================================================================== BUG: KASAN: wild-memory-access on address ffe708746f171000 Read of size 176 by task syz-executor6/13226 CPU: 1 PID: 13226 Comm: syz-executor6 Not tainted 4.9.52-g96a28fc #57 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cf34f9e8 ffffffff81d93149 ffe708746f171000 00000000000000b0 0000000000000000 ffff8801a610c180 ffe708746f171000 ffff8801cf34fa70 ffffffff8153d08f 0000000000000000 0000000000000001 ffffffff826648db Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_report_error mm/kasan/report.c:284 [inline] [] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309 [] kasan_report+0x20/0x30 mm/kasan/report.c:296 [] check_memory_region_inline mm/kasan/kasan.c:308 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315 [] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320 [] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline] [] sg_read_oxfer drivers/scsi/sg.c:1978 [inline] [] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520 [] do_loop_readv_writev.part.17+0x141/0x1e0 fs/read_write.c:714 [] do_loop_readv_writev fs/read_write.c:880 [inline] [] do_readv_writev+0x520/0x750 fs/read_write.c:874 [] vfs_readv+0x84/0xc0 fs/read_write.c:898 [] do_readv+0xe6/0x250 fs/read_write.c:924 [] SYSC_readv fs/read_write.c:1011 [inline] [] SyS_readv+0x27/0x30 fs/read_write.c:1008 [] entry_SYSCALL_64_fastpath+0x23/0xc6 ================================================================== IPVS: Creating netns size=2536 id=35 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=32 sclass=netlink_tcpdiag_socket pig=13299 comm=syz-executor1 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=32 sclass=netlink_tcpdiag_socket pig=13299 comm=syz-executor1 pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads netlink: 3 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor6'. 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 IPVS: Creating netns size=2536 id=36 Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable IPVS: Creating netns size=2536 id=37 Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable device syz1 left promiscuous mode tmpfs: No value for mount option 'I' device syz6 entered promiscuous mode device syz6 left promiscuous mode tmpfs: No value for mount option 'I' device syz6 entered promiscuous mode device syz6 left promiscuous mode binder: 13742:13744 ioctl 4c00 6 returned -22 binder: 13742:13744 ioctl 4c00 18 returned -22 device syz5 left promiscuous mode 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 device syz7 entered promiscuous mode device syz7 left promiscuous mode device syz7 entered promiscuous mode IPVS: Creating netns size=2536 id=38 IPVS: Creating netns size=2536 id=39 binder: 14146:14148 ioctl 5609 20219ffa returned -22 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14158 comm=syz-executor3 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14158 comm=syz-executor3 sd 0:0:1:0: [sg0] tag#431 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK sd 0:0:1:0: [sg0] tag#431 CDB: opcode=0xff (vendor) sd 0:0:1:0: [sg0] tag#431 CDB[00]: ff ff ff ff 00 00 00 00 00 00 00 00 54 52 d5 59 binder: 14146:14164 ioctl 5609 20219ffa returned -22 sd 0:0:1:0: [sg0] tag#431 CDB[10]: 00 00 00 00 b3 64 09 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#431 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#431 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#431 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK sd 0:0:1:0: [sg0] tag#431 CDB: opcode=0xff (vendor) sd 0:0:1:0: [sg0] tag#431 CDB[00]: ff ff ff ff 00 00 00 00 00 00 00 00 54 52 d5 59 sd 0:0:1:0: [sg0] tag#431 CDB[10]: 00 00 00 00 2e 82 0a 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#431 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sd 0:0:1:0: [sg0] tag#431 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 handle_userfault: 1 callbacks suppressed FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 14298 Comm: syz-executor0 Tainted: G B 4.9.52-g96a28fc #57 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d5c7f780 ffffffff81d93149 ffff8801d5c7fa60 0000000000000000 ffff8801d94e3610 ffff8801d5c7f950 ffff8801d94e3500 ffff8801d5c7f978 ffffffff81660dc8 ffff8801d5c7f8d0 0000000000000000 00000001c3ea3067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] SYSC_select fs/select.c:652 [inline] [] SyS_select+0x158/0x1e0 fs/select.c:634 [] entry_SYSCALL_64_fastpath+0x23/0xc6 nla_parse: 26 callbacks suppressed netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'. device syz0 left promiscuous mode device syz0 entered promiscuous mode device syz7 left promiscuous mode device syz4 left promiscuous mode device syz0 left promiscuous mode device syz0 entered promiscuous mode device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26783 sclass=netlink_route_socket pig=14650 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26783 sclass=netlink_route_socket pig=14650 comm=syz-executor7 netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. device syz5 entered promiscuous mode netlink: 4 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor6'. device