Date
July 8, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 34.454065] ================================================================== [ 34.454127] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 34.454184] Write of size 1 at addr fff00000c9adfc78 by task kunit_try_catch/316 [ 34.454260] [ 34.454293] CPU: 0 UID: 0 PID: 316 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 34.454389] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.454419] Hardware name: linux,dummy-virt (DT) [ 34.454452] Call trace: [ 34.454483] show_stack+0x20/0x38 (C) [ 34.454737] dump_stack_lvl+0x8c/0xd0 [ 34.454801] print_report+0x118/0x5d0 [ 34.454894] kasan_report+0xdc/0x128 [ 34.454975] __asan_report_store1_noabort+0x20/0x30 [ 34.455033] strncpy_from_user+0x270/0x2a0 [ 34.455090] copy_user_test_oob+0x5c0/0xec8 [ 34.455155] kunit_try_run_case+0x170/0x3f0 [ 34.455274] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.455410] kthread+0x328/0x630 [ 34.455490] ret_from_fork+0x10/0x20 [ 34.455572] [ 34.455602] Allocated by task 316: [ 34.455640] kasan_save_stack+0x3c/0x68 [ 34.455686] kasan_save_track+0x20/0x40 [ 34.455742] kasan_save_alloc_info+0x40/0x58 [ 34.455803] __kasan_kmalloc+0xd4/0xd8 [ 34.455851] __kmalloc_noprof+0x198/0x4c8 [ 34.455899] kunit_kmalloc_array+0x34/0x88 [ 34.455946] copy_user_test_oob+0xac/0xec8 [ 34.455988] kunit_try_run_case+0x170/0x3f0 [ 34.456048] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.456098] kthread+0x328/0x630 [ 34.456134] ret_from_fork+0x10/0x20 [ 34.456188] [ 34.456342] The buggy address belongs to the object at fff00000c9adfc00 [ 34.456342] which belongs to the cache kmalloc-128 of size 128 [ 34.456484] The buggy address is located 0 bytes to the right of [ 34.456484] allocated 120-byte region [fff00000c9adfc00, fff00000c9adfc78) [ 34.456656] [ 34.456716] The buggy address belongs to the physical page: [ 34.456765] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109adf [ 34.456992] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.457164] page_type: f5(slab) [ 34.457291] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 34.457344] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.457386] page dumped because: kasan: bad access detected [ 34.457444] [ 34.457466] Memory state around the buggy address: [ 34.457501] fff00000c9adfb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.457772] fff00000c9adfb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.457890] >fff00000c9adfc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 34.457995] ^ [ 34.458311] fff00000c9adfc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.458441] fff00000c9adfd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.458489] ================================================================== [ 34.448430] ================================================================== [ 34.448484] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 34.448538] Write of size 121 at addr fff00000c9adfc00 by task kunit_try_catch/316 [ 34.448605] [ 34.448635] CPU: 0 UID: 0 PID: 316 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 34.449175] Tainted: [B]=BAD_PAGE, [N]=TEST [ 34.449240] Hardware name: linux,dummy-virt (DT) [ 34.449291] Call trace: [ 34.449317] show_stack+0x20/0x38 (C) [ 34.449384] dump_stack_lvl+0x8c/0xd0 [ 34.449507] print_report+0x118/0x5d0 [ 34.449576] kasan_report+0xdc/0x128 [ 34.449645] kasan_check_range+0x100/0x1a8 [ 34.449735] __kasan_check_write+0x20/0x30 [ 34.449783] strncpy_from_user+0x3c/0x2a0 [ 34.449852] copy_user_test_oob+0x5c0/0xec8 [ 34.449901] kunit_try_run_case+0x170/0x3f0 [ 34.450089] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.450192] kthread+0x328/0x630 [ 34.450285] ret_from_fork+0x10/0x20 [ 34.450369] [ 34.450420] Allocated by task 316: [ 34.450532] kasan_save_stack+0x3c/0x68 [ 34.450638] kasan_save_track+0x20/0x40 [ 34.450905] kasan_save_alloc_info+0x40/0x58 [ 34.450989] __kasan_kmalloc+0xd4/0xd8 [ 34.451058] __kmalloc_noprof+0x198/0x4c8 [ 34.451142] kunit_kmalloc_array+0x34/0x88 [ 34.451200] copy_user_test_oob+0xac/0xec8 [ 34.451306] kunit_try_run_case+0x170/0x3f0 [ 34.451386] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 34.451461] kthread+0x328/0x630 [ 34.451519] ret_from_fork+0x10/0x20 [ 34.451632] [ 34.451687] The buggy address belongs to the object at fff00000c9adfc00 [ 34.451687] which belongs to the cache kmalloc-128 of size 128 [ 34.451747] The buggy address is located 0 bytes inside of [ 34.451747] allocated 120-byte region [fff00000c9adfc00, fff00000c9adfc78) [ 34.451811] [ 34.451833] The buggy address belongs to the physical page: [ 34.451866] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109adf [ 34.452064] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 34.452156] page_type: f5(slab) [ 34.452236] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 34.452313] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 34.452373] page dumped because: kasan: bad access detected [ 34.452437] [ 34.452767] Memory state around the buggy address: [ 34.452858] fff00000c9adfb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.452965] fff00000c9adfb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.453036] >fff00000c9adfc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 34.453097] ^ [ 34.453139] fff00000c9adfc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.453219] fff00000c9adfd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.453261] ==================================================================
[ 27.752639] ================================================================== [ 27.753012] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 27.753343] Write of size 121 at addr ffff8881062af800 by task kunit_try_catch/333 [ 27.753649] [ 27.753761] CPU: 1 UID: 0 PID: 333 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 27.754040] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.754061] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.754087] Call Trace: [ 27.754111] <TASK> [ 27.754134] dump_stack_lvl+0x73/0xb0 [ 27.754169] print_report+0xd1/0x610 [ 27.754391] ? __virt_addr_valid+0x1db/0x2d0 [ 27.754423] ? strncpy_from_user+0x2e/0x1d0 [ 27.754447] ? kasan_complete_mode_report_info+0x2a/0x200 [ 27.754479] ? strncpy_from_user+0x2e/0x1d0 [ 27.754504] kasan_report+0x141/0x180 [ 27.754528] ? strncpy_from_user+0x2e/0x1d0 [ 27.754557] kasan_check_range+0x10c/0x1c0 [ 27.754584] __kasan_check_write+0x18/0x20 [ 27.754611] strncpy_from_user+0x2e/0x1d0 [ 27.754635] ? __kasan_check_read+0x15/0x20 [ 27.754665] copy_user_test_oob+0x760/0x10f0 [ 27.754695] ? __pfx_copy_user_test_oob+0x10/0x10 [ 27.754720] ? finish_task_switch.isra.0+0x153/0x700 [ 27.754744] ? __switch_to+0x47/0xf50 [ 27.754775] ? __schedule+0x10cc/0x2b60 [ 27.754806] ? __pfx_read_tsc+0x10/0x10 [ 27.754851] ? ktime_get_ts64+0x86/0x230 [ 27.754880] kunit_try_run_case+0x1a5/0x480 [ 27.754905] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.754927] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.754949] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.754980] ? __kthread_parkme+0x82/0x180 [ 27.755003] ? preempt_count_sub+0x50/0x80 [ 27.755028] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.755051] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.755080] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.755108] kthread+0x337/0x6f0 [ 27.755131] ? trace_preempt_on+0x20/0xc0 [ 27.755158] ? __pfx_kthread+0x10/0x10 [ 27.755181] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.755210] ? calculate_sigpending+0x7b/0xa0 [ 27.755250] ? __pfx_kthread+0x10/0x10 [ 27.755275] ret_from_fork+0x116/0x1d0 [ 27.755296] ? __pfx_kthread+0x10/0x10 [ 27.755321] ret_from_fork_asm+0x1a/0x30 [ 27.755356] </TASK> [ 27.755368] [ 27.766103] Allocated by task 333: [ 27.766841] kasan_save_stack+0x45/0x70 [ 27.767459] kasan_save_track+0x18/0x40 [ 27.767971] kasan_save_alloc_info+0x3b/0x50 [ 27.768494] __kasan_kmalloc+0xb7/0xc0 [ 27.768985] __kmalloc_noprof+0x1c9/0x500 [ 27.769486] kunit_kmalloc_array+0x25/0x60 [ 27.770018] copy_user_test_oob+0xab/0x10f0 [ 27.770503] kunit_try_run_case+0x1a5/0x480 [ 27.770659] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.770852] kthread+0x337/0x6f0 [ 27.771341] ret_from_fork+0x116/0x1d0 [ 27.771899] ret_from_fork_asm+0x1a/0x30 [ 27.772406] [ 27.772621] The buggy address belongs to the object at ffff8881062af800 [ 27.772621] which belongs to the cache kmalloc-128 of size 128 [ 27.773298] The buggy address is located 0 bytes inside of [ 27.773298] allocated 120-byte region [ffff8881062af800, ffff8881062af878) [ 27.773661] [ 27.773734] The buggy address belongs to the physical page: [ 27.774148] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062af [ 27.775288] flags: 0x200000000000000(node=0|zone=2) [ 27.775864] page_type: f5(slab) [ 27.776315] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 27.777130] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.777924] page dumped because: kasan: bad access detected [ 