program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a5f74756e00000000000000000008000a00", @ANYRES32=r4, @ANYBLOB="862954250ffa"], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@ipv6_delrule={0x7c, 0x21, 0x100, 0x70bd2d, 0x25dfdbfe, {0xa, 0x0, 0x14, 0xbb, 0x40, 0x0, 0x0, 0x8, 0x10014}, [@FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x2d}}, @FIB_RULE_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x33}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e21, 0x4e22}}, @FRA_SRC={0x14, 0x2, @mcast2}]}, 0x7c}}, 0x40000) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$OCFS2_IOC_RESVSP64(r1, 0x4030582a, &(0x7f0000000340)={0x0, 0x2, 0x5, 0x5, 0x8, 0x2}) syz_kvm_setup_syzos_vm$x86(r5, &(0x7f0000c00000/0x400000)=nil) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv0\x00'}) (async) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a5f74756e00000000000000000008000a00", @ANYRES32=r4, @ANYBLOB="862954250ffa"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@ipv6_delrule={0x7c, 0x21, 0x100, 0x70bd2d, 0x25dfdbfe, {0xa, 0x0, 0x14, 0xbb, 0x40, 0x0, 0x0, 0x8, 0x10014}, [@FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x2d}}, @FIB_RULE_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x33}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @FIB_RULE_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e21, 0x4e22}}, @FRA_SRC={0x14, 0x2, @mcast2}]}, 0x7c}}, 0x40000) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) ioctl$OCFS2_IOC_RESVSP64(r1, 0x4030582a, &(0x7f0000000340)={0x0, 0x2, 0x5, 0x5, 0x8, 0x2}) (async) syz_kvm_setup_syzos_vm$x86(r5, &(0x7f0000c00000/0x400000)=nil) (async) [ 102.826054][ T5282] Bluetooth: hci0: command tx timeout [ 102.906590][ T5334] batman_adv: batadv0: Adding interface: syz_tun [ 102.906605][ T5334] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.906626][ T5334] batman_adv: batadv0: Interface activated: syz_tun [ 103.037456][ T5333] ================================================================== [ 103.037473][ T5333] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 103.037599][ T5333] Read of size 4 at addr ffff888038f0383c by task syz.0.0/5333 [ 103.037606][ T5333] [ 103.037620][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.037629][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.037640][ T5333] Call Trace: [ 103.037678][ T5333] [ 103.037683][ T5333] dump_stack_lvl+0xe8/0x150 [ 103.037701][ T5333] print_address_description+0x55/0x1e0 [ 103.037717][ T5333] ? dvb_frontend_release+0x407/0x4d0 [ 103.037733][ T5333] print_report+0x58/0x70 [ 103.037747][ T5333] kasan_report+0x117/0x150 [ 103.037761][ T5333] ? dvb_frontend_release+0x407/0x4d0 [ 103.037772][ T5333] dvb_frontend_release+0x407/0x4d0 [ 103.037783][ T5333] ? __pfx_dvb_frontend_release+0x10/0x10 [ 103.037793][ T5333] __fput+0x40d/0xa50 [ 103.037804][ T5333] task_work_run+0x1d9/0x270 [ 103.037813][ T5333] ? __pfx_task_work_run+0x10/0x10 [ 103.037823][ T5333] exit_to_user_mode_loop+0x204/0x770 [ 103.037836][ T5333] ? rcu_is_watching+0x16/0xb0 [ 103.037853][ T5333] do_syscall_64+0x328/0x520 [ 103.037866][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.037877][ T5333] ? clear_bhb_loop+0x70/0xc0 [ 103.037890][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.037927][ T5333] RIP: 0033:0x7faad5b9e559 [ 103.037949][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.037959][ T5333] RSP: 002b:00007fff660c0518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.037974][ T5333] RAX: 0000000000000000 RBX: 00007faad5e27da0 RCX: 00007faad5b9e559 [ 103.037982][ T5333] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.037988][ T5333] RBP: 00007faad5e27da0 R08: 0000000000000006 R09: 0000000000000000 [ 103.037993][ T5333] R10: 0000000000dffcc8 R11: 0000000000000246 R12: 0000000000019432 [ 103.038001][ T5333] R13: 00007faad5e2609c R14: 00007faad5e26098 R15: 00007faad5e26090 [ 103.038013][ T5333] [ 103.038017][ T5333] [ 103.038020][ T5333] Allocated by task 1: [ 103.038026][ T5333] kasan_save_track+0x3e/0x80 [ 103.038038][ T5333] __kasan_kmalloc+0x93/0xb0 [ 103.038049][ T5333] __kmalloc_cache_noprof+0x321/0x600 [ 103.038059][ T5333] dvb_register_device+0x309/0x1dd0 [ 103.038069][ T5333] dvb_register_frontend+0x603/0x900 [ 103.038081][ T5333] vidtv_bridge_probe+0x9d5/0xf60 [ 103.038090][ T5333] platform_probe+0xf9/0x190 [ 103.038133][ T5333] really_probe+0x254/0xae0 [ 103.038143][ T5333] __driver_probe_device+0x1e8/0x360 [ 103.038162][ T5333] driver_probe_device+0x4f/0x240 [ 103.038176][ T5333] __driver_attach+0x339/0x600 [ 103.038189][ T5333] bus_for_each_dev+0x23b/0x2c0 [ 103.038198][ T5333] bus_add_driver+0x345/0x670 [ 103.038208][ T5333] driver_register+0x23a/0x320 [ 103.038222][ T5333] vidtv_bridge_init+0x3d/0x60 [ 103.038281][ T5333] do_one_initcall+0x250/0x870 [ 103.038291][ T5333] do_initcall_level+0x10a/0x1a0 [ 103.038298][ T5333] do_initcalls+0x59/0xa0 [ 103.038305][ T5333] kernel_init_freeable+0x29d/0x3e0 [ 103.038314][ T5333] kernel_init+0x22/0x1d0 [ 103.038328][ T5333] ret_from_fork+0x514/0xb70 [ 103.038338][ T5333] ret_from_fork_asm+0x1a/0x30 [ 103.038347][ T5333] [ 103.038350][ T5333] Freed by task 5333: [ 103.038356][ T5333] kasan_save_track+0x3e/0x80 [ 103.038367][ T5333] kasan_save_free_info+0x40/0x50 [ 103.038381][ T5333] __kasan_slab_free+0x5c/0x80 [ 103.038392][ T5333] kfree+0x1c5/0x650 [ 103.038402][ T5333] dvb_generic_release+0x11d/0x1b0 [ 103.038413][ T5333] dvb_frontend_release+0x132/0x4d0 [ 103.038422][ T5333] __fput+0x40d/0xa50 [ 103.038431][ T5333] task_work_run+0x1d9/0x270 [ 103.038438][ T5333] exit_to_user_mode_loop+0x204/0x770 [ 103.038451][ T5333] do_syscall_64+0x328/0x520 [ 103.038458][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.038464][ T5333] [ 103.038466][ T5333] The buggy address belongs to the object at ffff888038f03800 [ 103.038466][ T5333] which belongs to the cache kmalloc-256 of size 256 [ 103.038488][ T5333] The buggy address is located 60 bytes inside of [ 103.038488][ T5333] freed 256-byte region [ffff888038f03800, ffff888038f03900) [ 103.038499][ T5333] [ 103.038501][ T5333] The buggy address belongs to the physical page: [ 103.038508][ T5333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38f03 [ 103.038519][ T5333] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 103.038530][ T5333] page_type: f5(slab) [ 103.038540][ T5333] raw: 04fff00000000000 ffff88801c041b40 dead000000000122 0000000000000000 [ 103.038550][ T5333] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 103.038555][ T5333] page dumped because: kasan: bad access detected [ 103.038561][ T5333] page_owner tracks the page as allocated [ 103.038566][ T5333] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22925942695 [ 103.038580][ T5333] post_alloc_hook+0x1f9/0x250 [ 103.038591][ T5333] get_page_from_freelist+0x2209/0x2280 [ 103.038598][ T5333] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 103.038605][ T5333] allocate_slab+0x7d/0x620 [ 103.038614][ T5333] refill_objects+0x2d5/0x350 [ 103.038622][ T5333] __pcs_replace_empty_main+0x2c8/0x6c0 [ 103.038630][ T5333] __kmalloc_cache_noprof+0x39b/0x600 [ 103.038636][ T5333] bus_add_driver+0x162/0x670 [ 103.038643][ T5333] driver_register+0x23a/0x320 [ 103.038654][ T5333] usb_register_driver+0x1e4/0x390 [ 103.038664][ T5333] pvr_init+0x4c/0xb0 [ 103.038672][ T5333] do_one_initcall+0x250/0x870 [ 103.038683][ T5333] do_initcall_level+0x10a/0x1a0 [ 103.038693][ T5333] do_initcalls+0x59/0xa0 [ 