program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_open_dev$dvb_frontend(&(0x7f0000000540), 0x0, 0x200200) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_mount_image$vfat(&(0x7f0000000440), &(0x7f0000000080)='./file1\x00', 0x800090, &(0x7f0000001400)={[{@iocharset={'iocharset', 0x3d, 'maciceland'}}, {@uni_xlate}, {@shortname_winnt}, {@numtail}, {@shortname_lower}, {@shortname_winnt}, {@uni_xlate}, {@fat=@uid}, {@fat=@check_strict}, {@uni_xlate}, {@shortname_win95}, {@rodir}, {@fat=@codepage={'codepage', 0x3d, '855'}}, {@shortname_lower}, {@utf8}, {@fat=@codepage={'codepage', 0x3d, '852'}}, {@uni_xlateno}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'iso8859-6'}}, {@shortname_lower}, {@nonumtail}, {@shortname_win95}, {@rodir}, {@utf8no}, {@nonumtail}, {@shortname_lower}, {@shortname_mixed}, {@utf8}], [{@appraise}, {@pcr={'pcr', 0x3d, 0x10}}]}, 0x6, 0x2d3, &(0x7f0000000a40)="$eJzs3b1rJGUYAPBnNrMfarFbWInggBZWx+Vamw1yB2Iqjy1OCw3eHUh2ES4Q8QPXq8TOxtK/QBD8Q2zsLAVbwc4IgZGZncl+ZNhsJBvx8vsVyZuZ55n3ed+ZJNPkyQcvTw4fZvH46Re/Ra+XRGvYjThJYhCtqH0VS4bfBgDwf3aS5/FnPtNw+tdv1uT2tlgXALA9F/z+r6TlxwdFxE/XVxsAsB33H7z79t7+/t13sqwX9yZfH4+SiCg+z87vPY6PYhyP4nb04zSifFFoR/m2UAzv5Xk+TbPCIF6bTI9HRebk/Z+r6+/9EVHm70Y/BuWhs7eNMv+t/bu72cxC/rSo4/lq/mGRfyf68eJZ8lL+nYb8GHXi9VcX6r8V/fjlw/g4xvGwLGKe/+Vulr2Zf/fX5+8V5RX5yfR41C3j5vKdevLpNd8jAAAAAAAAAAAAAAAAAAAAAACePbeq3jndKPv3FIeq/js7p8UX7chqg+X+PLP8pL7QvD9QtPI8n+bxfd1f53aWZXkVOM9P46W0aiwIAAAAAAAAAAAAAAAAAAAAN9zRp58dHozHj55cyaDuBpBGxN/3I/7tdYYLR16J9cHdas6D8bhVDZdj0sUjsVPHJBFryygWcUXbctHguXM1V4MffmzMKlZ0lEbTqd7Fk7ab57rk4JP2bB8bY+qn6/Agad7D7lnxveLGxeqN60Tz7O1YOdKp7+dqcP0obracTuOp/qW3pfNCOZiuiYlk3ffFG78vLSeJleBO2XGjMb1dDZp2Y/ZsbPQ8R2+Wfv5nRaJbBwAAAAAAAAAAAAAAAAAAbNX8r38bTj5dm9rKu1srCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACu1fz//28ySJeTN8jqxJOj/2ptAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Bz/BAAA//8a6VGq") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) (async) syz_open_dev$dvb_frontend(&(0x7f0000000540), 0x0, 0x200200) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) syz_mount_image$vfat(&(0x7f0000000440), &(0x7f0000000080)='./file1\x00', 0x800090, &(0x7f0000001400)={[{@iocharset={'iocharset', 0x3d, 'maciceland'}}, {@uni_xlate}, {@shortname_winnt}, {@numtail}, {@shortname_lower}, {@shortname_winnt}, {@uni_xlate}, {@fat=@uid}, {@fat=@check_strict}, {@uni_xlate}, {@shortname_win95}, {@rodir}, {@fat=@codepage={'codepage', 0x3d, '855'}}, {@shortname_lower}, {@utf8}, {@fat=@codepage={'codepage', 0x3d, '852'}}, {@uni_xlateno}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'iso8859-6'}}, {@shortname_lower}, {@nonumtail}, {@shortname_win95}, {@rodir}, {@utf8no}, {@nonumtail}, {@shortname_lower}, {@shortname_mixed}, {@utf8}], [{@appraise}, {@pcr={'pcr', 0x3d, 0x10}}]}, 0x6, 0x2d3, &(0x7f0000000a40)="$eJzs3b1rJGUYAPBnNrMfarFbWInggBZWx+Vamw1yB2Iqjy1OCw3eHUh2ES4Q8QPXq8TOxtK/QBD8Q2zsLAVbwc4IgZGZncl+ZNhsJBvx8vsVyZuZ55n3ed+ZJNPkyQcvTw4fZvH46Re/Ra+XRGvYjThJYhCtqH0VS4bfBgDwf3aS5/FnPtNw+tdv1uT2tlgXALA9F/z+r6TlxwdFxE/XVxsAsB33H7z79t7+/t13sqwX9yZfH4+SiCg+z87vPY6PYhyP4nb04zSifFFoR/m2UAzv5Xk+TbPCIF6bTI9HRebk/Z+r6+/9EVHm70Y/BuWhs7eNMv+t/bu72cxC/rSo4/lq/mGRfyf68eJZ8lL+nYb8GHXi9VcX6r8V/fjlw/g4xvGwLGKe/+Vulr2Zf/fX5+8V5RX5yfR41C3j5vKdevLpNd8jAAAAAAAAAAAAAAAAAAAAAACePbeq3jndKPv3FIeq/js7p8UX7chqg+X+PLP8pL7QvD9QtPI8n+bxfd1f53aWZXkVOM9P46W0aiwIAAAAAAAAAAAAAAAAAAAAN9zRp58dHozHj55cyaDuBpBGxN/3I/7tdYYLR16J9cHdas6D8bhVDZdj0sUjsVPHJBFryygWcUXbctHguXM1V4MffmzMKlZ0lEbTqd7Fk7ab57rk4JP2bB8bY+qn6/Agad7D7lnxveLGxeqN60Tz7O1YOdKp7+dqcP0obracTuOp/qW3pfNCOZiuiYlk3ffFG78vLSeJleBO2XGjMb1dDZp2Y/ZsbPQ8R2+Wfv5nRaJbBwAAAAAAAAAAAAAAAAAAbNX8r38bTj5dm9rKu1srCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACu1fz//28ySJeTN8jqxJOj/2ptAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Bz/BAAA//8a6VGq") (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) (async) [ 