platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 platform regulatory.0: Falling back to sysfs fallback for: regulatory.db ================================================================== BUG: KASAN: invalid-access in __list_add_valid+0x10/0x90 lib/list_debug.c:22 Read at addr f6ff0000227ee090 by task syz-executor.0/8449 Pointer tag: [f6], memory tag: [f1] CPU: 1 PID: 8449 Comm: syz-executor.0 Not tainted 5.12.0-rc2-syzkaller-00570-g88fe49249c99 #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x1b0 arch/arm64/kernel/stacktrace.c:112 show_stack+0x18/0x70 arch/arm64/kernel/stacktrace.c:191 __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0xd0/0x12c lib/dump_stack.c:120 print_address_description+0x70/0x29c mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report+0x134/0x380 mm/kasan/report.c:416 report_tag_fault arch/arm64/mm/fault.c:324 [inline] do_tag_recovery arch/arm64/mm/fault.c:336 [inline] __do_kernel_fault+0x1a8/0x1dc arch/arm64/mm/fault.c:378 do_bad_area arch/arm64/mm/fault.c:474 [inline] do_tag_check_fault+0x74/0x90 arch/arm64/mm/fault.c:729 do_mem_abort+0x44/0xbc arch/arm64/mm/fault.c:805 el1_abort+0x40/0x6c arch/arm64/kernel/entry-common.c:167 el1_sync_handler+0xac/0xd0 arch/arm64/kernel/entry-common.c:259 el1_sync+0x70/0x100 arch/arm64/kernel/entry.S:656 __list_add_valid+0x10/0x90 lib/list_debug.c:22 __list_add include/linux/list.h:67 [inline] list_add include/linux/list.h:86 [inline] fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:516 [inline] fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:581 [inline] firmware_fallback_sysfs+0x1a4/0x460 drivers/base/firmware_loader/fallback.c:657 _request_firmware+0x28c/0x510 drivers/base/firmware_loader/main.c:831 request_firmware+0x48/0x70 drivers/base/firmware_loader/main.c:875 reg_reload_regdb+0x40/0xf4 net/wireless/reg.c:1095 nl80211_reload_regdb+0x10/0x20 net/wireless/nl80211.c:7235 genl_family_rcv_msg_doit+0xc8/0x150 net/netlink/genetlink.c:739 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] genl_rcv_msg+0xe4/0x1e0 net/netlink/genetlink.c:800 netlink_rcv_skb+0x5c/0x130 net/netlink/af_netlink.c:2502 genl_rcv+0x38/0x50 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x25c/0x320 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x1d4/0x3e4 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0x54/0x60 net/socket.c:674 ____sys_sendmsg+0x280/0x2c0 net/socket.c:2350 ___sys_sendmsg+0x7c/0xc0 net/socket.c:2404 __sys_sendmsg+0x68/0xc4 net/socket.c:2433 __do_sys_sendmsg net/socket.c:2442 [inline] __se_sys_sendmsg net/socket.c:2440 [inline] __arm64_sys_sendmsg+0x28/0x3c net/socket.c:2440 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.0+0x60/0x120 arch/arm64/kernel/syscall.c:129 do_el0_svc+0x74/0x90 arch/arm64/kernel/syscall.c:168 el0_svc+0x2c/0x54 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432 el0_sync+0x18c/0x1c0 arch/arm64/kernel/entry.S:699 Allocated by task 8449: stack_trace_save+0x50/0x80 kernel/stacktrace.c:121 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:427 [inline] ____kasan_kmalloc mm/kasan/common.c:506 [inline] ____kasan_kmalloc mm/kasan/common.c:465 [inline] __kasan_kmalloc+0xc8/0x100 mm/kasan/common.c:515 kasan_kmalloc include/linux/kasan.h:233 [inline] kmem_cache_alloc_trace include/linux/slab.h:452 [inline] kmalloc include/linux/slab.h:554 [inline] kzalloc include/linux/slab.h:684 [inline] device_private_init drivers/base/core.c:3084 [inline] device_add+0x41c/0x7d0 drivers/base/core.c:3134 fw_load_sysfs_fallback drivers/base/firmware_loader/fallback.c:509 [inline] fw_load_from_user_helper