Date
July 3, 2025, 10:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.295055] ================================================================== [ 34.295108] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 34.295439] Write of size 121 at addr fff00000c5a89500 by task kunit_try_catch/317 [ 34.295643] [ 34.295676] CPU: 0 UID: 0 PID: 317 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT [ 34.295799] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.295829] Hardware name: linux,dummy-virt (DT) [ 34.296170] Call trace: [ 34.296211] show_stack+0x20/0x38 (C) [ 34.296498] dump_stack_lvl+0x8c/0xd0 [ 34.296592] print_report+0x118/0x608 [ 34.296647] kasan_report+0xdc/0x128 [ 34.296695] kasan_check_range+0x100/0x1a8 [ 34.296747] __kasan_check_write+0x20/0x30 [ 34.296794] strncpy_from_user+0x3c/0x2a0 [ 34.297255] copy_user_test_oob+0x5c0/0xec8 [ 34.297573] kunit_try_run_case+0x170/0x3f0 [ 34.297690] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.297784] kthread+0x328/0x630 [ 34.297880] ret_from_fork+0x10/0x20 [ 34.298141] [ 34.298190] Allocated by task 317: [ 34.298221] kasan_save_stack+0x3c/0x68 [ 34.298520] kasan_save_track+0x20/0x40 [ 34.298584] kasan_save_alloc_info+0x40/0x58 [ 34.298634] __kasan_kmalloc+0xd4/0xd8 [ 34.298713] __kmalloc_noprof+0x198/0x4c8 [ 34.298757] kunit_kmalloc_array+0x34/0x88 [ 34.298800] copy_user_test_oob+0xac/0xec8 [ 34.298858] kunit_try_run_case+0x170/0x3f0 [ 34.298905] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.298954] kthread+0x328/0x630 [ 34.298989] ret_from_fork+0x10/0x20 [ 34.299030] [ 34.299053] The buggy address belongs to the object at fff00000c5a89500 [ 34.299053] which belongs to the cache kmalloc-128 of size 128 [ 34.299117] The buggy address is located 0 bytes inside of [ 34.299117] allocated 120-byte region [fff00000c5a89500, fff00000c5a89578) [ 34.299184] [ 34.299206] The buggy address belongs to the physical page: [ 34.299243] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105a89 [ 34.299299] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.299374] page_type: f5(slab) [ 34.299423] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 34.299479] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.299523] page dumped because: kasan: bad access detected [ 34.299555] [ 34.299580] Memory state around the buggy address: [ 34.299623] fff00000c5a89400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.299667] fff00000c5a89480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.299723] >fff00000c5a89500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 34.299765] ^ [ 34.299824] fff00000c5a89580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.300102] fff00000c5a89600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.300260] ================================================================== [ 34.302306] ================================================================== [ 34.302377] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 34.302427] Write of size 1 at addr fff00000c5a89578 by task kunit_try_catch/317 [ 34.302500] [ 34.302539] CPU: 0 UID: 0 PID: 317 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT [ 34.302629] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.303134] Hardware name: linux,dummy-virt (DT) [ 34.303206] Call trace: [ 34.303272] show_stack+0x20/0x38 (C) [ 34.303422] dump_stack_lvl+0x8c/0xd0 [ 34.303507] print_report+0x118/0x608 [ 34.303660] kasan_report+0xdc/0x128 [ 34.303715] __asan_report_store1_noabort+0x20/0x30 [ 34.304001] strncpy_from_user+0x270/0x2a0 [ 34.304315] copy_user_test_oob+0x5c0/0xec8 [ 34.304462] kunit_try_run_case+0x170/0x3f0 [ 34.304620] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.304724] kthread+0x328/0x630 [ 34.305070] ret_from_fork+0x10/0x20 [ 34.305140] [ 34.305340] Allocated by task 317: [ 34.305644] kasan_save_stack+0x3c/0x68 [ 34.305744] kasan_save_track+0x20/0x40 [ 34.306113] kasan_save_alloc_info+0x40/0x58 [ 34.306247] __kasan_kmalloc+0xd4/0xd8 [ 34.306295] __kmalloc_noprof+0x198/0x4c8 [ 34.306651] kunit_kmalloc_array+0x34/0x88 [ 34.306730] copy_user_test_oob+0xac/0xec8 [ 34.306987] kunit_try_run_case+0x170/0x3f0 [ 34.307184] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.307290] kthread+0x328/0x630 [ 34.307605] ret_from_fork+0x10/0x20 [ 34.307676] [ 34.307719] The buggy address belongs to the object at fff00000c5a89500 [ 34.307719] which belongs to the cache kmalloc-128 of size 128 [ 34.308043] The buggy address is located 0 bytes to the right of [ 34.308043] allocated 120-byte region [fff00000c5a89500, fff00000c5a89578) [ 34.308127] [ 34.308149] The buggy address belongs to the physical page: [ 34.308423] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105a89 [ 34.308508] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.308856] page_type: f5(slab) [ 34.308922] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 34.309034] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.309105] page dumped because: kasan: bad access detected [ 34.309139] [ 34.309159] Memory state around the buggy address: [ 34.309305] fff00000c5a89400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.309353] fff00000c5a89480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.309583] >fff00000c5a89500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 34.309739] ^ [ 34.309794] fff00000c5a89580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.310079] fff00000c5a89600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.310165] ==================================================================
[ 27.202040] ================================================================== [ 27.202497] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 27.202989] Write of size 1 at addr ffff888105ab1d78 by task kunit_try_catch/334 [ 27.203405] [ 27.203605] CPU: 0 UID: 0 PID: 334 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT(voluntary) [ 27.203656] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.203671] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.203695] Call Trace: [ 27.203709] <TASK> [ 27.203725] dump_stack_lvl+0x73/0xb0 [ 27.203755] print_report+0xd1/0x650 [ 27.203779] ? __virt_addr_valid+0x1db/0x2d0 [ 27.203804] ? strncpy_from_user+0x1a5/0x1d0 [ 27.203827] ? kasan_complete_mode_report_info+0x2a/0x200 [ 27.203854] ? strncpy_from_user+0x1a5/0x1d0 [ 27.203878] kasan_report+0x141/0x180 [ 27.203901] ? strncpy_from_user+0x1a5/0x1d0 [ 27.203929] __asan_report_store1_noabort+0x1b/0x30 [ 27.203955] strncpy_from_user+0x1a5/0x1d0 [ 27.203982] copy_user_test_oob+0x760/0x10f0 [ 27.204010] ? __pfx_copy_user_test_oob+0x10/0x10 [ 27.204034] ? finish_task_switch.isra.0+0x153/0x700 [ 27.204058] ? __switch_to+0x47/0xf50 [ 27.204086] ? __schedule+0x10cc/0x2b60 [ 27.204113] ? __pfx_read_tsc+0x10/0x10 [ 27.204136] ? ktime_get_ts64+0x86/0x230 [ 27.204161] kunit_try_run_case+0x1a5/0x480 [ 27.204188] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.204321] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.204346] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.204374] ? __kthread_parkme+0x82/0x180 [ 27.204396] ? preempt_count_sub+0x50/0x80 [ 27.204421] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.204449] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.204489] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.204515] kthread+0x337/0x6f0 [ 27.204537] ? trace_preempt_on+0x20/0xc0 [ 27.204561] ? __pfx_kthread+0x10/0x10 [ 27.204584] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.204610] ? calculate_sigpending+0x7b/0xa0 [ 27.204636] ? __pfx_kthread+0x10/0x10 [ 27.204660] ret_from_fork+0x116/0x1d0 [ 27.204681] ? __pfx_kthread+0x10/0x10 [ 27.204705] ret_from_fork_asm+0x1a/0x30 [ 27.204737] </TASK> [ 27.204750] [ 27.213662] Allocated by task 334: [ 27.213831] kasan_save_stack+0x45/0x70 [ 27.214046] kasan_save_track+0x18/0x40 [ 27.214218] kasan_save_alloc_info+0x3b/0x50 [ 27.214791] __kasan_kmalloc+0xb7/0xc0 [ 27.214939] __kmalloc_noprof+0x1c9/0x500 [ 27.215253] kunit_kmalloc_array+0x25/0x60 [ 27.215452] copy_user_test_oob+0xab/0x10f0 [ 27.215758] kunit_try_run_case+0x1a5/0x480 [ 27.215961] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.216332] kthread+0x337/0x6f0 [ 27.216661] ret_from_fork+0x116/0x1d0 [ 27.216802] ret_from_fork_asm+0x1a/0x30 [ 27.216934] [ 27.217001] The buggy address belongs to the object at ffff888105ab1d00 [ 27.217001] which belongs to the cache kmalloc-128 of size 128 [ 27.217965] The buggy address is located 0 bytes to the right of [ 27.217965] allocated 120-byte region [ffff888105ab1d00, ffff888105ab1d78) [ 27.219350] [ 27.219531] The buggy address belongs to the physical page: [ 27.220142] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105ab1 [ 27.220522] flags: 0x200000000000000(node=0|zone=2) [ 27.220683] page_type: f5(slab) [ 27.220799] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 27.221023] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.221363] page dumped because: kasan: bad access detected [ 27.221878] [ 27.222054] Memory state around the buggy address: [ 