program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x8}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x8}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) (async) [ 101.546209][ T5294] Bluetooth: hci0: command tx timeout [ 101.573378][ T5329] ================================================================== [ 101.577293][ T5329] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 101.582023][ T5329] Read of size 4 at addr ffff888037e94c3c by task syz.0.0/5329 [ 101.585243][ T5329] [ 101.586320][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.586340][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.586347][ T5329] Call Trace: [ 101.586354][ T5329] [ 101.586359][ T5329] dump_stack_lvl+0xe8/0x150 [ 101.586379][ T5329] print_address_description+0x55/0x1e0 [ 101.586394][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 101.586408][ T5329] print_report+0x58/0x70 [ 101.586420][ T5329] kasan_report+0x117/0x150 [ 101.586435][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 101.586463][ T5329] dvb_frontend_release+0x407/0x4d0 [ 101.586477][ T5329] ? __pfx_dvb_frontend_release+0x10/0x10 [ 101.586489][ T5329] __fput+0x418/0xa50 [ 101.586503][ T5329] task_work_run+0x1d9/0x270 [ 101.586519][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 101.586535][ T5329] get_signal+0x1181/0x12c0 [ 101.586549][ T5329] ? do_raw_spin_lock+0x12b/0x2f0 [ 101.586562][ T5329] arch_do_signal_or_restart+0xbb/0x860 [ 101.586575][ T5329] ? do_raw_spin_unlock+0x4d/0x210 [ 101.586586][ T5329] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 101.586603][ T5329] exit_to_user_mode_loop+0x104/0x730 [ 101.586617][ T5329] ? rcu_is_watching+0x15/0xb0 [ 101.586632][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.586643][ T5329] do_syscall_64+0x353/0x580 [ 101.586658][ T5329] ? clear_bhb_loop+0x40/0x90 [ 101.586669][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.586680][ T5329] RIP: 0033:0x7f644939de59 [ 101.586692][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.586701][ T5329] RSP: 002b:00007fff8f87cdf8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 101.586714][ T5329] RAX: 0000000000000000 RBX: 00007f6449627da0 RCX: 00007f644939de59 [ 101.586721][ T5329] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 101.586727][ T5329] RBP: 00007f6449627da0 R08: 00007f6449626128 R09: 0000000000000000 [ 101.586734][ T5329] R10: 0000000000dffd38 R11: 0000000000000246 R12: 0000000000018f17 [ 101.586740][ T5329] R13: 00007f644962609c R14: 00007f6449626098 R15: 00007f6449626090 [ 101.586751][ T5329] [ 101.586755][ T5329] [ 101.683818][ T5329] Allocated by task 1: [ 101.685506][ T5329] kasan_save_track+0x3e/0x80 [ 101.687621][ T5329] __kasan_kmalloc+0x93/0xb0 [ 101.689570][ T5329] __kmalloc_cache_noprof+0x32d/0x660 [ 101.691933][ T5329] dvb_register_device+0x309/0x1dd0 [ 101.694278][ T5329] dvb_register_frontend+0x603/0x900 [ 101.696810][ T5329] vidtv_bridge_probe+0x9d5/0xf60 [ 101.699009][ T5329] platform_probe+0xf9/0x190 [ 101.701106][ T5329] really_probe+0x254/0xae0 [ 101.702931][ T5329] __driver_probe_device+0x1e8/0x360 [ 101.704987][ T5329] driver_probe_device+0x4f/0x240 [ 101.707048][ T5329] __driver_attach+0x339/0x600 [ 101.709063][ T5329] bus_for_each_dev+0x23b/0x2c0 [ 101.711403][ T5329] bus_add_driver+0x345/0x670 [ 101.713516][ T5329] driver_register+0x23a/0x320 [ 101.715499][ T5329] vidtv_bridge_init+0x3d/0x60 [ 101.717584][ T5329] do_one_initcall+0x250/0x870 [ 101.719463][ T5329] do_initcall_level+0x10a/0x1a0 [ 101.721520][ T5329] do_initcalls+0x59/0xa0 [ 101.723264][ T5329] kernel_init_freeable+0x29d/0x3e0 [ 101.725608][ T5329] kernel_init+0x1d/0x1d0 [ 101.727727][ T5329] ret_from_fork+0x514/0xb70 [ 101.730018][ T5329] ret_from_fork_asm+0x1a/0x30 [ 101.732111][ T5329] [ 101.733098][ T5329] Freed by task 5329: [ 101.734692][ T5329] kasan_save_track+0x3e/0x80 [ 101.736497][ T5329] kasan_save_free_info+0x40/0x50 [ 101.738567][ T5329] __kasan_slab_free+0x5c/0x80 [ 101.740836][ T5329] kfree+0x1c5/0x640 [ 101.742809][ T5329] dvb_generic_release+0x11d/0x1b0 [ 101.745437][ T5329] dvb_frontend_release+0x132/0x4d0 [ 101.748006][ T5329] __fput+0x418/0xa50 [ 101.749816][ T5329] task_work_run+0x1d9/0x270 [ 101.751823][ T5329] get_signal+0x1181/0x12c0 [ 101.753735][ T5329] arch_do_signal_or_restart+0xbb/0x860 [ 101.756068][ T5329] exit_to_user_mode_loop+0x104/0x730 [ 101.758552][ T5329] do_syscall_64+0x353/0x580 [ 101.760750][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.763428][ T5329] [ 101.764448][ T5329] The buggy address belongs to the object at ffff888037e94c00 [ 101.764448][ T5329] which belongs to the cache kmalloc-256 of size 256 [ 101.770141][ T5329] The buggy address is located 60 bytes inside of [ 101.770141][ T5329] freed 256-byte region [ffff888037e94c00, ffff888037e94d00) [ 