program: openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000100)=0xb0000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x10, r1, 0x17686000) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r2, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e, 0x0, 0xfffffffffffffffc}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYRESOCT, @ANYRESDEC=r3, @ANYRESHEX=r0, @ANYRES32=0x0, @ANYRES16=r3, @ANYRESHEX=r1], 0x50) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f0000000240)={[{@nombcache}, {@nouid32}, {@inlinecrypt}, {@delalloc}, {@noload}, {@delalloc}, {@nobarrier}, {@dax_never}, {@lazytime}]}, 0x3, 0x4ea, &(0x7f00000006c0)="$eJzs3UtvG1sdAPD/OPa9yW3AuYVFqURb+lCKoE7S9BGxKK3EY1UJUfZpSJwoihNXidM2UQXuJwChCpBYsWKDxAdAQv0ICKkS7FiwAlWQ0gUbZDR+tI1jh+TWjdvk95NO58w59fz/x4/xnJlRHMCRdSYibkbEQERciIh8sz3TLFFtlPT/vdh6NJuWJGq1O/9MImm2tW/zWPNhqe9/N+KHyc64axubSzOlUnF1e/PmpcXlmYXiQnFlcnLi2tT1qatT43scSZLdrXc4Im586+XPf/Kb79z4w9cf/G36Hxd/lKZ1t9nfaRy90Bh6LgZbDdV3EaV/0vdNtj5CAAA+BOcj4nhEnI2Ir0Y+BmLXw2gAAADgA1T75vDHrSoAAABwOGXq98YmmULzft/hyGQKhcY9vF+MTzKl8lrla/Pl9ZW5xj20I5HLzC+WiuPNe4VHIpek6xP1+uv1y23rkxHxaUQ8yQ+l6/U+AAAA4GAca5v/v8w35v8AAADAIeNiPAAAABx+5v8AAABw+Jn/AwAAwKH2vdu301J7sfWo/jsAc/c31pfK9y/NFdeWCsvrs4XZ8uq9wkK5vFAqFgb+//ZK5fK9K7Gy/nCskl2rjK1tbE4vl9dXKtP13/WeLh4/gDEBAAAA2316+ulfkoiofmOoXlIfNftyfc0MeI8k2baGu1/pUyZAT+zhlP52Z9bfTSLAgWv/TgeODnN8IGlvaDswGOx2qPDH/cdyzAEAAP0x+iXX/+GoyvQ7AaBvftrvBIC+cS4ejq7c/u8ABA6ZHdf/2wx269jz9f9abV8JAQAAPTfcWFSjeS1wODKZQuHVZcFkfrFUHI+Iz0fEn/O5j9P1iT7mCwAAAAAAAAAAAAAAAAAAAAAAAAAfolotiRoAAABwqEVk/p40f/9rNH9+uP38wEfJf/L1ZUQ8+NWdXzycqVRWJ9L2f71qr/yy2X65H2cwAAAA4CjK7drbmqe35vEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0Esvth7NtspBxn1+K4ZipFP8bAzWl4ORi4hP/p1E9o3HJREx0IP41ccRcaJT/CRNK0aaWbTHz0TEUJ/jH+tBfDjKnt6KiJudPn+ZOFNfdv78ZZvlbT2/Vf+Qd4zf2v8NdNn/fW6PMU4++91Y1/iPI05mO+9/WvGTLvHP7TH+3R9sbnbrq/06YrTj90+yLdZYZfne2NrG5qXF5ZmF4kJxZXJy4trU9amrU+Nj84ulYvPfjjF+9uXfV590HX+mvnwzfmucI40Mf9xt/Of3OP7/Pnu49YVGNbczfsTFc51f/xP1ZefnP31PXGh+D6T9o616tVF/06nf/ulUt9zS+HNdnv/G65+vdRv/xb0Nf8eYAYD+WtvYXJoplYqrB1A5e6V3G0wOKGeVLpXB9yONg658+6230zocfpvt/LVn40rnDJ27+rxjAgAAeu71QX+/MwEAAAAAAAAAAAAAAAAAAICj6zP98bDT+3tUe8xqf4YKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCr/wUAAP//GpnIcw==") r5 = fanotify_init(0x8, 0x40000) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') fanotify_mark(r5, 0x1, 0x8100011, r6, 0x0) r7 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$binfmt_register(r7, &(0x7f0000000400)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0x1, 0x3a, 'usrj\x17\x03&\xee\xa2\xca8\xc8G\x11\x0e\xfe\x16\xb2\xe6\xaai\xd1Q\x00\x00\x00\x00\xab\x98\x00\x00\x00\x00', 0x3a, '\x00\x03!\f\xee\x998r~\b\x13\x89\xae\xf1\x06hz\xcc\xd6\xbb\xb8\x19\x90\x9e\xdb\xa2F\xfa_F(\x05\b\x13\x82\x12\xad\x0f^\xdc\xf2\xb5', 0x3a, './file2', 0x3a, [0x46]}, 0x73) open$dir(&(0x7f0000000340)='./sys\x00', 0xc0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080d00000000007b8af8ff0000a200000000000007020000f8ffffffb7030000080082da8313823b210000b70400120000002185000000c30000009500000000000000002000"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x30, r9, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x14, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}, {0x11}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040040}, 