program:
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
r1 = fsopen(&(0x7f0000000080)='exfat\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x3, &(0x7f00000000c0)='source', &(0x7f00000001c0)='source', 0x0)
syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000c00000/0x400000)=nil)
syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) (async)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async)
fsopen(&(0x7f0000000080)='exfat\x00', 0x0) (async)
fsconfig$FSCONFIG_SET_STRING(r1, 0x3, &(0x7f00000000c0)='source', &(0x7f00000001c0)='source', 0x0) (async)
syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000c00000/0x400000)=nil) (async)
[ 95.259558][ T44] Bluetooth: hci0: command tx timeout
[ 95.346757][ T5323] i2c i2c-1: dvb_frontend_start: failed to start kthread (-4)
[ 95.387577][ T5323] ==================================================================
[ 95.391003][ T5323] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0
[ 95.394504][ T5323] Read of size 4 at addr ffff888033748c3c by task syz.0.0/5323
[ 95.397750][ T5323]
[ 95.398778][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.398792][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.398800][ T5323] Call Trace:
[ 95.398807][ T5323]
[ 95.398812][ T5323] dump_stack_lvl+0xe8/0x150
[ 95.398835][ T5323] print_address_description+0x55/0x1e0
[ 95.398851][ T5323] ? dvb_frontend_release+0x407/0x4d0
[ 95.398868][ T5323] print_report+0x58/0x70
[ 95.398881][ T5323] kasan_report+0x117/0x150
[ 95.398897][ T5323] ? dvb_frontend_release+0x407/0x4d0
[ 95.398915][ T5323] dvb_frontend_release+0x407/0x4d0
[ 95.398931][ T5323] ? __pfx_dvb_frontend_release+0x10/0x10
[ 95.398946][ T5323] __fput+0x418/0xa50
[ 95.398960][ T5323] task_work_run+0x1d9/0x270
[ 95.398972][ T5323] ? __pfx_task_work_run+0x10/0x10
[ 95.398983][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 95.398999][ T5323] do_exit+0x73a/0x2360
[ 95.399015][ T5323] ? __kasan_slab_free+0x5c/0x80
[ 95.399028][ T5323] ? kmem_cache_free+0x182/0x650
[ 95.399041][ T5323] ? do_syscall_64+0x174/0x580
[ 95.399054][ T5323] ? __pfx_do_exit+0x10/0x10
[ 95.399070][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.399085][ T5323] do_group_exit+0x22d/0x2f0
[ 95.399094][ T5323] ? _raw_spin_unlock_irq+0x23/0x50
[ 95.399111][ T5323] get_signal+0x121b/0x12c0
[ 95.399130][ T5323] arch_do_signal_or_restart+0xbb/0x860
[ 95.399145][ T5323] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 95.399159][ T5323] ? do_sys_openat2+0x14e/0x200
[ 95.399177][ T5323] exit_to_user_mode_loop+0x104/0x730
[ 95.399191][ T5323] ? rcu_is_watching+0x15/0xb0
[ 95.399203][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.399215][ T5323] do_syscall_64+0x353/0x580
[ 95.399227][ T5323] ? trace_irq_disable+0x3b/0x140
[ 95.399240][ T5323] ? clear_bhb_loop+0x40/0x90
[ 95.399252][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.399263][ T5323] RIP: 0033:0x7f6b1155e6ce
[ 95.399275][ T5323] Code: Unable to access opcode bytes at 0x7f6b1155e6a4.
[ 95.399280][ T5323] RSP: 002b:00007f6b0d9f4e88 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 95.399293][ T5323] RAX: fffffffffffffffc RBX: 00007f6b0d9f56c0 RCX: 00007f6b1155e6ce
[ 95.399301][ T5323] RDX: 0000000000000002 RSI: 00007f6b0d9f4f50 RDI: ffffffffffffff9c
[ 95.399309][ T5323] RBP: 00007f6b11633eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.399316][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.399324][ T5323] R13: 00007f6b11826038 R14: 00007f6b11825fa0 R15: 00007ffd8ede4098
[ 95.399335][ T5323]
[ 95.399338][ T5323]
[ 95.503716][ T5323] Allocated by task 1:
[ 95.505335][ T5323] kasan_save_track+0x3e/0x80
[ 95.507257][ T5323] __kasan_kmalloc+0x93/0xb0
[ 95.509199][ T5323] __kmalloc_cache_noprof+0x32d/0x660
[ 95.511387][ T5323] dvb_register_device+0x309/0x1dd0
[ 95.513447][ T5323] dvb_register_frontend+0x603/0x900
[ 95.515473][ T5323] vidtv_bridge_probe+0x9d5/0xf60
