==================================================================
BUG: KASAN: stack-out-of-bounds in _copy_to_iter+0x48f/0x1420
Read of size 4095 at addr ffff8880446f7b11 by task syz-executor.1/5467
CPU: 0 PID: 5467 Comm: syz-executor.1 Not tainted 5.19.0-rc6-next-20220712 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
print_report.cold+0x5e/0x5e1
kasan_report+0xb1/0x1b0
kasan_check_range+0x35/0x1b0
memcpy+0x20/0x60
_copy_to_iter+0x48f/0x1420
tty_read+0x29a/0x5d0
generic_file_splice_read+0x187/0x4d0
do_splice_to+0x1bc/0x240
splice_file_to_pipe+0x100/0x120
do_sendfile+0x42a/0x1270
__x64_sys_sendfile64+0x1cd/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f7622479b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f761f9ef188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f762258cf60 RCX: 00007f7622479b19
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004
RBP: 00007f76224d3f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc7810427f R14: 00007f761f9ef300 R15: 0000000000022000
The buggy address belongs to stack of task syz-executor.1/5467
and is located at offset 65 in frame:
tty_read+0x0/0x5d0
This frame has 2 objects:
[32, 40) 'cookie'
[64, 128) 'kernel_buf'
The buggy address belongs to the physical page:
page:000000007e67e02c refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x446f7
flags: 0x100000000000000(node=0|zone=1)
raw: 0100000000000000 0000000000000000 ffffea000111bdc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880446f7a00: 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
ffff8880446f7a80: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2
>ffff8880446f7b00: f2 f2 00 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00
^
ffff8880446f7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1
ffff8880446f7c00: f1 f1 f1 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
==================================================================
loop4: detected capacity change from 0 to 264192
audit: type=1400 audit(1657636560.432:10): avc: denied { module_load } for pid=5524 comm="syz-executor.0" path="/syz-executor.0" dev="sda" ino=15936 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=system permissive=1
loop4: detected capacity change from 0 to 512
Invalid ELF header type: 3 != 1
EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
ext4 filesystem being mounted at /syzkaller-testdir999865138/syzkaller.WwWNZ0/74/file0 supports timestamps until 2038 (0x7fffffff)
loop3: detected capacity change from 0 to 40
EXT4-fs (loop4): unmounting filesystem.
loop3: detected capacity change from 0 to 40
loop3: detected capacity change from 0 to 40
loop4: detected capacity change from 0 to 512
Invalid ELF header type: 3 != 1
EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
ext4 filesystem being mounted at /syzkaller-testdir999865138/syzkaller.WwWNZ0/75/file0 supports timestamps until 2038 (0x7fffffff)
Invalid ELF header type: 3 != 1
EXT4-fs (loop4): unmounting filesystem.
Invalid ELF header type: 3 != 1
loop4: detected capacity change from 0 to 512
EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
ext4 filesystem being mounted at /syzkaller-testdir999865138/syzkaller.WwWNZ0/76/file0 supports timestamps until 2038 (0x7fffffff)
Invalid ELF header type: 3 != 1
Invalid ELF header type: 3 != 1
Invalid ELF header type: 3 != 1
EXT4-fs (loop4): unmounting filesystem.
Invalid ELF header type: 3 != 1
loop4: detected capacity change from 0 to 512
EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
ext4 filesystem being mounted at /syzkaller-testdir999865138/syzkaller.WwWNZ0/77/file0 supports timestamps until 2038 (0x7fffffff)
Invalid ELF header type: 3 != 1
blktrace: Concurrent blktraces are not allowed on sg0
Invalid ELF header type: 3 != 1
Invalid ELF header type: 3 != 1
EXT4-fs (loop4): unmounting filesystem.
blktrace: Concurrent blktraces are not allowed on sg0
Invalid ELF header type: 3 != 1
Invalid ELF header type: 3 != 1
blktrace: Concurrent blktraces are not allowed on sg0
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
tmpfs: Bad value for 'mpol'
tmpfs: Bad value for 'mpol'
UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
misc raw-gadget: fail, usb_gadget_register_driver returned -16
syz-executor.5 uses obsolete (PF_INET,SOCK_PACKET)
audit: type=1400 audit(1657636568.204:11): avc: denied { read } for pid=5872 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
random: crng reseeded on system resumption
Restarting kernel threads ... done.
random: crng reseeded on system resumption
Restarting kernel threads ... done.
loop3: detected capacity change from 0 to 40
loop3: detected capacity change from 0 to 40
loop3: detected capacity change from 0 to 40
random: crng reseeded on system resumption
Restarting kernel threads ... done.
loop3: detected capacity change from 0 to 40
random: crng reseeded on system resumption
Restarting kernel threads ... done.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5990 at lib/iov_iter.c:1026 iov_iter_pipe+0x23c/0x2b0
Modules linked in:
CPU: 1 PID: 5990 Comm: syz-executor.6 Tainted: G B 5.19.0-rc6-next-20220712 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:iov_iter_pipe+0x23c/0x2b0
Code: 83 c0 03 38 d0 7c 04 84 d2 75 30 44 89 63 24 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 8b 03 3f ff 0f 0b e8 84 03 3f ff <0f> 0b e9 ac fe ff ff e8 a8 3e 71 ff e9 1b fe ff ff e8 0e 3f 71 ff
RSP: 0018:ffff88804975f9d8 EFLAGS: 00010212
RAX: 000000000000a21d RBX: ffff88804975fa68 RCX: ffffc900055f4000
RDX: 0000000000040000 RSI: ffffffff82057d4c RDI: 0000000000000004
RBP: ffff888043829000 R08: 0000000000000004 R09: 0000000000000010
R10: 0000000000000010 R11: 0000000000000001 R12: 0000000000000010
R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000010
FS: 00007f63cd35e700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2dd23000 CR3: 0000000048b82000 CR4: 0000000000350ee0
Call Trace:
generic_file_splice_read+0x95/0x4d0
do_splice_to+0x1bc/0x240
splice_direct_to_actor+0x2ac/0x8c0
do_splice_direct+0x1b8/0x280
do_sendfile+0xb19/0x1270
__x64_sys_sendfile64+0x1cd/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f63cfde8b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f63cd35e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f63cfefbf60 RCX: 00007f63cfde8b19
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003
RBP: 00007f63cfe42f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000100000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd0f74664f R14: 00007f63cd35e300 R15: 0000000000022000
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [] copy_process+0x1db6/0x6d60
softirqs last enabled at (0): [] copy_process+0x1dfa/0x6d60
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---