program syz-executor3 not setting count and/or reply_len properly
==================================================================
BUG: KASAN: use-after-free in bio_copy_user_iov+0xcdf/0xe50 block/bio.c:1205 at addr ffff8801d9317c80
Read of size 8 by task syz-executor4/7270
CPU: 0 PID: 7270 Comm: syz-executor4 Not tainted 4.9.39-g72a0c9f #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d5fcf4f0 ffffffff81eacd59 ffff8801dac013c0 ffff8801d9317c80
 ffff8801d9317d80 ffffed003b262f90 ffff8801d9317c80 ffff8801d5fcf518
 ffffffff81546bfc ffffed003b262f90 ffff8801dac013c0 0000000000000000
Call Trace:
 [<ffffffff81eacd59>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eacd59>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81546bfc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff81546ead>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff81546ead>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81546ead>] kasan_report.part.1+0x20d/0x4e0 mm/kasan/report.c:309
 [<ffffffff81547239>] kasan_report mm/kasan/report.c:330 [inline]
 [<ffffffff81547239>] __asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:330
 [<ffffffff81e051cf>] bio_copy_user_iov+0xcdf/0xe50 block/bio.c:1205
 [<ffffffff81e3665f>] __blk_rq_map_user_iov block/blk-map.c:56 [inline]
 [<ffffffff81e3665f>] blk_rq_map_user_iov+0x22f/0x770 block/blk-map.c:133
 [<ffffffff81e36ca9>] blk_rq_map_user+0x109/0x180 block/blk-map.c:163
 [<ffffffff8278f982>] sg_start_req drivers/scsi/sg.c:1766 [inline]
 [<ffffffff8278f982>] sg_common_write.isra.21+0xc12/0x17a0 drivers/scsi/sg.c:775
 [<ffffffff82793d1b>] sg_write+0x68b/0xb10 drivers/scsi/sg.c:678
 [<ffffffff81572d6b>] __vfs_write+0xfb/0x660 fs/read_write.c:510
 [<ffffffff81576df0>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<ffffffff8157a724>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff8157a724>] SyS_write+0xd4/0x1a0 fs/read_write.c:599
 [<ffffffff83965985>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff8801d9317c80, in cache kmalloc-256 size: 256
Allocated:
PID = 7280
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 __kmalloc+0x128/0x320 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 sg_build_sgat drivers/scsi/sg.c:1816 [inline]
 sg_build_indirect.isra.20+0x8b/0x550 drivers/scsi/sg.c:1842
 sg_build_reserve+0x8d/0xb0 drivers/scsi/sg.c:1973
 sg_add_sfp drivers/scsi/sg.c:2160 [inline]
 sg_open+0x92b/0x1590 drivers/scsi/sg.c:329
 chrdev_open+0x227/0x4a0 fs/char_dev.c:392
 do_dentry_open+0x607/0xc60 fs/open.c:766
 vfs_open+0x105/0x220 fs/open.c:879
 do_last fs/namei.c:3402 [inline]
 path_openat+0x644/0x2a40 fs/namei.c:3525
 do_filp_open+0x18b/0x270 fs/namei.c:3560
 do_sys_open+0x336/0x4b0 fs/open.c:1072
 SYSC_open fs/open.c:1090 [inline]
 SyS_open+0x2d/0x40 fs/open.c:1085
 entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 7280
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xf0/0x2f0 mm/slub.c:3878
 sg_remove_scat.isra.17+0x212/0x2d0 drivers/scsi/sg.c:1924
 sg_ioctl+0x12b5/0x29d0 drivers/scsi/sg.c:973
 vfs_ioctl fs/ioctl.c:43 [inline]
 do_vfs_ioctl+0x194/0x1070 fs/ioctl.c:679
 SYSC_ioctl fs/ioctl.c:694 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801d9317b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d9317c00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8801d9317c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8801d9317d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d9317d80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================
==================================================================
BUG: KASAN: wild-memory-access on address ffe708754477d000
Write of size 38 by task syz-executor4/7270
