BUG: KASAN: wild-memory-access on address ffe70869b6c84000 Read of size 58 by task syz-executor5/7240 CPU: 0 PID: 7240 Comm: syz-executor5 Not tainted 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c97efae8 ffffffff81d93149 ffe70869b6c84000 000000000000003a 0000000000000000 ffff8801abd53f00 ffe70869b6c84000 ffff8801c97efb70 ffffffff8153d08f 0000000000000000 0000000000000001 ffffffff826648db Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_report_error mm/kasan/report.c:284 [inline] [] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309 [] kasan_report+0x20/0x30 mm/kasan/report.c:296 [] check_memory_region_inline mm/kasan/kasan.c:308 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315 [] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320 [] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline] [] sg_read_oxfer drivers/scsi/sg.c:1978 [inline] [] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520 [] __vfs_read+0x103/0x670 fs/read_write.c:452 [] vfs_read+0x107/0x330 fs/read_write.c:475 [] SYSC_read fs/read_write.c:591 [inline] [] SyS_read+0xd9/0x1b0 fs/read_write.c:584 [] entry_SYSCALL_64_fastpath+0x23/0xc6 ================================================================== binder: 7264:7266 ioctl 8915 20ff1fe0 returned -22 sg_write: data in/out 93/34 bytes for SCSI command 0xfc-- guessing data in; program syz-executor5 not setting count and/or reply_len properly device syz4 entered promiscuous mode binder: 7264:7281 ioctl 8915 20ff1fe0 returned -22 netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'. FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 1 PID: 7377 Comm: syz-executor0 Tainted: G B 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=59136 sclass=netlink_route_socket pig=7379 comm=syz-executor5 ffff8801c6997960 ffffffff81d93149 ffff8801c6997c40 0000000000000000[ 65.128016] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=59136 sclass=netlink_route_socket pig=7395 comm=syz-executor5 ffff8801ad6a3d90[ 65.140804] device gre0 entered promiscuous mode devpts: called with bogus options ffff8801c6997b30[ 65.152548] devpts: called with bogus options ffff8801ad6a3c80 ffff8801c6997b58 ffffffff81660dc8 ffff8801c6997ab0 0000000000000292 00000001d273b067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 capability: warning: `syz-executor7' uses deprecated v2 capabilities in a way that may be insecure binder: 7409:7411 ioctl 80045200 20e75ffc returned -22 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] key_get_type_from_user.constprop.10+0x24/0xe0 security/keys/keyctl.c:37 [] SYSC_request_key security/keys/keyctl.c:171 [inline] [] SyS_request_key+0x89/0x2d0 security/keys/keyctl.c:158 [] entry_SYSCALL_64_fastpath+0x23/0xc6 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pig=7446 comm=syz-executor4 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pig=7463 comm=syz-executor4 IPVS: Creating netns size=2536 id=18 device syz2 entered promiscuous mode IPVS: Creating netns size=2536 id=19 binder: 7602:7660 ioctl 400454ca 2034afd8 returned -22 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7825 comm=syz-executor0 device gre0 entered promiscuous mode FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 1 PID: 8005 Comm: syz-executor0 Tainted: G B 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801ac01f960 ffffffff81d93149 ffff8801ac01fc40 0000000000000000 ffff8801ad6a2710 ffff8801ac01fb30 ffff8801ad6a2600 ffff8801ac01fb58 ffffffff81660dc8 ffff8801ac01fab0 0000000000000000 00000001a876c067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] key_get_type_from_user.constprop.10+0x24/0xe0 security/keys/keyctl.c:37 [] SYSC_request_key security/keys/keyctl.c:171 [inline] [] SyS_request_key+0x89/0x2d0 security/keys/keyctl.c:158 [] entry_SYSCALL_64_fastpath+0x23/0xc6 binder: 8187:8192 ioctl 2403 7fff returned -22 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8199 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8217 comm=syz-executor0 sg_write: data in/out 65500/34 bytes for SCSI command 0xfc-- guessing data in; program syz-executor7 not setting count and/or reply_len properly binder: 8373:8374 ioctl 540f 2089affd returned -22 binder: 8373:8393 ioctl 540f 2089affd returned -22 FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 1 PID: 8394 Comm: syz-executor7 Tainted: G B 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d9b077b0 ffffffff81d93149 ffff8801d9b07a90 0000000000000000 ffff8801a6d4d610 ffff8801d9b07980 ffff8801a6d4d500 ffff8801d9b079a8 ffffffff81660dc8 ffff8801d9b07900 ffffffff811b99c1 00000001c674d067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] do_fcntl fs/fcntl.c:274 [inline] [] SYSC_fcntl fs/fcntl.c:372 [inline] [] SyS_fcntl+0x8fd/0xc70 fs/fcntl.c:357 [] entry_SYSCALL_64_fastpath+0x23/0xc6 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 1 PID: 8370 Comm: syz-executor7 Tainted: G B 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801ca2a7720 ffffffff81d93149 ffff8801ca2a7a00 0000000000000000 ffff8801a6d4d610 ffff8801ca2a78f0 ffff8801a6d4d500 ffff8801ca2a7918 ffffffff81660dc8 ffff8801ca2a7870 ffff8801c99f4880 00000001c674d067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] sock_do_ioctl+0x94/0xb0 