102.655820][ T4660] Bluetooth: hci0: command tx timeout [ 102.765822][ T5342] loop0: detected capacity change from 0 to 256 [ 102.867665][ T5341] ================================================================== [ 102.871139][ T5341] BUG: KFENCE: use-after-free read in dvb_frontend_release+0x150/0x4d0 [ 102.871139][ T5341] [ 102.875536][ T5341] Use-after-free read at 0xffff88805b30603c (in kfence-#130): [ 102.878658][ T5341] dvb_frontend_release+0x150/0x4d0 [ 102.880862][ T5341] __fput+0x44f/0xa60 [ 102.882559][ T5341] task_work_run+0x1d9/0x270 [ 102.884544][ T5341] get_signal+0x11eb/0x1330 [ 102.886516][ T5341] arch_do_signal_or_restart+0xbc/0x840 [ 102.888752][ T5341] exit_to_user_mode_loop+0xa9/0x680 [ 102.890988][ T5341] do_syscall_64+0x353/0x580 [ 102.892917][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.895375][ T5341] [ 102.896385][ T5341] kfence-#130: 0xffff88805b306000-0xffff88805b3060d7, size=216, cache=kmalloc-256 [ 102.896385][ T5341] [ 102.901106][ T5341] allocated by task 1 on cpu 0 at 26.019897s (76.881208s ago): [ 102.904167][ T5341] dvb_register_device+0x2fd/0x21e0 [ 102.906305][ T5341] dvb_register_frontend+0x61b/0x920 [ 102.908560][ T5341] vidtv_bridge_probe+0x9aa/0xf80 [ 102.910675][ T5341] platform_probe+0xf9/0x190 [ 102.912544][ T5341] really_probe+0x267/0xaf0 [ 102.914499][ T5341] __driver_probe_device+0x1ef/0x380 [ 102.916478][ T5341] driver_probe_device+0x4f/0x240 [ 102.918432][ T5341] __driver_attach+0x34c/0x640 [ 102.920443][ T5341] bus_for_each_dev+0x23b/0x2c0 [ 102.922513][ T5341] bus_add_driver+0x345/0x670 [ 102.924481][ T5341] driver_register+0x23a/0x320 [ 102.926516][ T5341] vidtv_bridge_init+0x28/0x50 [ 102.928622][ T5341] do_one_initcall+0x250/0x870 [ 102.930587][ T5341] do_initcall_level+0x104/0x190 [ 102.932604][ T5341] do_initcalls+0x59/0xa0 [ 102.934382][ T5341] kernel_init_freeable+0x2a6/0x3e0 [ 102.936433][ T5341] kernel_init+0x1d/0x1d0 [ 102.938159][ T5341] ret_from_fork+0x514/0xb70 [ 102.939941][ T5341] ret_from_fork_asm+0x1a/0x30 [ 102.941792][ T5341] [ 102.942730][ T5341] freed by task 5341 on cpu 0 at 102.867644s (0.075086s ago): [ 102.945687][ T5341] dvb_generic_release+0x11d/0x1b0 [ 102.947808][ T5341] dvb_frontend_release+0x132/0x4d0 [ 102.949974][ T5341] __fput+0x44f/0xa60 [ 102.951694][ T5341] task_work_run+0x1d9/0x270 [ 102.953673][ T5341] get_signal+0x11eb/0x1330 [ 102.955516][ T5341] arch_do_signal_or_restart+0xbc/0x840 [ 102.957794][ T5341] exit_to_user_mode_loop+0xa9/0x680 [ 102.959984][ T5341] do_syscall_64+0x353/0x580 [ 102.961989][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.964414][ T5341] [ 102.965523][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.969242][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.973169][ T5341] RIP: 0010:dvb_frontend_release+0x150/0x4d0 [ 102.975575][ T5341] Code: f9 4c 89 e7 4c 89 fe e8 ee b8 fd ff 89 c5 48 8b 04 24 4c 8d 78 3c 4c 