program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207baaf8ff00000000bda106000000000047050000f8ffffffb702000008000000b70300000000000085000000050000001801000020786c250000000000202020db1af8ff51000000bda1f8ff0000000007010000f8ffffffb702000008000000b70300000000000085000000060000009500000000000000"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x301200) (async, rerun: 32) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (rerun: 32) creat(&(0x7f0000000380)='./file0\x00', 0x89) (async, rerun: 32) r1 = syz_open_dev$media(&(0x7f0000000000), 0x8, 0x80940) (async, rerun: 32) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0x40106e8c, &(0x7f0000000080)={@desc={0x4100, 0x0, @desc3}}) (async) ioctl$DRM_IOCTL_MODE_CURSOR2(r2, 0xc02464bb, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000080), 0x10010) (async, rerun: 32) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000005, 0x10012, r3, 0x0) (rerun: 32) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r2, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0xd4}) r4 = syz_open_dev$media(&(0x7f0000000000), 0x3, 0x20040) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc0287c02, &(0x7f00000003c0)={0x80000000, 0x0, &(0x7f00000005c0)=[{}, {{}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_ENTITIES(r1, 0xc1007c01, &(0x7f0000000100)={r5}) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000001080)='./file0\x00', 0x0, 0x1001, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r6, &(0x7f00000001c0)='file net/sctp/* +p', 0x12) (async, rerun: 32) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) (rerun: 32) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000440)=[@in={0x2, 0x4e23, @private=0xa010100}], 0xfffffffffffffead) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x2c, &(0x7f00000002c0)=[@in6={0xa, 0x4e20, 0x0, @loopback}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f0000000000)=0x10) (async, rerun: 32) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 32) [ 95.503914][ T5283] Bluetooth: hci0: command tx timeout [ 96.378295][ T5331] ================================================================== [ 96.378331][ T5331] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 96.378437][ T5331] Read of size 4 at addr ffff88803420ae3c by task syz.0.0/5331 [ 96.378447][ T5331] [ 96.378454][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.378467][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.378474][ T5331] Call Trace: [ 96.378479][ T5331] [ 96.378484][ T5331] dump_stack_lvl+0xe8/0x150 [ 96.378501][ T5331] print_address_description+0x55/0x1e0 [ 96.378518][ T5331] ? dvb_frontend_release+0x407/0x4d0 [ 96.378533][ T5331] print_report+0x58/0x70 [ 96.378546][ T5331] kasan_report+0x117/0x150 [ 96.378559][ T5331] ? dvb_frontend_release+0x407/0x4d0 [ 96.378577][ T5331] dvb_frontend_release+0x407/0x4d0 [ 96.378593][ T5331] ? __pfx_dvb_frontend_release+0x10/0x10 [ 96.378609][ T5331] __fput+0x418/0xa50 [ 96.378621][ T5331] task_work_run+0x1d9/0x270 [ 96.378635][ T5331] ? __pfx_task_work_run+0x10/0x10 [ 96.378646][ T5331] ? do_raw_spin_unlock+0x4d/0x200 [ 96.378663][ T5331] do_exit+0x73a/0x2360 [ 96.378676][ T5331] ? __pfx_fpu__restore_sig+0x10/0x10 [ 96.378691][ T5331] ? __pfx_do_exit+0x10/0x10 [ 96.378702][ T5331] ? do_raw_spin_lock+0x12b/0x2f0 [ 96.378717][ T5331] do_group_exit+0x22d/0x2f0 [ 96.378728][ T5331] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.378743][ T5331] get_signal+0x121b/0x12c0 [ 96.378761][ T5331] arch_do_signal_or_restart+0xbb/0x860 [ 96.378777][ T5331] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 96.378797][ T5331] exit_to_user_mode_loop+0x10e/0x770 [ 96.378809][ T5331] ? rcu_is_watching+0x16/0xb0 [ 96.378822][ T5331] do_syscall_64+0x328/0x520 [ 96.378836][ T5331] ? trace_irq_disable+0x3b/0x140 [ 96.378847][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.378858][ T5331] ? clear_bhb_loop+0x70/0xc0 [ 96.378871][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.378882][ T5331] RIP: 0033:0x7f9beeb9e159 [ 96.378892][ T5331] Code: Unable to access opcode bytes at 0x7f9beeb9e12f. [ 96.378898][ T5331] RSP: 002b:00007f9befa8a0a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 