Date
June 16, 2025, 7:07 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 22.959638] ================================================================== [ 22.959727] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x204/0x250 [ 22.959871] Read of size 8 at addr fff00000c6587678 by task kunit_try_catch/290 [ 22.959936] [ 22.960207] CPU: 0 UID: 0 PID: 290 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT [ 22.960415] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.960449] Hardware name: linux,dummy-virt (DT) [ 22.960492] Call trace: [ 22.960525] show_stack+0x20/0x38 (C) [ 22.960724] dump_stack_lvl+0x8c/0xd0 [ 22.960852] print_report+0x118/0x608 [ 22.961002] kasan_report+0xdc/0x128 [ 22.961100] __asan_report_load8_noabort+0x20/0x30 [ 22.961156] copy_to_kernel_nofault+0x204/0x250 [ 22.961210] copy_to_kernel_nofault_oob+0x158/0x418 [ 22.961267] kunit_try_run_case+0x170/0x3f0 [ 22.961320] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.961376] kthread+0x328/0x630 [ 22.961422] ret_from_fork+0x10/0x20 [ 22.961480] [ 22.961536] Allocated by task 290: [ 22.961574] kasan_save_stack+0x3c/0x68 [ 22.961626] kasan_save_track+0x20/0x40 [ 22.961669] kasan_save_alloc_info+0x40/0x58 [ 22.961995] __kasan_kmalloc+0xd4/0xd8 [ 22.962082] __kmalloc_cache_noprof+0x16c/0x3c0 [ 22.962176] copy_to_kernel_nofault_oob+0xc8/0x418 [ 22.962247] kunit_try_run_case+0x170/0x3f0 [ 22.962319] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.962370] kthread+0x328/0x630 [ 22.962408] ret_from_fork+0x10/0x20 [ 22.962454] [ 22.962481] The buggy address belongs to the object at fff00000c6587600 [ 22.962481] which belongs to the cache kmalloc-128 of size 128 [ 22.962550] The buggy address is located 0 bytes to the right of [ 22.962550] allocated 120-byte region [fff00000c6587600, fff00000c6587678) [ 22.962623] [ 22.962652] The buggy address belongs to the physical page: [ 22.962696] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106587 [ 22.962760] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 22.962817] page_type: f5(slab) [ 22.962881] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 22.962942] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.963013] page dumped because: kasan: bad access detected [ 22.963083] [ 22.963130] Memory state around the buggy address: [ 22.963218] fff00000c6587500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.963277] fff00000c6587580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.963328] >fff00000c6587600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 22.963374] ^ [ 22.963452] fff00000c6587680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.963548] fff00000c6587700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.963596] ================================================================== [ 22.964802] ================================================================== [ 22.965018] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x8c/0x250 [ 22.965111] Write of size 8 at addr fff00000c6587678 by task kunit_try_catch/290 [ 22.965173] [ 22.965215] CPU: 0 UID: 0 PID: 290 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT [ 22.965316] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.965359] Hardware name: linux,dummy-virt (DT) [ 22.965400] Call trace: [ 22.965582] show_stack+0x20/0x38 (C) [ 22.965718] dump_stack_lvl+0x8c/0xd0 [ 22.965877] print_report+0x118/0x608 [ 22.966041] kasan_report+0xdc/0x128 [ 22.966109] kasan_check_range+0x100/0x1a8 [ 22.966171] __kasan_check_write+0x20/0x30 [ 22.966224] copy_to_kernel_nofault+0x8c/0x250 [ 22.967174] copy_to_kernel_nofault_oob+0x1bc/0x418 [ 22.967272] kunit_try_run_case+0x170/0x3f0 [ 22.967343] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.967411] kthread+0x328/0x630 [ 22.967465] ret_from_fork+0x10/0x20 [ 22.968090] [ 22.968472] Allocated by task 290: [ 22.968813] kasan_save_stack+0x3c/0x68 [ 22.968891] kasan_save_track+0x20/0x40 [ 22.968940] kasan_save_alloc_info+0x40/0x58 [ 22.968987] __kasan_kmalloc+0xd4/0xd8 [ 22.969037] __kmalloc_cache_noprof+0x16c/0x3c0 [ 22.969147] copy_to_kernel_nofault_oob+0xc8/0x418 [ 22.969252] kunit_try_run_case+0x170/0x3f0 [ 22.969335] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.969405] kthread+0x328/0x630 [ 22.969497] ret_from_fork+0x10/0x20 [ 22.969562] [ 22.969765] The buggy address belongs to the object at fff00000c6587600 [ 22.969765] which belongs to the cache kmalloc-128 of size 128 [ 22.969868] The buggy address is located 0 bytes to the right of [ 22.969868] allocated 120-byte