net/socket.c:899 [] sock_ioctl+0x2e0/0x3d0 net/socket.c:978 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x1aa/0x10c0 fs/ioctl.c:679 [] SYSC_ioctl fs/ioctl.c:694 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 [] entry_SYSCALL_64_fastpath+0x23/0xc6 device syz3 entered promiscuous mode device syz3 left promiscuous mode device syz3 entered promiscuous mode device syz3 left promiscuous mode CPU: 0 PID: 8405 Comm: syz-executor7 Tainted: G B 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c87df9b0 ffffffff81d93149 ffff8801c87dfc90 0000000000000000 ffff8801a6d4d610 ffff8801c87dfb80 ffff8801a6d4d500 ffff8801c87dfba8 ffffffff81660dc8 ffff8801c87dfb00 ffff8801c87dfbe0 00000001c674d067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] entry_SYSCALL_64_fastpath+0x23/0xc6 nla_parse: 18 callbacks suppressed netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 10 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 10 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor3'. IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE IPv6: NLM_F_CREATE should be set when creating new route IPv6: NLM_F_CREATE should be set when creating new route netlink: 2 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor3'. IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE IPVS: Creating netns size=2536 id=20 binder: 8628:8643 ioctl 4c07 0 returned -22 binder: 8628:8672 ioctl 4c07 0 returned -22 sock: process `syz-executor6' is using obsolete getsockopt SO_BSDCOMPAT syz-executor4 (8688) used greatest stack depth: 24992 bytes left device lo entered promiscuous mode IPVS: Creating netns size=2536 id=21 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14917 sclass=netlink_route_socket pig=8884 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14917 sclass=netlink_route_socket pig=8893 comm=syz-executor0 FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 8886 Comm: syz-executor7 Tainted: G B 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cb71f720 ffffffff81d93149 ffff8801cb71fa00 0000000000000000 ffff8801cd72a110 ffff8801cb71f8f0 ffff8801cd72a000 ffff8801cb71f918 ffffffff81660dc8 ffff8801cb71f870 ffff8801c8184880 00000001ce572067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] sock_do_ioctl+0x94/0xb0 net/socket.c:899 [] sock_ioctl+0x2e0/0x3d0 net/socket.c:978 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x1aa/0x10c0 fs/ioctl.c:679 [] SYSC_ioctl fs/ioctl.c:694 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 [] entry_SYSCALL_64_fastpath+0x23/0xc6 CPU: 1 PID: 8898 Comm: syz-executor7 Tainted: G B 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cec776a0 ffffffff81d93149 ffff8801cec77980 0000000000000000 ffff8801cd72a110 ffff8801cec77870 ffff8801cd72a000 ffff8801cec77898 ffffffff81660dc8 ffff8801cec777f0 0000000000000000 00000001ce572067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] inet6_ioctl+0x133/0x1e0 net/ipv6/af_inet6.c:533 [] sock_do_ioctl+0x65/0xb0 net/socket.c:892 [] sock_ioctl+0x2e0/0x3d0 net/socket.c:978 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x1aa/0x10c0 fs/ioctl.c:679 [] SYSC_ioctl fs/ioctl.c:694 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 [] entry_SYSCALL_64_fastpath+0x23/0xc6 pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads device gre0 entered promiscuous mode device syz1 entered promiscuous mode device syz5 entered promiscuous mode device syz5 left promiscuous mode device syz5 entered promiscuous mode device gre0 entered promiscuous mode device syz2 left promiscuous mode binder: 9178:9179 ioctl 5404 207dcfec returned -22 binder: 9178:9231 ioctl 5404 207dcfec returned -22 program syz-executor2 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 program syz-executor2 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 device lo entered promiscuous mode device  entered promiscuous mode device  left promiscuous mode 9pnet_virtio: no channels available for device ./file0 sg_write: data in/out 65500/34 bytes for SCSI command 0xfc-- guessing data in; program syz-executor3 not setting count and/or reply_len properly device gre0 entered promiscuous mode devpts: called with bogus options 9pnet_virtio: no channels available for device ./file0 devpts: called with bogus options binder: 9423:9429 ioctl 4b45 20306000 returned -22 binder: 9423:9429 ioctl 4b45 20306000 returned -22 keychord: using input dev AT Translated Set 2 keyboard for fevent keychord: invalid keycode count 0 keychord: using input dev AT Translated Set 2 keyboard for fevent keychord: invalid keycode count 0 tmpfs: No value for mount option 'I' tmpfs: No value for mount option 'I' nla_parse: 14 callbacks suppressed netlink: 4 bytes leftover after parsing attributes in process `syz-executor7'. FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 1 PID: 9571 Comm: syz-executor3 Tainted: G B 4.9.52-g9b2b081 #55 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c609f8c0 ffffffff81d93149 ffff8801c609fba0 0000000000000000 ffff8801a6d4d610 ffff8801c609fa90 ffff8801a6d4d500 ffff8801c609fab8 ffffffff81660dc8 ffff8801c609fa10 0000000000000000 00000001cfdc9067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012