CPU: 1 PID: 7270 Comm: syz-executor4 Tainted: G    B           4.9.39-g72a0c9f #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d5fcf470 ffffffff81eacd59 ffff8801d5fcf630 0000000000000026
 0000000000000001 ffe708754477d000 ffe708754477d000 ffff8801d5fcf4f0
 ffffffff815470a0 0000000000000001 ffff8801d5fcf500 ffffffff81ef5faa
Call Trace:
 [<ffffffff81eacd59>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eacd59>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff815470a0>] kasan_report_error mm/kasan/report.c:284 [inline]
 [<ffffffff815470a0>] kasan_report.part.1+0x400/0x4e0 mm/kasan/report.c:309
 [<ffffffff81547440>] kasan_report+0x20/0x30 mm/kasan/report.c:296
 [<ffffffff81545dc7>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff81545dc7>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff81545e54>] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326
 [<ffffffff81ef5faa>] __copy_from_user arch/x86/include/asm/uaccess_64.h:114 [inline]
 [<ffffffff81ef5faa>] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline]
 [<ffffffff81ef5faa>] copy_page_from_iter+0x1aa/0x5c0 lib/iov_iter.c:618
 [<ffffffff81e04fbc>] bio_copy_from_iter block/bio.c:1031 [inline]
 [<ffffffff81e04fbc>] bio_copy_user_iov+0xacc/0xe50 block/bio.c:1232
 [<ffffffff81e3665f>] __blk_rq_map_user_iov block/blk-map.c:56 [inline]
 [<ffffffff81e3665f>] blk_rq_map_user_iov+0x22f/0x770 block/blk-map.c:133
 [<ffffffff81e36ca9>] blk_rq_map_user+0x109/0x180 block/blk-map.c:163
 [<ffffffff8278f982>] sg_start_req drivers/scsi/sg.c:1766 [inline]
 [<ffffffff8278f982>] sg_common_write.isra.21+0xc12/0x17a0 drivers/scsi/sg.c:775
 [<ffffffff82793d1b>] sg_write+0x68b/0xb10 drivers/scsi/sg.c:678
 [<ffffffff81572d6b>] __vfs_write+0xfb/0x660 fs/read_write.c:510
 [<ffffffff81576df0>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<ffffffff8157a724>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff8157a724>] SyS_write+0xd4/0x1a0 fs/read_write.c:599
 [<ffffffff83965985>] entry_SYSCALL_64_fastpath+0x23/0xc6
==================================================================
==================================================================
BUG: KASAN: wild-memory-access on address ffe708754477d000
Write of size 38 by task syz-executor4/7270
CPU: 1 PID: 7270 Comm: syz-executor4 Tainted: G    B           4.9.39-g72a0c9f #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d5fcf420 ffffffff81eacd59 ffe708754477d000 0000000000000026
 0000000000000001 0000000020006fdb ffe708754477d000 ffff8801d5fcf4a0
 ffffffff815470a0 0000000000000000 ffff8801d5fcf458 ffffffff81edff24
Call Trace:
 [<ffffffff81eacd59>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eacd59>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff815470a0>] kasan_report_error mm/kasan/report.c:284 [inline]
 [<ffffffff815470a0>] kasan_report.part.1+0x400/0x4e0 mm/kasan/report.c:309
 [<ffffffff81547440>] kasan_report+0x20/0x30 mm/kasan/report.c:296
 [<ffffffff81545dc7>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff81545dc7>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff81546233>] memset+0x23/0x40 mm/kasan/kasan.c:333
 [<ffffffff81edff24>] copy_user_handle_tail+0xb4/0xd0 arch/x86/lib/usercopy_64.c:86
 [<ffffffff81ef5fb9>] copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 [<ffffffff81ef5fb9>] __copy_from_user_nocheck arch/x86/include/asm/uaccess_64.h:59 [inline]
 [<ffffffff81ef5fb9>] __copy_from_user arch/x86/include/asm/uaccess_64.h:115 [inline]
 [<ffffffff81ef5fb9>] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline]
 [<ffffffff81ef5fb9>] copy_page_from_iter+0x1b9/0x5c0 lib/iov_iter.c:618
 [<ffffffff81e04fbc>] bio_copy_from_iter block/bio.c:1031 [inline]
 [<ffffffff81e04fbc>] bio_copy_user_iov+0xacc/0xe50 block/bio.c:1232