program: openat$dm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000001100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88001, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000300)={'sit0\x00', 0x0, 0x10, 0x40, 0x1, 0xa77b, {{0x16, 0x4, 0x2, 0x7, 0x58, 0x66, 0x0, 0x4, 0x2f, 0x0, @broadcast, @broadcast, {[@ra={0x94, 0x4, 0x1}, @rr={0x7, 0xf, 0xdb, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @rand_addr=0x64010101]}, @ssrr={0x89, 0x1f, 0x49, [@local, @private=0xa010102, @multicast2, @dev={0xac, 0x14, 0x14, 0x2c}, @broadcast, @rand_addr=0x64010101, @private=0xa010100]}, @rr={0x7, 0xb, 0x67, [@multicast2, @multicast2]}, @ra={0x94, 0x4}, @end, @end]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ba00000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x188, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r1}, [@snapshot={0x0, 0x1008, 0x0, 0x50, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'P', 0x20, '0'}}]}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000001540)={0x4, 0x0, 0x0, 0x1c0, 0x138, 0x1, 0x0, 0xda01, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@mirror={0x0, 0x2888, 0x0, 0x88, 'mirror\x00', {'core 2 64 nosync', 0x20, 0x2, [{0x20, {@ram={'/dev/ram', 0x0}, 0x20, '16'}}, {0x20, {@rnull={'/dev/syzrnull', 0x0}, 0x20, '1024'}}], ' 2 handle_errors keep_log'}}]}) [ 95.904219][ T5304] Bluetooth: hci0: command tx timeout [ 96.062911][ T5357] ================================================================== [ 96.062924][ T5357] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 96.063087][ T5357] Read of size 8 at addr ffff88804004d398 by task syz.0.0/5357 [ 96.063104][ T5357] [ 96.063125][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.063138][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.063155][ T5357] Call Trace: [ 96.063182][ T5357] [ 96.063187][ T5357] dump_stack_lvl+0xe8/0x150 [ 96.063206][ T5357] print_address_description+0x55/0x1e0 [ 96.063224][ T5357] ? snapshot_ctr+0x5cb/0x1340 [ 96.063239][ T5357] print_report+0x58/0x70 [ 96.063253][ T5357] kasan_report+0x117/0x150 [ 96.063269][ T5357] ? snapshot_ctr+0x5cb/0x1340 [ 96.063287][ T5357] snapshot_ctr+0x5cb/0x1340 [ 96.063306][ T5357] ? __pfx_snapshot_ctr+0x10/0x10 [ 96.063322][ T5357] ? skip_spaces+0x8a/0xa0 [ 96.063381][ T5357] ? dm_split_args+0x50b/0x5d0 [ 96.063395][ T5357] dm_table_add_target+0x58d/0xc70 [ 96.063411][ T5357] table_load+0x325/0x8a0 [ 96.063426][ T5357] ? __pfx_table_load+0x10/0x10 [ 96.063443][ T5357] dm_ctl_ioctl+0x9ec/0xe10 [ 96.063458][ T5357] ? __pfx_table_load+0x10/0x10 [ 96.063470][ T5357] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 96.063485][ T5357] ? __fget_files+0x2a/0x420 [ 96.063492][ T5357] ? bpf_lsm_file_ioctl+0x9/0x20 [ 96.063502][ T5357] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 96.063508][ T5357] __se_sys_ioctl+0xfc/0x170 [ 96.063517][ T5357] do_syscall_64+0x166/0x520 [ 96.063564][ T5357] ? trace_irq_disable+0x3b/0x140 [ 96.063575][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.063586][ T5357] ? clear_bhb_loop+0x70/0xc0 [ 96.063599][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.063610][ T5357] RIP: 0033:0x7f36ac39f559 [ 96.063631][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.063642][ T5357] RSP: 002b:00007f36ad349fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.063657][ T5357] RAX: ffffffffffffffda RBX: 00007f36ac625fa0 RCX: 00007f36ac39f559 [ 96.063666][ T5357] RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 96.063673][ T5357] RBP: 00007f36ac436b20 R08: 0000000000000000 R09: 0000000000000000 [ 96.063680][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.063687][ T5357] R13: 