binder: 11559:11563 ioctl 4b6a 20df7fb3 returned -22 ================================================================== BUG: KASAN: wild-memory-access on address ffe7087450c83000 Read of size 37 by task syz-executor2/11573 CPU: 0 PID: 11573 Comm: syz-executor2 Not tainted 4.9.53-g379e3b2 #59 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801a5a2fae8 ffffffff81d93789 ffe7087450c83000 0000000000000025 0000000000000000 ffff8801a5061840[ 248.461283] syz-executor5 (11596) used greatest stack depth: 24992 bytes left ffe7087450c83000 ffff8801a5a2fb70 ffffffff8153d48f 0000000000000000 0000000000000001 ffffffff826650bb Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_report_error mm/kasan/report.c:284 [inline] [] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309 [] kasan_report+0x20/0x30 mm/kasan/report.c:296 [] check_memory_region_inline mm/kasan/kasan.c:308 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315 [] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320 [] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline] [] sg_read_oxfer drivers/scsi/sg.c:1978 [inline] [] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520 [] __vfs_read+0x103/0x670 fs/read_write.c:452 [] vfs_read+0x107/0x330 fs/read_write.c:475 [] SYSC_read fs/read_write.c:591 [inline] [] SyS_read+0xd9/0x1b0 fs/read_write.c:584 [] entry_SYSCALL_64_fastpath+0x23/0xc6 ================================================================== SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14917 sclass=netlink_route_socket pig=11712 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14917 sclass=netlink_route_socket pig=11729 comm=syz-executor7 device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14917 sclass=netlink_route_socket pig=11748 comm=syz-executor7 syz-executor3 (11783) used greatest stack depth: 24752 bytes left syz-executor1: vmalloc: allocation failure: 16587630936 bytes, mode:0x24000c2(GFP_KERNEL|__GFP_HIGHMEM) CPU: 0 PID: 11823 Comm: syz-executor1 Tainted: G B 4.9.53-g379e3b2 #59 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c6017880 ffffffff81d93789 1ffff10038c02f13 ffff8801a93fb000 ffffffff83ab7ac0 0000000000000001 0000000000400000 ffff8801c6017990 ffffffff81451172 024000c2d44ed188 0000000041b58ab3 ffffffff8418fdb5 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] warn_alloc+0x212/0x240 mm/page_alloc.c:3054 [] __vmalloc_node_range+0x3f5/0x5f0 mm/vmalloc.c:1722 [] __vmalloc_node mm/vmalloc.c:1744 [inline] [] __vmalloc_node_flags mm/vmalloc.c:1758 [inline] [] vmalloc+0x5b/0x70 mm/vmalloc.c:1773 [] xt_alloc_entry_offsets+0x41/0x60 net/netfilter/x_tables.c:722 [] translate_table+0x21a/0x1e30 net/ipv4/netfilter/ip_tables.c:700 [] ? 0xffffffff810002b8 [] do_replace net/ipv4/netfilter/ip_tables.c:1151 [inline] [] do_ipt_set_ctl+0x2be/0x470 net/ipv4/netfilter/ip_tables.c:1687 [] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline] [] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114 [] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1243 [] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2705 [] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705 [] SYSC_setsockopt net/socket.c:1771 [inline] [] SyS_setsockopt+0x160/0x250 net/socket.c:1750 [] entry_SYSCALL_64_fastpath+0x23/0xc6 Mem-Info: active_anon:71262 inactive_anon:43 isolated_anon:0 active_file:3717 inactive_file:5883 isolated_file:0 unevictable:0 dirty:118 writeback:0 unstable:0 slab_reclaimable:6373 slab_unreclaimable:56021 mapped:22132 shmem:470 pagetables:649 bounce:0 free:1465128 free_pcp:299 free_cma:0 syz-executor1: vmalloc: allocation failure: 16587630936 bytes, mode:0x24000c2(GFP_KERNEL|__GFP_HIGHMEM) CPU: 1 PID: 11891 Comm: syz-executor1 Tainted: G B 4.9.53-g379e3b2 #59 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c949f880 ffffffff81d93789 1ffff10039293f13 ffff8801c9493000 ffffffff83ab7ac0 0000000000000001 0000000000400000 ffff8801c949f990 ffffffff81451172 024000c2944884b6 0000000041b58ab3 ffffffff8418fdb5 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] warn_alloc+0x212/0x240 mm/page_alloc.c:3054 [] __vmalloc_node_range+0x3f5/0x5f0 mm/vmalloc.c:1722 [] __vmalloc_node mm/vmalloc.c:1744 [inline] [] __vmalloc_node_flags mm/vmalloc.c:1758 [inline] [] vmalloc+0x5b/0x70 mm/vmalloc.c:1773 [] xt_alloc_entry_offsets+0x41/0x60 net/netfilter/x_tables.c:722 [] translate_table+0x21a/0x1e30 net/ipv4/netfilter/ip_tables.c:700 [] ? 