sg_write: data in/out 917468/251 bytes for SCSI command 0x0-- guessing data in; program syz-executor.1 not setting count and/or reply_len properly ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4734 at lib/iov_iter.c:385 _copy_from_iter+0x2b2/0x1330 Modules linked in: CPU: 0 PID: 4734 Comm: syz-executor.1 Not tainted 6.3.0-rc7-next-20230419 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:_copy_from_iter+0x2b2/0x1330 Code: 5d 41 5e 41 5f e9 82 a8 35 02 e8 e9 4a 36 ff be 85 01 00 00 48 c7 c7 a0 cf 9e 84 e8 38 5b 5a ff e9 51 fe ff ff e8 ce 4a 36 ff <0f> 0b 45 31 f6 eb 87 e8 c2 4a 36 ff 31 ff 89 ee e8 f9 45 36 ff 40 RSP: 0018:ffff8880164b7608 EFLAGS: 00010216 RAX: 0000000000003d54 RBX: 0000000000000000 RCX: ffffc90000be5000 RDX: 0000000000040000 RSI: ffffffff82158a22 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000001000 R13: ffff8880164b7838 R14: 0000000000001000 R15: ffff8880164b7838 FS: 00007f6cab7a2700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdf66ecd3a4 CR3: 000000000ebfc000 CR4: 0000000000350ef0 Call Trace: <TASK> copy_page_from_iter+0xe3/0x180 blk_rq_map_user_iov+0xb39/0x16c0 blk_rq_map_user_io+0x1d1/0x200 sg_common_write.constprop.0+0xd8d/0x15f0 sg_write.part.0+0x698/0xac0 sg_write+0x8d/0xe0 vfs_write+0x2d8/0xdd0 ksys_write+0x12b/0x260 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f6cae22cb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6cab7a2188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f6cae33ff60 RCX: 00007f6cae22cb19 RDX: 0000000000000125 RSI: 00000000200003c0 RDI: 0000000000000004 RBP: 00007f6cae286f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff1b6edfdf R14: 00007f6cab7a2300 R15: 0000000000022000 </TASK> irq event stamp: 8709 hardirqs last enabled at (8803): [<ffffffff812fc4b8>] __up_console_sem+0x78/0x80 hardirqs last disabled at (8824): [<ffffffff812fc49d>] __up_console_sem+0x5d/0x80 softirqs last enabled at (6564): [<ffffffff8118e26c>] __irq_exit_rcu+0xcc/0x110 softirqs last disabled at (6369): [<ffffffff8118e26c>] __irq_exit_rcu+0xcc/0x110 ---[ end trace 0000000000000000 ]--- FAULT_INJECTION: forcing a failure. name fail_page_alloc, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 4745 Comm: syz-executor.7 Tainted: G W 6.3.0-rc7-next-20230419 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xc1/0xf0 should_fail_ex+0x4b4/0x5b0 prepare_alloc_pages+0x178/0x500 loop6: detected capacity change from 0 to 15 __alloc_pages+0x149/0x480 vma_alloc_folio+0xe2/0x450 __handle_mm_fault+0xe73/0x3200 handle_mm_fault+0x2ce/0xb40 do_user_addr_fault+0x5f6/0x1310 exc_page_fault+0x9c/0x1a0 asm_exc_page_fault+0x26/0x30 RIP: 0010:copy_user_generic_string+0x30/0x50 Code: cb 83 fa 08 72 27 89 f9 83 e1 07 74 15 83 e9 08 f7 d9 29 ca 8a 06 88 07 48 ff c6 48 ff c7 ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 31 c0 0f 01 ca e9 c3 4c 03 00 8d 0c ca 89 ca RSP: 0018:ffff888046247d30 EFLAGS: 00050246 RAX: 0000000000000001 RBX: 0000000000000030 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffff888046247d98 RDI: 0000000020000000 RBP: 0000000020000000 R08: 0000000000000000 R09: ffff888046247dc7 R10: ffffed1008c48fb8 R11: 0000000000000001 R12: 00007fffffffefd0 R13: ffff888046247d98 R14: fffffffffffffff2 R15: ffff8880159a2000 _copy_to_user+0x12d/0x150 ksys_shmctl.constprop.0+0x2d9/0x390 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f4b1aafeb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4b18074188 EFLAGS: 00000246 ORIG_RAX: 000000000000001f RAX: ffffffffffffffda RBX: 00007f4b1ac11f60 RCX: 00007f4b1aafeb19 RDX: 0000000020000000 RSI: 000000000000000e RDI: 0000000000000023 RBP: 00007f4b180741d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 00007fff8738920f R14: 00007f4b18074300 R15: 0000000000022000 </TASK> loop4: detected capacity change from 0 to 4 netlink: 'syz-executor.6': attribute type 4 has an invalid length. EXT4-fs (loop4): VFS: Can't find ext4 filesystem loop6: detected capacity change from 0 to 15 sg_write: data in/out 917468/251 bytes for SCSI command 0x0-- guessing data in; program syz-executor.1 not setting count and/or reply_len properly netlink: 'syz-executor.6': attribute type 4 has an invalid length. ---------------- Code disassembly (best guess): 0: cb lret 1: 83 fa 08 cmp $0x8,%edx 4: 72 27 jb 0x2d 6: 89 f9 mov %edi,%ecx 8: 83 e1 07 and $0x7,%ecx b: 74 15 je 0x22 d: 83 e9 08 sub $0x8,%ecx 10: f7 d9 neg %ecx 12: 29 ca sub %ecx,%edx 14: 8a 06 mov (%rsi),%al 16: 88 07 mov %al,(%rdi) 18: 48 ff c6 inc %rsi 1b: 48 ff c7 inc %rdi 1e: ff c9 dec %ecx 20: 75 f2 jne 0x14 22: 89 d1 mov %edx,%ecx 24: c1 e9 03 shr $0x3,%ecx 27: 83 e2 07 and $0x7,%edx * 2a: f3 48 a5 rep movsq %ds:(%rsi),%es:(%rdi) <-- trapping instruction 2d: 89 d1 mov %edx,%ecx 2f: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) 31: 31 c0 xor %eax,%eax 33: 0f 01 ca clac 36: e9 c3 4c 03 00 jmpq 0x34cfe 3b: 8d 0c ca lea (%rdx,%rcx,8),%ecx 3e: 89 ca mov %ecx,%edx