program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) (async) [ 93.009100][ T49] Bluetooth: hci0: command tx timeout [ 93.020105][ T24] cfg80211: failed to load regulatory.db [ 93.172350][ T5343] ================================================================== [ 93.172367][ T5343] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 93.172649][ T5343] Read of size 4 at addr ffff888034f4763c by task syz.0.0/5343 [ 93.172660][ T5343] [ 93.172677][ T5343] CPU: 0 UID: 0 PID: 5343 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.172698][ T5343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.172706][ T5343] Call Trace: [ 93.172711][ T5343] [ 93.172717][ T5343] dump_stack_lvl+0xe8/0x150 [ 93.172802][ T5343] print_address_description+0x55/0x1e0 [ 93.172832][ T5343] ? dvb_frontend_release+0x407/0x4d0 [ 93.172843][ T5343] print_report+0x58/0x70 [ 93.172859][ T5343] kasan_report+0x117/0x150 [ 93.172915][ T5343] ? dvb_frontend_release+0x407/0x4d0 [ 93.172929][ T5343] dvb_frontend_release+0x407/0x4d0 [ 93.172942][ T5343] ? __pfx_dvb_frontend_release+0x10/0x10 [ 93.172952][ T5343] __fput+0x408/0xa40 [ 93.172981][ T5343] fput_close_sync+0x11f/0x240 [ 93.172996][ T5343] ? __pfx_fput_close_sync+0x10/0x10 [ 93.173014][ T5343] filp_close_sync+0x6e/0xa0 [ 93.173039][ T5343] __se_sys_close_range+0xa77/0xef0 [ 93.173096][ T5343] ? __pfx___se_sys_close_range+0x10/0x10 [ 93.173115][ T5343] do_syscall_64+0x166/0x520 [ 93.173216][ T5343] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.173230][ T5343] ? clear_bhb_loop+0x70/0xc0 [ 93.173242][ T5343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.173253][ T5343] RIP: 0033:0x7f2d3c99f559 [ 93.173264][ T5343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.173274][ T5343] RSP: 002b:00007fff5acb7818 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 93.173288][ T5343] RAX: ffffffffffffffda RBX: 00007f2d3cc27da0 RCX: 00007f2d3c99f559 [ 93.173296][ T5343] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 93.173303][ T5343] RBP: 00007f2d3cc27da0 R08: 00007f2d3cc264e8 R09: 0000000000000000 [ 93.173310][ T5343] R10: 0000000000dffd40 R11: 0000000000000246 R12: 0000000000016ddd [ 93.173317][ T5343] R13: 00007f2d3cc2609c R14: 00007f2d3cc26098 R15: 00007f2d3cc26090 [ 93.173341][ T5343] [ 93.173345][ T5343] [ 93.173348][ T5343] Allocated by task 1: [ 93.173373][ T5343] kasan_save_track+0x3e/0x80 [ 93.173384][ T5343] __kasan_kmalloc+0x93/0xb0 [ 93.173395][ T5343] __kmalloc_cache_noprof+0x31c/0x600 [ 93.173418][ T5343] dvb_register_device+0x309/0x1dd0 [ 93.173429][ T5343] dvb_register_frontend+0x603/0x900 [ 93.173444][ T5343] vidtv_bridge_probe+0xab2/0x10e0 [ 93.173458][ T5343] platform_probe+0xf9/0x190 [ 93.173523][ T5343] really_probe+0x254/0xae0 [ 93.173534][ T5343] __driver_probe_device+0x1e8/0x360 [ 93.173544][ T5343] driver_probe_device+0x4f/0x240 [ 93.173555][ T5343] __driver_attach+0x339/0x600 [ 93.173565][ T5343] bus_for_each_dev+0x23b/0x2c0 [ 93.173578][ T5343] bus_add_driver+0x38f/0x6e0 [ 93.173591][ T5343] driver_register+0x23a/0x320 [ 93.173603][ T5343] vidtv_bridge_init+0x3d/0x60 [ 93.173686][ T5343] do_one_initcall+0x250/0x870 [ 93.173695][ T5343] do_initcall_level+0x10a/0x1a0 [ 93.173704][ T5343] do_initcalls+0x59/0xa0 [ 93.173715][ T5343] kernel_init_freeable+0x29d/0x3e0 [ 93.173726][ T5343] kernel_init+0x22/0x1d0 [ 93.173741][ T5343] ret_from_fork+0x514/0xb70 [ 93.173766][ T5343] ret_from_fork_asm+0x1a/0x30 [ 93.173777][ T5343] [ 93.173779][ T5343] Freed by task 5343: [ 93.173785][ T5343] kasan_save_track+0x3e/0x80 [ 93.173795][ T5343] kasan_save_free_info+0x40/0x50 [ 93.173810][ T5343] __kasan_slab_free+0x5c/0x80 [ 93.173821][ T5343] kfree+0x1c5/0x650 [ 93.173835][ T5343] dvb_generic_release+0x11d/0x1b0 [ 93.173844][ T5343] dvb_frontend_release+0x132/0x4d0 [ 93.173849][ T5343] __fput+0x408/0xa40 [ 93.173859][ T5343] fput_close_sync+0x11f/0x240 [ 93.173868][ T5343] filp_close_sync+0x6e/0xa0 [ 93.173877][ T5343] __se_sys_close_range+0xa77/0xef0 [ 93.173887][ T5343] do_syscall_64+0x166/0x520 [ 93.173896][ T5343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.173903][ T5343] [ 93.173905][ T5343] The buggy address belongs to the object at ffff888034f47600 [ 93.173905][ T5343] which belongs to the cache kmalloc-256 of size 256 [ 93.173912][ T5343] The buggy address is located 60 bytes inside of [ 93.173912][ T5343] freed 256-byte region [ffff888034f47600, ffff888034f47700) [ 93.173919][ T5343] [ 93.173921][ T5343] The buggy address belongs to the physical page: [ 93.173926][ T5343] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34f47 [ 93.173933][ T5343] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 93.173942][ T5343] page_type: f5(slab) [ 93.173953][ T5343] raw: 04fff00000000000 ffff88801c441b40 dead000000000100 dead000000000122 [ 93.173961][ T5343] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 93.173966][ T5343] page dumped because: kasan: bad access detected [ 93.173983][ T5343] page_owner tracks the page as allocated [ 93.173988][ T5343] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 21887080634 [ 93.174006][ T5343] post_alloc_hook+0x1f9/0x250 [ 93.174022][ T5343] get_page_from_freelist+0x220f/0x2280 [ 93.174033][ T5343] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 93.174043][ T5343] allocate_slab+0x7d/0x5e0 [ 93.174056][ T5343] refill_objects+0x2d5/0x350 [ 93.174068][ T5343] __pcs_replace_empty_main+0x2c8/0x6c0 [ 93.174081][ T5343] __kmalloc_cache_noprof+0x396/0x600 [ 93.174090][ T5343] bus_add_driver+0x19d/0x6e0 [ 93.174103][ T5343] driver_register+0x23a/0x320 [ 93.174114][ T5343] usb_register_driver+0x1e4/0x390 [ 93.174134][ T5343] do_one_initcall+0x250/0x870 [ 93.174143][ T5343] do_initcall_level+0x10a/0x1a0 [ 93.174154][ T5343] do_initcalls+0x59/0xa0 [ 93.174164][ T5343] kernel_init_freeable+0x29d/0x3e0 [ 93.174175][ T5343] kernel_init+0x22/0x1d0 [ 93.174189][ T5343] ret_from_fork+0x514/0xb70 [ 93.174200][ T5343] page last free pid 45 tgid 45 ts 21886357549 stack trace: [ 93.174208][ T5343] __free_frozen_pages+0xc97/0xd90 [ 93.174223][ T5343] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 93.174232][ T5343] alloc_vmap_area+0xd10/0x1410 [ 93.174247][ T5343] __get_vm_area_node+0x200/0x2f0 [ 93.174261][ T5343] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 93.174276][ T5343] __vmalloc_node_noprof+0xc2/0x100 [ 93.174290][ T5343] dup_task_struct+0x2c6/0xa00 [ 93.174352][ T5343] copy_process+0x7ea/0x44b0 [ 93.174366][ T5343] kernel_clone+0x2d7/0x940 [ 93.174380][ T5343] user_mode_thread+0x115/0x180 [ 93.174394][ T5343] call_usermodehelper_exec_work+0x5c/0x230 [ 93.174419][ T5343] process_scheduled_works+0xc3d/0x1630 [ 93.174435][ T5343] worker_thread+0xa47/0xfb0 [ 93.174449][ T5343] kthread+0x38b/0x480 [ 93.174459][ T5343] ret_from_fork+0x514/0xb70 [ 93.174470][ T5343] ret_from_fork_asm+0x1a/0x30 [ 93.174487][ T5343] [ 93.174490][ T5343] Memory state around the buggy address: [ 93.174496][ T5343] ffff888034f47500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.174503][ T5343] ffff888034f47580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.174511][ T5343] >ffff888034f47600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.174517][ T5343] ^ [ 93.174523][ T5343] ffff888034f47680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.174529][ T5343] ffff888034f47700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.174535][ T5343] ================================================================== [ 93.174615][ T5343] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.519825][ T5343] CPU: 0 UID: 0 PID: 5343 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.523282][ T5343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.528081][ T5343] Call Trace: [ 93.529919][ T5343] [ 93.531583][ T5343] vpanic+0x56d/0xa60 [ 93.533875][ T5343] ? rcu_is_watching+0x16/0xb0 [ 93.536541][ T5343] ? __pfx_vpanic+0x10/0x10 [ 93.539026][ T5343] ? __pfx___schedule+0x10/0x10 [ 93.544958][ T5343] panic+0xc5/0xd0 [ 93.547099][ T5343] ? __pfx_panic+0x10/0x10 [ 93.549565][ T5343] ? preempt_schedule_common+0x7f/0xd0 [ 93.552650][ T5343] ? dvb_frontend_release+0x407/0x4d0 [ 93.556121][ T5343] check_panic_on_warn+0x89/0xb0 [ 93.559490][ T5343] ? dvb_frontend_release+0x407/0x4d0 [ 93.563033][ T5343] end_report+0x73/0x170 [ 93.565729][ T5343] ? dvb_frontend_release+0x407/0x4d0 [ 93.569313][ T5343] kasan_report+0x128/0x150 [ 93.572468][ T5343] ? dvb_frontend_release+0x407/0x4d0 [ 93.575445][ T5343] dvb_frontend_release+0x407/0x4d0 [ 93.577850][ T5343] ? __pfx_dvb_frontend_release+0x10/0x10 [ 93.580208][ T5343] __fput+0x408/0xa40 [ 93.581851][ T5343] fput_close_sync+0x11f/0x240 [ 93.583829][ T5343] ? __pfx_fput_close_sync+0x10/0x10 [ 93.585955][ T5343] filp_close_sync+0x6e/0xa0 [ 93.588648][ T5343] __se_sys_close_range+0xa77/0xef0 [ 93.592137][ T5343] ? __pfx___se_sys_close_range+0x10/0x10 [ 93.595723][ T5343] do_syscall_64+0x166/0x520 [ 93.598134][ T5343] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.601019][ T5343] ? clear_bhb_loop+0x70/0xc0 [ 93.603258][ T5343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.606057][ T5343] RIP: 0033:0x7f2d3c99f559 [ 93.608673][ T5343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.618794][ T5343] RSP: 002b:00007fff5acb7818 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 93.623506][ T5343] RAX: ffffffffffffffda RBX: 00007f2d3cc27da0 RCX: 00007f2d3c99f559 [ 93.627568][ T5343] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 93.631520][ T5343] RBP: 00007f2d3cc27da0 R08: 00007f2d3cc264e8 R09: 0000000000000000 [ 93.635571][ T5343] R10: 0000000000dffd40 R11: 0000000000000246 R12: 0000000000016ddd [ 93.639940][ T5343] R13: 00007f2d3cc2609c R14: 00007f2d3cc26098 R15: 00007f2d3cc26090 [ 93.644404][ T5343] [ 93.646623][ T5343] Kernel Offset: disabled [ 93.648995][ T5343] Rebooting in 86400 seconds..