netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. loop7: detected capacity change from 0 to 264192 loop5: detected capacity change from 0 to 262144 ================================================================== BUG: KASAN: slab-use-after-free in __blk_rq_map_sg+0x67b/0x740 Read of size 8 at addr ffff8880207748c0 by task kworker/1:0H/24 CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Not tainted 6.19.0-rc4-next-20260109 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: kblockd blk_mq_run_work_fn Call Trace: dump_stack_lvl+0xca/0x120 print_report+0xcb/0x610 kasan_report+0xca/0x100 __blk_rq_map_sg+0x67b/0x740 scsi_alloc_sgtables+0x206/0xc30 sd_init_command+0x8d8/0x30e0 scsi_queue_rq+0x133b/0x3280 blk_mq_dispatch_rq_list+0x3ad/0x1c00 __blk_mq_sched_dispatch_requests+0xc37/0x13e0 blk_mq_sched_dispatch_requests+0xd7/0x1b0 blk_mq_run_work_fn+0x1f9/0x380 process_one_work+0x8e1/0x1960 worker_thread+0x67e/0xe90 kthread+0x385/0x490 ret_from_fork+0x67a/0x7a0 ret_from_fork_asm+0x1a/0x30 Allocated by task 70: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x59/0x70 kmem_cache_alloc_noprof+0x212/0x760 mempool_alloc_noprof+0x1b3/0x300 __sg_alloc_table+0x252/0x390 sg_alloc_table_chained+0x9f/0x1f0 scsi_alloc_sgtables+0x1bb/0xc30 sd_init_command+0x8d8/0x30e0 scsi_queue_rq+0x133b/0x3280 blk_mq_dispatch_rq_list+0x3ad/0x1c00 __blk_mq_sched_dispatch_requests+0xc37/0x13e0 blk_mq_sched_dispatch_requests+0xd7/0x1b0 blk_mq_run_hw_queue+0x3bd/0x640 blk_mq_dispatch_list+0x4de/0x1580 blk_mq_flush_plug_list+0x12a/0x5b0 __blk_flush_plug+0x25c/0x460 blk_finish_plug+0x53/0xa0 jbd2_journal_commit_transaction+0x2b45/0x5b90 kjournald2+0x1d8/0x720 kthread+0x385/0x490 ret_from_fork+0x67a/0x7a0 ret_from_fork_asm+0x1a/0x30 Freed by task 4247: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x43/0x70 kmem_cache_free+0x2cd/0x660 mempool_free+0xdb/0x130 __sg_free_table+0x125/0x1a0 sg_free_table_chained+0x8d/0xa0 scsi_end_request+0x5ac/0x9e0 scsi_io_completion+0xbf/0x1620 scsi_complete+0x37c/0x680 blk_complete_reqs+0xb2/0xf0 handle_softirqs+0x1b1/0x7d0 __irq_exit_rcu+0xc4/0x100 irq_exit_rcu+0x9/0x20 sysvec_call_function_single+0xa6/0xc0 asm_sysvec_call_function_single+0x1a/0x20 The buggy address belongs to the object at ffff8880207748c0 which belongs to the cache sgpool-8 of size 256 The buggy address is located 0 bytes inside of freed 256-byte region [ffff8880207748c0, ffff8880207749c0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20774 flags: 0x100000000000000(node=0|zone=1) page_type: f5(slab) raw: 0100000000000000 ffff888009bd4a00 ffffea000081bd00 0000000000000004 raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888020774780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888020774800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888020774880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff888020774900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888020774980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ================================================================== ------------[ cut here ]------------ WARNING: block/blk-mq-dma.c:309 at __blk_rq_map_sg+0x636/0x740, CPU#1: kworker/1:0H/24 Modules linked in: CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Tainted: G B 6.19.0-rc4-next-20260109 #1 PREEMPT(voluntary) Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: kblockd blk_mq_run_work_fn RIP: 0010:__blk_rq_map_sg+0x636/0x740 Code: ff ff e8 dd 28 30 ff b9 06 00 00 00 48 89 d8 48 8d bc 24 98 00 00 00 48 89 7c 24 20 f3 48 ab e9 fd fa ff ff e8 bb 28 30 ff 90 <0f> 0b 90 e9 f8 fd ff ff 48 89 cf e8 aa 6c 6e ff e9 66 fa ff ff 48 RSP: 0018:ffff888009b6f670 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffffffff8245502e RDX: ffff888009b60000 RSI: ffffffff82455235 RDI: 0000000000000004 RBP: 