================================================================== BUG: KASAN: slab-out-of-bounds in list_empty include/linux/list.h:189 [inline] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130 Read of size 8 at addr ffff8801cc8f5140 by task syzkaller036179/3314 CPU: 0 PID: 3314 Comm: syzkaller036179 Not tainted 4.4.112-gca0ebb4 #29 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 d200dab6c841491a ffff8801d088fab0 ffffffff81d056fd ffffea0007323d40 ffff8801cc8f5140 0000000000000000 ffff8801cc8f5140 ffff8801d09f4438 ffff8801d088fae8 ffffffff814fd953 ffff8801cc8f5140 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x73/0x260 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x285/0x370 mm/kasan/report.c:408 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] list_empty include/linux/list.h:189 [inline] [] sg_remove_request+0xf9/0x110 drivers/scsi/sg.c:2130 [] sg_finish_rem_req+0x295/0x340 drivers/scsi/sg.c:1848 [] sg_read+0xa21/0x1490 drivers/scsi/sg.c:538 [] __vfs_read+0x103/0x440 fs/read_write.c:432 [] vfs_read+0x123/0x3a0 fs/read_write.c:454 [] SYSC_read fs/read_write.c:569 [inline] [] SyS_read+0xd9/0x1b0 fs/read_write.c:562 [] entry_SYSCALL_64_fastpath+0x16/0x92 Allocated by task 0: (stack is not available) Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8801cc8f5100 which belongs to the cache fasync_cache of size 96 The buggy address is located 64 bytes inside of 96-byte region [ffff8801cc8f5100, ffff8801cc8f5160) The buggy address belongs to the page: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 3313 Comm: syzkaller036179 Not tainted 4.4.112-gca0ebb4 #29 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8800b4a10000 task.stack: ffff8801d0a50000 RIP: 0010:[] [] __rb_insert lib/rbtree.c:120 [inline] RIP: 0010:[] [] rb_insert_color+0x9f/0xcb0 lib/rbtree.c:420 RSP: 0018:ffff8801db307d18 EFLAGS: 00010003 RAX: 0a0508a8e82a0be9 RBX: ffffffff838a8620 RCX: ffffffff838a8620 RDX: 1ffffffff07150c5 RSI: ffff8801db319710 RDI: ffff8801db319c40 RBP: ffff8801db307d60 R08: ffffffff857d1748 R09: 0000000000000001 R10: 0000000000000000 R11: 1ffff1003b660f62 R12: ffff8801d0877df8 R13: 5028454741505f4e R14: ffff8801db319c40 R15: dffffc0000000000 FS: 00007fbe6f98b700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020265ff7 CR3: 00000001d1722000 CR4: 0000000000160670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff842bcb20 ffff8800b4a10870 0000000000000001 ffff8801db307d70 ffff8801db319c40 dffffc0000000000 0000000000000000 ffff8801db319710 ffff8801d0877e00 ffff8801db307db0 ffffffff81d22fc7 ffff8801db319c58 Call Trace: [] timerqueue_add+0x157/0x2a0 lib/timerqueue.c:57 [] enqueue_hrtimer+0x168/0x450 kernel/time/hrtimer.c:890 [] __run_hrtimer kernel/time/hrtimer.c:1268 [inline] [] __hrtimer_run_queues+0x732/0xfe0 kernel/time/hrtimer.c:1317 [] hrtimer_interrupt+0x1a6/0x440 kernel/time/hrtimer.c:1351 [] local_apic_timer_interrupt+0x6a/0xb0 arch/x86/kernel/apic/apic.c:901 [] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:925 [] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:725 [] smp_call_function_many+0x481/0x710 kernel/smp.c:435 [] native_flush_tlb_others+0xfe/0x710 arch/x86/mm/tlb.c:292 [] flush_tlb_others arch/x86/include/asm/paravirt.h:338 [inline] [] flush_tlb_mm_range+0x103/0x560 arch/x86/mm/tlb.c:358 [] tlb_flush_mmu_tlbonly+0x185/0x2f0 mm/memory.c:242 [] tlb_flush_mmu mm/memory.c:263 [inline] [] tlb_finish_mmu+0x1b/0xa0 mm/memory.c:275 [] unmap_region+0x250/0x330 mm/mmap.c:2468 [] do_munmap+0x70f/0xec0 mm/mmap.c:2662 [] mmap_region+0x423/0x1250 mm/mmap.c:1605 [] do_mmap+0x4fd/0x9d0 mm/mmap.c:1441 [] do_mmap_pgoff include/linux/mm.h:1915 [inline] [] vm_mmap_pgoff+0x16e/0x1c0 mm/util.c:272 [] SYSC_mmap_pgoff mm/mmap.c:1491 [inline] [] SyS_mmap_pgoff+0xd0/0x560 mm/mmap.c:1449 [] SYSC_mmap arch/x86/kernel/sys_x86_64.c:95 [inline] [] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86 [] entry_SYSCALL_64_fastpath+0x16/0x92 Code: 48 89 c2 48 c1 ea 03 42 80 3c 3a 00 0f 85 94 09 00 00 4c 8b 6b 08 4d 39 e5 0f 84 b0 01 00 00 4d 85 ed 74 1d 4c 89 e8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 95 09 00 00 41 f6 45 00 01 0f 84 20 03 00 RIP [] __rb_insert lib/rbtree.c:120 [inline] RIP [] rb_insert_color+0x9f/0xcb0 lib/rbtree.c:420 RSP ---[ end trace 13437bd5893f86f2 ]---