BUG: KASAN: use-after-free in bio_copy_user_iov+0xe61/0xea0 block/bio.c:1205 at addr ffff8801cdd2d780
Read of size 8 by task syz-executor0/3311
CPU: 0 PID: 3311 Comm: syz-executor0 Not tainted 4.9.41-g4501c04 #23
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
ffff8801d4f374c0 ffffffff81d92609 ffff8801da0013c0 ffff8801cdd2d780
ffff8801cdd2d880 ffffed0039ba5af0 ffff8801cdd2d780 ffff8801d4f374e8
ffffffff8153c1bc ffffed0039ba5af0 ffff8801da0013c0 0000000000000000
Call Trace:
[<ffffffff81d92609>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81d92609>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff8153c1bc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
[<ffffffff8153c47c>] print_address_description mm/kasan/report.c:198 [inline]
[<ffffffff8153c47c>] kasan_report_error mm/kasan/report.c:287 [inline]
[<ffffffff8153c47c>] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309
[<ffffffff8153c819>] kasan_report mm/kasan/report.c:330 [inline]
[<ffffffff8153c819>] __asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:330
[<ffffffff81cdfbb1>] bio_copy_user_iov+0xe61/0xea0 block/bio.c:1205
[<ffffffff81d13b07>] __blk_rq_map_user_iov block/blk-map.c:56 [inline]
[<ffffffff81d13b07>] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133
[<ffffffff81d14171>] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163
[<ffffffff8266885a>] sg_start_req drivers/scsi/sg.c:1766 [inline]
[<ffffffff8266885a>] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775
[<ffffffff8266cc78>] sg_write+0x688/0xad0 drivers/scsi/sg.c:678
[<ffffffff8156a133>] __vfs_write+0x103/0x680 fs/read_write.c:510
[<ffffffff8156e260>] vfs_write+0x170/0x4e0 fs/read_write.c:560
[<ffffffff81571c59>] SYSC_write fs/read_write.c:607 [inline]
[<ffffffff81571c59>] SyS_write+0xd9/0x1b0 fs/read_write.c:599
[<ffffffff838a5985>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff8801cdd2d780, in cache kmalloc-256 size: 256
Allocated:
PID = 3311
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:495
set_track mm/kasan/kasan.c:507 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
__kmalloc+0x11d/0x310 mm/slub.c:3741
kmalloc include/linux/slab.h:495 [inline]
kzalloc include/linux/slab.h:636 [inline]
sg_build_sgat drivers/scsi/sg.c:1816 [inline]
sg_build_indirect.isra.23+0x8b/0x550 drivers/scsi/sg.c:1842
sg_build_reserve+0x8d/0xb0 drivers/scsi/sg.c:1973
sg_add_sfp drivers/scsi/sg.c:2160 [inline]
sg_open+0x946/0x15a0 drivers/scsi/sg.c:329
chrdev_open+0x22b/0x4c0 fs/char_dev.c:392
do_dentry_open+0x607/0xc60 fs/open.c:766
vfs_open+0x105/0x220 fs/open.c:879
do_last fs/namei.c:3402 [inline]
path_openat+0x64c/0x2a60 fs/namei.c:3525
do_filp_open+0x197/0x290 fs/namei.c:3560
do_sys_open+0x352/0x4c0 fs/open.c:1072
SYSC_open fs/open.c:1090 [inline]
SyS_open+0x2d/0x40 fs/open.c:1085
entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 3312
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:495
set_track mm/kasan/kasan.c:507 [inline]
kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
slab_free_hook mm/slub.c:1355 [inline]
slab_free_freelist_hook mm/slub.c:1377 [inline]
slab_free mm/slub.c:2958 [inline]
kfree+0xf0/0x2f0 mm/slub.c:3878
sg_remove_scat.isra.20+0x212/0x2d0 drivers/scsi/sg.c:1924
sg_ioctl+0x12d0/0x29f0 drivers/scsi/sg.c:973
vfs_ioctl fs/ioctl.c:43 [inline]
do_vfs_ioctl+0x1aa/0x10c0 fs/ioctl.c:679
SYSC_ioctl fs/ioctl.c:694 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
ffff8801cdd2d680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801cdd2d700: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff8801cdd2d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801cdd2d800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801cdd2d880: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================
==================================================================
BUG: KASAN: wild-memory-access on address ffe708744e790000
Write of size 38 by task syz-executor0/3311
CPU: 0 PID: 3311 Comm: syz-executor0 Tainted: G B 4.9.41-g4501c04 #23