0000000000000001 R08: 0000000000000001 R09: fffffbfff0f64698 R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000 R13: 0000000000000e00 R14: ffff88800e920000 R15: ffff888009b6f7f8 FS: 0000000000000000(0000) GS:ffff8880e544a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3036e8000 CR3: 000000000e7d9000 CR4: 0000000000350ef0 Call Trace: scsi_alloc_sgtables+0x206/0xc30 sd_init_command+0x8d8/0x30e0 scsi_queue_rq+0x133b/0x3280 blk_mq_dispatch_rq_list+0x3ad/0x1c00 __blk_mq_sched_dispatch_requests+0xc37/0x13e0 blk_mq_sched_dispatch_requests+0xd7/0x1b0 blk_mq_run_work_fn+0x1f9/0x380 process_one_work+0x8e1/0x1960 worker_thread+0x67e/0xe90 kthread+0x385/0x490 ret_from_fork+0x67a/0x7a0 ret_from_fork_asm+0x1a/0x30 irq event stamp: 17705 hardirqs last enabled at (17705): [] irqentry_exit+0x17b/0x650 hardirqs last disabled at (17704): [] handle_softirqs+0x65e/0x7d0 softirqs last enabled at (17296): [] __irq_exit_rcu+0xc4/0x100 softirqs last disabled at (17287): [] __irq_exit_rcu+0xc4/0x100 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ kernel BUG at drivers/scsi/scsi_lib.c:1173! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Tainted: G B W 6.19.0-rc4-next-20260109 #1 PREEMPT(voluntary) Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: kblockd blk_mq_run_work_fn RIP: 0010:scsi_alloc_sgtables+0xa32/0xc30 Code: e9 71 f7 ff ff e8 8e 14 32 fe 90 0f 0b 90 41 bc 0a 00 00 00 e9 c8 fc ff ff 41 bc 09 00 00 00 e9 bd fc ff ff e8 6f 14 32 fe 90 <0f> 0b 45 31 f6 e9 b7 f9 ff ff e8 5f 14 32 fe be 01 00 00 00 31 ff RSP: 0018:ffff888009b6f7b0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88800e9200f8 RCX: ffffffff8343629d RDX: ffff888009b60000 RSI: ffffffff83436681 RDI: 0000000000000004 RBP: 0000000000000002 R08: 0000000000000001 R09: fffffbfff0f64698 R10: 0000000000000002 R11: 0000000000000001 R12: 0000000000000001 R13: ffff88800e92001c R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880e544a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3036e8000 CR3: 000000000e7d9000 CR4: 0000000000350ef0 Call Trace: sd_init_command+0x8d8/0x30e0 scsi_queue_rq+0x133b/0x3280 blk_mq_dispatch_rq_list+0x3ad/0x1c00 __blk_mq_sched_dispatch_requests+0xc37/0x13e0 blk_mq_sched_dispatch_requests+0xd7/0x1b0 blk_mq_run_work_fn+0x1f9/0x380 process_one_work+0x8e1/0x1960 worker_thread+0x67e/0xe90 kthread+0x385/0x490 ret_from_fork+0x67a/0x7a0 ret_from_fork_asm+0x1a/0x30 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:scsi_alloc_sgtables+0xa32/0xc30 Code: e9 71 f7 ff ff e8 8e 14 32 fe 90 0f 0b 90 41 bc 0a 00 00 00 e9 c8 fc ff ff 41 bc 09 00 00 00 e9 bd fc ff ff e8 6f 14 32 fe 90 <0f> 0b 45 31 f6 e9 b7 f9 ff ff e8 5f 14 32 fe be 01 00 00 00 31 ff vfat: Unknown parameter 'àË»âZÉžÖªšAÊ2Í™»š<Æ;¿ÿƒz+í$äšSÍS‹`â«³@ÉŒ' RSP: 0018:ffff888009b6f7b0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88800e9200f8 RCX: ffffffff8343629d RDX: ffff888009b60000 RSI: ffffffff83436681 RDI: 0000000000000004 RBP: 0000000000000002 R08: 0000000000000001 R09: fffffbfff0f64698 R10: 0000000000000002 R11: 0000000000000001 R12: 0000000000000001 R13: ffff88800e92001c R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880e544a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3036e8000 CR3: 000000000e7d9000 CR4: 0000000000350ef0 BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:51 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 24, name: kworker/1:0H preempt_count: 0, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Tainted: G B D W 6.19.0-rc4-next-20260109 #1 PREEMPT(voluntary) Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: kblockd blk_mq_run_work_fn Call Trace: dump_stack_lvl+0xfa/0x120 __might_resched+0x2f3/0x510 exit_signals+0x2b/0xae0 do_exit+0x2e3/0x2950 make_task_dead+0x174/0x3b0 rewind_stack_and_make_dead+0x16/0x20 RIP: 