program: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000007140), 0x2, 0x0) (async) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000200)='./proc\x00', 0x10000, &(0x7f0000000240)=ANY=[@ANYBLOB='gid=', @ANYRESHEX=0x0, @ANYRES32=0x0, @ANYRESHEX=0xee00, @ANYBLOB=',codepage=macgaelic,fmask=00000000000000000000001,namecase=1,iocharset=cp865,namecase=1,namecase=1,errors=continue,\x00'], 0x1, 0x153b, &(0x7f0000000300)="$eJzs3AucTtX6OPDnWWvtMSbpbZLLsNZ6Nm9yWSRJLklySZIkSXJLSJIcSUgMuSUNSUjuyXVCcpmYNO73+yUhSZokCcktWf/PxPycTvU/5/xOJ+d35vl+Pu9n1jPrffZ+1jzz7nfvPS/fdB5SvWGNKvWJCP4lePFLIgDEAsAAALgGAAIAKBNfJj5jPrvExH9tJ+yP9dD0K10Bu5K4/1kb9z9r4/5nbdz/rI37n7Vx/7M27n/Wxv1nLCvbPCPftfzIug++/5+V8fv/f5H0EmO+WFvi+i4AMf9oCvf//z78F3K5//+1gn/kSdz/rI37n1XFXukC2H8Afv1nBdl+d4b7n7Vx/xnLyv76XnAsXPn70X/2AyL/zr+B+J4Xf8pXfp2/u37GGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY+xPcMZfpgAgc3yl62KMMcYYY4wxxtgfx2e70hUwxhhjjDHGGGPs3w9BgAQFAcRANoiF7BAHAiAmc/5aiIfrIBdcD7khD+SFfJAA+aEAaDBggSCEglAIonADFIYboQgUhWJQHByUgJJwE5SCm6E03AJl4FYoC7dBOSgPFaAi3A6V4A6oDHdCFbgLqkI1qA414G6oCfdALbgXasN9UAfuh7rwANSDB6E+PAQN4GFoCI9AI3gUGkMTaArNoPn/Kv8F6A4vQg/oCYnQC3rDS9AH+kI/6A8D4GUYCK/AIHgVkmBw3BB4DYbC6zAM3oDhMAJGwpswCt6C0TAGxsI4GA8TYCK8DZPgHZgMU2AqTIPpMAOS4V2YCbNgNrwHc+B9mAvzYD4sgBT4ABbCIkiFD2ExfARpsASWwjJYDitgJayC1bAG1sI6WA8bYCNsgs2wBbbCNtgOO2AnfAy74BPYDXtgL3wK++CzfzL/9N/kd0FAQIECFSqMwRiMxViMwzjMgTkwJ+bECEYwHuMxF+bC3Jgb82JeTMAELIAF0KBBQsKCWBCjGMXCWBiLYBEshsXQocOSWBJL4c1YGktjGSyDZbEslsPyWB4rYkWshJWwMlbGKlgFq2JVrI7V8W68G3thLayFtbE21sE6mbensD7WxwbYABtiQ2yEjbAxNsam2BSbY3NsgS2wJbbE1tga22AbbIttsR22w/bYHjtgB+yIHbETdsLO2Bm7YFfsmv5CNsAX8UXsiVVFL+yNvbEPJmXrh/2xP76MA/EVfAVfxSQcjEPwNXwNX8dheAqHXxiBI3EkVhJv4WgcgyTG4XgcjxNxIk7CSTgZp+AUnIbTcQYmYzLOxFk4C9/DOfg+vo/zcB4uwBRMwYW4CFMxFRfjaUzDJbgUl+FyXIHLcRWuxlW4FtfhWtyAG3ATbsItuAW34TbcgTvwY1QA+AnuwT2YhPtwH+7H/XgAD+BBPIjpmI6H8BAexsN4BI/gUTyKx/A4nsDjeBJP4ik8jWfwDJ7Dc3gen0v4qsHHRdckgcighBIxIkbEilgRJ+JEDpFD5BQ5RURERLyIF7lELpFb5BZ5RV6RIBJEAVFAGGEEiTDjSCGiIioKi8KiiCgiioliwgknSoqSopQoJUqL0qKMuFWUFbeJcqK8aOUqioqikmjtKos7RRVRRVQV1UR1UUPUEDVFTVFL1BK1RW1RR9QRdcUDop7ohf3wIZHRmYZiMDYSQ7CxaCLkpSNUCzEMW4pWorV4QozA4dhWtHDtxNOivRiNHcRfxBh8VnQS47CzeF50EV1FN/GC6C5auh6ip5iMvURvMQ37iL6in+gvZmI18R7OyV5dvCqSxGAxRLwmFuDrYpi4SgwXI8RI8aYYJd4So8UYMVaME+PFBDFRvC0miXfEZDFFTBXTxHQxQySLd8VMMUvMFu+JOeJ9MVfME/PFApEiPhALxSKRKj4Ui8VHIk0sEUvFMrFcrBArxSqxWqwRa8U6sV5sEBvFJrFZbBFbxTaxXewQO8XHYpf4ROwWe8Re8anYJz4T+8Xn4oD4QhwUX4p08ZU4JL4Wh8U34oj4VhwV34lj4rg4Ib4XJ8UP4pQ4Lc6Is