BUG: KASAN: wild-memory-access on address ffe708746e867000
Read of size 28 by task syz-executor0/6546
CPU: 0 PID: 6546 Comm: syz-executor0 Not tainted 4.9.52-g9b2b081 #55
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d193f9e8 ffffffff81d93149 ffe708746e867000 000000000000001c
 0000000000000000 ffff8801d85dfd80 ffe708746e867000 ffff8801d193fa70
 ffffffff8153d08f 0000000000000000 0000000000000001 ffffffff826648db
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153d08f>] kasan_report_error mm/kasan/report.c:284 [inline]
 [<ffffffff8153d08f>] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309
 [<ffffffff8153d460>] kasan_report+0x20/0x30 mm/kasan/report.c:296
 [<ffffffff8153bda7>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff8153bda7>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff8153be11>] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320
 [<ffffffff826648db>] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline]
 [<ffffffff826648db>] sg_read_oxfer drivers/scsi/sg.c:1978 [inline]
 [<ffffffff826648db>] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520
 [<ffffffff8156b741>] do_loop_readv_writev.part.17+0x141/0x1e0 fs/read_write.c:714
 [<ffffffff8156f510>] do_loop_readv_writev fs/read_write.c:880 [inline]
 [<ffffffff8156f510>] do_readv_writev+0x520/0x750 fs/read_write.c:874
 [<ffffffff8156f7c4>] vfs_readv+0x84/0xc0 fs/read_write.c:898
 [<ffffffff8156f8e6>] do_readv+0xe6/0x250 fs/read_write.c:924
 [<ffffffff81572ca7>] SYSC_readv fs/read_write.c:1011 [inline]
 [<ffffffff81572ca7>] SyS_readv+0x27/0x30 fs/read_write.c:1008
 [<ffffffff838ac645>] entry_SYSCALL_64_fastpath+0x23/0xc6
==================================================================
netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'.
sg_write: data in/out 34319/34 bytes for SCSI command 0xfc-- guessing data in;
   program syz-executor0 not setting count and/or reply_len properly
device gre0 entered promiscuous mode
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
device syz2 entered promiscuous mode
device syz2 left promiscuous mode
device syz2 entered promiscuous mode
device syz2 left promiscuous mode
device gre0 entered promiscuous mode
device gre0 entered promiscuous mode
netlink: 13 bytes leftover after parsing attributes in process `syz-executor1'.
netlink: 13 bytes leftover after parsing attributes in process `syz-executor1'.
IPVS: Creating netns size=2536 id=15
binder: 6944:6947 ioctl 400454d4 204b0000 returned -22
binder: 6944:6950 ioctl 400454d4 204b0000 returned -22
9pnet_virtio: no channels available for device ./file0
device lo left promiscuous mode
9pnet_virtio: no channels available for device ./file0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7054 comm=syz-executor6
IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
IPv6: NLM_F_CREATE should be set when creating new route
IPv6: NLM_F_CREATE should be set when creating new route
device lo entered promiscuous mode
device lo left promiscuous mode
IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
IPv6: NLM_F_CREATE should be set when creating new route
IPv6: NLM_F_CREATE should be set when creating new route
device lo entered promiscuous mode
device lo left promiscuous mode
device syz1 entered promiscuous mode
device syz1 left promiscuous mode
øÿÿÿ: renamed from syz1
device syz2 entered promiscuous mode
IPVS: Creating netns size=2536 id=16
nla_parse: 12 callbacks suppressed
netlink: 6 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 6 bytes leftover after parsing attributes in process `syz-executor0'.
device gre0 entered promiscuous mode
device lo entered promiscuous mode
device lo left promiscuous mode
device gre0 left promiscuous mode
device gre0 entered promiscuous mode
device lo entered promiscuous mode
device gre0 left promiscuous mode
device lo left promiscuous mode
sock: sock_set_timeout: `syz-executor6' (pid 7717) tries to set negative timeout
IPVS: Creating netns size=2536 id=17
IPVS: Creating netns size=2536 id=18
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
binder: 7802:7850 ioctl 4b60 205baf8c returned -22
IPVS: Creating netns size=2536 id=19
binder: 7802:7809 ioctl 4b60 205baf8c returned -22
pktgen: kernel_thread() failed for cpu 0
sg_write: data in/out 93/34 bytes for SCSI command 0xfc-- guessing data in;
   program syz-executor4 not setting count and/or reply_len properly
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
binder: 7939:7941 ioctl 80045200 20eb1ffc returned -22
binder: 7939:7941 ioctl 80045200 20eb1ffc returned -22
netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'.
