program:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0)
capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd})
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, &(0x7f0000000400)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]})
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)
[ 76.300639][ T5272] Bluetooth: hci0: command tx timeout
[ 76.331244][ T1323] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.335426][ T1323] ieee802154 phy1 wpan1: encryption failed: -22
[ 77.132103][ T5307] ==================================================================
[ 77.135431][ T5307] BUG: KASAN: use-after-free in release_card_device+0x1ab/0x1b0
[ 77.138707][ T5307] Read of size 1 at addr ffff88803f2ec909 by task syz.0.0/5307
[ 77.141887][ T5307]
[ 77.142904][ T5307] CPU: 0 UID: 0 PID: 5307 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 77.142917][ T5307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.142923][ T5307] Call Trace:
[ 77.142930][ T5307]
[ 77.142936][ T5307] dump_stack_lvl+0xe8/0x150
[ 77.142953][ T5307] print_address_description+0x55/0x1e0
[ 77.142971][ T5307] ? release_card_device+0x1ab/0x1b0
[ 77.142985][ T5307] print_report+0x58/0x70
[ 77.142998][ T5307] kasan_report+0x117/0x150
[ 77.143012][ T5307] ? release_card_device+0x1ab/0x1b0
[ 77.143027][ T5307] release_card_device+0x1ab/0x1b0
[ 77.143042][ T5307] ? __pfx_release_card_device+0x10/0x10
[ 77.143062][ T5307] device_release+0xc4/0x1f0
[ 77.143113][ T5307] kobject_put+0x222/0x550
[ 77.143130][ T5307] snd_card_file_remove+0x331/0x390
[ 77.143145][ T5307] snd_pcm_release+0x12c/0x160
[ 77.143159][ T5307] ? __pfx_snd_disconnect_release+0x10/0x10
[ 77.143172][ T5307] __fput+0x418/0xa50
[ 77.143188][ T5307] task_work_run+0x1d9/0x270
[ 77.143205][ T5307] ? __pfx_task_work_run+0x10/0x10
[ 77.143223][ T5307] exit_to_user_mode_loop+0x1fa/0x750
[ 77.143237][ T5307] ? rcu_is_watching+0x15/0xb0
[ 77.143254][ T5307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.143265][ T5307] do_syscall_64+0x353/0x580
[ 77.143279][ T5307] ? trace_irq_disable+0x3b/0x140
[ 77.143290][ T5307] ? clear_bhb_loop+0x70/0xc0
[ 77.143301][ T5307] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.143312][ T5307] RIP: 0033:0x7f560999e0d9
[ 77.143323][ T5307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 77.143334][ T5307] RSP: 002b:00007fff574a87b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 77.143347][ T5307] RAX: 0000000000000000 RBX: 00007f5609c27da0 RCX: 00007f560999e0d9
[ 77.143355][ T5307] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 77.143361][ T5307] RBP: 00007f5609c27da0 R08: 0000000000000006 R09: 0000000000000000
[ 77.143367][ T5307] R10: 00007f5609c27cb0 R11: 0000000000000246 R12: 0000000000012c80
[ 77.143376][ T5307] R13: 00007f5609c25fac R14: 0000000000012991 R15: 00007fff574a88c0
[ 77.143387][ T5307]
[ 77.143391][ T5307]
[ 77.233197][ T5307] The buggy address belongs to the physical page:
[ 77.235851][ T5307] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f2ec
[ 77.239476][ T5307] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 77.242405][ T5307] raw: 04fff00000000000 ffffea000142d108 ffffea000142d308 0000000000000000
[ 77.245867][ T5307] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 77.249300][ T5307] page dumped because: kasan: bad access detected
[ 77.251911][ T5307] page_owner tracks the page as freed
[ 77.254117][ T5307] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 20588116096, free_ts 77115519311
[ 77.261009][ T5307] post_alloc_hook+0x1f9/0x250
[ 77.262999][ T5307] get_page_from_freelist+0x21fa/0x2270
[ 77.265313][ T5307] __alloc_frozen_pages_noprof+0x18d/0x380
[ 77.267738][ T5307] alloc_pages_mpol+0x212/0x380
[ 77.269812][ T5307] ___kmalloc_large_node+0x4c/0x120
[ 77.271951][ T5307] __kmalloc_large_node_noprof+0x18/0x90
[ 77.274226][ T5307] __kmalloc_node_track_caller_noprof+0x164/0x730
[ 77.276801][ T5307] __devres_alloc_node+0x4c/0x160
[ 77.278853][ T5307] snd_devm_card_new+0x84/0x160
[ 77.280853][ T5307] loopback_probe+0x150/0x13d0
[ 77.282797][ T5307] platform_probe+0xf9/0x190
