program:
mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/platform/drivers/serial8250/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000600)='serial8250', 0xa) (fail_nth: 54)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0)
[ 93.951527][ T5287] Bluetooth: hci0: command tx timeout
[ 94.189829][ T5324] FAULT_INJECTION: forcing a failure.
[ 94.189829][ T5324] name failslab, interval 1, probability 0, space 0, times 1
[ 94.236659][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.236678][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.236684][ T5324] Call Trace:
[ 94.236701][ T5324]
[ 94.236706][ T5324] dump_stack_lvl+0xe8/0x150
[ 94.236775][ T5324] should_fail_ex+0x40c/0x560
[ 94.236823][ T5324] should_failslab+0xa8/0x100
[ 94.236838][ T5324] __kmalloc_noprof+0xfe/0x720
[ 94.236851][ T5324] ? serial_core_register_port+0xe73/0x2840
[ 94.236871][ T5324] ? serial_core_register_port+0xe73/0x2840
[ 94.236889][ T5324] serial_core_register_port+0xe73/0x2840
[ 94.236915][ T5324] ? __pfx_serial_core_register_port+0x10/0x10
[ 94.236929][ T5324] ? rcu_is_watching+0x15/0xb0
[ 94.236950][ T5324] ? __raw_spin_lock_init+0x45/0x100
[ 94.236967][ T5324] serial8250_unregister_port+0x39c/0x720
[ 94.236985][ T5324] serial8250_remove+0x87/0xc0
[ 94.236999][ T5324] ? __pfx_platform_remove+0x10/0x10
[ 94.237014][ T5324] device_release_driver_internal+0x48b/0x880
[ 94.237031][ T5324] unbind_store+0x1a1/0x1d0
[ 94.237051][ T5324] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.237063][ T5324] kernfs_fop_write_iter+0x3a4/0x540
[ 94.237084][ T5324] vfs_write+0x612/0xba0
[ 94.237107][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 94.237130][ T5324] ? __fget_files+0x2a/0x420
[ 94.237150][ T5324] ksys_write+0x150/0x270
[ 94.237169][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 94.237191][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.237204][ T5324] do_syscall_64+0x174/0x580
[ 94.237279][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.237296][ T5324] ? clear_bhb_loop+0x40/0x90
[ 94.237311][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.237323][ T5324] RIP: 0033:0x7f11e779de99
[ 94.237335][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.237344][ T5324] RSP: 002b:00007f11e858cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.237358][ T5324] RAX: ffffffffffffffda RBX: 00007f11e7a25fa0 RCX: 00007f11e779de99
[ 94.237366][ T5324] RDX: 000000000000000a RSI: 0000200000000600 RDI: 0000000000000003
[ 94.237373][ T5324] RBP: 00007f11e858d050 R08: 0000000000000000 R09: 0000000000000000
[ 94.237379][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 94.237386][ T5324] R13: 00007f11e7a26038 R14: 00007f11e7a25fa0 R15: 00007ffef24accc8
[ 94.237406][ T5324]
[ 94.404101][ T5324] ==================================================================
[ 94.407430][ T5324] BUG: KASAN: slab-use-after-free in serial_core_unregister_port+0x93f/0xb40
[ 94.411042][ T5324] Read of size 8 at addr ffff88803fbd9040 by task syz.0.0/5324
[ 94.414208][ T5324]
[ 94.415221][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.415236][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.415242][ T5324] Call Trace:
[ 94.415248][ T5324]
[ 94.415255][ T5324] dump_stack_lvl+0xe8/0x150
[ 94.415274][ T5324] print_address_description+0x55/0x1e0
[ 94.415290][ T5324] ? serial_core_unregister_port+0x93f/0xb40
