BUG: KASAN: wild-memory-access on address ffe7087450a2b000
Read of size 28 by task syz-executor6/7313
CPU: 0 PID: 7313 Comm: syz-executor6 Not tainted 4.9.52-gc30c69c #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c6b0f9e8 ffffffff81d93149 ffe7087450a2b000 000000000000001c
 0000000000000000 ffff8801c7738960 ffe7087450a2b000 ffff8801c6b0fa70
 ffffffff8153d08f 0000000000000000 0000000000000001 ffffffff826648db
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153d08f>] kasan_report_error mm/kasan/report.c:284 [inline]
 [<ffffffff8153d08f>] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309
 [<ffffffff8153d460>] kasan_report+0x20/0x30 mm/kasan/report.c:296
 [<ffffffff8153bda7>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff8153bda7>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff8153be11>] kasan_check_read+0x11/0x20 mm/kasan/kasan.c:320
 [<ffffffff826648db>] __copy_to_user arch/x86/include/asm/uaccess_64.h:182 [inline]
 [<ffffffff826648db>] sg_read_oxfer drivers/scsi/sg.c:1978 [inline]
 [<ffffffff826648db>] sg_read+0x124b/0x1400 drivers/scsi/sg.c:520
 [<ffffffff8156b741>] do_loop_readv_writev.part.17+0x141/0x1e0 fs/read_write.c:714
 [<ffffffff8156f510>] do_loop_readv_writev fs/read_write.c:880 [inline]
 [<ffffffff8156f510>] do_readv_writev+0x520/0x750 fs/read_write.c:874
 [<ffffffff8156f7c4>] vfs_readv+0x84/0xc0 fs/read_write.c:898
 [<ffffffff8156f8e6>] do_readv+0xe6/0x250 fs/read_write.c:924
 [<ffffffff81572ca7>] SYSC_readv fs/read_write.c:1011 [inline]
 [<ffffffff81572ca7>] SyS_readv+0x27/0x30 fs/read_write.c:1008
 [<ffffffff838ac5c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
==================================================================
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=21199 sclass=netlink_audit_socket pig=7299 comm=syz-executor4
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=41 sclass=netlink_audit_socket pig=7299 comm=syz-executor4
sg_write: data in/out 111311697/137 bytes for SCSI command 0x2c-- guessing data in;
   program syz-executor6 not setting count and/or reply_len properly
mmap: syz-executor1 (7301): VmData 15941632 exceed data ulimit 4. Update limits or use boot option ignore_rlimit_data.
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=21199 sclass=netlink_audit_socket pig=7312 comm=syz-executor4
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=41 sclass=netlink_audit_socket pig=7299 comm=syz-executor4
binder: 7341:7345 ioctl 540f 20376000 returned -22
binder: 7341:7357 ioctl 540f 20376000 returned -22
binder: 7381:7384 ioctl 4b3b 1 returned -22
binder: 7381:7384 ioctl 4b3b 1 returned -22
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=31687 sclass=netlink_tcpdiag_socket pig=7388 comm=syz-executor1
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=31687 sclass=netlink_tcpdiag_socket pig=7392 comm=syz-executor1
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 7386 Comm: syz-executor3 Tainted: G    B           4.9.52-gc30c69c #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ca797a00 ffffffff81d93149 ffff8801ca797ce0 0000000000000000
 ffff8801c8a49490 ffff8801ca797bd0 ffff8801c8a49380 ffff8801ca797bf8
 ffffffff81660dc8 ffff8801ca797b50 0000000041b58ab3 00000001ce45e067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad798>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff838ac5c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 7378 Comm: syz-executor3 Tainted: G    B           4.9.52-gc30c69c #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c9a376d0 ffffffff81d93149 ffff8801c9a379b0 0000000000000000
 ffff8801c8a49490 ffff8801c9a378a0 ffff8801c8a49380 ffff8801c9a378c8
 ffffffff81660dc8 ffff8801c9a37820 ffffffff84649140 00000001ce45e067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad798>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff832e3689>] inet_ioctl+0x89/0x1c0 net/ipv4/af_inet.c:878
 [<ffffffff82ec9ef5>] sock_do_ioctl+0x65/0xb0 net/socket.c:892
 [<ffffffff82eca940>] sock_ioctl+0x2e0/0x3d0 net/socket.c:978
 [<ffffffff815ace0a>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff815ace0a>] do_vfs_ioctl+0x1aa/0x10c0 fs/ioctl.c:679
 [<ffffffff815addaf>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff815addaf>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff838ac5c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 7395 Comm: syz-executor3 Tainted: G    B           4.9.52-gc30c69c #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c95ef5b0 ffffffff81d93149 ffff8801c95ef890 0000000000000000
 ffff8801c8a49490 ffff8801c95ef780 ffff8801c8a49380 ffff8801c95ef7a8
 ffffffff81660dc8 ffff8801c95ef700 0000000000000000 00000001ce45e067
Call Trace:
 [<ffffffff81d93149>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93149>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660dc8>] handle_userfault+0xa48/0x1300 fs/userfaultfd.c:323
 [<ffffffff814cfd71>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cfd71>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cfd71>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cfd71>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810e020b>] __do_page_fault+0x4eb/0xbd0 arch/x86/mm/fault.c:1397
 [<ffffffff810e0917>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1460
 [<ffffffff838ad798>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012
 [<ffffffff8320bc1a>] ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1235
 [<ffffffff832b8825>] udp_setsockopt+0x45/0x80 net/ipv4/udp.c:2086
 [<ffffffff82ed6245>] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705
 [<ffffffff82ed31e0>] SYSC_setsockopt net/socket.c:1771 [inline]
 [<ffffffff82ed31e0>] SyS_setsockopt+0x160/0x250 net/socket.c:1750
 [<ffffffff838ac5c5>] entry_SYSCALL_64_fastpath+0x23/0xc6