==================================================================
BUG: KASAN: wild-memory-access on address ffe708746fa53000
Read of size 4060 by task syz-executor3/15333
CPU: 1 PID: 15333 Comm: syz-executor3 Not tainted 4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d902f628 ffffffff81d93659 ffe708746fa53000 0000000000000fdc
 0000000000000000 ffff8801cefae900 ffe708746fa53000 ffff8801d902f6b0
 ffffffff8153d48f 0000000000000000 0000000000000000 ffffffff826651bb
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153d48f>] kasan_report_error mm/kasan/report.c:284 [inline]
 [<ffffffff8153d48f>] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309
 [<ffffffff8153d860>] kasan_report+0x20/0x30 mm/kasan/report.c:296
 [<ffffffff8153c1a7>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff8153c1a7>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff8153c211>] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320
 [<ffffffff826651bb>] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline]
 [<ffffffff826651bb>] sg_read_oxfer drivers/scsi/sg.c:1978 [inline]
 [<ffffffff826651bb>] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520
 [<ffffffff8156bb41>] do_loop_readv_writev.part.17+0x141/0x1e0 fs/read_write.c:714
 [<ffffffff8156f910>] do_loop_readv_writev fs/read_write.c:880 [inline]
 [<ffffffff8156f910>] do_readv_writev+0x520/0x750 fs/read_write.c:874
 [<ffffffff8156fbc4>] vfs_readv+0x84/0xc0 fs/read_write.c:898
 [<ffffffff8160e8ff>] kernel_readv fs/splice.c:363 [inline]
 [<ffffffff8160e8ff>] default_file_splice_read+0x43f/0x7a0 fs/splice.c:435
 [<ffffffff8160d9fa>] do_splice_to+0x10a/0x160 fs/splice.c:899
 [<ffffffff8161377f>] do_splice fs/splice.c:1192 [inline]
 [<ffffffff8161377f>] SYSC_splice fs/splice.c:1416 [inline]
 [<ffffffff8161377f>] SyS_splice+0xf5f/0x1520 fs/splice.c:1399
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
==================================================================
binder: 15417:15432 ioctl 540d 0 returned -22
binder: 15417:15432 ioctl c06864a2 20bdcf9c returned -22
binder: 15417:15451 ioctl 540d 0 returned -22
binder: 15417:15432 ioctl c06864a2 20bdcf9c returned -22
device syz4 left promiscuous mode
FAULT_FLAG_ALLOW_RETRY missing 30
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 15489 Comm: syz-executor5 Tainted: G    B           4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d6a17850 ffffffff81d93659 ffff8801d6a17b30 0000000000000000
 ffff8801a8862d10 ffff8801d6a17a20 ffff8801a8862c00 ffff8801d6a17a48
 ffffffff816611c8 ffff8801d6a179a0 ffff8801c65f1a40 00000001cc413067
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816611c8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814d0171>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0171>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0171>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0171>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e0437>] __do_page_fault+0x5b7/0xd70 arch/x86/mm/fault.c:1397
 [<ffffffff810e0c17>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1461
 [<ffffffff838b0098>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff815aadac>] do_fcntl fs/fcntl.c:284 [inline]
 [<ffffffff815aadac>] SYSC_fcntl fs/fcntl.c:372 [inline]
 [<ffffffff815aadac>] SyS_fcntl+0x81c/0xc70 fs/fcntl.c:357
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
binder: 15538:15540 ioctl 20008919 20000000 returned -22
binder: 15538:15540 ioctl 4b45 20306000 returned -22
binder: 15538:15540 ioctl 20008919 20000000 returned -22
binder: 15538:15543 ioctl 4b45 20306000 returned -22
CPU: 1 PID: 15511 Comm: syz-executor5 Tainted: G    B           4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d6a07710 ffffffff81d93659 ffff8801d6a079f0 0000000000000000
 ffff8801a8862d10 ffff8801d6a078e0 ffff8801a8862c00 ffff8801d6a07908
 ffffffff816611c8 ffff8801d6a07860 ffff8801db221668 00000001cc413067
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816611c8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814d0171>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0171>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0171>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0171>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e0437>] __do_page_fault+0x5b7/0xd70 arch/x86/mm/fault.c:1397
 [<ffffffff810e0c17>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1461
 [<ffffffff838b0098>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
FAULT_FLAG_ALLOW_RETRY missing 30
 [<ffffffff815b2628>] SYSC_select fs/select.c:652 [inline]
 [<ffffffff815b2628>] SyS_select+0x158/0x1e0 fs/select.c:634
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
CPU: 0 PID: 15500 Comm: syz-executor5 Tainted: G    B           4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d929f940 ffffffff81d93659 ffff8801d929fc20 0000000000000000
 ffff8801a8862d10 ffff8801d929fb10 ffff8801a8862c00 ffff8801d929fb38
 ffffffff816611c8 ffffffff00000002 ffff8801000000f8 2200000000000000
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816611c8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814d0171>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0171>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0171>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0171>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e0437>] __do_page_fault+0x5b7/0xd70 arch/x86/mm/fault.c:1397
 [<ffffffff810e0c17>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1461
 [<ffffffff838b0098>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo entered promiscuous mode
netlink: 11 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 11 bytes leftover after parsing attributes in process `syz-executor5'.
