program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) timer_getoverrun(r1) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) (async) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) timer_getoverrun(r1) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) [ 102.838243][ T4649] Bluetooth: hci0: command tx timeout [ 102.999964][ T5329] ================================================================== [ 103.003491][ T5329] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 103.007645][ T5329] Read of size 4 at addr ffff88803673163c by task syz.0.0/5329 [ 103.011198][ T5329] [ 103.012231][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.012248][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.012255][ T5329] Call Trace: [ 103.012262][ T5329] [ 103.012268][ T5329] dump_stack_lvl+0xe8/0x150 [ 103.012291][ T5329] print_address_description+0x55/0x1e0 [ 103.012306][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 103.012319][ T5329] print_report+0x58/0x70 [ 103.012331][ T5329] kasan_report+0x117/0x150 [ 103.012345][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 103.012359][ T5329] dvb_frontend_release+0x407/0x4d0 [ 103.012372][ T5329] ? __pfx_dvb_frontend_release+0x10/0x10 [ 103.012386][ T5329] __fput+0x418/0xa50 [ 103.012400][ T5329] task_work_run+0x1d9/0x270 [ 103.012417][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 103.012435][ T5329] exit_to_user_mode_loop+0x1fa/0x730 [ 103.012449][ T5329] ? rcu_is_watching+0x15/0xb0 [ 103.012467][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.012478][ T5329] do_syscall_64+0x353/0x580 [ 103.012494][ T5329] ? clear_bhb_loop+0x40/0x90 [ 103.012505][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.012518][ T5329] RIP: 0033:0x7f285819de59 [ 103.012530][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.012538][ T5329] RSP: 002b:00007ffc5c1a9938 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.012551][ T5329] RAX: 0000000000000000 RBX: 00007f2858427da0 RCX: 00007f285819de59 [ 103.012558][ T5329] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.012566][ T5329] RBP: 00007f2858427da0 R08: 00007f2858426218 R09: 0000000000000000 [ 103.012573][ T5329] R10: 0000000000dffd1c R11: 0000000000000246 R12: 0000000000019485 [ 103.012579][ T5329] R13: 00007f285842618c R14: 00007f2858426188 R15: 00007f2858426180 [ 103.012590][ T5329] [ 103.012593][ T5329] [ 103.099727][ T5329] Allocated by task 1: [ 103.101697][ T5329] kasan_save_track+0x3e/0x80 [ 103.103623][ T5329] __kasan_kmalloc+0x93/0xb0 [ 103.105593][ T5329] __kmalloc_cache_noprof+0x32d/0x660 [ 103.107728][ T5329] dvb_register_device+0x309/0x1dd0 [ 103.109902][ T5329] dvb_register_frontend+0x603/0x900 [ 103.112353][ T5329] vidtv_bridge_probe+0x9d5/0xf60 [ 103.115241][ T5329] platform_probe+0xf9/0x190 [ 103.117710][ T5329] really_probe+0x254/0xae0 [ 103.119575][ T5329] __driver_probe_device+0x1e8/0x360 [ 103.121748][ T5329] driver_probe_device+0x4f/0x240 [ 103.123861][ T5329] __driver_attach+0x339/0x600 [ 103.125776][ T5329] bus_for_each_dev+0x23b/0x2c0 [ 103.127743][ T5329] bus_add_driver+0x345/0x670 [ 103.129814][ T5329] driver_register+0x23a/0x320 [ 103.132372][ T5329] vidtv_bridge_init+0x3d/0x60 [ 103.135070][ T5329] do_one_initcall+0x250/0x870 [ 103.137227][ T5329] do_initcall_level+0x10a/0x1a0 [ 103.139447][ T5329] do_initcalls+0x59/0xa0 [ 103.141353][ T5329] kernel_init_freeable+0x29d/0x3e0 [ 103.143618][ T5329] kernel_init+0x1d/0x1d0 [ 103.145462][ T5329] ret_from_fork+0x514/0xb70 [ 103.147472][ T5329] ret_from_fork_asm+0x1a/0x30 [ 103.149524][ T5329] [ 103.150514][ T5329] Freed by task 5329: [ 103.152258][ T5329] kasan_save_track+0x3e/0x80 [ 103.154415][ T5329] kasan_save_free_info+0x40/0x50 [ 103.157065][ T5329] __kasan_slab_free+0x5c/0x80 [ 103.159975][ T5329] kfree+0x1c5/0x640 [ 103.161819][ T5329] dvb_generic_release+0x11d/0x1b0 [ 103.163957][ T5329] dvb_frontend_release+0x132/0x4d0 [ 103.166147][ T5329] __fput+0x418/0xa50 [ 103.168050][ T5329] task_work_run+0x1d9/0x270 [ 103.170362][ T5329] exit_to_user_mode_loop+0x1fa/0x730 [ 103.173084][ T5329] do_syscall_64+0x353/0x580 [ 103.175565][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.178355][ T5329] [ 103.179343][ T5329] The buggy address belongs to the object at ffff888036731600 [ 103.179343][ T5329] which belongs to the cache kmalloc-256 of size 256 [ 103.184611][ T5329] The buggy address is located 60 bytes inside of [ 103.184611][ T5329] freed 256-byte region [ffff888036731600, ffff888036731700) [ 103.189784][ T5329] [ 103.190726][ T5329] The buggy address belongs to the physical page: [ 103.193824][ T5329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36731 [ 103.198873][ T5329] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 103.202213][ T5329] page_type: f5(slab) [ 103.204277][ T5329] raw: 04fff00000000000 ffff88801b041b40 