[ 94.415304][ T5324] print_report+0x58/0x70
[ 94.415315][ T5324] kasan_report+0x117/0x150
[ 94.415330][ T5324] ? kobject_put+0x267/0x550
[ 94.415342][ T5324] ? serial_core_unregister_port+0x93f/0xb40
[ 94.415358][ T5324] serial_core_unregister_port+0x93f/0xb40
[ 94.415373][ T5324] ? __pfx_serial_core_unregister_port+0x10/0x10
[ 94.415387][ T5324] ? __mutex_unlock_slowpath+0x731/0x900
[ 94.415399][ T5324] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 94.415410][ T5324] ? __raw_spin_lock_init+0x45/0x100
[ 94.415423][ T5324] serial8250_unregister_port+0x27d/0x720
[ 94.415436][ T5324] serial8250_remove+0x87/0xc0
[ 94.415450][ T5324] ? __pfx_platform_remove+0x10/0x10
[ 94.415464][ T5324] device_release_driver_internal+0x48b/0x880
[ 94.415477][ T5324] unbind_store+0x1a1/0x1d0
[ 94.415492][ T5324] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.415502][ T5324] kernfs_fop_write_iter+0x3a4/0x540
[ 94.415519][ T5324] vfs_write+0x612/0xba0
[ 94.415534][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 94.415550][ T5324] ? __fget_files+0x2a/0x420
[ 94.415563][ T5324] ksys_write+0x150/0x270
[ 94.415578][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 94.415592][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.415605][ T5324] do_syscall_64+0x174/0x580
[ 94.415614][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.415627][ T5324] ? clear_bhb_loop+0x40/0x90
[ 94.415640][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.415649][ T5324] RIP: 0033:0x7f11e779de99
[ 94.415662][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.415670][ T5324] RSP: 002b:00007f11e858cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.415682][ T5324] RAX: ffffffffffffffda RBX: 00007f11e7a25fa0 RCX: 00007f11e779de99
[ 94.415690][ T5324] RDX: 000000000000000a RSI: 0000200000000600 RDI: 0000000000000003
[ 94.415697][ T5324] RBP: 00007f11e858d050 R08: 0000000000000000 R09: 0000000000000000
[ 94.415703][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 94.415709][ T5324] R13: 00007f11e7a26038 R14: 00007f11e7a25fa0 R15: 00007ffef24accc8
[ 94.415720][ T5324]
[ 94.415725][ T5324]
[ 94.522804][ T5324] Allocated by task 5324:
[ 94.524607][ T5324] kasan_save_track+0x3e/0x80
[ 94.526594][ T5324] __kasan_kmalloc+0x93/0xb0
[ 94.528469][ T5324] __kmalloc_cache_noprof+0x32d/0x660
[ 94.530715][ T5324] serial_base_port_add+0x5b/0x270
[ 94.532853][ T5324] serial_core_register_port+0x37f/0x2840
[ 94.535185][ T5324] serial8250_unregister_port+0x39c/0x720
[ 94.537643][ T5324] serial8250_remove+0x87/0xc0
[ 94.539688][ T5324] device_release_driver_internal+0x48b/0x880
[ 94.542144][ T5324] unbind_store+0x1a1/0x1d0
[ 94.544124][ T5324] kernfs_fop_write_iter+0x3a4/0x540
[ 94.546381][ T5324] vfs_write+0x612/0xba0
[ 94.548152][ T5324] ksys_write+0x150/0x270
[ 94.549939][ T5324] do_syscall_64+0x174/0x580
[ 94.551843][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.554282][ T5324]
[ 94.555316][ T5324] Freed by task 5324:
[ 94.557098][ T5324] kasan_save_track+0x3e/0x80
[ 94.559082][ T5324] kasan_save_free_info+0x40/0x50
[ 94.561257][ T5324] __kasan_slab_free+0x5c/0x80
[ 94.563316][ T5324] kfree+0x1c5/0x640
[ 94.564961][ T5324] device_release+0xc4/0x1f0
[ 94.566939][ T5324] kobject_put+0x222/0x550
[ 94.568794][ T5324] serial_core_register_port+0x55b/0x2840
[ 94.571081][ T5324] serial8250_unregister_port+0x39c/0x720
[ 94.573376][ T5324] serial8250_remove+0x87/0xc0
