program syz-executor.0 not setting count and/or reply_len properly FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 1 CPU: 0 PID: 6125 Comm: syz-executor.2 Not tainted 6.0.0-rc1-next-20220822 #1 BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1521 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 6125, name: syz-executor.2 preempt_count: 0, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by syz-executor.2/6125: #0: ffff88801efc5268 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe7/0x100 irq event stamp: 364 hardirqs last enabled at (363): [] __up_console_sem+0x78/0x80 hardirqs last disabled at (364): [] dump_stack_lvl+0x2e/0xb3 softirqs last enabled at (358): [] __irq_exit_rcu+0x11b/0x180 softirqs last disabled at (327): [] __irq_exit_rcu+0x11b/0x180 CPU: 0 PID: 6125 Comm: syz-executor.2 Not tainted 6.0.0-rc1-next-20220822 #1 FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 1 CPU: 0 PID: 6120 Comm: syz-executor.5 Not tainted 6.0.0-rc1-next-20220822 #1 syz-executor.5[6120] cmdline: /syz-executor.5 exec Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x8b/0xb3 should_fail.cold+0x5/0xa _copy_to_user+0x2a/0x140 simple_read_from_buffer+0xcc/0x160 proc_fail_nth_read+0x198/0x230 vfs_read+0x253/0x930 ksys_read+0x127/0x250 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fc8d1cd069c Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 RSP: 002b:00007fc8cf293170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007fc8d1cd069c RDX: 000000000000000f RSI: 00007fc8cf2931e0 RDI: 0000000000000004 RBP: 00007fc8cf2931d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff2365328f R14: 00007fc8cf293300 R15: 0000000000022000 syz-executor.2[6125] cmdline: /syz-executor.2 exec Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x8b/0xb3 __might_resched.cold+0x222/0x26b down_read_killable+0x75/0x490 __access_remote_vm+0xac/0x6f0 get_mm_cmdline.part.0+0x214/0x600 FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 6130 Comm: syz-executor.4 Not tainted 6.0.0-rc1-next-20220822 #1 get_task_cmdline_kernel+0x1e9/0x230 dump_stack_print_cmdline.part.0+0x82/0x150 syz-executor.4[6130] cmdline: /syz-executor.4 exec Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_print_info+0x185/0x190 dump_stack_lvl+0x8b/0xb3 dump_stack_lvl+0x7f/0xb3 should_fail.cold+0x5/0xa should_fail.cold+0x5/0xa _copy_to_user+0x2a/0x140 _copy_to_user+0x2a/0x140 simple_read_from_buffer+0xcc/0x160 simple_read_from_buffer+0xcc/0x160 proc_fail_nth_read+0x198/0x230 proc_fail_nth_read+0x198/0x230 vfs_read+0x253/0x930 vfs_read+0x253/0x930 ksys_read+0x127/0x250 ksys_read+0x127/0x250 do_syscall_64+0x3b/0x90 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f946bba869c RIP: 0033:0x7efd5d9bb69c Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 RSP: 002b:00007f946914a170 EFLAGS: 00000246 RSP: 002b:00007efd5af7e170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efd5d9bb69c RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f946bba869c RDX: 000000000000000f RSI: 00007efd5af7e1e0 RDI: 0000000000000004 RDX: 000000000000000f RSI: 00007f946914a1e0 RDI: 0000000000000004 RBP: 00007efd5af7e1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 RBP: 00007f946914a1d0 R08: 0000000000000000 R09: 0000000000000000 R13: 00007ffe3cc3b14f R14: 00007efd5af7e300 R15: 0000000000022000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffd069b121f R14: 00007f946914a300 R15: 0000000000022000 syz-executor.2[6125] cmdline: /syz-executor.2 exec Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x8b/0xb3 should_fail.cold+0x5/0xa _copy_to_user+0x2a/0x140 simple_read_from_buffer+0xcc/0x160 proc_fail_nth_read+0x198/0x230 vfs_read+0x253/0x930 ksys_read+0x127/0x250 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7efd5d9bb69c Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 RSP: 002b:00007efd5af7e170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efd5d9bb69c RDX: 000000000000000f RSI: 00007efd5af7e1e0 RDI: 0000000000000004 RBP: 00007efd5af7e1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffe3cc3b14f R14: 00007efd5af7e300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 6133 Comm: syz-executor.3 Tainted: G W 6.0.0-rc1-next-20220822 #1 syz-executor.3[6133] cmdline: /syz-executor.3 exec Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x8b/0xb3 should_fail.cold+0x5/0xa _copy_to_user+0x2a/0x140 simple_read_from_buffer+0xcc/0x160 proc_fail_nth_read+0x198/0x230 vfs_read+0x253/0x930 ksys_read+0x127/0x250 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd50a7e169c Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 RSP: 002b:00007fd507da4170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd50a7e169c RDX: 000000000000000f RSI: 00007fd507da41e0 RDI: 0000000000000005 RBP: 00007fd507da41d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffeb0c32ebf R14: 00007fd507da4300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 6144 Comm: syz-executor.1 Tainted: G W 6.0.0-rc1-next-20220822 #1 sg_write: data in/out 2012/251 bytes for SCSI command 0x0-- guessing data in; program syz-executor.0 not setting count and/or reply_len properly syz-executor.1[6144] cmdline: /syz-executor.1 exec Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x8b/0xb3 should_fail.cold+0x5/0xa _copy_to_user+0x2a/0x140 simple_read_from_buffer+0xcc/0x160 proc_fail_nth_read+0x198/0x230 vfs_read+0x253/0x930 ksys_read+0x127/0x250 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fb7f742c69c Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 RSP: 002b:00007fb7f49ef170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb7f742c69c RDX: 000000000000000f RSI: 00007fb7f49ef1e0 RDI: 0000000000000004 RBP: 00007fb7f49ef1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffe82354cdf R14: 00007fb7f49ef300 R15: 0000000000022000 blktrace: Concurrent blktraces are not allowed on sg0 sg_write: data in/out 2012/251 bytes for SCSI command 0x0-- guessing data in; program syz-executor.0 not setting count and/or reply_len properly blktrace: Concurrent blktraces are not allowed on sg0 ---------------- Code disassembly (best guess): 0: ec in (%dx),%al 1: 28 48 89 sub %cl,-0x77(%rax) 4: 54 push %rsp 5: 24 18 and $0x18,%al 7: 48 89 74 24 10 mov %rsi,0x10(%rsp) c: 89 7c 24 08 mov %edi,0x8(%rsp) 10: e8 f9 fc ff ff callq 0xfffffd0e 15: 48 8b 54 24 18 mov 0x18(%rsp),%rdx 1a: 48 8b 74 24 10 mov 0x10(%rsp),%rsi 1f: 41 89 c0 mov %eax,%r8d 22: 8b 7c 24 08 mov 0x8(%rsp),%edi 26: 31 c0 xor %eax,%eax 28: 0f 05 syscall * 2a: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 34 ja 0x66 32: 44 89 c7 mov %r8d,%edi 35: 48 89 44 24 08 mov %rax,0x8(%rsp) 3a: e8 2f fd ff ff callq 0xfffffd6e 3f: 48 rex.W