sg_write: data in/out 917468/251 bytes for SCSI command 0x0-- guessing data in; program syz-executor.3 not setting count and/or reply_len properly ------------[ cut here ]------------ WARNING: CPU: 0 PID: 28226 at lib/iov_iter.c:629 _copy_from_iter+0x2b2/0x1140 Modules linked in: CPU: 0 PID: 28226 Comm: syz-executor.3 Not tainted 6.2.0-rc7-next-20230206 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:_copy_from_iter+0x2b2/0x1140 Code: 5d 41 5e 41 5f e9 d2 68 33 02 e8 a9 49 36 ff be 79 02 00 00 48 c7 c7 c0 c7 9e 84 e8 b8 01 5a ff e9 51 fe ff ff e8 8e 49 36 ff <0f> 0b 45 31 f6 eb 87 e8 82 49 36 ff 31 ff 89 ee e8 e9 44 36 ff 40 RSP: 0018:ffff88804646f608 EFLAGS: 00010216 RAX: 00000000000066e8 RBX: 0000000000000000 RCX: ffffc900021e8000 RDX: 0000000000040000 RSI: ffffffff82151252 RDI: 0000000000000001 RBP: 0000000000001000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: ffff88804646f838 R14: 0000000000001000 R15: ffff88804646f838 FS: 00007f5acd40e700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f050e89d3a4 CR3: 000000004c704000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000600 Call Trace: copy_page_from_iter+0x251/0x430 blk_rq_map_user_iov+0xb41/0x16c0 blk_rq_map_user_io+0x1d1/0x200 sg_common_write.constprop.0+0xd8d/0x15f0 sg_write.part.0+0x698/0xac0 sg_write+0x8d/0xe0 vfs_write+0x2cf/0xdc0 ksys_write+0x12b/0x260 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f5acfe98b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5acd40e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5acffabf60 RCX: 00007f5acfe98b19 RDX: 0000000000000125 RSI: 00000000200003c0 RDI: 0000000000000005 RBP: 00007f5acfef2f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc96b9ab8f R14: 00007f5acd40e300 R15: 0000000000022000 irq event stamp: 8773 hardirqs last enabled at (8815): [] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (8854): [] sysvec_apic_timer_interrupt+0xf/0x90 softirqs last enabled at (5576): [] __irq_exit_rcu+0xcc/0x110 softirqs last disabled at (5549): [] __irq_exit_rcu+0xcc/0x110 ---[ end trace 0000000000000000 ]--- sg_write: data in/out 917468/251 bytes for SCSI command 0x0-- guessing data in; program syz-executor.3 not setting count and/or reply_len properly sg_write: data in/out 917468/251 bytes for SCSI command 0x0-- guessing data in; program syz-executor.3 not setting count and/or reply_len properly netlink: 4 bytes leftover after parsing attributes in process `syz-executor.6'. random: crng reseeded on system resumption random: crng reseeded on system resumption random: crng reseeded on system resumption random: crng reseeded on system resumption random: crng reseeded on system resumption device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode device lo entered promiscuous mode netlink: 4 bytes leftover after parsing attributes in process `syz-executor.7'.