101.776028][ T5329] [ 101.777245][ T5329] The buggy address belongs to the physical page: [ 101.780190][ T5329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37e94 [ 101.783748][ T5329] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 101.786685][ T5329] page_type: f5(slab) [ 101.788337][ T5329] raw: 04fff00000000000 ffff88801b041b40 dead000000000100 dead000000000122 [ 101.791960][ T5329] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 101.795681][ T5329] page dumped because: kasan: bad access detected [ 101.798273][ T5329] page_owner tracks the page as allocated [ 101.800620][ T5329] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 19911007766, free_ts 0 [ 101.808315][ T5329] post_alloc_hook+0x1f9/0x250 [ 101.810515][ T5329] get_page_from_freelist+0x21fa/0x2270 [ 101.813158][ T5329] __alloc_frozen_pages_noprof+0x18d/0x380 [ 101.815838][ T5329] allocate_slab+0x79/0x5e0 [ 101.817615][ T5329] refill_objects+0x2d5/0x350 [ 101.819459][ T5329] __pcs_replace_empty_main+0x2bf/0x6b0 [ 101.821875][ T5329] __kmalloc_cache_noprof+0x3a7/0x660 [ 101.824214][ T5329] bus_add_driver+0x162/0x670 [ 101.826302][ T5329] driver_register+0x23a/0x320 [ 101.828399][ T5329] i2c_register_driver+0xbb/0x1a0 [ 101.830704][ T5329] do_one_initcall+0x250/0x870 [ 101.832765][ T5329] do_initcall_level+0x10a/0x1a0 [ 101.834806][ T5329] do_initcalls+0x59/0xa0 [ 101.836595][ T5329] kernel_init_freeable+0x29d/0x3e0 [ 101.838723][ T5329] kernel_init+0x1d/0x1d0 [ 101.840573][ T5329] ret_from_fork+0x514/0xb70 [ 101.842712][ T5329] page_owner free stack trace missing [ 101.845186][ T5329] [ 101.846185][ T5329] Memory state around the buggy address: [ 101.848502][ T5329] ffff888037e94b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.851927][ T5329] ffff888037e94b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.855441][ T5329] >ffff888037e94c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.859111][ T5329] ^ [ 101.861737][ T5329] ffff888037e94c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.865110][ T5329] ffff888037e94d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.868493][ T5329] ================================================================== [ 101.898450][ T5329] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 101.901461][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.905551][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.910490][ T5329] Call Trace: [ 101.911968][ T5329] [ 101.913242][ T5329] vpanic+0x56c/0xa60 [ 101.914954][ T5329] ? __pfx_vpanic+0x10/0x10 [ 101.916915][ T5329] ? __pfx___schedule+0x10/0x10 [ 101.919231][ T5329] panic+0xc5/0xd0 [ 101.921412][ T5329] ? __pfx_panic+0x10/0x10 [ 101.923743][ T5329] ? preempt_schedule_common+0x82/0xd0 [ 101.926140][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 101.928366][ T5329] check_panic_on_warn+0x89/0xb0 [ 101.930490][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 101.932757][ T5329] end_report+0x73/0x170 [ 101.934573][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 101.936838][ T5329] kasan_report+0x128/0x150 [ 101.938860][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 101.941553][ T5329] dvb_frontend_release+0x407/0x4d0 [ 101.944282][ T5329] ? __pfx_dvb_frontend_release+0x10/0x10 [ 101.946917][ T5329] __fput+0x418/0xa50 [ 101.948608][ T5329] task_work_run+0x1d9/0x270 [ 101.950611][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 101.952872][ T5329] get_signal+0x1181/0x12c0 [ 101.954882][ T5329] ? do_raw_spin_lock+0x12b/0x2f0 [ 101.957096][ T5329] arch_do_signal_or_restart+0xbb/0x860 [ 101.959515][ T5329] ? do_raw_spin_unlock+0x4d/0x210 [ 101.961825][ T5329] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 101.964862][ T5329] exit_to_user_mode_loop+0x104/0x730 [ 101.967584][ T5329] ? rcu_is_watching+0x15/0xb0 [ 101.969618][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.972117][ T5329] do_syscall_64+0x353/0x580 [ 101.974074][ T5329] ? clear_bhb_loop+0x40/0x90 [ 101.975982][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.977988][ T5329] RIP: 0033:0x7f644939de59 [ 101.979603][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.989481][ T5329] RSP: 002b:00007fff8f87cdf8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 101.992754][ T5329] RAX: 0000000000000000 RBX: 00007f6449627da0 RCX: 00007f644939de59 [ 101.996230][ T5329] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 101.999718][ T5329] RBP: 00007f6449627da0 R08: 00007f6449626128 R09: 0000000000000000 [ 102.003190][ T5329] R10: 0000000000dffd38 R11: 0000000000000246 R12: 0000000000018f17 [ 102.007251][ T5329] R13: 00007f644962609c R14: 00007f6449626098 R15: 00007f6449626090 [ 102.011154][ T5329] [ 102.012885][ T5329] Kernel Offset: disabled [ 102.014736][ T5329] Rebooting in 86400 seconds..