program: syz_mount_image$udf(&(0x7f0000000f00), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000340)={[{@adinicb}, {@nostrict}, {@utf8}, {@uid}, {}, {@shortad}, {}, {@iocharset={'iocharset', 0x3d, 'cp1251'}}, {@iocharset={'iocharset', 0x3d, 'iso8859-2'}}, {@mode={'mode', 0x3d, 0x8}}, {@lastblock={'lastblock', 0x3d, 0x81}}, {@gid={'gid', 0x3d, 0xee00}}, {@uid_forget}]}, 0x1, 0xc5b, &(0x7f0000001bc0)="$eJzs3U9sHNd9B/DfGy3FldxWTJwqThoHm7ZIZcVy9S+mYhXuqqbZBpBlIRRzC8CVSKkLUyRBUo1spC3TSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBAhQINpjZt+KSIm1ZJCVK/nxs6rs7897MezPrGZnYNy8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIjfe/nCyVNpixUH7qV2sfsNAgD23KWxr5w8vdX9HwB4bF3Z7v//AQAAAAAAAAAAAACA/SJFEU9GirlLa2miet9Vv9geuHV7fGR062qHUlXzQFW+/KmfOn3m7BefHz7Xy4vtmfepv9s+Ha+OXbnQeGn25tz81MLC1GRjfKZ9bXZy6p63sNP6mx2vDkDj5mu3Jq9fX2icfu7MhtW3h94bfOLo0PnhZ0483Ss7PjI6OrZepN5fvnbfDenaboTHwSjiRKR49rs/Sa3eAx12eCzqD/bcb3ao6sTxqhPjI6NVR6bbrZnFcuXl3oEoIhp9lZq9Y7T1uYjawAPtw/aaEUtl88sGHy+7NzbXmm9dnZ5qXG7NL7YX27Mzl1O3tWV/GlHEuRSxHBGrg3dvbiCKqEWKbx9ZS1fzUz+q4/CFamDw9u14yE/+KNvZGIhYLh6Bc7aPDUYRr0SKn759LK7l60x1rfl8xCtlfj/izTJfjEjlB+NsxLtbfI54NNWiiL8oz//5tTRZXQ9615WLX218eeb6bF/Z3nXlQ94f7rpSPKT7w6FN+WDs82tTPYpoVVf8tXT/f9kBAAAAAAAAAAAAAAAAYLcdiiI+FSle/vc/qsYVRzUu/cj54d8f+uX+MeNPfcB2yrLPRcRScW9jcg/mgYGX0+WUHvJY4o+yehTxx3n83zcfdmMAAAAAAAAAAAAAAAAAAAA+0or4caTBeOdYWo7+OcXbMzcaV1pXp7uzwvbm/u3Nmd7pdDqN1M1mzomcSzmXc67kXM0ZRa6fs5lzIudSzuWcKzlXc8aBXD9nM+dEzqWcyzlXcq7mjFqun7OZcyLnUs7lnCs5V3PGPpm7FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgcVJEET+PFN/6+lqKFBHNiIno5srgw24dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAaTEV8L1I0/qB5Z1ktIlL1b9ex8o+z0TxY5sejOVzmi9G8kLNVZa35zYfQfnZmIBXxo0gxWH/rzgnP53+g++7OxyDe/Mb6u0/Xunmgt3LovcEnjh45Pzz62ae2e522asDxi+2ZW7cb4yOjo2N9i2t57x/vWzaU91vsTteJiIXX33itNT09NX//L8qPwH1W753JHez9Qb5ItUemqV7sxouo7YtmPJy+b1B/GBcn9lx5/383Uvz2O//Ru+F37//1+KXuuzt3+PjZn6zf/1/YvKF7vP/XNtfL9//yTrDV/f/JvmUv5L+NDNQi6os35waORtQXXn/jRPtm68bUjamZsydPfml4+EtnTg4cjKhfb09P9b3alcMFAAAAAAAAAAAAAAAA8OCkIn43UrR+tJYaEXG7Gq81dH74mRNPH4gD1XirDeO2Xx27cqHx0uzNufmphYWpycb4TPva7OTUve6uXg33Gh8Z3ZPOfKBDe9z+Q/WXZuden2/f+MPFLdcfrl+4urA437q29eo4FEVEs3/J8arB4yOjVaOn262ZqurlLQfTf3gDqYj/jBTXzjbS5/KyPP5/8wj/DeP/lzZvaBfH/3/28Pr4v4/1FS33mVIRP4sUv/WXT8XnqnYejruOWS73t5Hi+LnP5HJxsCzXa0P3uQLdkYFl2f+NFP/4841le+Mhn1wve+pDHdxHQHn+j0SK7/35d+LX87KNz3/Y+vwf3ryhPXr+wyf6lh3e8LyCHXedfP5PRIoXn3wrfqNa8v/v+/yP3hMbjnULrz+fY4/O/6/2LRvK+/3N3eo8AAAAAAAAAADAI2wgFfF3keIHo7X0fF52L9//m9y8oT36/tcn+5ZN5u//pdj9WU86nc6flvvwzUIAAAAAHicDqYgfR4obi2/dGUO9cfx33/jP31kf/zmSNq2tfs/3K9VzA3bz93/9hvJ+J3bebQAAAAAAAAAAAAAAAAAAANhXUiri+Tyf+kQ1nn9y2/nUVyLFy//9bC6XjpblevPAD1V/1i/Nzpy4MD09W4/F1tXpqcbYXOvaVFn3E5Fi7W8