Date
July 24, 2025, 4:41 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 35.354700] ================================================================== [ 35.354879] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x204/0x250 [ 35.354966] Read of size 8 at addr fff00000c9b92378 by task kunit_try_catch/312 [ 35.355224] [ 35.355334] CPU: 1 UID: 0 PID: 312 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250724 #1 PREEMPT [ 35.355506] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.355597] Hardware name: linux,dummy-virt (DT) [ 35.355666] Call trace: [ 35.355726] show_stack+0x20/0x38 (C) [ 35.355830] dump_stack_lvl+0x8c/0xd0 [ 35.355918] print_report+0x118/0x5e8 [ 35.356016] kasan_report+0xdc/0x128 [ 35.356094] __asan_report_load8_noabort+0x20/0x30 [ 35.356191] copy_to_kernel_nofault+0x204/0x250 [ 35.356275] copy_to_kernel_nofault_oob+0x158/0x418 [ 35.356416] kunit_try_run_case+0x170/0x3f0 [ 35.356501] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.356556] kthread+0x328/0x630 [ 35.356600] ret_from_fork+0x10/0x20 [ 35.356654] [ 35.356675] Allocated by task 312: [ 35.356973] kasan_save_stack+0x3c/0x68 [ 35.357128] kasan_save_track+0x20/0x40 [ 35.357222] kasan_save_alloc_info+0x40/0x58 [ 35.357315] __kasan_kmalloc+0xd4/0xd8 [ 35.357386] __kmalloc_cache_noprof+0x16c/0x3c0 [ 35.357454] copy_to_kernel_nofault_oob+0xc8/0x418 [ 35.357522] kunit_try_run_case+0x170/0x3f0 [ 35.357924] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.357998] kthread+0x328/0x630 [ 35.358059] ret_from_fork+0x10/0x20 [ 35.358157] [ 35.358210] The buggy address belongs to the object at fff00000c9b92300 [ 35.358210] which belongs to the cache kmalloc-128 of size 128 [ 35.358301] The buggy address is located 0 bytes to the right of [ 35.358301] allocated 120-byte region [fff00000c9b92300, fff00000c9b92378) [ 35.358689] [ 35.358719] The buggy address belongs to the physical page: [ 35.358894] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b92 [ 35.359194] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 35.359533] page_type: f5(slab) [ 35.359622] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 35.359743] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 35.359846] page dumped because: kasan: bad access detected [ 35.359881] [ 35.359902] Memory state around the buggy address: [ 35.359940] fff00000c9b92200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.359987] fff00000c9b92280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.360272] >fff00000c9b92300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 35.360423] ^ [ 35.360507] fff00000c9b92380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.360782] fff00000c9b92400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.360913] ================================================================== [ 35.361818] ================================================================== [ 35.361873] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x8c/0x250 [ 35.361928] Write of size 8 at addr fff00000c9b92378 by task kunit_try_catch/312 [ 35.362005] [ 35.362040] CPU: 1 UID: 0 PID: 312 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc7-next-20250724 #1 PREEMPT [ 35.362133] Tainted: [B]=BAD_PAGE, [N]=TEST [ 35.362165] Hardware name: linux,dummy-virt (DT) [ 35.362198] Call trace: [ 35.362222] show_stack+0x20/0x38 (C) [ 35.362291] dump_stack_lvl+0x8c/0xd0 [ 35.362346] print_report+0x118/0x5e8 [ 35.362393] kasan_report+0xdc/0x128 [ 35.362438] kasan_check_range+0x100/0x1a8 [ 35.362486] __kasan_check_write+0x20/0x30 [ 35.362534] copy_to_kernel_nofault+0x8c/0x250 [ 35.362591] copy_to_kernel_nofault_oob+0x1bc/0x418 [ 35.362643] kunit_try_run_case+0x170/0x3f0 [ 35.362764] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.362824] kthread+0x328/0x630 [ 35.362868] ret_from_fork+0x10/0x20 [ 35.362919] [ 35.362939] Allocated by task 312: [ 35.362976] kasan_save_stack+0x3c/0x68 [ 35.363411] kasan_save_track+0x20/0x40 [ 35.363473] kasan_save_alloc_info+0x40/0x58 [ 35.363516] __kasan_kmalloc+0xd4/0xd8 [ 35.363603] __kmalloc_cache_noprof+0x16c/0x3c0 [ 35.363717] copy_to_kernel_nofault_oob+0xc8/0x418 [ 35.363788] kunit_try_run_case+0x170/0x3f0 [ 35.363899] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 35.363986] kthread+0x328/0x630 [ 35.364021] ret_from_fork+0x10/0x20 [ 35.364060] [ 35.364083] The buggy address belongs to the object at fff00000c9b92300 [ 35.364083] which belongs to the cache kmalloc-128 of size 128 [ 35.364146] The buggy address is located 0 bytes to the right of [ 35.364146] allocated 120-byte region [fff00000c9b92300, fff00000c9b92378) [ 35.364418] [ 35.364479] The buggy address belongs to the physical page: [ 35.364530] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b92 [ 35.364606] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 35.364669] page_type: f5(slab) [ 35.364710] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 35.364775] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 35.364973] page dumped because: kasan: bad access detected [ 35.365049] [ 35.365119] Memory state around the buggy address: [ 35.365212] fff00000c9b92200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.365261] fff00000c9b92280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.365308] >fff00000c9b92300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 35.365624] ^ [ 35.365703] fff00000c9b92380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.365801] fff00000c9b92400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.365911] ==================================================================
[ 31.033943] ================================================================== [ 31.034664] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x99/0x260 [ 31.035449] Write of size 8 at addr ffff888105635378 by task kunit_try_catch/329 [ 31.036340] [ 31.036497] CPU: 0 UID: 0 PID: 329 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250724 #1 PREEMPT(voluntary) [ 31.036560] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 31.036585] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 31.036609] Call Trace: [ 31.036623] <TASK> [ 31.036643] dump_stack_lvl+0x73/0xb0 [ 31.036673] print_report+0xd1/0x640 [ 31.036718] ? __virt_addr_valid+0x1db/0x2d0 [ 31.036744] ? copy_to_kernel_nofault+0x99/0x260 [ 31.036770] ? kasan_complete_mode_report_info+0x2a/0x200 [ 31.036846] ? copy_to_kernel_nofault+0x99/0x260 [ 31.036874] kasan_report+0x141/0x180 [ 31.036898] ? copy_to_kernel_nofault+0x99/0x260 [ 31.036942] kasan_check_range+0x10c/0x1c0 [ 31.036966] __kasan_check_write+0x18/0x20 [ 31.036990] copy_to_kernel_nofault+0x99/0x260 [ 31.037016] copy_to_kernel_nofault_oob+0x288/0x560 [ 31.037041] ? __pfx_copy_to_kernel_nofault_oob+0x10/0x10 [ 31.037066] ? finish_task_switch.isra.0+0x153/0x700 [ 31.037092] ? __schedule+0x10da/0x2b60 [ 31.037117] ? trace_hardirqs_on+0x37/0xe0 [ 31.037149] ? __pfx_read_tsc+0x10/0x10 [ 31.037172] ? ktime_get_ts64+0x86/0x230 [ 31.037198] kunit_try_run_case+0x1a5/0x480 [ 31.037224] ? __pfx_kunit_try_run_case+0x10/0x10 [ 31.037248] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 31.037273] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 31.037299] ? __kthread_parkme+0x82/0x180 [ 31.037321] ? preempt_count_sub+0x50/0x80 [ 31.037345] ? __pfx_kunit_try_run_case+0x10/0x10 [ 31.037368] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 31.037393] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 31.037417] kthread+0x337/0x6f0 [ 31.037439] ? trace_preempt_on+0x20/0xc0 [ 31.037462] ? __pfx_kthread+0x10/0x10 [ 31.037484] ? _raw_spin_unlock_irq+0x47/0x80 [ 31.037507] ? calculate_sigpending+0x7b/0xa0 [ 31.037532] ? __pfx_kthread+0x10/0x10 [ 31.037554] ret_from_fork+0x116/0x1d0 [ 31.037585] ? __pfx_kthread+0x10/0x10 [ 31.037607] ret_from_fork_asm+0x1a/0x30 [ 31.037639] </TASK> [ 31.037651] [ 31.049848] Allocated by task 329: [ 31.050247] kasan_save_stack+0x45/0x70 [ 31.050480] kasan_save_track+0x18/0x40 [ 31.050685] kasan_save_alloc_info+0x3b/0x50 [ 31.051039] __kasan_kmalloc+0xb7/0xc0 [ 31.051189] __kmalloc_cache_noprof+0x189/0x420 [ 31.051351] copy_to_kernel_nofault_oob+0x12f/0x560 [ 31.051555] kunit_try_run_case+0x1a5/0x480 [ 31.051802] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 31.052146] kthread+0x337/0x6f0 [ 31.052326] ret_from_fork+0x116/0x1d0 [ 31.052584] ret_from_fork_asm+0x1a/0x30 [ 31.053023] [ 31.053120] The buggy address belongs to the object at ffff888105635300 [ 31.053120] which belongs to the cache kmalloc-128 of size 128 [ 31.054178] The buggy address is located 0 bytes to the right of [ 31.054178] allocated 120-byte region [ffff888105635300, ffff888105635378) [ 31.054766] [ 31.054899] The buggy address belongs to the physical page: [ 31.055152] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105635 [ 31.055539] flags: 0x200000000000000(node=0|zone=2) [ 31.055868] page_type: f5(slab) [ 31.056041] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 31.056364] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.056651] page dumped because: kasan: bad access detected [ 31.056971] [ 31.057077] Memory