program: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000001380), 0x282, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./proc\x00', 0x4, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000900)={@cgroup, 0xffffffffffffffff, 0x6, 0x203e}, 0x20) write(r1, &(0x7f0000000100)='1', 0x1) (async) write(r1, &(0x7f0000000100)='1', 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000980), 0x20000, 0x0) syz_emit_vhci(&(0x7f00000009c0)=ANY=[@ANYBLOB="043e110b"], 0xfc) syz_emit_ethernet(0x5eb, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd68b5b94505b532fffe80000000000000000000000000000cfe800000000000000000000000000013000004d40000000200000000634f0bcc03510601fe8000000000000000000000000000bbff0200000000000000000000000000010006000200000000fc000000000000000000000000000000fe880000000000000000000000000001ff0200000000000000000000000000013a07000000000000050200080233480e70bef9b1bc612091475e0ed9b8a6f75955ebc6320e538060733fce55a0cf021be4d5466dd8b63f23fbed69012acbae0225000000000000000206010500000000fc000000000000000000000000000001fc020000000000000000000000000000fe80000000000000000000000000002d21000938640000006c0e00000000000007180000000004800300fcffffffffffffff0004000000000000050200040738000000000c01faff060000000000000006000000000000000700000000000000050000000000000005000000000000000600000000000000071800000001043603000900000000000000ff010000000000000000000000005e1800000000000005020002c910fc01000000000000000000000000000107100000000102b8f5ff8000000000000000079169266268ed4b65197a88892119ad3161359e6b6383e866cd32c15fe86014f36cd08e331c9044bd8a1b635165c37c482611295f6860850341bb2625be024b16eee06b9f38263a08495225a17febc83355e3710fdb7b60de09c9947af9ba6a39bd3d486b91a13bd787d1581879c6183cdc92e912cf88bb97015c8917653643fd6f85591596c9c9a289afc25c04243f47fc40c2040000006d000000000000001d000f91650000003c0c040602300800fe800000000000000000000000000024fe8000000000000000000000000000bbfe80000000000000000000000000000dfc020000000000000000000000000000fe80000000000000000000000000000c00000000000000000000ffffac14141f330a010600000000fc010000000000000000000000000001fe8000000000000000000000000000190000000000000000000000000000000000000000000000000000000000000001fc0200000000000000000000000000012109000000000000c204000000600730000000030a0306000101000000000000d5000000000000004879ffffffffffff01000000000000000100008000000000c910200100000000000000000000000000010000000000000000000000000000000000000000000300004e2200004e24000000000000000000450e01f800660000d9119078ac1414167f0000014e224e2001e4907881ff00009c51dede3a6de2f4287c1e9ef9baa15c9a6618e11705f070f8bf2a491fc2f04ab805d123574e6eac519143e81e1ee9f1c65abf68a02a4896bfaf58d1ba2869b00227ccdd71aa21d08cb645a4daefbd50bf71090950c516f2f77aa83ff58dc05f39cf47534a7148032cd309e3650c3a95001348a43d65a8e2bb4c453d75a3075c9a4e9194977d30bd618e808727fd7872826e00e786d0ef64e6e9016cbed8b64579d41d483156134cb6206239bc490c545e894ded3c4393ea2559444f0e551b4c7867ef4ca099ea4dcf971e4a9e74cc4c74aa03f537f96739c9791a8406ea4108820ded90f2fd56fa0a7e0c895719bc5390686ab7cf277603e78e623ec670e0ba4be4aed47b97d57e14ab6fd94ebdbe961da856476f25fa70e68d6a1246358c4aabc89b84e4a681bfa1e162a1aad0ce378377f57c73f9aaa57df236b14dbdd36474947a72edf6eff0cbaa915f31730358b8f15c451cd46a768cc2c2b5df1d0f9be07f6e61c85e8937b1dc1582c9721303d174c681cf8af34c13f962e30fccb8320403f0f6a4ad122edb25a6e9a3e4ea0803babdf19f79297b7411772963cd42363c2e69c4da0cd4feca23e3f8fd4a632e4e1349f112d463245877459fea09e4339ccb78c68489009959426cf61d92462cbf6993e0c6a7c9297fee751e61e58da8000e32fffe880000000000000000000000000001fe800000000000000000000000000016000004d50000040000000003"], 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a00)={0x6, 0x4, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c00000095"], &(0x7f0000000b00)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000b40)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000b80)={r3, r4}, 0x40) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000b80)={r3, r4}, 