[ 94.575320][ T5324] device_release_driver_internal+0x48b/0x880
[ 94.577802][ T5324] unbind_store+0x1a1/0x1d0
[ 94.579794][ T5324] kernfs_fop_write_iter+0x3a4/0x540
[ 94.582083][ T5324] vfs_write+0x612/0xba0
[ 94.583974][ T5324] ksys_write+0x150/0x270
[ 94.585851][ T5324] do_syscall_64+0x174/0x580
[ 94.587851][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.590331][ T5324]
[ 94.591378][ T5324] The buggy address belongs to the object at ffff88803fbd9000
[ 94.591378][ T5324] which belongs to the cache kmalloc-2k of size 2048
[ 94.596806][ T5324] The buggy address is located 64 bytes inside of
[ 94.596806][ T5324] freed 2048-byte region [ffff88803fbd9000, ffff88803fbd9800)
[ 94.601908][ T5324]
[ 94.602873][ T5324] The buggy address belongs to the physical page:
[ 94.605329][ T5324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fbd8
[ 94.608574][ T5324] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 94.611898][ T5324] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 94.615035][ T5324] page_type: f5(slab)
[ 94.616902][ T5324] raw: 04fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 94.620723][ T5324] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 94.624360][ T5324] head: 04fff00000000040 ffff88801b042000 dead000000000100 dead000000000122
[ 94.628064][ T5324] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 94.631724][ T5324] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 94.635508][ T5324] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 94.639154][ T5324] page dumped because: kasan: bad access detected
[ 94.641895][ T5324] page_owner tracks the page as allocated
[ 94.644377][ T5324] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 803, tgid 803 (kworker/0:2), ts 94135270707, free_ts 91525274829
[ 94.653151][ T5324] post_alloc_hook+0x1f9/0x250
[ 94.655190][ T5324] get_page_from_freelist+0x21fa/0x2270
[ 94.657604][ T5324] __alloc_frozen_pages_noprof+0x18d/0x380
[ 94.660029][ T5324] allocate_slab+0x79/0x5e0
[ 94.661867][ T5324] refill_objects+0x2d5/0x350
[ 94.663734][ T5324] __pcs_replace_empty_main+0x2bf/0x6b0
[ 94.665991][ T5324] __kmalloc_node_track_caller_noprof+0x557/0x730
[ 94.668573][ T5324] __alloc_skb+0x2bd/0x7a0
[ 94.670339][ T5324] mld_newpack+0x165/0xcb0
[ 94.672168][ T5324] add_grec+0x119f/0x19d0
[ 94.673973][ T5324] mld_send_initial_cr+0x288/0x550
[ 94.676087][ T5324] mld_dad_work+0x3d/0x480
[ 94.677904][ T5324] process_scheduled_works+0xa8e/0x14e0
[ 94.680283][ T5324] worker_thread+0xa47/0xfb0
[ 94.682465][ T5324] kthread+0x388/0x470
[ 94.684308][ T5324] ret_from_fork+0x514/0xb70
[ 94.686227][ T5324] page last free pid 803 tgid 803 stack trace:
[ 94.688728][ T5324] free_pages_prepare+0x960/0xa60
[ 94.690703][ T5324] __free_contig_range_common+0x174/0x340
[ 94.693006][ T5324] free_pages_bulk+0x48/0x120
[ 94.694934][ T5324] vfree+0x224/0x4a0
[ 94.696620][ T5324] delayed_vfree_work+0x55/0x80
[ 94.698614][ T5324] process_scheduled_works+0xa8e/0x14e0
[ 94.700979][ T5324] worker_thread+0xa47/0xfb0
[ 94.702891][ T5324] kthread+0x388/0x470
[ 94.704519][ T5324] ret_from_fork+0x514/0xb70
[ 94.706550][ T5324] ret_from_fork_asm+0x1a/0x30
[ 94.708543][ T5324]
[ 94.709602][ T5324] Memory state around the buggy address:
[ 94.711959][ T5324] ffff88803fbd8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.715087][ T5324] ffff88803fbd8f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.718874][ T5324] >ffff88803fbd9000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.722156][ T5324] ^
