loop5: detected capacity change from 0 to 40
program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO
==================================================================
BUG: KASAN: stack-out-of-bounds in _copy_to_iter+0x48f/0x1420
Read of size 4094 at addr ffff888045757b12 by task syz-executor.2/4246
CPU: 0 PID: 4246 Comm: syz-executor.2 Not tainted 5.19.0-rc6-next-20220711 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
print_report.cold+0x5e/0x5e1
kasan_report+0xb1/0x1b0
kasan_check_range+0x35/0x1b0
memcpy+0x20/0x60
_copy_to_iter+0x48f/0x1420
tty_read+0x29a/0x5d0
generic_file_splice_read+0x187/0x4d0
do_splice_to+0x1bc/0x240
splice_file_to_pipe+0x100/0x120
do_sendfile+0x42a/0x1270
__x64_sys_sendfile64+0x1cd/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f582f537b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f582caad188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f582f64af60 RCX: 00007f582f537b19
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f582f591f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd846d255f R14: 00007f582caad300 R15: 0000000000022000
The buggy address belongs to stack of task syz-executor.2/4246
and is located at offset 66 in frame:
tty_read+0x0/0x5d0
This frame has 2 objects:
[32, 40) 'cookie'
[64, 128) 'kernel_buf'
The buggy address belongs to the physical page:
page:000000001975ea36 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x45757
flags: 0x100000000000000(node=0|zone=1)
raw: 0100000000000000 0000000000000000 ffffea000115d5c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888045757a00: 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
ffff888045757a80: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2
>ffff888045757b00: f2 f2 00 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00
^
ffff888045757b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1
ffff888045757c00: f1 f1 f1 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
==================================================================
program syz-executor.3 is using a deprecated SCSI ioctl, please convert it to SG_IO
syz-executor.5: attempt to access beyond end of device
loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
Buffer I/O error on dev loop5, logical block 10, lost async page write
loop5: detected capacity change from 0 to 40
syz-executor.5: attempt to access beyond end of device
loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
Buffer I/O error on dev loop5, logical block 10, lost async page write
process 'syz-executor.2' launched '/dev/fd/-1/./file0' with NULL argv: empty string added
syz-executor.3 (4320): /proc/4319/oom_adj is deprecated, please use /proc/4319/oom_score_adj instead.
loop5: detected capacity change from 0 to 8
FAT-fs (loop5): bogus logical sector size 2049
FAT-fs (loop5): Can't find a valid FAT filesystem
loop5: detected capacity change from 0 to 8
FAT-fs (loop5): bogus logical sector size 2049
FAT-fs (loop5): Can't find a valid FAT filesystem
random: crng reseeded on system resumption
random: crng reseeded on system resumption
audit: type=1401 audit(1657552396.262:9): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:kernel_t:s0 newcontext=system_u:object_r:var_auth_t:s0
loop6: detected capacity change from 0 to 256
FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
loop6: detected capacity change from 0 to 256
FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
loop6: detected capacity change from 0 to 256
FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
loop6: detected capacity change from 0 to 256
FAT-fs (loop6): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
syz-executor.2 (4650) used greatest stack depth: 23704 bytes left
EXT4-fs: Cannot specify journal on remount
EXT4-fs: Cannot specify journal on remount
capability: warning: `syz-executor.1' uses 32-bit capabilities (legacy support in use)
netlink: 4612 bytes leftover after parsing attributes in process `syz-executor.3'.
syz-executor.0 (4801) used greatest stack depth: 23640 bytes left
audit: type=1401 audit(1657552400.183:10): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:kernel_t:s0 newcontext=system_u:object_r:var_auth_t:s0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4841 at lib/iov_iter.c:1026 iov_iter_pipe+0x23c/0x2b0
audit: type=1400 audit(1657552400.250:11): avc: denied { write } for pid=4831 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
Modules linked in:
CPU: 0 PID: 4841 Comm: syz-executor.1 Tainted: G B 5.19.0-rc6-next-20220711 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:iov_iter_pipe+0x23c/0x2b0
Code: 83 c0 03 38 d0 7c 04 84 d2 75 30 44 89 63 24 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 fb 04 3f ff 0f 0b e8 f4 04 3f ff <0f> 0b e9 ac fe ff ff e8 48 40 71 ff e9 1b fe ff ff e8 ae 40 71 ff
RSP: 0018:ffff888019bff9d8 EFLAGS: 00010216
RAX: 000000000000f123 RBX: ffff888019bffa68 RCX: ffffc90000823000
RDX: 0000000000040000 RSI: ffffffff8205786c RDI: 0000000000000004
RBP: ffff888044879400 R08: 0000000000000004 R09: 0000000000000010
R10: 0000000000000010 R11: 0000000000000001 R12: 0000000000000010
R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000010
FS: 00007efc56e5e700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdb2dd70718 CR3: 0000000043048000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
generic_file_splice_read+0x95/0x4d0
do_splice_to+0x1bc/0x240
splice_direct_to_actor+0x2ac/0x8c0
do_splice_direct+0x1b8/0x280
do_sendfile+0xb19/0x1270
__x64_sys_sendfile64+0x1cd/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7efc598e8b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efc56e5e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007efc599fbf60 RCX: 00007efc598e8b19
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
RBP: 00007efc59942f6d R08: 0000000000000000 R09: 0000000000000000
R10: 000000010000027f R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffc6b678df R14: 00007efc56e5e300 R15: 0000000000022000
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [] copy_process+0x1db6/0x6d60
softirqs last enabled at (0): [] copy_process+0x1dfa/0x6d60
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---
audit: type=1401 audit(1657552400.567:12): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:kernel_t:s0 newcontext=system_u:object_r:var_auth_t:s0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4869 at lib/iov_iter.c:1026 iov_iter_pipe+0x23c/0x2b0
Modules linked in:
CPU: 0 PID: 4869 Comm: syz-executor.1 Tainted: G B W 5.19.0-rc6-next-20220711 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:iov_iter_pipe+0x23c/0x2b0
Code: 83 c0 03 38 d0 7c 04 84 d2 75 30 44 89 63 24 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 fb 04 3f ff 0f 0b e8 f4 04 3f ff <0f> 0b e9 ac fe ff ff e8 48 40 71 ff e9 1b fe ff ff e8 ae 40 71 ff
RSP: 0018:ffff8880441c79d8 EFLAGS: 00010216
RAX: 000000000000eafa RBX: ffff8880441c7a68 RCX: ffffc90000823000
RDX: 0000000000040000 RSI: ffffffff8205786c RDI: 0000000000000004
RBP: ffff88804487a000 R08: 0000000000000004 R09: 0000000000000010
R10: 0000000000000010 R11: 0000000000000001 R12: 0000000000000010
R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000010
FS: 00007efc56e5e700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020003038 CR3: 000000001acda000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
generic_file_splice_read+0x95/0x4d0
do_splice_to+0x1bc/0x240
splice_direct_to_actor+0x2ac/0x8c0
do_splice_direct+0x1b8/0x280
do_sendfile+0xb19/0x1270
__x64_sys_sendfile64+0x1cd/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7efc598e8b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efc56e5e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007efc599fbf60 RCX: 00007efc598e8b19
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
RBP: 00007efc59942f6d R08: 0000000000000000 R09: 0000000000000000
R10: 000000010000027f R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffc6b678df R14: 00007efc56e5e300 R15: 0000000000022000
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [] copy_process+0x1db6/0x6d60
softirqs last enabled at (0): [] copy_process+0x1dfa/0x6d60
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---
Bluetooth: hci0: command 0x0401 tx timeout
audit: type=1326 audit(1657552400.955:13): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=4882 comm="syz-executor.7" exe="/syz-executor.7" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff0f21d5b19 code=0x0
audit: type=1401 audit(1657552400.967:14): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:kernel_t:s0 newcontext=system_u:object_r:var_auth_t:s0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4874 at lib/iov_iter.c:1026 iov_iter_pipe+0x23c/0x2b0
Modules linked in:
CPU: 0 PID: 4874 Comm: syz-executor.1 Tainted: G B W 5.19.0-rc6-next-20220711 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:iov_iter_pipe+0x23c/0x2b0
Code: 83 c0 03 38 d0 7c 04 84 d2 75 30 44 89 63 24 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 fb 04 3f ff 0f 0b e8 f4 04 3f ff <0f> 0b e9 ac fe ff ff e8 48 40 71 ff e9 1b fe ff ff e8 ae 40 71 ff
RSP: 0018:ffff88801f4979d8 EFLAGS: 00010216
RAX: 000000000000f4be RBX: ffff88801f497a68 RCX: ffffc90000823000
RDX: 0000000000040000 RSI: ffffffff8205786c RDI: 0000000000000004
RBP: ffff888018709400 R08: 0000000000000004 R09: 0000000000000010
R10: 0000000000000010 R11: 0000000000000001 R12: 0000000000000010
R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000010
FS: 00007efc56e5e700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020003038 CR3: 00000000452ce000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
generic_file_splice_read+0x95/0x4d0
do_splice_to+0x1bc/0x240
splice_direct_to_actor+0x2ac/0x8c0
do_splice_direct+0x1b8/0x280
do_sendfile+0xb19/0x1270
__x64_sys_sendfile64+0x1cd/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7efc598e8b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efc56e5e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007efc599fbf60 RCX: 00007efc598e8b19
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
RBP: 00007efc59942f6d R08: 0000000000000000 R09: 0000000000000000
R10: 000000010000027f R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffc6b678df R14: 00007efc56e5e300 R15: 0000000000022000
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [] copy_process+0x1db6/0x6d60
softirqs last enabled at (0): [] copy_process+0x1dfa/0x6d60
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---