state around the buggy address: [ 31.057287] ffff888105635200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.057622] ffff888105635280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.057960] >ffff888105635300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 31.058288] ^ [ 31.058648] ffff888105635380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.058963] ffff888105635400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.059427] ================================================================== [ 31.000567] ================================================================== [ 31.001451] BUG: KASAN: slab-out-of-bounds in copy_to_kernel_nofault+0x225/0x260 [ 31.001731] Read of size 8 at addr ffff888105635378 by task kunit_try_catch/329 [ 31.001961] [ 31.002055] CPU: 0 UID: 0 PID: 329 Comm: kunit_try_catch Tainted: G B W N 6.16.0-rc7-next-20250724 #1 PREEMPT(voluntary) [ 31.002115] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST [ 31.002132] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 31.002157] Call Trace: [ 31.002173] <TASK> [ 31.002196] dump_stack_lvl+0x73/0xb0 [ 31.002229] print_report+0xd1/0x640 [ 31.002256] ? __virt_addr_valid+0x1db/0x2d0 [ 31.002284] ? copy_to_kernel_nofault+0x225/0x260 [ 31.002312] ? kasan_complete_mode_report_info+0x2a/0x200 [ 31.002340] ? copy_to_kernel_nofault+0x225/0x260 [ 31.002364] kasan_report+0x141/0x180 [ 31.002388] ? copy_to_kernel_nofault+0x225/0x260 [ 31.002417] __asan_report_load8_noabort+0x18/0x20 [ 31.002442] copy_to_kernel_nofault+0x225/0x260 [ 31.002467] copy_to_kernel_nofault_oob+0x1ed/0x560 [ 31.002492] ? __pfx_copy_to_kernel_nofault_oob+0x10/0x10 [ 31.002515] ? finish_task_switch.isra.0+0x153/0x700 [ 31.002541] ? __schedule+0x10da/0x2b60 [ 31.002566] ? trace_hardirqs_on+0x37/0xe0 [ 31.002623] ? __pfx_read_tsc+0x10/0x10 [ 31.002646] ? ktime_get_ts64+0x86/0x230 [ 31.002674] kunit_try_run_case+0x1a5/0x480 [ 31.002703] ? __pfx_kunit_try_run_case+0x10/0x10 [ 31.002726] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 31.002751] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 31.002777] ? __kthread_parkme+0x82/0x180 [ 31.002800] ? preempt_count_sub+0x50/0x80 [ 31.002823] ? __pfx_kunit_try_run_case+0x10/0x10 [ 31.002848] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 31.002874] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 31.002898] kthread+0x337/0x6f0 [ 31.002919] ? trace_preempt_on+0x20/0xc0 [ 31.002942] ? __pfx_kthread+0x10/0x10 [ 31.002963] ? _raw_spin_unlock_irq+0x47/0x80 [ 31.002987] ? calculate_sigpending+0x7b/0xa0 [ 31.003013] ? __pfx_kthread+0x10/0x10 [ 31.003035] ret_from_fork+0x116/0x1d0 [ 31.003056] ? __pfx_kthread+0x10/0x10 [ 31.003077] ret_from_fork_asm+0x1a/0x30 [ 31.003110] </TASK> [ 31.003122] [ 31.018274] Allocated by task 329: [ 31.018696] kasan_save_stack+0x45/0x70 [ 31.018973] kasan_save_track+0x18/0x40 [ 31.019430] kasan_save_alloc_info+0x3b/0x50 [ 31.019761] __kasan_kmalloc+0xb7/0xc0 [ 31.020435] __kmalloc_cache_noprof+0x189/0x420 [ 31.020609] copy_to_kernel_nofault_oob+0x12f/0x560 [ 31.020766] kunit_try_run_case+0x1a5/0x480 [ 31.020904] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 31.021428] kthread+0x337/0x6f0 [ 31.021880] ret_from_fork+0x116/0x1d0 [ 31.022257] ret_from_fork_asm+0x1a/0x30 [ 31.022635] [ 31.022790] The buggy address belongs to the object at ffff888105635300 [ 31.022790] which belongs to the cache kmalloc-128 of size 128 [ 31.024126] The buggy address is located 0 bytes to the right of [ 31.024126] allocated 120-byte region [ffff888105635300, ffff888105635378) [ 31.025043] [ 31.025216] The buggy address belongs to the physical page: [ 31.025752] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105635 [ 31.026326] flags: 0x200000000000000(node=0|zone=2) [ 31.026493] page_type: f5(slab) [ 31.026623] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 31.027071] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 31.027727] page dumped because: kasan: bad access detected [ 31.028307] [ 31.028557] Memory state around the buggy address: [ 31.029040] ffff888105635200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.029792] ffff888105635280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.030487] >ffff888105635300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 31.030721] ^ [ 31.031260] ffff888105635380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.031976] ffff888105635400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.032741] ==================================================================