------------[ cut here ]------------
WARNING: CPU: 0 PID: 7874 at drivers/scsi/scsi_lib.c:1032 scsi_alloc_sgtables+0x9af/0xbb0 drivers/scsi/scsi_lib.c:1032
Modules linked in:
CPU: 0 PID: 7874 Comm: syz-executor.6 Not tainted 5.16.0-rc6-next-20211224 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
RIP: 0010:scsi_alloc_sgtables+0x9af/0xbb0 drivers/scsi/scsi_lib.c:1032
CPU: 1 PID: 7872 Comm: syz-executor.1 Not tainted 5.16.0-rc6-next-20211224 #1
Code: 48 c1 e8 03 80 3c 10 00 0f 85 54 01 00 00 48 c7 c0 00 00 00 80 48 2b 05 7f 41 40 02 48 89 04 24 e9 66 fd ff ff e8 c1 0b 94 fe <0f> 0b 41 bc 0a 00 00 00 e9 83 fa ff ff 41 bc 09 00 00 00 e9 78 fa
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
RSP: 0018:ffff8880183a7590 EFLAGS: 00010216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
fail_dump lib/fault-inject.c:52 [inline]
should_fail.cold+0x5/0xa lib/fault-inject.c:146
RAX: 0000000000000443 RBX: ffff88800def7440 RCX: ffffc90007c19000
_copy_from_user+0x2e/0x170 lib/usercopy.c:14
RDX: 0000000000040000 RSI: ffffffff82af132f RDI: 0000000000000003
copy_from_user include/linux/uaccess.h:192 [inline]
copy_struct_from_user include/linux/uaccess.h:371 [inline]
copy_clone_args_from_user+0x147/0x780 kernel/fork.c:2764
RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000000
R10: ffffffff82af12c2 R11: 0000000000000000 R12: ffff88800def735c
R13: ffff88800979a000 R14: ffff88800def7340 R15: 0000000000000001
FS: 00007fabbdbe4700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001600 CR3: 000000001d35a000 CR4: 0000000000350ef0
Call Trace:
__do_sys_clone3+0x96/0x2e0 kernel/fork.c:2888
scsi_setup_scsi_cmnd drivers/scsi/scsi_lib.c:1219 [inline]
scsi_prepare_cmd drivers/scsi/scsi_lib.c:1614 [inline]
scsi_queue_rq+0x251f/0x3140 drivers/scsi/scsi_lib.c:1730
blk_mq_dispatch_rq_list+0x6c2/0x2170 block/blk-mq.c:1851
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f99eb3eeb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
__blk_mq_sched_dispatch_requests+0x20b/0x410 block/blk-mq-sched.c:299
RSP: 002b:00007f99e8964188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f99eb501f60 RCX: 00007f99eb3eeb19
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000640
RBP: 00007f99e89641d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffdce7f7d6f R14: 00007f99e8964300 R15: 0000000000022000
blk_mq_sched_dispatch_requests+0xfb/0x180 block/blk-mq-sched.c:332
__blk_mq_run_hw_queue+0xf9/0x350 block/blk-mq.c:1968
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
__blk_mq_delay_run_hw_queue+0x584/0x660 block/blk-mq.c:2045
CPU: 1 PID: 7873 Comm: syz-executor.7 Not tainted 5.16.0-rc6-next-20211224 #1
blk_mq_run_hw_queue+0x30f/0x480 block/blk-mq.c:2096
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
blk_mq_sched_insert_request+0x2e5/0x3e0 block/blk-mq-sched.c:451
fail_dump lib/fault-inject.c:52 [inline]
should_fail.cold+0x5/0xa lib/fault-inject.c:146
should_failslab+0x5/0x10 mm/slab_common.c:1304
slab_pre_alloc_hook mm/slab.h:716 [inline]
slab_alloc_node mm/slub.c:3144 [inline]
slab_alloc mm/slub.c:3238 [inline]
__kmalloc+0x72/0x440 mm/slub.c:4420
kmalloc include/linux/slab.h:586 [inline]
kzalloc include/linux/slab.h:715 [inline]
lsm_cred_alloc security/security.c:537 [inline]
security_prepare_creds+0x10a/0x180 security/security.c:1684
prepare_creds+0x505/0x6f0 kernel/cred.c:291
blk_execute_rq+0xcc/0x340 block/blk-mq.c:1231
copy_creds+0x72/0x930 kernel/cred.c:365
copy_process+0x10d5/0x6e20 kernel/fork.c:2043
sg_io+0x67c/0x1210 drivers/scsi/scsi_ioctl.c:485
kernel_clone+0xe7/0xa60 kernel/fork.c:2620
scsi_ioctl_sg_io drivers/scsi/scsi_ioctl.c:866 [inline]
scsi_ioctl+0x52b/0x1580 drivers/scsi/scsi_ioctl.c:921
