Date
July 17, 2025, 10:12 a.m.
Environment | |
---|---|
qemu-arm64 | |
qemu-x86_64 |
[ 32.460230] ================================================================== [ 32.460281] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x3c/0x2a0 [ 32.460338] Write of size 121 at addr fff00000c98f2e00 by task kunit_try_catch/316 [ 32.460391] [ 32.460423] CPU: 0 UID: 0 PID: 316 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT [ 32.460506] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.460536] Hardware name: linux,dummy-virt (DT) [ 32.460569] Call trace: [ 32.460591] show_stack+0x20/0x38 (C) [ 32.460639] dump_stack_lvl+0x8c/0xd0 [ 32.460689] print_report+0x118/0x5d0 [ 32.460733] kasan_report+0xdc/0x128 [ 32.460779] kasan_check_range+0x100/0x1a8 [ 32.460826] __kasan_check_write+0x20/0x30 [ 32.460874] strncpy_from_user+0x3c/0x2a0 [ 32.460923] copy_user_test_oob+0x5c0/0xec8 [ 32.460973] kunit_try_run_case+0x170/0x3f0 [ 32.461019] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.461714] kthread+0x328/0x630 [ 32.461834] ret_from_fork+0x10/0x20 [ 32.461941] [ 32.462077] Allocated by task 316: [ 32.462126] kasan_save_stack+0x3c/0x68 [ 32.462318] kasan_save_track+0x20/0x40 [ 32.462390] kasan_save_alloc_info+0x40/0x58 [ 32.462455] __kasan_kmalloc+0xd4/0xd8 [ 32.462531] __kmalloc_noprof+0x198/0x4c8 [ 32.462645] kunit_kmalloc_array+0x34/0x88 [ 32.462789] copy_user_test_oob+0xac/0xec8 [ 32.462968] kunit_try_run_case+0x170/0x3f0 [ 32.463015] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.463318] kthread+0x328/0x630 [ 32.463418] ret_from_fork+0x10/0x20 [ 32.463478] [ 32.463713] The buggy address belongs to the object at fff00000c98f2e00 [ 32.463713] which belongs to the cache kmalloc-128 of size 128 [ 32.463825] The buggy address is located 0 bytes inside of [ 32.463825] allocated 120-byte region [fff00000c98f2e00, fff00000c98f2e78) [ 32.464005] [ 32.464083] The buggy address belongs to the physical page: [ 32.464239] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1098f2 [ 32.464297] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.464538] page_type: f5(slab) [ 32.464702] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.464814] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.465097] page dumped because: kasan: bad access detected [ 32.465238] [ 32.465274] Memory state around the buggy address: [ 32.465310] fff00000c98f2d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.465466] fff00000c98f2d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.465632] >fff00000c98f2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 32.465736] ^ [ 32.465826] fff00000c98f2e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.466086] fff00000c98f2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.466145] ================================================================== [ 32.467393] ================================================================== [ 32.467664] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x270/0x2a0 [ 32.467729] Write of size 1 at addr fff00000c98f2e78 by task kunit_try_catch/316 [ 32.467836] [ 32.467870] CPU: 0 UID: 0 PID: 316 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT [ 32.467958] Tainted: [B]=BAD_PAGE, [N]=TEST [ 32.467985] Hardware name: linux,dummy-virt (DT) [ 32.468018] Call trace: [ 32.468201] show_stack+0x20/0x38 (C) [ 32.468279] dump_stack_lvl+0x8c/0xd0 [ 32.468400] print_report+0x118/0x5d0 [ 32.468466] kasan_report+0xdc/0x128 [ 32.468635] __asan_report_store1_noabort+0x20/0x30 [ 32.468728] strncpy_from_user+0x270/0x2a0 [ 32.468814] copy_user_test_oob+0x5c0/0xec8 [ 32.468997] kunit_try_run_case+0x170/0x3f0 [ 32.469085] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.469147] kthread+0x328/0x630 [ 32.469190] ret_from_fork+0x10/0x20 [ 32.469239] [ 32.469259] Allocated by task 316: [ 32.469495] kasan_save_stack+0x3c/0x68 [ 32.469681] kasan_save_track+0x20/0x40 [ 32.469776] kasan_save_alloc_info+0x40/0x58 [ 32.470076] __kasan_kmalloc+0xd4/0xd8 [ 32.470114] __kmalloc_noprof+0x198/0x4c8 [ 32.470246] kunit_kmalloc_array+0x34/0x88 [ 32.470343] copy_user_test_oob+0xac/0xec8 [ 32.470486] kunit_try_run_case+0x170/0x3f0 [ 32.470526] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 32.470571] kthread+0x328/0x630 [ 32.470613] ret_from_fork+0x10/0x20 [ 32.470708] [ 32.470731] The buggy address belongs to the object at fff00000c98f2e00 [ 32.470731] which belongs to the cache kmalloc-128 of size 128 [ 32.470811] The buggy address is located 0 bytes to the right of [ 32.470811] allocated 120-byte region [fff00000c98f2e00, fff00000c98f2e78) [ 32.470886] [ 32.470909] The buggy address belongs to the physical page: [ 32.470954] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1098f2 [ 32.471009] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 32.471068] page_type: f5(slab) [ 32.471109] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 32.471613] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 32.471682] page dumped because: kasan: bad access detected [ 32.471914] [ 32.471987] Memory state around the buggy address: [ 32.472154] fff00000c98f2d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.472228] fff00000c98f2d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.472294] >fff00000c98f2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 32.472334] ^ [ 32.472662] fff00000c98f2e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.472826] fff00000c98f2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.473011] ==================================================================
[ 29.728406] ================================================================== [ 29.728918] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x1a5/0x1d0 [ 29.729565] Write of size 1 at addr ffff888104588678 by task kunit_try_catch/334 [ 29.730219] [ 29.730425] CPU: 1 UID: 0 PID: 334 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT(voluntary) [ 29.730476] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.730488] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 29.730520] Call Trace: [ 29.730534] <TASK> [ 29.730551] dump_stack_lvl+0x73/0xb0 [ 29.730592] print_report+0xd1/0x610 [ 29.730615] ? __virt_addr_valid+0x1db/0x2d0 [ 29.730638] ? strncpy_from_user+0x1a5/0x1d0 [ 29.730660] ? kasan_complete_mode_report_info+0x2a/0x200 [ 29.730688] ? strncpy_from_user+0x1a5/0x1d0 [ 29.730711] kasan_report+0x141/0x180 [ 29.730733] ? strncpy_from_user+0x1a5/0x1d0 [ 29.730760] __asan_report_store1_noabort+0x1b/0x30 [ 29.730785] strncpy_from_user+0x1a5/0x1d0 [ 29.730810] copy_user_test_oob+0x760/0x10f0 [ 29.730836] ? __pfx_copy_user_test_oob+0x10/0x10 [ 29.730859] ? finish_task_switch.isra.0+0x153/0x700 [ 29.730880] ? __switch_to+0x47/0xf80 [ 29.730906] ? __schedule+0x10c6/0x2b60 [ 29.730928] ? __pfx_read_tsc+0x10/0x10 [ 29.730949] ? ktime_get_ts64+0x86/0x230 [ 29.730974] kunit_try_run_case+0x1a5/0x480 [ 29.730999] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.731021] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 29.731044] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 29.731068] ? __kthread_parkme+0x82/0x180 [ 29.731103] ? preempt_count_sub+0x50/0x80 [ 29.731125] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.731149] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.731172] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 29.731196] kthread+0x337/0x6f0 [ 29.731216] ? trace_preempt_on+0x20/0xc0 [ 29.731239] ? __pfx_kthread+0x10/0x10 [ 29.731278] ? _raw_spin_unlock_irq+0x47/0x80 [ 29.731300] ? calculate_sigpending+0x7b/0xa0 [ 29.731323] ? __pfx_kthread+0x10/0x10 [ 29.731344] ret_from_fork+0x116/0x1d0 [ 29.731364] ? __pfx_kthread+0x10/0x10 [ 29.731384] ret_from_fork_asm+0x1a/0x30 [ 29.731415] </TASK> [ 29.731426] [ 29.743044] Allocated by task 334: [ 29.743411] kasan_save_stack+0x45/0x70 [ 29.743774] kasan_save_track+0x18/0x40 [ 29.744135] kasan_save_alloc_info+0x3b/0x50 [ 29.744553] __kasan_kmalloc+0xb7/0xc0 [ 29.744816] __kmalloc_noprof+0x1ca/0x510 [ 29.744963] kunit_kmalloc_array+0x25/0x60 [ 29.745211] copy_user_test_oob+0xab/0x10f0 [ 29.745623] kunit_try_run_case+0x1a5/0x480 [ 29.746007] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.746428] kthread+0x337/0x6f0 [ 29.746590] ret_from_fork+0x116/0x1d0 [ 29.746957] ret_from_fork_asm+0x1a/0x30 [ 29.747123] [ 29.747189] The buggy address belongs to the object at ffff888104588600 [ 29.747189] which belongs to the cache kmalloc-128 of size 128 [ 29.748234] The buggy address is located 0 bytes to the right of [ 29.748234] allocated 120-byte region [ffff888104588600, ffff888104588678) [ 29.748828] [ 29.748897] The buggy address belongs to the physical page: [ 29.749063] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104588 [ 29.749410] flags: 0x200000000000000(node=0|zone=2) [ 29.749844] page_type: f5(slab) [ 29.750171] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 29.750836] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.751492] page dumped because: kasan: bad access detected [ 29.751960] [ 29.752117] Memory state around the buggy address: [ 