Date
July 10, 2025, 9:07 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 32.632971] ================================================================== [ 32.633027] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 32.633080] Write of size 1 at addr fff00000c9bc2978 by task kunit_try_catch/316 [ 32.633145] [ 32.633453] CPU: 0 UID: 0 PID: 316 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250710 #1 PREEMPT [ 32.633619] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.633680] Hardware name: linux,dummy-virt (DT) [ 32.633728] Call trace: [ 32.633753] show_stack+0x20/0x38 (C) [ 32.633808] dump_stack_lvl+0x8c/0xd0 [ 32.633910] print_report+0x118/0x5d0 [ 32.633964] kasan_report+0xdc/0x128 [ 32.634022] __asan_report_store1_noabort+0x20/0x30 [ 32.634078] strncpy_from_user+0x270/0x2a0 [ 32.634140] copy_user_test_oob+0x5c0/0xec8 [ 32.634190] kunit_try_run_case+0x170/0x3f0 [ 32.634240] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.634295] kthread+0x328/0x630 [ 32.634337] ret_from_fork+0x10/0x20 [ 32.634386] [ 32.634416] Allocated by task 316: [ 32.634446] kasan_save_stack+0x3c/0x68 [ 32.634493] kasan_save_track+0x20/0x40 [ 32.634533] kasan_save_alloc_info+0x40/0x58 [ 32.634576] __kasan_kmalloc+0xd4/0xd8 [ 32.634623] __kmalloc_noprof+0x198/0x4c8 [ 32.634664] kunit_kmalloc_array+0x34/0x88 [ 32.634943] copy_user_test_oob+0xac/0xec8 [ 32.635301] kunit_try_run_case+0x170/0x3f0 [ 32.635465] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.635550] kthread+0x328/0x630 [ 32.635595] ret_from_fork+0x10/0x20 [ 32.635634] [ 32.635883] The buggy address belongs to the object at fff00000c9bc2900 [ 32.635883] which belongs to the cache kmalloc-128 of size 128 [ 32.636076] The buggy address is located 0 bytes to the right of [ 32.636076] allocated 120-byte region [fff00000c9bc2900, fff00000c9bc2978) [ 32.636426] [ 32.636602] The buggy address belongs to the physical page: [ 32.636680] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109bc2 [ 32.636908] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.636970] page_type: f5(slab) [ 32.637047] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.637154] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.637277] page dumped because: kasan: bad access detected [ 32.637441] [ 32.637469] Memory state around the buggy address: [ 32.637533] fff00000c9bc2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.637611] fff00000c9bc2880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.637768] >fff00000c9bc2900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 32.637836] ^ [ 32.637886] fff00000c9bc2980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.638117] fff00000c9bc2a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.638321] ================================================================== [ 32.626496] ================================================================== [ 32.626581] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 32.626635] Write of size 121 at addr fff00000c9bc2900 by task kunit_try_catch/316 [ 32.626688] [ 32.626749] CPU: 0 UID: 0 PID: 316 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250710 #1 PREEMPT [ 32.626837] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.626868] Hardware name: linux,dummy-virt (DT) [ 32.626900] Call trace: [ 32.626924] show_stack+0x20/0x38 (C) [ 32.626972] dump_stack_lvl+0x8c/0xd0 [ 32.627047] print_report+0x118/0x5d0 [ 32.627093] kasan_report+0xdc/0x128 [ 32.627245] kasan_check_range+0x100/0x1a8 [ 32.627333] __kasan_check_write+0x20/0x30 [ 32.627429] strncpy_from_user+0x3c/0x2a0 [ 32.627541] copy_user_test_oob+0x5c0/0xec8 [ 32.627757] kunit_try_run_case+0x170/0x3f0 [ 32.627924] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.628006] kthread+0x328/0x630 [ 32.628073] ret_from_fork+0x10/0x20 [ 32.628275] [ 32.628388] Allocated by task 316: [ 32.628467] kasan_save_stack+0x3c/0x68 [ 32.628533] kasan_save_track+0x20/0x40 [ 32.628620] kasan_save_alloc_info+0x40/0x58 [ 32.628661] __kasan_kmalloc+0xd4/0xd8 [ 32.628841] __kmalloc_noprof+0x198/0x4c8 [ 32.629124] kunit_kmalloc_array+0x34/0x88 [ 32.629248] copy_user_test_oob+0xac/0xec8 [ 32.629573] kunit_try_run_case+0x170/0x3f0 [ 32.629638] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.629752] kthread+0x328/0x630 [ 32.629842] ret_from_fork+0x10/0x20 [ 32.629918] [ 32.630063] The buggy address belongs to the object at fff00000c9bc2900 [ 32.630063] which belongs to the cache kmalloc-128 of size 128 [ 32.630189] The buggy address is located 0 bytes inside of [ 32.630189] allocated 