program: bpf$ENABLE_STATS(0x20, 0x0, 0x500) r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000080)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x84000, 0x0, 0x0, @by_dev={r1}, [@snapshot={0x0, 0x2840, 0x0, 0x80, 'snapshot-merge\x00', {@ram_num={'1:', 0x0}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'PO', 0x20, '128', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) socket$packet(0x11, 0x2, 0x300) mkdirat(0xffffffffffffff9c, 0x0, 0x777) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x40010, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000240)='./bus\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c73686f72746e616d653d77696e6e742c756e695f786c6174653d302c756e695f786c6174653d312c757466383d312c757466383d312c646973636172642c757466383d302c756e695f786c6174653d302c666c7573682c73686f72746e616d653d6d697865642c73686f72746e616d653d6c6f7765722c646f733178666c6f7070792c73686f72746e616d653d77696e6e742c73686f72746e616d653d6c6f7765722c757466382c0014697a7960fb374b723f64329787434c6c9f891d2e309efaf1d4e529e1ba0f697fedffb095592bc19d5a8f8141ee9bf46262f3a2b1452bf206c0e2ae8a465e6e1be6eeb5d588035a24458d476fc1f9a234cdc4ba352a4185614ce67df4870bff796357ee95fffb99cde9"], 0x1, 0x2bc, &(0x7f0000000780)="$eJzs3U9rY1UUAPDz0uQ1QxftwpUIvsUs3Fims3VhBqkgdqVk4R/QwZmBoQkDDQRGxTArP4ELF34Pd+4FN34DwYVLdw5SuPLeS5NMkkmmHdMO5ffb9HLuOe/em3fbFMK7+fKN/vG9R4MHT779I9rtLBqd6MTTLPaiEWfSWAAA18LTlOLvC72/NxubmhMAsFkz7/+t56RsL4be3fS0AIAN+viTTz+8c3R0+FFRtCP63w+7WdQ/6/47D+Jh9OJ+3IrdOJ1+FpBS3X7/g6PDaBalvbjZHw27ZWX/i98mqXlU9QexG3vL6w+K2kz9aNis/vPIsoiHnXIit2M3XluoL/sPby+pj24eb7XHiyzH34/d+P2reBS9uFd9pjEd/7s8ivfSD/9881mZXNZno2F3u8qbSluXfW8AAAAAAAAAAAAAAAAAAAAAALi+9ouJvbjZL0P1+TvdrdOqf/+Z/up8nUbVX9dnEXnVmDsfaJTip7PzdW4VRZGyOn9yvs+NZrzejOaVLRwAAAAAAAAAAAAAAAAAAABeIYPHXx/f7fXun/wvjfFD/pPH+i96nc5M5M1Ynbx9rrFia5xeznU+5+DXz/uTSLmIi0x+2CoiVs25tRC5Uc5n/ZX/TSmlLIt4udvUepGx1jR2VueUL/AvP+68fXw3W/cats9u3M+zXXmcDB7P3dPIVg96+kwknWv75Sty8vGOeaHr7LzkL9E7f9aDjSPZmlW0ZiKtcSOet/3a59rPl/c3CAAAAAAAAAAAAAAAAAAAqE0f+l3S+WRlaWNjkwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACASzb9/v9pIxYic41R/FUVL89JKY0mkTxOBle9RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6//wIAAP//qWdtxQ==") r2 = openat(0xffffffffffffff9c, &(0x7f0000000a40)='./file1\x00', 0x105042, 0x1c3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4012011, r2, 0x0) r3 = socket(0x11, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$packet(r3, 0x0, 0x0) mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x2, 0x1) mbind(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x8, 0x3) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) read$FUSE(r2, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='ns\x00') renameat2(r4, &(0x7f0000000280)='./cgroup\x00', r4, &(0x7f0000000500)='./mnt\x00', 0x2) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$XFS_IOC_BULKSTAT(r5, 0x8040587f, &(0x7f0000000e40)={{0x548d8c95, 0x1, 0x1a1538bd, 0x1, 0x9}, &(0x7f0000000a80)}) syz_emit_ethernet(0x3c, &(0x7f0000000000)={@broadcast, @remote, @val={@val={0x88a8, 0x5, 0x1, 0x2}, {0x8100, 0x1}}, {@generic={0x8906, "7290b8563b43d10d01ee7180e92f4654307e1783700aaa4a0833301915309d9323bb1aededab"}}}, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0) socket(0x2, 0x80805, 0x0) [ 103.427357][ T5335] ================================================================== [ 103.427577][ T5335] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 103.427770][ T5335] Read of size 8 at addr ffff888038cc9818 by task syz.0.0/5335 [ 103.427782][ T5335] [ 103.427835][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.427850][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.427870][ T5335] Call Trace: [ 103.427878][ T5335] [ 103.427885][ T5335] dump_stack_lvl+0xe8/0x150 [ 103.427923][ T5335] print_address_description+0x55/0x1e0 [ 103.427954][ T5335] ? snapshot_ctr+0x5cb/0x1340 [ 103.427971][ T5335] print_report+0x58/0x70 [ 103.427986][ T5335] kasan_report+0x117/0x150 [ 103.428027][ T5335] ? snapshot_ctr+0x5cb/0x1340 [ 103.428047][ T5335] snapshot_ctr+0x5cb/0x1340 [ 103.428067][ T5335] ? __pfx_snapshot_ctr+0x10/0x10 [ 103.428082][ T5335] ? skip_spaces+0x8a/0xa0 [ 103.428151][ T5335] ? dm_split_args+0x50b/0x5d0 [ 103.428168][ T5335] dm_table_add_target+0x58d/0xc70 [ 103.428187][ T5335] table_load+0x325/0x8a0 [ 103.428201][ T5335] ? __pfx_table_load+0x10/0x10 [ 103.428219][ T5335] dm_ctl_ioctl+0x9ec/0xe10 [ 103.428233][ T5335] ? __pfx_table_load+0x10/0x10 [ 103.428245][ T5335] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.428265][ T5335] ? __fget_files+0x2a/0x420 [ 103.428296][ T5335] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.428325][ T5335] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.428339][ T5335] __se_sys_ioctl+0xfc/0x170 [ 103.428364][ T5335] do_syscall_64+0x166/0x520 [ 103.428398][ T5335] ? trace_irq_disable+0x3b/0x140 [ 103.428431][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.428444][ T5335] ? clear_bhb_loop+0x70/0xc0 [ 103.428459][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.428471][ T5335] RIP: 0033:0x7f85e5d9f559 [ 103.428501][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.428513][ T5335] RSP: 002b:00007f85e21f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.428529][ T5335] RAX: ffffffffffffffda RBX: 00007f85e6025fa0 RCX: 00007f85e5d9f559 [ 103.428538][ T5335] RDX: 0000200000000340 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 103.428547][ T5335] RBP: 00007f85e5e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.428555][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.428562][ T5335] R13: 00007f85e6026038 R14: 00007f85e6025fa0 R15: 00007ffea46c7338 [ 103.428589][ T5335] [ 103.428593][ T5335] [ 103.428596][ T5335] Allocated by task 5335: [ 103.428603][ T5335] kasan_save_track+0x3e/0x80 [ 103.428616][ T5335] __kasan_kmalloc+0x93/0xb0 [ 103.428630][ T5335] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 103.428675][ T5335] dm_get_table_device+0x23e/0x730 [ 103.428691][ T5335] dm_get_device+0x327/0x760 [ 103.428702][ T5335] snapshot_ctr+0x2b2/0x1340 [ 103.428716][ T5335] dm_table_add_target+0x58d/0xc70 [ 103.428728][ T5335] table_load+0x325/0x8a0 [ 103.428737][ T5335] dm_ctl_ioctl+0x9ec/0xe10 [ 103.428746][ T5335] __se_sys_ioctl+0xfc/0x170 [ 103.428763][ T5335] do_syscall_64+0x166/0x520 [ 103.428778][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.428791][ T5335] [ 103.428793][ T5335] Freed by task 5335: [ 103.428799][ T5335] kasan_save_track+0x3e/0x80 [ 103.428809][ T5335] kasan_save_free_info+0x40/0x50 [ 103.428824][ T5335] __kasan_slab_free+0x5c/0x80 [ 103.428835][ T5335] kfree+0x1c5/0x650 [ 103.428850][ T5335] dm_put_table_device+0x255/0x2a0 [ 103.428865][ T5335] dm_get_device+0x56f/0x760 [ 103.428875][ T5335] snapshot_ctr+0x471/0x1340 [ 103.428889][ T5335] dm_table_add_target+0x58d/0xc70 [ 103.428900][ T5335] table_load+0x325/0x8a0 [ 103.428910][ T5335] dm_ctl_ioctl+0x9ec/0xe10 [ 103.428920][ T5335] __se_sys_ioctl+0xfc/0x170 [ 103.428930][ T5335] do_syscall_64+0x166/0x520 [ 103.428945][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.428956][ T5335] [ 103.428959][ T5335] The buggy address belongs to the object at ffff888038cc9800 [ 103.428959][ T5335] which belongs to the cache kmalloc-96 of size 96 [ 103.428983][ T5335] The buggy address is located 24 bytes inside of [ 103.428983][ T5335] freed 96-byte region [ffff888038cc9800, ffff888038cc9860) [ 103.428997][ T5335] [ 103.429009][ T5335] The buggy address belongs to the physical page: [ 103.429017][ T5335] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38cc9 [ 103.429031][ T5335] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 103.429043][ T5335] page_type: f5(slab) [ 103.429055][ T5335] raw: 04fff00000000000 ffff88801c041280 dead000000000100 dead000000000122 [ 103.429066][ T5335] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 103.429072][ T5335] page dumped because: kasan: bad access detected [ 103.429080][ T5335] page_owner tracks the page as allocated [ 103.429085][ T5335] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20402887471 [ 103.429130][ T5335] post_alloc_hook+0x1f9/0x250 [ 103.429148][ T5335] get_page_from_freelist+0x2209/0x2280 [ 103.429158][ T5335] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 103.429166][ T5335] allocate_slab+0x7d/0x620 [ 103.429176][ T5335] refill_objects+0x2d5/0x350 [ 103.429187][ T5335] __pcs_replace_empty_main+0x2c8/0x6c0 [ 103.429198][ T5335] __kmalloc_cache_noprof+0x396/0x600 [ 103.429212][ T5335] usb_hub_create_port_device+0xc7/0xc40 [ 103.429236][ T5335] hub_probe+0x26bc/0x3c00 [ 103.429267][ T5335] usb_probe_interface+0x788/0xe50 [ 103.429281][ T5335] really_probe+0x254/0xae0 [ 103.429292][ T5335] __driver_probe_device+0x1e8/0x360 [ 103.429303][ T5335] driver_probe_device+0x4f/0x240 [ 103.429314][ T5335] __device_attach_driver+0x270/0x410 [ 103.429326][ T5335] bus_for_each_drv+0x258/0x2f0 [ 103.429340][ T5335] __device_attach+0x2c4/0x450 [ 103.429349][ T5335] page_owner free stack trace missing [ 103.429354][ T5335] [ 103.429356][ T5335] Memory state around the buggy address: [ 103.429362][ T5335] ffff888038cc9700: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 103.429370][ T5335] ffff888038cc9780: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 103.429377][ T5335] >ffff888038cc9800: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 103.429383][ T5335] ^ [ 103.429390][ T5335] ffff888038cc9880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 103.429396][ T5335] ffff888038cc9900: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 103.429401][ T5335] ================================================================== [ 103.429411][ T5335] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.705971][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.709981][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.714177][ T5335] Call Trace: [ 103.715566][ T5335] [ 103.716894][ T5335] vpanic+0x56d/0xa60 [ 103.718688][ T5335] ? __pfx_vpanic+0x10/0x10 [ 103.720736][ T5335] panic+0xc5/0xd0 [ 103.722335][ T5335] ? __pfx_panic+0x10/0x10 [ 103.724360][ T5335] ? snapshot_ctr+0x5cb/0x1340 [ 103.726526][ T5335] ? snapshot_ctr+0x5cb/0x1340 [ 103.728711][ T5335] check_panic_on_warn+0x89/0xb0 [ 103.731012][ T5335] ? snapshot_ctr+0x5cb/0x1340 [ 103.733052][ T5335] end_report+0x73/0x170 [ 103.734883][ T5335] ? snapshot_ctr+0x5cb/0x1340 [ 103.736972][ T5335] kasan_report+0x128/0x150 [ 103.738890][ T5335] ? snapshot_ctr+0x5cb/0x1340 [ 103.740895][ T5335] snapshot_ctr+0x5cb/0x1340 [ 103.742899][ T5335] ? __pfx_snapshot_ctr+0x10/0x10 [ 103.745129][ T5335] ? skip_spaces+0x8a/0xa0 [ 103.747177][ T5335] ? dm_split_args+0x50b/0x5d0 [ 103.749257][ T5335] dm_table_add_target+0x58d/0xc70 [ 103.751586][ T5335] table_load+0x325/0x8a0 [ 103.753427][ T5335] ? __pfx_table_load+0x10/0x10 [ 103.755493][ T5335] dm_ctl_ioctl+0x9ec/0xe10 [ 103.757468][ T5335] ? __pfx_table_load+0x10/0x10 [ 103.759630][ T5335] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.761843][ T5335] ? __fget_files+0x2a/0x420 [ 103.763880][ T5335] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.765920][ T5335] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.768212][ T5335] __se_sys_ioctl+0xfc/0x170 [ 103.770224][ T5335] do_syscall_64+0x166/0x520 [ 103.772275][ T5335] ? trace_irq_disable+0x3b/0x140 [ 103.774478][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.777226][ T5335] ? clear_bhb_loop+0x70/0xc0 [ 103.779247][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.781478][ T5335] RIP: 0033:0x7f85e5d9f559 [ 103.783273][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.791278][ T5335] RSP: 002b:00007f85e21f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.794921][ T5335] RAX: ffffffffffffffda RBX: 00007f85e6025fa0 RCX: 00007f85e5d9f559 [ 103.798234][ T5335] RDX: 0000200000000340 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 103.801840][ T5335] RBP: 00007f85e5e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.805385][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.812786][ T5335] R13: 00007f85e6026038 R14: 00007f85e6025fa0 R15: 00007ffea46c7338 [ 103.816287][ T5335] [ 103.818030][ T5335] Kernel Offset: disabled [ 103.819870][ T5335] Rebooting in 86400 seconds..