96.378911][ T5331] RAX: fffffffffffffe00 RBX: 00007f9beee26458 RCX: 00007f9beeb9e159 [ 96.378920][ T5331] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f9beee26458 [ 96.378927][ T5331] RBP: 00007f9beee26450 R08: 0000000000000000 R09: 0000000000000000 [ 96.378934][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.378940][ T5331] R13: 00007f9beee264e8 R14: 00007ffd6e816ce0 R15: 00007ffd6e816dc8 [ 96.378952][ T5331] [ 96.378956][ T5331] [ 96.378959][ T5331] Allocated by task 1: [ 96.378965][ T5331] kasan_save_track+0x3e/0x80 [ 96.378980][ T5331] __kasan_kmalloc+0x93/0xb0 [ 96.378995][ T5331] __kmalloc_cache_noprof+0x321/0x600 [ 96.379008][ T5331] dvb_register_device+0x309/0x1dd0 [ 96.379018][ T5331] dvb_register_frontend+0x603/0x900 [ 96.379032][ T5331] vidtv_bridge_probe+0x9d5/0xf60 [ 96.379045][ T5331] platform_probe+0xf9/0x190 [ 96.379093][ T5331] really_probe+0x254/0xae0 [ 96.379107][ T5331] __driver_probe_device+0x1e8/0x360 [ 96.379120][ T5331] driver_probe_device+0x4f/0x240 [ 96.379133][ T5331] __driver_attach+0x339/0x600 [ 96.379147][ T5331] bus_for_each_dev+0x23b/0x2c0 [ 96.379156][ T5331] bus_add_driver+0x345/0x670 [ 96.379166][ T5331] driver_register+0x23a/0x320 [ 96.379181][ T5331] vidtv_bridge_init+0x3d/0x60 [ 96.379255][ T5331] do_one_initcall+0x250/0x870 [ 96.379270][ T5331] do_initcall_level+0x10a/0x1a0 [ 96.379283][ T5331] do_initcalls+0x59/0xa0 [ 96.379300][ T5331] kernel_init_freeable+0x29d/0x3e0 [ 96.379312][ T5331] kernel_init+0x22/0x1d0 [ 96.379321][ T5331] ret_from_fork+0x514/0xb70 [ 96.379330][ T5331] ret_from_fork_asm+0x1a/0x30 [ 96.379345][ T5331] [ 96.379347][ T5331] Freed by task 5331: [ 96.379353][ T5331] kasan_save_track+0x3e/0x80 [ 96.379366][ T5331] kasan_save_free_info+0x40/0x50 [ 96.379378][ T5331] __kasan_slab_free+0x5c/0x80 [ 96.379392][ T5331] kfree+0x1c5/0x650 [ 96.379403][ T5331] dvb_generic_release+0x11d/0x1b0 [ 96.379418][ T5331] dvb_frontend_release+0x132/0x4d0 [ 96.379433][ T5331] __fput+0x418/0xa50 [ 96.379443][ T5331] task_work_run+0x1d9/0x270 [ 96.379453][ T5331] do_exit+0x73a/0x2360 [ 96.379462][ T5331] do_group_exit+0x22d/0x2f0 [ 96.379471][ T5331] get_signal+0x121b/0x12c0 [ 96.379483][ T5331] arch_do_signal_or_restart+0xbb/0x860 [ 96.379497][ T5331] exit_to_user_mode_loop+0x10e/0x770 [ 96.379506][ T5331] do_syscall_64+0x328/0x520 [ 96.379520][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.379550][ T5331] [ 96.379553][ T5331] The buggy address belongs to the object at ffff88803420ae00 [ 96.379553][ T5331] which belongs to the cache kmalloc-256 of size 256 [ 96.379563][ T5331] The buggy address is located 60 bytes inside of [ 96.379563][ T5331] freed 256-byte region [ffff88803420ae00, ffff88803420af00) [ 96.379574][ T5331] [ 96.379577][ T5331] The buggy address belongs to the physical page: [ 96.379583][ T5331] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3420a [ 96.379593][ T5331] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 96.379603][ T5331] page_type: f5(slab) [ 96.379613][ T5331] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 96.379622][ T5331] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 96.379628][ T5331] page dumped because: kasan: bad access detected [ 96.379635][ T5331] page_owner tracks the page as allocated [ 96.379639][ T5331] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 21238453385 [ 96.379657][ T5331] post_alloc_hook+0x1f9/0x250 [ 96.379670][ T5331] get_page_from_freelist+0x2209/0x2280 [ 96.379685][ T5331] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 96.379699][ T5331] allocate_slab+0x7d/0x620 [ 96.379708][ T5331] refill_objects+0x2d5/0x350 [ 96.379719][ T5331] __pcs_replace_empty_main+0x2c8/0x6c0 [ 96.379729][ T5331] __kmalloc_cache_noprof+0x39b/0x600 [ 96.379741][ T5331] bus_add_driver+0x162/0x670 [ 96.379751][ T5331] driver_register+0x23a/0x320 [ 96.379766][ T5331] do_one_initcall+0x250/0x870 [ 96.379780][ T5331] do_initcall_level+0x10a/0x1a0 [ 96.379792][ T5331] do_initcalls+0x59/0xa0 [ 96.379803][ T5331] kernel_init_freeable+0x29d/0x3e0 [ 96.379814][ T5331] kernel_init+0x22/0x1d0 [ 96.379823][ T5331] ret_from_fork+0x514/0xb70 [ 96.379832][ T5331] ret_from_fork_asm+0x1a/0x30 [ 96.379846][ T5331] page last free pid 1050 tgid 1050 ts 20695158334 stack trace: [ 96.379853][ T5331] __free_frozen_pages+0xc93/0xd90 [ 96.379866][ T5331] kasan_depopulate_vmalloc_pte+0x6d/0x90 [ 96.379880][ T5331] __apply_to_page_range+0xbd8/0x1420 [ 96.379890][ T5331] __kasan_release_vmalloc+0xa2/0xd0 [ 96.379903][ T5331] purge_vmap_node+0x220/0x960 [ 96.379917][ T5331] __purge_vmap_area_lazy+0x783/0xb40 [ 96.379930][ T5331] drain_vmap_area_work+0x27/0x40 [ 96.379943][ T5331] process_scheduled_works+0xc3d/0x1630 [ 96.379956][ T5331] worker_thread+0xa47/0xfb0 [ 96.379968][ T5331] kthread+0x38b/0x480 [ 96.379977][ T5331] ret_from_fork+0x514/0xb70 [ 96.379985][ T5331] ret_from_fork_asm+0x1a/0x30 [ 96.380000][ T5331] [ 96.380003][ T5331] Memory state around the buggy address: [ 96.380008][ T5331] ffff88803420ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 96.380016][ T5331] ffff88803420ad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 96.380023][ T5331] >ffff88803420ae00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.380028][ T5331] ^ [ 96.380034][ T5331] ffff88803420ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.380041][ T5331] ffff88803420af00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 96.380047][ T5331] ================================================================== [ 96.722432][ T5331] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 96.725496][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.729362][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.733562][ T5331] Call Trace: [ 96.735004][ T5331] [ 96.736268][ T5331] vpanic+0x56d/0xa60 [ 96.738000][ T5331] ? __pfx_vpanic+0x10/0x10 [ 96.739973][ T5331] ? __pfx___schedule+0x10/0x10 [ 96.742688][ T5331] panic+0xc5/0xd0 [ 96.744256][ T5331] ? __pfx_panic+0x10/0x10 [ 96.745966][ T5331] ? preempt_schedule_common+0x7f/0xd0 [ 96.748029][ T5331] ? dvb_frontend_release+0x407/0x4d0 [ 96.750060][ T5331] check_panic_on_warn+0x89/0xb0 [ 96.751904][ T5331] ? dvb_frontend_release+0x407/0x4d0 [ 96.753838][ T5331] end_report+0x73/0x170 [ 96.755369][ T5331] ? dvb_frontend_release+0x407/0x4d0 [ 96.757282][ T5331] kasan_report+0x128/0x150 [ 96.758981][ T5331] ? dvb_frontend_release+0x407/0x4d0 [ 96.761084][ T5331] dvb_frontend_release+0x407/0x4d0 [ 96.763080][ T5331] ? __pfx_dvb_frontend_release+0x10/0x10 [ 96.765073][ T5331] __fput+0x418/0xa50 [ 96.766447][ T5331] task_work_run+0x1d9/0x270 [ 96.768060][ T5331] ? __pfx_task_work_run+0x10/0x10 [ 96.769831][ T5331] ? do_raw_spin_unlock+0x4d/0x200 [ 96.771657][ T5331] do_exit+0x73a/0x2360 [ 96.773117][ T5331] ? __pfx_fpu__restore_sig+0x10/0x10 [ 96.775036][ T5331] ? __pfx_do_exit+0x10/0x10 [ 96.776722][ T5331] ? do_raw_spin_lock+0x12b/0x2f0 [ 96.778544][ T5331] do_group_exit+0x22d/0x2f0 [ 96.780272][ T5331] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.782588][ T5331] get_signal+0x121b/0x12c0 [ 96.784323][ T5331] arch_do_signal_or_restart+0xbb/0x860 [ 96.786401][ T5331] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 96.788736][ T5331] exit_to_user_mode_loop+0x10e/0x770 [ 96.790678][ T5331] ? rcu_is_watching+0x16/0xb0 [ 96.792469][ T5331] do_syscall_64+0x328/0x520 [ 96.794142][ T5331] ? trace_irq_disable+0x3b/0x140 [ 96.795906][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.798048][ T5331] ? clear_bhb_loop+0x70/0xc0 [ 96.799702][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.801793][ T5331] RIP: 0033:0x7f9beeb9e159 [ 96.803488][ T5331] Code: Unable to access opcode bytes at 0x7f9beeb9e12f. [ 96.805915][ T5331] RSP: 002b:00007f9befa8a0a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 96.808967][ T5331] RAX: fffffffffffffe00 RBX: 00007f9beee26458 RCX: 00007f9beeb9e159 [ 96.812203][ T5331] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f9beee26458 [ 96.815343][ T5331] RBP: 00007f9beee26450 R08: 0000000000000000 R09: 0000000000000000 [ 96.818217][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.821255][ T5331] R13: 00007f9beee264e8 R14: 00007ffd6e816ce0 R15: 00007ffd6e816dc8 [ 96.824285][ T5331] [ 96.826021][ T5331] Kernel Offset: disabled [ 96.827773][ T5331] Rebooting in 86400 seconds..