program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/4\x00') pread64(r2, &(0x7f00000001c0)=""/31, 0x1f, 0x6677) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) [ 94.072533][ T5299] Bluetooth: hci0: command tx timeout [ 94.181609][ T5340] ================================================================== [ 94.181672][ T5340] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 94.181858][ T5340] Read of size 4 at addr ffff888038b76c3c by task syz.0.0/5340 [ 94.181875][ T5340] [ 94.181883][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.181896][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.181903][ T5340] Call Trace: [ 94.181907][ T5340] [ 94.181914][ T5340] dump_stack_lvl+0xe8/0x150 [ 94.181934][ T5340] print_address_description+0x55/0x1e0 [ 94.181951][ T5340] ? dvb_frontend_release+0x407/0x4d0 [ 94.181972][ T5340] print_report+0x58/0x70 [ 94.181986][ T5340] kasan_report+0x117/0x150 [ 94.182001][ T5340] ? dvb_frontend_release+0x407/0x4d0 [ 94.182014][ T5340] dvb_frontend_release+0x407/0x4d0 [ 94.182026][ T5340] ? __pfx_dvb_frontend_release+0x10/0x10 [ 94.182037][ T5340] __fput+0x408/0xa40 [ 94.182053][ T5340] fput_close_sync+0x11f/0x240 [ 94.182068][ T5340] ? __pfx_fput_close_sync+0x10/0x10 [ 94.182084][ T5340] filp_close_sync+0x6e/0xa0 [ 94.182100][ T5340] __se_sys_close_range+0xa77/0xef0 [ 94.182122][ T5340] ? __pfx___se_sys_close_range+0x10/0x10 [ 94.182137][ T5340] ? __task_pid_nr_ns+0x28/0x470 [ 94.182152][ T5340] do_syscall_64+0x166/0x520 [ 94.182164][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.182176][ T5340] ? clear_bhb_loop+0x70/0xc0 [ 94.182188][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.182199][ T5340] RIP: 0033:0x7f086039f559 [ 94.182209][ T5340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.182231][ T5340] RSP: 002b:00007ffd33f279c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 94.182245][ T5340] RAX: ffffffffffffffda RBX: 00007ffd33f27ab0 RCX: 00007f086039f559 [ 94.182254][ T5340] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 94.182261][ T5340] RBP: 0000000000016ed4 R08: 0000000000000001 R09: 0000000000000000 [ 94.182267][ T5340] R10: 00007f08601ff030 R11: 0000000000000246 R12: 00007ffd33f27af0 [ 94.182275][ T5340] R13: 00007f0860625fac R14: 0000000000016f6b R15: 00007f0860625fa0 [ 94.182287][ T5340] [ 94.182290][ T5340] [ 94.182293][ T5340] Allocated by task 1: [ 94.182299][ T5340] kasan_save_track+0x3e/0x80 [ 94.182309][ T5340] __kasan_kmalloc+0x93/0xb0 [ 94.182319][ T5340] __kmalloc_cache_noprof+0x31c/0x600 [ 94.182336][ T5340] dvb_register_device+0x309/0x1dd0 [ 94.182348][ T5340] dvb_register_frontend+0x603/0x900 [ 94.182356][ T5340] vidtv_bridge_probe+0x9d5/0xf60 [ 94.182370][ T5340] platform_probe+0xf9/0x190 [ 94.182420][ T5340] really_probe+0x254/0xae0 [ 94.182432][ T5340] __driver_probe_device+0x1e8/0x360 [ 94.182445][ T5340] driver_probe_device+0x4f/0x240 [ 94.182457][ T5340] __driver_attach+0x339/0x600 [ 94.182469][ T5340] bus_for_each_dev+0x23b/0x2c0 [ 94.182485][ T5340] bus_add_driver+0x38f/0x6e0 [ 94.182493][ T5340] driver_register+0x23a/0x320 [ 94.182506][ T5340] vidtv_bridge_init+0x3d/0x60 [ 94.182562][ T5340] do_one_initcall+0x250/0x870 [ 94.182571][ T5340] do_initcall_level+0x10a/0x1a0 [ 94.182594][ T5340] do_initcalls+0x59/0xa0 [ 94.182605][ T5340] kernel_init_freeable+0x29d/0x3e0 [ 94.182617][ T5340] kernel_init+0x22/0x1d0 [ 94.182628][ T5340] ret_from_fork+0x514/0xb70 [ 94.182640][ T5340] ret_from_fork_asm+0x1a/0x30 [ 94.182649][ T5340] [ 94.182652][ T5340] Freed by task 5340: [ 94.182659][ T5340] kasan_save_track+0x3e/0x80 [ 94.182668][ T5340] kasan_save_free_info+0x40/0x50 [ 94.182683][ T5340] __kasan_slab_free+0x5c/0x80 [ 94.182693][ T5340] kfree+0x1c5/0x650 [ 94.182706][ T5340] dvb_generic_release+0x11d/0x1b0 [ 94.182716][ T5340] dvb_frontend_release+0x132/0x4d0 [ 94.182727][ T5340] __fput+0x408/0xa40 [ 94.182739][ T5340] fput_close_sync+0x11f/0x240 [ 94.182753][ T5340] filp_close_sync+0x6e/0xa0 [ 94.182765][ T5340] __se_sys_close_range+0xa77/0xef0 [ 94.182780][ T5340] do_syscall_64+0x166/0x520 [ 94.182790][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.182800][ T5340] [ 94.182803][ T5340] The buggy address belongs to the object at ffff888038b76c00 [ 94.182803][ T5340] which belongs to the cache kmalloc-256 of size 256 [ 94.182821][ T5340] The buggy address is located 60 bytes inside of [ 94.182821][ T5340] freed 256-byte region [ffff888038b76c00, ffff888038b76d00) [ 94.182832][ T5340] [ 94.182835][ T5340] The buggy address belongs to the physical page: [ 94.182840][ T5340] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38b76 [ 94.182851][ T5340] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 94.182860][ T5340] page_type: f5(slab) [ 94.182877][ T5340] raw: 04fff00000000000 ffff88801c441b40 dead000000000100 dead000000000122 [ 94.182886][ T5340] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 94.182892][ T5340] page dumped because: kasan: bad access detected [ 94.182898][ T5340] page_owner tracks the page as allocated [ 94.182902][ T5340] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22057294083 [ 94.182918][ T5340] post_alloc_hook+0x1f9/0x250 [ 94.182933][ T5340] get_page_from_freelist+0x220f/0x2280 [ 94.182944][ T5340] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 94.182954][ T5340] allocate_slab+0x7d/0x5e0 [ 94.182966][ T5340] refill_objects+0x2d5/0x350 [ 94.182978][ T5340] __pcs_replace_empty_main+0x2c8/0x6c0 [ 94.182990][ T5340] __kmalloc_cache_noprof+0x396/0x600 [ 94.183005][ T5340] bus_add_driver+0x19d/0x6e0 [ 94.183014][ T5340] driver_register+0x23a/0x320 [ 94.183027][ T5340] do_one_initcall+0x250/0x870 [ 94.183036][ T5340] do_initcall_level+0x10a/0x1a0 [ 94.183048][ T5340] do_initcalls+0x59/0xa0 [ 94.183058][ T5340] kernel_init_freeable+0x29d/0x3e0 [ 94.183070][ T5340] kernel_init+0x22/0x1d0 [ 94.183081][ T5340] ret_from_fork+0x514/0xb70 [ 94.183091][ T5340] ret_from_fork_asm+0x1a/0x30 [ 94.183100][ T5340] page last free pid 10 tgid 10 ts 21198108745 stack trace: [ 94.183108][ T5340] __free_frozen_pages+0xc97/0xd90 [ 94.183122][ T5340] kasan_depopulate_vmalloc_pte+0x6d/0x90 [ 94.183138][ T5340] __apply_to_page_range+0xbd8/0x1420 [ 94.183150][ T5340] __kasan_release_vmalloc+0xa2/0xd0 [ 94.183165][ T5340] purge_vmap_node+0x225/0x960 [ 94.183174][ T5340] __purge_vmap_area_lazy+0x783/0xb40 [ 94.183183][ T5340] drain_vmap_area_work+0x27/0x40 [ 94.183192][ T5340] process_scheduled_works+0xc3d/0x1630 [ 94.183208][ T5340] worker_thread+0xa47/0xfb0 [ 94.183222][ T5340] kthread+0x38b/0x480 [ 94.183232][ T5340] ret_from_fork+0x514/0xb70 [ 94.183242][ T5340] ret_from_fork_asm+0x1a/0x30 [ 94.183252][ T5340] [ 94.183254][ T5340] Memory state around the buggy address: [ 94.183260][ T5340] ffff888038b76b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.183267][ T5340] ffff888038b76b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.183274][ T5340] >ffff888038b76c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.183280][ T5340] ^ [ 94.183285][ T5340] ffff888038b76c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.183292][ T5340] ffff888038b76d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.183297][ T5340] ================================================================== [ 94.192652][ T5340] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.502011][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.505791][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.510275][ T5340] Call Trace: [ 94.511523][ T5340] [ 94.512624][ T5340] vpanic+0x56d/0xa60 [ 94.514232][ T5340] ? rcu_is_watching+0x16/0xb0 [ 94.515869][ T5340] ? __pfx_vpanic+0x10/0x10 [ 94.517369][ T5340] ? __pfx___schedule+0x10/0x10 [ 94.518953][ T5340] panic+0xc5/0xd0 [ 94.520218][ T5340] ? __pfx_panic+0x10/0x10 [ 94.521978][ T5340] ? preempt_schedule_common+0x7f/0xd0 [ 94.524104][ T5340] ? dvb_frontend_release+0x407/0x4d0 [ 94.526245][ T5340] check_panic_on_warn+0x89/0xb0 [ 94.528175][ T5340] ? dvb_frontend_release+0x407/0x4d0 [ 94.530282][ T5340] end_report+0x73/0x170 [ 94.532017][ T5340] ? dvb_frontend_release+0x407/0x4d0 [ 94.534126][ T5340] kasan_report+0x128/0x150 [ 94.536113][ T5340] ? dvb_frontend_release+0x407/0x4d0 [ 94.538294][ T5340] dvb_frontend_release+0x407/0x4d0 [ 94.540425][ T5340] ? __pfx_dvb_frontend_release+0x10/0x10 [ 94.542744][ T5340] __fput+0x408/0xa40 [ 94.544454][ T5340] fput_close_sync+0x11f/0x240 [ 94.546508][ T5340] ? __pfx_fput_close_sync+0x10/0x10 [ 94.548699][ T5340] filp_close_sync+0x6e/0xa0 [ 94.550647][ T5340] __se_sys_close_range+0xa77/0xef0 [ 94.552902][ T5340] ? __pfx___se_sys_close_range+0x10/0x10 [ 94.555397][ T5340] ? __task_pid_nr_ns+0x28/0x470 [ 94.557518][ T5340] do_syscall_64+0x166/0x520 [ 94.559542][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.561710][ T5340] ? clear_bhb_loop+0x70/0xc0 [ 94.563417][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.565543][ T5340] RIP: 0033:0x7f086039f559 [ 94.567113][ T5340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.574022][ T5340] RSP: 002b:00007ffd33f279c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 94.577380][ T5340] RAX: ffffffffffffffda RBX: 00007ffd33f27ab0 RCX: 00007f086039f559 [ 94.580579][ T5340] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 94.583954][ T5340] RBP: 0000000000016ed4 R08: 0000000000000001 R09: 0000000000000000 [ 94.587274][ T5340] R10: 00007f08601ff030 R11: 0000000000000246 R12: 00007ffd33f27af0 [ 94.590381][ T5340] R13: 00007f0860625fac R14: 0000000000016f6b R15: 00007f0860625fa0 [ 94.593629][ T5340] [ 94.595284][ T5340] Kernel Offset: disabled [ 94.596968][ T5340] Rebooting in 86400 seconds..