================================================================== BUG: KASAN: use-after-free in list_empty include/linux/list.h:189 [inline] BUG: KASAN: use-after-free in sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2120 Read of size 8 at addr ffff8801d2bc5340 by task syz-executor0/10786 CPU: 1 PID: 10786 Comm: syz-executor0 Not tainted 4.4.113-g202e079 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 5a8d93c087e1aff1 ffff8800b253f9f0 ffffffff81d0278d ffffea00074af140 ffff8801d2bc5340 0000000000000000 ffff8801d2bc5340 ffff8800aa48a338 ffff8800b253fa28 ffffffff814fd053 ffff8801d2bc5340 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x73/0x260 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x285/0x370 mm/kasan/report.c:408 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] list_empty include/linux/list.h:189 [inline] [] sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2120 [] sg_finish_rem_req+0x295/0x340 drivers/scsi/sg.c:1837 [] sg_read+0xa1b/0x1490 drivers/scsi/sg.c:537 [] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:680 [] do_readv_writev+0x5dd/0x6e0 fs/read_write.c:810 [] vfs_readv+0x78/0xb0 fs/read_write.c:834 [] SYSC_readv fs/read_write.c:860 [inline] [] SyS_readv+0xd9/0x240 fs/read_write.c:852 [] entry_SYSCALL_64_fastpath+0x1c/0x98 Allocated by task 5998: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 [] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554 [] slab_post_alloc_hook mm/slub.c:1349 [inline] [] slab_alloc_node mm/slub.c:2615 [inline] [] slab_alloc mm/slub.c:2623 [inline] [] kmem_cache_alloc+0xba/0x290 mm/slub.c:2628 [] fasync_alloc fs/fcntl.c:603 [inline] [] fasync_add_entry fs/fcntl.c:661 [inline] [] fasync_helper+0x37/0xb0 fs/fcntl.c:690 [] sock_fasync+0xd1/0x1f0 net/socket.c:1063 [] ioctl_fioasync fs/ioctl.c:511 [inline] [] do_vfs_ioctl+0x981/0xee0 fs/ioctl.c:576 [] SYSC_ioctl fs/ioctl.c:622 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613 [] entry_SYSCALL_64_fastpath+0x1c/0x98 Freed by task 3371: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kmem_cache_free+0xc7/0x320 mm/slub.c:2881 [] fasync_free_rcu+0x1d/0x20 fs/fcntl.c:562 [] __rcu_reclaim kernel/rcu/rcu.h:118 [inline] [] rcu_do_batch kernel/rcu/tree.c:2705 [inline] [] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline] [] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline] [] rcu_process_callbacks+0x7f4/0x14a0 kernel/rcu/tree.c:2957 [] __do_softirq+0x227/0xa38 kernel/softirq.c:273 The buggy address belongs to the object at ffff8801d2bc5300 which belongs to the cache fasync_cache of size 96 The buggy address is located 64 bytes inside of 96-byte region [ffff8801d2bc5300, ffff8801d2bc5360) The buggy address belongs to the page: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accesskasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 10018 Comm: syz-executor1 Not tainted 4.4.113-g202e079 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8800b5318000 task.stack: ffff8800b4798000 RIP: 0010:[] [] __rb_insert lib/rbtree.c:120 [inline] RIP: 0010:[] [] rb_insert_color+0x9f/0xcb0 lib/rbtree.c:420 RSP: 0000:ffff8801db207d18 EFLAGS: 00010003 RAX: 0a0508a8e82a0be9 RBX: ffffffff838a8de0 RCX: ffffffff838a8de0 RDX: 1ffffffff07151bd RSI: ffff8801db219710 RDI: ffff8801db219c40 RBP: ffff8801db207d60 R08: ffffffff8580af08 R09: 0000000000000096 R10: 0000000000000001 R11: dffffc0000000000 R12: ffff8800b09ffdf8 R13: 5028454741505f4e R14: ffff8801db219c40 R15: dffffc0000000000 FS: 000000000106f940(0063) GS:ffff8801db200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000047e560 CR3: 00000000b6a0a000 CR4: 0000000000160670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8801db207d58 0000000000000000 0000000000000000 0000000000000005 ffff8801db219c40 dffffc0000000000 0000000000000000 ffff8801db219710 ffff8800b09ffe00 ffff8801db207db0 ffffffff81d20067 ffff8801db219c58 Call Trace: [] timerqueue_add+0x157/0x2a0 lib/timerqueue.c:57 [] enqueue_hrtimer+0x168/0x450 kernel/time/hrtimer.c:890 [] __run_hrtimer kernel/time/hrtimer.c:1268 [inline] [] __hrtimer_run_queues+0x732/0xfe0 kernel/time/hrtimer.c:1317 [] hrtimer_interrupt+0x1a6/0x440 kernel/time/hrtimer.c:1351 [] local_apic_timer_interrupt+0x6a/0xb0 arch/x86/kernel/apic/apic.c:901 [] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:925 [] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:737 [] vprintk_emit+0x55e/0x850 kernel/printk/printk.c:1832 [] vprintk+0x28/0x30 kernel/printk/printk.c:1843 [] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844 [] printk+0xb7/0xe2 kernel/printk/printk.c:1922 [] kasan_die_handler+0x3d/0x40 arch/x86/mm/kasan_init_64.c:59 [] notifier_call_chain+0x95/0x1b0 kernel/notifier.c:93 [] __atomic_notifier_call_chain kernel/notifier.c:183 [inline] [] atomic_notifier_call_chain+0x7b/0x140 kernel/notifier.c:193 [] notify_die+0xdf/0x160 kernel/notifier.c:549 [] do_general_protection+0x2f7/0x390 arch/x86/kernel/traps.c:461 [] general_protection+0x28/0x30 arch/x86/entry/entry_64.S:1032 [] filemap_map_pages+0x4b5/0x9d0 mm/filemap.c:2080 [] do_fault_around mm/memory.c:2939 [inline] [] do_read_fault mm/memory.c:2958 [inline] [] do_fault mm/memory.c:3129 [inline] [] handle_pte_fault mm/memory.c:3298 [inline] [] __handle_mm_fault mm/memory.c:3426 [inline] [] handle_mm_fault+0x24b7/0x3190 mm/memory.c:3455 [] __do_page_fault+0x35b/0xa00 arch/x86/mm/fault.c:1245 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1308 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1033 Code: 48 89 c2 48 c1 ea 03 42 80 3c 3a 00 0f 85 94 09 00 00 4c 8b 6b 08 4d 39 e5 0f 84 b0 01 00 00 4d 85 ed 74 1d 4c 89 e8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 95 09 00 00 41 f6 45 00 01 0f 84 20 03 00 RIP [] __rb_insert lib/rbtree.c:120 [inline] RIP [] rb_insert_color+0x9f/0xcb0 lib/rbtree.c:420 RSP ---[ end trace 6e0ccdfa70f16baa ]---