general protection fault in __free_pages

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 38f41ec1 Merge 4.4.125 into android-4.4
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=1702199b800000
kernel config: https://syzkaller.appspot.com/x/.config?x=d3227609e1874daa
dashboard link: https://syzkaller.appspot.com/bug?extid=4d1772fddd13bab3cade
compiler: gcc (GCC) 7.1.1 20170620
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15a9091b800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=123e719b800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4d1772...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read, 116 bits of
entropy available)
random: sshd: uninitialized urandom read (32 bytes read, 119 bits of
entropy available)
random: sshd: uninitialized urandom read (32 bytes read, 125 bits of
entropy available)
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3698 Comm: syzkaller418695 Not tainted 4.4.125-g38f41ec #63
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8801cbb5c800 task.stack: ffff8801d4dc8000
RIP: 0010:[<ffffffff81435041>] [<ffffffff81435041>] __read_once_size
include/linux/compiler.h:218 [inline]
RIP: 0010:[<ffffffff81435041>] [<ffffffff81435041>] atomic_read
arch/x86/include/asm/atomic.h:27 [inline]
RIP: 0010:[<ffffffff81435041>] [<ffffffff81435041>] put_page_testzero
include/linux/mm.h:357 [inline]
RIP: 0010:[<ffffffff81435041>] [<ffffffff81435041>] __free_pages+0x21/0x90
mm/page_alloc.c:3365
RSP: 0018:ffff8801d4dcf9e8 EFLAGS: 00010a07
RAX: dffffc0000000000 RBX: dead4ead00000000 RCX: ffffffff825bb1fb
RDX: 1bd5a9d5a0000003 RSI: 0000000000000006 RDI: dead4ead0000001c
RBP: ffff8801d4dcf9f8 R08: 0000000048000000 R09: 0000000000001e30
R10: 0000000000002100 R11: 1ffff1003a9b9f1a R12: 0000000000000004
R13: 0000000000000020 R14: ffff8801ca484200 R15: dffffc0000000000
FS: 00007f894431d700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020e94000 CR3: 00000001cd9b2000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
0000000000000246 ffff8801ca484358 ffff8801d4dcfa58 ffffffff825bb221
ffff8801ca484370 ffffed003949086b ffffed003949086e ffff8801ca484368
dead4ead00000000 ffff8801ca484340 0000000000000000 0000000000000000
Call Trace:
[<ffffffff825bb221>] sg_remove_scat.isra.17+0x1c1/0x2d0
drivers/scsi/sg.c:1956
[<ffffffff825bb5d6>] sg_finish_rem_req+0x2a6/0x320 drivers/scsi/sg.c:1839
[<ffffffff825bb7db>] sg_new_read+0x18b/0x420 drivers/scsi/sg.c:578
[<ffffffff825bd35f>] sg_read+0x8cf/0x14d0 drivers/scsi/sg.c:466
[<ffffffff8151e141>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:680
[<ffffffff8152049d>] do_readv_writev+0x5dd/0x6e0 fs/read_write.c:810
[<ffffffff81520618>] vfs_readv+0x78/0xb0 fs/read_write.c:834
[<ffffffff81522949>] SYSC_readv fs/read_write.c:860 [inline]
[<ffffffff81522949>] SyS_readv+0xd9/0x240 fs/read_write.c:852
[<ffffffff83779965>] entry_SYSCALL_64_fastpath+0x22/0x9e
Code: c6 a0 0c 00 e9 78 fd ff ff 90 48 b8 00 00 00 00 00 fc ff df 55 48 89
e5 53 48 89 fb 48 83 c7 1c 48 89 fa 48 83 ec 08 48 c1 ea 03 <0f> b6 14 02
48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 49