__do_sys_clone3+0x1d5/0x2e0 kernel/fork.c:2895
sr_block_ioctl+0x1cb/0x210 drivers/scsi/sr.c:586
blkdev_ioctl+0x362/0x7f0 block/ioctl.c:588
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f63cd555b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x196/0x210 fs/ioctl.c:860
RSP: 002b:00007f63caacb188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
RAX: ffffffffffffffda RBX: 00007f63cd668f60 RCX: 00007f63cd555b19
entry_SYSCALL_64_after_hwframe+0x44/0xae
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000640
RIP: 0033:0x7fabc066eb19
RBP: 00007f63caacb1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
R13: 00007ffc9a22b1ef R14: 00007f63caacb300 R15: 0000000000022000
RSP: 002b:00007fabbdbe4188 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fabc0781f60 RCX: 00007fabc066eb19
RDX: 00000000200001c0 RSI: 0000000000002285 RDI: 0000000000000003
RBP: 00007fabc06c8f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffde3a65ddf R14: 00007fabbdbe4300 R15: 0000000000022000
irq event stamp: 2169
hardirqs last enabled at (2181): [] __up_console_sem+0x78/0x80 kernel/printk/printk.c:256
hardirqs last disabled at (2192): [] __up_console_sem+0x5d/0x80 kernel/printk/printk.c:254
softirqs last enabled at (1244): [] invoke_softirq kernel/softirq.c:432 [inline]
softirqs last enabled at (1244): [] __irq_exit_rcu+0x113/0x170 kernel/softirq.c:637
softirqs last disabled at (1059): [] invoke_softirq kernel/softirq.c:432 [inline]
softirqs last disabled at (1059): [] __irq_exit_rcu+0x113/0x170 kernel/softirq.c:637
---[ end trace 0000000000000000 ]---
cgroup: Unknown subsys name '!¹í PQž'
EXT4-fs: Invalid gid value -1
ext4: Unknown parameter 'hash'
cgroup: Unknown subsys name '!¹í PQž'
EXT4-fs: Invalid gid value -1
ext4: Unknown parameter 'hash'
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7893 Comm: syz-executor.2 Tainted: G W 5.16.0-rc6-next-20211224 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
fail_dump lib/fault-inject.c:52 [inline]
should_fail.cold+0x5/0xa lib/fault-inject.c:146
should_failslab+0x5/0x10 mm/slab_common.c:1304
slab_pre_alloc_hook mm/slab.h:716 [inline]
slab_alloc_node mm/slub.c:3144 [inline]
slab_alloc mm/slub.c:3238 [inline]
kmem_cache_alloc+0x5b/0x480 mm/slub.c:3243
kmem_cache_zalloc include/linux/slab.h:705 [inline]
copy_signal kernel/fork.c:1624 [inline]
copy_process+0x1fb8/0x6e20 kernel/fork.c:2173
kernel_clone+0xe7/0xa60 kernel/fork.c:2620
__do_sys_clone3+0x1d5/0x2e0 kernel/fork.c:2895
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f7b54587b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7b51afd188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f7b5469af60 RCX: 00007f7b54587b19
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000640
RBP: 00007f7b51afd1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffda2e75d5f R14: 00007f7b51afd300 R15: 0000000000022000
CPU: 0 PID: 7894 Comm: syz-executor.1 Tainted: G W 5.16.0-rc6-next-20211224 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
fail_dump lib/fault-inject.c:52 [inline]
should_fail.cold+0x5/0xa lib/fault-inject.c:146
should_failslab+0x5/0x10 mm/slab_common.c:1304
slab_pre_alloc_hook mm/slab.h:716 [inline]
slab_alloc_node mm/slub.c:3144 [inline]
kmem_cache_alloc_node+0x55/0x490 mm/slub.c:3266
alloc_task_struct_node kernel/fork.c:171 [inline]
dup_task_struct kernel/fork.c:885 [inline]
copy_process+0x3011/0x6e20 kernel/fork.c:2006
kernel_clone+0xe7/0xa60 kernel/fork.c:2620
__do_sys_clone3+0x1d5/0x2e0 kernel/fork.c:2895
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f99eb3eeb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f99e8964188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f99eb501f60 RCX: 00007f99eb3eeb19