device syz5 left promiscuous mode
binder: 15814:15815 ioctl 40084504 20386ff8 returned -22
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
binder: 15814:15835 ioctl 40084504 20386ff8 returned -22
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
IPVS: Creating netns size=2536 id=38
selinux_nlmsg_perm: 140 callbacks suppressed
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=257 sclass=netlink_audit_socket pig=15900 comm=syz-executor4
IPVS: Creating netns size=2536 id=39
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=257 sclass=netlink_audit_socket pig=15900 comm=syz-executor4
device gre0 entered promiscuous mode
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
keychord: unsupported version 48
device lo entered promiscuous mode
device lo left promiscuous mode
keychord: keycode 46132 out of range
keychord: unsupported version 48
keychord: keycode 46132 out of range
binder: 16202:16252 ioctl 2403 7fff returned -22
binder: 16202:16285 ioctl 2403 7fff returned -22
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
device gre0 entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device  entered promiscuous mode
device  left promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
netlink: 11 bytes leftover after parsing attributes in process `syz-executor1'.
device gre0 entered promiscuous mode
netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'.
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'.
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
IPVS: Creating netns size=2536 id=40
IPVS: Creating netns size=2536 id=41
binder: 16557:16568 ioctl c0206434 20b7bfe0 returned -22
device gre0 entered promiscuous mode
binder: 16557:16559 ioctl c0206434 20b7bfe0 returned -22
FAULT_FLAG_ALLOW_RETRY missing 30
FAULT_FLAG_ALLOW_RETRY missing 20
CPU: 1 PID: 16627 Comm: syz-executor7 Tainted: G    B           4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c916f2a8 ffffffff81d93659 ffff8801c916f588 0000000000000000
 ffff8801a8863490 ffff8801c916f478 ffff8801a8863380 ffff8801c916f4a0
 ffffffff816611c8 ffff8801c916f3f8 0000000000000000 00000001cc67d067
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816611c8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814d0171>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0171>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0171>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0171>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff814bf364>] faultin_page mm/gup.c:386 [inline]
 [<ffffffff814bf364>] __get_user_pages+0x3b4/0x1110 mm/gup.c:585
 [<ffffffff814c0663>] __get_user_pages_locked mm/gup.c:797 [inline]
 [<ffffffff814c0663>] __get_user_pages_unlocked mm/gup.c:872 [inline]
 [<ffffffff814c0663>] get_user_pages_unlocked+0x1d3/0x370 mm/gup.c:900
 [<ffffffff810ef9de>] get_user_pages_fast+0x11e/0x320 arch/x86/mm/gup.c:440
 [<ffffffff812decb1>] get_futex_key+0x1f1/0x1000 kernel/futex.c:545
 [<ffffffff812e1265>] futex_requeue+0x215/0x15c0 kernel/futex.c:1743
 [<ffffffff812e3ecf>] do_futex+0x47f/0x1640 kernel/futex.c:3242
 [<ffffffff812e52b6>] SYSC_futex kernel/futex.c:3280 [inline]
 [<ffffffff812e52b6>] SyS_futex+0x226/0x2d0 kernel/futex.c:3248
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 16614 Comm: syz-executor7 Tainted: G    B           4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d5467860 ffffffff81d93659 ffff8801d5467b40 0000000000000000
 ffff8801a8863490 ffff8801d5467a30 ffff8801a8863380 ffff8801d5467a58
 ffffffff816611c8 ffff8801d54679b0 ffff8801a8a03000 00000001cc67d067
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816611c8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814d0171>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0171>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0171>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0171>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e0437>] __do_page_fault+0x5b7/0xd70 arch/x86/mm/fault.c:1397
 [<ffffffff810e0c17>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1461
 [<ffffffff838b0098>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff8116a57d>] SyS_rt_sigtimedwait+0x2d/0x40 kernel/signal.c:2819
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
device syz2 entered promiscuous mode
