program: r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00'}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000000)={r2, 0x5, 0x30, 0x3, 0x4}, &(0x7f0000000040)=0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000005, 0x6031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4006, &(0x7f0000000000)=0x8, 0x5, 0x3) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000180)={{{@in=@initdev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f0000000280)=0xe8) quotactl$Q_QUOTAON(0xffffffff80000200, &(0x7f0000000140)=@loop={'/dev/loop', 0x0}, r3, &(0x7f00000002c0)='./file0\x00') mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000004640), 0x202) syz_emit_vhci(&(0x7f0000009b40)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_ecred_conn_req={{0x17, 0x0, 0x8}, {0xfff7, 0x1, 0x80, 0x5}}}}, 0x15) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) r5 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100004898b610c2154500201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r5) r6 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$printer(r6, &(0x7f0000001100)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) iopl(0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) write$char_usb(r7, &(0x7f00000007c0)="0bcde56ca9a62cbf", 0x8) syz_usb_disconnect(r6) write(r4, &(0x7f0000000100)='+p', 0x2) syz_mount_image$ext4(&(0x7f0000000440)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f00000000c0)={[{@inode_readahead_blks}, {@noinit_itable}, {@mblk_io_submit}, {@minixdf}, {@jqfmt_vfsv0}, {@usrjquota, 0x2e}], [], 0x2e}, 0x84, 0x460, &(0x7f0000000dc0)="$eJzs3UtvG0UcAPD/rpOWvkgo5dEHECiIiEfSpAV64AAIpF6QkOBQjiFNq9K0QU2QaFXRgFA5on4C4IjEJ+AEFwScQFzhjpAq1AuFA1q09m7rPBzs2I5D/ftJ28zsjj3/2fHYszu2GkDfGsn/SSJ2RsQvETFUyy4tMFL7c+P6pem/rl+aTiLLXv8jqZb78/ql6bJo+bgdRWY0jUg/SmL/KvXOX7h4Zmp2duZ8kR9fOPvO+PyFi0+fPjt1aubUzLnJo0ePHJ547tnJZzrSzl15rPvenzuw99ibV1+dPn71re+/zOPdWRyvb0fNcNt1jsRIcU6ybPmxx9p+9s1lV106GehhILSkEhF5dw1Wx/9QVOJW5w3FKx/2NDigq7Isy7au2FspE4sZcBtLotcRAL1RftDn17/ltoHTj5679mLtAihv941iqx0ZiLQoM7js+raTRiLi+OLfn+ZbrHofAgCgs77O5z9PLZ3/DVaPpHFvXbk7i7Wh4Yi4KyJ2R8TdEbEnIu6JqJa9LyLub7H+kWX5lfOfn7atr2XNyed/zxdrW0vnf+XsL4YrRW5Xtf2DycnTszOHinMyGoNb8/zEGnV88/LPnzQ6Vj//y7e8/nIuWMTx+8CyG3Qnpham2mlzvWsfROwbWK39yc31vPzv3ojYt47nz8/Z6Se+ONDo+H+3fw0dWGfKPo94vNb/i7Gs/aVk7fXJ8TtidubQePmqWOmHH6+81qj+ttrfAXn/b6+u2a3s/8JwUr9eO996HVd+/bjhNc16X/9bkjeq6S3FvvemFhbOT0RsSRZX7p+89dgyX5bP2z96cPXxvzvin8+Kx+2PiPxF/EBEPBgRDxWxPxwRj0TEwTXa/91Lj769/vZ3V97+E6u+/zXq/9YTlTPfftWo/ub6/0g1NVrsaeb9r9kA2zl3AAAA8H+RVr8Dn6RjN9NpOjZW+w7/ntiezs7NLzx5cu7dcydq35UfjsG0vNM1VHc/dKK4N1zmJ5flD1fvG2dZlm2r5sem52a7taYONGdHg/Gf+63S6+iArmtpHS3pXhzAxvN7Tehfxj/0r2L8v9DrOICN5/Mf+tdq4/9yxI0ehAJsMJ//0L+Mf+hfxj/0L+Mf+lI7v+tfK7H7WLee+XZLVDZHGC0nIt0UYawvkW6OMIr/AmM4otnCl2OjAuv1OxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBn/BsAAP//WL7pRA==") r8 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000007c0)={"2abd6077106b96fd86906d8bb121fede5c456066e26847a25b40bd8c704e85106bcdf531e5018f43b10beaad8a21ec23660e873e612914fb754c676e5e86bdeedc709d2739a0e431d79d1154e604a55b25a644a1dd7348b412e6625603ba840558105a3c264cdabed417943951603383e780b5ef31f85a312135e2f8f687940d7b4722013696d1d3f880aaf926f6f5d3f1ba83366fae08c96f83fd698fcfde9b3c065e5ee54287f3ac1ffdcbb1c40073b712a170f63c12dd24b94dd66c571163a4cd43ea50f693d8bbd1eb610314c301e1c5efdbccf9ad9389630afac17aa72b8aaef3b6e04