program:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0)
capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd})
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, &(0x7f0000000400)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]})
r4 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0x80000000, 0xfffffffd, 0xffffffff, 0xfffffffd, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x9, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x80000001, 0x1003, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]})
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)
[ 86.642533][ T4637] Bluetooth: hci0: command tx timeout
[ 87.553500][ T5307] ==================================================================
[ 87.556800][ T5307] BUG: KASAN: use-after-free in release_card_device+0x1ab/0x1b0
[ 87.560145][ T5307] Read of size 1 at addr ffff88803f63c909 by task syz.0.0/5307
[ 87.563714][ T5307]
[ 87.565015][ T5307] CPU: 0 UID: 0 PID: 5307 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.565029][ T5307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.565036][ T5307] Call Trace:
[ 87.565043][ T5307]
[ 87.565049][ T5307] dump_stack_lvl+0xe8/0x150
[ 87.565070][ T5307] print_address_description+0x55/0x1e0
[ 87.565085][ T5307] ? release_card_device+0x1ab/0x1b0
[ 87.565099][ T5307] print_report+0x58/0x70
[ 87.565110][ T5307] kasan_report+0x117/0x150
[ 87.565125][ T5307] ? release_card_device+0x1ab/0x1b0
[ 87.565141][ T5307] release_card_device+0x1ab/0x1b0
[ 87.565154][ T5307] ? __pfx_release_card_device+0x10/0x10
[ 87.565168][ T5307] device_release+0xc4/0x1f0
[ 87.565239][ T5307] kobject_put+0x222/0x550
[ 87.565255][ T5307] snd_card_file_remove+0x331/0x390
[ 87.565270][ T5307] snd_pcm_release+0x12c/0x160
[ 87.565283][ T5307] ? __pfx_snd_disconnect_release+0x10/0x10
[ 87.565298][ T5307] __fput+0x418/0xa50
[ 87.565312][ T5307] task_work_run+0x1d9/0x270
[ 87.565329][ T5307] ? __pfx_task_work_run+0x10/0x10
[ 87.565346][ T5307] exit_to_user_mode_loop+0x1fa/0x750
[ 87.565360][ T5307] ? rcu_is_watching+0x15/0xb0
[ 87.565376][ T5307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.565387][ T5307] do_syscall_64+0x353/0x580
[ 87.565400][ T5307] ? clear_bhb_loop+0x70/0xc0
[ 87.565411][ T5307] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.565422][ T5307] RIP: 0033:0x7fcbafd9e0d9
[ 87.565434][ T5307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.565443][ T5307] RSP: 002b:00007fff2bd040f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 87.565456][ T5307] RAX: 0000000000000000 RBX: 00007fcbb0027da0 RCX: 00007fcbafd9e0d9
[ 87.565464][ T5307] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 87.565470][ T5307] RBP: 00007fcbb0027da0 R08: 0000000000000006 R09: 0000000000000000
[ 87.565476][ T5307] R10: 00007fcbb0027cb0 R11: 0000000000000246 R12: 0000000000015533
[ 87.565483][ T5307] R13: 00007fcbb0025fac R14: 0000000000015269 R15: 00007fff2bd04200
[ 87.565494][ T5307]
[ 87.565498][ T5307]
[ 87.660162][ T5307] The buggy address belongs to the physical page:
[ 87.663416][ T5307] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f63c
[ 87.667130][ T5307] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 87.669948][ T5307] raw: 04fff00000000000 ffffea00010e8008 ffff88801fc414c0 0000000000000000
[ 87.673267][ T5307] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 87.676608][ T5307] page dumped because: kasan: bad access detected
[ 87.679149][ T5307] page_owner tracks the page as freed
[ 87.681352][ T5307] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x92cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC), pid 5308, tgid 5307 (syz.0.0), ts 87550488525, free_ts 87550540497
[ 87.689310][ T5307] post_alloc_hook+0x1f9/0x250
[ 87.691559][ T5307] get_page_from_freelist+0x21fa/0x2270
[ 87.693995][ T5307] __alloc_frozen_pages_noprof+0x18d/0x380
[ 87.696293][ T5307] alloc_pages_mpol+0x212/0x380
[ 87.698332][ T5307] alloc_pages_noprof+0xac/0x2a0
[ 87.700456][ T5307] stack_depot_save_flags+0x735/0x800
[ 87.702719][ T5307] kasan_save_track+0x4f/0x80
[ 87.704661][ T5307] __kasan_kmalloc+0x93/0xb0
[ 87.706605][ T5307] __kmalloc_cache_noprof+0x32d/0x660
[ 87.708913][ T5307] kobject_uevent_env+0x289/0x9e0