120-byte region [fff00000c9bc2900, fff00000c9bc2978) [ 32.630361] [ 32.630431] The buggy address belongs to the physical page: [ 32.630542] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109bc2 [ 32.630600] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.630653] page_type: f5(slab) [ 32.630848] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.630939] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.630993] page dumped because: kasan: bad access detected [ 32.631039] [ 32.631074] Memory state around the buggy address: [ 32.631275] fff00000c9bc2800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.631350] fff00000c9bc2880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.631432] >fff00000c9bc2900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 32.631497] ^ [ 32.631642] fff00000c9bc2980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.631726] fff00000c9bc2a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.631778] ==================================================================
[ 29.291120] ================================================================== [ 29.291464] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 29.291767] Write of size 121 at addr ffff8881060c3d00 by task kunit_try_catch/333 [ 29.292132] [ 29.292216] CPU: 1 UID: 0 PID: 333 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250710 #1 PREEMPT(voluntary) [ 29.292264] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.292277] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 29.292299] Call Trace: [ 29.292314] <TASK> [ 29.292330] dump_stack_lvl+0x73/0xb0 [ 29.292359] print_report+0xd1/0x610 [ 29.292382] ? __virt_addr_valid+0x1db/0x2d0 [ 29.292407] ? strncpy_from_user+0x2e/0x1d0 [ 29.292432] ? kasan_complete_mode_report_info+0x2a/0x200 [ 29.292460] ? strncpy_from_user+0x2e/0x1d0 [ 29.292485] kasan_report+0x141/0x180 [ 29.292509] ? strncpy_from_user+0x2e/0x1d0 [ 29.292538] kasan_check_range+0x10c/0x1c0 [ 29.292563] __kasan_check_write+0x18/0x20 [ 29.292587] strncpy_from_user+0x2e/0x1d0 [ 29.292611] ? __kasan_check_read+0x15/0x20 [ 29.292637] copy_user_test_oob+0x760/0x10f0 [ 29.292663] ? __pfx_copy_user_test_oob+0x10/0x10 [ 29.292688] ? finish_task_switch.isra.0+0x153/0x700 [ 29.292724] ? __switch_to+0x47/0xf80 [ 29.292751] ? __schedule+0x10cc/0x2b60 [ 29.292776] ? __pfx_read_tsc+0x10/0x10 [ 29.292800] ? ktime_get_ts64+0x86/0x230 [ 29.292835] kunit_try_run_case+0x1a5/0x480 [ 29.292859] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.292881] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 29.292906] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 29.292931] ? __kthread_parkme+0x82/0x180 [ 29.292952] ? preempt_count_sub+0x50/0x80 [ 29.292977] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.293001] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.293028] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 29.293055] kthread+0x337/0x6f0 [ 29.293076] ? trace_preempt_on+0x20/0xc0 [ 29.293100] ? __pfx_kthread+0x10/0x10 [ 29.293123] ? _raw_spin_unlock_irq+0x47/0x80 [ 29.293146] ? calculate_sigpending+0x7b/0xa0 [ 29.293172] ? __pfx_kthread+0x10/0x10 [ 29.293195] ret_from_fork+0x116/0x1d0 [ 29.293215] ? __pfx_kthread+0x10/0x10 [ 29.293238] ret_from_fork_asm+0x1a/0x30 [ 29.293270] </TASK> [ 29.293282] [ 29.301054] Allocated by task 333: [ 29.301203] kasan_save_stack+0x45/0x70 [ 29.301393] kasan_save_track+0x18/0x40 [ 29.301594] kasan_save_alloc_info+0x3b/0x50 [ 29.301776] __kasan_kmalloc+0xb7/0xc0 [ 29.301962] __kmalloc_noprof+0x1c9/0x500 [ 29.302155] kunit_kmalloc_array+0x25/0x60 [ 29.302326] copy_user_test_oob+0xab/0x10f0 [ 29.302543] kunit_try_run_case+0x1a5/0x480 [ 29.302704] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.302880] kthread+0x337/0x6f0 [ 29.302999] ret_from_fork+0x116/0x1d0 [ 29.303130] ret_from_fork_asm+0x1a/0x30 [ 29.303267] [ 29.303333] The buggy address belongs to the object at ffff8881060c3d00 [ 29.303333] which belongs to the cache kmalloc-128 of size 128 [ 29.303768] The buggy address is located 0 bytes inside of [ 29.303768] allocated 120-byte region [ffff8881060c3d00, ffff8881060c3d78) [ 29.304516] [ 29.304608] The buggy address belongs to the physical page: [ 29.304797] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1060c3 [ 29.305033] flags: 0x200000000000000(node=0|zone=2) [ 29.305192] page_type: f5(slab) [ 29.305307] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 29.305534] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.305898] page dumped because: kasan: bad access