+Kc+FGcFz+JC8ILkCiFlFLJQMbIbDJWZpdx8iqZQwaZx38ZL6+TueT1MrfMI/PKfDJB5pcFpJZGWkkylAVlIRmVN8jC8kZZRBaVxWRx6WQJWVLeJEvJm2VpeYssI2+VZeVtspwsLyvIivJ2WUneISFycR9VZTVZXdaQd8tEuEfWkvfK2vI+WUfeL+vKB2Q9+aCsLx+SDeTDsqF8RDaSj8rGsolsKpvJ5vIx2UI+LlvKVrK1fEK2kU/KtvIp2U4+LdtLf+lX5FnZST4nO8vnZRfZVXaTP8kL0ssesqeEXiB7y5dkH9lX9pP95QD5shwoX5GD5KsySQ6WQ+Rrcqh8XQ6Tb8jhcoQcKd+Uo+RbcrQcI8fKcXK8nCAnyrflJPmOnCynyKlympwuZ8h+l7Y0W8q/m//2b+QP+nnvm+RmuUVuldvkdrlD7pQfy11yl9wtd8u9cq/cJ/fJ/XK/PCAPyIPyoEyX6fKQPCQPy8PyiDwij8qj8pg8Ls/K7+VJ+YM8JU/L0/KsPCfPyfOXfgagUAkllVKBilHZVKzKruLUVSqHulrlVNeoiLpWxavrVC51vcqt8qi8Kp9KUPlVAaWVUVaRClVBVUhF1Q146RdGFVPFlVMlVEl10z+TrwqrG1URVfQX+Zn1Jf5Ofc1Vc9VCtVAtVUvVWrVWbVQb1Va1Ve1UO9VetVcdVAfVUXVUnVQn1Vl1Vl1UF9VNdVPdVXfVQ/VQiSpR9VYvqT6qr+qn+qsB6mWRsYZBapBKUklqiBqihqqhapgapoar4WqkGqlGqVFqtBqtxqqxarwaryaqiWqSmqQmq8lqqpqqpqvpKlklq5lqppqtZqs5ao6aq+aq+Wq+SlEpaqFaqFJVqlqsFqs0tUQtUcvUMrVCrVCr1Cq1Rq1R69Q6tUFtUGlqs9qstqqtarvarnaqnWqX2qV2q91qr9qr9ql9ar/arw6oA+qgOqjSVbo6pA6pw+qwOqKOqKPqqDqmjqkT6oQ6qU6qU+qUOqPOqHPqnDqvzqsL6kLGaV8gAhGoQAUxQUwQG8QGcUFckCPIEeQMcgaRIBLEB/FBruD6IHeQJ8gb5AsSgvxBgUAHJrCBuNT0aHBDUDi4MSgSFA2KBcUDF5QISgY3BaWCm4PSwS1BmeDWoGxwW1AuKB9UCCoGtweVgjuCysGdQZXgrqBqUC2oHtQI7g5qBvcEtYJ7g9rBfUGd4P6gbvBAUC94MKgfPBQ0CB4OGgaPBI2CR4PGQZOgadAsaP6Hbt/7U3kedz10T52oe+ne+iXdR/fV/XR/PUC/rAfqV/Qg/apO0oP1EP2aHqpf18P0G3q4HqFH6jf1KP2WHq3H6LF6nB6vJ+iJ+m09Sb+jJ+speqqepqfrGTpZv6tn6ll6tn5Pz9Hv67l6np6vF+gU/YFeqBfpVP2hXqw/0ml6iV6ql+nleoVeqVfp1XqNXqvX6fV6g96oN+nNeoveqrfp7XqH3qk/1rv0J3q33qP36k/1Pv2Z3q8/1wf0F/qg/lKn66/0If21Pqy/0Uf0t/qo/k4f08d1af29Pql/0Kf0aX1Gn9Xn9I/6vP5JX9A+4+Q+4+3dKKNMjIkxsSbWxJk4k8PkMDlNThMxERNv4k0uk8vkNrlNXpPXJJgEU8AUMBnIkCloCpqoiZrCprApYoqYYqaYccaZkqakKWVKmdKmtCljypiypqwpZ8qZCqaCud3cbu4wd5g7zZ3mLnOXqWaqmRqmhqlpappappapbWqbOqaOqWvqmnqmnqlv6psGpoFpaBqaRqaRaWwam6amqWlumpsWpoVpaVqa1qa1aWPamLamrWln2pn2pr3pYDqYjqaj6WQ6mc6ms+liuphuppvpbrqbHqaHSTSJprfpbfqYPqaf6WcGmAFmoBloBplBJskkmSFmiBlqhpphZpgZbkaYkRknquYtM9qMMWPNODPejDcTzUQzyUwyk81kM9VMNdPNdJNsks1MM9PMNrPNHDPHzDVzzXwz36SYFLPQLDSpJtUsNotNmkkzS81Ss9wsNyvNSrParDZrzVqzHtabjWaj2Ww2m61mq9lutpudZqfZZXaZ3Wa32Wv2mn1mn9lv9psD5oA5aA6adJNuDplD5rA5bI6YI+aoOWqOmWPmhDlhTpqT5pQ5Zc6YM+acyXPp/dKbWJvdxtmrbA57tc1pr7F/G+e1+WyCzW8LWG1z2zwZx/7/iY21togtaovZ4tbZErakvelXcTlb3lawFe3ttpK9w1b+VVzT3mNr2XttbXufrWHv/kVcx95v69pHbD1EANvENrDNbEP7iG1kH7WNbRPb1DazbeyTtq19yrazT9v29plfxQvtIrvarrFr7Tq72+6xZ+xZe9h+Y8/ZH20P29MOsC/bgfYVO8i+apPs4F/FI+2bdpR9y462Y+xYO+5X8VQ7zU63M2yyfdfOtLN+FafYD+wcm2rn2nl2vl3wc5xRU6r90C62H9k0G8BSu8wutyvsSrvqf2pdZjfYjXaT3WU/sVvtNrvd7rA7M0+E7R67135q99nP7CH7tT1gv7AH7RGbbr/6Oc5Y3xH7rT1qv7PH7HF7wn5vT9ofVGZ2xtq/tz/ZC9ZbICQgSYoCiqFsFEvZKY6uohx0NeWkayhC11I8XUe56HrKTXkoL+WjBMpPBUiTIUtEIRWkQhSlGyizvGJUnByVoJJ0E5Wim6k03UJl6FYqS7dROSpPFagi3U6V6A6qTHdSFbqLqlI1qk416G6qSfdQLbqXatN9VIfup7r0ANWjB6k+PUQN6GFqSI9QI3qUGlMTakrNqDk9Ri3ocWpJrag1PUFt6ElqS09RO3qa2tMz1IH+Qh3pWepEz1Fnep66UFfqRi9Qd3qRelBPSqRe1Jteoj7Ul/pRfxpAL9NAeoUG0auURINpCL1GQ+l1GkZv0HAaQSPpTRpFb9FoGkNjaRyNpwk0kd6mSfQOTaYpNJWm0XSaQcn0Ls2kWTSb3qM59D7NpXk0nxZQCn1AC2kRpdKHtJg+ojRaQktpGS2nFbSSVtFqWkNraR2tpw20kTbRZtpCW2kbbacdtJM+pl30Ce2mPbSXPqV99Bntp8/pAH1BB+lLSqev6BB9TYfpGzpC3/qe9B0do+N0gr6nk/QDnaLTdIbO0jn6kc7TT3SBPEGIoQhlqMIgjAmzhbFh9jAuvCrMEV4d5gyvCSPhtWF8eF2YK7w+zB3mCfOG+cKEMH9YINShCW1IYRgWDAuF0fCGsHB4Y1gkLBoWC4uHLiwRlgxvCkuFN4elw1vCMuGtYdnwtrBcWD585L6K4e1hpfCOsHJ4Z1glvCusGlYLq4c1wrvDmuE9Ya3w3rB2eF9YOrw/rBs+ENYLHwzrhw+FDcKHw4bhI2Gj8NGwcdgkbBo2C5uHj4UtwsfDlmGrsHV4VdgmfDJsGz4VtgufDtuHz/w8f/+izPknfjWfGPYKe4cvhS+F3t8r50cXRFOiH0QXRhdFU6MfRhdHP4qmRZdEl0aXRZdHV0RXRldFV0fXRNdG10XXRzdEN0Y37U/2NbKBQyecdMoFLsZlc7Euu4tzV7kc7mqX013jIu5aF++uc7nc9S63y+PyunwuweV3BZx2xllHLnQFXSEXdTe4wu5GV8QVdcVccedcCVfSNXPNXXPXwj3uWrpWrrV7wj3hnnRPuqfcU+5p19494zq4v7iO7lnXyT3nnnPPuy6uq+vmXnDd3YScF1+Tia636+36uD6un+vnBrgBbqAb6Aa5QS7JJbkhbogb6oa6YW6YG+6Gu5FupBvlRrnRbrQb68a68W68m+gmuklukpvsJrupbqqb7qa7ZJfsZrqZrtKsi3uZ6+a6+W6+S3EpbqHLOGdMdYvdYpfm0txSt9Qtd8vdSrfSrXar3Vq31q13691Gt9FtdpvdVrfVbXfb3U630+1yu9xuf83Fjbp9br/b7w64A+6g+9Klu6/cIfe1O+y+cUfct+6o+84dc8fdCfe9O+l+cKfcaXfGnXXn3I/uvPvJXXDejY9MiEyMvB2ZFHknMjkyJTI1Mi0yPTIjkhx5NzIzMisyO/JeZE7k/cjcyLzI/MiCSErkg8jCyKJIauTDyOLIR5G0yJLI0siyyPLIioj3+beGvqAv5KP+Bl/Y3+iL+KK+mC/unS/hS/qbfKmLdad5f6sv62/z5Xx5X8E/6hv7Jr6pb+ab+8d8C/+4b+lb+db+Cd/GP+nb+qd8O/+0b++f8R38X3xH/6zv5J/znf3zvovv6rv5F3x3/6Lv4Xv6RN/L9/Yv+T6+r+/n+/sB/mU/0L/iB/lXfZIf7If41/xQ/7of5t/ww/0IPzLmTT8q8xIZxvnxfoKf6N/2k/w7frKf4qf6aX66n+GT/bt+pp/lZ/v3/Bz/vp/r5/n5foFP8R/4hX6RT/Uf+sX+I5/ml2TeNPYr/Sq/2q/xa/06v95v8Bv9Jr/Zb/Fb/Ta/3e/wO/3Hfpf/xO/2e/xe/6nf5z/z+/3n/oD/wh/0X/p0/5U/5L/2h/03/oj/1h/13/lj/rg/4b/3J/0P/pQ/7c/4s/6c/9Gf9z/5C/xv1hhjjDHG/iETLg/FL2cu3s7v9Rs54q+e3BsArt6WL/1vM9fnvjjuKxJiM74+3bPzQ5mPqlUTExMvPTdNQlBoHkDmX4Iy/PzRg0vxEmgNT0I7aAWlfrP+vqLrOfo724/eChD3VzkZBWXGl7f/OQAm/mq9fcVjT4xcWDY8E///2f48gCKFLudkh8vxEmj98/2VVlD6d+rP0+Lv1J/9i/EALf8qJwdcji/XXxIeh2eg3S+e+Qt3/t4EY4wxxhhjjLH/fn1FhY6Z15+Zn/j8revzBHU5Jxtcjv/e9TljjDHGGGOMMcauvGe7dnvqsXbtWnX85weV/1dZ//CgEfy7tsyD3xx4D5D5HQUA/+IGATIG8s9cxZY/ZV9Jl146fzu1/KwP4D+jlX/E4AofmBhjjDHGGGN/uMsn/b/8vrpSBTHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY1nQn/HfiV3pNTLGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGNX2v8LAAD//4WF+0I=") (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001840), 