+k+sW1fzqvfnmu3O8r8/FPh8pRv++V7Y7F3tvbvLufOD1TifiVFn2Y5Hiv/5hY9k8NXWeO7ra7umy7F9Hiq/989Zlj66XPVOW/U6k+OHXGr2yh8uyveejfnK97HPXZos9OCsAAAAAAAAAAAAAAAAAAAB81AykIv4sUvzPzeU7Y/nz/P8DfW8rb36jb77/TW5X8/wPVfP/b/f6fub/r54rsLTdXgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4PGUoog3IsXcpbW0Mli+76pfbM/cuj0+Mrp1tUOpqnmgKl/+1E+dPnP2i88Pn+vl+9ffbZ+KV8euXGi8NHtzbn5qYWFqsjE+0742Ozl1z1vYaf3NjlcHoHHztVuT168vNE4/d2bD6ttD7w0+cXTo/PAzJ57ulR0fGR0d6ytTG7jvvd8lbbP8YBTxV5Hi2e/+JP1gMKKInR+LD/js7LVDVSeOV50YHxmtOjLdbs0slisv9w5EEdHoq9TsHaMHcC52pBmxVDa/bPDxsntjc6351tXpqcbl1vxie7E9O3M5dVtb9qcRRZxLEcsRsTp49+YGoojXIsW3j6ylfxmMONA7Dl+4NPaVk6e3b0exh328B2U7GwMRy8UjcM72scEo4p8ixU/fPhb/OhhRi+5PfD7ilTK/H/FmdM93Kj8YZyPe3eJzxKOpFkX8X3n+z6+ltwfL60HvunLxq40vz1yf7Svbu6488veHB2mfX5vqUcQPqyv+Wvo3/10DAAAAAAAAAAAAAAAA7CNF/FqkeOGdY6kaH3xnTHF75kbjSuvqdHdYX2/sX2/MdKfT6TRSN5s5J3Iu5VzOuZJzNWcUuX7OZpn1Tmciv1/KuZxzJedqzmrwb3Q6jQO5fs6JnEs5l3Ou5FzNGbW8/5zNnBM5l3Iu51zJuZoz9snYPQAAAAAAAAAAAAAAAAAA4PFSVP+k+NbX11JnsDu/9ER0c8V8oI+9XwQAAP//Bt7zGQ==") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r0, &(0x7f0000000180)='270', 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/class/video4linux/video0/dev_debug\x00', 0x1, 0x0) syz_mount_image$vfat(&(0x7f0000000a80), &(0x7f0000000ac0)='./file1\x00', 0x0, &(0x7f0000000b00)={[{@utf8}, {@fat=@dos1xfloppy}, {@fat=@codepage={'codepage', 0x3d, '850'}}, {@shortname_winnt}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'macturkish'}}, {@uni_xlate}, {@uni_xlate}, {@numtail}, {@iocharset={'iocharset', 0x3d, 'cp869'}}, {@shortname_mixed}, {@fat=@codepage={'codepage', 0x3d, '936'}}, {@iocharset={'iocharset', 0x3d, 'cp850'}}, {@iocharset={'iocharset', 0x3d, 'iso8859-13'}}, {@uni_xlateno}, {@fat=@check_strict}]}, 0x21, 0x38c, &(0x7f0000000f40)="$eJzs3U+IW8UfAPBv+pLdTeHX3cMPioISvQm69A8eFA9byhaKuaiEVg9isFuUzVrYYHB7aLpexKPgUUHwIh704KFnERTx5sGrVbQqHrS3gsWRJC/Ja5PdrtRtXfx8DuWb78y8mXmdTd6+R2ZfuJ5Wz1Ti7NWrV2JurhTlpeNLca0UC5HF0MWYNDMlBwDsDddSit/TwCiZTYnGSndoaADALul9/qduMfP659vVTz79AWDPy3//r25XZ24y9eMTvX/P7d64AIDdM3H//8Fx2f2Dx/yFR/3lqQ8EAIC95Zlnn3vyWD3i6WptLmLtjU6j04jHx+XHzsbL0YqVOBTzcT1icKGQUjr9ff/FiZP15UO1Wq0bPy1EIyLe6zQi1rqdxuBK4VjWbz8bh2M+FvL2+dVGSik78Ul9+XCtLyIudvv9x1qp06jE/rz/b/fHShyJWvx/on3EyfrykVp+gMbasH03YnN836I3/sWYj69fjHPRijPVU5HS8LKmvnzhcK12PNVvaN9pzMaZ0VmYcgcEAAAAAAAAAAAAAAAAAAAAAABuw2JtZGG0/00a79+zuDilvL8/zqB9vj/Q5mB/oDSbIqXfXnuk8WY22KtnuD/QzfvzdBrl2Hd3pw4AAAAAAAAAAAAAAAAAAAD/Gu2NmWi2Wivr7Y3zq8Wgu97e2BcRvcwrX370WTUm69wiKOd9FIpqeer8ajNlw8opu6FOHmS9zoeZDy+NRlysMzuaxdRh9IrbM1vU+d8DP7wzztyXDY/857hOFtMnmN00jGFQiYi1AxFRjRgVVcZT3vKMHc2DI7c4q5dTSlsd58Lzk62iFFH++/9x2wepF3xx5aV7jrYPPtrPfJoGHnp4/tTlt9//ZbXZ6vXc0/pgZr19Pa0289fTF9tKqbxFp1lh/ZTyc1gqroTydkPdvDHTzL759fS9b321s5mmYubVKXWywXQ+Xm9vlPKflH7RzCDo5W5qVW2dzCLOL0XxOJUpi//2gqmL7eC7S81LF777eafHKbxJjDfqqP7T7z8AAAAAAAAAAAAAAAAAAMBY4bviufzLvpXtWj32VB7M7e7oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODOGP/9/0KwOZHZSfBHNyaLZlfW2xEH7vY0AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4j/srAAD//x9pY8c=") syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000001300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000013c0)={0x90, 0x0, 0x4, {0x5, 0x3, 0x0, 0x4000000000008, 0xfffffffd, 0x6, {0x2, 0x8, 0x8, 0x6, 0x7, 0x100, 0x8, 0x6, 0xe, 0xa000, 0x4, 0x0, 0x0, 0x40005, 0x85}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f0000000d40)={0x3, 0xff, 0x6, 0xa, 0x1a, "e442118545a4bfd2"}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001480)=ANY=[@ANYBLOB="09000000010000004200000040"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001500), &(0x7f0000001540), 0x3fe, r2}, 0x38) r3 = syz_open_dev$vim2m(&(0x7f0000000c00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000c40)={0x1, @pix_mp={0x0, 0xe, 0x47425247, 0x7, 0xa, [{0x7, 0x8001}, {0x8, 0xffffff67}, {0x18c, 0x9}, {0x8, 0x53}, {0x1ff}, {0x7fffffff, 0xcca}, {0x81, 0xe}, {0x46, 0x4}], 0x9, 0x7, 0x8, 0x0, 0x2}}) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = userfaultfd(0x801) ioctl$SIOCPNADDRESOURCE(r0, 0x89e0, &(0x7f0000000d80)=0x40) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000001580)={0xaa, 0x128}) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f00000015c0)={0x0, &(0x7f0000001600)=""/119, &(0x7f0000001680), &(0x7f00000016c0), 0x7, r2}, 0x38) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=@updpolicy={0x23c, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1, @in=@remote, 0x0, 0xffff, 0x0, 0xfffc, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x1}, {0xffffffffffffffff, 0x0, 0x0, 0x17ffffffffffb}, 0x40}, [@tmpl={0x184, 0x5, [{{@in6=@mcast2, 0x0, 0x3c}, 0x0, @in=@broadcast}, {{@in=@initdev={0xac, 0x1e, 0xfc, 0x0}, 0x0, 0x3c}, 0x2, @in6=@dev={0xfe, 0x80, '\x00', 0x1}}, {{@in6=@mcast1, 0x0, 0x6c}, 0x0, @in=@multicast1, 0x2, 0x1}, {{@in=@rand_addr=0x64010101, 0x0, 0x33}, 0x0, @in=@local, 0x0, 0x1, 0x2, 0x0, 0x10}, {{@in6=@loopback, 0x0, 0x6c}, 0x0, @in=@rand_addr=0x64010100, 0x1000, 0x2, 0x0, 0x0, 0x0, 0x4003, 0xffffffff}, {{@in6=@loopback, 0x0, 0x6c}, 0xa, @in6=@private1, 0x0, 0x5, 0x0, 0x0, 0xfffffffe, 0x2, 0x1}]}]}, 0x23c}}, 0x4010) write(r1, &(0x7f0000000680)='3', 0x1) r6 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCL_BLANKSCREEN(r7, 0x541c, &(0x7f0000000a40)) ioctl$VIDIOC_TRY_EXT_CTRLS(r6, 0xc0205649, &(0x7f0000000700)={0xf020000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000740)={0x990af5, 