103.038702][ T5333] kernel_init_freeable+0x29d/0x3e0 [ 103.038713][ T5333] kernel_init+0x22/0x1d0 [ 103.038726][ T5333] page last free pid 937 tgid 937 ts 22167905816 stack trace: [ 103.038765][ T5333] __free_frozen_pages+0xc93/0xd90 [ 103.038775][ T5333] kasan_depopulate_vmalloc_pte+0x6d/0x90 [ 103.038782][ T5333] __apply_to_page_range+0xbd8/0x1420 [ 103.038790][ T5333] __kasan_release_vmalloc+0xa2/0xd0 [ 103.038796][ T5333] purge_vmap_node+0x220/0x960 [ 103.038803][ T5333] __purge_vmap_area_lazy+0x783/0xb40 [ 103.038809][ T5333] drain_vmap_area_work+0x27/0x40 [ 103.038815][ T5333] process_scheduled_works+0xc3d/0x1630 [ 103.038824][ T5333] worker_thread+0xa47/0xfb0 [ 103.038833][ T5333] kthread+0x38b/0x480 [ 103.038840][ T5333] ret_from_fork+0x514/0xb70 [ 103.038846][ T5333] ret_from_fork_asm+0x1a/0x30 [ 103.038856][ T5333] [ 103.038858][ T5333] Memory state around the buggy address: [ 103.038865][ T5333] ffff888038f03700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.038872][ T5333] ffff888038f03780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.038880][ T5333] >ffff888038f03800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.038885][ T5333] ^ [ 103.038891][ T5333] ffff888038f03880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.038898][ T5333] ffff888038f03900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.038903][ T5333] ================================================================== [ 103.038999][ T5333] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.339875][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.343752][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.347644][ T5333] Call Trace: [ 103.349154][ T5333] [ 103.350523][ T5333] vpanic+0x56d/0xa60 [ 103.352298][ T5333] ? rcu_is_watching+0x16/0xb0 [ 103.354420][ T5333] ? __pfx_vpanic+0x10/0x10 [ 103.356400][ T5333] ? __pfx___schedule+0x10/0x10 [ 103.358558][ T5333] panic+0xc5/0xd0 [ 103.360187][ T5333] ? __pfx_panic+0x10/0x10 [ 103.362205][ T5333] ? preempt_schedule_common+0x7f/0xd0 [ 103.364587][ T5333] ? dvb_frontend_release+0x407/0x4d0 [ 103.366768][ T5333] check_panic_on_warn+0x89/0xb0 [ 103.368951][ T5333] ? dvb_frontend_release+0x407/0x4d0 [ 103.371359][ T5333] end_report+0x73/0x170 [ 103.373606][ T5333] ? dvb_frontend_release+0x407/0x4d0 [ 103.376004][ T5333] kasan_report+0x128/0x150 [ 103.378068][ T5333] ? dvb_frontend_release+0x407/0x4d0 [ 103.380521][ T5333] dvb_frontend_release+0x407/0x4d0 [ 103.382806][ T5333] ? __pfx_dvb_frontend_release+0x10/0x10 [ 103.385658][ T5333] __fput+0x40d/0xa50 [ 103.387666][ T5333] task_work_run+0x1d9/0x270 [ 103.389857][ T5333] ? __pfx_task_work_run+0x10/0x10 [ 103.392114][ T5333] exit_to_user_mode_loop+0x204/0x770 [ 103.394499][ T5333] ? rcu_is_watching+0x16/0xb0 [ 103.396547][ T5333] do_syscall_64+0x328/0x520 [ 103.398580][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.401218][ T5333] ? clear_bhb_loop+0x70/0xc0 [ 103.403273][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.406513][ T5333] RIP: 0033:0x7faad5b9e559 [ 103.408770][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.416991][ T5333] RSP: 002b:00007fff660c0518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.420743][ T5333] RAX: 0000000000000000 RBX: 00007faad5e27da0 RCX: 00007faad5b9e559 [ 103.424167][ T5333] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.427437][ T5333] RBP: 00007faad5e27da0 R08: 0000000000000006 R09: 0000000000000000 [ 103.430963][ T5333] R10: 0000000000dffcc8 R11: 0000000000000246 R12: 0000000000019432 [ 103.434461][ T5333] R13: 00007faad5e2609c R14: 00007faad5e26098 R15: 00007faad5e26090 [ 103.437967][ T5333] [ 103.439785][ T5333] Kernel Offset: disabled [ 103.441715][ T5333] Rebooting in 86400 seconds..