IPv6: NLM_F_REPLACE set, but no existing node found! ================================================================== BUG: KASAN: use-after-free in bio_copy_user_iov+0xe61/0xea0 block/bio.c:1205 at addr ffff8801d2119a00 Read of size 8 by task syz-executor2/28038 CPU: 0 PID: 28038 Comm: syz-executor2 Not tainted 4.9.44-gbf7ef8f #34 IPv6: NLM_F_REPLACE set, but no existing node found! Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c6f774c0 ffffffff81d929c9 ffff8801da0013c0 ffff8801d2119a00 ffff8801d2119b00 ffffed003a423340 ffff8801d2119a00 ffff8801c6f774e8 ffffffff8153c5ec ffffed003a423340 ffff8801da0013c0 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160 binder: 28073:28075 ioctl 5417 20b12ffc returned -22 binder: 28073:28076 ioctl 5417 20b12ffc returned -22 [] print_address_description mm/kasan/report.c:198 [inline] [] kasan_report_error mm/kasan/report.c:287 [inline] [] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309 [] kasan_report mm/kasan/report.c:330 [inline] [] __asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:330 [] bio_copy_user_iov+0xe61/0xea0 block/bio.c:1205 [] __blk_rq_map_user_iov block/blk-map.c:56 [inline] [] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133 [] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163 [] sg_start_req drivers/scsi/sg.c:1766 [inline] [] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775 [] sg_write+0x688/0xad0 drivers/scsi/sg.c:678 [] __vfs_write+0x103/0x680 fs/read_write.c:510 [] vfs_write+0x170/0x4e0 fs/read_write.c:560 [] SYSC_write fs/read_write.c:607 [inline] [] SyS_write+0xd9/0x1b0 fs/read_write.c:599 [] entry_SYSCALL_64_fastpath+0x23/0xc6 Object at ffff8801d2119a00, in cache kmalloc-256 size: 256 Allocated: PID = 28038 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:495 set_track mm/kasan/kasan.c:507 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598 __kmalloc+0x11d/0x310 mm/slub.c:3741 kmalloc include/linux/slab.h:495 [inline] kzalloc include/linux/slab.h:636 [inline] sg_build_sgat drivers/scsi/sg.c:1816 [inline] sg_build_indirect.isra.23+0x8b/0x550 drivers/scsi/sg.c:1842 sg_build_reserve+0x8d/0xb0 drivers/scsi/sg.c:1973 sg_add_sfp drivers/scsi/sg.c:2160 [inline] sg_open+0x946/0x15a0 drivers/scsi/sg.c:329 chrdev_open+0x22b/0x4c0 fs/char_dev.c:392 do_dentry_open+0x607/0xc60 fs/open.c:766 vfs_open+0x105/0x220 fs/open.c:879 do_last fs/namei.c:3402 [inline] path_openat+0x64c/0x2a60 fs/namei.c:3525 do_filp_open+0x197/0x290 fs/namei.c:3560 do_sys_open+0x352/0x4c0 fs/open.c:1072 SYSC_open fs/open.c:1090 [inline] SyS_open+0x2d/0x40 fs/open.c:1085 entry_SYSCALL_64_fastpath+0x23/0xc6 Freed: PID = 28045 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:495 set_track mm/kasan/kasan.c:507 [inline] kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kfree+0xf0/0x2f0 mm/slub.c:3878 sg_remove_scat.isra.20+0x212/0x2d0 drivers/scsi/sg.c:1924 sg_ioctl+0x12d0/0x29f0 drivers/scsi/sg.c:973 vfs_ioctl fs/ioctl.c:43 [inline] do_vfs_ioctl+0x1aa/0x10c0 fs/ioctl.c:679 SYSC_ioctl fs/ioctl.c:694 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 entry_SYSCALL_64_fastpath+0x23/0xc6 Memory state around the buggy address: ffff8801d2119900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801d2119980: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8801d2119a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801d2119a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801d2119b00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ================================================================== ================================================================== BUG: KASAN: wild-memory-access on address ffe7087634088000 Write of size 38 by task syz-executor2/28038 CPU: 0 PID: 28038 Comm: syz-executor2 Tainted: G B 4.9.44-gbf7ef8f #34 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c6f77448 ffffffff81d929c9 ffff8801c6f77618 0000000000000026 0000000000000001 ffff8801c6f77840 ffe7087634088000 ffff8801c6f774d0 ffffffff8153ca9f 0000000000000000 0000000000000001 ffffffff81ddc284 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_report_error mm/kasan/report.c:284 [inline] [] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309 [] kasan_report+0x20/0x30 mm/kasan/report.c:296 [] check_memory_region_inline mm/kasan/kasan.c:308 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315 [] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326 [] __copy_from_user arch/x86/include/asm/uaccess_64.h:114 [inline] [] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline] [] copy_page_from_iter+0x1a4/0x5d0 lib/iov_iter.c:618 [] bio_copy_from_iter block/bio.c:1031 [inline] [] bio_copy_user_iov+0xb05/0xea0 block/bio.c:1232 [] __blk_rq_map_user_iov block/blk-map.c:56 [inline] [] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133 [] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163 [] sg_start_req drivers/scsi/sg.c:1766 [inline] [] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775 [] sg_write+0x688/0xad0 drivers/scsi/sg.c:678 [] __vfs_write+0x103/0x680 fs/read_write.c:510 [] vfs_write+0x170/0x4e0 fs/read_write.c:560 [] SYSC_write fs/read_write.c:607 [inline] [] SyS_write+0xd9/0x1b0 fs/read_write.c:599 [] entry_SYSCALL_64_fastpath+0x23/0xc6 ================================================================== ================================================================== BUG: KASAN: wild-memory-access on address ffe7087634088000 Write of size 38 by task syz-executor2/28038 CPU: 0 PID: 28038 Comm: syz-executor2 Tainted: G B 4.9.44-gbf7ef8f #34 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c6f773f8 ffffffff81d929c9 ffe7087634088000 0000000000000026 0000000000000001 0000000020006fdb ffe7087634088000 ffff8801c6f77480 ffffffff8153ca9f ffffc900028f4000 0000000000010000 ffffffff81dc60d4 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] kasan_report_error mm/kasan/report.c:284 [inline] [] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309 [] kasan_report+0x20/0x30 mm/kasan/report.c:296 [] check_memory_region_inline mm/kasan/kasan.c:308 [inline] [] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315 [] memset+0x23/0x40 mm/kasan/kasan.c:333 [] copy_user_handle_tail+0xb4/0xd0 arch/x86/lib/usercopy_64.c:86 [] copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] [] __copy_from_user_nocheck arch/x86/include/asm/uaccess_64.h:59 [inline] [] __copy_from_user arch/x86/include/asm/uaccess_64.h:115 [inline] [] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline] [] copy_page_from_iter+0x1c0/0x5d0 lib/iov_iter.c:618 [] bio_copy_from_iter block/bio.c:1031 [inline] [] bio_copy_user_iov+0xb05/0xea0 block/bio.c:1232 [] __blk_rq_map_user_iov block/blk-map.c:56 [inline] [] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133 [] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163 [] sg_start_req drivers/scsi/sg.c:1766 [inline] [] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775 [] sg_write+0x688/0xad0 drivers/scsi/sg.c:678 [] __vfs_write+0x103/0x680 fs/read_write.c:510 [] vfs_write+0x170/0x4e0 fs/read_write.c:560 [] SYSC_write fs/read_write.c:607 [inline] [] SyS_write+0xd9/0x1b0 fs/read_write.c:599 [] entry_SYSCALL_64_fastpath+0x23/0xc6 ================================================================== kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 28038 Comm: syz-executor2 Tainted: G B 4.9.44-gbf7ef8f #34 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801c5c9b000 task.stack: ffff8801c6f70000 RIP: 0010:[] [] memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:64 RSP: 0018:ffff8801c6f774b8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffe7087634088000 RCX: 0000000000000026 RDX: 0000000000000026 RSI: 0000000000000000 RDI: ffe7087634088000 RBP: ffff8801c6f774d8 R08: 0000000000000001 R09: ffe7087634088000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000026 R13: 0000000000000000 R14: 0000000020006fdb R15: 0000000020006f00 FS: 00007fbc15daa700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4a5002aa20 CR3: 00000001d1ccd000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff8153bc31 ffff8801c5c9b000 0000000000000026 ffe7087634088000 ffff8801c6f77510 ffffffff81dc60d4 ffff8801c6f77618 0000000000000026 0000000000000026 ffff8801c6f77840 ffe7087634088000 ffff8801c6f77580 Call Trace: [] copy_user_handle_tail+0xb4/0xd0 arch/x86/lib/usercopy_64.c:86 [] copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] [] __copy_from_user_nocheck arch/x86/include/asm/uaccess_64.h:59 [inline] [] __copy_from_user arch/x86/include/asm/uaccess_64.h:115 [inline] [] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline] [] copy_page_from_iter+0x1c0/0x5d0 lib/iov_iter.c:618 [] bio_copy_from_iter block/bio.c:1031 [inline] [] bio_copy_user_iov+0xb05/0xea0 block/bio.c:1232 [] __blk_rq_map_user_iov block/blk-map.c:56 [inline] [] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133 [] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163 [] sg_start_req drivers/scsi/sg.c:1766 [inline] [] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775 [] sg_write+0x688/0xad0 drivers/scsi/sg.c:678 [] __vfs_write+0x103/0x680 fs/read_write.c:510 [] vfs_write+0x170/0x4e0 fs/read_write.c:560 [] SYSC_write fs/read_write.c:607 [inline] [] SyS_write+0xd9/0x1b0 fs/read_write.c:599 [] entry_SYSCALL_64_fastpath+0x23/0xc6 Code: 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 RIP [] memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:64 RSP ---[ end trace ba13412507a0f5ec ]---