0x6, '\x00', @ptr=0x80}}) r8 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DM_DEV_CREATE(r8, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r8, 0xc138fd09, &(0x7f0000000440)={0x4, 0x0, 0x0, 0x180, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r9}, [@snapshot={0x0, 0x1008, 0x0, 0x48, 'snapshot\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'PO', 0x20, '16'}}]}) [ 102.849298][ T5300] Bluetooth: hci0: command tx timeout [ 102.958002][ T5347] loop0: detected capacity change from 0 to 2048 [ 102.959583][ T5347] udf: Bad value for 'lastblock' [ 103.059990][ T5347] loop0: detected capacity change from 0 to 256 [ 103.104243][ T5347] FAT-fs (loop0): data area starts beyond volume (274 > 64) [ 103.104264][ T5347] FAT-fs (loop0): Can't find a valid FAT filesystem [ 103.215924][ T5347] ================================================================== [ 103.215935][ T5347] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 103.216189][ T5347] Read of size 8 at addr ffff888038d95f98 by task syz.0.0/5347 [ 103.216200][ T5347] [ 103.216207][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.216219][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.216227][ T5347] Call Trace: [ 103.216232][ T5347] [ 103.216238][ T5347] dump_stack_lvl+0xe8/0x150 [ 103.216297][ T5347] print_address_description+0x55/0x1e0 [ 103.216311][ T5347] ? snapshot_ctr+0x5cb/0x1340 [ 103.216320][ T5347] print_report+0x58/0x70 [ 103.216331][ T5347] kasan_report+0x117/0x150 [ 103.216365][ T5347] ? snapshot_ctr+0x5cb/0x1340 [ 103.216376][ T5347] snapshot_ctr+0x5cb/0x1340 [ 103.216387][ T5347] ? __pfx_snapshot_ctr+0x10/0x10 [ 103.216395][ T5347] ? skip_spaces+0x8a/0xa0 [ 103.216461][ T5347] ? dm_split_args+0x50b/0x5d0 [ 103.216478][ T5347] dm_table_add_target+0x58d/0xc70 [ 103.216487][ T5347] table_load+0x325/0x8a0 [ 103.216500][ T5347] ? __pfx_table_load+0x10/0x10 [ 103.216512][ T5347] dm_ctl_ioctl+0x9ec/0xe10 [ 103.216523][ T5347] ? __pfx_table_load+0x10/0x10 [ 103.216533][ T5347] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.216547][ T5347] ? __fget_files+0x2a/0x420 [ 103.216566][ T5347] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.216588][ T5347] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.216599][ T5347] __se_sys_ioctl+0xfc/0x170 [ 103.216615][ T5347] do_syscall_64+0x166/0x520 [ 103.216684][ T5347] ? trace_irq_disable+0x3b/0x140 [ 103.216696][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.216705][ T5347] ? clear_bhb_loop+0x70/0xc0 [ 103.216713][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.216721][ T5347] RIP: 0033:0x7fcaf019f559 [ 103.216731][ T5347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.216739][ T5347] RSP: 