================================================================== BUG: KASAN: wild-memory-access on address ffe708717f284000 Read of size 4060 by task syz-executor1/17938 CPU: 0 PID: 17938 Comm: syz-executor1 Not tainted 4.9.52-g291d968 #56 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cd147ae8 ffffffff81d93149 ffe708717f284000 0000000000000fdc 0000000000000000 ffff8801c6dbdd80 ffe708717f284000 ffff8801cd147b70 ffffffff8153d08f 0000000000000000 0000000000000001 ffffffff826648db Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_report_error mm/kasan/report.c:284 [inline] [] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309 [] kasan_report+0x20/0x30 mm/kasan/report.c:296 [] check_memory_region_inline mm/kasan/kasan.c:308 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315 [] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320 [] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline] [] sg_read_oxfer drivers/scsi/sg.c:1978 [inline] [] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520 [] __vfs_read+0x103/0x670 fs/read_write.c:452 [] vfs_read+0x107/0x330 fs/read_write.c:475 [] SYSC_read fs/read_write.c:591 [inline] [] SyS_read+0xd9/0x1b0 fs/read_write.c:584 [] entry_SYSCALL_64_fastpath+0x23/0xc6 ================================================================== device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pig=18050 comm=syz-executor1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pig=18077 comm=syz-executor1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pig=18050 comm=syz-executor1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pig=18050 comm=syz-executor1 netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. SELinux: unrecognized netlink message: protocol=9 nlmsg_type=21199 sclass=netlink_audit_socket pig=18204 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=41 sclass=netlink_audit_socket pig=18204 comm=syz-executor5 device lo entered promiscuous mode SELinux: unrecognized netlink message: protocol=9 nlmsg_type=21199 sclass=netlink_audit_socket pig=18234 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=41 sclass=netlink_audit_socket pig=18234 comm=syz-executor5 sock: sock_set_timeout: `syz-executor3' (pid 18357) tries to set negative timeout sock: sock_set_timeout: `syz-executor3' (pid 18357) tries to set negative timeout device gre0 entered promiscuous mode device syz3 entered promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE IPv6: NLM_F_CREATE should be set when creating new route IPv6: NLM_F_CREATE should be set when creating new route device lo entered promiscuous mode device lo left promiscuous mode device syz6 entered promiscuous mode IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE IPv6: NLM_F_CREATE should be set when creating new route IPv6: NLM_F_CREATE should be set when creating new route device syz6 left promiscuous mode device syz6 entered promiscuous mode SELinux: unrecognized netlink message: protocol=6 nlmsg_type=24235 sclass=netlink_xfrm_socket pig=18593 comm=syz-executor4 device lo entered promiscuous mode SELinux: unrecognized netlink message: protocol=6 nlmsg_type=24235 sclass=netlink_xfrm_socket pig=18593 comm=syz-executor4 qtaguid: iface_stat: create(lo): no inet dev qtaguid: iface_stat: create6(lo): no inet dev IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready qtaguid: iface_stat: create6(lo): no inet dev qtaguid: iface_stat: create(lo): no inet dev qtaguid: iface_stat: create6(lo): no inet dev IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready qtaguid: iface_stat: create6(lo): no inet dev device lo left promiscuous mode device gre0 entered promiscuous mode IPVS: length: 24 != 8 IPVS: length: 24 != 8 keychord: using input dev AT Translated Set 2 keyboard for fevent qtaguid: iface_stat: create6(lo): no inet dev syz-executor5: vmalloc: allocation failure: 16587630936 bytes, mode:0x24000c2(GFP_KERNEL|__GFP_HIGHMEM) CPU: 1 PID: 18833 Comm: syz-executor5 Tainted: G B 4.9.52-g291d968 #56 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801aa01f880 ffffffff81d93149 1ffff10035403f13 ffff8801d93fe000 ffffffff83ab7ac0 0000000000000001 0000000000400000 ffff8801aa01f990 ffffffff81450d72 024000c274e35790 0000000041b58ab3 ffffffff8418fa45 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] warn_alloc+0x212/0x240 mm/page_alloc.c:3054 [] __vmalloc_node_range+0x3f5/0x5f0 mm/vmalloc.c:1722 [] __vmalloc_node mm/vmalloc.c:1744 [inline] [] __vmalloc_node_flags mm/vmalloc.c:1758 [inline] [] vmalloc+0x5b/0x70 mm/vmalloc.c:1773 [] xt_alloc_entry_offsets+0x41/0x60 net/netfilter/x_tables.c:722 [] translate_table+0x21a/0x1e30 net/ipv4/netfilter/ip_tables.c:700 [] ? 0xffffffff810002b8 [] do_replace net/ipv4/netfilter/ip_tables.c:1151 [inline] [] do_ipt_set_ctl+0x2be/0x470 net/ipv4/netfilter/ip_tables.c:1687 [] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline] [] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114 [] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1243 [] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2705 [] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705 [] SYSC_setsockopt net/socket.c:1771 [inline] [] SyS_setsockopt+0x160/0x250 net/socket.c:1750 [] entry_SYSCALL_64_fastpath+0x23/0xc6 Mem-Info: active_anon:93841 inactive_anon:1693 isolated_anon:0 active_file:3831 inactive_file:6055 isolated_file:0 unevictable:0 dirty:88 writeback:0 unstable:0 slab_reclaimable:6086 slab_unreclaimable:37584 mapped:23882 shmem:1856 pagetables:819 bounce:0 free:1459160 free_pcp:235 free_cma:0 Node 0 active_anon:375364kB inactive_anon:6772kB active_file:15324kB inactive_file:24220kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:95528kB dirty:352kB writeback:0kB shmem:7424kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 