[ 95.517466][ T5323] platform_probe+0xf9/0x190
[ 95.519387][ T5323] really_probe+0x254/0xae0
[ 95.521321][ T5323] __driver_probe_device+0x1e8/0x360
[ 95.523523][ T5323] driver_probe_device+0x4f/0x240
[ 95.525585][ T5323] __driver_attach+0x339/0x600
[ 95.527656][ T5323] bus_for_each_dev+0x23b/0x2c0
[ 95.529741][ T5323] bus_add_driver+0x345/0x670
[ 95.531745][ T5323] driver_register+0x23a/0x320
[ 95.533820][ T5323] vidtv_bridge_init+0x3d/0x60
[ 95.535916][ T5323] do_one_initcall+0x250/0x870
[ 95.537926][ T5323] do_initcall_level+0x10a/0x1a0
[ 95.540012][ T5323] do_initcalls+0x59/0xa0
[ 95.541791][ T5323] kernel_init_freeable+0x29d/0x3e0
[ 95.543973][ T5323] kernel_init+0x1d/0x1d0
[ 95.545741][ T5323] ret_from_fork+0x514/0xb70
[ 95.547702][ T5323] ret_from_fork_asm+0x1a/0x30
[ 95.549671][ T5323]
[ 95.550726][ T5323] Freed by task 5323:
[ 95.552443][ T5323] kasan_save_track+0x3e/0x80
[ 95.554369][ T5323] kasan_save_free_info+0x40/0x50
[ 95.556419][ T5323] __kasan_slab_free+0x5c/0x80
[ 95.558419][ T5323] kfree+0x1c5/0x640
[ 95.560046][ T5323] dvb_generic_release+0x11d/0x1b0
[ 95.562117][ T5323] dvb_frontend_release+0x132/0x4d0
[ 95.564252][ T5323] __fput+0x418/0xa50
[ 95.565944][ T5323] task_work_run+0x1d9/0x270
[ 95.567928][ T5323] do_exit+0x73a/0x2360
[ 95.569692][ T5323] do_group_exit+0x22d/0x2f0
[ 95.571628][ T5323] get_signal+0x121b/0x12c0
[ 95.573486][ T5323] arch_do_signal_or_restart+0xbb/0x860
[ 95.575817][ T5323] exit_to_user_mode_loop+0x104/0x730
[ 95.578130][ T5323] do_syscall_64+0x353/0x580
[ 95.580138][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.582578][ T5323]
[ 95.583599][ T5323] The buggy address belongs to the object at ffff888033748c00
[ 95.583599][ T5323] which belongs to the cache kmalloc-256 of size 256
[ 95.589185][ T5323] The buggy address is located 60 bytes inside of
[ 95.589185][ T5323] freed 256-byte region [ffff888033748c00, ffff888033748d00)
[ 95.594674][ T5323]
[ 95.595734][ T5323] The buggy address belongs to the physical page:
[ 95.598378][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33748
[ 95.602010][ T5323] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 95.604958][ T5323] page_type: f5(slab)
[ 95.606611][ T5323] raw: 04fff00000000000 ffff88801b041b40 dead000000000100 dead000000000122
[ 95.610034][ T5323] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 95.613417][ T5323] page dumped because: kasan: bad access detected
[ 95.616013][ T5323] page_owner tracks the page as allocated
[ 95.618368][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 19936437938, free_ts 19897420869
[ 95.626389][ T5323] post_alloc_hook+0x1f9/0x250
[ 95.628368][ T5323] get_page_from_freelist+0x21fa/0x2270
[ 95.630655][ T5323] __alloc_frozen_pages_noprof+0x18d/0x380
[ 95.633066][ T5323] allocate_slab+0x79/0x5e0
[ 95.634961][ T5323] refill_objects+0x2d5/0x350
[ 95.637026][ T5323] __pcs_replace_empty_main+0x2bf/0x6b0
[ 95.639302][ T5323] __kmalloc_cache_noprof+0x3a7/0x660
[ 95.641533][ T5323] bus_add_driver+0x162/0x670
[ 95.643563][ T5323] driver_register+0x23a/0x320
[ 95.645598][ T5323] usb_register_driver+0x1e4/0x390
[ 95.647817][ T5323] do_one_initcall+0x250/0x870
[ 95.649796][ T5323] do_initcall_level+0x10a/0x1a0
[ 95.651882][ T5323] do_initcalls+0x59/0xa0
[ 95.653703][ T5323] kernel_init_freeable+0x29d/0x3e0
[ 95.655830][ T5323] kernel_init+0x1d/0x1d0
[ 95.657600][ T5323] ret_from_fork+0x514/0xb70
[ 95.659532][ T5323] page last free pid 1 tgid 1 stack trace:
[ 95.661879][ T5323] __free_frozen_pages+0xc1e/0xd10
[ 95.664000][ T5323] __slab_free+0x274/0x2c0
[ 95.665803][ T5323] qlist_free_all+0x99/0x100
[ 95.667813][ T5323] kasan_quarantine_reduce+0x148/0x160
[ 95.670064][ T5323] __kasan_slab_alloc+0x22/0x80
[ 95.672094][ T5323] __kmalloc_cache_noprof+0x2ab/0x660
[ 95.674267][ T5323] bus_add_driver+0x162/0x670
[ 95.676226][ T5323] driver_register+0x23a/0x320
[ 95.678321][ T5323] __serio_register_driver+0xb1/0x1a0
