general protection fault in sg_common

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-49	general protection fault in sg_common_write				26	2428d	2590d	0/3	auto-closed as invalid on 2019/02/22 14:59
sg_write: data in/out 134348763/216 bytes for SCSI command 0x9f-- guessing data in;
   program syz-executor2 not setting count and/or reply_len properly
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 6572 Comm: syz-executor2 Not tainted 4.4.120-gd63fdf6 #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801bfc56000 task.stack: ffff8801d6cf0000
RIP: 0010:[<ffffffff825bf362>]  [<ffffffff825bf362>] sg_start_req drivers/scsi/sg.c:1690 [inline]
RIP: 0010:[<ffffffff825bf362>]  [<ffffffff825bf362>] sg_common_write.isra.21+0x382/0x18c0 drivers/scsi/sg.c:787
RSP: 0018:ffff8801d6cf7890  EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 000000000000009f RCX: ffffffff825bf07a
RDX: 0000000000000002 RSI: ffff8800b9a5439c RDI: ffff8800b9a5439a
RBP: ffff8801d6cf7a28 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 1ffff1003ad9ef0c R12: 1ffff1003ad9ef20
R13: ffff8800b9a54200 R14: ffff8801d6cf7af0 R15: ffff8800b9a54358
FS:  0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f6fc2b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f6fc2db0 CR3: 00000000b17f8000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8800b9a542f8 ffff8800b9a543e0 ffff88010801ffdb 0000000000000010
 ffff8800b9a5439c 0000000000000000 ffff880100001770 ffffffff0801ffdb
 ffff880100000000 ffff8800b9a54200 ffff8801bfc56000 fffffffffffffffc
Call Trace:
 [<ffffffff825c426a>] sg_write+0x6ba/0xb70 drivers/scsi/sg.c:690
 [<ffffffff8151d373>] __vfs_write+0x103/0x450 fs/read_write.c:489
 [<ffffffff8151f1da>] vfs_write+0x18a/0x530 fs/read_write.c:538
 [<ffffffff815218c9>] SYSC_write fs/read_write.c:585 [inline]
 [<ffffffff815218c9>] SyS_write+0xd9/0x1b0 fs/read_write.c:577
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
Code: 42 66 89 85 90 fe ff ff 48 8b 85 c8 fe ff ff 48 83 c0 10 48 89 c2 48 89 85 80 fe ff ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 14 15 00 00 48 8b 85 c8 fe ff ff 48 8b 58 10 
RIP  [<ffffffff825bf362>] sg_start_req drivers/scsi/sg.c:1690 [inline]
RIP  [<ffffffff825bf362>] sg_common_write.isra.21+0x382/0x18c0 drivers/scsi/sg.c:787
 RSP <ffff8801d6cf7890>
---[ end trace 40d75d35cd1d9b1f ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..