program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x52203) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$BTRFS_IOC_FS_INFO(r1, 0x8400941f, &(0x7f0000000340)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x52203) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) ioctl$BTRFS_IOC_FS_INFO(r1, 0x8400941f, &(0x7f0000000340)) (async) [ 101.351292][ T5336] i2c i2c-1: dvb_frontend_start: failed to start kthread (-4) [ 101.370815][ T5336] ================================================================== [ 101.374105][ T5336] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 101.377475][ T5336] Read of size 4 at addr ffff888032b0b83c by task syz.0.0/5336 [ 101.380578][ T5336] [ 101.383139][ T5336] CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.383169][ T5336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.383242][ T5336] Call Trace: [ 101.383249][ T5336] [ 101.383289][ T5336] dump_stack_lvl+0xe8/0x150 [ 101.383324][ T5336] print_address_description+0x55/0x1e0 [ 101.383392][ T5336] ? dvb_frontend_release+0x407/0x4d0 [ 101.383426][ T5336] print_report+0x58/0x70 [ 101.383508][ T5336] kasan_report+0x117/0x150 [ 101.383625][ T5336] ? dvb_frontend_release+0x407/0x4d0 [ 101.385301][ T5336] dvb_frontend_release+0x407/0x4d0 [ 101.386514][ T5336] ? __pfx_dvb_frontend_release+0x10/0x10 [ 101.386530][ T5336] __fput+0x418/0xa50 [ 101.386543][ T5336] task_work_run+0x1d9/0x270 [ 101.386555][ T5336] ? __pfx_task_work_run+0x10/0x10 [ 101.386714][ T5336] ? do_raw_spin_unlock+0x4d/0x210 [ 101.386749][ T5336] do_exit+0x73a/0x2360 [ 101.386766][ T5336] ? __kasan_slab_free+0x5c/0x80 [ 101.386777][ T5336] ? kmem_cache_free+0x182/0x650 [ 101.386859][ T5336] ? do_syscall_64+0x174/0x580 [ 101.386872][ T5336] ? __pfx_do_exit+0x10/0x10 [ 101.388124][ T5336] ? do_raw_spin_lock+0x12b/0x2f0 [ 101.388279][ T5336] do_group_exit+0x22d/0x2f0 [ 101.388439][ T5336] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.388552][ T5336] get_signal+0x121b/0x12c0 [ 101.388617][ T5336] arch_do_signal_or_restart+0xbb/0x860 [ 101.388714][ T5336] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 101.388746][ T5336] ? do_sys_openat2+0x14e/0x200 [ 101.388797][ T5336] exit_to_user_mode_loop+0x104/0x730 [ 101.388845][ T5336] ? rcu_is_watching+0x15/0xb0 [ 101.388906][ T5336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.388998][ T5336] do_syscall_64+0x353/0x580 [ 101.389059][ T5336] ? trace_irq_disable+0x3b/0x140 [ 101.389106][ T5336] ? clear_bhb_loop+0x40/0x90 [ 101.389136][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.389165][ T5336] RIP: 0033:0x7f6de6d5e6ce [ 101.389208][ T5336] Code: Unable to access opcode bytes at 0x7f6de6d5e6a4. [ 101.389214][ T5336] RSP: 002b:00007f6de7c51e88 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 101.389243][ T5336] RAX: fffffffffffffffc RBX: 00007f6de7c526c0 RCX: 00007f6de6d5e6ce [ 101.389250][ T5336] RDX: 0000000000000002 RSI: 00007f6de7c51f50 RDI: ffffffffffffff9c [ 101.389321][ T5336] RBP: 00007f6de6e33eaf R08: 0000000000000000 R09: 0000000000000000 [ 101.389327][ T5336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.389353][ T5336] R13: 00007f6de7026218 R14: 00007f6de7026180 R15: 00007ffd976b1698 [ 101.389364][ T5336] [ 101.389385][ T5336] [ 101.491357][ T5336] Allocated by task 1: [ 101.493059][ T5336] kasan_save_track+0x3e/0x80 [ 101.495083][ T5336] __kasan_kmalloc+0x93/0xb0 [ 101.496965][ T5336] __kmalloc_cache_noprof+0x32d/0x660 [ 101.499163][ T5336] dvb_register_device+0x309/0x1dd0 [ 101.501341][ T5336] dvb_register_frontend+0x603/0x900 [ 101.503514][ T5336] vidtv_bridge_probe+0x9d5/0xf60 [ 101.505718][ T5336] platform_probe+0xf9/0x190 [ 101.507574][ T5336] really_probe+0x254/0xae0 [ 101.509461][ T5336] __driver_probe_device+0x1e8/0x360 [ 101.511547][ T5336] driver_probe_device+0x4f/0x240 [ 101.513618][ T5336] __driver_attach+0x339/0x600 [ 101.515609][ T5336] bus_for_each_dev+0x23b/0x2c0 [ 101.517664][ T5336] bus_add_driver+0x345/0x670 [ 101.519581][ T5336] driver_register+0x23a/0x320 [ 101.521576][ T5336] vidtv_bridge_init+0x3d/0x60 [ 101.523589][ T5336] do_one_initcall+0x250/0x870 [ 101.525582][ T5336] do_initcall_level+0x10a/0x1a0 [ 101.527518][ T5336] do_initcalls+0x59/0xa0 [ 101.529309][ T5336] kernel_init_freeable+0x29d/0x3e0 [ 101.531347][ T5336] kernel_init+0x1d/0x1d0 [ 101.533058][ T5336] ret_from_fork+0x514/0xb70 [ 101.534983][ T5336] ret_from_fork_asm+0x1a/0x30 [ 101.536900][ T5336] [ 101.537910][ T5336] Freed by task 5336: [ 101.539532][ T5336] kasan_save_track+0x3e/0x80 [ 101.541445][ T5336] kasan_save_free_info+0x40/0x50 [ 101.543412][ T5336] __kasan_slab_free+0x5c/0x80 [ 101.545331][ T5336] kfree+0x1c5/0x640 [ 101.546975][ T5336] dvb_generic_release+0x11d/0x1b0 [ 101.549017][ T5336] dvb_frontend_release+0x132/0x4d0 [ 101.551065][ T5336] __fput+0x418/0xa50 [ 101.552662][ T5336] task_work_run+0x1d9/0x270 [ 101.554586][ T5336] do_exit+0x73a/0x2360 [ 101.556326][ T5336] do_group_exit+0x22d/0x2f0 [ 101.558215][ T5336] get_signal+0x121b/0x12c0 [ 101.560056][ T5336] arch_do_signal_or_restart+0xbb/0x860 [ 101.562345][ T5336] exit_to_user_mode_loop+0x104/0x730 [ 101.564557][ T5336] do_syscall_64+0x353/0x580 [ 101.566493][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.568952][ T5336] [ 101.570051][ T5336] The buggy address belongs to the object at ffff888032b0b800 [ 101.570051][ T5336] which belongs to the cache kmalloc-256 of size 256 [ 101.575720][ T5336] The buggy address is located 60 bytes inside of [ 101.575720][ T5336] freed 256-byte region [ffff888032b0b800, ffff888032b0b900) [ 101.581043][ T5336] [ 101.582062][ T5336] The buggy address belongs to the physical page: [ 101.584577][ T5336] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32b0b [ 101.588035][ T5336] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 101.591076][ T5336] page_type: f5(slab) [ 101.592800][ T5336] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 101.596318][ T5336] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 101.599730][ T5336] page dumped because: kasan: bad access detected [ 101.602314][ T5336] page_owner tracks the page as allocated [ 101.604670][ T5336] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20381422401, free_ts 20375737071 [ 101.612488][ T5336] post_alloc_hook+0x1f9/0x250 [ 101.614353][ T5336] get_page_from_freelist+0x21fa/0x2270 [ 101.616539][ T5336] __alloc_frozen_pages_noprof+0x18d/0x380 [ 101.618866][ T5336] allocate_slab+0x79/0x5e0 [ 101.620729][ T5336] refill_objects+0x2d5/0x350 [ 101.622658][ T5336] __pcs_replace_empty_main+0x2bf/0x6b0 [ 101.624919][ T5336] __kmalloc_cache_noprof+0x3a7/0x660 [ 101.627020][ T5336] bus_add_driver+0x162/0x670 [ 101.628862][ T5336] driver_register+0x23a/0x320 [ 101.630869][ T5336] usb_register_driver+0x1e4/0x390 [ 101.632899][ T5336] do_one_initcall+0x250/0x870 [ 101.634880][ T5336] do_initcall_level+0x10a/0x1a0 [ 101.636913][ T5336] do_initcalls+0x59/0xa0 [ 101.638713][ T5336] kernel_init_freeable+0x29d/0x3e0 [ 101.640834][ T5336] kernel_init+0x1d/0x1d0 [ 101.642728][ T5336] ret_from_fork+0x514/0xb70 [ 101.644713][ T5336] page last free pid 12 tgid 12 stack trace: [ 101.647210][ T5336] __free_frozen_pages+0xc1e/0xd10 [ 101.649327][ T5336] __kasan_populate_vmalloc+0x12d/0x1c0 [ 101.651637][ T5336] alloc_vmap_area+0xd1a/0x1420 [ 101.653735][ T5336] __get_vm_area_node+0x1f2/0x300 [ 101.656093][ T5336] __vmalloc_node_range_noprof+0x358/0x1730 [ 101.658512][ T5336] __vmalloc_node_noprof+0xc2/0x100 [ 101.660571][ T5336] dup_task_struct+0x2a0/0x8e0 [ 101.662526][ T5336] copy_process+0x820/0x4390 [ 101.664293][ T5336] kernel_clone+0x2d7/0x940 [ 101.666158][ T5336] user_mode_thread+0x110/0x180 [ 101.668126][ T5336] call_usermodehelper_exec_work+0x5c/0x230 [ 101.670455][ T5336] process_scheduled_works+0xa8e/0x14e0 [ 101.672697][ T5336] worker_thread+0xa47/0xfb0 [ 101.674678][ T5336] kthread+0x388/0x470 [ 101.676322][ T5336] ret_from_fork+0x514/0xb70 [ 101.678263][ T5336] ret_from_fork_asm+0x1a/0x30 [ 101.680224][ T5336] [ 101.681229][ T5336] Memory state around the buggy address: [ 101.683502][ T5336] ffff888032b0b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.686665][ T5336] ffff888032b0b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.689883][ T5336] >ffff888032b0b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.692951][ T5336] ^ [ 101.695436][ T5336] ffff888032b0b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.698688][ T5336] ffff888032b0b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.701854][ T5336] ================================================================== [ 101.706222][ T5336] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 101.709122][ T5336] CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.712590][ T5336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.716532][ T5336] Call Trace: [ 101.717921][ T5336] [ 101.719130][ T5336] vpanic+0x56c/0xa60 [ 101.720796][ T5336] ? __pfx_vpanic+0x10/0x10 [ 101.722660][ T5336] ? __pfx___schedule+0x10/0x10 [ 101.724604][ T5336] panic+0xc5/0xd0 [ 101.726122][ T5336] ? __pfx_panic+0x10/0x10 [ 101.727945][ T5336] ? preempt_schedule_common+0x82/0xd0 [ 101.730051][ T5336] ? dvb_frontend_release+0x407/0x4d0 [ 101.732179][ T5336] check_panic_on_warn+0x89/0xb0 [ 101.734213][ T5336] ? dvb_frontend_release+0x407/0x4d0 [ 101.736352][ T5336] end_report+0x73/0x170 [ 101.738065][ T5336] ? dvb_frontend_release+0x407/0x4d0 [ 101.740219][ T5336] kasan_report+0x128/0x150 [ 101.742094][ T5336] ? dvb_frontend_release+0x407/0x4d0 [ 101.744281][ T5336] dvb_frontend_release+0x407/0x4d0 [ 101.746351][ T5336] ? __pfx_dvb_frontend_release+0x10/0x10 [ 101.748582][ T5336] __fput+0x418/0xa50 [ 101.750139][ T5336] task_work_run+0x1d9/0x270 [ 101.751989][ T5336] ? __pfx_task_work_run+0x10/0x10 [ 101.754070][ T5336] ? do_raw_spin_unlock+0x4d/0x210 [ 101.756124][ T5336] do_exit+0x73a/0x2360 [ 101.757874][ T5336] ? __kasan_slab_free+0x5c/0x80 [ 101.760004][ T5336] ? kmem_cache_free+0x182/0x650 [ 101.762047][ T5336] ? do_syscall_64+0x174/0x580 [ 101.764022][ T5336] ? __pfx_do_exit+0x10/0x10 [ 101.765912][ T5336] ? do_raw_spin_lock+0x12b/0x2f0 [ 101.767994][ T5336] do_group_exit+0x22d/0x2f0 [ 101.769871][ T5336] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.771937][ T5336] get_signal+0x121b/0x12c0 [ 101.773850][ T5336] arch_do_signal_or_restart+0xbb/0x860 [ 101.776035][ T5336] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 101.778467][ T5336] ? do_sys_openat2+0x14e/0x200 [ 101.780362][ T5336] exit_to_user_mode_loop+0x104/0x730 [ 101.782566][ T5336] ? rcu_is_watching+0x15/0xb0 [ 101.784519][ T5336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.786877][ T5336] do_syscall_64+0x353/0x580 [ 101.788562][ T5336] ? trace_irq_disable+0x3b/0x140 [ 101.790375][ T5336] ? clear_bhb_loop+0x40/0x90 [ 101.792073][ T5336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.794443][ T5336] RIP: 0033:0x7f6de6d5e6ce [ 101.796146][ T5336] Code: Unable to access opcode bytes at 0x7f6de6d5e6a4. [ 101.798826][ T5336] RSP: 002b:00007f6de7c51e88 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 101.801841][ T5336] RAX: fffffffffffffffc RBX: 00007f6de7c526c0 RCX: 00007f6de6d5e6ce [ 101.804749][ T5336] RDX: 0000000000000002 RSI: 00007f6de7c51f50 RDI: ffffffffffffff9c [ 101.807752][ T5336] RBP: 00007f6de6e33eaf R08: 0000000000000000 R09: 0000000000000000 [ 101.810802][ T5336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.813535][ T5336] R13: 00007f6de7026218 R14: 00007f6de7026180 R15: 00007ffd976b1698 [ 101.816469][ T5336] [ 101.818144][ T5336] Kernel Offset: disabled [ 101.819912][ T5336] Rebooting in 86400 seconds..