[ 77.284700][ T5307] really_probe+0x254/0xae0
[ 77.286636][ T5307] __driver_probe_device+0x1e8/0x360
[ 77.288840][ T5307] driver_probe_device+0x4f/0x240
[ 77.290958][ T5307] __device_attach_driver+0x270/0x410
[ 77.293148][ T5307] bus_for_each_drv+0x258/0x2f0
[ 77.295139][ T5307] page last free pid 5308 tgid 5307 stack trace:
[ 77.297771][ T5307] __free_frozen_pages+0xc1e/0xd10
[ 77.299942][ T5307] devres_release_all+0x1ce/0x260
[ 77.302083][ T5307] device_release_driver_internal+0x5d9/0x880
[ 77.304640][ T5307] unbind_store+0x1a1/0x1d0
[ 77.306572][ T5307] kernfs_fop_write_iter+0x3a4/0x540
[ 77.308766][ T5307] vfs_write+0x612/0xba0
[ 77.310599][ T5307] ksys_write+0x150/0x270
[ 77.312418][ T5307] do_syscall_64+0x174/0x580
[ 77.314326][ T5307] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.316753][ T5307]
[ 77.317765][ T5307] Memory state around the buggy address:
[ 77.320154][ T5307] ffff88803f2ec800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.323473][ T5307] ffff88803f2ec880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.326893][ T5307] >ffff88803f2ec900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.330258][ T5307] ^
[ 77.332059][ T5307] ffff88803f2ec980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.335256][ T5307] ffff88803f2eca00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 77.338525][ T5307] ==================================================================
[ 77.372940][ T5307] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 77.375869][ T5307] CPU: 0 UID: 0 PID: 5307 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 77.379671][ T5307] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.383997][ T5307] Call Trace:
[ 77.385456][ T5307]
[ 77.386745][ T5307] vpanic+0x56c/0xa60
[ 77.388472][ T5307] ? __pfx_vpanic+0x10/0x10
[ 77.390515][ T5307] panic+0xc5/0xd0
[ 77.392099][ T5307] ? __pfx_panic+0x10/0x10
[ 77.394036][ T5307] ? preempt_schedule_thunk+0x16/0x40
[ 77.396289][ T5307] ? release_card_device+0x1ab/0x1b0
[ 77.398501][ T5307] ? preempt_schedule_thunk+0x16/0x40
[ 77.400766][ T5307] ? release_card_device+0x1ab/0x1b0
[ 77.403031][ T5307] check_panic_on_warn+0x89/0xb0
[ 77.405089][ T5307] ? release_card_device+0x1ab/0x1b0
[ 77.407338][ T5307] end_report+0x73/0x170
[ 77.409202][ T5307] ? release_card_device+0x1ab/0x1b0
[ 77.411428][ T5307] kasan_report+0x128/0x150
[ 77.413345][ T5307] ? release_card_device+0x1ab/0x1b0
[ 77.415618][ T5307] release_card_device+0x1ab/0x1b0
[ 77.417817][ T5307] ? __pfx_release_card_device+0x10/0x10
[ 77.420167][ T5307] device_release+0xc4/0x1f0
[ 77.422127][ T5307] kobject_put+0x222/0x550
[ 77.424061][ T5307] snd_card_file_remove+0x331/0x390
[ 77.426310][ T5307] snd_pcm_release+0x12c/0x160
[ 77.428299][ T5307] ? __pfx_snd_disconnect_release+0x10/0x10
[ 77.430826][ T5307] __fput+0x418/0xa50
[ 77.432532][ T5307] task_work_run+0x1d9/0x270
[ 77.434478][ T5307] ? __pfx_task_work_run+0x10/0x10
[ 77.436622][ T5307] exit_to_user_mode_loop+0x1fa/0x750
[ 77.438966][ T5307] ? rcu_is_watching+0x15/0xb0
[ 77.440957][ T5307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.443584][ T5307] do_syscall_64+0x353/0x580
[ 77.445549][ T5307] ? trace_irq_disable+0x3b/0x140
[ 77.447571][ T5307] ? clear_bhb_loop+0x70/0xc0
[ 77.449592][ T5307] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.451997][ T5307] RIP: 0033:0x7f560999e0d9
[ 77.453896][ T5307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 77.461813][ T5307] RSP: 002b:00007fff574a87b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 77.465297][ T5307] RAX: 0000000000000000 RBX: 00007f5609c27da0 RCX: 00007f560999e0d9
[ 77.468579][ T5307] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 77.471907][ T5307] RBP: 00007f5609c27da0 R08: 0000000000000006 R09: 0000000000000000
[ 77.475174][ T5307] R10: 00007f5609c27cb0 R11: 0000000000000246 R12: 0000000000012c80
[ 77.478461][ T5307] R13: 00007f5609c25fac R14: 0000000000012991 R15: 00007fff574a88c0
[ 77.481862][ T5307]
[ 77.483566][ T5307] Kernel Offset: disabled
[ 77.485424][ T5307] Rebooting in 86400 seconds..