0xffffffff810002b8 [] do_replace net/ipv4/netfilter/ip_tables.c:1151 [inline] [] do_ipt_set_ctl+0x2be/0x470 net/ipv4/netfilter/ip_tables.c:1687 [] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline] [] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114 [] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1243 [] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2705 [] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705 [] SYSC_setsockopt net/socket.c:1771 [inline] [] SyS_setsockopt+0x160/0x250 net/socket.c:1750 [] entry_SYSCALL_64_fastpath+0x23/0xc6 Mem-Info: active_anon:73275 inactive_anon:43 isolated_anon:0 active_file:3717 inactive_file:5883 isolated_file:0 unevictable:0 dirty:118 writeback:0 unstable:0 slab_reclaimable:6373 slab_unreclaimable:56078 mapped:22132 shmem:470 pagetables:649 bounce:0 free:1463074 free_pcp:318 free_cma:0 Node 0 active_anon:293100kB inactive_anon:172kB active_file:14868kB inactive_file:23532kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:88528kB dirty:472kB writeback:0kB shmem:1880kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 36864kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no DMA free:15908kB min:160kB low:200kB high:240kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB DMA32 free:2981152kB min:30600kB low:38248kB high:45896kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2981848kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:696kB local_pcp:648kB free_cma:0kB Normal free:2855236kB min:36816kB low:46020kB high:55224kB active_anon:293100kB inactive_anon:172kB active_file:14868kB inactive_file:23532kB unevictable:0kB writepending:472kB present:4718592kB managed:3585220kB mlocked:0kB slab_reclaimable:25492kB slab_unreclaimable:224312kB kernel_stack:5888kB pagetables:2596kB bounce:0kB free_pcp:576kB local_pcp:252kB free_cma:0kB DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 10094 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 320235 pages reserved Node 0 active_anon:290316kB inactive_anon:180kB active_file:14896kB inactive_file:23540kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:88428kB dirty:624kB writeback:0kB shmem:1888kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 40960kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no DMA free:15908kB min:160kB low:200kB high:240kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2910 6411 6411 DMA32 free:2981152kB min:30600kB low:38248kB high:45896kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2981848kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:696kB local_pcp:48kB free_cma:0kB lowmem_reserve[]: 0 0 3501 3501 Normal free:2853696kB min:36816kB low:46020kB high:55224kB active_anon:290316kB inactive_anon:180kB active_file:14896kB inactive_file:23540kB unevictable:0kB writepending:632kB present:4718592kB managed:3585220kB mlocked:0kB slab_reclaimable:25776kB slab_unreclaimable:228860kB kernel_stack:5568kB pagetables:2532kB bounce:0kB free_pcp:888kB local_pcp:320kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB DMA32: 4*4kB (M) 2*8kB (M) 4*16kB (M) 2*32kB (M) 4*64kB (M) 3*128kB (M) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 2*2048kB (M) 726*4096kB (M) = 2981152kB Normal: 49*4kB (UME) 493*8kB (UM) 1313*16kB (UME) 774*32kB (UM) 513*64kB (ME) 229*128kB (UME) 99*256kB (UM) 19*512kB (UME) 5*1024kB (UM) 5*2048kB (UME) 657*4096kB (M) = 2853564kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 10082 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965979 pages RAM 0 pages HighMem/MovableOnly 320235 pages reserved binder: 12007:12008 ioctl 4b3b 1 returned -22 binder: 12007:12031 ioctl 4b3b 1 returned -22 nla_parse: 16 callbacks suppressed netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'. binder: 12303:12306 ioctl c0bc5351 20821000 returned -22 sd 0:0:1:0: [sg0] tag#416 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK sd 0:0:1:0: [sg0] tag#416 CDB: Test Unit Ready sd 0:0:1:0: [sg0] tag#416 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#416 CDB[10]: 00 00 00 00 10 27 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#416 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#416 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 binder: 12303:12368 ioctl c0bc5351 20821000 returned -22 sd 0:0:1:0: [sg0] tag#979 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK sd 0:0:1:0: [sg0] tag#979 CDB: Test Unit Ready sd 0:0:1:0: [sg0] tag#979 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#979 CDB[10]: 00 00 00 00 10 27 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#979 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#979 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 device gre0 entered promiscuous mode binder: 12398:12410 ioctl 54a2 0 returned -22 binder: 12415:12416 ioctl c0206416 20ff9000 returned -22 binder: 12415:12420 ioctl c0206416 20ff9000 returned -22 keychord: keycode 29282 out of range keychord: invalid keycode count 0 IPVS: Creating netns size=2536 id=28 pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads device lo entered promiscuous mode qtaguid: iface_stat: create(lo): no inet dev qtaguid: iface_stat: create6(lo): no inet dev IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready qtaguid: iface_stat: create6(lo): no inet dev netlink: 1 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor4'.