program: r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) r1 = syz_open_dev$dmmidi(&(0x7f0000000480), 0x2, 0x80000) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r1, 0x40045731, 0x0) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0xa82, 0x0) ioctl$OCFS2_IOC_GROUP_ADD64(r0, 0x40186f03, &(0x7f0000000180)={0x331b, 0xffffffff, 0x5, 0x3}) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000e80)={0x4, 0x0, 0x0, 0x178, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r3}, [@snapshot={0x0, 0x1018, 0x0, 0x40, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x1}, 0x20, 'N', 0x20, '0'}}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0xfffffffffffffff4, 0x0}, 0x200480d0) r4 = io_uring_setup(0x1001195, &(0x7f0000000300)={0x0, 0xadec, 0x8, 0x3, 0xc}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r6, 0x4040ae77, &(0x7f0000000280)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000005c0)={[0x4, 0x7, 0x0, 0x184, 0x671, 0x10, 0xf1, 0x100000001, 0x1, 0x5, 0x7, 0x29, 0x0, 0x2, 0x0, 0xbd9], 0xffff1001, 0x53101}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000006c0)={[0x3, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0xa7f, 0x68ff, 0x0, 0x8000000009, 0x803, 0x26c00, 0x9, 0x2], 0xeeee8000, 0x102280}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000007c0)={0x1, &(0x7f0000000800)=[{0x6, 0x80, 0x0, 0x7ff00000}]}) socket$packet(0x11, 0x3, 0x300) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000840)='source', 0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000a40)={{0x3000, 0x1, 0x8, 0x8, 0x3, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x1, 0x5, 0x75, 0x6, 0x36, 0xe, 0x2, 0x87}, {0x0, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x4, 0x6, 0x2, 0x7e, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0xd000, 0xf, 0x3, 0x16, 0x87, 0xab, 0x8, 0x9, 0x9, 0xf8, 0x97}, {0xeeefa000, 0x0, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x18227000, 0xe, 0x5, 0x7, 0x5, 0x7, 0x43, 0x8, 0x81, 0x42, 0x70}, {0xdddd0000, 0xa000, 0xa, 0x5, 0xcd, 0x7, 0x9, 0x9, 0x2, 0xc, 0xb0, 0x91}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x1, 0x0, 0x3000, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r7, 0xae80, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0xac, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [0x2], 0x0, [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe], [0x0, 0x0, 0x0, 0x10, 0x6]}}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION={0xc, 0x9, 0x4bd8}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x6}]}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0xfff}]}, 0xac}}, 0x0) getsockname$packet(r8, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) bind$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, r11, 0x1, 0x0, 0x6, @link_local}, 0x14) io_uring_enter(r4, 0x2219, 0xcf74, 0x16, 0x0, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f00000004c0), 0x202080, 0x0) [ 102.677165][ T4660] Bluetooth: hci0: command tx timeout [ 102.878572][ T5345] ================================================================== [ 102.878631][ T5345] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 102.883981][ T5345] Read of size 8 at addr ffff888041252398 by task syz.0.0/5345 [ 102.884050][ T5345] [ 102.884117][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.884169][ T5345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.884187][ T5345] Call Trace: [ 102.884208][ T5345] [ 102.884242][ T5345] dump_stack_lvl+0xe8/0x150 [ 102.884281][ T5345] print_address_description+0x55/0x1e0 [ 102.884299][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 102.884313][ T5345] print_report+0x58/0x70 [ 102.884327][ T5345] kasan_report+0x117/0x150 [ 102.884358][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 102.884377][ T5345] snapshot_ctr+0x5cb/0x1340 [ 102.884396][ T5345] ? __pfx_snapshot_ctr+0x10/0x10 [ 102.884411][ T5345] ? skip_spaces+0x8a/0xa0 [ 102.884547][ T5345] ? dm_split_args+0x50b/0x5d0 [ 102.884565][ T5345] dm_table_add_target+0x58d/0xc70 [ 102.884584][ T5345] table_load+0x325/0x8a0 [ 102.884598][ T5345] ? __pfx_table_load+0x10/0x10 [ 102.884613][ T5345] dm_ctl_ioctl+0x9ec/0xe10 [ 102.884627][ T5345] ? __pfx_table_load+0x10/0x10 [ 102.884638][ T5345] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 102.884657][ T5345] ? __fget_files+0x2a/0x420 [ 102.884669][ T5345] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.884686][ T5345] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 102.884697][ T5345] __se_sys_ioctl+0xfc/0x170 [ 102.884713][ T5345] do_syscall_64+0x166/0x520 [ 102.884774][ T5345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.884788][ T5345] ? clear_bhb_loop+0x70/0xc0 [ 102.884801][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.884814][ T5345] RIP: 0033:0x7f8c0299f559 [ 102.884828][ T5345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.884841][ T5345] RSP: 002b:00007f8c037cafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.884873][ T5345] RAX: ffffffffffffffda RBX: 00007f8c02c25fa0 RCX: 00007f8c0299f559 [ 102.884882][ T5345] RDX: 0000200000000e80 RSI: 00000000c138fd09 RDI: 0000000000000005 [ 102.884892][ T5345] RBP: 00007f8c02a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 102.884900][ T5345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.884908][ T5345] R13: 00007f8c02c26038 R14: 00007f8c02c25fa0 R15: 00007ffe0006aa38 [ 102.884922][ T5345] [ 102.884928][ T5345] [ 102.884931][ T5345] Allocated by task 5345: [ 102.884946][ T5345] kasan_save_track+0x3e/0x80 [ 102.884962][ T5345] __kasan_kmalloc+0x93/0xb0 [ 102.884975][ T5345] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 102.884987][ T5345] dm_get_table_device+0x23e/0x730 [ 102.885000][ T5345] dm_get_device+0x327/0x760 [ 102.885010][ T5345] snapshot_ctr+0x2b2/0x1340 [ 102.885024][ T5345] dm_table_add_target+0x58d/0xc70 [ 102.885035][ T5345] table_load+0x325/0x8a0 [ 102.885057][ T5345] dm_ctl_ioctl+0x9ec/0xe10 [ 102.885069][ T5345] __se_sys_ioctl+0xfc/0x170 [ 102.885083][ T5345] do_syscall_64+0x166/0x520 [ 102.885099][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.885111][ T5345] [ 102.885115][ T5345] Freed by task 5345: [ 102.885121][ T5345] kasan_save_track+0x3e/0x80 [ 102.885134][ T5345] kasan_save_free_info+0x40/0x50 [ 102.885145][ T5345] __kasan_slab_free+0x5c/0x80 [ 102.885160][ T5345] kfree+0x1c5/0x650 [ 102.885169][ T5345] dm_put_table_device+0x255/0x2a0 [ 102.885181][ T5345] dm_get_device+0x56f/0x760 [ 102.885191][ T5345] snapshot_ctr+0x471/0x1340 [ 102.885205][ T5345] dm_table_add_target+0x58d/0xc70 [ 102.885216][ T5345] table_load+0x325/0x8a0 [ 102.885226][ T5345] dm_ctl_ioctl+0x9ec/0xe10 [ 102.885235][ T5345] __se_sys_ioctl+0xfc/0x170 [ 102.885246][ T5345] do_syscall_64+0x166/0x520 [ 102.885254][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.885264][ T5345] [ 102.885267][ T5345] The buggy address belongs to the object at ffff888041252380 [ 102.885267][ T5345] which belongs to the cache kmalloc-96 of size 96 [ 102.885292][ T5345] The buggy address is located 24 bytes inside of [ 102.885292][ T5345] freed 96-byte region [ffff888041252380, ffff8880412523e0) [ 102.885304][ T5345] [ 102.885308][ T5345] The buggy address belongs to the physical page: [ 102.885316][ T5345] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x41252 [ 102.885329][ T5345] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 102.885342][ T5345] page_type: f5(slab) [ 102.885353][ T5345] raw: 04fff00000000000 ffff88801c041280 dead000000000100 dead000000000122 [ 102.885365][ T5345] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 102.885371][ T5345] page dumped because: kasan: bad access detected [ 102.885377][ T5345] page_owner tracks the page as allocated [ 102.885381][ T5345] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 37, tgid 37 (kworker/u4:2), ts 28593948011 [ 102.885399][ T5345] post_alloc_hook+0x1f9/0x250 [ 102.885410][ T5345] get_page_from_freelist+0x2209/0x2280 [ 102.885422][ T5345] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 102.885433][ T5345] allocate_slab+0x7d/0x620 [ 102.885447][ T5345] refill_objects+0x2d5/0x350 [ 102.885461][ T5345] __pcs_replace_empty_main+0x2c8/0x6c0 [ 102.885475][ T5345] __kmalloc_noprof+0x476/0x710 [ 102.885484][ T5345] security_task_alloc+0x4d/0x330 [ 102.885527][ T5345] copy_process+0x1c75/0x44b0 [ 102.885560][ T5345] kernel_clone+0x2d7/0x940 [ 102.885575][ T5345] user_mode_thread+0x115/0x180 [ 102.885589][ T5345] call_usermodehelper_exec_work+0x5c/0x230 [ 102.885602][ T5345] process_scheduled_works+0xc3d/0x1630 [ 102.885614][ T5345] worker_thread+0xa47/0xfb0 [ 102.885628][ T5345] kthread+0x38b/0x480 [ 102.885639][ T5345] ret_from_fork+0x514/0xb70 [ 102.885651][ T5345] page last free pid 37 tgid 37 ts 28593875945 stack trace: [ 102.885675][ T5345] __free_frozen_pages+0xc93/0xd90 [ 102.885687][ T5345] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 102.885700][ T5345] alloc_vmap_area+0xd10/0x1410 [ 102.885719][ T5345] __get_vm_area_node+0x200/0x2f0 [ 102.885736][ T5345] __vmalloc_node_range_noprof+0x343/0x1540 [ 102.885745][ T5345] __vmalloc_node_noprof+0xc2/0x100 [ 102.885754][ T5345] dup_task_struct+0x2c6/0xa00 [ 102.885766][ T5345] copy_process+0x7ea/0x44b0 [ 102.885777][ T5345] kernel_clone+0x2d7/0x940 [ 102.885789][ T5345] user_mode_thread+0x115/0x180 [ 102.885801][ T5345] call_usermodehelper_exec_work+0x5c/0x230 [ 102.885812][ T5345] process_scheduled_works+0xc3d/0x1630 [ 102.885824][ T5345] worker_thread+0xa47/0xfb0 [ 102.885837][ T5345] kthread+0x38b/0x480 [ 102.885846][ T5345] ret_from_fork+0x514/0xb70 [ 102.885855][ T5345] ret_from_fork_asm+0x1a/0x30 [ 102.885865][ T5345] [ 102.885868][ T5345] Memory state around the buggy address: [ 102.885875][ T5345] ffff888041252280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 102.885882][ T5345] ffff888041252300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 102.885890][ T5345] >ffff888041252380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 102.885894][ T5345] ^ [ 102.885901][ T5345] ffff888041252400: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 102.885907][ T5345] ffff888041252480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 102.885912][ T5345] ================================================================== [ 103.373203][ T5345] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.376619][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.380648][ T5345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.385255][ T5345] Call Trace: [ 103.386920][ T5345] [ 103.388350][ T5345] vpanic+0x56d/0xa60 [ 103.390282][ T5345] ? __pfx_vpanic+0x10/0x10 [ 103.392235][ T5345] panic+0xc5/0xd0 [ 103.393895][ T5345] ? __pfx_panic+0x10/0x10 [ 103.395915][ T5345] ? preempt_schedule_thunk+0x16/0x40 [ 103.398178][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 103.400331][ T5345] ? preempt_schedule_thunk+0x16/0x40 [ 103.402726][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 103.404852][ T5345] check_panic_on_warn+0x89/0xb0 [ 103.407025][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 103.409070][ T5345] end_report+0x73/0x170 [ 103.410980][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 103.412960][ T5345] kasan_report+0x128/0x150 [ 103.414786][ T5345] ? snapshot_ctr+0x5cb/0x1340 [ 103.416832][ T5345] snapshot_ctr+0x5cb/0x1340 [ 103.418796][ T5345] ? __pfx_snapshot_ctr+0x10/0x10 [ 103.421088][ T5345] ? skip_spaces+0x8a/0xa0 [ 103.423185][ T5345] ? dm_split_args+0x50b/0x5d0 [ 103.425147][ T5345] dm_table_add_target+0x58d/0xc70 [ 103.427414][ T5345] table_load+0x325/0x8a0 [ 103.429198][ T5345] ? __pfx_table_load+0x10/0x10 [ 103.435712][ T5345] dm_ctl_ioctl+0x9ec/0xe10 [ 103.438209][ T5345] ? __pfx_table_load+0x10/0x10 [ 103.440202][ T5345] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.442479][ T5345] ? __fget_files+0x2a/0x420 [ 103.444434][ T5345] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.446772][ T5345] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.448971][ T5345] __se_sys_ioctl+0xfc/0x170 [ 103.450958][ T5345] do_syscall_64+0x166/0x520 [ 103.452803][ T5345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.455410][ T5345] ? clear_bhb_loop+0x70/0xc0 [ 103.457312][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.459955][ T5345] RIP: 0033:0x7f8c0299f559 [ 103.462008][ T5345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.470117][ T5345] RSP: 002b:00007f8c037cafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.473536][ T5345] RAX: ffffffffffffffda RBX: 00007f8c02c25fa0 RCX: 00007f8c0299f559 [ 103.477754][ T5345] RDX: 0000200000000e80 RSI: 00000000c138fd09 RDI: 0000000000000005 [ 103.480980][ T5345] RBP: 00007f8c02a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.484526][ T5345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.488018][ T5345] R13: 00007f8c02c26038 R14: 00007f8c02c25fa0 R15: 00007ffe0006aa38 [ 103.497318][ T5345] [ 103.499351][ T5345] Kernel Offset: disabled [ 103.501207][ T5345] Rebooting in 86400 seconds..