 15.012267] which belongs to the cache kmalloc-128 of size 128 [ 15.012831] The buggy address is located 0 bytes to the right of [ 15.012831] allocated 120-byte region [ffff888102f96900, ffff888102f96978) [ 15.013266] [ 15.013342] The buggy address belongs to the physical page: [ 15.013522] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102f96 [ 15.014027] flags: 0x200000000000000(node=0|zone=2) [ 15.014278] page_type: f5(slab) [ 15.014449] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 15.014865] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.015180] page dumped because: kasan: bad access detected [ 15.015431] [ 15.015516] Memory state around the buggy address: [ 15.015734] ffff888102f96800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.016079] ffff888102f96880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.016370] >ffff888102f96900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 15.016680] ^ [ 15.017009] ffff888102f96980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.017233] ffff888102f96a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.017463] ==================================================================