0x40) syz_emit_ethernet(0xfdef, &(0x7f0000000bc0)={@link_local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53aff", 0x30, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x32, 0x0, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}}}}, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000001480)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x29001, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}, @uuid={'CRP-syz', 0x0, '1\x00'}}}) (async) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000001480)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x29001, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}, @uuid={'CRP-syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x9c00, 0x0, 0x0, @by_dev={r5}, [@snapshot={0x0, 0x18, 0x0, 0x80, 'snapshot-merge\x00', {@ram_num={'1:', 0x1}, 0x20, @ram={'/dev/ram', 0x1}, 0x20, 'P', 0x20, '16', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) (async) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x9c00, 0x0, 0x0, @by_dev={r5}, [@snapshot={0x0, 0x18, 0x0, 0x80, 'snapshot-merge\x00', {@ram_num={'1:', 0x1}, 0x20, @ram={'/dev/ram', 0x1}, 0x20, 'P', 0x20, '16', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000940), 0x1, 0x0) [ 383.894176][ T4667] Bluetooth: hci0: command tx timeout [ 384.010172][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 384.010301][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 384.212835][ T5400] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3) [ 384.261823][ T5401] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(9) [ 384.262390][ T5400] ================================================================== [ 384.262417][ T5400] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 384.262552][ T5400] Read of size 8 at addr ffff8880389e8198 by task syz.0.0/5400 [ 384.262597][ T5400] [ 384.262614][ T5400] CPU: 0 UID: 0 PID: 5400 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 384.262639][ T5400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 384.262646][ T5400] Call Trace: [ 384.262659][ T5400] [ 384.262677][ T5400] dump_stack_lvl+0xe8/0x150 [ 384.262718][ T5400] print_address_description+0x55/0x1e0 [ 384.262754][ T5400] ? snapshot_ctr+0x5cb/0x1340 [ 384.262769][ T5400] print_report+0x58/0x70 [ 384.262786][ T5400] kasan_report+0x117/0x150 [ 384.262816][ T5400] ? snapshot_ctr+0x5cb/0x1340 [ 384.262832][ T5400] snapshot_ctr+0x5cb/0x1340 [ 384.262851][ T5400] ? __pfx_snapshot_ctr+0x10/0x10 [ 384.262864][ T5400] ? skip_spaces+0x8a/0xa0 [ 384.262913][ T5400] ? dm_split_args+0x50b/0x5d0 [ 384.262943][ T5400] dm_table_add_target+0x58d/0xc70 [ 384.262957][ T5400] table_load+0x325/0x8a0 [ 384.262975][ T5400] ? __pfx_table_load+0x10/0x10 [ 384.262993][ T5400] ? __might_fault+0xaf/0x130 [ 384.263021][ T5400] dm_ctl_ioctl+0x9ec/0xe10 [ 384.263039][ T5400] ? __pfx_table_load+0x10/0x10 [ 384.263055][ T5400] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 384.263078][ T5400] ? __fget_files+0x2a/0x420 [ 384.263096][ T5400] ? bpf_lsm_file_ioctl+0x9/0x20 [ 384.263141][ T5400] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 384.263156][ T5400] __se_sys_ioctl+0xfc/0x170 [ 384.263170][ T5400] do_syscall_64+0x166/0x520 [ 384.263227][ T5400] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.263238][ T5400] ? clear_bhb_loop+0x70/0xc0 [ 384.263250][ T5400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.263260][ T5400] RIP: 0033:0x7f5f7139f559 [ 384.263271][ T5400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.263281][ T5400] RSP: 002b:00007f5f6d7f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 384.263302][ T5400] RAX: ffffffffffffffda RBX: 00007f5f71625fa0 RCX: 00007f5f7139f559 [ 384.263311][ T5400] RDX: 0000200000000740 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 384.263318][ T5400] RBP: 00007f5f71436b20 R08: 0000000000000000 R09: 0000000000000000 [ 