86016kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no DMA free:15908kB min:160kB low:200kB high:240kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB DMA32 free:2981152kB min:30600kB low:38248kB high:45896kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2981848kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:696kB local_pcp:648kB free_cma:0kB Normal free:2839580kB min:36816kB low:46020kB high:55224kB active_anon:375364kB inactive_anon:6772kB active_file:15324kB inactive_file:24220kB unevictable:0kB writepending:352kB present:4718592kB managed:3585220kB mlocked:0kB slab_reclaimable:24344kB slab_unreclaimable:150336kB kernel_stack:6400kB pagetables:3276kB bounce:0kB free_pcp:208kB local_pcp:116kB free_cma:0kB DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 11766 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 320235 pages reserved qtaguid: iface_stat: create6(lo): no inet dev IPVS: Creating netns size=2536 id=37 nla_parse: 22 callbacks suppressed netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'. binder: 18943:18957 ioctl 540b 1c0000000000 returned -22 binder: 18943:18945 ioctl c0206434 20804fe0 returned -22 binder: 18943:19059 ioctl 540b 1c0000000000 returned -22 binder: 18943:19008 ioctl c0206434 20804fe0 returned -22 pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads IPVS: Creating netns size=2536 id=38 IPVS: Creating netns size=2536 id=39 netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads netlink: 4 bytes leftover after parsing attributes in process `syz-executor6'. syz-executor7 (19385) used greatest stack depth: 24624 bytes left pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads binder: 19423:19433 ioctl 4b6a 20df7fb3 returned -22 program syz-executor6 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 19467 Comm: syz-executor0 Tainted: G B 4.9.52-g291d968 #56 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d5e7f7a0 ffffffff81d93149 ffff8801d5e7fa80 0000000000000000 ffff8801ca057f10 ffff8801d5e7f970 ffff8801ca057e00 ffff8801d5e7f998 ffffffff81660dc8 ffff8801d5e7f8f0 0000000000000046 00000001ccd09067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline] [] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114 [] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1243 [] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2705 [] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705 [] SYSC_setsockopt net/socket.c:1771 [inline] [] SyS_setsockopt+0x160/0x250 net/socket.c:1750 [] entry_SYSCALL_64_fastpath+0x23/0xc6 program syz-executor6 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 selinux_nlmsg_perm: 8 callbacks suppressed SELinux: unrecognized netlink message: protocol=6 nlmsg_type=770 sclass=netlink_xfrm_socket pig=19519 comm=syz-executor2 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=770 sclass=netlink_xfrm_socket pig=19519 comm=syz-executor2 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=770 sclass=netlink_xfrm_socket pig=19519 comm=syz-executor2 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=770 sclass=netlink_xfrm_socket pig=19519 comm=syz-executor2 CPU: 1 PID: 19476 Comm: syz-executor0 Tainted: G B 4.9.52-g291d968 #56 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cf3b7920 ffffffff81d93149 ffff8801cf3b7c00 0000000000000000 ffff8801ca057f10 ffff8801cf3b7af0 ffff8801ca057e00 ffff8801cf3b7b18 ffffffff81660dc8 ffff8801cf3b7a70 dffffc0000000000 00000001ccd09067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] entry_SYSCALL_64_fastpath+0x23/0xc6 PF_BRIDGE: RTM_SETLINK with unknown ifindex PF_BRIDGE: RTM_SETLINK with unknown ifindex sd 0:0:1:0: [sg0] tag#494 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK sd 0:0:1:0: [sg0] tag#494 CDB: Test Unit Ready device lo entered promiscuous mode sd 0:0:1:0: [sg0] tag#494 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#494 CDB[10]: 00 00 00 00 10 27 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#494 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#494 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 device lo left promiscuous mode sd 0:0:1:0: [sg0] tag#494 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK sd 0:0:1:0: [sg0] tag#494 CDB: Test Unit Ready sd 0:0:1:0: [sg0] tag#494 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#494 CDB[10]: 00 00 00 00 10 27 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#494 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#494 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 device syz5 entered promiscuous mode device syz5 left promiscuous mode device syz5 entered promiscuous mode device gre0 entered promiscuous mode 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 IPv6: ADDRCONF(NETDEV_CHANGE): syz0: link becomes ready netlink: 2 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor7'. SELinux: unrecognized netlink message: protocol=6 nlmsg_type=3131 sclass=netlink_xfrm_socket pig=20193 comm=syz-executor2 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=3131 sclass=netlink_xfrm_socket pig=20199 comm=syz-executor2 netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor7'. device gre0 entered promiscuous mode netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'. program syz-executor2 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 program syz-executor2 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 netlink: 6 bytes leftover after parsing attributes in process `syz-executor2'. binder: 20514:20516 ioctl c08c5335 209dcf74 returned -22 binder: 20514:20516 ioctl 80404532 200f2f20 returned -22 binder: 20514:20536 ioctl c08c5335 209dcf74 returned -22 binder: 20514:20516 ioctl 80404532 200f2f20 returned -22 binder: 20650:20652 ioctl 541b 20cf5000 returned -22 binder: 20650:20658 ioctl 541b 20cf5000 returned -22