program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi4\x00', 0x40000, 0x0) (async) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi4\x00', 0x40000, 0x0) ioctl$COMEDI_INSNLIST(r1, 0x8010640b, &(0x7f00001859c0)={0x1, &(0x7f0000185780)=[{0x4000000, 0x0, 0x0, 0x0, 0x3}]}) (async) ioctl$COMEDI_INSNLIST(r1, 0x8010640b, &(0x7f00001859c0)={0x1, &(0x7f0000185780)=[{0x4000000, 0x0, 0x0, 0x0, 0x3}]}) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') [ 77.276582][ T5322] ================================================================== [ 77.279749][ T5322] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 77.283106][ T5322] Read of size 4 at addr ffff8880363da43c by task syz.0.0/5322 [ 77.286229][ T5322] [ 77.287275][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 77.287288][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.287294][ T5322] Call Trace: [ 77.287300][ T5322] [ 77.287305][ T5322] dump_stack_lvl+0xe8/0x150 [ 77.287324][ T5322] print_address_description+0x55/0x1e0 [ 77.287339][ T5322] ? dvb_frontend_release+0x407/0x4d0 [ 77.287354][ T5322] print_report+0x58/0x70 [ 77.287366][ T5322] kasan_report+0x117/0x150 [ 77.287381][ T5322] ? dvb_frontend_release+0x407/0x4d0 [ 77.287395][ T5322] dvb_frontend_release+0x407/0x4d0 [ 77.287410][ T5322] ? __pfx_dvb_frontend_release+0x10/0x10 [ 77.287424][ T5322] __fput+0x418/0xa50 [ 77.287438][ T5322] task_work_run+0x1d9/0x270 [ 77.287449][ T5322] ? __pfx_task_work_run+0x10/0x10 [ 77.287461][ T5322] get_signal+0x1181/0x12c0 [ 77.287475][ T5322] ? do_raw_spin_lock+0x12b/0x2f0 [ 77.287488][ T5322] arch_do_signal_or_restart+0xbb/0x860 [ 77.287502][ T5322] ? do_raw_spin_unlock+0x4d/0x210 [ 77.287512][ T5322] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 77.287528][ T5322] exit_to_user_mode_loop+0x104/0x730 [ 77.287543][ T5322] ? rcu_is_watching+0x15/0xb0 [ 77.287553][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.287564][ T5322] do_syscall_64+0x353/0x580 [ 77.287575][ T5322] ? clear_bhb_loop+0x40/0x90 [ 77.287586][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.287597][ T5322] RIP: 0033:0x7f10a6d9de99 [ 77.287608][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.287616][ T5322] RSP: 002b:00007fff8302fbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 77.287628][ T5322] RAX: 0000000000000000 RBX: 00007f10a7027da0 RCX: 00007f10a6d9de99 [ 77.287635][ T5322] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 77.287641][ T5322] RBP: 00007f10a7027da0 R08: 00007f10a7026038 R09: 0000000000000000 [ 77.287648][ T5322] R10: 0000000000dffd68 R11: 0000000000000246 R12: 000000000001306b [ 77.287655][ T5322] R13: 00007f10a702609c R14: 0000000000012d6a R15: 00007f10a7026090 [ 77.287666][ T5322] [ 77.287670][ T5322] [ 77.379561][ T5322] Allocated by task 1: [ 77.381166][ T5322] kasan_save_track+0x3e/0x80 [ 77.382968][ T5322] __kasan_kmalloc+0x93/0xb0 [ 77.384588][ T5322] __kmalloc_cache_noprof+0x32d/0x660 [ 77.386376][ T5322] dvb_register_device+0x309/0x1dd0 [ 77.388458][ T5322] dvb_register_frontend+0x603/0x900 [ 77.390503][ T5322] vidtv_bridge_probe+0x9d5/0xf60 [ 77.392463][ T5322] platform_probe+0xf9/0x190 [ 77.394308][ T5322] really_probe+0x254/0xae0 [ 77.396121][ T5322] __driver_probe_device+0x1e8/0x360 [ 77.398228][ T5322] driver_probe_device+0x4f/0x240 [ 77.400287][ T5322] __driver_attach+0x339/0x600 [ 77.402201][ T5322] bus_for_each_dev+0x23b/0x2c0 [ 77.404199][ T5322] bus_add_driver+0x345/0x670 [ 77.406060][ T5322] driver_register+0x23a/0x320 [ 77.407949][ T5322] vidtv_bridge_init+0x3d/0x60 [ 77.409970][ T5322] do_one_initcall+0x250/0x870 [ 77.411976][ T5322] do_initcall_level+0x10a/0x1a0 [ 77.414028][ T5322] do_initcalls+0x59/0xa0 [ 77.415721][ T5322] kernel_init_freeable+0x29d/0x3e0 [ 77.417786][ T5322] kernel_init+0x1d/0x1d0 [ 77.419597][ T5322] ret_from_fork+0x514/0xb70 [ 77.421355][ T5322] ret_from_fork_asm+0x1a/0x30 [ 77.423307][ T5322] [ 77.424292][ T5322] Freed by task 5322: [ 77.425934][ T5322] kasan_save_track+0x3e/0x80 [ 77.427901][ T5322] kasan_save_free_info+0x40/0x50 [ 77.429990][ T5322] __kasan_slab_free+0x5c/0x80 [ 77.432061][ T5322] kfree+0x1c5/0x640 [ 77.433684][ T5322] dvb_generic_release+0x11d/0x1b0 [ 77.435839][ T5322] dvb_frontend_release+0x132/0x4d0 [ 77.438019][ T5322] __fput+0x418/0xa50 [ 77.439679][ T5322] task_work_run+0x1d9/0x270 [ 77.441663][ T5322] get_signal+0x1181/0x12c0 [ 77.443689][ T5322] arch_do_signal_or_restart+0xbb/0x860 [ 77.445988][ T5322] exit_to_user_mode_loop+0x104/0x730 [ 77.448229][ T5322] do_syscall_64+0x353/0x580 [ 77.450216][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.452764][ T5322] [ 77.453790][ T5322] The buggy address belongs to the object at ffff8880363da400 [ 77.453790][ T5322] which belongs to the cache kmalloc-256 of size 256 [ 77.459401][ T5322] The buggy address is located 60 bytes inside of [ 77.459401][ T5322] freed 256-byte region [ffff8880363da400, ffff8880363da500) [ 77.465118][ T5322] [ 77.466156][ T5322] The buggy address belongs to the physical page: [ 77.468918][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x363da [ 77.472679][ T5322] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 77.475650][ T5322] page_type: f5(slab) [ 77.477299][ T5322] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 77.480884][ T5322] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 77.484371][ T5322] page dumped because: kasan: bad access detected [ 77.487084][ T5322] page_owner tracks the page as allocated [ 77.489347][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17877807126, free_ts 17833135737 [ 77.497531][ T5322] post_alloc_hook+0x1f9/0x250 [ 77.499574][ T5322] get_page_from_freelist+0x21fa/0x2270 [ 77.501883][ T5322] __alloc_frozen_pages_noprof+0x18d/0x380 [ 77.504205][ T5322] allocate_slab+0x79/0x5e0 [ 77.506164][ T5322] refill_objects+0x2d5/0x350 [ 77.508198][ T5322] __pcs_replace_empty_main+0x2bf/0x6b0 [ 77.510589][ T5322] __kmalloc_cache_noprof+0x3a7/0x660 [ 77.512904][ T5322] bus_add_driver+0x162/0x670 [ 77.514810][ T5322] driver_register+0x23a/0x320 [ 77.516812][ T5322] i2c_register_driver+0xbb/0x1a0 [ 77.518847][ T5322] do_one_initcall+0x250/0x870 [ 77.520879][ T5322] do_initcall_level+0x10a/0x1a0 [ 77.522979][ T5322] do_initcalls+0x59/0xa0 [ 77.524772][ T5322] kernel_init_freeable+0x29d/0x3e0 [ 77.526930][ T5322] kernel_init+0x1d/0x1d0 [ 77.528672][ T5322] ret_from_fork+0x514/0xb70 [ 77.530510][ T5322] page last free pid 1 tgid 1 stack trace: [ 77.532745][ T5322] __free_frozen_pages+0xc1e/0xd10 [ 77.534731][ T5322] __slab_free+0x274/0x2c0 [ 77.536600][ T5322] qlist_free_all+0x99/0x100 [ 77.538468][ T5322] kasan_quarantine_reduce+0x148/0x160 [ 77.540685][ T5322] __kasan_slab_alloc+0x22/0x80 [ 77.542689][ T5322] __kmalloc_cache_noprof+0x2ab/0x660 [ 77.544927][ T5322] bus_add_driver+0x162/0x670 [ 77.546977][ T5322] driver_register+0x23a/0x320 [ 77.548936][ T5322] usb_register_driver+0x1e4/0x390 [ 77.551142][ T5322] au0828_init+0xb2/0xe0 [ 77.552899][ T5322] do_one_initcall+0x250/0x870 [ 77.554930][ T5322] do_initcall_level+0x10a/0x1a0 [ 77.556980][ T5322] do_initcalls+0x59/0xa0 [ 77.558890][ T5322] kernel_init_freeable+0x29d/0x3e0 [ 77.561149][ T5322] kernel_init+0x1d/0x1d0 [ 77.562983][ T5322] ret_from_fork+0x514/0xb70 [ 77.564879][ T5322] [ 77.565916][ T5322] Memory state around the buggy address: [ 77.568199][ T5322] ffff8880363da300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.571635][ T5322] ffff8880363da380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.574998][ T5322] >ffff8880363da400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.578220][ T5322] ^ [ 77.580679][ T5322] ffff8880363da480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 77.584071][ T5322] ffff8880363da500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.587545][ T5322] ================================================================== [ 77.594010][ T4652] Bluetooth: hci0: command tx timeout [ 77.598888][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 77.603010][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 77.734777][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.737851][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 77.741649][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.745814][ T5322] Call Trace: [ 77.747303][ T5322] [ 77.748593][ T5322] vpanic+0x56c/0xa60 [ 77.750221][ T5322] ? __pfx_vpanic+0x10/0x10 [ 77.752072][ T5322] ? __pfx___schedule+0x10/0x10 [ 77.754041][ T5322] panic+0xc5/0xd0 [ 77.755484][ T5322] ? __pfx_panic+0x10/0x10 [ 77.757137][ T5322] ? preempt_schedule_common+0x82/0xd0 [ 77.759164][ T5322] ? dvb_frontend_release+0x407/0x4d0 [ 77.761496][ T5322] check_panic_on_warn+0x89/0xb0 [ 77.763583][ T5322] ? dvb_frontend_release+0x407/0x4d0 [ 77.765891][ T5322] end_report+0x73/0x170 [ 77.767725][ T5322] ? dvb_frontend_release+0x407/0x4d0 [ 77.770020][ T5322] kasan_report+0x128/0x150 [ 77.771963][ T5322] ? dvb_frontend_release+0x407/0x4d0 [ 77.774255][ T5322] dvb_frontend_release+0x407/0x4d0 [ 77.776460][ T5322] ? __pfx_dvb_frontend_release+0x10/0x10 [ 77.778984][ T5322] __fput+0x418/0xa50 [ 77.780702][ T5322] task_work_run+0x1d9/0x270 [ 77.782632][ T5322] ? __pfx_task_work_run+0x10/0x10 [ 77.784789][ T5322] get_signal+0x1181/0x12c0 [ 77.786696][ T5322] ? do_raw_spin_lock+0x12b/0x2f0 [ 77.788832][ T5322] arch_do_signal_or_restart+0xbb/0x860 [ 77.791147][ T5322] ? do_raw_spin_unlock+0x4d/0x210 [ 77.793370][ T5322] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 77.796071][ T5322] exit_to_user_mode_loop+0x104/0x730 [ 77.798283][ T5322] ? rcu_is_watching+0x15/0xb0 [ 77.800260][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.802810][ T5322] do_syscall_64+0x353/0x580 [ 77.804697][ T5322] ? clear_bhb_loop+0x40/0x90 [ 77.806629][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.809035][ T5322] RIP: 0033:0x7f10a6d9de99 [ 77.810961][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.819328][ T5322] RSP: 002b:00007fff8302fbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 77.823107][ T5322] RAX: 0000000000000000 RBX: 00007f10a7027da0 RCX: 00007f10a6d9de99 [ 77.826590][ T5322] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 77.830074][ T5322] RBP: 00007f10a7027da0 R08: 00007f10a7026038 R09: 0000000000000000 [ 77.833539][ T5322] R10: 0000000000dffd68 R11: 0000000000000246 R12: 000000000001306b [ 77.836834][ T5322] R13: 00007f10a702609c R14: 0000000000012d6a R15: 00007f10a7026090 [ 77.840265][ T5322] [ 77.842030][ T5322] Kernel Offset: disabled [ 77.843946][ T5322] Rebooting in 86400 seconds..