region [fff00000c6587600, fff00000c6587678) [ 22.969957] [ 22.969989] The buggy address belongs to the physical page: [ 22.970036] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106587 [ 22.970107] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 22.970172] page_type: f5(slab) [ 22.970230] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 22.970298] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.970358] page dumped because: kasan: bad access detected [ 22.970404] [ 22.970431] Memory state around the buggy address: [ 22.970476] fff00000c6587500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.970536] fff00000c6587580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.970593] >fff00000c6587600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 22.970645] ^ [ 22.970739] fff00000c6587680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.970799] fff00000c6587700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.970855] ==================================================================
[ 15.432898] ================================================================== [ 15.433226] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x99/0x260 [ 15.433626] Write of size 8 at addr ffff888102a34678 by task kunit_try_catch/307 [ 15.433921] [ 15.434100] CPU: 0 UID: 0 PID: 307 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT(voluntary) [ 15.434148] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.434161] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.434216] Call Trace: [ 15.434231] <TASK> [ 15.434261] dump_stack_lvl+0x73/0xb0 [ 15.434304] print_report+0xd1/0x650 [ 15.434327] ? __virt_addr_valid+0x1db/0x2d0 [ 15.434351] ? copy_to_kernel_nofault+0x99/0x260 [ 15.434375] ? kasan_complete_mode_report_info+0x2a/0x200 [ 15.434406] ? copy_to_kernel_nofault+0x99/0x260 [ 15.434430] kasan_report+0x141/0x180 [ 15.434453] ? copy_to_kernel_nofault+0x99/0x260 [ 15.434510] kasan_check_range+0x10c/0x1c0 [ 15.434534] __kasan_check_write+0x18/0x20 [ 15.434554] copy_to_kernel_nofault+0x99/0x260 [ 15.434591] copy_to_kernel_nofault_oob+0x288/0x560 [ 15.434629] ? __pfx_copy_to_kernel_nofault_oob+0x10/0x10 [ 15.434653] ? finish_task_switch.isra.0+0x153/0x700 [ 15.434676] ? __schedule+0x10cc/0x2b60 [ 15.434699] ? trace_hardirqs_on+0x37/0xe0 [ 15.434732] ? __pfx_read_tsc+0x10/0x10 [ 15.434755] ? ktime_get_ts64+0x86/0x230 [ 15.434781] kunit_try_run_case+0x1a5/0x480 [ 15.434806] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.434828] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 15.434851] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 15.434874] ? __kthread_parkme+0x82/0x180 [ 15.434894] ? preempt_count_sub+0x50/0x80 [ 15.434918] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.434953] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.434977] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 15.435001] kthread+0x337/0x6f0 [ 15.435021] ? trace_preempt_on+0x20/0xc0 [ 15.435044] ? __pfx_kthread+0x10/0x10 [ 15.435064] ? _raw_spin_unlock_irq+0x47/0x80 [ 15.435085] ? calculate_sigpending+0x7b/0xa0 [ 15.435110] ? __pfx_kthread+0x10/0x10 [ 15.435132] ret_from_fork+0x116/0x1d0 [ 15.435151] ? __pfx_kthread+0x10/0x10 [ 15.435172] ret_from_fork_asm+0x1a/0x30 [ 15.435204] </TASK> [ 15.435215] [ 15.443203] Allocated by task 307: [ 15.443537] kasan_save_stack+0x45/0x70 [ 15.443732] kasan_save_track+0x18/0x40 [ 15.443896] kasan_save_alloc_info+0x3b/0x50 [ 15.444137] __kasan_kmalloc+0xb7/0xc0 [ 15.444291] __kmalloc_cache_noprof+0x189/0x420 [ 15.444529] copy_to_kernel_nofault_oob+0x12f/0x560 [ 15.444846] kunit_try_run_case+0x1a5/0x480 [ 15.445124] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.445502] kthread+0x337/0x6f0 [ 15.445649] ret_from_fork+0x116/0x1d0 [ 15.445782] ret_from_fork_asm+0x1a/0x30 [ 15.445914] [ 15.445991] The buggy address belongs to the object at ffff888102a34600 [ 15.445991] which belongs to the cache kmalloc-128 of size 128 [ 15.446338] The buggy address is located 0 bytes to the right of [ 15.446338] allocated 120-byte region [ffff888102a34600, ffff888102a34678) [ 15.446809] [ 15.446901] The buggy address belongs to the physical page: [ 15.447203] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a34 [ 15.447558] flags: 0x200000000000000(node=0|zone=2) [ 15.447788] page_type: f5(slab) [ 15.447960] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 15.448388] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.448837] page dumped because: kasan: bad access detected [ 15.449162] [ 15.449300] Memory