program:
openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000)=0x7, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)
[ 92.518793][ T10] cfg80211: failed to load regulatory.db
[ 92.632980][ T4642] Bluetooth: hci0: command tx timeout
[ 93.472647][ T5311] ==================================================================
[ 93.481158][ T5311] BUG: KASAN: use-after-free in release_card_device+0x1ab/0x1b0
[ 93.491692][ T5311] Read of size 1 at addr ffff88803f5b8909 by task syz.0.0/5311
[ 93.503005][ T5311]
[ 93.504743][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.504761][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.504769][ T5311] Call Trace:
[ 93.504778][ T5311]
[ 93.504785][ T5311] dump_stack_lvl+0xe8/0x150
[ 93.504808][ T5311] print_address_description+0x55/0x1e0
[ 93.504826][ T5311] ? release_card_device+0x1ab/0x1b0
[ 93.504841][ T5311] print_report+0x58/0x70
[ 93.504852][ T5311] kasan_report+0x117/0x150
[ 93.504866][ T5311] ? release_card_device+0x1ab/0x1b0
[ 93.504879][ T5311] release_card_device+0x1ab/0x1b0
[ 93.504892][ T5311] ? __pfx_release_card_device+0x10/0x10
[ 93.504903][ T5311] device_release+0xc4/0x1f0
[ 93.504961][ T5311] kobject_put+0x222/0x550
[ 93.504977][ T5311] snd_card_file_remove+0x331/0x390
[ 93.504992][ T5311] snd_pcm_oss_release+0x1fe/0x250
[ 93.505004][ T5311] ? __pfx_snd_disconnect_release+0x10/0x10
[ 93.505019][ T5311] __fput+0x418/0xa50
[ 93.505033][ T5311] task_work_run+0x1d9/0x270
[ 93.505050][ T5311] ? __pfx_task_work_run+0x10/0x10
[ 93.505065][ T5311] exit_to_user_mode_loop+0x1fa/0x730
[ 93.505080][ T5311] ? rcu_is_watching+0x15/0xb0
[ 93.505095][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.505105][ T5311] do_syscall_64+0x353/0x580
[ 93.505119][ T5311] ? clear_bhb_loop+0x70/0xc0
[ 93.505152][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.505163][ T5311] RIP: 0033:0x7fbb5739e0d9
[ 93.505175][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.505185][ T5311] RSP: 002b:00007ffd661b9ab8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 93.505198][ T5311] RAX: 0000000000000000 RBX: 00007fbb57627da0 RCX: 00007fbb5739e0d9
[ 93.505207][ T5311] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 93.505214][ T5311] RBP: 00007fbb57627da0 R08: 0000000000000006 R09: 0000000000000000
[ 93.505221][ T5311] R10: 00007fbb57627cb0 R11: 0000000000000246 R12: 0000000000016c33
[ 93.505229][ T5311] R13: 00007fbb57625fac R14: 000000000001693d R15: 00007ffd661b9bc0
[ 93.505242][ T5311]
[ 93.505247][ T5311]
[ 93.772693][ T5311] The buggy address belongs to the physical page:
[ 93.793264][ T5311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f5b8
[ 93.810043][ T5311] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 93.816040][ T5311] raw: 04fff00000000000 ffffea00013fad08 ffff88801fc412c0 0000000000000000
[ 93.819543][ T5311] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 93.837810][ T5311] page dumped because: kasan: bad access detected
[ 93.861746][ T5311] page_owner tracks the page as freed
[ 93.865243][ T5311] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x92cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_NOMEMALLOC), pid 5312, tgid 5311 (syz.0.0), ts 93471883639, free_ts 93471936339
[ 93.879615][ T5311] post_alloc_hook+0x1f9/0x250
[ 93.897074][ T5311] get_page_from_freelist+0x21fa/0x2270
[ 93.900623][ T5311] __alloc_frozen_pages_noprof+0x18d/0x380
[ 93.904538][ T5311] alloc_pages_mpol+0x212/0x380
[ 93.907785][ T5311] alloc_pages_noprof+0xac/0x2a0
[ 93.911189][ T5311] stack_depot_save_flags+0x735/0x800
[ 93.922261][ T5311] kasan_save_track+0x4f/0x80
[ 93.924417][ T5311] __kasan_kmalloc+0x93/0xb0
[ 93.926564][ T5311] __kmalloc_cache_noprof+0x32d/0x660
[ 93.928807][ T5311] kobject_uevent_env+0x289/0x9e0
[ 93.941404][ T5311] device_release_driver_internal+0x782/0x880
[ 93.945132][ T5311] unbind_store+0x1a1/0x1d0
[ 93.947966][ T5311] kernfs_fop_write_iter+0x3a4/0x540
[ 93.951213][ T5311] vfs_write+0x612/0xba0