[ 95.680600][ T5323] do_one_initcall+0x250/0x870
[ 95.682548][ T5323] do_initcall_level+0x10a/0x1a0
[ 95.684612][ T5323] do_initcalls+0x59/0xa0
[ 95.686418][ T5323] kernel_init_freeable+0x29d/0x3e0
[ 95.688616][ T5323] kernel_init+0x1d/0x1d0
[ 95.690394][ T5323] ret_from_fork+0x514/0xb70
[ 95.692345][ T5323] ret_from_fork_asm+0x1a/0x30
[ 95.694345][ T5323]
[ 95.695343][ T5323] Memory state around the buggy address:
[ 95.697689][ T5323] ffff888033748b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.700960][ T5323] ffff888033748b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.704251][ T5323] >ffff888033748c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.707666][ T5323] ^
[ 95.710177][ T5323] ffff888033748c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.713652][ T5323] ffff888033748d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.717182][ T5323] ==================================================================
[ 95.783133][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.786082][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.789674][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.793901][ T5323] Call Trace:
[ 95.795382][ T5323]
[ 95.796700][ T5323] vpanic+0x56c/0xa60
[ 95.798385][ T5323] ? __pfx_vpanic+0x10/0x10
[ 95.800260][ T5323] ? __pfx___schedule+0x10/0x10
[ 95.802215][ T5323] panic+0xc5/0xd0
[ 95.803782][ T5323] ? __pfx_panic+0x10/0x10
[ 95.805602][ T5323] ? preempt_schedule_common+0x82/0xd0
[ 95.808079][ T5323] ? dvb_frontend_release+0x407/0x4d0
[ 95.810369][ T5323] check_panic_on_warn+0x89/0xb0
[ 95.812492][ T5323] ? dvb_frontend_release+0x407/0x4d0
[ 95.814863][ T5323] end_report+0x73/0x170
[ 95.817504][ T5323] ? dvb_frontend_release+0x407/0x4d0
[ 95.819651][ T5323] kasan_report+0x128/0x150
[ 95.821550][ T5323] ? dvb_frontend_release+0x407/0x4d0
[ 95.823849][ T5323] dvb_frontend_release+0x407/0x4d0
[ 95.826111][ T5323] ? __pfx_dvb_frontend_release+0x10/0x10
[ 95.828529][ T5323] __fput+0x418/0xa50
[ 95.830254][ T5323] task_work_run+0x1d9/0x270
[ 95.832215][ T5323] ? __pfx_task_work_run+0x10/0x10
[ 95.834291][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 95.836467][ T5323] do_exit+0x73a/0x2360
[ 95.838226][ T5323] ? __kasan_slab_free+0x5c/0x80
[ 95.840361][ T5323] ? kmem_cache_free+0x182/0x650
[ 95.842498][ T5323] ? do_syscall_64+0x174/0x580
[ 95.844462][ T5323] ? __pfx_do_exit+0x10/0x10
[ 95.846371][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.848435][ T5323] do_group_exit+0x22d/0x2f0
[ 95.850293][ T5323] ? _raw_spin_unlock_irq+0x23/0x50
[ 95.852368][ T5323] get_signal+0x121b/0x12c0
[ 95.854263][ T5323] arch_do_signal_or_restart+0xbb/0x860
[ 95.856521][ T5323] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 95.859175][ T5323] ? do_sys_openat2+0x14e/0x200
[ 95.861085][ T5323] exit_to_user_mode_loop+0x104/0x730
[ 95.863288][ T5323] ? rcu_is_watching+0x15/0xb0
[ 95.865363][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.867980][ T5323] do_syscall_64+0x353/0x580
[ 95.869987][ T5323] ? trace_irq_disable+0x3b/0x140
[ 95.872122][ T5323] ? clear_bhb_loop+0x40/0x90
[ 95.874168][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.876825][ T5323] RIP: 0033:0x7f6b1155e6ce
[ 95.878769][ T5323] Code: Unable to access opcode bytes at 0x7f6b1155e6a4.
[ 95.881738][ T5323] RSP: 002b:00007f6b0d9f4e88 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 95.885361][ T5323] RAX: fffffffffffffffc RBX: 00007f6b0d9f56c0 RCX: 00007f6b1155e6ce
[ 95.888795][ T5323] RDX: 0000000000000002 RSI: 00007f6b0d9f4f50 RDI: ffffffffffffff9c
[ 95.892040][ T5323] RBP: 00007f6b11633eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.895127][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.898315][ T5323] R13: 00007f6b11826038 R14: 00007f6b11825fa0 R15: 00007ffd8ede4098
[ 95.901468][ T5323]
[ 95.903129][ T5323] Kernel Offset: disabled
[ 95.904888][ T5323] Rebooting in 86400 seconds..