general protection fault in sg_read

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: d63fdf61 Merge 4.4.120 into android-4.4
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=17372533800000
kernel config: https://syzkaller.appspot.com/x/.config?x=b36b3c05dfb8e06d
dashboard link: https://syzkaller.appspot.com/bug?extid=70d1e7619807e2901081
compiler: gcc (GCC) 7.1.1 20170620
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13885093800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12cf7093800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+70d1e7...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
IPVS: Creating netns size=2552 id=3
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3738 Comm: syzkaller258683 Not tainted 4.4.120-gd63fdf6 #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8800adff4800 task.stack: ffff8801d9228000
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
RIP: 0010:[<ffffffff825bab57>] [<ffffffff825bab57>] sg_read_oxfer
drivers/scsi/sg.c:1976 [inline]
RIP: 0010:[<ffffffff825bab57>] [<ffffffff825bab57>] sg_read+0xd17/0x1490
drivers/scsi/sg.c:530
RSP: 0018:ffff8801d922fbc0 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff825bab1e
RDX: 0000000000000000 RSI: 0000000020000024 RDI: ffff8800ad5ba270
RBP: ffff8801d922fcd0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 1ffff1003b245f3e R12: 0000000000000076
R13: 0000000000000000 R14: ffff8801d0164060 R15: ffff8800ad5ba240
FS: 00007f82ddc77700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000025525c0 CR3: 00000000b1f8a000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
0000000000000000 0000000000000000 0000000000000000 ffff8800ad5ba258
0000000000000000 ffff8800ad5ba268 000000000000009a 0000000000000000
ffff8801d4b12500 0000000000001000 1ffff1003b245f84 0000000020000024
Call Trace:
[<ffffffff8151cf33>] __vfs_read+0x103/0x440 fs/read_write.c:432
[<ffffffff8151edd3>] vfs_read+0x123/0x3a0 fs/read_write.c:454
[<ffffffff81521719>] SYSC_read fs/read_write.c:569 [inline]
[<ffffffff81521719>] SyS_read+0xd9/0x1b0 fs/read_write.c:562
[<ffffffff8377395f>] entry_SYSCALL_64_fastpath+0x1c/0x98
Code: 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 97 06 00 00 48
b8 00 00 00 00 00 fc ff df 49 8b 5f 28 48 89 da 48 c1 ea 03 <80> 3c 02 00
0f 85 6b 06 00 00 48 8b 1b 48 85 db 0f 84 3b 03 00
RIP [<ffffffff825bab57>] sg_read_oxfer drivers/scsi/sg.c:1976 [inline]
RIP [<ffffffff825bab57>] sg_read+0xd17/0x1490 drivers/scsi/sg.c:530
RSP <ffff8801d922fbc0>
general protection fault: 0000 [#2] [ 27.836986] ---[ end trace
1695d5206311e472 ]---
Kernel panic - not syncing: Fatal exception
PREEMPT SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3740 Comm: syzkaller258683 Tainted: G D
4.4.120-gd63fdf6 #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8801d925b000 task.stack: ffff8801d97e0000
RIP: 0010:[<ffffffff825bab57>] [<ffffffff825bab57>] sg_read_oxfer
drivers/scsi/sg.c:1976 [inline]
RIP: 0010:[<ffffffff825bab57>] [<ffffffff825bab57>] sg_read+0xd17/0x1490
drivers/scsi/sg.c:530
RSP: 0018:ffff8801d97e7bc0 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff825bab1e
RDX: 0000000000000000 RSI: 0000000020000024 RDI: ffff8801d9754370
RBP: ffff8801d97e7cd0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 1ffff1003b2fcf3e R12: 0000000000000076
R13: 0000000000000000 R14: ffff8801d0ce2a80 R15: ffff8801d9754340
FS: 00007f82ddc56700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f82ddc55e78 CR3: 00000000b1f8a000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
0000000000000000 0000000000000000 0000000000000000 ffff8801d9754358
0000000000000000 ffff8801d9754368 000000000000009a 0000000000000000
ffff8801d4b12500 0000000000001000 1ffff1003b2fcf84 0000000020000024
Call Trace:
[<ffffffff8151cf33>] __vfs_read+0x103/0x440 fs/read_write.c:432
[<ffffffff8151edd3>] vfs_read+0x123/0x3a0 fs/read_write.c:454
[<ffffffff81521719>] SYSC_read fs/read_write.c:569 [inline]
[<ffffffff81521719>] SyS_read+0xd9/0x1b0 fs/read_write.c:562
[<ffffffff8377395f>] entry_SYSCALL_64_fastpath+0x1c/0x98
Code: 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 97 06 00 00 48
b8 00 00 00 00 00 fc ff df 49 8b 5f 28 48 89 da 48 c1 ea 03 <80> 3c 02 00
0f 85 6b 06 00 00 48 8b 1b 48 85 db 0f 84 3b 03 00
RIP [<ffffffff825bab57>] sg_read_oxfer drivers/scsi/sg.c:1976 [inline]
RIP [<ffffffff825bab57>] sg_read+0xd17/0x1490 drivers/scsi/sg.c:530
RSP <ffff8801d97e7bc0>
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches