================================================================== BUG: KASAN: use-after-free in do_blk_trace_setup+0xa5b/0xad0 kernel/trace/blktrace.c:561 Read of size 8 at addr ffff88809fcf8100 by task syz-executor.3/24639 CPU: 1 PID: 24639 Comm: syz-executor.3 Not tainted 4.14.180-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393 do_blk_trace_setup+0xa5b/0xad0 kernel/trace/blktrace.c:561 blk_trace_setup+0xa3/0x120 kernel/trace/blktrace.c:579 sg_ioctl+0x2f9/0x2620 drivers/scsi/sg.c:1129 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45c829 RSP: 002b:00007f64ebadac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004e1660 RCX: 000000000045c829 RDX: 0000000020000140 RSI: 00000000c0481273 RDI: 0000000000000005 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000022a R14: 00000000004c4506 R15: 00007f64ebadb6d4 Allocated by task 24639: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529 kmem_cache_alloc_trace+0x14d/0x7b0 mm/slab.c:3618 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] do_blk_trace_setup+0x11e/0xad0 kernel/trace/blktrace.c:495 blk_trace_setup+0xa3/0x120 kernel/trace/blktrace.c:579 sg_ioctl+0x2f9/0x2620 drivers/scsi/sg.c:1129 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 24644: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xcb/0x260 mm/slab.c:3815 blk_trace_cleanup kernel/trace/blktrace.c:351 [inline] blk_trace_remove+0x52/0x80 kernel/trace/blktrace.c:364 sg_ioctl+0x22a/0x2620 drivers/scsi/sg.c:1138 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff88809fcf80c0 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 64 bytes inside of 128-byte region [ffff88809fcf80c0, ffff88809fcf8140) The buggy address belongs to the page: page:ffffea00027f3e00 count:1 mapcount:0 mapping:ffff88809fcf8000 index:0x0 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffff88809fcf8000 0000000000000000 0000000100000015 raw: ffffea00021f5c20 ffffea00021e7e60 ffff88812fe54640 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809fcf8000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809fcf8080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >ffff88809fcf8100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88809fcf8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88809fcf8200: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 ================================================================== FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 24662 Comm: syz-executor.4 Tainted: G B 4.14.180-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x14b lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] __do_kmalloc mm/slab.c:3718 [inline] __kmalloc+0x2e9/0x7c0 mm/slab.c:3729 kmalloc_array include/linux/slab.h:607 [inline] kcalloc include/linux/slab.h:618 [inline] iter_file_splice_write+0x143/0xa10 fs/splice.c:692 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x115/0x160 fs/splice.c:1018 splice_direct_to_actor+0x27e/0x730 fs/splice.c:973 do_splice_direct+0x164/0x210 fs/splice.c:1061 do_sendfile+0x469/0xaf0 fs/read_write.c:1441 SYSC_sendfile64 fs/read_write.c:1496 [inline] SyS_sendfile64+0x9b/0x110 fs/read_write.c:1488 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45c829 RSP: 002b:00007f887034ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00000000004fc2e0 RCX: 000000000045c829 RDX: 0000000020000200 RSI: 0000000000000006 RDI: 0000000000000006 RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000ff8 R11: 0000000000000246 R12: 0000000000000007 R13: 00000000000008dc R14: 00000000004cb816 R15: 00007f887034b6d4