program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) timer_gettime(r0, &(0x7f0000000080)) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x301200) (async, rerun: 64) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (rerun: 64) [ 93.754134][ T4641] Bluetooth: hci0: command tx timeout [ 93.889685][ T5317] ================================================================== [ 93.893227][ T5317] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 93.896853][ T5317] Read of size 4 at addr ffff88803571e23c by task syz.0.0/5317 [ 93.900182][ T5317] [ 93.901297][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.901311][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.901318][ T5317] Call Trace: [ 93.901325][ T5317] [ 93.901331][ T5317] dump_stack_lvl+0xe8/0x150 [ 93.901351][ T5317] print_address_description+0x55/0x1e0 [ 93.901365][ T5317] ? dvb_frontend_release+0x407/0x4d0 [ 93.901379][ T5317] print_report+0x58/0x70 [ 93.901390][ T5317] kasan_report+0x117/0x150 [ 93.901405][ T5317] ? dvb_frontend_release+0x407/0x4d0 [ 93.901420][ T5317] dvb_frontend_release+0x407/0x4d0 [ 93.901433][ T5317] ? __pfx_dvb_frontend_release+0x10/0x10 [ 93.901447][ T5317] __fput+0x418/0xa50 [ 93.901461][ T5317] task_work_run+0x1d9/0x270 [ 93.901478][ T5317] ? __pfx_task_work_run+0x10/0x10 [ 93.901493][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 93.901507][ T5317] do_exit+0x73a/0x2360 [ 93.901522][ T5317] ? __pfx_do_exit+0x10/0x10 [ 93.901536][ T5317] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.901547][ T5317] do_group_exit+0x22d/0x2f0 [ 93.901560][ T5317] ? _raw_spin_unlock_irq+0x23/0x50 [ 93.901575][ T5317] get_signal+0x121b/0x12c0 [ 93.901591][ T5317] arch_do_signal_or_restart+0xbb/0x860 [ 93.901606][ T5317] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 93.901624][ T5317] exit_to_user_mode_loop+0x10e/0x770 [ 93.901637][ T5317] ? rcu_is_watching+0x16/0xb0 [ 93.901648][ T5317] do_syscall_64+0x328/0x520 [ 93.901659][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.901670][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 93.901681][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.901692][ T5317] RIP: 0033:0x7f05f899e0d9 [ 93.901703][ T5317] Code: Unable to access opcode bytes at 0x7f05f899e0af. [ 93.901708][ T5317] RSP: 002b:00007f05f983d0a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 93.901721][ T5317] RAX: fffffffffffffe00 RBX: 00007f05f8c26098 RCX: 00007f05f899e0d9 [ 93.901728][ T5317] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f05f8c26098 [ 93.901735][ T5317] RBP: 00007f05f8c26090 R08: 0000000000000000 R09: 0000000000000000 [ 93.901741][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.901748][ T5317] R13: 00007f05f8c26128 R14: 00007ffe3020eff0 R15: 00007ffe3020f0d8 [ 93.901758][ T5317] [ 93.901762][ T5317] [ 93.995290][ T5317] Allocated by task 1: [ 93.996966][ T5317] kasan_save_track+0x3e/0x80 [ 93.998927][ T5317] __kasan_kmalloc+0x93/0xb0 [ 94.000836][ T5317] __kmalloc_cache_noprof+0x331/0x660 [ 94.002971][ T5317] dvb_register_device+0x309/0x1dd0 [ 94.005030][ T5317] dvb_register_frontend+0x603/0x900 [ 94.007110][ T5317] vidtv_bridge_probe+0x9d5/0xf60 [ 94.009130][ T5317] platform_probe+0xf9/0x190 [ 94.013570][ T5317] really_probe+0x254/0xae0 [ 94.015501][ T5317] __driver_probe_device+0x1e8/0x360 [ 94.018178][ T5317] driver_probe_device+0x4f/0x240 [ 94.020268][ T5317] __driver_attach+0x339/0x600 [ 94.022389][ T5317] bus_for_each_dev+0x23b/0x2c0 [ 94.024463][ T5317] bus_add_driver+0x345/0x670 [ 94.026531][ T5317] driver_register+0x23a/0x320 [ 94.028614][ T5317] vidtv_bridge_init+0x3d/0x60 [ 94.030763][ T5317] do_one_initcall+0x250/0x870 [ 94.032947][ T5317] do_initcall_level+0x10a/0x1a0 [ 94.035042][ T5317] do_initcalls+0x59/0xa0 [ 94.036877][ T5317] kernel_init_freeable+0x29d/0x3e0 [ 94.039055][ T5317] kernel_init+0x22/0x1d0 [ 94.040875][ T5317] ret_from_fork+0x514/0xb70 [ 94.042889][ T5317] ret_from_fork_asm+0x1a/0x30 [ 94.044986][ T5317] [ 94.046048][ T5317] Freed by task 5317: [ 94.047753][ T5317] kasan_save_track+0x3e/0x80 [ 94.049710][ T5317] kasan_save_free_info+0x40/0x50 [ 94.051826][ T5317] __kasan_slab_free+0x5c/0x80 [ 94.053933][ T5317] kfree+0x1c5/0x640 [ 94.055618][ T5317] dvb_generic_release+0x11d/0x1b0 [ 94.057795][ T5317] dvb_frontend_release+0x132/0x4d0 [ 94.059917][ T5317] __fput+0x418/0xa50 [ 94.061643][ T5317] task_work_run+0x1d9/0x270 [ 94.063697][ T5317] do_exit+0x73a/0x2360 [ 94.065486][ T5317] do_group_exit+0x22d/0x2f0 [ 94.067433][ T5317] get_signal+0x121b/0x12c0 [ 94.069328][ T5317] arch_do_signal_or_restart+0xbb/0x860 [ 94.071579][ T5317] exit_to_user_mode_loop+0x10e/0x770 [ 94.073778][ T5317] do_syscall_64+0x328/0x520 [ 94.075616][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.077950][ T5317] [ 94.078994][ T5317] The buggy address belongs to the object at ffff88803571e200 [ 94.078994][ T5317] which belongs to the cache kmalloc-256 of size 256 [ 94.084714][ T5317] The buggy address is located 60 bytes inside of [ 94.084714][ T5317] freed 256-byte region [ffff88803571e200, ffff88803571e300) [ 94.090398][ T5317] [ 94.091421][ T5317] The buggy address belongs to the physical page: [ 94.094515][ T5317] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3571e [ 94.098247][ T5317] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 94.101366][ T5317] page_type: f5(slab) [ 94.103238][ T5317] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 94.107033][ T5317] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 94.110671][ T5317] page dumped because: kasan: bad access detected [ 94.113316][ T5317] page_owner tracks the page as allocated [ 94.115764][ T5317] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20731433300, free_ts 20726025093 [ 94.124145][ T5317] post_alloc_hook+0x1f9/0x250 [ 94.126383][ T5317] get_page_from_freelist+0x21fe/0x2270 [ 94.128888][ T5317] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.131407][ T5317] allocate_slab+0x79/0x5e0 [ 94.133491][ T5317] refill_objects+0x2d5/0x350 [ 94.135600][ T5317] __pcs_replace_empty_main+0x2c3/0x6b0 [ 94.138154][ T5317] __kmalloc_cache_noprof+0x3ab/0x660 [ 94.140594][ T5317] bus_add_driver+0x162/0x670 [ 94.142673][ T5317] driver_register+0x23a/0x320 [ 94.144753][ T5317] usb_register_driver+0x1e4/0x390 [ 94.146941][ T5317] do_one_initcall+0x250/0x870 [ 94.149040][ T5317] do_initcall_level+0x10a/0x1a0 [ 94.151147][ T5317] do_initcalls+0x59/0xa0 [ 94.153085][ T5317] kernel_init_freeable+0x29d/0x3e0 [ 94.155243][ T5317] kernel_init+0x22/0x1d0 [ 94.157041][ T5317] ret_from_fork+0x514/0xb70 [ 94.158937][ T5317] page last free pid 1 tgid 1 stack trace: [ 94.161470][ T5317] __free_frozen_pages+0xc22/0xd20 [ 94.164191][ T5317] __slab_free+0x274/0x2c0 [ 94.166597][ T5317] qlist_free_all+0x99/0x100 [ 94.168621][ T5317] kasan_quarantine_reduce+0x148/0x160 [ 94.170879][ T5317] __kasan_slab_alloc+0x22/0x80 [ 94.172958][ T5317] kmem_cache_alloc_noprof+0x2a4/0x5f0 [ 94.175217][ T5317] __kernfs_new_node+0xe6/0x980 [ 94.177255][ T5317] kernfs_new_node+0xea/0x140 [ 94.179225][ T5317] __kernfs_create_file+0x4b/0x2e0 [ 94.181408][ T5317] sysfs_add_file_mode_ns+0x237/0x300 [ 94.183747][ T5317] sysfs_create_file_ns+0x12b/0x1b0 [ 