27.222567] ffff888105ab1c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.223181] ffff888105ab1c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.223792] >ffff888105ab1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 27.224439] ^ [ 27.225035] ffff888105ab1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.225683] ffff888105ab1e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.226138] ================================================================== [ 27.179646] ================================================================== [ 27.179890] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 27.180353] Write of size 121 at addr ffff888105ab1d00 by task kunit_try_catch/334 [ 27.180911] [ 27.181027] CPU: 0 UID: 0 PID: 334 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4-next-20250703 #1 PREEMPT(voluntary) [ 27.181075] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.181089] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.181113] Call Trace: [ 27.181131] <TASK> [ 27.181149] dump_stack_lvl+0x73/0xb0 [ 27.181180] print_report+0xd1/0x650 [ 27.181403] ? __virt_addr_valid+0x1db/0x2d0 [ 27.181432] ? strncpy_from_user+0x2e/0x1d0 [ 27.181468] ? kasan_complete_mode_report_info+0x2a/0x200 [ 27.181496] ? strncpy_from_user+0x2e/0x1d0 [ 27.181521] kasan_report+0x141/0x180 [ 27.181659] ? strncpy_from_user+0x2e/0x1d0 [ 27.181696] kasan_check_range+0x10c/0x1c0 [ 27.181723] __kasan_check_write+0x18/0x20 [ 27.181748] strncpy_from_user+0x2e/0x1d0 [ 27.181772] ? __kasan_check_read+0x15/0x20 [ 27.181798] copy_user_test_oob+0x760/0x10f0 [ 27.181824] ? __pfx_copy_user_test_oob+0x10/0x10 [ 27.181855] ? finish_task_switch.isra.0+0x153/0x700 [ 27.181879] ? __switch_to+0x47/0xf50 [ 27.181907] ? __schedule+0x10cc/0x2b60 [ 27.181935] ? __pfx_read_tsc+0x10/0x10 [ 27.181958] ? ktime_get_ts64+0x86/0x230 [ 27.181983] kunit_try_run_case+0x1a5/0x480 [ 27.182011] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.182036] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.182059] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.182088] ? __kthread_parkme+0x82/0x180 [ 27.182110] ? preempt_count_sub+0x50/0x80 [ 27.182134] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.182161] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.182187] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.182225] kthread+0x337/0x6f0 [ 27.182246] ? trace_preempt_on+0x20/0xc0 [ 27.182270] ? __pfx_kthread+0x10/0x10 [ 27.182292] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.182317] ? calculate_sigpending+0x7b/0xa0 [ 27.182343] ? __pfx_kthread+0x10/0x10 [ 27.182367] ret_from_fork+0x116/0x1d0 [ 27.182387] ? __pfx_kthread+0x10/0x10 [ 27.182410] ret_from_fork_asm+0x1a/0x30 [ 27.182442] </TASK> [ 27.182466] [ 27.191858] Allocated by task 334: [ 27.192170] kasan_save_stack+0x45/0x70 [ 27.192359] kasan_save_track+0x18/0x40 [ 27.192660] kasan_save_alloc_info+0x3b/0x50 [ 27.192857] __kasan_kmalloc+0xb7/0xc0 [ 27.193090] __kmalloc_noprof+0x1c9/0x500 [ 27.193269] kunit_kmalloc_array+0x25/0x60 [ 27.193626] copy_user_test_oob+0xab/0x10f0 [ 27.193831] kunit_try_run_case+0x1a5/0x480 [ 27.194135] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.194379] kthread+0x337/0x6f0 [ 27.194617] ret_from_fork+0x116/0x1d0 [ 27.194782] ret_from_fork_asm+0x1a/0x30 [ 27.194961] [ 27.195048] The buggy address belongs to the object at ffff888105ab1d00 [ 27.195048] which belongs to the cache kmalloc-128 of size 128 [ 27.195835] The buggy address is located 0 bytes inside of [ 27.195835] allocated 120-byte region [ffff888105ab1d00, ffff888105ab1d78) [ 27.196465] [ 27.196560] The buggy address belongs to the physical page: [ 27.196747] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105ab1 [ 27.197244] flags: 0x200000000000000(node=0|zone=2) [ 27.197532] page_type: f5(slab) [ 27.197658] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 27.198083] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.198512] page dumped because: kasan: bad access detected [ 27.198761] [ 27.199004] Memory state around the buggy address: [ 27.199175] ffff888105ab1c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.199530] ffff888105ab1c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.199827] >ffff888105ab1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 27.200112] ^ [ 27.200636] ffff888105ab1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.200990] ffff888105ab1e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.201284] ==================================================================