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
ffff8801d4f37448 ffffffff81d92609 ffff8801d4f37618 0000000000000026
0000000000000001 ffff8801d4f37840 ffe708744e790000 ffff8801d4f374d0
ffffffff8153c66f 0000000000000000 0000000000000001 ffffffff81ddbec4
Call Trace:
[<ffffffff81d92609>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81d92609>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff8153c66f>] kasan_report_error mm/kasan/report.c:284 [inline]
[<ffffffff8153c66f>] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309
[<ffffffff8153ca40>] kasan_report+0x20/0x30 mm/kasan/report.c:296
[<ffffffff8153b387>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
[<ffffffff8153b387>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
[<ffffffff8153b414>] kasan_check_write+0x14/0x20 mm/kasan/kasan.c:326
[<ffffffff81ddbec4>] __copy_from_user arch/x86/include/asm/uaccess_64.h:114 [inline]
[<ffffffff81ddbec4>] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline]
[<ffffffff81ddbec4>] copy_page_from_iter+0x1a4/0x5d0 lib/iov_iter.c:618
[<ffffffff81cdf855>] bio_copy_from_iter block/bio.c:1031 [inline]
[<ffffffff81cdf855>] bio_copy_user_iov+0xb05/0xea0 block/bio.c:1232
[<ffffffff81d13b07>] __blk_rq_map_user_iov block/blk-map.c:56 [inline]
[<ffffffff81d13b07>] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133
[<ffffffff81d14171>] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163
[<ffffffff8266885a>] sg_start_req drivers/scsi/sg.c:1766 [inline]
[<ffffffff8266885a>] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775
[<ffffffff8266cc78>] sg_write+0x688/0xad0 drivers/scsi/sg.c:678
[<ffffffff8156a133>] __vfs_write+0x103/0x680 fs/read_write.c:510
[<ffffffff8156e260>] vfs_write+0x170/0x4e0 fs/read_write.c:560
[<ffffffff81571c59>] SYSC_write fs/read_write.c:607 [inline]
[<ffffffff81571c59>] SyS_write+0xd9/0x1b0 fs/read_write.c:599
[<ffffffff838a5985>] entry_SYSCALL_64_fastpath+0x23/0xc6
==================================================================
==================================================================
BUG: KASAN: wild-memory-access on address ffe708744e790000
Write of size 38 by task syz-executor0/3311
CPU: 0 PID: 3311 Comm: syz-executor0 Tainted: G B 4.9.41-g4501c04 #23
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
ffff8801d4f373f8 ffffffff81d92609 ffe708744e790000 0000000000000026
0000000000000001 0000000020006fdb ffe708744e790000 ffff8801d4f37480
ffffffff8153c66f 0000000000000000 0000000000000000 ffffffff81dc5d14
Call Trace:
[<ffffffff81d92609>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81d92609>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff8153c66f>] kasan_report_error mm/kasan/report.c:284 [inline]
[<ffffffff8153c66f>] kasan_report.part.1+0x40f/0x500 mm/kasan/report.c:309
[<ffffffff8153ca40>] kasan_report+0x20/0x30 mm/kasan/report.c:296
[<ffffffff8153b387>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
[<ffffffff8153b387>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
[<ffffffff8153b7f3>] memset+0x23/0x40 mm/kasan/kasan.c:333
[<ffffffff81dc5d14>] copy_user_handle_tail+0xb4/0xd0 arch/x86/lib/usercopy_64.c:86
[<ffffffff81ddbee0>] copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
[<ffffffff81ddbee0>] __copy_from_user_nocheck arch/x86/include/asm/uaccess_64.h:59 [inline]
[<ffffffff81ddbee0>] __copy_from_user arch/x86/include/asm/uaccess_64.h:115 [inline]
[<ffffffff81ddbee0>] copy_page_from_iter_iovec lib/iov_iter.c:267 [inline]
[<ffffffff81ddbee0>] copy_page_from_iter+0x1c0/0x5d0 lib/iov_iter.c:618
[<ffffffff81cdf855>] bio_copy_from_iter block/bio.c:1031 [inline]
[<ffffffff81cdf855>] bio_copy_user_iov+0xb05/0xea0 block/bio.c:1232
[<ffffffff81d13b07>] __blk_rq_map_user_iov block/blk-map.c:56 [inline]
[<ffffffff81d13b07>] blk_rq_map_user_iov+0x237/0x790 block/blk-map.c:133
[<ffffffff81d14171>] blk_rq_map_user+0x111/0x1a0 block/blk-map.c:163
[<ffffffff8266885a>] sg_start_req drivers/scsi/sg.c:1766 [inline]
[<ffffffff8266885a>] sg_common_write.isra.24+0xc1a/0x17c0 drivers/scsi/sg.c:775