00007f36ac626038 R14: 00007f36ac625fa0 R15: 00007ffe6e9165b8 [ 96.063701][ T5357] [ 96.063705][ T5357] [ 96.063709][ T5357] Allocated by task 5357: [ 96.063715][ T5357] kasan_save_track+0x3e/0x80 [ 96.063726][ T5357] __kasan_kmalloc+0x93/0xb0 [ 96.063737][ T5357] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 96.063748][ T5357] dm_get_table_device+0x23e/0x730 [ 96.063761][ T5357] dm_get_device+0x327/0x760 [ 96.063771][ T5357] snapshot_ctr+0x2b2/0x1340 [ 96.063785][ T5357] dm_table_add_target+0x58d/0xc70 [ 96.063796][ T5357] table_load+0x325/0x8a0 [ 96.063805][ T5357] dm_ctl_ioctl+0x9ec/0xe10 [ 96.063814][ T5357] __se_sys_ioctl+0xfc/0x170 [ 96.063825][ T5357] do_syscall_64+0x166/0x520 [ 96.063840][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.063850][ T5357] [ 96.063853][ T5357] Freed by task 5357: [ 96.063858][ T5357] kasan_save_track+0x3e/0x80 [ 96.063868][ T5357] kasan_save_free_info+0x40/0x50 [ 96.063878][ T5357] __kasan_slab_free+0x5c/0x80 [ 96.063884][ T5357] kfree+0x1c5/0x650 [ 96.063893][ T5357] dm_put_table_device+0x255/0x2a0 [ 96.063901][ T5357] dm_get_device+0x56f/0x760 [ 96.063907][ T5357] snapshot_ctr+0x471/0x1340 [ 96.063916][ T5357] dm_table_add_target+0x58d/0xc70 [ 96.063923][ T5357] table_load+0x325/0x8a0 [ 96.063929][ T5357] dm_ctl_ioctl+0x9ec/0xe10 [ 96.063935][ T5357] __se_sys_ioctl+0xfc/0x170 [ 96.063942][ T5357] do_syscall_64+0x166/0x520 [ 96.063951][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.063957][ T5357] [ 96.063959][ T5357] The buggy address belongs to the object at ffff88804004d380 [ 96.063959][ T5357] which belongs to the cache kmalloc-96 of size 96 [ 96.063974][ T5357] The buggy address is located 24 bytes inside of [ 96.063974][ T5357] freed 96-byte region [ffff88804004d380, ffff88804004d3e0) [ 96.063982][ T5357] [ 96.063983][ T5357] The buggy address belongs to the physical page: [ 96.063989][ T5357] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4004d [ 96.063996][ T5357] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 96.064007][ T5357] page_type: f5(slab) [ 96.064018][ T5357] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 96.064028][ T5357] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 96.064034][ T5357] page dumped because: kasan: bad access detected [ 96.064040][ T5357] page_owner tracks the page as allocated [ 96.064044][ T5357] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 25597448691 [ 96.064063][ T5357] post_alloc_hook+0x1f9/0x250 [ 96.064081][ T5357] get_page_from_freelist+0x220f/0x2280 [ 96.064091][ T5357] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 96.064110][ T5357] allocate_slab+0x7d/0x5e0 [ 96.064123][ T5357] ___slab_alloc+0x16a/0x960 [ 96.064136][ T5357] __kmalloc_cache_node_noprof+0x1d6/0x620 [ 96.064146][ T5357] __alloc_workqueue+0x7dc/0x21d0 [ 96.064157][ T5357] alloc_workqueue_noprof+0xe3/0x210 [ 96.064169][ T5357] mlx4_ib_init+0x1b/0x90 [ 96.064226][ T5357] do_one_initcall+0x250/0x870 [ 96.064237][ T5357] do_initcall_level+0x10a/0x1a0 [ 96.064247][ T5357] do_initcalls+0x59/0xa0 [ 96.064256][ T5357] kernel_init_freeable+0x29d/0x3e0 [ 96.064266][ T5357] kernel_init+0x22/0x1d0 [ 96.064277][ T5357] ret_from_fork+0x514/0xb70 [ 96.064288][ T5357] ret_from_fork_asm+0x1a/0x30 [ 96.064295][ T5357] page last free pid 44 tgid 44 ts 25596861804 stack trace: [ 96.064311][ T5357] __free_frozen_pages+0xc97/0xd90 [ 96.064322][ T5357] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 96.064333][ T5357] alloc_vmap_area+0xd10/0x1410 [ 96.064345][ T5357] __get_vm_area_node+0x200/0x2f0 [ 96.064358][ T5357] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 96.064402][ T5357] __vmalloc_node_noprof+0xc2/0x100 [ 96.064419][ T5357] dup_task_struct+0x2c6/0xa00 [ 96.064429][ T5357] copy_process+0x7ea/0x44b0 [ 96.064438][ T5357] kernel_clone+0x2d7/0x940 [ 96.064448][ T5357] user_mode_thread+0x115/0x180 [ 96.064458][ T5357] call_usermodehelper_exec_work+0x5c/0x230 [ 96.064468][ T5357] process_scheduled_works+0xc3d/0x1630 [ 96.064480][ T5357] worker_thread+0xa47/0xfb0 [ 96.064495][ T5357] kthread+0x38b/0x480 [ 96.064505][ T5357] ret_from_fork+0x514/0xb70 [ 96.064515][ T5357] ret_from_fork_asm+0x1a/0x30 [ 96.064526][ T5357] [ 96.064529][ T5357] Memory state around the buggy address: [ 96.064535][ T5357] ffff88804004d280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 96.064543][ T5357] ffff88804004d300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 96.064550][ T5357] >ffff88804004d380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 96.064556][ T5357] ^ [ 96.064561][ T5357] ffff88804004d400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 96.064568][ T5357] ffff88804004d480: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 96.064573][ T5357] ================================================================== [ 96.064578][ T5357] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 96.370239][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.373853][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.378254][ T5357] Call Trace: [ 96.379717][ T5357] [ 96.381058][ T5357] vpanic+0x56d/0xa60 [ 96.382851][ T5357] ? __pfx_vpanic+0x10/0x10 [ 96.384907][ T5357] panic+0xc5/0xd0 [ 96.386599][ T5357] ? __pfx_panic+0x10/0x10 [ 96.388674][ T5357] ? snapshot_ctr+0x5cb/0x1340 [ 96.390834][ T5357] ? snapshot_ctr+0x5cb/0x1340 [ 96.392961][ T5357] check_panic_on_warn+0x89/0xb0 [ 96.395152][ T5357] ? snapshot_ctr+0x5cb/0x1340 [ 96.397294][ T5357] end_report+0x73/0x170 [ 96.399184][ T5357] ? snapshot_ctr+0x5cb/0x1340 [ 96.401352][ T5357] kasan_report+0x128/0x150 [ 96.403407][ T5357] ? snapshot_ctr+0x5cb/0x1340 [ 96.405551][ T5357] snapshot_ctr+0x5cb/0x1340 [ 96.407722][ T5357] ? __pfx_snapshot_ctr+0x10/0x10 [ 96.409993][ T5357] ? skip_spaces+0x8a/0xa0 [ 96.412011][ T5357] ? dm_split_args+0x50b/0x5d0 [ 96.414158][ T5357] dm_table_add_target+0x58d/0xc70 [ 96.416579][ T5357] table_load+0x325/0x8a0 [ 96.418623][ T5357] ? __pfx_table_load+0x10/0x10 [ 96.420971][ T5357] dm_ctl_ioctl+0x9ec/0xe10 [ 96.423185][ T5357] ? __pfx_table_load+0x10/0x10 [ 96.425496][ T5357] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 96.427804][ T5357] ? __fget_files+0x2a/0x420 [ 96.429926][ T5357] ? bpf_lsm_file_ioctl+0x9/0x20 [ 96.432103][ T5357] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 96.434497][ T5357] __se_sys_ioctl+0xfc/0x170 [ 96.436582][ T5357] do_syscall_64+0x166/0x520 [ 96.438738][ T5357] ? trace_irq_disable+0x3b/0x140 [ 96.441041][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.443802][ T5357] ? clear_bhb_loop+0x70/0xc0 [ 96.446053][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.448704][ T5357] RIP: 0033:0x7f36ac39f559 [ 96.450680][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.459250][ T5357] RSP: 002b:00007f36ad349fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.462771][ T5357] RAX: ffffffffffffffda RBX: 00007f36ac625fa0 RCX: 00007f36ac39f559 [ 96.466344][ T5357] RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 96.469919][ T5357] RBP: 00007f36ac436b20 R08: 0000000000000000 R09: 0000000000000000 [ 96.473252][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.476330][ T5357] R13: 00007f36ac626038 R14: 00007f36ac625fa0 R15: 00007ffe6e9165b8 [ 96.479487][ T5357] [ 96.481239][ T5357] Kernel Offset: disabled [ 96.483020][ T5357] Rebooting in 86400 seconds..