| TITLE: KASAN: slab-out-of-bounds Read in sg_remove_request |
| |
| [ 190.154802] ================================================================== |
| [ 190.154802] BUG: KASAN: slab-out-of-bounds in sg_remove_request+0x103/0x120 at addr ffff8801a85de8c0 |
| [ 190.154802] Read of size 8 by task syz-executor0/6860 |
| [ 190.154802] CPU: 0 PID: 6860 Comm: syz-executor0 Not tainted 4.9.58-g27155df #71 |
| [ 190.154802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 190.154802] ffff8801a2bf7a80 ffffffff81d91149 ffff8801d77fd3c0 ffff8801a85de880 |
| [ 190.154802] ffff8801a85de8e0 ffffed00350bbd18 ffff8801a85de8c0 ffff8801a2bf7aa8 |
| [ 190.154802] ffffffff8153c01c ffffed00350bbd18 ffff8801d77fd3c0 0000000000000000 |
| [ 190.154802] Call Trace: |
| [ 190.154802] [<ffffffff81d91149>] dump_stack+0xc1/0x128 |
| [ 190.154802] [<ffffffff8153c01c>] kasan_object_err+0x1c/0x70 |
| [ 190.154802] [<ffffffff8153c2dc>] kasan_report.part.1+0x21c/0x500 |
| [ 190.154802] [<ffffffff8153c679>] __asan_report_load8_noabort+0x29/0x30 |
| [ 190.154802] [<ffffffff8265fad3>] sg_remove_request+0x103/0x120 |
| [ 190.154802] [<ffffffff82660055>] sg_finish_rem_req+0x295/0x340 |
| [ 190.154802] [<ffffffff82661d8c>] sg_read+0x91c/0x1400 |
| [ 190.154802] [<ffffffff8156c5f3>] __vfs_read+0x103/0x670 |
| [ 190.154802] [<ffffffff8156db87>] vfs_read+0x107/0x330 |
| [ 190.154802] [<ffffffff81571829>] SyS_read+0xd9/0x1b0 |
| [ 190.154802] [<ffffffff838aa0c5>] entry_SYSCALL_64_fastpath+0x23/0xc6 |
| [ 190.154802] Object at ffff8801a85de880, in cache fasync_cache size: 96 |
| [ 190.154802] Allocated: |
| [ 190.154802] PID = 0 |
| [ 190.154802] (stack is not available) |
| [ 190.154802] Freed: |
| [ 190.154802] PID = 0 |
| [ 190.154802] (stack is not available) |
| [ 190.154802] Memory state around the buggy address: |
| [ 190.154802] ffff8801a85de780: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc |
| [ 190.154802] ffff8801a85de800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc |
| [ 190.154802] >ffff8801a85de880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc |
| [ 190.154802] ^ |
| [ 190.154802] ffff8801a85de900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc |
| [ 190.154802] ffff8801a85de980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc |
| [ 190.154802] ================================================================== |