IPVS: length: 24 != 8
FAULT_FLAG_ALLOW_RETRY missing 30
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 8063 Comm: syz-executor3 Tainted: G    B           4.9.52-g9b2b081 #55
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801aaaf77b0 ffffffff81d93149 ffff8801aaaf7a90 0000000000000000
 ffff8801a61df910 ffff8801aaaf7980 ffff8801a61df800 ffff8801aaaf79a8
 ffffffff81660dc8 ffff8801aaaf7900 ffffffff811b99c1 00000001cce64067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad818>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff815aaa8d>] do_fcntl fs/fcntl.c:274 [inline]
 [<ffffffff815aaa8d>] SYSC_fcntl fs/fcntl.c:372 [inline]
 [<ffffffff815aaa8d>] SyS_fcntl+0x8fd/0xc70 fs/fcntl.c:357
 [<ffffffff838ac645>] entry_SYSCALL_64_fastpath+0x23/0xc6
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 8048 Comm: syz-executor3 Tainted: G    B           4.9.52-g9b2b081 #55
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cebef840 ffffffff81d93149 ffff8801cebefb20 0000000000000000
 ffff8801a61df910 ffff8801cebefa10 ffff8801a61df800 ffff8801cebefa38
 ffffffff81660dc8 ffff8801cebef990 ffff8801db221518 00000001cce64067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad818>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff811525fb>] SYSC_capset kernel/capability.c:232 [inline]
 [<ffffffff811525fb>] SyS_capset+0xbb/0x8e0 kernel/capability.c:223
 [<ffffffff838ac645>] entry_SYSCALL_64_fastpath+0x23/0xc6
netlink: 2 bytes leftover after parsing attributes in process `syz-executor0'.
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 8111 Comm: syz-executor6 Tainted: G    B           4.9.52-g9b2b081 #55
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801a9f6f8d0 ffffffff81d93149 ffff8801a9f6fbb0 0000000000000000
 ffff8801a7415010 ffff8801a9f6faa0 ffff8801a7414f00 ffff8801a9f6fac8
 ffffffff81660dc8 ffff8801a9f6fa20 0000000000000000 00000001d13be067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad818>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff8116a27d>] SyS_rt_sigtimedwait+0x2d/0x40 kernel/signal.c:2819
 [<ffffffff838ac645>] entry_SYSCALL_64_fastpath+0x23/0xc6
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 8105 Comm: syz-executor6 Tainted: G    B           4.9.52-g9b2b081 #55
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ca85f9a0 ffffffff81d93149 ffff8801ca85fc80 0000000000000000
 ffff8801a7415010 ffff8801ca85fb70 ffff8801a7414f00 ffff8801ca85fb98
 ffffffff81660dc8 ffff8801ca85faf0 ffff8801ca85fbb8 00000001d13be067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad818>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff838ac645>] entry_SYSCALL_64_fastpath+0x23/0xc6
netlink: 2 bytes leftover after parsing attributes in process `syz-executor0'.
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 8114 Comm: syz-executor6 Tainted: G    B           4.9.52-g9b2b081 #55
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cbc5f8d0 ffffffff81d93149 ffff8801cbc5fbb0 0000000000000000
 ffff8801a7414e90 ffff8801cbc5faa0 ffff8801a7414d80 ffff8801cbc5fac8
 ffffffff81660dc8 ffff8801cbc5fa20 ffffffff811ba655 00000001a265c067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad818>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff8116a27d>] SyS_rt_sigtimedwait+0x2d/0x40 kernel/signal.c:2819
 [<ffffffff838ac645>] entry_SYSCALL_64_fastpath+0x23/0xc6
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 8111 Comm: syz-executor6 Tainted: G    B           4.9.52-g9b2b081 #55
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801a9f6f9a0 ffffffff81d93149 ffff8801a9f6fc80 0000000000000000
 ffff8801a7414e90 ffff8801a9f6fb70 ffff8801a7414d80 ffff8801a9f6fb98
 ffffffff81660dc8 ffff8801a9f6faf0 ffff8801a9f6fbb8 00000001a265c067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad818>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff838ac645>] entry_SYSCALL_64_fastpath+0x23/0xc6
CPU: 0 PID: 8080 Comm: syz-executor3 Tainted: G    B           4.9.52-g9b2b081 #55
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ceb2f9b0 ffffffff81d93149 ffff8801ceb2fc90 0000000000000000
 ffff8801a61df910 ffff8801ceb2fb80 ffff8801a61df800 ffff8801ceb2fba8
 ffffffff81660dc8 ffff8801ceb2fb00 ffff8801ceb2fbe0 00000001cce64067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad818>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff838ac645>] entry_SYSCALL_64_fastpath+0x23/0xc6
binder: 8158:8162 ioctl c0206416 20ff9000 returned -22
binder: 8158:8162 ioctl c0206416 20ff9000 returned -22