sg_write: data in/out 917468/251 bytes for SCSI command 0x0-- guessing data in;
program syz-executor.1 not setting count and/or reply_len properly
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4734 at lib/iov_iter.c:385 _copy_from_iter+0x2b2/0x1330
Modules linked in:
CPU: 0 PID: 4734 Comm: syz-executor.1 Not tainted 6.3.0-rc7-next-20230419 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:_copy_from_iter+0x2b2/0x1330
Code: 5d 41 5e 41 5f e9 82 a8 35 02 e8 e9 4a 36 ff be 85 01 00 00 48 c7 c7 a0 cf 9e 84 e8 38 5b 5a ff e9 51 fe ff ff e8 ce 4a 36 ff <0f> 0b 45 31 f6 eb 87 e8 c2 4a 36 ff 31 ff 89 ee e8 f9 45 36 ff 40
RSP: 0018:ffff8880164b7608 EFLAGS: 00010216
RAX: 0000000000003d54 RBX: 0000000000000000 RCX: ffffc90000be5000
RDX: 0000000000040000 RSI: ffffffff82158a22 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000001000
R13: ffff8880164b7838 R14: 0000000000001000 R15: ffff8880164b7838
FS: 00007f6cab7a2700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdf66ecd3a4 CR3: 000000000ebfc000 CR4: 0000000000350ef0
Call Trace:
copy_page_from_iter+0xe3/0x180
blk_rq_map_user_iov+0xb39/0x16c0
blk_rq_map_user_io+0x1d1/0x200
sg_common_write.constprop.0+0xd8d/0x15f0
sg_write.part.0+0x698/0xac0
sg_write+0x8d/0xe0
vfs_write+0x2d8/0xdd0
ksys_write+0x12b/0x260
do_syscall_64+0x3f/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f6cae22cb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6cab7a2188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f6cae33ff60 RCX: 00007f6cae22cb19
RDX: 0000000000000125 RSI: 00000000200003c0 RDI: 0000000000000004
RBP: 00007f6cae286f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff1b6edfdf R14: 00007f6cab7a2300 R15: 0000000000022000
irq event stamp: 8709
hardirqs last enabled at (8803): [] __up_console_sem+0x78/0x80
hardirqs last disabled at (8824): [] __up_console_sem+0x5d/0x80
softirqs last enabled at (6564): [] __irq_exit_rcu+0xcc/0x110
softirqs last disabled at (6369): [] __irq_exit_rcu+0xcc/0x110
---[ end trace 0000000000000000 ]---
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 4745 Comm: syz-executor.7 Tainted: G W 6.3.0-rc7-next-20230419 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xc1/0xf0
should_fail_ex+0x4b4/0x5b0
prepare_alloc_pages+0x178/0x500
loop6: detected capacity change from 0 to 15
__alloc_pages+0x149/0x480
vma_alloc_folio+0xe2/0x450
__handle_mm_fault+0xe73/0x3200
handle_mm_fault+0x2ce/0xb40
do_user_addr_fault+0x5f6/0x1310
exc_page_fault+0x9c/0x1a0
asm_exc_page_fault+0x26/0x30
RIP: 0010:copy_user_generic_string+0x30/0x50
Code: cb 83 fa 08 72 27 89 f9 83 e1 07 74 15 83 e9 08 f7 d9 29 ca 8a 06 88 07 48 ff c6 48 ff c7 ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 48 a5 89 d1 f3 a4 31 c0 0f 01 ca e9 c3 4c 03 00 8d 0c ca 89 ca
RSP: 0018:ffff888046247d30 EFLAGS: 00050246
RAX: 0000000000000001 RBX: 0000000000000030 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffff888046247d98 RDI: 0000000020000000
RBP: 0000000020000000 R08: 0000000000000000 R09: ffff888046247dc7
R10: ffffed1008c48fb8 R11: 0000000000000001 R12: 00007fffffffefd0
R13: ffff888046247d98 R14: fffffffffffffff2 R15: ffff8880159a2000
_copy_to_user+0x12d/0x150
ksys_shmctl.constprop.0+0x2d9/0x390
do_syscall_64+0x3f/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f4b1aafeb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4b18074188 EFLAGS: 00000246 ORIG_RAX: 000000000000001f
RAX: ffffffffffffffda RBX: 00007f4b1ac11f60 RCX: 00007f4b1aafeb19
RDX: 0000000020000000 RSI: 000000000000000e RDI: 0000000000000023
RBP: 00007f4b180741d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fff8738920f R14: 00007f4b18074300 R15: 0000000000022000
loop4: detected capacity change from 0 to 4
netlink: 'syz-executor.6': attribute type 4 has an invalid length.
EXT4-fs (loop4): VFS: Can't find ext4 filesystem
loop6: detected capacity change from 0 to 15
sg_write: data in/out 917468/251 bytes for SCSI command 0x0-- guessing data in;
program syz-executor.1 not setting count and/or reply_len properly
netlink: 'syz-executor.6': attribute type 4 has an invalid length.
----------------
Code disassembly (best guess):
0: cb lret
1: 83 fa 08 cmp $0x8,%edx
4: 72 27 jb 0x2d
6: 89 f9 mov %edi,%ecx
8: 83 e1 07 and $0x7,%ecx
b: 74 15 je 0x22
d: 83 e9 08 sub $0x8,%ecx
10: f7 d9 neg %ecx
12: 29 ca sub %ecx,%edx
14: 8a 06 mov (%rsi),%al
16: 88 07 mov %al,(%rdi)
18: 48 ff c6 inc %rsi
1b: 48 ff c7 inc %rdi
1e: ff c9 dec %ecx
20: 75 f2 jne 0x14
22: 89 d1 mov %edx,%ecx
24: c1 e9 03 shr $0x3,%ecx
27: 83 e2 07 and $0x7,%edx
* 2a: f3 48 a5 rep movsq %ds:(%rsi),%es:(%rdi) <-- trapping instruction
2d: 89 d1 mov %edx,%ecx
2f: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi)
31: 31 c0 xor %eax,%eax
33: 0f 01 ca clac
36: e9 c3 4c 03 00 jmpq 0x34cfe
3b: 8d 0c ca lea (%rdx,%rcx,8),%ecx
3e: 89 ca mov %ecx,%edx