b39957c97085bb5069981e131cf59e88160af5b69eac5fe494fa3718187d71f3f49b70b51021afdaa326a234287362128ea7d4311600e0d361a66ef1d4cc33c6a33bb9561db9ddad201f36a75224a1154766b0d27c2ce1faa7727d8cfa6787b55f8cff99de8d8b12bcffbf2aef1a38977d0906d1347975e47847a48e81c312037007b8e8ca952256de365c46110f804fd1677307478b565b6c3f900a4d303fce9d33c6c5b9251d1a2395dc000164d6a334acdf9ca9b9ba085b59da809bb9e7462a8f3f368ec0f1f98c97e7adec5f4b2ce98f82f4f4202f0d843e3000e06337774fcb710356d6890585c948bfffbdfdfc42e043de19476d7ec0524efb0ef3d5903df078a2576760ed46d0ef664869d66e1b446b5d3b78fdf1b399c3b3454a29fa267fb0c02fd55a3c10dedb82313cec01f4379b6716871718cb5955df0c653feb0de14f0be75e379f9ad8dc3dad93125a15b853f94a15b2f23b56c5728dcd14e68beb58749be287cf8e78997b21a8f286a6a2d432a1b9c611492fab85325010e20755720da9ff9b85c25e0bfa94ffe9a68d95cbb4b1919a0aa7e4f32b992f5fa9341c7821a2102d652d92a0887e3352d11e54889d3c9f0d78f9015ce5d274fed4e65216a0a1e81a046e0da44ecab9911bd16bada56bef0c9a39d228fd41aeb418d8c6c10c4899463245b2a64b6fe382cd2a61eecf32d63f02565d7dbae003176b0972785e8daba6cccc0f7df73e65feb62cc4f8a878f0646ed70a91554c36bdfeed46166b29f6953e08ef0afdca54adfb27f8bb55ad86aacb524b2bbfc0d63c454f8ff4aa2d26c86348e965a4dcb924dac436777fab9375d2024383cb690ba7d5f37d71d48ef5761c8a5979e2781c553af18191f710fbc71cb9c590a1f8a39ce7222757e46441946947fb53c3f8a4729f99eb86980e9ac30d3c315fe0c6d8b69cd236fbd97e9f3eca19ee8c45404a44a70ff4fef45e941ad4e79b2faaf005f8b25e0dfe571ac7b1ca68b83c4bf00b0c6bedfd234b2a17cc924c029c3601ecbd01238a44783a8e45dac0962849fcd1ee95704bce0887aee4a271e5bcf37b9fa22ff0e13797f44ff06298326d7f1fb6b65c17d90f120847b40216a69"}) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYRES16=r1], 0x38}, 0x1, 0x0, 0x0, 0x14f7325d9d03b00}, 0x4000) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) [ 94.093208][ T4646] Bluetooth: hci0: command tx timeout [ 94.440051][ T11] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.590140][ T11] usb 5-1: Using ep0 maxpacket: 16 [ 94.591470][ T11] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 94.593176][ T11] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 94.593194][ T11] usb 5-1: config 0 interface 0 has no altsetting 0 [ 94.595725][ T11] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.595740][ T11] usb 5-1: Product: syz [ 94.595747][ T11] usb 5-1: Manufacturer: syz [ 94.595755][ T11] usb 5-1: SerialNumber: syz [ 94.647426][ T11] usb 5-1: config 0 descriptor?? [ 94.867937][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 94.885529][ T11] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input6 [ 94.920666][ T11] imon:send_packet: packet tx failed (-71) [ 94.940091][ T11] imon 5-1:0.0: panel buttons/knobs setup failed [ 95.020516][ T11] rc_core: IR keymap rc-imon-pad not found [ 95.020535][ T11] Registered IR keymap rc-empty [ 95.020598][ T11] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 95.020610][ T11] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 95.021642][ T11] imon:send_packet: packet tx failed (-71) [ 95.045481][ T11] imon 5-1:0.0: remote input dev register failed [ 95.045581][ T11] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 95.094396][ T11] imon 5-1:0.0: unable to initialize intf0, err 0 [ 95.094414][ T11] imon:imon_probe: failed to initialize context! [ 95.094422][ T11] imon 5-1:0.0: unable to register, err -19 [ 95.115307][ T11] usb 5-1: USB disconnect, device number 2 [ 95.451825][ T11] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 95.600761][ T11] usb 5-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 95.601969][ T11] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 95.602405][ T11] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 95.602423][ T11] usb 5-1: config 0 interface 0 has no altsetting 0 [ 95.604691][ T11] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.604734][ T11] usb 5-1: Product: syz [ 95.604742][ T11] usb 5-1: Manufacturer: syz [ 95.604750][ T11] usb 5-1: SerialNumber: syz [ 95.607403][ T11] usb 5-1: config 0 descriptor?? [ 95.641050][ T5319] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 95.847428][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 95.856447][ T11] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input8 [ 96.110212][ T11] rc_core: IR keymap rc-imon-pad not found [ 96.110228][ T11] Registered IR keymap rc-empty [ 96.112036][ T11] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 96.112049][ T11] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 96.170145][ T4646] Bluetooth: hci0: command tx timeout [ 96.262247][ T11] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0 [ 96.265184][ T11] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input9 [ 96.284677][ T11] imon 5-1:0.0: iMON device (15c2:0045, intf0) on usb<5:3> initialized [ 96.512370][ T11] usb 5-1: USB disconnect, device number 3 [ 96.515079][ T5319] imon:send_packet: packet tx failed (-71) [ 96.530620][ T5319] imon:lcd_write: send packet failed! [ 96.785229][ T5320] loop0: detected capacity change from 0 to 512 [ 96.798698][ T5320] EXT4-fs: Ignoring removed mblk_io_submit option [ 96.894663][ T5320] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -13 ** 1767 printk messages dropped ** [ 97.007799][ T5320] EXT4-fs error (device loop0): ext4_clear_blocks:876: inode #13: comm syz.0.0: attempt to clear invalid blocks 2 len 1 [ 97.007902][ T5320] loop0: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 97.010111][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 97.010130][ C0] EXT4-fs (loop0): initial error at time 1789450091: ext4_clear_blocks:876: inode 13 [ 97.010149][ C0] EXT4-fs (loop0): last error at time 1789450091: ext4_clear_blocks:876: inode 13 [ 97.041946][ T5320] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 97.046509][ T5320] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #13: comm syz.0.0: invalid indirect mapped block 1819239214 (level 0) [ 97.046536][ T5320] loop0: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 97.056059][ T5320] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #13: comm syz.0.0: invalid indirect mapped block 1819239214 (level 1) [ 97.056087][ T5320] loop0: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 97.105662][ T5320] EXT4-fs (loop0): 1 truncate cleaned up [ 97.120854][ T5320] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. ** 1903 printk messages dropped ** [ 98.146672][ T5318] ================================================================== [ 98.146685][ T5318] BUG: KASAN: slab-use-after-free in dev_driver_string+0x35/0xd0 [ 98.146803][ T5318] Read of size 8 at addr ffff888012e4a0e0 by task syz.0.0/5318 [ 98.146813][ T5318] [ 98.146830][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 98.146843][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.146851][ T5318] Call Trace: [ 98.146856][ T5318] [ 98.146862][ T5318] dump_stack_lvl+0xe8/0x150 [ 98.146879][ T5318] print_address_description+0x55/0x1e0 [ 98.146894][ T5318] ? dev_driver_string+0x35/0xd0 [ 98.146909][ T5318] print_report+0x58/0x70 [ 98.146922][ T5318] kasan_report+0x117/0x150 [ 98.146936][ T5318] ? dev_driver_string+0x35/0xd0 [ 98.146952][ T5318] dev_driver_string+0x35/0xd0 [ 98.146967][ T5318] __dynamic_dev_dbg+0x1ae/0x2e0 [ 98.146979][ T5318] ? __mutex_lock+0x30b/0x1550 [ 98.147028][ T5318] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 98.147039][ T5318] ? __pfx_ima_file_free+0x10/0x10 [ 98.147053][ T5318] ? __asan_memset+0x22/0x50 [ 98.147068][ T5318] ? __fsnotify_parent+0x267/0x620 [ 98.147083][ T5318] ? display_close+0x4b/0x240 [ 98.147101][ T5318] display_close+0x1f9/0x240 [ 98.147114][ T5318] ? __pfx_display_close+0x10/0x10 [ 98.147123][ T5318] __fput+0x418/0xa50 [ 98.147138][ T5318] task_work_run+0x1d9/0x270 [ 98.147151][ T5318] ? __pfx_task_work_run+0x10/0x10 [ 98.147165][ T5318] exit_to_user_mode_loop+0x204/0x770 [ 98.147178][ T5318] ? rcu_is_watching+0x16/0xb0 [ 98.147193][ T5318] do_syscall_64+0x328/0x520 [ 98.147204][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.147216][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 98.147229][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.147241][ T5318] RIP: 0033:0x7fd58099e159 [ 98.147252][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.147263][ T5318] RSP: 002b:00007ffd49d97828 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 98.147277][ T5318] RAX: 0000000000000000 RBX: 00007fd580c27da0 RCX: 00007fd58099e159 [ 98.147286][ T5318] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 98.147294][ T5318] RBP: 00007fd580c27da0 R08: 00007fd580c26038 R09: 0000000000000000 [ 98.147302][ T5318] R10: 0000000000dd8040 R11: 0000000000000246 R12: 000000000001868e [ 98.147310][ T5318] R13: 00007fd580c2609c R14: 0000000000017b07 R15: 00007fd580c26090 [ 98.147322][ T5318] [ 98.147327][ T5318] [ 98.147330][ T5318] Allocated by task 11: [ 98.147336][ T5318] kasan_save_track+0x3e/0x80 [ 98.147352][ T5318] __kasan_kmalloc+0x93/0xb0 [ 98.147362][ T5318] __kmalloc_cache_noprof+0x321/0x600 [ 98.147376][ T5318] usb_set_configuration+0x3cc/0x2180 [ 98.147388][ T5318] usb_generic_driver_probe+0x8d/0x150 [ 98.147398][ T5318] usb_probe_device+0x1c3/0x3b0 [ 98.147408][ T5318] really_probe+0x254/0xae0 [ 98.147419][ T5318] __driver_probe_device+0x1e8/0x360 [ 98.147434][ T5318] driver_probe_device+0x4f/0x240 [ 98.147444][ T5318] __device_attach_driver+0x270/0x410 [ 98.147454][ T5318] bus_for_each_drv+0x258/0x2f0 [ 98.147465][ T5318] __device_attach+0x2c4/0x450 [ 98.147474][ T5318] device_initial_probe+0xa1/0xd0 [ 98.147483][ T5318] bus_probe_device+0x12a/0x220 [ 98.147494][ T5318] device_add+0x7d7/0xb80 [ 98.147508][ T5318] usb_new_device+0x9aa/0x1690 [ 98.147522][ T5318] hub_event+0x28e8/0x4d30 [ 98.147531][ T5318] process_scheduled_works+0xc3d/0x1630 [ 98.147551][ T5318] worker_thread+0xa47/0xfb0 [ 98.147564][ T5318] kthread+0x38b/0x480 [ 98.147574][ T5318] ret_from_fork+0x514/0xb70 [ 98.147584][ T5318] ret_from_fork_asm+0x1a/0x30 [ 98.147599][ T5318] [ 98.147602][ T5318] Freed by task 11: [ 98.147608][ T5318] kasan_save_track+0x3e/0x80 [ 98.147622][ T5318] kasan_save_free_info+0x40/0x50 [ 98.147635][ T5318] __kasan_slab_free+0x5c/0x80 [ 98.147644][ T5318] kfree+0x1c5/0x650 [ 98.147656][ T5318] device_release+0xc4/0x1f0 [ 98.147667][ T5318] kobject_put+0x222/0x550 [ 98.147680][ T5318] usb_disable_device+0x611/0x8d0 [ 98.147690][ T5318] usb_disconnect+0x346/0x9a0 [ 98.147703][ T5318] hub_event+0x1bbb/0x4d30 [ 98.147713][ T5318] process_scheduled_works+0xc3d/0x1630 [ 98.147725][ T5318] worker_thread+0xa47/0xfb0 [ 98.147738][ T5318] kthread+0x38b/0x480 [ 98.147747][ T5318] ret_from_fork+0x514/0xb70 [ 98.147757][ T5318] ret_from_fork_asm+0x1a/0x30 [ 98.147771][ T5318] [ 98.147773][ T5318] The buggy address belongs to the object at ffff888012e4a000 [ 98.147773][ T5318] which belongs to the cache kmalloc-2k of size 2048 [ 98.147783][ T5318] The buggy address is located 224 bytes inside of [ 98.147783][ T5318] freed 2048-byte region [ffff888012e4a000, ffff888012e4a800) [ 98.147795][ T5318] [ 98.147798][ T5318] The buggy address belongs to the physical page: [ 98.147805][ T5318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e48 [ 98.147816][ T5318] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 98.147826][ T5318] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 98.147838][ T5318] page_type: f5(slab) [ 98.147848][ T5318] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 98.147858][ T5318] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 98.147869][ T5318] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 98.147878][ T5318] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 98.147887][ T5318] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 98.147897][ T5318] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 98.147904][ T5318] page dumped because: kasan: bad access detected [ 98.147910][ T5318] page_owner tracks the page as allocated [ 98.147915][ T5318] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5281, tgid 5281 (syz-executor), ts 90526443664 [ 98.147934][ T5318] post_alloc_hook+0x1f9/0x250 [ 98.147948][ T5318] get_page_from_freelist+0x2209/0x2280 [ 98.147963][ T5318] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 98.147978][ T5318] allocate_slab+0x7d/0x620 [ 98.147990][ T5318] refill_objects+0x2d5/0x350 [ 98.148001][ T5318] __pcs_replace_empty_main+0x2c8/0x6c0 [ 98.148012][ T5318] __kmalloc_cache_noprof+0x39b/0x600 [ 98.148026][ T5318] rtnl_newlink+0x143/0x1c30 [ 98.148036][ T5318] rtnetlink_rcv_msg+0x802/0xc00 [ 98.148045][ T5318] netlink_rcv_skb+0x226/0x4a0 [ 98.148059][ T5318] netlink_unicast+0x7bd/0x940 [ 98.148070][ T5318] netlink_sendmsg+0x813/0xb40 [ 98.148084][ T5318] sock_sendmsg_nosec+0x13a/0x180 [ 98.148098][ T5318] __sys_sendto+0x408/0x5a0 [ 98.148108][ T5318] __x64_sys_sendto+0xde/0x100 [ 98.148116][ T5318] do_syscall_64+0x166/0x520 [ 98.148126][ T5318] page last free pid 4696 tgid 4696 ts 33544933700 stack trace: [ 98.148134][ T5318] __free_frozen_pages+0xc93/0xd90 [ 98.148148][ T5318] __slab_free+0x274/0x2c0 [ 98.148161][ T5318] qlist_free_all+0x99/0x100 [ 98.148174][ T5318] kasan_quarantine_reduce+0x148/0x160 [ 98.148189][ T5318] __kasan_slab_alloc+0x22/0x80 [ 98.148198][ T5318] kmem_cache_alloc_node_noprof+0x354/0x610 [ 98.148212][ T5318] __alloc_skb+0x1db/0x7a0 [ 98.148222][ T5318] netlink_sendmsg+0x5d4/0xb40 [ 98.148235][ T5318] sock_sendmsg_nosec+0x13a/0x180 [ 98.148249][ T5318] ____sys_sendmsg+0x54e/0x850 [ 98.148260][ T5318] ___sys_sendmsg+0x2a5/0x360 [ 98.148271][ T5318] __x64_sys_sendmsg+0x1b1/0x290 [ 98.148283][ T5318] do_syscall_64+0x166/0x520 [ 98.148293][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.148304][ T5318] [ 98.148307][ T5318] Memory state around the buggy address: [ 98.148314][ T5318] ffff888012e49f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.148322][ T5318] ffff888012e4a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.148330][ T5318] >ffff888012e4a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.148335][ T5318] ^ [ 98.148342][ T5318] ffff888012e4a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.148350][ T5318] ffff888012e4a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.148356][ T5318] ================================================================== [ 98.153570][ T5318] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 98.518468][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 98.522815][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.527242][ T5318] Call Trace: [ 98.528774][ T5318] [ 98.530108][ T5318] vpanic+0x56d/0xa60 [ 98.532040][ T5318] ? __pfx_vpanic+0x10/0x10 [ 98.534157][ T5318] panic+0xc5/0xd0 [ 98.535924][ T5318] ? __pfx_panic+0x10/0x10 [ 98.537970][ T5318] ? preempt_schedule_thunk+0x16/0x40 [ 98.540397][ T5318] ? dev_driver_string+0x35/0xd0 [ 98.542683][ T5318] ? preempt_schedule_thunk+0x16/0x40 [ 98.545130][ T5318] ? dev_driver_string+0x35/0xd0 [ 98.547387][ T5318] check_panic_on_warn+0x89/0xb0 [ 98.549660][ T5318] ? dev_driver_string+0x35/0xd0 [ 98.551907][ T5318] end_report+0x73/0x170 [ 98.553879][ T5318] ? dev_driver_string+0x35/0xd0 [ 98.556141][ T5318] kasan_report+0x128/0x150 [ 98.558239][ T5318] ? dev_driver_string+0x35/0xd0 [ 98.560621][ T5318] dev_driver_string+0x35/0xd0 [ 98.562879][ T5318] __dynamic_dev_dbg+0x1ae/0x2e0 [ 98.564984][ T5318] ? __mutex_lock+0x30b/0x1550 [ 98.567145][ T5318] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 98.569274][ T5318] ? __pfx_ima_file_free+0x10/0x10 [ 98.571292][ T5318] ? __asan_memset+0x22/0x50 [ 98.573163][ T5318] ? __fsnotify_parent+0x267/0x620 [ 98.575401][ T5318] ? display_close+0x4b/0x240 [ 98.577311][ T5318] display_close+0x1f9/0x240 [ 98.579850][ T5318] ? __pfx_display_close+0x10/0x10 [ 98.582200][ T5318] __fput+0x418/0xa50 [ 98.583998][ T5318] task_work_run+0x1d9/0x270 [ 98.586059][ T5318] ? __pfx_task_work_run+0x10/0x10 [ 98.588284][ T5318] exit_to_user_mode_loop+0x204/0x770 [ 98.590654][ T5318] ? rcu_is_watching+0x16/0xb0 [ 98.592814][ T5318] do_syscall_64+0x328/0x520 [ 98.594802][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.597572][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 98.599496][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.601927][ T5318] RIP: 0033:0x7fd58099e159 [ 98.603517][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.611552][ T5318] RSP: 002b:00007ffd49d97828 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 98.615042][ T5318] RAX: 0000000000000000 RBX: 00007fd580c27da0 RCX: 00007fd58099e159 [ 98.618281][ T5318] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 98.621533][ T5318] RBP: 00007fd580c27da0 R08: 00007fd580c26038 R09: 0000000000000000 [ 98.624843][ T5318] R10: 0000000000dd8040 R11: 0000000000000246 R12: 000000000001868e [ 98.628219][ T5318] R13: 00007fd580c2609c R14: 0000000000017b07 R15: 00007fd580c26090 [ 98.631670][ T5318] [ 98.633777][ T5318] Kernel Offset: disabled [ 98.635676][ T5318] Rebooting in 86400 seconds..