0x88ce359bdb08143e, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000001880)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) (async) ioctl$TCFLSH(r1, 0x800455ca, 0x1) (async) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000001bc0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000001c00)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x4c00, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f00000022c0)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x81600, 0x0, 0x0, @by_dev={r3}, [@snapshot={0x0, 0x10, 0x0, 0x60, 'snapshot-merge\x00', {@ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, 'P', 0x20, '7'}}]}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000007180)={'syzkaller0\x00', 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f00000019c0)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000001a00)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001a40)='./file0\x00', 0x0) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000001ec0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(0x0, r4, 0x0) (async) r5 = open$dir(&(0x7f0000002040)='.\x00', 0x0, 0x0) renameat2(r5, &(0x7f0000002080)='./file0\x00', r5, &(0x7f00000020c0)='./file1\x00', 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000018c0)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000001940)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r7 = syz_open_dev$vim2m(&(0x7f0000001f40), 0x100000001, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f0000001f80)={0x30, 0x1, 0x0, "a6892d080000003a6a7cfb56ff2e7f37c17a5ac1f393f65946a68dd1f8822c88", 0x30314742}) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001980)=[{0x0, 0x0, &(0x7f00000019c0), 0x0, 0x0, 0x0, 0x8011}], 0x1, 0x4040801) recvmsg(0xffffffffffffffff, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000001b00)=""/81, 0x51}], 0x1}, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) (async) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000001b80)=ANY=[@ANYBLOB="00000300aaaaaaaaaa42aaaaaaaaaabbaa8baaaaaabb"]) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) vmsplice(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f00000000c0)="f7", 0x7ffff000}], 0x1, 0x0) [ 74.768913][ T5335] loop0: detected capacity