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 a1 02 00 00 <45> 8b 3f bf ff ff ff ff 44 89 fe e8 10 36 de f9 41 83 ff ff 74 0a [ 102.982983][ T5341] RSP: 0018:ffffc9000e09fae8 EFLAGS: 00010246 [ 102.985453][ T5341] RAX: 0000000000000000 RBX: ffff888033374000 RCX: ffffffff8232d5a9 [ 102.988865][ T5341] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff9a4aea50 [ 102.992268][ T5341] RBP: 0000000000000000 R08: ffffffff9a4aea57 R09: 1ffffffff3495d4a [ 102.995613][ T5341] R10: dffffc0000000000 R11: fffffbfff3495d4b R12: ffff88803918f740 [ 102.999173][ T5341] R13: ffff888030436000 R14: dffffc0000000000 R15: ffff88805b30603c [ 103.002434][ T5341] FS: 0000555557a03540(0000) GS:ffff88808c895000(0000) knlGS:0000000000000000 [ 103.006178][ T5341] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.008987][ T5341] CR2: ffff88805b30603c CR3: 0000000044875000 CR4: 0000000000352ef0 [ 103.012366][ T5341] Call Trace: [ 103.013756][ T5341] [ 103.014985][ T5341] ? __pfx_dvb_frontend_release+0x10/0x10 [ 103.017435][ T5341] __fput+0x44f/0xa60 [ 103.019511][ T5341] task_work_run+0x1d9/0x270 [ 103.021877][ T5341] ? __pfx_task_work_run+0x10/0x10 [ 103.024122][ T5341] get_signal+0x11eb/0x1330 [ 103.026109][ T5341] ? __pfx___fput_deferred+0x10/0x10 [ 103.028409][ T5341] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.030511][ T5341] arch_do_signal_or_restart+0xbc/0x840 [ 103.032855][ T5341] ? do_raw_spin_unlock+0x4d/0x210 [ 103.035053][ T5341] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 103.037660][ T5341] exit_to_user_mode_loop+0xa9/0x680 [ 103.039871][ T5341] ? rcu_is_watching+0x15/0xb0 [ 103.041883][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.044397][ T5341] do_syscall_64+0x353/0x580 [ 103.046379][ T5341] ? clear_bhb_loop+0x40/0x90 [ 103.048405][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.050764][ T5341] RIP: 0033:0x7fb48219ce59 [ 103.052578][ T5341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.060608][ T5341] RSP: 002b:00007ffd3b9cba08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.064041][ T5341] RAX: 0000000000000000 RBX: 00007fb482417da0 RCX: 00007fb48219ce59 [ 103.067248][ T5341] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.070499][ T5341] RBP: 00007fb482417da0 R08: 0000000000000006 R09: 0000000000000000 [ 103.073651][ T5341] R10: 0000000000dffd24 R11: 0000000000000246 R12: 00000000000193f7 [ 103.076806][ T5341] R13: 00007fb48241609c R14: 00007fb482416098 R15: 00007fb482416090 [ 103.080030][ T5341] [ 103.081349][ T5341] ================================================================== [ 103.084612][ T5341] Kernel panic - not syncing: KFENCE: panic_on_warn set ... [ 103.087866][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.091040][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.094383][ T5341] Call Trace: [ 103.095522][ T5341] [ 103.096530][ T5341] vpanic+0x56c/0xa60 [ 103.098274][ T5341] ? __pfx_vpanic+0x10/0x10 [ 103.100230][ T5341] ? is_bpf_text_address+0x292/0x2b0 [ 103.102451][ T5341] panic+0xc5/0xd0 [ 103.104053][ T5341] ? __pfx_panic+0x10/0x10 [ 103.105904][ T5341] ? __pfx__printk+0x10/0x10 [ 103.107885][ T5341] check_panic_on_warn+0x89/0xb0 [ 103.110037][ T5341] kfence_report_error+0x75b/0xa50 [ 103.112201][ T5341] ? __pfx_kfence_report_error+0x10/0x10 [ 103.114517][ T5341] ? dvb_frontend_release+0x150/0x4d0 [ 103.116813][ T5341] ? __fput+0x44f/0xa60 [ 103.118633][ T5341] ? task_work_run+0x1d9/0x270 [ 103.120652][ T5341] ? get_signal+0x11eb/0x1330 [ 103.122596][ T5341] ? arch_do_signal_or_restart+0xbc/0x840 [ 103.124861][ T5341] ? exit_to_user_mode_loop+0xa9/0x680 [ 103.127114][ T5341] ? do_syscall_64+0x353/0x580 [ 103.129110][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.131795][ T5341] kfence_handle_page_fault+0x319/0x700 [ 103.134216][ T5341] ? __pfx_kfence_handle_page_fault+0x10/0x10 [ 103.136757][ T5341] page_fault_oops+0x1b6/0xa80 [ 103.138529][ T5341] ? lookup_address_in_pgd_attr+0x5c4/0x8c0 [ 103.140664][ T5341] ? __pfx_page_fault_oops+0x10/0x10 [ 103.143570][ T5341] ? is_prefetch+0x450/0x690 [ 103.145437][ T5341] ? __pfx_is_prefetch+0x10/0x10 [ 103.147123][ T5341] exc_page_fault+0x91/0xc0 [ 103.148633][ T5341] asm_exc_page_fault+0x26/0x30 [ 103.150174][ T5341] RIP: 0010:dvb_frontend_release+0x150/0x4d0 [ 103.152124][ T5341] Code: f9 4c 89 e7 4c 89 fe e8 ee b8 fd ff 89 c5 48 8b 04 24 4c 8d 78 3c 4c 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 a1 02 00 00 <45> 8b 3f bf ff ff ff ff 44 89 fe e8 10 36 de f9 41 83 ff ff 74 0a [ 103.159854][ T5341] RSP: 0018:ffffc9000e09fae8 EFLAGS: 00010246 [ 103.162513][ T5341] RAX: 0000000000000000 RBX: ffff888033374000 RCX: ffffffff8232d5a9 [ 103.165956][ T5341] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff9a4aea50 [ 103.169399][ T5341] RBP: 0000000000000000 R08: ffffffff9a4aea57 R09: 1ffffffff3495d4a [ 103.172397][ T5341] R10: dffffc0000000000 R11: fffffbfff3495d4b R12: ffff88803918f740 [ 103.175265][ T5341] R13: ffff888030436000 R14: dffffc0000000000 R15: ffff88805b30603c [ 103.178232][ T5341] ? kfence_guarded_free+0xac9/0xe10 [ 103.180400][ T5341] ? dvb_frontend_release+0x132/0x4d0 [ 103.182303][ T5341] ? __pfx_dvb_frontend_release+0x10/0x10 [ 103.184577][ T5341] __fput+0x44f/0xa60 [ 103.186418][ T5341] task_work_run+0x1d9/0x270 [ 103.188488][ T5341] ? __pfx_task_work_run+0x10/0x10 [ 103.190717][ T5341] get_signal+0x11eb/0x1330 [ 103.192620][ T5341] ? __pfx___fput_deferred+0x10/0x10 [ 103.194816][ T5341] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.196938][ T5341] arch_do_signal_or_restart+0xbc/0x840 [ 103.199239][ T5341] ? do_raw_spin_unlock+0x4d/0x210 [ 103.201371][ T5341] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 103.203896][ T5341] exit_to_user_mode_loop+0xa9/0x680 [ 103.206068][ T5341] ? rcu_is_watching+0x15/0xb0 [ 103.208050][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.210568][ T5341] do_syscall_64+0x353/0x580 [ 103.212428][ T5341] ? clear_bhb_loop+0x40/0x90 [ 103.214366][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.216684][ T5341] RIP: 0033:0x7fb48219ce59 [ 103.218510][ T5341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.225293][ T5341] RSP: 002b:00007ffd3b9cba08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.228291][ T5341] RAX: 0000000000000000 RBX: 00007fb482417da0 RCX: 00007fb48219ce59 [ 103.231458][ T5341] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.234518][ T5341] RBP: 00007fb482417da0 R08: 0000000000000006 R09: 0000000000000000 [ 103.237755][ T5341] R10: 0000000000dffd24 R11: 0000000000000246 R12: 00000000000193f7 [ 103.241081][ T5341] R13: 00007fb48241609c R14: 00007fb482416098 R15: 00007fb482416090 [ 103.244323][ T5341] [ 103.246121][ T5341] Kernel Offset: disabled [ 103.248565][ T5341] Rebooting in 86400 seconds..