program: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000040)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000980)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x8210, 0x0, 0x0, @by_dev={r1}, [@snapshot={0x0, 0x8, 0x0, 0x80, 'snapshot-merge\x00', {@ram_num={'1:', 0x1}, 0x20, @ram={'/dev/ram', 0x1}, 0x20, 'p', 0x20, '64', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) syz_mount_image$ext4(&(0x7f0000000640)='ext4\x00', &(0x7f0000000680)='./file1\x00', 0x3018000, &(0x7f00000006c0)={[{@sysvgroups}]}, 0x4, 0x521, &(0x7f0000000b40)="$eJzs3d9rZFcdAPDvvcnEZDc1UxVZC7bFVnaL7kzSWI0ibQXRp4Ja39eYTELIJBMyk7oJRVP8AwQRFfwDfBF88FGQ/gkiFPRdVBTRrT7qXrkzN5ofM8mYmexsJ58PnMw598f5nnPJ3Lk/DvcGcG09GxGvRsRERLwQEXPF9LRIcdhJ+XLvPnhzJU9JZNnrf0siKaYd1ZWXJyPiZrHadER87csR30zOxm3uH2wu1+u13aJcbW3tVJv7B3c3tpbXa+u17cXFhV9ExEtL81lhoH6WI+LlL/7ph9/76Zde/tUnv/X7e3+58+28WZ//cKfdEbEyUIAeOnWX2tviSL6Ndq8i2Ijk/SlNjLoVAAD0Iz/G/0BEfKx9/D8XE+2jOQAAAGCcZK/Mxr+SiAwAAAAYW2lEzEaSVoqxALORppVKZwzvh+JGWm80W59Ya+xtr+bzIspRStc26rX5YqxwOUpJXl4oxtgelV88VV6MiCcj4gdzM+1yZaVRXx31xQ8AAAC4Jm4+c/L8/59zaTsPAAAAjJlyzwIAAAAwLpzyAwAAwPhz/g8AAABj7SuvvZan7Og93qtv7O9tNt64u1prbla29lYqK43dncp6o7Hefmbf1kX11RuNnU/F9t79aqvWbFWb+wf3thp72617GydegQ0AAAA8Qk8+8/bvkog4/NxMO0XxHECAE/446gYAwzQx6gYAIzM56gYAI1O6cAl7CBh3yQXzzw7e6VwrjF9fTXsAAIDhu/2Rs/f/p4p5F18bAN7LjPUBgOvn5N29mZG1A3j0SpcdAXhr2C0BRuX9xWev0T49H97Rx/3/zjWGLLtUwwAAgKGZbackrRTnALORppVKxBPxMCtHKVnbqNfmi3m/nSu9Ly8vtNdMLhwzDAAAAAAAAAAAAAAAAAAAAAAAAAB0ZFkSGQAAADDWItI/J+2n+Ufcnnt+9uTVgVNv/frJ6z+6v9xq7S5ETCV/n8snTUVE68fF9BczrwQAAACA0ZrJ/3TO04vPhVE3CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBx8+6DN1eOUt8rTQwe969fiIhyt/iTMd3+nI5SRNz4RxKTx9ZLhhM+Dt+KiFvd4ifxMMuyctGKbvFnrjh+ub1pusdPI+LmEOLDdfZ2vv95tdv3L41n25/dv3+TRRpU7/1f+t/930SP/c8Tp8q9PPXOz6s9478V8dRk9/3PUfykE/9EiLzwXJ99/MbXDw66zjhWZbf4x2NVW1s71eb+wd2NreX12npte3Fx4dNLn1l6aWm+urZRrxV/u4b5/kd/+fC8/t/oEb98sv9ntv/zffU+i3+/c//BBzuFUrf4d57r/vt7q0f8tPjt+3iRz+ffPsofdvLHPf2z3zx9Xv9Xe/R/+oL+3+mr//HZF7763T90nXNmawAAj0Jz/2BzuV6v7Z6Tme5jmf8rEzFoPa8MtT2PQyYuXmb6MWnqVWSy73T+HwerZ8DVz2SyQVafjCE0Y+rM93QiLlthEnGY19XnPyQAADBm/nfQf94dJAAAAAAAAAAAAAAAAAAAAOAqXfKxZNMR0ffCp2MejqarAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADn+k8AAAD//xwK0hs=") syz_mount_image$fuse(0x0, &(0x7f0000001080)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x846048, 0x0, 0x0, 0x0, 0x0) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000700), 0x60000, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000001400)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x4002, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TARGET_MSG(r2, 0xc138fd0e, &(0x7f0000001540)={0x4, 0x0, 0x0, 0x168, 0x138, 0x0, 0x0, 0x4000, 0x0, 0x0, @by_dev={r3}, {0x0, @thin_create={'create_snap 2 ', 0x9}}}) mkdir(&(0x7f0000001180)='./bus\x00', 0x68) mount$overlay(0x0, &(0x7f00000011c0)='./file0\x00', &(0x7f0000001200), 0x8, &(0x7f0000001240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000001280)='./file0\x00') link(&(0x7f00000012c0)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000013c0)='./file2\x00') ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000440)={0x4, 0x0, 0x0, 0x188, 0x138, 0x1, 0x0, 0x80000, 0x0, 0x0, @by_dev={r1}, [@integrity={0x0, 0x2440, 0x0, 0x50, 'integrity\x00', {{@ram={'/dev/ram', 0x1}, 0x20, '8191'}, 0x20, '4', 0x20, 'I', ' 1 journal_sectors:64'}}]}) [ 