CPU: 0 PID: 16644 Comm: syz-executor7 Tainted: G    B           4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ca667960 ffffffff81d93659 ffff8801ca667c40 0000000000000000
 ffff8801a8863490 ffff8801ca667b30 ffff8801a8863380 ffff8801ca667b58
 ffffffff816611c8 ffff8801ca667ab0 0000000000000292 00000001cc67d067
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816611c8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814d0171>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0171>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0171>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0171>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e0437>] __do_page_fault+0x5b7/0xd70 arch/x86/mm/fault.c:1397
 [<ffffffff810e0c17>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1461
 [<ffffffff838b0098>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
binder: 16704:16708 ioctl 4b6d 0 returned -22
binder: 16704:16728 ioctl 4b6d 0 returned -22
FAULT_FLAG_ALLOW_RETRY missing 30
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 16714 Comm: syz-executor3 Tainted: G    B           4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cce0f9c0 ffffffff81d93659 ffff8801cce0fca0 0000000000000000
 ffff8801a8862710 ffff8801cce0fb90 ffff8801a8862600 ffff8801cce0fbb8
 ffffffff816611c8 ffff8801cce0fb10 ffff8801d9844140 00000001aa6ff067
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816611c8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814d0171>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0171>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0171>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0171>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e0437>] __do_page_fault+0x5b7/0xd70 arch/x86/mm/fault.c:1397
 [<ffffffff810e0c17>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1461
 [<ffffffff838b0098>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff81bbdaab>] SYSC_keyctl security/keys/keyctl.c:1605 [inline]
 [<ffffffff81bbdaab>] SyS_keyctl+0x1fb/0x230 security/keys/keyctl.c:1593
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
device lo entered promiscuous mode
netlink: 1 bytes leftover after parsing attributes in process `syz-executor1'.
IPv6: Can't replace route, no match found
CPU: 0 PID: 16720 Comm: syz-executor3 Tainted: G    B           4.9.54-ge5eba30 #61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d25af700 ffffffff81d93659 ffff8801d25af9e0 0000000000000000
 ffff8801a8862710 ffff8801d25af8d0 ffff8801a8862600 ffff8801d25af8f8
 ffffffff816611c8 ffff8801d25af850 ffff8801d25af760 00000001aa6ff067
Call Trace:
 [<ffffffff81d93659>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93659>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816611c8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814d0171>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0171>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0171>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0171>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e0437>] __do_page_fault+0x5b7/0xd70 arch/x86/mm/fault.c:1397
 [<ffffffff810e0c17>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1461
 [<ffffffff838b0098>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff81dd1848>] import_iovec+0xc8/0x3c0 lib/iov_iter.c:1243
 [<ffffffff81bbc620>] keyctl_instantiate_key_iov+0xd0/0x150 security/keys/keyctl.c:1165
 [<ffffffff81bbd929>] SYSC_keyctl security/keys/keyctl.c:1684 [inline]
 [<ffffffff81bbd929>] SyS_keyctl+0x79/0x230 security/keys/keyctl.c:1593
 [<ffffffff838aeec5>] entry_SYSCALL_64_fastpath+0x23/0xc6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16793 comm=syz-executor5
netlink: 1 bytes leftover after parsing attributes in process `syz-executor1'.
IPv6: Can't replace route, no match found
netlink: 1 bytes leftover after parsing attributes in process `syz-executor4'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor4'.
device gre0 entered promiscuous mode
netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'.
netlink: 5 bytes leftover after parsing attributes in process `syz-executor6'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor5'.
IPVS: Creating netns size=2536 id=42
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
IPVS: Creating netns size=2536 id=43
keychord: invalid keycode count 0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=17400 comm=syz-executor2