last executing test programs: 37.049916ms ago: executing program 3 (id=4): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='maps\x00') exit(0x5) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='fd/3\x00') 16.048878ms ago: executing program 1 (id=2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/cpuset.cpus\x00', 0x2, 0x1b8) io_setup(0x1ff, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000140)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x1, r1, &(0x7f00000001c0)='1-N:', 0x4, 0x3}]) r3 = socket(0x29, 0x1, 0xfffffffc) setsockopt$MRT6_PIM(r3, 0x29, 0xcf, &(0x7f0000000000), 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0xc, @empty, 0x7f}, 0x1c) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0x3, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xfffffefd, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0xa, 0x3c1b, 0x1, 0x24, 0x800000d, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0xfffffff9, 0x5, 0x6, 0x8, 0x4, 0x401, 0x40], [0x10000007, 0x9, 0x8000012d, 0x8004, 0x5, 0xfffffff6, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2ff, 0x1, 0x9, 0xfffffffc, 0x4, 0x10001, 0x0, 0x3, 0x33, 0xe, 0x6, 0x78, 0xea4, 0x0, 0x3, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0x1000d, 0x4e0, 0x6, 0x4, 0xb, 0x4, 0x9, 0x4, 0xf, 0xffff8001, 0x47, 0x31f3, 0x1, 0xfe000000, 0xfffe, 0x1ff, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x4, 0x42, 0xffffffff], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x2, 0x5, 0x8, 0x4, 0x5, 0x5, 0x4, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4004, 0xffffff11, 0x6, 0x38, 0x800003, 0x200, 0x83, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x3, 0xa9, 0x5, 0x6, 0xac5, 0xbf, 0x4002, 0x3, 0x7ff, 0x12b, 0x4, 0x40000001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x7248, 0x6, 0x0, 0xb9, 0x9, 0x1ff, 0x2, 0x0, 0x5, 0x3, 0x101, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x78b, 0x8, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x1, 0xc8, 0x1, 0xfffff000, 0x5, 0x3, 0x0, 0x100, 0x9602, 0xb, 0xaf, 0x8, 0x4, 0x1, 0x2000005, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff343e, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 5.407289ms ago: executing program 2 (id=3): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'caif0\x00', 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x768}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa07, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x200}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000700)=[@text64={0x40, &(0x7f0000000740)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000100)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @multicast1}}}], 0x20}}], 0x1, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000180)={@multicast2, @empty}, 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f00000001c0)=[{&(0x7f0000000200)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r5, &(0x7f0000000240)=[{&(0x7f0000000280)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f00000002c0)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="e00000027fa80a0101"], 0x57) setsockopt$inet_mreqsrc(r4, 0x0, 0x24, &(0x7f0000000340)={@multicast2, @loopback, @empty}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x0) writev(r7, &(0x7f0000000380)=[{&(0x7f00000003c0)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000007c0)={[0x5836, 0x1000000000000008, 0x2, 0x4000000000000e52, 0x1, 0xf, 0x1043, 0x200000000006, 0x10, 0x1, 0xfffffffffffffffe, 0x100000000, 0x9ca6, 0x1, 0x8000000000005, 0x5c], 0x8080000, 0x42590}) ioctl$KVM_RUN(r2, 0xae80, 0x0) close_range(r0, r2, 0x0) 0s ago: executing program 0 (id=1): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000013c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000001400)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000002b40)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0xc88, 0x0, 0x60, 'snapshot-merge\x00', {@ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, 'PO', 0x20, '128'}}]}) kernel console output (not intermixed with test programs): [ 14.843435][ T36] audit: type=1400 audit(1793520550.730:62): avc: denied { rlimitinh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.846459][ T36] audit: type=1400 audit(1793520550.730:63): avc: denied { siginh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.92' (ED25519) to the list of known hosts. [ 23.177152][ T36] audit: type=1400 audit(1793520559.070:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.180781][ T286] cgroup: Unknown subsys name 'net' [ 23.199860][ T36] audit: type=1400 audit(1793520559.070:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.227232][ T36] audit: type=1400 audit(1793520559.100:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.227736][ T286] cgroup: Unknown subsys name 'devices' [ 23.354089][ T286] cgroup: Unknown subsys name 'hugetlb' [ 23.359737][ T286] cgroup: Unknown subsys name 'rlimit' [ 23.475603][ T36] audit: type=1400 audit(1793520559.370:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.498816][ T36] audit: type=1400 audit(1793520559.370:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.523770][ T36] audit: type=1400 audit(1793520559.370:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.553971][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.562872][ T36] audit: type=1400 audit(1793520559.460:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.588318][ T36] audit: type=1400 audit(1793520559.460:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.603610][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.614294][ T36] audit: type=1400 audit(1793520559.490:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.648246][ T36] audit: type=1400 audit(1793520559.490:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.504368][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.511493][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.518673][ T293] bridge_slave_0: entered allmulticast mode [ 24.525175][ T293] bridge_slave_0: entered promiscuous mode [ 24.533789][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.540850][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.548071][ T293] bridge_slave_1: entered allmulticast mode [ 24.554387][ T293] bridge_slave_1: entered promiscuous mode [ 24.576250][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.583372][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.590550][ T296] bridge_slave_0: entered allmulticast mode [ 24.596936][ T296] bridge_slave_0: entered promiscuous mode [ 24.622745][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.629835][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.637120][ T296] bridge_slave_1: entered allmulticast mode [ 24.643482][ T296] bridge_slave_1: entered promiscuous mode [ 24.692518][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.699605][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.707010][ T295] bridge_slave_0: entered allmulticast mode [ 24.713522][ T295] bridge_slave_0: entered promiscuous mode [ 24.720010][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.727289][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.734490][ T295] bridge_slave_1: entered allmulticast mode [ 24.740778][ T295] bridge_slave_1: entered promiscuous mode [ 24.762117][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.769204][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.776404][ T294] bridge_slave_0: entered allmulticast mode [ 24.782728][ T294] bridge_slave_0: entered promiscuous mode [ 24.802382][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.809491][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.816761][ T294] bridge_slave_1: entered allmulticast mode [ 24.823079][ T294] bridge_slave_1: entered promiscuous mode [ 24.940824][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.948032][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.955561][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.962637][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.975676][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.982789][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.990077][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.997154][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.006458][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.013547][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.020862][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.027963][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.053965][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.061061][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.068394][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.075464][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.112407][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.119838][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.127666][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.135145][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.143025][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.150330][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.157866][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.165240][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.185386][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.192577][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.200140][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.207227][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.219188][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.226307][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.234200][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.241241][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.264163][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.271269][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.314202][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.321359][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.329705][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.336773][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.345001][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.352081][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.359622][ T296] veth0_vlan: entered promiscuous mode [ 25.383195][ T293] veth0_vlan: entered promiscuous mode [ 25.399722][ T296] veth1_macvtap: entered promiscuous mode [ 25.419495][ T294] veth0_vlan: entered promiscuous mode [ 25.432632][ T295] veth0_vlan: entered promiscuous mode [ 25.446040][ T293] veth1_macvtap: entered promiscuous mode [ 25.473004][ T295] veth1_macvtap: entered promiscuous mode [ 25.484754][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.511616][ T294] veth1_macvtap: entered promiscuous mode [ 25.577789][ T318] ================================================================== [ 25.585933][ T318] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 25.593542][ T318] Read of size 8 at addr ffff88810c666998 by task syz.0.1/318 [ 25.601033][ T318] [ 25.603394][ T318] CPU: 1 UID: 0 PID: 318 Comm: syz.0.1 Not tainted syzkaller #0 1736d3b6ee88961c9d73e511fbf4428dbce80e3d [ 25.603421][ T318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 25.603441][ T318] Call Trace: [ 25.603448][ T318] [ 25.603456][ T318] __dump_stack+0x21/0x30 [ 25.603477][ T318] dump_stack_lvl+0x140/0x1c0 [ 25.603494][ T318] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.603511][ T318] ? __cfi__printk+0x10/0x10 [ 25.603543][ T318] print_address_description+0x71/0x210 [ 25.603577][ T318] print_report+0x4a/0x70 [ 25.603605][ T318] kasan_report+0x162/0x1a0 [ 25.603625][ T318] ? snapshot_ctr+0x586/0x1350 [ 25.603645][ T318] ? snapshot_ctr+0x586/0x1350 [ 25.603663][ T318] __asan_report_load8_noabort+0x18/0x20 [ 25.603689][ T318] snapshot_ctr+0x586/0x1350 [ 25.603708][ T318] ? dm_split_args+0xa1/0x740 [ 25.603735][ T318] ? __cfi_snapshot_ctr+0x10/0x10 [ 25.603754][ T318] ? dm_split_args+0x5d0/0x740 [ 25.603789][ T318] dm_table_add_target+0x59c/0xcb0 [ 25.603819][ T318] table_load+0x2eb/0x7d0 [ 25.603843][ T318] ? __check_object_size+0x99/0x870 [ 25.603873][ T318] ? __cfi_table_load+0x10/0x10 [ 25.603897][ T318] ? __kasan_check_write+0x18/0x20 [ 25.603923][ T318] ? __cfi_table_load+0x10/0x10 [ 25.603948][ T318] dm_ctl_ioctl+0x8f3/0xde0 [ 25.603972][ T318] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 25.604000][ T318] ? __fget_files+0x2bc/0x330 [ 25.604018][ T318] ? bpf_lsm_file_ioctl+0xd/0x20 [ 25.604038][ T318] ? security_file_ioctl+0x3e/0x110 [ 25.604064][ T318] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 25.604087][ T318] __se_sys_ioctl+0x126/0x1b0 [ 25.604106][ T318] __x64_sys_ioctl+0x7f/0xa0 [ 25.604124][ T318] x64_sys_call+0x1878/0x2ee0 [ 25.604143][ T318] do_syscall_64+0x57/0xf0 [ 25.604160][ T318] ? clear_bhb_loop+0x50/0xa0 [ 25.604185][ T318] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.604207][ T318] RIP: 0033:0x7f5aa4d9f559 [ 25.604229][ T318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.604245][ T318] RSP: 002b:00007f5aa5bbc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 25.604270][ T318] RAX: ffffffffffffffda RBX: 00007f5aa5025fa0 RCX: 00007f5aa4d9f559 [ 25.604285][ T318] RDX: 0000200000002b40 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 25.604299][ T318] RBP: 00007f5aa4e36b50 R08: 0000000000000000 R09: 0000000000000000 [ 25.604311][ T318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.604323][ T318] R13: 00007f5aa5026038 R14: 00007f5aa5025fa0 R15: 00007ffe171f8138 [ 25.604339][ T318] [ 25.604346][ T318] [ 25.773558][ T319] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.776700][ T318] Allocated by task 318: [ 25.886376][ T318] kasan_save_track+0x3e/0x80 [ 25.891109][ T318] kasan_save_alloc_info+0x3a/0x50 [ 25.896264][ T318] __kasan_kmalloc+0x96/0xb0 [ 25.900904][ T318] __kmalloc_cache_node_noprof+0x225/0x430 [ 25.906762][ T318] dm_get_table_device+0x1e3/0x6c0 [ 25.911911][ T318] dm_get_device+0x32b/0x7f0 [ 25.916536][ T318] snapshot_ctr+0x292/0x1350 [ 25.921157][ T318] dm_table_add_target+0x59c/0xcb0 [ 25.926364][ T318] table_load+0x2eb/0x7d0 [ 25.930731][ T318] dm_ctl_ioctl+0x8f3/0xde0 [ 25.935269][ T318] __se_sys_ioctl+0x126/0x1b0 [ 25.939977][ T318] __x64_sys_ioctl+0x7f/0xa0 [ 25.944634][ T318] x64_sys_call+0x1878/0x2ee0 [ 25.949350][ T318] do_syscall_64+0x57/0xf0 [ 25.953798][ T318] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.959734][ T318] [ 25.962081][ T318] Freed by task 318: [ 25.966000][ T318] kasan_save_track+0x3e/0x80 [ 25.970711][ T318] kasan_save_free_info+0x44/0x50 [ 25.975769][ T318] __kasan_slab_free+0x5f/0x80 [ 25.980566][ T318] kfree+0x158/0x440 [ 25.984498][ T318] dm_put_table_device+0x298/0x2e0 [ 25.989661][ T318] dm_get_device+0x571/0x7f0 [ 25.994293][ T318] snapshot_ctr+0x435/0x1350 [ 25.998903][ T318] dm_table_add_target+0x59c/0xcb0 [ 26.004054][ T318] table_load+0x2eb/0x7d0 [ 26.008414][ T318] dm_ctl_ioctl+0x8f3/0xde0 [ 26.012950][ T318] __se_sys_ioctl+0x126/0x1b0 [ 26.017692][ T318] __x64_sys_ioctl+0x7f/0xa0 [ 26.022318][ T318] x64_sys_call+0x1878/0x2ee0 [ 26.027041][ T318] do_syscall_64+0x57/0xf0 [ 26.031512][ T318] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.037432][ T318] [ 26.039776][ T318] The buggy address belongs to the object at ffff88810c666980 [ 26.039776][ T318] which belongs to the cache kmalloc-96 of size 96 [ 26.053788][ T318] The buggy address is located 24 bytes inside of [ 26.053788][ T318] freed 96-byte region [ffff88810c666980, ffff88810c6669e0) [ 26.067447][ T318] [ 26.069799][ T318] The buggy address belongs to the physical page: [ 26.076241][ T318] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c666 [ 26.085129][ T318] flags: 0x4000000000000000(zone=1) [ 26.090353][ T318] page_type: f5(slab) [ 26.094368][ T318] raw: 4000000000000000 ffff888100041280 ffffea0004319bc0 dead000000000002 [ 26.102982][ T318] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 26.111591][ T318] page dumped because: kasan: bad access detected [ 26.118043][ T318] page_owner tracks the page as allocated [ 26.123785][ T318] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2831903552, free_ts 1998047334 [ 26.142139][ T318] post_alloc_hook+0x37d/0x3b0 [ 26.146947][ T318] prep_new_page+0x2d/0x180 [ 26.151471][ T318] get_page_from_freelist+0x4aea/0x4ba0 [ 26.157042][ T318] __alloc_pages_noprof+0x35a/0x7e0 [ 26.162287][ T318] alloc_slab_page+0x6b/0x1e0 [ 26.166984][ T318] allocate_slab+0x69/0x430 [ 26.171507][ T318] ___slab_alloc+0x591/0x8c0 [ 26.176124][ T318] __kmalloc_cache_noprof+0x2cd/0x470 [ 26.181534][ T318] call_usermodehelper_setup+0x97/0x300 [ 26.187135][ T318] kobject_uevent_env+0x65f/0x7e0 [ 26.192188][ T318] kobject_uevent+0x21/0x40 [ 26.196726][ T318] kset_register+0x1bc/0x250 [ 26.201341][ T318] bus_register+0x184/0x4d0 [ 26.205907][ T318] scsi_sysfs_register+0x1c/0x80 [ 26.210876][ T318] init_scsi+0x51/0xd0 [ 26.214974][ T318] do_one_initcall+0x1e8/0x6a0 [ 26.219762][ T318] page last free pid 1 tgid 1 stack trace: [ 26.225580][ T318] __free_pages_ok+0xc5d/0xf30 [ 26.230368][ T318] free_unref_page+0x466/0xf50 [ 26.235158][ T318] __folio_put+0x272/0x2c0 [ 26.239624][ T318] free_large_kmalloc+0xb7/0x110 [ 26.244588][ T318] kfree+0x209/0x440 [ 26.248511][ T318] kvfree+0x39/0x50 [ 26.252343][ T318] btf_check_all_metas+0x60b/0xbd0 [ 26.257680][ T318] btf_parse_base+0x36d/0x6e0 [ 26.262378][ T318] btf_parse_vmlinux+0xb6/0x3b0 [ 26.267251][ T318] bpf_get_btf_vmlinux+0x45/0x70 [ 26.272222][ T318] btf_get_module_btf+0x85/0x200 [ 26.277185][ T318] __register_btf_kfunc_id_set+0xbe/0x1f10 [ 26.283032][ T318] register_btf_kfunc_id_set+0xaa/0xf0 [ 26.288533][ T318] wakeup_sources_bpf_init+0x1b/0x65 [ 26.293862][ T318] wakeup_sources_init+0x2e/0x4b [ 26.298841][ T318] do_one_initcall+0x1e8/0x6a0 [ 26.303633][ T318] [ 26.305983][ T318] Memory state around the buggy address: [ 26.311656][ T318] ffff88810c666880: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 26.319754][ T318] ffff88810c666900: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 26.327853][ T318] >ffff88810c666980: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 26.331945][ T325] netlink: 'syz.2.3': attribute type 4 has an invalid length. [ 26.335967][ T318] ^ [ 26.335986][ T318] ffff88810c666a00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 26.336003][ T318] ffff88810c666a80: 00 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc [ 26.364469][ T318] ================================================================== [ 26.393423][ T318] Disabling lock debugging due to kernel taint [ 26.399739][ T318] device-mapper: table: 252:0: device 1:0 not in table devices list [ 26.408257][ T318] device-mapper: table: 252:0: snapshot-merge: COW device cannot be the same as origin device (-EINVAL) [ 26.420052][ T318] device-mapper: ioctl: error adding target to table [ 26.423804][ T319] netlink: 'syz.2.3': attribute type 4 has an invalid length. [ 26.427532][ T318] device-mapper: table: 252:0: dm_table_destroy: dm_put_device call missing for 1:0 [ 26.455871][ T319] netlink: 'syz.2.3': attribute type 4 has an invalid length.