drivers/base/firmware_loader/fallback.c:581 [inline] firmware_fallback_sysfs+0x170/0x460 drivers/base/firmware_loader/fallback.c:657 _request_firmware+0x28c/0x510 drivers/base/firmware_loader/main.c:831 request_firmware+0x48/0x70 drivers/base/firmware_loader/main.c:875 reg_reload_regdb+0x40/0xf4 net/wireless/reg.c:1095 nl80211_reload_regdb+0x10/0x20 net/wireless/nl80211.c:7235 genl_family_rcv_msg_doit+0xc8/0x150 net/netlink/genetlink.c:739 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] genl_rcv_msg+0xe4/0x1e0 net/netlink/genetlink.c:800 netlink_rcv_skb+0x5c/0x130 net/netlink/af_netlink.c:2502 genl_rcv+0x38/0x50 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x25c/0x320 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x1d4/0x3e4 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0x54/0x60 net/socket.c:674 ____sys_sendmsg+0x280/0x2c0 net/socket.c:2350 ___sys_sendmsg+0x7c/0xc0 net/socket.c:2404 __sys_sendmsg+0x68/0xc4 net/socket.c:2433 __do_sys_sendmsg net/socket.c:2442 [inline] __se_sys_sendmsg net/socket.c:2440 [inline] __arm64_sys_sendmsg+0x28/0x3c net/socket.c:2440 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.0+0x60/0x120 arch/arm64/kernel/syscall.c:129 do_el0_svc+0x74/0x90 arch/arm64/kernel/syscall.c:168 el0_svc+0x2c/0x54 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432 el0_sync+0x18c/0x1c0 arch/arm64/kernel/entry.S:699 Freed by task 8436: stack_trace_save+0x50/0x80 kernel/stacktrace.c:121 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38 kasan_set_track+0x28/0x40 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/hw_tags.c:174 ____kasan_slab_free.constprop.0+0x1e0/0x230 mm/kasan/common.c:360 __kasan_slab_free+0x10/0x1c mm/kasan/common.c:367 kasan_slab_free include/linux/kasan.h:199 [inline] slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0xbc/0x210 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kfree+0x348/0x4d0 mm/slub.c:4213 sctp_endpoint_destroy+0xb8/0x100 net/sctp/endpointola.c:220 sctp_endpoint_put net/sctp/endpointola.c:236 [inline] sctp_endpoint_free+0x88/0xb0 net/sctp/endpointola.c:183 sctp_destroy_sock+0x28/0xc0 net/sctp/socket.c:5035 sk_common_release+0x24/0x150 net/core/sock.c:3270 sctp_close+0x138/0x2f0 net/sctp/socket.c:1533 inet_release+0x50/0xa4 net/ipv4/af_inet.c:431 __sock_release+0x44/0xbc net/socket.c:599 sock_close+0x18/0x30 net/socket.c:1258 __fput+0x78/0x230 fs/file_table.c:280 ____fput+0x10/0x20 fs/file_table.c:313 task_work_run+0x80/0x160 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939 work_pending+0xc/0x3d4 The buggy address belongs to the object at ffff0000227ee000 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 144 bytes inside of 256-byte region [ffff0000227ee000, ffff0000227ee100) The buggy address belongs to the page: page:0000000042eb0e8a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x627ee head:0000000042eb0e8a order:1 compound_mapcount:0 memcg:f1ff000007de2301 flags: 0x1ffffc000010200(slab|head) raw: 01ffffc000010200 fffffc0000896680 0000000200000002 f1ff000003c01300 raw: 0000000000000000 0000000000100010 00000001ffffffff f1ff000007de2301 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000227ede00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ffff0000227edf00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe >ffff0000227ee000: f1 f1 f1 f1 f1 f1 f1 f1 f1 f1 f1 f1 f1 f1 fe fe ^ ffff0000227ee100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ffff0000227ee200: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 ==================================================================