0x44) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000440)={0x0, 0x2}, &(0x7f0000000480)=0x8) [ 157.174933][ T5295] Bluetooth: hci0: command tx timeout [ 157.423080][ T5337] loop0: detected capacity change from 0 to 512 [ 157.439801][ T5337] EXT4-fs: inline encryption not supported [ 157.465135][ T5337] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 157.515140][ T5337] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm syz.0.0: bg 0: block 64: padding at end of block bitmap is not set [ 157.535619][ T5337] loop0: lost filesystem error report for type 5 error -117 [ 157.537782][ T5337] Quota error (device loop0): write_blk: dquota write failed [ 157.541175][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 157.541240][ C0] EXT4-fs (loop0): initial error at time 1785784070: ext4_validate_block_bitmap:441 [ 157.541256][ C0] EXT4-fs (loop0): last error at time 1785784070: ext4_validate_block_bitmap:441 [ 157.556667][ T5337] Quota error (device loop0): qtree_write_dquot: Error -117 occurred while creating quota [ 157.561181][ T5337] EXT4-fs error (device loop0): ext4_acquire_dquot:7041: comm syz.0.0: Failed to acquire dquot type 0 [ 157.566331][ T5337] loop0: lost filesystem error report for type 5 error -117 [ 157.567495][ T5337] EXT4-fs (loop0): 1 truncate cleaned up [ 157.582125][ T5337] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 157.681337][ T5342] Quota error (device loop0): write_blk: dquota write failed [ 157.700378][ T5342] Quota error (device loop0): qtree_write_dquot: Error -28 occurred while creating quota [ 157.704650][ T5342] EXT4-fs error (device loop0): ext4_acquire_dquot:7041: comm syz.0.0: Failed to acquire dquot type 0 [ 158.108281][ T5335] ================================================================== [ 158.111764][ T5335] BUG: KASAN: use-after-free in release_card_device+0x1ab/0x1b0 [ 158.115106][ T5335] Read of size 1 at addr ffff88803f9d8909 by task syz.0.0/5335 [ 158.118453][ T5335] [ 158.119609][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 158.119624][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 158.119632][ T5335] Call Trace: [ 158.119639][ T5335] [ 158.119644][ T5335] dump_stack_lvl+0xe8/0x150 [ 158.119666][ T5335] print_address_description+0x55/0x1e0 [ 158.119683][ T5335] ? release_card_device+0x1ab/0x1b0 [ 158.119698][ T5335] print_report+0x58/0x70 [ 158.119711][ T5335] kasan_report+0x117/0x150 [ 158.119727][ T5335] ? release_card_device+0x1ab/0x1b0 [ 158.119743][ T5335] release_card_device+0x1ab/0x1b0 [ 158.119759][ T5335] ? __pfx_release_card_device+0x10/0x10 [ 158.119773][ T5335] device_release+0xc4/0x1f0 [ 158.119854][ T5335] kobject_put+0x222/0x550 [ 158.119871][ T5335] snd_card_file_remove+0x331/0x390 [ 158.119888][ T5335] snd_pcm_oss_release+0x1fe/0x250 [ 158.119903][ T5335] ? __pfx_snd_disconnect_release+0x10/0x10 [ 158.119919][ T5335] __fput+0x418/0xa50 [ 158.119934][ T5335] task_work_run+0x1d9/0x270 [ 158.119946][ T5335] ? __pfx_task_work_run+0x10/0x10 [ 158.119959][ T5335] exit_to_user_mode_loop+0x1fa/0x730 [ 158.119974][ T5335] ? rcu_is_watching+0x15/0xb0 [ 158.119984][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.119997][ T5335] do_syscall_64+0x353/0x580 [ 158.120011][ T5335] ? clear_bhb_loop+0x40/0x90 [ 158.120023][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.120035][ T5335] RIP: 0033:0x7f3a8259e019 [ 158.120047][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.120057][ T5335] RSP: 002b:00007ffe187f8248 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 158.120070][ T5335] RAX: 0000000000000000 RBX: 00007f3a82827da0 RCX: 00007f3a8259e019 [ 158.120078][ T5335] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 158.120085][ T5335] RBP: 00007f3a82827da0 R08: 0000000000000006 R09: 0000000000000000 [ 158.120093][ T5335] R10: 00007f3a82827cb0 R11: 0000000000000246 R12: 00000000000267e9 [ 158.120107][ T5335] R13: 00007f3a8282618c R14: 00000000000266da R15: 00007f3a82826180 [ 158.120118][ T5335] [ 158.120122][ T5335] [ 158.211479][ T5335] The buggy address belongs to the physical page: [ 158.214265][ T5335] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f9d8 [ 158.217906][ T5335] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 158.220935][ T5335] raw: 04fff00000000000 ffffea0001493208 ffff88801fc412c0 0000000000000000 [ 158.224553][ T5335] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 158.228107][ T5335] page dumped because: kasan: bad access detected [ 158.230645][ T5335] page_owner tracks the page as freed [ 158.232858][ T5335] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 46334034397, free_ts 158104977600 [ 158.240071][ T5335] post_alloc_hook+0x1f9/0x250 [ 158.242327][ T5335] get_page_from_freelist+0x21fa/0x2270 [ 158.245037][ T5335] __alloc_frozen_pages_noprof+0x18d/0x380 [ 158.247462][ T5335] alloc_pages_mpol+0x212/0x380 [ 158.249512][ T5335] ___kmalloc_large_node+0x4c/0x120 [ 158.252722][ T5335] __kmalloc_large_node_noprof+0x18/0x90 [ 158.255656][ T5335] __kmalloc_node_track_caller_noprof+0x164/0x730 [ 158.258229][ T5335] __devres_alloc_node+0x4c/0x160 [ 158.260382][ T5335] snd_devm_card_new+0x84/0x160 [ 158.262464][ T5335] loopback_probe+0x150/0x13d0 [ 158.264573][ T5335] platform_probe+0xf9/0x190 [ 158.266677][ T5335] really_probe+0x254/0xae0 [ 158.268710][ T5335] __driver_probe_device+0x1e8/0x360 [ 158.270891][ T5335] driver_probe_device+0x4f/0x240 [ 158.272945][ T5335] __device_attach_driver+0x270/0x410 [ 158.275236][ T5335] bus_for_each_drv+0x258/0x2f0 [ 158.277231][ T5335] page last free pid 5336 tgid 5335 stack trace: [ 158.279907][ T5335] __free_frozen_pages+0xc1e/0xd10 [ 158.282141][ T5335] devres_release_all+0x1ce/0x260 [ 158.284326][ T5335] device_release_driver_internal+0x5d9/0x880 [ 158.286877][ T5335] unbind_store+0x1a1/0x1d0 [ 158.288749][ T5335] kernfs_fop_write_iter+0x3a4/0x540 [ 158.290941][ T5335] vfs_write+0x612/0xba0 [ 158.292769][ T5335] ksys_write+0x150/0x270 [ 158.294604][ T5335] do_syscall_64+0x174/0x580 [ 158.296713][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.299168][ T5335] [ 158.300229][ T5335] Memory state around the buggy address: [ 158.302637][ T5335] ffff88803f9d8800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 158.305768][ T5335] ffff88803f9d8880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 158.308995][ T5335] >ffff88803f9d8900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 158.312272][ T5335] ^ [ 158.314078][ T5335] ffff88803f9d8980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 158.317338][ T5335] ffff88803f9d8a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 158.320438][ T5335] ================================================================== [ 158.357021][ T5335] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 158.360485][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 158.364411][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 158.368718][ T5335] Call Trace: [ 158.370145][ T5335] [ 158.371388][ T5335] vpanic+0x56c/0xa60 [ 158.373110][ T5335] ? __pfx_vpanic+0x10/0x10 [ 158.375173][ T5335] panic+0xc5/0xd0 [ 158.376891][ T5335] ? __pfx_panic+0x10/0x10 [ 158.378873][ T5335] ? preempt_schedule_thunk+0x16/0x40 [ 158.381092][ T5335] ? release_card_device+0x1ab/0x1b0 [ 158.383361][ T5335] ? preempt_schedule_thunk+0x16/0x40 [ 158.385498][ T5335] ? release_card_device+0x1ab/0x1b0 [ 158.387766][ T5335] check_panic_on_warn+0x89/0xb0 [ 158.389912][ T5335] ? release_card_device+0x1ab/0x1b0 [ 158.392153][ T5335] end_report+0x73/0x170 [ 158.393978][ T5335] ? release_card_device+0x1ab/0x1b0 [ 158.396123][ T5335] kasan_report+0x128/0x150 [ 158.397950][ T5335] ? release_card_device+0x1ab/0x1b0 [ 158.400076][ T5335] release_card_device+0x1ab/0x1b0 [ 158.402134][ T5335] ? __pfx_release_card_device+0x10/0x10 [ 158.404358][ T5335] device_release+0xc4/0x1f0 [ 158.406142][ T5335] kobject_put+0x222/0x550 [ 158.407885][ T5335] snd_card_file_remove+0x331/0x390 [ 158.409994][ T5335] snd_pcm_oss_release+0x1fe/0x250 [ 158.412212][ T5335] ? __pfx_snd_disconnect_release+0x10/0x10 [ 158.414741][ T5335] __fput+0x418/0xa50 [ 158.416536][ T5335] task_work_run+0x1d9/0x270 [ 158.418574][ T5335] ? __pfx_task_work_run+0x10/0x10 [ 158.420892][ T5335] exit_to_user_mode_loop+0x1fa/0x730 [ 158.423287][ T5335] ? rcu_is_watching+0x15/0xb0 [ 158.425255][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.427631][ T5335] do_syscall_64+0x353/0x580 [ 158.429694][ T5335] ? clear_bhb_loop+0x40/0x90 [ 158.431760][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.434255][ T5335] RIP: 0033:0x7f3a8259e019 [ 158.436138][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.445635][ T5335] RSP: 002b:00007ffe187f8248 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 158.449585][ T5335] RAX: 0000000000000000 RBX: 00007f3a82827da0 RCX: 00007f3a8259e019 [ 158.453124][ T5335] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 158.456349][ T5335] RBP: 00007f3a82827da0 R08: 0000000000000006 R09: 0000000000000000 [ 158.460261][ T5335] R10: 00007f3a82827cb0 R11: 0000000000000246 R12: 00000000000267e9 [ 158.463778][ T5335] R13: 00007f3a8282618c R14: 00000000000266da R15: 00007f3a82826180 [ 158.466986][ T5335] [ 158.468608][ T5335] Kernel Offset: disabled [ 158.470507][ T5335] Rebooting in 86400 seconds..