detected [ 29.306148] [ 29.306238] Memory state around the buggy address: [ 29.306462] ffff8881060c3c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.306814] ffff8881060c3c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.307141] >ffff8881060c3d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 29.307468] ^ [ 29.307807] ffff8881060c3d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.308132] ffff8881060c3e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.308421] ================================================================== [ 29.308982] ================================================================== [ 29.309324] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 29.309776] Write of size 1 at addr ffff8881060c3d78 by task kunit_try_catch/333 [ 29.310000] [ 29.310081] CPU: 1 UID: 0 PID: 333 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250710 #1 PREEMPT(voluntary) [ 29.310127] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.310141] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 29.310164] Call Trace: [ 29.310179] <TASK> [ 29.310195] dump_stack_lvl+0x73/0xb0 [ 29.310224] print_report+0xd1/0x610 [ 29.310247] ? __virt_addr_valid+0x1db/0x2d0 [ 29.310271] ? strncpy_from_user+0x1a5/0x1d0 [ 29.310296] ? kasan_complete_mode_report_info+0x2a/0x200 [ 29.310322] ? strncpy_from_user+0x1a5/0x1d0 [ 29.310346] kasan_report+0x141/0x180 [ 29.310368] ? strncpy_from_user+0x1a5/0x1d0 [ 29.310397] __asan_report_store1_noabort+0x1b/0x30 [ 29.310439] strncpy_from_user+0x1a5/0x1d0 [ 29.310465] copy_user_test_oob+0x760/0x10f0 [ 29.310492] ? __pfx_copy_user_test_oob+0x10/0x10 [ 29.310516] ? finish_task_switch.isra.0+0x153/0x700 [ 29.310540] ? __switch_to+0x47/0xf80 [ 29.310567] ? __schedule+0x10cc/0x2b60 [ 29.310591] ? __pfx_read_tsc+0x10/0x10 [ 29.310615] ? ktime_get_ts64+0x86/0x230 [ 29.310641] kunit_try_run_case+0x1a5/0x480 [ 29.310665] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.310687] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 29.310722] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 29.310747] ? __kthread_parkme+0x82/0x180 [ 29.310770] ? preempt_count_sub+0x50/0x80 [ 29.310794] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.310827] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.310854] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 29.310881] kthread+0x337/0x6f0 [ 29.310902] ? trace_preempt_on+0x20/0xc0 [ 29.310927] ? __pfx_kthread+0x10/0x10 [ 29.310950] ? _raw_spin_unlock_irq+0x47/0x80 [ 29.310973] ? calculate_sigpending+0x7b/0xa0 [ 29.310998] ? __pfx_kthread+0x10/0x10 [ 29.311022] ret_from_fork+0x116/0x1d0 [ 29.311042] ? __pfx_kthread+0x10/0x10 [ 29.311065] ret_from_fork_asm+0x1a/0x30 [ 29.311096] </TASK> [ 29.311109] [ 29.318790] Allocated by task 333: [ 29.318960] kasan_save_stack+0x45/0x70 [ 29.319133] kasan_save_track+0x18/0x40 [ 29.319265] kasan_save_alloc_info+0x3b/0x50 [ 29.319412] __kasan_kmalloc+0xb7/0xc0 [ 29.319685] __kmalloc_noprof+0x1c9/0x500 [ 29.319904] kunit_kmalloc_array+0x25/0x60 [ 29.320108] copy_user_test_oob+0xab/0x10f0 [ 29.320292] kunit_try_run_case+0x1a5/0x480 [ 29.320434] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.320920] kthread+0x337/0x6f0 [ 29.321070] ret_from_fork+0x116/0x1d0 [ 29.321234] ret_from_fork_asm+0x1a/0x30 [ 29.321387] [ 29.321481] The buggy address belongs to the object at ffff8881060c3d00 [ 29.321481] which belongs to the cache kmalloc-128 of size 128 [ 29.321933] The buggy address is located 0 bytes to the right of [ 29.321933] allocated 120-byte region [ffff8881060c3d00, ffff8881060c3d78) [ 29.322301] [ 29.322369] The buggy address belongs to the physical page: [ 29.322568] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1060c3 [ 29.323012] flags: 0x200000000000000(node=0|zone=2) [ 29.323242] page_type: f5(slab) [ 29.323406] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 29.323913] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.324141] page dumped because: kasan: bad access detected [ 29.324309] [ 29.324376] Memory state around the buggy address: [ 29.324623] ffff8881060c3c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.324933] ffff8881060c3c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.325220] >ffff8881060c3d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 29.325520] ^ [ 29.325822] ffff8881060c3d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.326103] ffff8881060c3e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.326393] ==================================================================