86.456484][ T5300] Bluetooth: hci0: command tx timeout [ 86.610150][ T5345] ================================================================== [ 86.610197][ T5345] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 86.610298][ T5345] Read of size 8 at addr ffff888038973218 by task syz.0.0/5345 [ 86.610308][ T5345] [ 86.610326][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.610340][ T5345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.610355][ T5345] Call Trace: [ 86.610359][ T5345] [ 86.610362][ T5345] dump_stack_lvl+0xe8/0x150 [ 86.610376][ T5345] print_address_description+0x55/0x1e0 [ 86.610388][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 86.610397][ T5345] print_report+0x58/0x70 [ 86.610407][ T5345] kasan_report+0x117/0x150 [ 86.610417][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 86.610427][ T5345] snapshot_ctr+0x5cb/0x1340 [ 86.610437][ T5345] ? __pfx_snapshot_ctr+0x10/0x10 [ 86.610448][ T5345] ? skip_spaces+0x8a/0xa0 [ 86.610496][ T5345] ? dm_split_args+0x50b/0x5d0 [ 86.610511][ T5345] dm_table_add_target+0x58d/0xc70 [ 86.610528][ T5345] table_load+0x325/0x8a0 [ 86.610545][ T5345] ? __pfx_table_load+0x10/0x10 [ 86.610561][ T5345] ? __might_fault+0xaf/0x130 [ 86.610578][ T5345] dm_ctl_ioctl+0x9ec/0xe10 [ 86.610595][ T5345] ? __pfx_table_load+0x10/0x10 [ 86.610610][ T5345] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 86.610633][ T5345] ? __fget_files+0x2a/0x420 [ 86.610657][ T5345] ? bpf_lsm_file_ioctl+0x9/0x20 [ 86.610672][ T5345] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 86.610685][ T5345] __se_sys_ioctl+0xfc/0x170 [ 86.610694][ T5345] do_syscall_64+0x166/0x520 [ 86.610703][ T5345] ? trace_irq_disable+0x3b/0x140 [ 86.610713][ T5345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.610722][ T5345] ? clear_bhb_loop+0x70/0xc0 [ 86.610730][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.610738][ T5345] RIP: 0033:0x7f199139f559 [ 86.610758][ T5345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.610768][ T5345] RSP: 002b:00007f19921b1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.610784][ T5345] RAX: ffffffffffffffda RBX: 00007f1991625fa0 RCX: 00007f199139f559 [ 86.610793][ T5345] RDX: 0000200000000980 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 86.610800][ T5345] RBP: 00007f1991436b20 R08: 0000000000000000 R09: 0000000000000000 [ 86.610807][ T5345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.610815][ T5345] R13: 00007f1991626038 R14: 00007f1991625fa0 R15: 00007ffc7bd19458 [ 86.610829][ T5345] [ 86.610834][ T5345] [ 86.610837][ T5345] Allocated by task 5345: [ 86.610843][ T5345] kasan_save_track+0x3e/0x80 [ 86.610855][ T5345] __kasan_kmalloc+0x93/0xb0 [ 86.610867][ T5345] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 86.610874][ T5345] dm_get_table_device+0x23e/0x730 [ 86.610881][ T5345] dm_get_device+0x327/0x760 [ 86.610887][ T5345] snapshot_ctr+0x2b2/0x1340 [ 86.610895][ T5345] dm_table_add_target+0x58d/0xc70 [ 86.610901][ T5345] table_load+0x325/0x8a0 [ 86.610911][ T5345] dm_ctl_ioctl+0x9ec/0xe10 [ 86.610920][ T5345] __se_sys_ioctl+0xfc/0x170 [ 86.610928][ T5345] do_syscall_64+0x166/0x520 [ 86.610934][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.610941][ T5345] [ 86.610943][ T5345] Freed by task 5345: [ 86.610946][ T5345] kasan_save_track+0x3e/0x80 [ 86.610953][ T5345] kasan_save_free_info+0x40/0x50 [ 86.610966][ T5345] __kasan_slab_free+0x5c/0x80 [ 86.610975][ T5345] kfree+0x1c5/0x650 [ 86.610988][ T5345] dm_put_table_device+0x255/0x2a0 [ 86.611000][ T5345] dm_get_device+0x56f/0x760 [ 86.611009][ T5345] snapshot_ctr+0x471/0x1340 [ 86.611021][ T5345] dm_table_add_target+0x58d/0xc70 [ 86.611030][ T5345] table_load+0x325/0x8a0 [ 86.611044][ T5345] dm_ctl_ioctl+0x9ec/0xe10 [ 86.611057][ T5345] __se_sys_ioctl+0xfc/0x170 [ 86.611067][ T5345] do_syscall_64+0x166/0x520 [ 86.611076][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.611086][ T5345] [ 86.611088][ T5345] The buggy address belongs to the object at ffff888038973200 [ 86.611088][ T5345] which belongs to the cache kmalloc-96 of size 96 [ 86.611098][ T5345] The buggy address is located 24 bytes inside of [ 86.611098][ T5345] freed 96-byte region [ffff888038973200, ffff888038973260) [ 86.611109][ T5345] [ 86.611112][ T5345] The buggy address belongs to the physical page: [ 86.611120][ T5345] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38973 [ 86.611130][ T5345] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 86.611136][ T5345] page_type: f5(slab) [ 86.611143][ T5345] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 86.611152][ T5345] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 86.611156][ T5345] page dumped because: kasan: bad access detected [ 86.611160][ T5345] page_owner tracks the page as allocated [ 86.611164][ T5345] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20778325552 [ 86.611182][ T5345] post_alloc_hook+0x1f9/0x250 [ 86.611197][ T5345] get_page_from_freelist+0x220f/0x2280 [ 86.611208][ T5345] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 86.611217][ T5345] allocate_slab+0x7d/0x5e0 [ 86.611229][ T5345] refill_objects+0x2d5/0x350 [ 86.611241][ T5345] __pcs_replace_empty_main+0x2c8/0x6c0 [ 86.611278][ T5345] __kvmalloc_node_noprof+0x637/0x820 [ 86.611289][ T5345] __v4l2_subdev_state_alloc+0x18b/0x3d0 [ 86.611301][ T5345] __v4l2_subdev_init_finalize+0x228/0x310 [ 86.611310][ T5345] vimc_ent_sd_register+0x312/0x470 [ 86.611322][ T5345] vimc_sensor_add+0x427/0x4f0 [ 86.611330][ T5345] vimc_probe+0x386/0x1490 [ 86.611339][ T5345] platform_probe+0xf9/0x190 [ 86.611351][ T5345] really_probe+0x254/0xae0 [ 86.611365][ T5345] __driver_probe_device+0x1e8/0x360 [ 86.611379][ T5345] driver_probe_device+0x4f/0x240 [ 86.611393][ T5345] page last free pid 1 tgid 1 ts 20778270214 stack trace: [ 86.611401][ T5345] __free_frozen_pages+0xc97/0xd90 [ 86.611416][ T5345] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 86.611432][ T5345] alloc_vmap_area+0xd10/0x1410 [ 86.611445][ T5345] __get_vm_area_node+0x200/0x2f0 [ 86.611458][ T5345] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 86.611472][ T5345] vzalloc_noprof+0xb2/0xe0 [ 86.611485][ T5345] tpg_alloc+0x390/0x860 [ 86.611494][ T5345] vimc_sensor_add+0x3a5/0x4f0 [ 86.611506][ T5345] vimc_probe+0x386/0x1490 [ 86.611511][ T5345] platform_probe+0xf9/0x190 [ 86.611518][ T5345] really_probe+0x254/0xae0 [ 86.611528][ T5345] __driver_probe_device+0x1e8/0x360 [ 86.611539][ T5345] driver_probe_device+0x4f/0x240 [ 86.611552][ T5345] __driver_attach+0x339/0x600 [ 86.611564][ T5345] bus_for_each_dev+0x23b/0x2c0 [ 86.611578][ T5345] bus_add_driver+0x38f/0x6e0 [ 86.611587][ T5345] [ 86.611589][ T5345] Memory state around the buggy address: [ 86.611595][ T5345] ffff888038973100: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 86.611603][ T5345] ffff888038973180: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 86.611611][ T5345] >ffff888038973200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 86.611616][ T5345] ^ [ 86.611622][ T5345] ffff888038973280: 00 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc [ 86.611630][ T5345] ffff888038973300: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 86.611636][ T5345] ================================================================== [ 86.972222][ T5345] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 86.975433][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.979341][ T5345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.983633][ T5345] Call Trace: [ 86.985080][ T5345] [ 86.986326][ T5345] vpanic+0x56d/0xa60 [ 86.988027][ T5345] ? __pfx_vpanic+0x10/0x10 [ 86.989990][ T5345] panic+0xc5/0xd0 [ 86.991551][ T5345] ? __pfx_panic+0x10/0x10 [ 86.993361][ T5345] ? preempt_schedule_thunk+0x16/0x40 [ 86.995573][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 86.997601][ T5345] ? preempt_schedule_thunk+0x16/0x40 [ 86.999808][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 87.001825][ T5345] check_panic_on_warn+0x89/0xb0 [ 87.003882][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 87.005950][ T5345] end_report+0x73/0x170 [ 87.007782][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 87.009719][ T5345] kasan_report+0x128/0x150 [ 87.011699][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 87.013764][ T5345] snapshot_ctr+0x5cb/0x1340 [ 87.015620][ T5345] ? __pfx_snapshot_ctr+0x10/0x10 [ 87.017816][ T5345] ? skip_spaces+0x8a/0xa0 [ 87.019687][ T5345] ? dm_split_args+0x50b/0x5d0 [ 87.021674][ T5345] dm_table_add_target+0x58d/0xc70 [ 87.023698][ T5345] table_load+0x325/0x8a0 [ 87.025443][ T5345] ? __pfx_table_load+0x10/0x10 [ 87.027486][ T5345] ? __might_fault+0xaf/0x130 [ 87.029593][ T5345] dm_ctl_ioctl+0x9ec/0xe10 [ 87.031518][ T5345] ? __pfx_table_load+0x10/0x10 [ 87.033448][ T5345] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 87.035601][ T5345] ? __fget_files+0x2a/0x420 [ 87.037518][ T5345] ? bpf_lsm_file_ioctl+0x9/0x20 [ 87.039617][ T5345] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 87.041949][ T5345] __se_sys_ioctl+0xfc/0x170 [ 87.043904][ T5345] do_syscall_64+0x166/0x520 [ 87.045749][ T5345] ? trace_irq_disable+0x3b/0x140 [ 87.047866][ T5345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.050317][ T5345] ? clear_bhb_loop+0x70/0xc0 [ 87.052282][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.054564][ T5345] RIP: 0033:0x7f199139f559 [ 87.056216][ T5345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.064026][ T5345] RSP: 002b:00007f19921b1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 87.067553][ T5345] RAX: ffffffffffffffda RBX: 00007f1991625fa0 RCX: 00007f199139f559 [ 87.071384][ T5345] RDX: 0000200000000980 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 87.074675][ T5345] RBP: 00007f1991436b20 R08: 0000000000000000 R09: 0000000000000000 [ 87.077830][ T5345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.081146][ T5345] R13: 00007f1991626038 R14: 00007f1991625fa0 R15: 00007ffc7bd19458 [ 87.084308][ T5345] [ 87.086058][ T5345] Kernel Offset: disabled [ 87.087848][ T5345] Rebooting in 86400 seconds..