[ 93.960416][ T5311] ksys_write+0x150/0x270
[ 93.962435][ T5311] do_syscall_64+0x174/0x580
[ 93.964581][ T5311] page last free pid 5312 tgid 5311 stack trace:
[ 93.967509][ T5311] __free_frozen_pages+0xc1e/0xd10
[ 93.969818][ T5311] stack_depot_save_flags+0x407/0x800
[ 93.983198][ T5311] kasan_save_track+0x4f/0x80
[ 93.986041][ T5311] __kasan_kmalloc+0x93/0xb0
[ 93.992975][ T5311] __kmalloc_cache_noprof+0x32d/0x660
[ 94.001558][ T5311] kobject_uevent_env+0x289/0x9e0
[ 94.006093][ T5311] device_release_driver_internal+0x782/0x880
[ 94.013294][ T5311] unbind_store+0x1a1/0x1d0
[ 94.023028][ T5311] kernfs_fop_write_iter+0x3a4/0x540
[ 94.026915][ T5311] vfs_write+0x612/0xba0
[ 94.031040][ T5311] ksys_write+0x150/0x270
[ 94.038035][ T5311] do_syscall_64+0x174/0x580
[ 94.040979][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.049644][ T5311]
[ 94.051387][ T5311] Memory state around the buggy address:
[ 94.058915][ T5311] ffff88803f5b8800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 94.067670][ T5311] ffff88803f5b8880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 94.078892][ T5311] >ffff88803f5b8900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 94.084334][ T5311] ^
[ 94.087526][ T5311] ffff88803f5b8980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 94.097857][ T5311] ffff88803f5b8a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 94.101242][ T5311] ==================================================================
[ 94.143584][ T5311] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.148189][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.154004][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.161509][ T5311] Call Trace:
[ 94.163463][ T5311]
[ 94.180639][ T5311] vpanic+0x56c/0xa60
[ 94.182665][ T5311] ? __pfx_vpanic+0x10/0x10
[ 94.185129][ T5311] panic+0xc5/0xd0
[ 94.186976][ T5311] ? __pfx_panic+0x10/0x10
[ 94.188745][ T5311] ? preempt_schedule_thunk+0x16/0x40
[ 94.211650][ T5311] ? release_card_device+0x1ab/0x1b0
[ 94.214086][ T5311] ? preempt_schedule_thunk+0x16/0x40
[ 94.216524][ T5311] ? release_card_device+0x1ab/0x1b0
[ 94.219065][ T5311] check_panic_on_warn+0x89/0xb0
[ 94.229450][ T5311] ? release_card_device+0x1ab/0x1b0
[ 94.232136][ T5311] end_report+0x73/0x170
[ 94.234122][ T5311] ? release_card_device+0x1ab/0x1b0
[ 94.243265][ T5311] kasan_report+0x128/0x150
[ 94.251637][ T5311] ? release_card_device+0x1ab/0x1b0
[ 94.254920][ T5311] release_card_device+0x1ab/0x1b0
[ 94.260202][ T5311] ? __pfx_release_card_device+0x10/0x10
[ 94.269420][ T5311] device_release+0xc4/0x1f0
[ 94.275380][ T5311] kobject_put+0x222/0x550
[ 94.280543][ T5311] snd_card_file_remove+0x331/0x390
[ 94.290677][ T5311] snd_pcm_oss_release+0x1fe/0x250
[ 94.295363][ T5311] ? __pfx_snd_disconnect_release+0x10/0x10
[ 94.299370][ T5311] __fput+0x418/0xa50
[ 94.307542][ T5311] task_work_run+0x1d9/0x270
[ 94.310686][ T5311] ? __pfx_task_work_run+0x10/0x10
[ 94.318056][ T5311] exit_to_user_mode_loop+0x1fa/0x730
[ 94.321481][ T5311] ? rcu_is_watching+0x15/0xb0
[ 94.324357][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.329014][ T5311] do_syscall_64+0x353/0x580
[ 94.331847][ T5311] ? clear_bhb_loop+0x70/0xc0
[ 94.334334][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.336723][ T5311] RIP: 0033:0x7fbb5739e0d9
[ 94.338590][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.352131][ T5311] RSP: 002b:00007ffd661b9ab8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 94.357162][ T5311] RAX: 0000000000000000 RBX: 00007fbb57627da0 RCX: 00007fbb5739e0d9
[ 94.362683][ T5311] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 94.367479][ T5311] RBP: 00007fbb57627da0 R08: 0000000000000006 R09: 0000000000000000
[ 94.383360][ T5311] R10: 00007fbb57627cb0 R11: 0000000000000246 R12: 0000000000016c33
[ 94.387093][ T5311] R13: 00007fbb57625fac R14: 000000000001693d R15: 00007ffd661b9bc0
[ 94.391133][ T5311]
[ 94.399036][ T5311] Kernel Offset: disabled
[ 94.401147][ T5311] Rebooting in 86400 seconds..