RIP [<ffffffff81435041>] __read_once_size include/linux/compiler.h:218
[inline]
RIP [<ffffffff81435041>] atomic_read arch/x86/include/asm/atomic.h:27
[inline]
RIP [<ffffffff81435041>] put_page_testzero include/linux/mm.h:357 [inline]
RIP [<ffffffff81435041>] __free_pages+0x21/0x90 mm/page_alloc.c:3365
RSP <ffff8801d4dcf9e8>
general protection fault: 0000 [#2] [ 27.376550] ---[ end trace
a4e74a4924bf2818 ]---
Kernel panic - not syncing: Fatal exception
PREEMPT SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3699 Comm: syzkaller418695 Tainted: G D
4.4.125-g38f41ec #63
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8800afcc4800 task.stack: ffff8800af268000
RIP: 0010:[<ffffffff81435041>] [<ffffffff81435041>] __read_once_size
include/linux/compiler.h:218 [inline]
RIP: 0010:[<ffffffff81435041>] [<ffffffff81435041>] atomic_read
arch/x86/include/asm/atomic.h:27 [inline]
RIP: 0010:[<ffffffff81435041>] [<ffffffff81435041>] put_page_testzero
include/linux/mm.h:357 [inline]
RIP: 0010:[<ffffffff81435041>] [<ffffffff81435041>] __free_pages+0x21/0x90
mm/page_alloc.c:3365
RSP: 0018:ffff8800af26f9e8 EFLAGS: 00010a07
RAX: dffffc0000000000 RBX: dead4ead00000000 RCX: ffffffff825bb1fb
RDX: 1bd5a9d5a0000003 RSI: 0000000000000006 RDI: dead4ead0000001c
RBP: ffff8800af26f9f8 R08: 0000000048000000 R09: 0000000000001e30
R10: 0000000000002100 R11: 1ffff10015e4df1a R12: 0000000000000004
R13: 0000000000000020 R14: ffff8801ca874200 R15: dffffc0000000000
FS: 00007f89442fc700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f89442fbe78 CR3: 00000001cd9b2000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
0000000000000246 ffff8801ca874358 ffff8800af26fa58 ffffffff825bb221
ffff8801ca874370 ffffed003950e86b ffffed003950e86e ffff8801ca874368
dead4ead00000000 ffff8801ca874340 0000000000000000 0000000000000000
Call Trace:
[<ffffffff825bb221>] sg_remove_scat.isra.17+0x1c1/0x2d0
drivers/scsi/sg.c:1956
[<ffffffff825bb5d6>] sg_finish_rem_req+0x2a6/0x320 drivers/scsi/sg.c:1839
[<ffffffff825bb7db>] sg_new_read+0x18b/0x420 drivers/scsi/sg.c:578
[<ffffffff825bd35f>] sg_read+0x8cf/0x14d0 drivers/scsi/sg.c:466
[<ffffffff8151e141>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:680
[<ffffffff8152049d>] do_readv_writev+0x5dd/0x6e0 fs/read_write.c:810
[<ffffffff81520618>] vfs_readv+0x78/0xb0 fs/read_write.c:834
[<ffffffff81522949>] SYSC_readv fs/read_write.c:860 [inline]
[<ffffffff81522949>] SyS_readv+0xd9/0x240 fs/read_write.c:852
[<ffffffff83779965>] entry_SYSCALL_64_fastpath+0x22/0x9e
Code: c6 a0 0c 00 e9 78 fd ff ff 90 48 b8 00 00 00 00 00 fc ff df 55 48 89
e5 53 48 89 fb 48 83 c7 1c 48 89 fa 48 83 ec 08 48 c1 ea 03 <0f> b6 14 02
48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 49
RIP [<ffffffff81435041>] __read_once_size include/linux/compiler.h:218
[inline]
RIP [<ffffffff81435041>] atomic_read arch/x86/include/asm/atomic.h:27
[inline]
RIP [<ffffffff81435041>] put_page_testzero include/linux/mm.h:357 [inline]
RIP [<ffffffff81435041>] __free_pages+0x21/0x90 mm/page_alloc.c:3365
RSP <ffff8800af26f9e8>
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches