program: socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x32, &(0x7f00000015c0)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaa8e080045000024000000020011907800000000e89c3fc2d35d2c6d7badf7a7999c73d3ac1414bb0000000700109078a209000000000000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sec/integrity/ima/ascii_runtime_measurements\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/1024, 0x400) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sec/integrity/ima/binary_runtime_measurements\x00', 0x0, 0x0) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000180)=0x8, 0x4) read(r1, &(0x7f0000000940)=""/1024, 0x400) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000d40)='./sec/ima/ascii_runtime_measurements\x00', 0x0, 0x0) read(r2, &(0x7f0000000d80)=""/1024, 0x400) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000001180)='./sec/ima/binary_runtime_measurements\x00', 0x0, 0x0) read(r3, &(0x7f00000011c0)=""/1024, 0x400) close(r3) add_key$user(&(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140), 0xc9, 0xfffffffffffffffd) r4 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x883, 0x0) ioctl$DM_DEV_CREATE(r4, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x4, &(0x7f0000000400)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffd}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x35) ioctl$DM_TABLE_LOAD(r3, 0xc138fd09, &(0x7f0000001640)={0x4, 0x0, 0x0, 0x1b0, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r5}, [@snapshot={0x0, 0x888, 0x0, 0x0, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x1}, 0x20, 'p', 0x20, '7', ' 1 discard_zeroes_cow'}}]}) [ 114.548009][ T4648] Bluetooth: hci0: command tx timeout [ 114.781551][ T5323] ================================================================== [ 114.781574][ T5323] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 114.781721][ T5323] Read of size 8 at addr ffff888034871118 by task syz.0.0/5323 [ 114.781730][ T5323] [ 114.781738][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 114.781751][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.781768][ T5323] Call Trace: [ 114.781774][ T5323] [ 114.781779][ T5323] dump_stack_lvl+0xe8/0x150 [ 114.781842][ T5323] print_address_description+0x55/0x1e0 [ 114.781859][ T5323] ? snapshot_ctr+0x5cb/0x1340 [ 114.781870][ T5323] print_report+0x58/0x70 [ 114.781884][ T5323] kasan_report+0x117/0x150 [ 114.781919][ T5323] ? snapshot_ctr+0x5cb/0x1340 [ 114.781933][ T5323] snapshot_ctr+0x5cb/0x1340 [ 114.781948][ T5323] ? __pfx_snapshot_ctr+0x10/0x10 [ 114.781978][ T5323] ? skip_spaces+0x8a/0xa0 [ 114.782045][ T5323] ? dm_split_args+0x50b/0x5d0 [ 114.782075][ T5323] dm_table_add_target+0x58d/0xc70 [ 114.782098][ T5323] table_load+0x325/0x8a0 [ 114.782116][ T5323] ? __pfx_table_load+0x10/0x10 [ 114.782134][ T5323] dm_ctl_ioctl+0x9ec/0xe10 [ 114.782149][ T5323] ? __pfx_table_load+0x10/0x10 [ 114.782164][ T5323] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 114.782184][ T5323] ? __fget_files+0x2a/0x420 [ 114.782215][ T5323] ? bpf_lsm_file_ioctl+0x9/0x20 [ 114.782252][ T5323] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 114.782266][ T5323] __se_sys_ioctl+0xfc/0x170 [ 114.782280][ T5323] do_syscall_64+0x166/0x520 [ 114.782314][ T5323] ? trace_irq_disable+0x3b/0x140 [ 114.782343][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.782355][ T5323] ? clear_bhb_loop+0x70/0xc0 [ 114.782370][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.782381][ T5323] RIP: 0033:0x7fb1d859f559 [ 114.782392][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.782403][ T5323] RSP: 002b:00007fb1d9418fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 114.782418][ T5323] RAX: ffffffffffffffda RBX: 00007fb1d8825fa0 RCX: 00007fb1d859f559 [ 114.782427][ T5323] RDX: 0000200000001640 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 114.782434][ T5323] RBP: 00007fb1d8636b20 R08: 0000000000000000 R09: 0000000000000000 [ 114.782442][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.782449][ T5323] R13: 00007fb1d8826038 R14: 00007fb1d8825fa0 R15: 00007ffd9ad4c568 [ 114.782462][ T5323] [ 114.782465][ T5323] [ 114.782468][ T5323] Allocated by task 5323: [ 114.782474][ T5323] kasan_save_track+0x3e/0x80 [ 114.782485][ T5323] __kasan_kmalloc+0x93/0xb0 [ 114.782496][ T5323] __kmalloc_cache_node_noprof+0x3d1/0x620 [ 114.782507][ T5323] dm_get_table_device+0x23e/0x740 [ 114.782518][ T5323] dm_get_device+0x327/0x760 [ 114.782534][ T5323] snapshot_ctr+0x2b2/0x1340 [ 114.782544][ T5323] dm_table_add_target+0x58d/0xc70 [ 114.782557][ T5323] table_load+0x325/0x8a0 [ 114.782571][ T5323] dm_ctl_ioctl+0x9ec/0xe10 [ 114.782583][ T5323] __se_sys_ioctl+0xfc/0x170 [ 114.782592][ T5323] do_syscall_64+0x166/0x520 [ 114.782602][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.782612][ T5323] [ 114.782614][ T5323] Freed by task 5323: [ 114.782619][ T5323] kasan_save_track+0x3e/0x80 [ 114.782628][ T5323] kasan_save_free_info+0x40/0x50 [ 114.782651][ T5323] __kasan_slab_free+0x5c/0x80 [ 114.782662][ T5323] kfree+0x1c5/0x650 [ 114.782675][ T5323] dm_put_table_device+0x255/0x2a0 [ 114.782685][ T5323] dm_get_device+0x56f/0x760 [ 114.782698][ T5323] snapshot_ctr+0x471/0x1340 [ 114.782707][ T5323] dm_table_add_target+0x58d/0xc70 [ 114.782720][ T5323] table_load+0x325/0x8a0 [ 114.782732][ T5323] dm_ctl_ioctl+0x9ec/0xe10 [ 114.782744][ T5323] __se_sys_ioctl+0xfc/0x170 [ 114.782753][ T5323] do_syscall_64+0x166/0x520 [ 114.782763][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.782772][ T5323] [ 114.782775][ T5323] The buggy address belongs to the object at ffff888034871100 [ 114.782775][ T5323] which belongs to the cache kmalloc-96 of size 96 [ 114.782784][ T5323] The buggy address is located 24 bytes inside of [ 114.782784][ T5323] freed 96-byte region [ffff888034871100, ffff888034871160) [ 114.782804][ T5323] [ 114.782808][ T5323] The buggy address belongs to the physical page: [ 114.782814][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034871800 pfn:0x34871 [ 114.782827][ T5323] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 114.782838][ T5323] page_type: f5(slab) [ 114.782850][ T5323] raw: 04fff00000000200 ffff88801c041280 ffff8880304001c8 ffffea0000ff9190 [ 114.782860][ T5323] raw: ffff888034871800 000000000020001f 00000000f5000000 0000000000000000 [ 114.782865][ T5323] page dumped because: kasan: bad access detected [ 114.782872][ T5323] page_owner tracks the page as allocated [ 114.782876][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 182, tgid 182 (kworker/u4:6), ts 12092067915 [ 114.782895][ T5323] post_alloc_hook+0x1f9/0x250 [ 114.782922][ T5323] get_page_from_freelist+0x2209/0x2280 [ 114.782935][ T5323] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 114.782945][ T5323] allocate_slab+0x7d/0x620 [ 114.782958][ T5323] refill_objects+0x2d5/0x350 [ 114.782970][ T5323] __pcs_replace_empty_main+0x2c8/0x6c0 [ 114.782982][ T5323] __kmalloc_noprof+0x47b/0x720 [ 114.782990][ T5323] security_task_alloc+0x4d/0x330 [ 114.783013][ T5323] copy_process+0x1c7a/0x44b0 [ 114.783035][ T5323] kernel_clone+0x2d7/0x940 [ 114.783048][ T5323] user_mode_thread+0x115/0x180 [ 114.783064][ T5323] call_usermodehelper_exec_work+0x5c/0x230 [ 114.783084][ T5323] process_scheduled_works+0xc3d/0x1630 [ 114.783096][ T5323] worker_thread+0xa47/0xfb0 [ 114.783110][ T5323] kthread+0x38b/0x480 [ 114.783119][ T5323] ret_from_fork+0x514/0xb70 [ 114.783137][ T5323] page_owner free stack trace missing [ 114.783140][ T5323] [ 114.783143][ T5323] Memory state around the buggy address: [ 114.783149][ T5323] ffff888034871000: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 114.783157][ T5323] ffff888034871080: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 114.783164][ T5323] >ffff888034871100: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 114.783170][ T5323] ^ [ 114.783176][ T5323] ffff888034871180: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 114.783184][ T5323] ffff888034871200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 114.783190][ T5323] ================================================================== [ 114.783250][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 115.063105][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 115.066632][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 115.070649][ T5323] Call Trace: [ 115.072159][ T5323] [ 115.073510][ T5323] vpanic+0x56d/0xa60 [ 115.075255][ T5323] ? __pfx_vpanic+0x10/0x10 [ 115.077272][ T5323] panic+0xc5/0xd0 [ 115.078942][ T5323] ? __pfx_panic+0x10/0x10 [ 115.080972][ T5323] ? preempt_schedule_thunk+0x16/0x40 [ 115.083410][ T5323] ? snapshot_ctr+0x5cb/0x1340 [ 115.085552][ T5323] ? preempt_schedule_thunk+0x16/0x40 [ 115.087883][ T5323] ? snapshot_ctr+0x5cb/0x1340 [ 115.090047][ T5323] check_panic_on_warn+0x89/0xb0 [ 115.092229][ T5323] ? snapshot_ctr+0x5cb/0x1340 [ 115.094322][ T5323] end_report+0x73/0x170 [ 115.096100][ T5323] ? snapshot_ctr+0x5cb/0x1340 [ 115.098176][ T5323] kasan_report+0x128/0x150 [ 115.100148][ T5323] ? snapshot_ctr+0x5cb/0x1340 [ 115.102301][ T5323] snapshot_ctr+0x5cb/0x1340 [ 115.104365][ T5323] ? __pfx_snapshot_ctr+0x10/0x10 [ 115.106527][ T5323] ? skip_spaces+0x8a/0xa0 [ 115.108437][ T5323] ? dm_split_args+0x50b/0x5d0 [ 115.110556][ T5323] dm_table_add_target+0x58d/0xc70 [ 115.112932][ T5323] table_load+0x325/0x8a0 [ 115.114888][ T5323] ? __pfx_table_load+0x10/0x10 [ 115.117113][ T5323] dm_ctl_ioctl+0x9ec/0xe10 [ 115.119192][ T5323] ? __pfx_table_load+0x10/0x10 [ 115.121319][ T5323] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 115.123626][ T5323] ? __fget_files+0x2a/0x420 [ 115.125707][ T5323] ? bpf_lsm_file_ioctl+0x9/0x20 [ 115.127593][ T5323] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 115.129509][ T5323] __se_sys_ioctl+0xfc/0x170 [ 115.131301][ T5323] do_syscall_64+0x166/0x520 [ 115.133093][ T5323] ? trace_irq_disable+0x3b/0x140 [ 115.135244][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.137930][ T5323] ? clear_bhb_loop+0x70/0xc0 [ 115.139948][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.142246][ T5323] RIP: 0033:0x7fb1d859f559 [ 115.144248][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.152465][ T5323] RSP: 002b:00007fb1d9418fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 115.155924][ T5323] RAX: ffffffffffffffda RBX: 00007fb1d8825fa0 RCX: 00007fb1d859f559 [ 115.159378][ T5323] RDX: 0000200000001640 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 115.162773][ T5323] RBP: 00007fb1d8636b20 R08: 0000000000000000 R09: 0000000000000000 [ 115.166151][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.169550][ T5323] R13: 00007fb1d8826038 R14: 00007fb1d8825fa0 R15: 00007ffd9ad4c568 [ 115.173075][ T5323] [ 115.174890][ T5323] Kernel Offset: disabled [ 115.176805][ T5323] Rebooting in 86400 seconds..