384.263326][ T5400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 384.263333][ T5400] R13: 00007f5f71626038 R14: 00007f5f71625fa0 R15: 00007ffd1a6f9a28 [ 384.263347][ T5400] [ 384.263352][ T5400] [ 384.263355][ T5400] Allocated by task 5400: [ 384.263373][ T5400] kasan_save_track+0x3e/0x80 [ 384.263384][ T5400] __kasan_kmalloc+0x93/0xb0 [ 384.263393][ T5400] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 384.263403][ T5400] dm_get_table_device+0x23e/0x730 [ 384.263414][ T5400] dm_get_device+0x327/0x760 [ 384.263422][ T5400] snapshot_ctr+0x2b2/0x1340 [ 384.263434][ T5400] dm_table_add_target+0x58d/0xc70 [ 384.263442][ T5400] table_load+0x325/0x8a0 [ 384.263456][ T5400] dm_ctl_ioctl+0x9ec/0xe10 [ 384.263469][ T5400] __se_sys_ioctl+0xfc/0x170 [ 384.263480][ T5400] do_syscall_64+0x166/0x520 [ 384.263493][ T5400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.263502][ T5400] [ 384.263505][ T5400] Freed by task 5400: [ 384.263510][ T5400] kasan_save_track+0x3e/0x80 [ 384.263519][ T5400] kasan_save_free_info+0x40/0x50 [ 384.263533][ T5400] __kasan_slab_free+0x5c/0x80 [ 384.263543][ T5400] kfree+0x1c5/0x650 [ 384.263556][ T5400] dm_put_table_device+0x255/0x2a0 [ 384.263566][ T5400] dm_get_device+0x56f/0x760 [ 384.263575][ T5400] snapshot_ctr+0x471/0x1340 [ 384.263589][ T5400] dm_table_add_target+0x58d/0xc70 [ 384.263598][ T5400] table_load+0x325/0x8a0 [ 384.263614][ T5400] dm_ctl_ioctl+0x9ec/0xe10 [ 384.263630][ T5400] __se_sys_ioctl+0xfc/0x170 [ 384.263641][ T5400] do_syscall_64+0x166/0x520 [ 384.263655][ T5400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.263666][ T5400] [ 384.263668][ T5400] The buggy address belongs to the object at ffff8880389e8180 [ 384.263668][ T5400] which belongs to the cache kmalloc-96 of size 96 [ 384.263677][ T5400] The buggy address is located 24 bytes inside of [ 384.263677][ T5400] freed 96-byte region [ffff8880389e8180, ffff8880389e81e0) [ 384.263688][ T5400] [ 384.263691][ T5400] The buggy address belongs to the physical page: [ 384.263697][ T5400] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x389e8 [ 384.263707][ T5400] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 384.263717][ T5400] page_type: f5(slab) [ 384.263726][ T5400] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 384.263736][ T5400] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 384.263741][ T5400] page dumped because: kasan: bad access detected [ 384.263747][ T5400] page_owner tracks the page as allocated [ 384.263750][ T5400] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 181, tgid 181 (kworker/u4:6), ts 19692848807 [ 384.263767][ T5400] post_alloc_hook+0x1f9/0x250 [ 384.263783][ T5400] get_page_from_freelist+0x220f/0x2280 [ 384.263794][ T5400] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 384.263803][ T5400] allocate_slab+0x7d/0x5e0 [ 384.263816][ T5400] refill_objects+0x2d5/0x350 [ 384.263828][ T5400] __pcs_replace_empty_main+0x2c8/0x6c0 [ 384.263840][ T5400] __kmalloc_noprof+0x476/0x710 [ 384.263849][ T5400] security_task_alloc+0x4d/0x330 [ 384.263865][ T5400] copy_process+0x1c75/0x44b0 [ 384.263892][ T5400] kernel_clone+0x2d7/0x940 [ 384.263906][ T5400] user_mode_thread+0x115/0x180 [ 384.263920][ T5400] call_usermodehelper_exec_work+0x5c/0x230 [ 384.263940][ T5400] process_scheduled_works+0xc3d/0x1630 [ 384.263954][ T5400] worker_thread+0xa47/0xfb0 [ 384.263967][ T5400] kthread+0x38b/0x480 [ 384.263977][ T5400] ret_from_fork+0x514/0xb70 [ 384.264001][ T5400] page last free pid 181 tgid 181 ts 19692758708 stack trace: [ 384.264058][ T5400] __free_frozen_pages+0xc97/0xd90 [ 384.264077][ T5400] __kasan_populate_vmalloc+0x12d/0x1c0 [ 384.264086][ T5400] alloc_vmap_area+0xd10/0x1410 [ 384.264103][ T5400] __get_vm_area_node+0x200/0x2f0 [ 384.264116][ T5400] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 384.264130][ T5400] __vmalloc_node_noprof+0xc2/0x100 [ 384.264142][ T5400] dup_task_struct+0x2c6/0xa00 [ 384.264154][ T5400] copy_process+0x7ea/0x44b0 [ 384.264165][ T5400] kernel_clone+0x2d7/0x940 [ 384.264178][ T5400] user_mode_thread+0x115/0x180 [ 384.264191][ T5400] call_usermodehelper_exec_work+0x5c/0x230 [ 384.264203][ T5400] process_scheduled_works+0xc3d/0x1630 [ 384.264223][ T5400] worker_thread+0xa47/0xfb0 [ 384.264237][ T5400] kthread+0x38b/0x480 [ 384.264247][ T5400] ret_from_fork+0x514/0xb70 [ 384.264257][ T5400] ret_from_fork_asm+0x1a/0x30 [ 384.264267][ T5400] [ 384.264269][ T5400] Memory state around the buggy address: [ 384.264277][ T5400] ffff8880389e8080: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 384.264285][ T5400] ffff8880389e8100: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 384.264292][ T5400] >ffff8880389e8180: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 384.264297][ T5400] ^ [ 384.264302][ T5400] ffff8880389e8200: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 384.264309][ T5400] ffff8880389e8280: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 384.264315][ T5400] ================================================================== [ 384.264374][ T5400] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 384.584482][ T5400] CPU: 0 UID: 0 PID: 5400 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 384.588568][ T5400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 384.593456][ T5400] Call Trace: [ 384.595086][ T5400] [ 384.596505][ T5400] vpanic+0x56d/0xa60 [ 384.598413][ T5400] ? __pfx_vpanic+0x10/0x10 [ 384.600380][ T5400] panic+0xc5/0xd0 [ 384.602065][ T5400] ? __pfx_panic+0x10/0x10 [ 384.604047][ T5400] ? preempt_schedule_thunk+0x16/0x40 [ 384.606398][ T5400] ? snapshot_ctr+0x5cb/0x1340 [ 384.608516][ T5400] ? preempt_schedule_thunk+0x16/0x40 [ 384.610913][ T5400] ? snapshot_ctr+0x5cb/0x1340 [ 384.612980][ T5400] check_panic_on_warn+0x89/0xb0 [ 384.615237][ T5400] ? snapshot_ctr+0x5cb/0x1340 [ 384.617357][ T5400] end_report+0x73/0x170 [ 384.619259][ T5400] ? snapshot_ctr+0x5cb/0x1340 [ 384.621406][ T5400] kasan_report+0x128/0x150 [ 384.623490][ T5400] ? snapshot_ctr+0x5cb/0x1340 [ 384.625645][ T5400] snapshot_ctr+0x5cb/0x1340 [ 384.627737][ T5400] ? __pfx_snapshot_ctr+0x10/0x10 [ 384.629936][ T5400] ? skip_spaces+0x8a/0xa0 [ 384.631946][ T5400] ? dm_split_args+0x50b/0x5d0 [ 384.634114][ T5400] dm_table_add_target+0x58d/0xc70 [ 384.636365][ T5400] table_load+0x325/0x8a0 [ 384.638116][ T5400] ? __pfx_table_load+0x10/0x10 [ 384.640027][ T5400] ? __might_fault+0xaf/0x130 [ 384.642159][ T5400] dm_ctl_ioctl+0x9ec/0xe10 [ 384.644260][ T5400] ? __pfx_table_load+0x10/0x10 [ 384.646465][ T5400] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 384.648776][ T5400] ? __fget_files+0x2a/0x420 [ 384.650864][ T5400] ? bpf_lsm_file_ioctl+0x9/0x20 [ 384.652985][ T5400] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 384.655276][ T5400] __se_sys_ioctl+0xfc/0x170 [ 384.657340][ T5400] do_syscall_64+0x166/0x520 [ 384.659285][ T5400] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.661792][ T5400] ? clear_bhb_loop+0x70/0xc0 [ 384.663804][ T5400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.666362][ T5400] RIP: 0033:0x7f5f7139f559 [ 384.668288][ T5400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.676132][ T5400] RSP: 002b:00007f5f6d7f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 384.679916][ T5400] RAX: ffffffffffffffda RBX: 00007f5f71625fa0 RCX: 00007f5f7139f559 [ 384.683248][ T5400] RDX: 0000200000000740 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 384.686532][ T5400] RBP: 00007f5f71436b20 R08: 0000000000000000 R09: 0000000000000000 [ 384.689763][ T5400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 384.692971][ T5400] R13: 00007f5f71626038 R14: 00007f5f71625fa0 R15: 00007ffd1a6f9a28 [ 384.696142][ T5400] [ 384.697896][ T5400] Kernel Offset: disabled [ 384.699732][ T5400] Rebooting in 86400 seconds..