print_req_error: I/O error, dev loop0, sector 0 ================================================================== BUG: KASAN: use-after-free in do_blk_trace_setup+0xa5b/0xad0 kernel/trace/blktrace.c:561 Read of size 8 at addr ffff88808ef8a640 by task syz-executor.1/16867 CPU: 1 PID: 16867 Comm: syz-executor.1 Not tainted 4.14.178-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393 do_blk_trace_setup+0xa5b/0xad0 kernel/trace/blktrace.c:561 blk_trace_setup+0xa3/0x120 kernel/trace/blktrace.c:579 sg_ioctl+0x2f9/0x2620 drivers/scsi/sg.c:1129 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45c829 RSP: 002b:00007ff3d6b70c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004e15c0 RCX: 000000000045c829 RDX: 0000000020000140 RSI: 00000000c0481273 RDI: 0000000000000006 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000022a R14: 00000000004c4506 R15: 00007ff3d6b716d4 Allocated by task 16867: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529 kmem_cache_alloc_trace+0x14d/0x7b0 mm/slab.c:3618 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] do_blk_trace_setup+0x11e/0xad0 kernel/trace/blktrace.c:495 blk_trace_setup+0xa3/0x120 kernel/trace/blktrace.c:579 sg_ioctl+0x2f9/0x2620 drivers/scsi/sg.c:1129 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 16873: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xcb/0x260 mm/slab.c:3815 blk_trace_cleanup kernel/trace/blktrace.c:351 [inline] blk_trace_remove+0x52/0x80 kernel/trace/blktrace.c:364 sg_ioctl+0x22a/0x2620 drivers/scsi/sg.c:1138 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff88808ef8a600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 64 bytes inside of 128-byte region [ffff88808ef8a600, ffff88808ef8a680) The buggy address belongs to the page: page:ffffea00023be280 count:1 mapcount:0 mapping:ffff88808ef8a000 index:0x0 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffff88808ef8a000 0000000000000000 0000000100000015 raw: ffffea0002a0bb20 ffffea00025206a0 ffff88812fe54640 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808ef8a500: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 ffff88808ef8a580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc >ffff88808ef8a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88808ef8a680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff88808ef8a700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ================================================================== IPVS: set_ctl: invalid protocol: 137 127.0.0.1:20004 IPVS: set_ctl: invalid protocol: 137 127.0.0.1:20004 binder: 16897:16902 ioctl c0306201 20000300 returned -14