gre0 entered promiscuous mode device gre0 left promiscuous mode netlink: 3 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor7'. device gre0 entered promiscuous mode device gre0 left promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor1'. IPVS: length: 24 != 49176 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 IPVS: length: 24 != 49176 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15038 comm=syz-executor3 binder_alloc: binder_alloc_mmap_handler: 15039 204f0000-204f4000 already mapped failed -16 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15038 comm=syz-executor3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15079 comm=syz-executor6 binder_alloc: binder_alloc_mmap_handler: 15039 204f0000-204f4000 already mapped failed -16 tc_dump_action: action bad kind tc_dump_action: action bad kind device gre0 entered promiscuous mode binder: binder_mmap: 15269 2007d000-2007e000 bad vm_flags failed -1 binder: binder_mmap: 15269 2007d000-2007e000 bad vm_flags failed -1 IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready binder: 15498:15500 ioctl 40485404 20185000 returned -22 binder: 15498:15500 ioctl 40485404 20185000 returned -22 device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode binder: 15860:15868 ioctl 40084504 20386ff8 returned -22 binder: 15860:15884 ioctl 40084504 20386ff8 returned -22 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=15878 comm=syz-executor5 ================================================================== BUG: KASAN: wild-memory-access on address ffe708746f171000 Read of size 37 by task syz-executor0/15933 CPU: 0 PID: 15933 Comm: syz-executor0 Tainted: G B 4.9.52-g96a28fc #57 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d93e7ae8 ffffffff81d93149 ffe708746f171000 0000000000000025 0000000000000000 ffff8801a62fbf00 ffe708746f171000 ffff8801d93e7b70 ffffffff8153d08f 0000000000000000 0000000000000001 ffffffff826648db Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_report_error mm/kasan/report.c:284 [inline] [] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309 [] kasan_report+0x20/0x30 mm/kasan/report.c:296 [] check_memory_region_inline mm/kasan/kasan.c:308 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315 [] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320 [] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline] [] sg_read_oxfer drivers/scsi/sg.c:1978 [inline] [] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520 [] __vfs_read+0x103/0x670 fs/read_write.c:452 [] vfs_read+0x107/0x330 fs/read_write.c:475 [] SYSC_read fs/read_write.c:591 [inline] [] SyS_read+0xd9/0x1b0 fs/read_write.c:584 [] entry_SYSCALL_64_fastpath+0x23/0xc6 ================================================================== IPVS: Creating netns size=2536 id=40 FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 1 PID: 16047 Comm: syz-executor2 Tainted: G B 4.9.52-g96a28fc #57 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d9387960 ffffffff81d93149 ffff8801d9387c40 0000000000000000 ffff8801d94e3910 ffff8801d9387b30 ffff8801d94e3800 ffff8801d9387b58 ffffffff81660dc8 ffff8801d9387ab0 0000000000000292 00000001a8201067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] SyS_rt_sigqueueinfo+0x24/0x30 kernel/signal.c:2967 [] entry_SYSCALL_64_fastpath+0x23/0xc6 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 1 PID: 16009 Comm: syz-executor2 Tainted: G B 4.9.52-g96a28fc #57 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c73af9a0 ffffffff81d93149 ffff8801c73afc80 0000000000000000 ffff8801d94e3910 ffff8801c73afb70 ffff8801d94e3800 ffff8801c73afb98 ffffffff81660dc8 ffff8801c73afaf0 ffff8801c73afbb8 00000001a8201067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] entry_SYSCALL_64_fastpath+0x23/0xc6 binder: 16048:16049 ioctl 5420 20185ffc returned -22 binder: 16048:16076 ioctl 5420 20185ffc returned -22 IPVS: Creating netns size=2536 id=41 CPU: 1 PID: 16059 Comm: syz-executor2 Tainted: G B 4.9.52-g96a28fc #57 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d6937780 ffffffff81d93149 ffff8801d6937a60 0000000000000000 ffff8801d94e3910 ffff8801d6937950 ffff8801d94e3800 ffff8801d6937978 ffffffff81660dc8 ffff8801d69378d0 0000000000000000 00000001a8201067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] SYSC_select fs/select.c:652 [inline] [] SyS_select+0x158/0x1e0 fs/select.c:634 [] entry_SYSCALL_64_fastpath+0x23/0xc6 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6 sclass=netlink_route_socket pig=16150 comm=syz-executor3 nla_parse: 12 callbacks suppressed netlink: 5 bytes leftover after parsing attributes in process `syz-executor2'. binder: 16141:16142 ioctl 6430 0 returned -22 9pnet_virtio: no channels available for device ./file0 netlink: 5 bytes leftover after parsing attributes in process `syz-executor2'. binder: 16141:16142 ioctl 6430 0 returned -22 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6 sclass=netlink_route_socket pig=16150 comm=syz-executor3 9pnet_virtio: no channels available for device ./file0 device lo entered promiscuous mode device syz3 entered promiscuous mode