dead000000000100 dead000000000122 [ 103.208151][ T5329] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 103.211458][ T5329] page dumped because: kasan: bad access detected [ 103.214024][ T5329] page_owner tracks the page as allocated [ 103.215873][ T5329] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 52, tgid 52 (kworker/u4:4), ts 14273478907, free_ts 13931666782 [ 103.226911][ T5329] post_alloc_hook+0x1f9/0x250 [ 103.229455][ T5329] get_page_from_freelist+0x21fa/0x2270 [ 103.232283][ T5329] __alloc_frozen_pages_noprof+0x18d/0x380 [ 103.235288][ T5329] allocate_slab+0x79/0x5e0 [ 103.237796][ T5329] refill_objects+0x2d5/0x350 [ 103.240435][ T5329] __pcs_replace_empty_main+0x2bf/0x6b0 [ 103.243651][ T5329] __kmalloc_cache_noprof+0x3a7/0x660 [ 103.246194][ T5329] scsi_probe_and_add_lun+0x2fd/0x4b10 [ 103.248702][ T5329] __scsi_add_device+0x18c/0x220 [ 103.250779][ T5329] ata_scsi_scan_host+0x1f3/0x6c0 [ 103.252705][ T5329] async_run_entry_fn+0x9d/0x430 [ 103.254628][ T5329] process_scheduled_works+0xa8e/0x14e0 [ 103.258483][ T5329] worker_thread+0xa47/0xfb0 [ 103.261697][ T5329] kthread+0x388/0x470 [ 103.263463][ T5329] ret_from_fork+0x514/0xb70 [ 103.265445][ T5329] ret_from_fork_asm+0x1a/0x30 [ 103.267621][ T5329] page last free pid 940 tgid 940 stack trace: [ 103.270568][ T5329] __free_frozen_pages+0xc1e/0xd10 [ 103.273155][ T5329] kasan_depopulate_vmalloc_pte+0x6d/0x90 [ 103.275677][ T5329] __apply_to_page_range+0xbd8/0x1420 [ 103.277926][ T5329] __kasan_release_vmalloc+0xa2/0xd0 [ 103.280797][ T5329] purge_vmap_node+0x220/0x960 [ 103.283714][ T5329] __purge_vmap_area_lazy+0x783/0xb40 [ 103.286081][ T5329] drain_vmap_area_work+0x27/0x40 [ 103.288230][ T5329] process_scheduled_works+0xa8e/0x14e0 [ 103.290564][ T5329] worker_thread+0xa47/0xfb0 [ 103.292685][ T5329] kthread+0x388/0x470 [ 103.294490][ T5329] ret_from_fork+0x514/0xb70 [ 103.296454][ T5329] ret_from_fork_asm+0x1a/0x30 [ 103.298795][ T5329] [ 103.300169][ T5329] Memory state around the buggy address: [ 103.303036][ T5329] ffff888036731500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.306628][ T5329] ffff888036731580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.310102][ T5329] >ffff888036731600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.313548][ T5329] ^ [ 103.316204][ T5329] ffff888036731680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.320181][ T5329] ffff888036731700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.323518][ T5329] ================================================================== [ 103.342886][ T5329] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.345861][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.349686][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.353832][ T5329] Call Trace: [ 103.355253][ T5329] [ 103.356554][ T5329] vpanic+0x56c/0xa60 [ 103.358311][ T5329] ? __pfx_vpanic+0x10/0x10 [ 103.360321][ T5329] ? __pfx___schedule+0x10/0x10 [ 103.362464][ T5329] panic+0xc5/0xd0 [ 103.364104][ T5329] ? __pfx_panic+0x10/0x10 [ 103.366111][ T5329] ? preempt_schedule_common+0x82/0xd0 [ 103.368607][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 103.370915][ T5329] check_panic_on_warn+0x89/0xb0 [ 103.372894][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 103.374759][ T5329] end_report+0x73/0x170 [ 103.376561][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 103.379005][ T5329] kasan_report+0x128/0x150 [ 103.381028][ T5329] ? dvb_frontend_release+0x407/0x4d0 [ 103.383353][ T5329] dvb_frontend_release+0x407/0x4d0 [ 103.385506][ T5329] ? __pfx_dvb_frontend_release+0x10/0x10 [ 103.387795][ T5329] __fput+0x418/0xa50 [ 103.389503][ T5329] task_work_run+0x1d9/0x270 [ 103.391324][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 103.393416][ T5329] exit_to_user_mode_loop+0x1fa/0x730 [ 103.395764][ T5329] ? rcu_is_watching+0x15/0xb0 [ 103.397826][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.400449][ T5329] do_syscall_64+0x353/0x580 [ 103.402420][ T5329] ? clear_bhb_loop+0x40/0x90 [ 103.404368][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.407240][ T5329] RIP: 0033:0x7f285819de59 [ 103.410196][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.417722][ T5329] RSP: 002b:00007ffc5c1a9938 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.421080][ T5329] RAX: 0000000000000000 RBX: 00007f2858427da0 RCX: 00007f285819de59 [ 103.424417][ T5329] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.428162][ T5329] RBP: 00007f2858427da0 R08: 00007f2858426218 R09: 0000000000000000 [ 103.431847][ T5329] R10: 0000000000dffd1c R11: 0000000000000246 R12: 0000000000019485 [ 103.435201][ T5329] R13: 00007f285842618c R14: 00007f2858426188 R15: 00007f2858426180 [ 103.438712][ T5329] [ 103.440679][ T5329] Kernel Offset: disabled [ 103.442794][ T5329] Rebooting in 86400 seconds..