002b:00007fcaf0fb7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.216753][ T5347] RAX: ffffffffffffffda RBX: 00007fcaf0425fa0 RCX: 00007fcaf019f559 [ 103.216761][ T5347] RDX: 0000200000000440 RSI: 00000000c138fd09 RDI: 000000000000000c [ 103.216768][ T5347] RBP: 00007fcaf0236b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.216776][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.216783][ T5347] R13: 00007fcaf0426038 R14: 00007fcaf0425fa0 R15: 00007fff192a46c8 [ 103.216796][ T5347] [ 103.216800][ T5347] [ 103.216803][ T5347] Allocated by task 5347: [ 103.216809][ T5347] kasan_save_track+0x3e/0x80 [ 103.216818][ T5347] __kasan_kmalloc+0x93/0xb0 [ 103.216825][ T5347] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 103.216832][ T5347] dm_get_table_device+0x23e/0x730 [ 103.216838][ T5347] dm_get_device+0x327/0x760 [ 103.216848][ T5347] snapshot_ctr+0x2b2/0x1340 [ 103.216855][ T5347] dm_table_add_target+0x58d/0xc70 [ 103.216861][ T5347] table_load+0x325/0x8a0 [ 103.216872][ T5347] dm_ctl_ioctl+0x9ec/0xe10 [ 103.216881][ T5347] __se_sys_ioctl+0xfc/0x170 [ 103.216888][ T5347] do_syscall_64+0x166/0x520 [ 103.216898][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.216905][ T5347] [ 103.216906][ T5347] Freed by task 5347: [ 103.216910][ T5347] kasan_save_track+0x3e/0x80 [ 103.216918][ T5347] kasan_save_free_info+0x40/0x50 [ 103.216929][ T5347] __kasan_slab_free+0x5c/0x80 [ 103.216936][ T5347] kfree+0x1c5/0x650 [ 103.216946][ T5347] dm_put_table_device+0x255/0x2a0 [ 103.216953][ T5347] dm_get_device+0x56f/0x760 [ 103.216962][ T5347] snapshot_ctr+0x471/0x1340 [ 103.216980][ T5347] dm_table_add_target+0x58d/0xc70 [ 103.216988][ T5347] table_load+0x325/0x8a0 [ 103.217003][ T5347] dm_ctl_ioctl+0x9ec/0xe10 [ 103.217017][ T5347] __se_sys_ioctl+0xfc/0x170 [ 103.217030][ T5347] do_syscall_64+0x166/0x520 [ 103.217043][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.217054][ T5347] [ 103.217057][ T5347] The buggy address belongs to the object at ffff888038d95f80 [ 103.217057][ T5347] which belongs to the cache kmalloc-96 of size 96 [ 103.217064][ T5347] The buggy address is located 24 bytes inside of [ 103.217064][ T5347] freed 96-byte region [ffff888038d95f80, ffff888038d95fe0) [ 103.217073][ T5347] [ 103.217075][ T5347] The buggy address belongs to the physical page: [ 103.217081][ T5347] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38d95 [ 103.217088][ T5347] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 103.217095][ T5347] page_type: f5(slab) [ 103.217102][ T5347] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 103.217108][ T5347] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 103.217112][ T5347] page dumped because: kasan: bad access detected [ 103.217116][ T5347] page_owner tracks the page as allocated [ 103.217118][ T5347] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 21281279314 [ 103.217141][ T5347] post_alloc_hook+0x1f9/0x250 [ 103.217153][ T5347] get_page_from_freelist+0x220f/0x2280 [ 103.217161][ T5347] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 103.217169][ T5347] allocate_slab+0x7d/0x5e0 [ 103.217179][ T5347] refill_objects+0x2d5/0x350 [ 103.217188][ T5347] __pcs_replace_empty_main+0x2c8/0x6c0 [ 103.217198][ T5347] __kmalloc_cache_noprof+0x396/0x600 [ 103.217205][ T5347] dev_pm_qos_expose_flags+0x94/0x2a0 [ 103.217235][ T5347] usb_hub_create_port_device+0x80d/0xc40 [ 103.217261][ T5347] hub_probe+0x26bc/0x3c00 [ 103.217271][ T5347] usb_probe_interface+0x751/0xe00 [ 103.217278][ T5347] really_probe+0x254/0xae0 [ 103.217286][ T5347] __driver_probe_device+0x1e8/0x360 [ 103.217294][ T5347] driver_probe_device+0x4f/0x240 [ 103.217302][ T5347] __device_attach_driver+0x270/0x410 [ 103.217310][ T5347] bus_for_each_drv+0x258/0x2f0 [ 103.217324][ T5347] page last free pid 37 tgid 37 ts 21270893139 stack trace: [ 103.217346][ T5347] __free_frozen_pages+0xc97/0xd90 [ 103.217362][ T5347] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 103.217373][ T5347] alloc_vmap_area+0xd10/0x1410 [ 103.217386][ T5347] __get_vm_area_node+0x200/0x2f0 [ 103.217399][ T5347] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 103.217415][ T5347] __vmalloc_node_noprof+0xc2/0x100 [ 103.217429][ T5347] dup_task_struct+0x2c6/0xa00 [ 103.217450][ T5347] copy_process+0x7ea/0x44b0 [ 103.217458][ T5347] kernel_clone+0x2d7/0x940 [ 103.217468][ T5347] user_mode_thread+0x115/0x180 [ 103.217479][ T5347] call_usermodehelper_exec_work+0x5c/0x230 [ 103.217490][ T5347] process_scheduled_works+0xc3d/0x1630 [ 103.217500][ T5347] worker_thread+0xa47/0xfb0 [ 103.217509][ T5347] kthread+0x38b/0x480 [ 103.217516][ T5347] ret_from_fork+0x514/0xb70 [ 103.217525][ T5347] ret_from_fork_asm+0x1a/0x30 [ 103.217532][ T5347] [ 103.217534][ T5347] Memory state around the buggy address: [ 103.217538][ T5347] ffff888038d95e80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 103.217543][ T5347] ffff888038d95f00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 103.217548][ T5347] >ffff888038d95f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 103.217551][ T5347] ^ [ 103.217555][ T5347] ffff888038d96000: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 103.217559][ T5347] ffff888038d96080: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 103.217563][ T5347] ================================================================== [ 103.589964][ T5347] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.592709][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.596180][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.599945][ T5347] Call Trace: [ 103.601426][ T5347] [ 103.602634][ T5347] vpanic+0x56d/0xa60 [ 103.604284][ T5347] ? __pfx_vpanic+0x10/0x10 [ 103.606327][ T5347] panic+0xc5/0xd0 [ 103.607939][ T5347] ? __pfx_panic+0x10/0x10 [ 103.609873][ T5347] ? preempt_schedule_thunk+0x16/0x40 [ 103.612525][ T5347] ? snapshot_ctr+0x5cb/0x1340 [ 103.614609][ T5347] ? preempt_schedule_thunk+0x16/0x40 [ 103.616903][ T5347] ? snapshot_ctr+0x5cb/0x1340 [ 103.618914][ T5347] check_panic_on_warn+0x89/0xb0 [ 103.621037][ T5347] ? snapshot_ctr+0x5cb/0x1340 [ 103.623116][ T5347] end_report+0x73/0x170 [ 103.624949][ T5347] ? snapshot_ctr+0x5cb/0x1340 [ 103.626939][ T5347] kasan_report+0x128/0x150 [ 103.628805][ T5347] ? snapshot_ctr+0x5cb/0x1340 [ 103.630742][ T5347] snapshot_ctr+0x5cb/0x1340 [ 103.632740][ T5347] ? __pfx_snapshot_ctr+0x10/0x10 [ 103.634934][ T5347] ? skip_spaces+0x8a/0xa0 [ 103.636939][ T5347] ? dm_split_args+0x50b/0x5d0 [ 103.639026][ T5347] dm_table_add_target+0x58d/0xc70 [ 103.641361][ T5347] table_load+0x325/0x8a0 [ 103.643149][ T5347] ? __pfx_table_load+0x10/0x10 [ 103.644994][ T5347] dm_ctl_ioctl+0x9ec/0xe10 [ 103.646846][ T5347] ? __pfx_table_load+0x10/0x10 [ 103.648781][ T5347] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.650766][ T5347] ? __fget_files+0x2a/0x420 [ 103.652757][ T5347] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.654847][ T5347] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.657050][ T5347] __se_sys_ioctl+0xfc/0x170 [ 103.659049][ T5347] do_syscall_64+0x166/0x520 [ 103.661009][ T5347] ? trace_irq_disable+0x3b/0x140 [ 103.663224][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.665909][ T5347] ? clear_bhb_loop+0x70/0xc0 [ 103.667969][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.670475][ T5347] RIP: 0033:0x7fcaf019f559 [ 103.672418][ T5347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.680576][ T5347] RSP: 002b:00007fcaf0fb7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.684262][ T5347] RAX: ffffffffffffffda RBX: 00007fcaf0425fa0 RCX: 00007fcaf019f559 [ 103.687675][ T5347] RDX: 0000200000000440 RSI: 00000000c138fd09 RDI: 000000000000000c [ 103.691149][ T5347] RBP: 00007fcaf0236b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.694597][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.698005][ T5347] R13: 00007fcaf0426038 R14: 00007fcaf0425fa0 R15: 00007fff192a46c8 [ 103.701442][ T5347] [ 103.703301][ T5347] Kernel Offset: disabled [ 103.705193][ T5347] Rebooting in 86400 seconds..