29.752564] ffff888104588500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.753054] ffff888104588580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.753304] >ffff888104588600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 29.753920] ^ [ 29.754552] ffff888104588680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.755020] ffff888104588700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.755490] ================================================================== [ 29.699518] ================================================================== [ 29.700200] BUG: KASAN: slab-out-of-bounds in strncpy_from_user+0x2e/0x1d0 [ 29.700850] Write of size 121 at addr ffff888104588600 by task kunit_try_catch/334 [ 29.701520] [ 29.701693] CPU: 1 UID: 0 PID: 334 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc6-next-20250717 #1 PREEMPT(voluntary) [ 29.701754] Tainted: [B]=BAD_PAGE, [N]=TEST [ 29.701767] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 29.701789] Call Trace: [ 29.701805] <TASK> [ 29.701821] dump_stack_lvl+0x73/0xb0 [ 29.701860] print_report+0xd1/0x610 [ 29.701884] ? __virt_addr_valid+0x1db/0x2d0 [ 29.701907] ? strncpy_from_user+0x2e/0x1d0 [ 29.701943] ? kasan_complete_mode_report_info+0x2a/0x200 [ 29.701969] ? strncpy_from_user+0x2e/0x1d0 [ 29.701993] kasan_report+0x141/0x180 [ 29.702015] ? strncpy_from_user+0x2e/0x1d0 [ 29.702043] kasan_check_range+0x10c/0x1c0 [ 29.702066] __kasan_check_write+0x18/0x20 [ 29.702098] strncpy_from_user+0x2e/0x1d0 [ 29.702119] ? __kasan_check_read+0x15/0x20 [ 29.702145] copy_user_test_oob+0x760/0x10f0 [ 29.702170] ? __pfx_copy_user_test_oob+0x10/0x10 [ 29.702193] ? finish_task_switch.isra.0+0x153/0x700 [ 29.702214] ? __switch_to+0x47/0xf80 [ 29.702240] ? __schedule+0x10c6/0x2b60 [ 29.702283] ? __pfx_read_tsc+0x10/0x10 [ 29.702304] ? ktime_get_ts64+0x86/0x230 [ 29.702328] kunit_try_run_case+0x1a5/0x480 [ 29.702352] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.702375] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 29.702398] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 29.702422] ? __kthread_parkme+0x82/0x180 [ 29.702447] ? preempt_count_sub+0x50/0x80 [ 29.702470] ? __pfx_kunit_try_run_case+0x10/0x10 [ 29.702494] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.702517] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 29.702540] kthread+0x337/0x6f0 [ 29.702560] ? trace_preempt_on+0x20/0xc0 [ 29.702583] ? __pfx_kthread+0x10/0x10 [ 29.702603] ? _raw_spin_unlock_irq+0x47/0x80 [ 29.702625] ? calculate_sigpending+0x7b/0xa0 [ 29.702648] ? __pfx_kthread+0x10/0x10 [ 29.702669] ret_from_fork+0x116/0x1d0 [ 29.702688] ? __pfx_kthread+0x10/0x10 [ 29.702709] ret_from_fork_asm+0x1a/0x30 [ 29.702741] </TASK> [ 29.702752] [ 29.715441] Allocated by task 334: [ 29.715777] kasan_save_stack+0x45/0x70 [ 29.716144] kasan_save_track+0x18/0x40 [ 29.716515] kasan_save_alloc_info+0x3b/0x50 [ 29.716916] __kasan_kmalloc+0xb7/0xc0 [ 29.717293] __kmalloc_noprof+0x1ca/0x510 [ 29.717669] kunit_kmalloc_array+0x25/0x60 [ 29.717972] copy_user_test_oob+0xab/0x10f0 [ 29.718200] kunit_try_run_case+0x1a5/0x480 [ 29.718605] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 29.718938] kthread+0x337/0x6f0 [ 29.719052] ret_from_fork+0x116/0x1d0 [ 29.719186] ret_from_fork_asm+0x1a/0x30 [ 29.719472] [ 29.719623] The buggy address belongs to the object at ffff888104588600 [ 29.719623] which belongs to the cache kmalloc-128 of size 128 [ 29.720696] The buggy address is located 0 bytes inside of [ 29.720696] allocated 120-byte region [ffff888104588600, ffff888104588678) [ 29.721678] [ 29.721747] The buggy address belongs to the physical page: [ 29.721913] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104588 [ 29.722164] flags: 0x200000000000000(node=0|zone=2) [ 29.722504] page_type: f5(slab) [ 29.722806] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 29.723476] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 29.724122] page dumped because: kasan: bad access detected [ 29.724616] [ 29.724781] Memory state around the buggy address: [ 29.725217] ffff888104588500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.725841] ffff888104588580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.726162] >ffff888104588600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 29.726775] ^ [ 29.727248] ffff888104588680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.727604] ffff888104588700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.727811] ==================================================================