state around the buggy address: [ 15.449645] ffff888102a34500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.449891] ffff888102a34580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.450116] >ffff888102a34600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 15.450323] ^ [ 15.450529] ffff888102a34680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.450984] ffff888102a34700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.451344] ================================================================== [ 15.411911] ================================================================== [ 15.413190] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x225/0x260 [ 15.413788] Read of size 8 at addr ffff888102a34678 by task kunit_try_catch/307 [ 15.414368] [ 15.414470] CPU: 0 UID: 0 PID: 307 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT(voluntary) [ 15.414523] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.414537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.414561] Call Trace: [ 15.414576] <TASK> [ 15.414596] dump_stack_lvl+0x73/0xb0 [ 15.414628] print_report+0xd1/0x650 [ 15.414654] ? __virt_addr_valid+0x1db/0x2d0 [ 15.414678] ? copy_to_kernel_nofault+0x225/0x260 [ 15.414702] ? kasan_complete_mode_report_info+0x2a/0x200 [ 15.414725] ? copy_to_kernel_nofault+0x225/0x260 [ 15.414749] kasan_report+0x141/0x180 [ 15.414771] ? copy_to_kernel_nofault+0x225/0x260 [ 15.414800] __asan_report_load8_noabort+0x18/0x20 [ 15.414825] copy_to_kernel_nofault+0x225/0x260 [ 15.414849] copy_to_kernel_nofault_oob+0x1ed/0x560 [ 15.414873] ? __pfx_copy_to_kernel_nofault_oob+0x10/0x10 [ 15.414896] ? finish_task_switch.isra.0+0x153/0x700 [ 15.414921] ? __schedule+0x10cc/0x2b60 [ 15.414954] ? trace_hardirqs_on+0x37/0xe0 [ 15.414986] ? __pfx_read_tsc+0x10/0x10 [ 15.415009] ? ktime_get_ts64+0x86/0x230 [ 15.415036] kunit_try_run_case+0x1a5/0x480 [ 15.415062] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.415084] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 15.415108] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 15.415130] ? __kthread_parkme+0x82/0x180 [ 15.415152] ? preempt_count_sub+0x50/0x80 [ 15.415174] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.415197] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.415221] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 15.415244] kthread+0x337/0x6f0 [ 15.415264] ? trace_preempt_on+0x20/0xc0 [ 15.415286] ? __pfx_kthread+0x10/0x10 [ 15.415320] ? _raw_spin_unlock_irq+0x47/0x80 [ 15.415353] ? calculate_sigpending+0x7b/0xa0 [ 15.415392] ? __pfx_kthread+0x10/0x10 [ 15.415413] ret_from_fork+0x116/0x1d0 [ 15.415432] ? __pfx_kthread+0x10/0x10 [ 15.415453] ret_from_fork_asm+0x1a/0x30 [ 15.415486] </TASK> [ 15.415500] [ 15.423223] Allocated by task 307: [ 15.423351] kasan_save_stack+0x45/0x70 [ 15.423490] kasan_save_track+0x18/0x40 [ 15.423619] kasan_save_alloc_info+0x3b/0x50 [ 15.424092] __kasan_kmalloc+0xb7/0xc0 [ 15.424314] __kmalloc_cache_noprof+0x189/0x420 [ 15.424530] copy_to_kernel_nofault_oob+0x12f/0x560 [ 15.424831] kunit_try_run_case+0x1a5/0x480 [ 15.424981] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.425146] kthread+0x337/0x6f0 [ 15.425302] ret_from_fork+0x116/0x1d0 [ 15.425650] ret_from_fork_asm+0x1a/0x30 [ 15.426083] [ 15.426202] The buggy address belongs to the object at ffff888102a34600 [ 15.426202] which belongs to the cache kmalloc-128 of size 128 [ 15.426829] The buggy address is located 0 bytes to the right of [ 15.426829] allocated 120-byte region [ffff888102a34600, ffff888102a34678) [ 15.427357] [ 15.427507] The buggy address belongs to the physical page: [ 15.427678] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a34 [ 15.427915] flags: 0x200000000000000(node=0|zone=2) [ 15.428080] page_type: f5(slab) [ 15.428275] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 15.428902] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.429246] page dumped because: kasan: bad access detected [ 15.429485] [ 15.429552] Memory state around the buggy address: [ 15.429708] ffff888102a34500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.429920] ffff888102a34580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.430514] >ffff888102a34600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 15.430891] ^ [ 15.431110] ffff888102a34680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.431648] ffff888102a34700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.432014] ==================================================================