program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}, 0x263b}], 0x1, 0x40004000, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x38, r1, 0xc4fc9e906872338b, 0x0, 0xf0ffff, {{0x5}, {@val={0x8}, @val={0xc}}}, [@NL80211_ATTR_TID_CONFIG={0x6, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x4}]}]}]}, 0x38}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r3 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x282, 0x0) ioctl$DM_DEV_CREATE(r3, 0xc138fd03, &(0x7f0000000040)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x29001, 0x0, 0x0, {0x0, {'syz', 0x0, '3\x00'}}}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DM_TABLE_LOAD(r3, 0xc138fd09, &(0x7f0000000180)={0x4, 0x0, 0x0, 0x1a0, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r4}, [@snapshot={0x0, 0x2018, 0x0, 0x68, 'snapshot\x00', {@ram_num={'1:', 0x1}, 0x20, @ram={'/dev/ram', 0x1}, 0x20, 'p', 0x20, '8', ' 1 discard_zeroes_cow'}}]}) bind$netlink(r2, &(0x7f00000004c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./debug\x00', 0x1ff) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000680)=0x5, 0x4) bind$inet6(r5, &(0x7f0000000700)={0xa, 0x14e22, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, 0x3}, 0x1c) setresuid(0x0, 0xee00, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000740)=0x5, 0x4) bind$inet6(r6, &(0x7f0000000780)={0xa, 0x14e22, 0xf, @ipv4={'\x00', '\xff\xff', @empty}, 0x80000000}, 0x1c) mount(0x0, &(0x7f0000000600)='./debug\x00', &(0x7f0000000640)='debugfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./debug/netdevsim/netdevsim0/take_snapshot\x00', 0x1, 0x0) ioctl$SG_GET_RESERVED_SIZE(r7, 0x2272, &(0x7f0000000400)) setxattr$trusted_overlay_opaque(&(0x7f0000000340)='./debug/file0\x00', &(0x7f0000000380), &(0x7f00000003c0), 0x2, 0x1) write(r7, 0x0, 0x0) [ 93.705461][ T4656] Bluetooth: hci0: command tx timeout [ 93.727828][ T812] cfg80211: failed to load regulatory.db [ 93.878481][ T5334] ================================================================== [ 93.878534][ T5334] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 93.878747][ T5334] Read of size 8 at addr ffff8880401fdf18 by task syz.0.0/5334 [ 93.878776][ T5334] [ 93.878797][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.878830][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.878868][ T5334] Call Trace: [ 93.878882][ T5334] [ 93.878898][ T5334] dump_stack_lvl+0xe8/0x150 [ 93.879017][ T5334] print_address_description+0x55/0x1e0 [ 93.879035][ T5334] ? snapshot_ctr+0x5cb/0x1340 [ 93.879051][ T5334] print_report+0x58/0x70 [ 93.879063][ T5334] kasan_report+0x117/0x150 [ 93.879113][ T5334] ? snapshot_ctr+0x5cb/0x1340 [ 93.879132][ T5334] snapshot_ctr+0x5cb/0x1340 [ 93.879151][ T5334] ? __pfx_snapshot_ctr+0x10/0x10 [ 93.879167][ T5334] ? skip_spaces+0x8a/0xa0 [ 93.879300][ T5334] ? dm_split_args+0x50b/0x5d0 [ 93.879317][ T5334] dm_table_add_target+0x58d/0xc70 [ 93.879334][ T5334] table_load+0x325/0x8a0 [ 93.879348][ T5334] ? __pfx_table_load+0x10/0x10 [ 93.879363][ T5334] dm_ctl_ioctl+0x9ec/0xe10 [ 93.879376][ T5334] ? __pfx_table_load+0x10/0x10 [ 93.879387][ T5334] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 93.879406][ T5334] ? __fget_files+0x2a/0x420 [ 93.879417][ T5334] ? bpf_lsm_file_ioctl+0x9/0x20 [ 93.879513][ T5334] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 93.879525][ T5334] __se_sys_ioctl+0xfc/0x170 [ 93.879539][ T5334] do_syscall_64+0x166/0x520 [ 93.879639][ T5334] ? trace_irq_disable+0x3b/0x140 [ 93.879654][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.879667][ T5334] ? clear_bhb_loop+0x70/0xc0 [ 93.879680][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.879692][ T5334] RIP: 0033:0x7fcfd3d9f559 [ 93.879704][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.879714][ T5334] RSP: 002b:00007fcfd4c37fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.879750][ T5334] RAX: ffffffffffffffda RBX: 00007fcfd4025fa0 RCX: 00007fcfd3d9f559 [ 93.879759][ T5334] RDX: 0000200000000180 RSI: 00000000c138fd09 RDI: 0000000000000005 [ 93.879766][ T5334] RBP: 00007fcfd3e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 93.879772][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.879778][ T5334] R13: 00007fcfd4026038 R14: 00007fcfd4025fa0 R15: 00007ffc3b624cb8 [ 93.879819][ T5334] [ 93.879825][ T5334] [ 93.879828][ T5334] Allocated by task 5334: [ 93.879844][ T5334] kasan_save_track+0x3e/0x80 [ 93.879861][ T5334] __kasan_kmalloc+0x93/0xb0 [ 93.879875][ T5334] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 93.879886][ T5334] dm_get_table_device+0x23e/0x730 [ 93.879898][ T5334] dm_get_device+0x327/0x760 [ 93.879909][ T5334] snapshot_ctr+0x2b2/0x1340 [ 93.879922][ T5334] dm_table_add_target+0x58d/0xc70 [ 93.879932][ T5334] table_load+0x325/0x8a0 [ 93.879942][ T5334] dm_ctl_ioctl+0x9ec/0xe10 [ 93.879952][ T5334] __se_sys_ioctl+0xfc/0x170 [ 93.879962][ T5334] do_syscall_64+0x166/0x520 [ 93.879971][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.879980][ T5334] [ 93.879983][ T5334] Freed by task 5334: [ 93.879988][ T5334] kasan_save_track+0x3e/0x80 [ 93.879999][ T5334] kasan_save_free_info+0x40/0x50 [ 93.880008][ T5334] __kasan_slab_free+0x5c/0x80 [ 93.880020][ T5334] kfree+0x1c5/0x650 [ 93.880027][ T5334] dm_put_table_device+0x255/0x2a0 [ 93.880039][ T5334] dm_get_device+0x56f/0x760 [ 93.880049][ T5334] snapshot_ctr+0x471/0x1340 [ 93.880060][ T5334] dm_table_add_target+0x58d/0xc70 [ 93.880070][ T5334] table_load+0x325/0x8a0 [ 93.880080][ T5334] dm_ctl_ioctl+0x9ec/0xe10 [ 93.880089][ T5334] __se_sys_ioctl+0xfc/0x170 [ 93.880099][ T5334] do_syscall_64+0x166/0x520 [ 93.880106][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.880115][ T5334] [ 93.880118][ T5334] The buggy address belongs to the object at ffff8880401fdf00 [ 93.880118][ T5334] which belongs to the cache kmalloc-96 of size 96 [ 93.880127][ T5334] The buggy address is located 24 bytes inside of [ 93.880127][ T5334] freed 96-byte region [ffff8880401fdf00, ffff8880401fdf60) [ 93.880138][ T5334] [ 93.880141][ T5334] The buggy address belongs to the physical page: [ 93.880147][ T5334] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x401fd [ 93.880159][ T5334] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 93.880170][ T5334] page_type: f5(slab) [ 93.880181][ T5334] raw: 04fff00000000000 ffff88801c041280 dead000000000100 dead000000000122 [ 93.880191][ T5334] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 93.880197][ T5334] page dumped because: kasan: bad access detected [ 93.880203][ T5334] page_owner tracks the page as allocated [ 93.880209][ T5334] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 25503470289 [ 93.880226][ T5334] post_alloc_hook+0x1f9/0x250 [ 93.880236][ T5334] get_page_from_freelist+0x2209/0x2280 [ 93.880249][ T5334] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 93.880260][ T5334] allocate_slab+0x7d/0x620 [ 93.880282][ T5334] refill_objects+0x2d5/0x350 [ 93.880297][ T5334] __pcs_replace_empty_main+0x2c8/0x6c0 [ 93.880312][ T5334] __kmalloc_cache_noprof+0x396/0x600 [ 93.880323][ T5334] lookup_or_create_module_kobject+0x75/0x170 [ 93.880340][ T5334] module_add_driver+0x79/0x320 [ 93.880380][ T5334] bus_add_driver+0x3e5/0x6e0 [ 93.880393][ T5334] driver_register+0x23a/0x320 [ 93.880404][ T5334] __hid_register_driver+0x12a/0x170 [ 93.880459][ T5334] do_one_initcall+0x250/0x870 [ 93.880475][ T5334] do_initcall_level+0x10a/0x1a0 [ 93.880533][ T5334] do_initcalls+0x59/0xa0 [ 93.880547][ T5334] kernel_init_freeable+0x29d/0x3e0 [ 93.880562][ T5334] page last free pid 13 tgid 13 ts 25503171112 stack trace: [ 93.880585][ T5334] __free_frozen_pages+0xc93/0xd90 [ 93.880596][ T5334] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 93.880607][ T5334] alloc_vmap_area+0xd10/0x1410 [ 93.880623][ T5334] __get_vm_area_node+0x200/0x2f0 [ 93.880637][ T5334] __vmalloc_node_range_noprof+0x343/0x1540 [ 93.880645][ T5334] __vmalloc_node_noprof+0xc2/0x100 [ 93.880653][ T5334] dup_task_struct+0x2c6/0xa00 [ 93.880664][ T5334] copy_process+0x7ea/0x44b0 [ 93.880675][ T5334] kernel_clone+0x2d7/0x940 [ 93.880687][ T5334] user_mode_thread+0x115/0x180 [ 93.880699][ T5334] call_usermodehelper_exec_work+0x5c/0x230 [ 93.880710][ T5334] process_scheduled_works+0xc3d/0x1630 [ 93.880722][ T5334] worker_thread+0xa47/0xfb0 [ 93.880734][ T5334] kthread+0x38b/0x480 [ 93.880744][ T5334] ret_from_fork+0x514/0xb70 [ 93.880754][ T5334] ret_from_fork_asm+0x1a/0x30 [ 93.880763][ T5334] [ 93.880766][ T5334] Memory state around the buggy address: [ 93.880771][ T5334] ffff8880401fde00: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 93.880779][ T5334] ffff8880401fde80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 93.880785][ T5334] >ffff8880401fdf00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 93.880791][ T5334] ^ [ 93.880796][ T5334] ffff8880401fdf80: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 93.880803][ T5334] ffff8880401fe000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.880808][ T5334] ================================================================== [ 93.880815][ T5334] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.183679][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.187332][ T5334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.191530][ T5334] Call Trace: [ 94.193065][ T5334] [ 94.194375][ T5334] vpanic+0x56d/0xa60 [ 94.196096][ T5334] ? __pfx_vpanic+0x10/0x10 [ 94.198031][ T5334] panic+0xc5/0xd0 [ 94.199626][ T5334] ? __pfx_panic+0x10/0x10 [ 94.201495][ T5334] ? snapshot_ctr+0x5cb/0x1340 [ 94.203682][ T5334] ? snapshot_ctr+0x5cb/0x1340 [ 94.205722][ T5334] check_panic_on_warn+0x89/0xb0 [ 94.207930][ T5334] ? snapshot_ctr+0x5cb/0x1340 [ 94.209979][ T5334] end_report+0x73/0x170 [ 94.211829][ T5334] ? snapshot_ctr+0x5cb/0x1340 [ 94.213910][ T5334] kasan_report+0x128/0x150 [ 94.215863][ T5334] ? snapshot_ctr+0x5cb/0x1340 [ 94.217886][ T5334] snapshot_ctr+0x5cb/0x1340 [ 94.219873][ T5334] ? __pfx_snapshot_ctr+0x10/0x10 [ 94.222071][ T5334] ? skip_spaces+0x8a/0xa0 [ 94.224073][ T5334] ? dm_split_args+0x50b/0x5d0 [ 94.226123][ T5334] dm_table_add_target+0x58d/0xc70 [ 94.228271][ T5334] table_load+0x325/0x8a0 [ 94.230168][ T5334] ? __pfx_table_load+0x10/0x10 [ 94.232244][ T5334] dm_ctl_ioctl+0x9ec/0xe10 [ 94.234057][ T5334] ? __pfx_table_load+0x10/0x10 [ 94.236095][ T5334] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 94.238019][ T5334] ? __fget_files+0x2a/0x420 [ 94.239714][ T5334] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.241565][ T5334] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 94.243659][ T5334] __se_sys_ioctl+0xfc/0x170 [ 94.245669][ T5334] do_syscall_64+0x166/0x520 [ 94.247681][ T5334] ? trace_irq_disable+0x3b/0x140 [ 94.249782][ T5334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.252484][ T5334] ? clear_bhb_loop+0x70/0xc0 [ 94.254720][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.257313][ T5334] RIP: 0033:0x7fcfd3d9f559 [ 94.259270][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.267497][ T5334] RSP: 002b:00007fcfd4c37fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.271163][ T5334] RAX: ffffffffffffffda RBX: 00007fcfd4025fa0 RCX: 00007fcfd3d9f559 [ 94.274573][ T5334] RDX: 0000200000000180 RSI: 00000000c138fd09 RDI: 0000000000000005 [ 94.277787][ T5334] RBP: 00007fcfd3e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 94.281112][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.284598][ T5334] R13: 00007fcfd4026038 R14: 00007fcfd4025fa0 R15: 00007ffc3b624cb8 [ 94.287951][ T5334] [ 94.290550][ T5334] Kernel Offset: disabled [ 94.292473][ T5334] Rebooting in 86400 seconds..