[ 94.724739][ T5324] ffff88803fbd9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.728142][ T5324] ffff88803fbd9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.731590][ T5324] ==================================================================
[ 94.880594][ T5324] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.884049][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.888166][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.892368][ T5324] Call Trace:
[ 94.893830][ T5324]
[ 94.895209][ T5324] vpanic+0x56c/0xa60
[ 94.896998][ T5324] ? __pfx_vpanic+0x10/0x10
[ 94.898964][ T5324] panic+0xc5/0xd0
[ 94.900598][ T5324] ? __pfx_panic+0x10/0x10
[ 94.902305][ T5324] ? preempt_schedule_thunk+0x16/0x40
[ 94.904493][ T5324] ? serial_core_unregister_port+0x93f/0xb40
[ 94.906951][ T5324] ? preempt_schedule_thunk+0x16/0x40
[ 94.909218][ T5324] ? serial_core_unregister_port+0x93f/0xb40
[ 94.911519][ T5324] check_panic_on_warn+0x89/0xb0
[ 94.913295][ T5324] ? serial_core_unregister_port+0x93f/0xb40
[ 94.915496][ T5324] end_report+0x73/0x170
[ 94.917169][ T5324] ? serial_core_unregister_port+0x93f/0xb40
[ 94.919629][ T5324] kasan_report+0x128/0x150
[ 94.921708][ T5324] ? kobject_put+0x267/0x550
[ 94.923842][ T5324] ? serial_core_unregister_port+0x93f/0xb40
[ 94.926535][ T5324] serial_core_unregister_port+0x93f/0xb40
[ 94.929076][ T5324] ? __pfx_serial_core_unregister_port+0x10/0x10
[ 94.931772][ T5324] ? __mutex_unlock_slowpath+0x731/0x900
[ 94.934200][ T5324] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 94.936886][ T5324] ? __raw_spin_lock_init+0x45/0x100
[ 94.939164][ T5324] serial8250_unregister_port+0x27d/0x720
[ 94.941635][ T5324] serial8250_remove+0x87/0xc0
[ 94.943549][ T5324] ? __pfx_platform_remove+0x10/0x10
[ 94.945749][ T5324] device_release_driver_internal+0x48b/0x880
[ 94.948151][ T5324] unbind_store+0x1a1/0x1d0
[ 94.950045][ T5324] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.952157][ T5324] kernfs_fop_write_iter+0x3a4/0x540
[ 94.954466][ T5324] vfs_write+0x612/0xba0
[ 94.956342][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 94.958323][ T5324] ? __fget_files+0x2a/0x420
[ 94.960293][ T5324] ksys_write+0x150/0x270
[ 94.962094][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 94.964125][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.967142][ T5324] do_syscall_64+0x174/0x580
[ 94.969711][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.972376][ T5324] ? clear_bhb_loop+0x40/0x90
[ 94.974385][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.976932][ T5324] RIP: 0033:0x7f11e779de99
[ 94.978849][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.986326][ T5324] RSP: 002b:00007f11e858cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.989451][ T5324] RAX: ffffffffffffffda RBX: 00007f11e7a25fa0 RCX: 00007f11e779de99
[ 94.992639][ T5324] RDX: 000000000000000a RSI: 0000200000000600 RDI: 0000000000000003
[ 94.995559][ T5324] RBP: 00007f11e858d050 R08: 0000000000000000 R09: 0000000000000000
[ 94.998520][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 95.001774][ T5324] R13: 00007f11e7a26038 R14: 00007f11e7a25fa0 R15: 00007ffef24accc8
[ 95.004866][ T5324]
[ 95.006612][ T5324] Kernel Offset: disabled
[ 95.009158][ T5324] Rebooting in 86400 seconds..