================================================================== BUG: KASAN: use-after-free in list_empty include/linux/list.h:189 [inline] BUG: KASAN: use-after-free in sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2120 Read of size 8 at addr ffff8801c82efcc0 by task syz-executor4/20009 CPU: 0 PID: 20009 Comm: syz-executor4 Not tainted 4.4.120-gd63fdf6 #28 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 575e148d9fecdfe5 ffff8801d2fefab0 ffffffff81d0408d ffffea000720bbc0 ffff8801c82efcc0 0000000000000000 ffff8801c82efcc0 ffff8801d3072338 ffff8801d2fefae8 ffffffff814fe143 ffff8801c82efcc0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x73/0x260 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x285/0x370 mm/kasan/report.c:408 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] list_empty include/linux/list.h:189 [inline] [] sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2120 [] sg_finish_rem_req+0x295/0x340 drivers/scsi/sg.c:1837 [] sg_read+0xa1b/0x1490 drivers/scsi/sg.c:537 [] __vfs_read+0x103/0x440 fs/read_write.c:432 [] vfs_read+0x123/0x3a0 fs/read_write.c:454 [] SYSC_read fs/read_write.c:569 [inline] [] SyS_read+0xd9/0x1b0 fs/read_write.c:562 [] entry_SYSCALL_64_fastpath+0x1c/0x98 Allocated by task 18051: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 [] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554 [] slab_post_alloc_hook mm/slub.c:1349 [inline] [] slab_alloc_node mm/slub.c:2615 [inline] [] slab_alloc mm/slub.c:2623 [inline] [] kmem_cache_alloc+0xba/0x290 mm/slub.c:2628 [] fasync_alloc fs/fcntl.c:607 [inline] [] fasync_add_entry fs/fcntl.c:665 [inline] [] fasync_helper+0x37/0xb0 fs/fcntl.c:694 [] __tty_fasync+0xd2/0x290 drivers/tty/tty_io.c:2216 [] tty_fasync+0x6f/0xa0 drivers/tty/tty_io.c:2255 [] setfl fs/fcntl.c:69 [inline] [] do_fcntl fs/fcntl.c:270 [inline] [] SYSC_fcntl fs/fcntl.c:375 [inline] [] SyS_fcntl+0x64f/0xc40 fs/fcntl.c:360 [] entry_SYSCALL_64_fastpath+0x1c/0x98 Freed by task 3: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kmem_cache_free+0xc7/0x320 mm/slub.c:2881 [] fasync_free_rcu+0x1d/0x20 fs/fcntl.c:566 [] __rcu_reclaim kernel/rcu/rcu.h:118 [inline] [] rcu_do_batch kernel/rcu/tree.c:2705 [inline] [] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline] [] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline] [] rcu_process_callbacks+0x7f4/0x14a0 kernel/rcu/tree.c:2957 [] __do_softirq+0x227/0xa38 kernel/softirq.c:273 The buggy address belongs to the object at ffff8801c82efc80 which belongs to the cache fasync_cache of size 96 The buggy address is located 64 bytes inside of 96-byte region [ffff8801c82efc80, ffff8801c82efce0) The buggy address belongs to the page: PANIC: double fault, error_code: 0x0 CPU: 1 PID: 3770 Comm: syz-fuzzer Not tainted 4.4.120-gd63fdf6 #28 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801c5bd8000 task.stack: ffff8801d1c70000 RIP: 0010:[ PTP clock support registered ioremap error for 0xbfffd000-0xc0000000, requested 0x2, got 0x0 dmi: Firmware registration failed. Advanced Linux Sound Architecture Driver Initialized. PCI: Using ACPI for IRQ routing NetLabel: Initializing NetLabel: domain hash size = 128 NetLabel: protocols = UNLABELED CIPSOv4 NetLabel: unlabeled traffic allowed by default amd_nb: Cannot enumerate AMD northbridges clocksource: Switched to clocksource kvm-clock