0000:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0000:0000000000000000 EFLAGS: 00000000 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 loop1: detected capacity change from 0 to 64 FAT-fs (loop1): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) loop3: detected capacity change from 0 to 262144 vfat: Unknown parameter 'àË»âZÉžÖªšAÊ2Í™»š<Æ;¿ÿƒz+í$äšSÍS‹`â«³@ÉŒ' BUG: unable to handle page fault for address: ffffeb860001b688 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#2] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 166 Comm: cron Tainted: G B D W 6.19.0-rc4-next-20260109 #1 PREEMPT(voluntary) Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:qlist_free_all+0x92/0x130 Code: 80 48 01 c1 0f 82 a7 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 20 57 f5 03 48 01 ca 48 c1 ea 0c 48 c1 e2 06 48 03 15 fe 56 f5 03 <48> 8b 4a 08 48 8d 71 ff 83 e1 01 b9 00 00 00 00 48 0f 45 d6 80 7a RSP: 0018:ffff888018e97b90 EFLAGS: 00010282 RAX: ffffea00006dad02 RBX: ffffea00006dad02 RCX: ffffea00806dad02 RDX: ffffeb860001b680 RSI: 0000000000000001 RDI: ffff888009bd4a01 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff81b3cb0b R10: ffffea000081dd00 R11: 0000000000000001 R12: 0000000000000000 R13: ffff888018e97bc8 R14: ffff8880207748c0 R15: ffff8880207748c0 FS: 00007f439406d840(0000) GS:ffff8880e534a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffeb860001b688 CR3: 000000000c0d9000 CR4: 0000000000350ef0 Call Trace: kasan_quarantine_reduce+0x19f/0x240 __kasan_slab_alloc+0x49/0x70 kmem_cache_alloc_noprof+0x212/0x760 __alloc_object+0x2b/0x2c0 __create_object+0x1d/0x80 kmem_cache_alloc_noprof+0x48f/0x760 getname_flags.part.0+0x48/0x540 getname_flags+0x95/0xe0 __do_sys_newstat+0x76/0x120 do_syscall_64+0xbf/0x420 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f43942593a6 Code: 00 00 75 05 48 83 c4 18 c3 e8 96 f2 01 00 66 0f 1f 44 00 00 41 89 f8 48 89 f7 48 89 d6 41 83 f8 01 77 29 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 c3 90 48 8b 15 b9 fa 0c 00 f7 d8 64 89 02 RSP: 002b:00007ffd865d9058 EFLAGS: 00000246 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f43942593a6 RDX: 00007ffd865d90e0 RSI: 00007ffd865d90e0 RDI: 00007f43942f64be RBP: 00007f43942f64be R08: 0000000000000001 R09: 0000000000000040 R10: 00007ffd865d9230 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: CR2: ffffeb860001b688 ---[ end trace 0000000000000000 ]--- RIP: 0010:scsi_alloc_sgtables+0xa32/0xc30 Code: e9 71 f7 ff ff e8 8e 14 32 fe 90 0f 0b 90 41 bc 0a 00 00 00 e9 c8 fc ff ff 41 bc 09 00 00 00 e9 bd fc ff ff e8 6f 14 32 fe 90 <0f> 0b 45 31 f6 e9 b7 f9 ff ff e8 5f 14 32 fe be 01 00 00 00 31 ff RSP: 0018:ffff888009b6f7b0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88800e9200f8 RCX: ffffffff8343629d RDX: ffff888009b60000 RSI: ffffffff83436681 RDI: 0000000000000004 RBP: 0000000000000002 R08: 0000000000000001 R09: fffffbfff0f64698 R10: 0000000000000002 R11: 0000000000000001 R12: 0000000000000001 R13: ffff88800e92001c R14: 0000000000000000 R15: 0000000000000000 FS: 00007f439406d840(0000) GS:ffff8880e534a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffeb860001b688 CR3: 000000000c0d9000 CR4: 0000000000350ef0 note: cron[166] exited with irqs disabled ---------------- Code disassembly (best guess): 0: 80 48 01 c1 orb $0xc1,0x1(%rax) 4: 0f 82 a7 00 00 00 jb 0xb1 a: 48 c7 c2 00 00 00 80 mov $0xffffffff80000000,%rdx 11: 48 2b 15 20 57 f5 03 sub 0x3f55720(%rip),%rdx # 0x3f55738 18: 48 01 ca add %rcx,%rdx 1b: 48 c1 ea 0c shr $0xc,%rdx 1f: 48 c1 e2 06 shl $0x6,%rdx 23: 48 03 15 fe 56 f5 03 add 0x3f556fe(%rip),%rdx # 0x3f55728 * 2a: 48 8b 4a 08 mov 0x8(%rdx),%rcx <-- trapping instruction 2e: 48 8d 71 ff lea -0x1(%rcx),%rsi 32: 83 e1 01 and $0x1,%ecx 35: b9 00 00 00 00 mov $0x0,%ecx 3a: 48 0f 45 d6 cmovne %rsi,%rdx 3e: 80 .byte 0x80 3f: 7a .byte 0x7a