change from 0 to 256 [ 74.840388][ T5336] ================================================================== [ 74.840462][ T5336] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 74.840636][ T5336] Read of size 8 at addr ffff888037ad6318 by task syz.0.0/5336 [ 74.840646][ T5336] [ 74.840653][ T5336] CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 74.840665][ T5336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.840680][ T5336] Call Trace: [ 74.840685][ T5336] [ 74.840691][ T5336] dump_stack_lvl+0xe8/0x150 [ 74.840751][ T5336] print_address_description+0x55/0x1e0 [ 74.840768][ T5336] ? snapshot_ctr+0x5cb/0x1340 [ 74.840780][ T5336] print_report+0x58/0x70 [ 74.840794][ T5336] kasan_report+0x117/0x150 [ 74.840830][ T5336] ? snapshot_ctr+0x5cb/0x1340 [ 74.840846][ T5336] snapshot_ctr+0x5cb/0x1340 [ 74.840861][ T5336] ? __pfx_snapshot_ctr+0x10/0x10 [ 74.840874][ T5336] ? skip_spaces+0x8a/0xa0 [ 74.840953][ T5336] ? dm_split_args+0x50b/0x5d0 [ 74.840966][ T5336] dm_table_add_target+0x58d/0xc70 [ 74.840980][ T5336] table_load+0x325/0x8a0 [ 74.840998][ T5336] ? __pfx_table_load+0x10/0x10 [ 74.841044][ T5336] dm_ctl_ioctl+0x9ec/0xe10 [ 74.841064][ T5336] ? __pfx_table_load+0x10/0x10 [ 74.841080][ T5336] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 74.841101][ T5336] ? __fget_files+0x2a/0x420 [ 74.841119][ T5336] ? bpf_lsm_file_ioctl+0x9/0x20 [ 74.841154][ T5336] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 74.841169][ T5336] __se_sys_ioctl+0xfc/0x170 [ 74.841182][ T5336] do_syscall_64+0x166/0x520 [ 74.841219][ T5336] ? trace_irq_disable+0x3b/0x140 [ 74.841234][ T5336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.841246][ T5336] ? clear_bhb_loop+0x70/0xc0 [ 74.841259][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.841270][ T5336] RIP: 0033:0x7ff68b59f559 [ 74.841281][ T5336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.841291][ T5336] RSP: 002b:00007ff68c3d9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 74.841305][ T5336] RAX: ffffffffffffffda RBX: 00007ff68b826180 RCX: 00007ff68b59f559 [ 74.841314][ T5336] RDX: 00002000000022c0 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 74.841322][ T5336] RBP: 00007ff68b636b20 R08: 0000000000000000 R09: 0000000000000000 [ 74.841329][ T5336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.841336][ T5336] R13: 00007ff68b826218 R14: 00007ff68b826180 R15: 00007ffc910d8cf8 [ 74.841348][ T5336] [ 74.841353][ T5336] [ 74.841355][ T5336] Allocated by task 5336: [ 74.841361][ T5336] kasan_save_track+0x3e/0x80 [ 74.841372][ T5336] __kasan_kmalloc+0x93/0xb0 [ 74.841382][ T5336] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 74.841392][ T5336] dm_get_table_device+0x23e/0x730 [ 74.841403][ T5336] dm_get_device+0x327/0x760 [ 74.841412][ T5336] snapshot_ctr+0x2b2/0x1340 [ 74.841424][ T5336] dm_table_add_target+0x58d/0xc70 [ 74.841434][ T5336] table_load+0x325/0x8a0 [ 74.841448][ T5336] dm_ctl_ioctl+0x9ec/0xe10 [ 74.841461][ T5336] __se_sys_ioctl+0xfc/0x170 [ 74.841471][ T5336] do_syscall_64+0x166/0x520 [ 74.841479][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.841489][ T5336] [ 74.841491][ T5336] Freed by task 5336: [ 74.841496][ T5336] kasan_save_track+0x3e/0x80 [ 74.841505][ T5336] kasan_save_free_info+0x40/0x50 [ 74.841518][ T5336] __kasan_slab_free+0x5c/0x80 [ 74.841528][ T5336] kfree+0x1c5/0x650 [ 74.841541][ T5336] dm_put_table_device+0x255/0x2a0 [ 74.841552][ T5336] dm_get_device+0x56f/0x760 [ 74.841560][ T5336] snapshot_ctr+0x471/0x1340 [ 74.841572][ T5336] dm_table_add_target+0x58d/0xc70 [ 74.841580][ T5336] table_load+0x325/0x8a0 [ 74.841594][ T5336] dm_ctl_ioctl+0x9ec/0xe10 [ 74.841608][ T5336] __se_sys_ioctl+0xfc/0x170 [ 74.841618][ T5336] do_syscall_64+0x166/0x520 [ 74.841626][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.841642][ T5336] [ 74.841644][ T5336] The buggy address belongs to the object at ffff888037ad6300 [ 74.841644][ T5336] which belongs to the cache kmalloc-96 of size 96 [ 74.841654][ T5336] The buggy address is located 24 bytes inside of [ 74.841654][ T5336] freed 96-byte region [ffff888037ad6300, ffff888037ad6360) [ 74.841665][ T5336] [ 74.841668][ T5336] The buggy address belongs to the physical page: [ 74.841674][ T5336] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37ad6 [ 74.841684][ T5336] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 74.841693][ T5336] page_type: f5(slab) [ 74.841703][ T5336] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 74.841713][ T5336] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 74.841718][ T5336] page dumped because: kasan: bad access detected [ 74.841724][ T5336] page_owner tracks the page as allocated [ 74.841728][ T5336] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 186, tgid 186 (kworker/u4:6), ts 20459121151 [ 74.841745][ T5336] post_alloc_hook+0x1f9/0x250 [ 74.841760][ T5336] get_page_from_freelist+0x220f/0x2280 [ 74.841770][ T5336] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 74.841780][ T5336] allocate_slab+0x7d/0x5e0 [ 74.841792][ T5336] refill_objects+0x2d5/0x350 [ 74.841804][ T5336] __pcs_replace_empty_main+0x2c8/0x6c0 [ 74.841815][ T5336] __kmalloc_noprof+0x476/0x710 [ 74.841830][ T5336] security_task_alloc+0x4d/0x330 [ 74.841844][ T5336] copy_process+0x1c75/0x44b0 [ 74.841858][ T5336] kernel_clone+0x2d7/0x940 [ 74.841871][ T5336] user_mode_thread+0x115/0x180 [ 74.841884][ T5336] call_usermodehelper_exec_work+0x5c/0x230 [ 74.841897][ T5336] process_scheduled_works+0xc3d/0x1630 [ 74.841911][ T5336] worker_thread+0xa47/0xfb0 [ 74.841925][ T5336] kthread+0x38b/0x480 [ 74.841935][ T5336] ret_from_fork+0x514/0xb70 [ 74.841946][ T5336] page last free pid 186 tgid 186 ts 20459000701 stack trace: [ 74.841963][ T5336] __free_frozen_pages+0xc97/0xd90 [ 74.841977][ T5336] __kasan_populate_vmalloc+0x12d/0x1c0 [ 74.841993][ T5336] alloc_vmap_area+0xd10/0x1410 [ 74.842005][ T5336] __get_vm_area_node+0x200/0x2f0 [ 74.842018][ T5336] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 74.842033][ T5336] __vmalloc_node_noprof+0xc2/0x100 [ 74.842046][ T5336] dup_task_struct+0x2c6/0xa00 [ 74.842059][ T5336] copy_process+0x7ea/0x44b0 [ 74.842070][ T5336] kernel_clone+0x2d7/0x940 [ 74.842083][ T5336] user_mode_thread+0x115/0x180 [ 74.842097][ T5336] call_usermodehelper_exec_work+0x5c/0x230 [ 74.842109][ T5336] process_scheduled_works+0xc3d/0x1630 [ 74.842122][ T5336] worker_thread+0xa47/0xfb0 [ 74.842135][ T5336] kthread+0x38b/0x480 [ 74.842145][ T5336] ret_from_fork+0x514/0xb70 [ 74.842154][ T5336] ret_from_fork_asm+0x1a/0x30 [ 74.842164][ T5336] [ 74.842167][ T5336] Memory state around the buggy address: [ 74.842173][ T5336] ffff888037ad6200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 74.842180][ T5336] ffff888037ad6280: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 74.842187][ T5336] >ffff888037ad6300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 74.842192][ T5336] ^ [ 74.842197][ T5336] ffff888037ad6380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 74.842204][ T5336] ffff888037ad6400: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 74.842209][ T5336] ================================================================== [ 75.228604][ T5336] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 75.231902][ T5336] CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 75.235917][ T5336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.240439][ T5336] Call Trace: [ 75.241910][ T5336] [ 75.243257][ T5336] vpanic+0x56d/0xa60 [ 75.245042][ T5336] ? __pfx_vpanic+0x10/0x10 [ 75.247020][ T5336] panic+0xc5/0xd0 [ 75.248700][ T5336] ? __pfx_panic+0x10/0x10 [ 75.250613][ T5336] ? preempt_schedule_thunk+0x16/0x40 [ 75.252768][ T5336] ? snapshot_ctr+0x5cb/0x1340 [ 75.254802][ T5336] ? preempt_schedule_thunk+0x16/0x40 [ 75.257200][ T5336] ? snapshot_ctr+0x5cb/0x1340 [ 75.259283][ T5336] check_panic_on_warn+0x89/0xb0 [ 75.261271][ T5336] ? snapshot_ctr+0x5cb/0x1340 [ 75.263137][ T5336] end_report+0x73/0x170 [ 75.264810][ T5336] ? snapshot_ctr+0x5cb/0x1340 [ 75.266615][ T5336] kasan_report+0x128/0x150 [ 75.268482][ T5336] ? snapshot_ctr+0x5cb/0x1340 [ 75.270554][ T5336] snapshot_ctr+0x5cb/0x1340 [ 75.272637][ T5336] ? __pfx_snapshot_ctr+0x10/0x10 [ 75.274793][ T5336] ? skip_spaces+0x8a/0xa0 [ 75.276689][ T5336] ? dm_split_args+0x50b/0x5d0 [ 75.278763][ T5336] dm_table_add_target+0x58d/0xc70 [ 75.281042][ T5336] table_load+0x325/0x8a0 [ 75.282899][ T5336] ? __pfx_table_load+0x10/0x10 [ 75.284904][ T5336] dm_ctl_ioctl+0x9ec/0xe10 [ 75.286905][ T5336] ? __pfx_table_load+0x10/0x10 [ 75.289083][ T5336] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 75.291332][ T5336] ? __fget_files+0x2a/0x420 [ 75.293445][ T5336] ? bpf_lsm_file_ioctl+0x9/0x20 [ 75.295607][ T5336] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 75.297948][ T5336] __se_sys_ioctl+0xfc/0x170 [ 75.299985][ T5336] do_syscall_64+0x166/0x520 [ 75.302078][ T5336] ? trace_irq_disable+0x3b/0x140 [ 75.304347][ T5336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.307122][ T5336] ? clear_bhb_loop+0x70/0xc0 [ 75.309275][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.311916][ T5336] RIP: 0033:0x7ff68b59f559 [ 75.313886][ T5336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.322034][ T5336] RSP: 002b:00007ff68c3d9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 75.325330][ T5336] RAX: ffffffffffffffda RBX: 00007ff68b826180 RCX: 00007ff68b59f559 [ 75.328676][ T5336] RDX: 00002000000022c0 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 75.331957][ T5336] RBP: 00007ff68b636b20 R08: 0000000000000000 R09: 0000000000000000 [ 75.335317][ T5336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.338656][ T5336] R13: 00007ff68b826218 R14: 00007ff68b826180 R15: 00007ffc910d8cf8 [ 75.342111][ T5336] [ 75.343941][ T5336] Kernel Offset: disabled [ 75.345872][ T5336] Rebooting in 86400 seconds..