| TITLE: BUG: bad usercopy in sg_io |
| |
| [ 1211.293569] usercopy: Kernel memory overwrite attempt detected to kernel text (offset 22791744, size 7)! |
| [ 1211.303669] ------------[ cut here ]------------ |
| [ 1211.308449] kernel BUG at mm/usercopy.c:102! |
| [ 1211.312951] invalid opcode: 0000 [#1] SMP KASAN PTI |
| [ 1211.317966] Modules linked in: |
| [ 1211.327515] CPU: 1 PID: 2118 Comm: syz-executor.3 Not tainted 4.15.0 #30 |
| [ 1211.334355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 1211.343736] RIP: 0010:usercopy_abort+0xbd/0xbf |
| [ 1211.348336] RSP: 0018:ffff88014d26f8a0 EFLAGS: 00010282 |
| [ 1211.353713] RAX: 000000000000005c RBX: ffffffff849801a0 RCX: 0000000000000000 |
| [ 1211.361000] RDX: 0000000000000000 RSI: ffffffff81572e02 RDI: ffffed0029a4df06 |
| [ 1211.368286] RBP: ffff88014d26f8f8 R08: 000000000000005c R09: 0000000000000000 |
| [ 1211.375561] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff849805c0 |
| [ 1211.382839] R13: ffffffff849802e0 R14: ffffffff849801a0 R15: ffffffff849801a0 |
| [ 1211.390118] FS: 0000000000000000(0000) GS:ffff8801dad00000(0063) knlGS:00000000f5d99b40 |
| [ 1211.404708] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 |
| [ 1211.410597] CR2: 00000000080db897 CR3: 000000015f0d4003 CR4: 00000000001626f0 |
| [ 1211.417915] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| [ 1211.425240] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 |
| [ 1211.432509] Call Trace: |
| [ 1211.446836] [<ffffffff81aa3299>] __check_object_size.cold+0x48/0xaf |
| [ 1211.459111] [<ffffffff820ed214>] sg_io+0x324/0x1350 |
| [ 1211.483447] [<ffffffff820eeb66>] sg_io_filtered+0xd6/0x186 |
| [ 1211.495319] [<ffffffff820dfde3>] foo_ioctl+0x613/0x3c70 |
| [ 1211.544801] [<ffffffff82142c3a>] compat_blkdev_ioctl+0x38a/0x1a40 |
| [ 1211.577464] [<ffffffff81c0e88c>] compat_SyS_ioctl+0x13c/0x2940 |
| [ 1211.596163] [<ffffffff8101da17>] do_fast_syscall_32+0x357/0xe1c |
| [ 1211.608956] [<ffffffff84401a9b>] entry_SYSENTER_compat+0x8b/0x9d |
| [ 1211.615171] RIP: 0023:0xf7f9dc69 |
| [ 1211.618522] RSP: 002b:00000000f5d990cc EFLAGS: 00000286 ORIG_RAX: 0000000000000036 |
| [ 1211.626233] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c05812fe |
| [ 1211.633484] RDX: 0000000020000140 RSI: 0000000000000000 RDI: 0000000000000000 |
| [ 1211.640734] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 |
| [ 1211.647999] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 |
| [ 1211.655249] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 |
| [ 1211.662521] Code: 55 c0 e8 c5 71 c2 ff 48 8b 55 c0 49 89 d9 4d 89 f0 ff 75 c8 4c 89 e1 4c 89 ee 48 c7 c7 80 04 98 84 ff 75 d0 41 57 e8 2b ea ac ff <0f> 0b e8 9a 71 c2 ff e8 d5 fa f8 ff 8b 55 cc 4d 89 e8 31 c9 31 |
| [ 1212.422926] RIP: usercopy_abort+0xbd/0xbf RSP: ffff88014d26f8a0 |
| [ 1212.429802] ---[ end trace d011b40e52d131d2 ]--- |