94.186039][ T5317] usb_register_driver+0x30f/0x390 [ 94.188158][ T5317] do_one_initcall+0x250/0x870 [ 94.190106][ T5317] do_initcall_level+0x10a/0x1a0 [ 94.192141][ T5317] do_initcalls+0x59/0xa0 [ 94.193960][ T5317] kernel_init_freeable+0x29d/0x3e0 [ 94.196129][ T5317] [ 94.197156][ T5317] Memory state around the buggy address: [ 94.199436][ T5317] ffff88803571e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.202832][ T5317] ffff88803571e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.206073][ T5317] >ffff88803571e200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.209396][ T5317] ^ [ 94.211846][ T5317] ffff88803571e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.215207][ T5317] ffff88803571e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.218524][ T5317] ================================================================== [ 94.244812][ T5317] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.247803][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.251495][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.255530][ T5317] Call Trace: [ 94.256973][ T5317] [ 94.258210][ T5317] vpanic+0x56d/0xa60 [ 94.259884][ T5317] ? __pfx_vpanic+0x10/0x10 [ 94.261724][ T5317] ? __pfx___schedule+0x10/0x10 [ 94.263737][ T5317] panic+0xc5/0xd0 [ 94.265314][ T5317] ? __pfx_panic+0x10/0x10 [ 94.267189][ T5317] ? preempt_schedule_common+0x7f/0xd0 [ 94.269500][ T5317] ? dvb_frontend_release+0x407/0x4d0 [ 94.271702][ T5317] check_panic_on_warn+0x89/0xb0 [ 94.273880][ T5317] ? dvb_frontend_release+0x407/0x4d0 [ 94.276070][ T5317] end_report+0x73/0x170 [ 94.277829][ T5317] ? dvb_frontend_release+0x407/0x4d0 [ 94.279925][ T5317] kasan_report+0x128/0x150 [ 94.281872][ T5317] ? dvb_frontend_release+0x407/0x4d0 [ 94.284229][ T5317] dvb_frontend_release+0x407/0x4d0 [ 94.286456][ T5317] ? __pfx_dvb_frontend_release+0x10/0x10 [ 94.288813][ T5317] __fput+0x418/0xa50 [ 94.290477][ T5317] task_work_run+0x1d9/0x270 [ 94.292433][ T5317] ? __pfx_task_work_run+0x10/0x10 [ 94.294561][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 94.296696][ T5317] do_exit+0x73a/0x2360 [ 94.298444][ T5317] ? __pfx_do_exit+0x10/0x10 [ 94.300456][ T5317] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.302646][ T5317] do_group_exit+0x22d/0x2f0 [ 94.304644][ T5317] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.306805][ T5317] get_signal+0x121b/0x12c0 [ 94.308560][ T5317] arch_do_signal_or_restart+0xbb/0x860 [ 94.310864][ T5317] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 94.313542][ T5317] exit_to_user_mode_loop+0x10e/0x770 [ 94.315904][ T5317] ? rcu_is_watching+0x16/0xb0 [ 94.318011][ T5317] do_syscall_64+0x328/0x520 [ 94.320061][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.322748][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.324773][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.327323][ T5317] RIP: 0033:0x7f05f899e0d9 [ 94.329298][ T5317] Code: Unable to access opcode bytes at 0x7f05f899e0af. [ 94.332125][ T5317] RSP: 002b:00007f05f983d0a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 94.335566][ T5317] RAX: fffffffffffffe00 RBX: 00007f05f8c26098 RCX: 00007f05f899e0d9 [ 94.338805][ T5317] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f05f8c26098 [ 94.341995][ T5317] RBP: 00007f05f8c26090 R08: 0000000000000000 R09: 0000000000000000 [ 94.345388][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.348786][ T5317] R13: 00007f05f8c26128 R14: 00007ffe3020eff0 R15: 00007ffe3020f0d8 [ 94.352091][ T5317] [ 94.353831][ T5317] Kernel Offset: disabled [ 94.355635][ T5317] Rebooting in 86400 seconds..