27.778199] [ 27.778493] Memory state around the buggy address: [ 27.778983] ffff8881062af700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.779206] ffff8881062af780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.779430] >ffff8881062af800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 27.779640] ^ [ 27.779866] ffff8881062af880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.780208] ffff8881062af900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.780570] ================================================================== [ 27.781105] ================================================================== [ 27.781396] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 27.781675] Write of size 1 at addr ffff8881062af878 by task kunit_try_catch/333 [ 27.782293] [ 27.782422] CPU: 1 UID: 0 PID: 333 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 27.782496] Tainted: [B]=BAD_PAGE, [N]=TEST [ 27.782510] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 27.782573] Call Trace: [ 27.782595] <TASK> [ 27.782614] dump_stack_lvl+0x73/0xb0 [ 27.782648] print_report+0xd1/0x610 [ 27.782672] ? __virt_addr_valid+0x1db/0x2d0 [ 27.782699] ? strncpy_from_user+0x1a5/0x1d0 [ 27.782723] ? kasan_complete_mode_report_info+0x2a/0x200 [ 27.783287] ? strncpy_from_user+0x1a5/0x1d0 [ 27.783325] kasan_report+0x141/0x180 [ 27.783355] ? strncpy_from_user+0x1a5/0x1d0 [ 27.783385] __asan_report_store1_noabort+0x1b/0x30 [ 27.783415] strncpy_from_user+0x1a5/0x1d0 [ 27.783442] copy_user_test_oob+0x760/0x10f0 [ 27.783473] ? __pfx_copy_user_test_oob+0x10/0x10 [ 27.783499] ? finish_task_switch.isra.0+0x153/0x700 [ 27.783524] ? __switch_to+0x47/0xf50 [ 27.783554] ? __schedule+0x10cc/0x2b60 [ 27.783585] ? __pfx_read_tsc+0x10/0x10 [ 27.783612] ? ktime_get_ts64+0x86/0x230 [ 27.783640] kunit_try_run_case+0x1a5/0x480 [ 27.783664] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.783686] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 27.783708] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 27.783739] ? __kthread_parkme+0x82/0x180 [ 27.783761] ? preempt_count_sub+0x50/0x80 [ 27.783786] ? __pfx_kunit_try_run_case+0x10/0x10 [ 27.783835] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.783864] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 27.783893] kthread+0x337/0x6f0 [ 27.783916] ? trace_preempt_on+0x20/0xc0 [ 27.783943] ? __pfx_kthread+0x10/0x10 [ 27.783969] ? _raw_spin_unlock_irq+0x47/0x80 [ 27.783998] ? calculate_sigpending+0x7b/0xa0 [ 27.784027] ? __pfx_kthread+0x10/0x10 [ 27.784051] ret_from_fork+0x116/0x1d0 [ 27.784073] ? __pfx_kthread+0x10/0x10 [ 27.784097] ret_from_fork_asm+0x1a/0x30 [ 27.784132] </TASK> [ 27.784145] [ 27.798715] Allocated by task 333: [ 27.799030] kasan_save_stack+0x45/0x70 [ 27.799413] kasan_save_track+0x18/0x40 [ 27.799764] kasan_save_alloc_info+0x3b/0x50 [ 27.800072] __kasan_kmalloc+0xb7/0xc0 [ 27.800363] __kmalloc_noprof+0x1c9/0x500 [ 27.800543] kunit_kmalloc_array+0x25/0x60 [ 27.800711] copy_user_test_oob+0xab/0x10f0 [ 27.801131] kunit_try_run_case+0x1a5/0x480 [ 27.801537] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 27.801895] kthread+0x337/0x6f0 [ 27.802181] ret_from_fork+0x116/0x1d0 [ 27.802323] ret_from_fork_asm+0x1a/0x30 [ 27.802465] [ 27.802533] The buggy address belongs to the object at ffff8881062af800 [ 27.802533] which belongs to the cache kmalloc-128 of size 128 [ 27.803134] The buggy address is located 0 bytes to the right of [ 27.803134] allocated 120-byte region [ffff8881062af800, ffff8881062af878) [ 27.804253] [ 27.804436] The buggy address belongs to the physical page: [ 27.804944] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062af [ 27.805629] flags: 0x200000000000000(node=0|zone=2) [ 27.805962] page_type: f5(slab) [ 27.806083] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 27.806319] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 27.806537] page dumped because: kasan: bad access detected [ 27.806701] [ 27.806764] Memory state around the buggy address: [ 27.807233] ffff8881062af700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.807868] ffff8881062af780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.808485] >ffff8881062af800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 27.809152] ^ [ 27.809789] ffff8881062af880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.810518] ffff8881062af900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.811184] ==================================================================