[ 87.711124][ T5307] device_release_driver_internal+0x782/0x880
[ 87.713706][ T5307] unbind_store+0x1a1/0x1d0
[ 87.715751][ T5307] kernfs_fop_write_iter+0x3a4/0x540
[ 87.718063][ T5307] vfs_write+0x612/0xba0
[ 87.719939][ T5307] ksys_write+0x150/0x270
[ 87.721530][ T5307] do_syscall_64+0x174/0x580
[ 87.723277][ T5307] page last free pid 5308 tgid 5307 stack trace:
[ 87.725698][ T5307] __free_frozen_pages+0xc1e/0xd10
[ 87.727876][ T5307] stack_depot_save_flags+0x407/0x800
[ 87.730201][ T5307] kasan_save_track+0x4f/0x80
[ 87.732329][ T5307] __kasan_kmalloc+0x93/0xb0
[ 87.734288][ T5307] __kmalloc_cache_noprof+0x32d/0x660
[ 87.736556][ T5307] kobject_uevent_env+0x289/0x9e0
[ 87.738713][ T5307] device_release_driver_internal+0x782/0x880
[ 87.741244][ T5307] unbind_store+0x1a1/0x1d0
[ 87.743223][ T5307] kernfs_fop_write_iter+0x3a4/0x540
[ 87.745474][ T5307] vfs_write+0x612/0xba0
[ 87.747262][ T5307] ksys_write+0x150/0x270
[ 87.749014][ T5307] do_syscall_64+0x174/0x580
[ 87.750879][ T5307] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.753315][ T5307]
[ 87.754300][ T5307] Memory state around the buggy address:
[ 87.756524][ T5307] ffff88803f63c800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 87.759698][ T5307] ffff88803f63c880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 87.763144][ T5307] >ffff88803f63c900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 87.766645][ T5307] ^
[ 87.768814][ T5307] ffff88803f63c980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 87.772534][ T5307] ffff88803f63ca00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 87.775996][ T5307] ==================================================================
[ 87.809345][ T5307] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.812160][ T5307] CPU: 0 UID: 0 PID: 5307 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.815541][ T5307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.819750][ T5307] Call Trace:
[ 87.821161][ T5307]
[ 87.822387][ T5307] vpanic+0x56c/0xa60
[ 87.824126][ T5307] ? __pfx_vpanic+0x10/0x10
[ 87.826174][ T5307] panic+0xc5/0xd0
[ 87.827820][ T5307] ? __pfx_panic+0x10/0x10
[ 87.829692][ T5307] ? preempt_schedule_thunk+0x16/0x40
[ 87.831968][ T5307] ? release_card_device+0x1ab/0x1b0
[ 87.834249][ T5307] ? preempt_schedule_thunk+0x16/0x40
[ 87.836571][ T5307] ? release_card_device+0x1ab/0x1b0
[ 87.838787][ T5307] check_panic_on_warn+0x89/0xb0
[ 87.840897][ T5307] ? release_card_device+0x1ab/0x1b0
[ 87.843224][ T5307] end_report+0x73/0x170
[ 87.845065][ T5307] ? release_card_device+0x1ab/0x1b0
[ 87.847316][ T5307] kasan_report+0x128/0x150
[ 87.849301][ T5307] ? release_card_device+0x1ab/0x1b0
[ 87.851584][ T5307] release_card_device+0x1ab/0x1b0
[ 87.853805][ T5307] ? __pfx_release_card_device+0x10/0x10
[ 87.856276][ T5307] device_release+0xc4/0x1f0
[ 87.858329][ T5307] kobject_put+0x222/0x550
[ 87.860276][ T5307] snd_card_file_remove+0x331/0x390
[ 87.862556][ T5307] snd_pcm_release+0x12c/0x160
[ 87.864582][ T5307] ? __pfx_snd_disconnect_release+0x10/0x10
[ 87.866926][ T5307] __fput+0x418/0xa50
[ 87.868649][ T5307] task_work_run+0x1d9/0x270
[ 87.870667][ T5307] ? __pfx_task_work_run+0x10/0x10
[ 87.872916][ T5307] exit_to_user_mode_loop+0x1fa/0x750
[ 87.875205][ T5307] ? rcu_is_watching+0x15/0xb0
[ 87.877176][ T5307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.879675][ T5307] do_syscall_64+0x353/0x580
[ 87.881689][ T5307] ? clear_bhb_loop+0x70/0xc0
[ 87.883844][ T5307] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.886389][ T5307] RIP: 0033:0x7fcbafd9e0d9
[ 87.888185][ T5307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.895576][ T5307] RSP: 002b:00007fff2bd040f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 87.898852][ T5307] RAX: 0000000000000000 RBX: 00007fcbb0027da0 RCX: 00007fcbafd9e0d9
[ 87.901892][ T5307] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 87.905213][ T5307] RBP: 00007fcbb0027da0 R08: 0000000000000006 R09: 0000000000000000
[ 87.908568][ T5307] R10: 00007fcbb0027cb0 R11: 0000000000000246 R12: 0000000000015533
[ 87.911807][ T5307] R13: 00007fcbb0025fac R14: 0000000000015269 R15: 00007fff2bd04200
[ 87.915170][ T5307]
[ 87.916873][ T5307] Kernel Offset: disabled
[ 87.918750][ T5307] Rebooting in 86400 seconds..