================================================================== BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x269/0xa30 lib/iov_iter.c:1144 Read of size 8 at addr ffffc900009bef38 by task syz-executor099/366 CPU: 0 PID: 366 Comm: syz-executor099 Not tainted 5.10.75-syzkaller-01082-g234d53d2bb60 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_description+0x8d/0x3d0 mm/kasan/report.c:233 __kasan_report+0x142/0x220 mm/kasan/report.c:419 kasan_report+0x51/0x70 mm/kasan/report.c:436 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 iov_iter_revert+0x269/0xa30 lib/iov_iter.c:1144 io_write+0xaf1/0xf80 fs/io_uring.c:3615 io_issue_sqe+0x1397/0xfc10 fs/io_uring.c:6030 __io_queue_sqe+0x2cf/0x2fa0 fs/io_uring.c:6352 io_queue_sqe+0x295/0x1180 fs/io_uring.c:6418 io_submit_sqe+0x385/0xfd0 fs/io_uring.c:6487 io_submit_sqes+0x1050/0x2da0 fs/io_uring.c:6715 __do_sys_io_uring_enter fs/io_uring.c:9110 [inline] __se_sys_io_uring_enter+0x322/0x12b0 fs/io_uring.c:9052 __x64_sys_io_uring_enter+0xe5/0x100 fs/io_uring.c:9052 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f83c3687a59 Code: 28 c3 e8 1a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff6e3c998 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f83c3687a59 RDX: 0000000000000000 RSI: 0000000000007cdc RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffff6e3c9c0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 addr ffffc900009bef38 is located in stack of task syz-executor099/366 at offset 24 in frame: io_write+0x0/0xf80 include/trace/events/io_uring.h:360 this frame has 3 objects: [32, 160) 'inline_vecs' [192, 200) 'iovec' [224, 264) '__iter' Memory state around the buggy address: ffffc900009bee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc900009bee80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900009bef00: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 ^ ffffc900009bef80: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 f2 f2 f2 ffffc900009bf000: 00