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000640
RBP: 00007f99e89641d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffdce7f7d6f R14: 00007f99e8964300 R15: 0000000000022000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 7907 Comm: syz-executor.1 Tainted: G W 5.16.0-rc6-next-20211224 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
fail_dump lib/fault-inject.c:52 [inline]
should_fail.cold+0x5/0xa lib/fault-inject.c:146
should_failslab+0x5/0x10 mm/slab_common.c:1304
slab_pre_alloc_hook mm/slab.h:716 [inline]
slab_alloc_node mm/slub.c:3144 [inline]
slab_alloc mm/slub.c:3238 [inline]
kmem_cache_alloc+0x5b/0x480 mm/slub.c:3243
mem_pool_alloc mm/kmemleak.c:430 [inline]
create_object.isra.0+0x3a/0xa20 mm/kmemleak.c:586
kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
slab_post_alloc_hook mm/slab.h:744 [inline]
slab_alloc_node mm/slub.c:3230 [inline]
kmem_cache_alloc_node+0x248/0x490 mm/slub.c:3266
alloc_task_struct_node kernel/fork.c:171 [inline]
dup_task_struct kernel/fork.c:885 [inline]
copy_process+0x3011/0x6e20 kernel/fork.c:2006
kernel_clone+0xe7/0xa60 kernel/fork.c:2620
__do_sys_clone3+0x1d5/0x2e0 kernel/fork.c:2895
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f99eb3eeb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f99e8964188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f99eb501f60 RCX: 00007f99eb3eeb19
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000640
RBP: 00007f99e89641d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffdce7f7d6f R14: 00007f99e8964300 R15: 0000000000022000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7910 Comm: syz-executor.2 Tainted: G W 5.16.0-rc6-next-20211224 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
fail_dump lib/fault-inject.c:52 [inline]
should_fail.cold+0x5/0xa lib/fault-inject.c:146
should_failslab+0x5/0x10 mm/slab_common.c:1304
slab_pre_alloc_hook mm/slab.h:716 [inline]
slab_alloc_node mm/slub.c:3144 [inline]
slab_alloc mm/slub.c:3238 [inline]
kmem_cache_alloc+0x5b/0x480 mm/slub.c:3243
mem_pool_alloc mm/kmemleak.c:430 [inline]
create_object.isra.0+0x3a/0xa20 mm/kmemleak.c:586
kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
slab_post_alloc_hook mm/slab.h:744 [inline]
slab_alloc_node mm/slub.c:3230 [inline]
slab_alloc mm/slub.c:3238 [inline]
kmem_cache_alloc+0x239/0x480 mm/slub.c:3243
kmem_cache_zalloc include/linux/slab.h:705 [inline]
copy_signal kernel/fork.c:1624 [inline]
copy_process+0x1fb8/0x6e20 kernel/fork.c:2173
kernel_clone+0xe7/0xa60 kernel/fork.c:2620
__do_sys_clone3+0x1d5/0x2e0 kernel/fork.c:2895
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f7b54587b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7b51afd188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f7b5469af60 RCX: 00007f7b54587b19
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000640
RBP: 00007f7b51afd1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffda2e75d5f R14: 00007f7b51afd300 R15: 0000000000022000
----------------
Code disassembly (best guess), 1 bytes skipped:
0: ff c3 inc %ebx
2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
9: 00 00 00
c: 0f 1f 40 00 nopl 0x0(%rax)
10: 48 89 f8 mov %rdi,%rax
13: 48 89 f7 mov %rsi,%rdi
16: 48 89 d6 mov %rdx,%rsi
19: 48 89 ca mov %rcx,%rdx
1c: 4d 89 c2 mov %r8,%r10
1f: 4d 89 c8 mov %r9,%r8
22: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
27: 0f 05 syscall
* 29: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
2f: 73 01 jae 0x32
31: c3 retq
32: 48 c7 c1 bc ff ff ff mov $0xffffffffffffffbc,%rcx
39: f7 d8 neg %eax
3b: 64 89 01 mov %eax,%fs:(%rcx)
3e: 48 rex.W