================================================================== BUG: KASAN: wild-memory-access on address ffe708746c7f1000 Read of size 2012 by task syz-executor0/3449 CPU: 1 PID: 3449 Comm: syz-executor0 Not tainted 4.9.52-gc30c69c #54 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cdc5fae8 ffffffff81d93149 ffe708746c7f1000 00000000000007dc 0000000000000000 ffff8801c88459c0 ffe708746c7f1000 ffff8801cdc5fb70 ffffffff8153d08f 0000000000000000 0000000000000001 ffffffff826648db Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_report_error mm/kasan/report.c:284 [inline] [] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309 [] kasan_report+0x20/0x30 mm/kasan/report.c:296 [] check_memory_region_inline mm/kasan/kasan.c:308 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315 [] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320 [] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline] [] sg_read_oxfer drivers/scsi/sg.c:1978 [inline] [] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520 [] __vfs_read+0x103/0x670 fs/read_write.c:452 [] vfs_read+0x107/0x330 fs/read_write.c:475 [] SYSC_read fs/read_write.c:591 [inline] [] SyS_read+0xd9/0x1b0 fs/read_write.c:584 [] entry_SYSCALL_64_fastpath+0x23/0xc6 ================================================================== SELinux: unrecognized netlink message: protocol=9 nlmsg_type=1025 sclass=netlink_audit_socket pig=3472 comm=syz-executor3 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=1025 sclass=netlink_audit_socket pig=3478 comm=syz-executor3 netlink: 1 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor3'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1025 sclass=netlink_route_socket pig=3559 comm=syz-executor7 TCP: request_sock_TCP: Possible SYN flooding on port 20004. Sending cookies. Check SNMP counters. netlink: 16 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 16 bytes leftover after parsing attributes in process `syz-executor1'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1025 sclass=netlink_route_socket pig=3575 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1025 sclass=netlink_route_socket pig=3578 comm=syz-executor7 netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. SELinux: unrecognized netlink message: protocol=4 nlmsg_type=32 sclass=netlink_tcpdiag_socket pig=3623 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=32 sclass=netlink_tcpdiag_socket pig=3623 comm=syz-executor7 netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. syz-executor6 uses obsolete (PF_INET,SOCK_PACKET) netlink: 2 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor5'. binder: 3722:3723 ioctl 8924 20418000 returned -22 device gre0 entered promiscuous mode binder: 3722:3742 ioctl 8924 20418000 returned -22 devpts: called with bogus options netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. device gre0 entered promiscuous mode random: crng init done device lo entered promiscuous mode FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 4083 Comm: syz-executor0 Tainted: G B 4.9.52-gc30c69c #54 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c615f9b0 ffffffff81d93149 ffff8801c615fc90 0000000000000000 ffff8801c6010290 ffff8801c615fb80 ffff8801c6010180 ffff8801c615fba8 ffffffff81660dc8 ffff8801c615fb00 ffffffff811c9fc7 00000001cd3ef067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] entry_SYSCALL_64_fastpath+0x23/0xc6 program syz-executor4 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 program syz-executor4 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 program syz-executor4 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 program syz-executor4 is using a deprecated SCSI ioctl, please convert it to SG_IO sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 CPU: 0 PID: 4093 Comm: syz-executor0 Tainted: G B 4.9.52-gc30c69c #54 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c8f07780 ffffffff81d93149 ffff8801c8f07a60 0000000000000000 ffff8801c6010290 ffff8801c8f07950 ffff8801c6010180 ffff8801c8f07978 ffffffff81660dc8 ffff8801c8f078d0 0000000000000000 00000001cd3ef067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] SYSC_select fs/select.c:652 [inline] [] SyS_select+0x158/0x1e0 fs/select.c:634 [] entry_SYSCALL_64_fastpath+0x23/0xc6 device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode qtaguid: iface_stat: iface_check_stats_reset_and_adjust(lo): iface reset its stats unexpectedly device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode binder_alloc: binder_alloc_mmap_handler: 4236 204f0000-204f4000 already mapped failed -16 sg_write: data in/out 476/6 bytes for SCSI command 0x0-- guessing data in; program syz-executor2 not setting count and/or reply_len properly binder_alloc: binder_alloc_mmap_handler: 4236 204f0000-204f4000 already mapped failed -16 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=18513 sclass=netlink_route_socket pig=4312 comm=syz-executor6 binder: 4335:4338 ioctl 641e 0 returned -22 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=18513 sclass=netlink_route_socket pig=4343 comm=syz-executor6 binder: 4335:4349 ioctl 641e 0 returned -22 device gre0 entered promiscuous mode binder: 4449:4454 ioctl 541d 0 returned -22 binder: 4449:4454 ioctl 541d 0 returned -22 mmap: syz-executor4 (4612) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt. IPVS: Creating netns size=2536 id=9 nla_parse: 6 callbacks suppressed netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'. device gre0 entered promiscuous mode loop_reread_partitions: partition scan of loop5 (t?`JzP[ p>TK6C="L l!V #F-') failed (rc=-13) netlink: 5 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'. IPv6: NLM_F_CREATE should be specified when creating new route ALSA: seq fatal error: cannot create timer (-22) IPv6: NLM_F_REPLACE set, but no existing node found! device lo entered promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'. IPv6: NLM_F_REPLACE set, but no existing node found! device lo left promiscuous mode ALSA: seq fatal error: cannot create timer (-22) device lo entered promiscuous mode device lo left promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 13 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'. program syz-executor3 is using a deprecated SCSI ioctl, please convert it to SG_IO program syz-executor3 is using a deprecated SCSI ioctl, please convert it to SG_IO device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device gre0 entered promiscuous mode device gre0 left promiscuous mode device gre0 entered promiscuous mode device gre0 left promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=5267 comm=syz-executor5 IPVS: Creating netns size=2536 id=10 IPVS: Creating netns size=2536 id=11 device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=5477 comm=syz-executor2 device syz7 entered promiscuous mode device syz7 left promiscuous mode device syz7 entered promiscuous mode pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 capability: warning: `syz-executor7' uses deprecated v2 capabilities in a way that may be insecure device syz1 entered promiscuous mode pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pig=5807 comm=syz-executor4 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pig=5807 comm=syz-executor4 IPVS: Creating netns size=2536 id=12 IPVS: Creating netns size=2536 id=13 keychord: using input dev AT Translated Set 2 keyboard for fevent device gre0 entered promiscuous mode binder: 5967:6000 ioctl 4b60 205baf8c returned -22 keychord: invalid keycode count 0 binder: 5967:5989 ioctl 4b60 205baf8c returned -22 keychord: using input dev AT Translated Set 2 keyboard for fevent keychord: invalid keycode count 0