program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x26, 0x5, 0x0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_FRONTEND_TUNE_MODE(r4, 0x6f51, 0x0) close(0x3) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_buf(r3, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d424000000000000000100000051000000", 0xfe60) r5 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1e}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {}, 0x0, 0x6e6bb9, 0x1}, {{@in=@remote, 0xfffffffc, 0x32}, 0x0, @in=@empty, 0x0, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7, 0x0, 0xfffd}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x15, 0x0, 0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @random}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x1}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x20040804}, 0x4000050) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=@newsa={0x138, 0x16, 0x633, 0x0, 0x80000000, {{@in=@multicast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in=@remote, 0x4d2, 0x32}, @in6=@loopback, {}, {0x5, 0xc, 0x0, 0x5}, {0x4, 0xfffffffd}, 0x2, 0x2, 0x2, 0x4, 0x18}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0) [ 102.312714][ T46] Bluetooth: hci0: command tx timeout [ 102.549286][ T5325] netlink: 64 bytes leftover after parsing attributes in process `syz.0.0'. [ 103.090487][ T5323] ================================================================== [ 103.090511][ T5323] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 103.090606][ T5323] Read of size 4 at addr ffff888037d91a3c by task syz.0.0/5323 [ 103.090617][ T5323] [ 103.090642][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.090654][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.090660][ T5323] Call Trace: [ 103.090665][ T5323] [ 103.090670][ T5323] dump_stack_lvl+0xe8/0x150 [ 103.090686][ T5323] print_address_description+0x55/0x1e0 [ 103.090701][ T5323] ? dvb_frontend_release+0x407/0x4d0 [ 103.090722][ T5323] print_report+0x58/0x70 [ 103.090734][ T5323] kasan_report+0x117/0x150 [ 103.090747][ T5323] ? dvb_frontend_release+0x407/0x4d0 [ 103.090760][ T5323] dvb_frontend_release+0x407/0x4d0 [ 103.090772][ T5323] ? __pfx_dvb_frontend_release+0x10/0x10 [ 103.090785][ T5323] __fput+0x418/0xa50 [ 103.090798][ T5323] task_work_run+0x1d9/0x270 [ 103.090811][ T5323] ? __pfx_task_work_run+0x10/0x10 [ 103.090824][ T5323] get_signal+0x1181/0x12c0 [ 103.090839][ T5323] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.090855][ T5323] arch_do_signal_or_restart+0xbb/0x860 [ 103.090870][ T5323] ? do_raw_spin_unlock+0x4d/0x200 [ 103.090884][ T5323] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 103.090903][ T5323] exit_to_user_mode_loop+0x10e/0x770 [ 103.090915][ T5323] ? rcu_is_watching+0x16/0xb0 [ 103.090928][ T5323] do_syscall_64+0x328/0x520 [ 103.090942][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.090953][ T5323] ? clear_bhb_loop+0x70/0xc0 [ 103.090964][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.090974][ T5323] RIP: 0033:0x7f800a79e159 [ 103.090993][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.091011][ T5323] RSP: 002b:00007ffc61bad608 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.091039][ T5323] RAX: 0000000000000000 RBX: 00007f800aa27da0 RCX: 00007f800a79e159 [ 103.091045][ T5323] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.091051][ T5323] RBP: 00007f800aa27da0 R08: 00007f800aa26038 R09: 0000000000000000 [ 103.091057][ T5323] R10: 0000000000de25a0 R11: 0000000000000246 R12: 000000000001923f [ 103.091064][ T5323] R13: 00007f800aa2609c R14: 0000000000019020 R15: 00007f800aa26090 [ 103.091076][ T5323] [ 103.091080][ T5323] [ 103.091083][ T5323] Allocated by task 1: [ 103.091088][ T5323] kasan_save_track+0x3e/0x80 [ 103.091098][ T5323] __kasan_kmalloc+0x93/0xb0 [ 103.091107][ T5323] __kmalloc_cache_noprof+0x321/0x600 [ 103.091121][ T5323] dvb_register_device+0x309/0x1dd0 [ 103.091131][ T5323] dvb_register_frontend+0x603/0x900 [ 103.091142][ T5323] vidtv_bridge_probe+0x9d5/0xf60 [ 103.091151][ T5323] platform_probe+0xf9/0x190 [ 103.091187][ T5323] really_probe+0x254/0xae0 [ 103.091198][ T5323] __driver_probe_device+0x1e8/0x360 [ 103.091207][ T5323] driver_probe_device+0x4f/0x240 [ 103.091217][ T5323] __driver_attach+0x339/0x600 [ 103.091226][ T5323] bus_for_each_dev+0x23b/0x2c0 [ 103.091239][ T5323] bus_add_driver+0x345/0x670 [ 103.091251][ T5323] driver_register+0x23a/0x320 [ 103.091262][ T5323] vidtv_bridge_init+0x3d/0x60 [ 103.091380][ T5323] do_one_initcall+0x250/0x870 [ 103.091393][ T5323] do_initcall_level+0x10a/0x1a0 [ 103.091406][ T5323] do_initcalls+0x59/0xa0 [ 103.091418][ T5323] kernel_init_freeable+0x29d/0x3e0 [ 103.091430][ T5323] kernel_init+0x22/0x1d0 [ 103.091438][ T5323] ret_from_fork+0x514/0xb70 [ 103.091447][ T5323] ret_from_fork_asm+0x1a/0x30 [ 103.091460][ T5323] [ 103.091463][ T5323] Freed by task 5323: [ 103.091468][ T5323] kasan_save_track+0x3e/0x80 [ 103.091476][ T5323] kasan_save_free_info+0x40/0x50 [ 103.091488][ T5323] __kasan_slab_free+0x5c/0x80 [ 103.091496][ T5323] kfree+0x1c5/0x650 [ 103.091507][ T5323] dvb_generic_release+0x11d/0x1b0 [ 103.091520][ T5323] dvb_frontend_release+0x132/0x4d0 [ 103.091532][ T5323] __fput+0x418/0xa50 [ 103.091542][ T5323] task_work_run+0x1d9/0x270 [ 103.091552][ T5323] get_signal+0x1181/0x12c0 [ 103.091563][ T5323] arch_do_signal_or_restart+0xbb/0x860 [ 103.091573][ T5323] exit_to_user_mode_loop+0x10e/0x770 [ 103.091580][ T5323] do_syscall_64+0x328/0x520 [ 103.091588][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.091594][ T5323] [ 103.091595][ T5323] The buggy address belongs to the object at ffff888037d91a00 [ 103.091595][ T5323] which belongs to the cache kmalloc-256 of size 256 [ 103.091610][ T5323] The buggy address is located 60 bytes inside of [ 103.091610][ T5323] freed 256-byte region [ffff888037d91a00, ffff888037d91b00) [ 103.091617][ T5323] [ 103.091618][ T5323] The buggy address belongs to the physical page: [ 103.091623][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37d91 [ 103.091631][ T5323] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 103.091638][ T5323] page_type: f5(slab) [ 103.091654][ T5323] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 103.091659][ T5323] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 103.091663][ T5323] page dumped because: kasan: bad access detected [ 103.091667][ T5323] page_owner tracks the page as allocated [ 103.091669][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 22185622096 [ 103.091680][ T5323] post_alloc_hook+0x1f9/0x250 [ 103.091689][ T5323] get_page_from_freelist+0x2209/0x2280 [ 103.091695][ T5323] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 103.091701][ T5323] allocate_slab+0x7d/0x620 [ 103.091708][ T5323] refill_objects+0x2d5/0x350 [ 103.091715][ T5323] __pcs_replace_empty_main+0x2c8/0x6c0 [ 103.091723][ T5323] __kmalloc_cache_noprof+0x39b/0x600 [ 103.091731][ T5323] bus_add_driver+0x162/0x670 [ 103.091739][ T5323] driver_register+0x23a/0x320 [ 103.091746][ T5323] usb_register_driver+0x1e4/0x390 [ 103.091755][ T5323] do_one_initcall+0x250/0x870 [ 103.091767][ T5323] do_initcall_level+0x10a/0x1a0 [ 103.091778][ T5323] do_initcalls+0x59/0xa0 [ 103.091788][ T5323] kernel_init_freeable+0x29d/0x3e0 [ 103.091799][ T5323] kernel_init+0x22/0x1d0 [ 103.091806][ T5323] ret_from_fork+0x514/0xb70 [ 103.091815][ T5323] page last free pid 37 tgid 37 ts 22184950240 stack trace: [ 103.091822][ T5323] __free_frozen_pages+0xc93/0xd90 [ 103.091834][ T5323] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 103.091848][ T5323] alloc_vmap_area+0xd1a/0x1420 [ 103.091860][ T5323] __get_vm_area_node+0x200/0x2f0 [ 103.091871][ T5323] __vmalloc_node_range_noprof+0x343/0x1540 [ 103.091884][ T5323] __vmalloc_node_noprof+0xc2/0x100 [ 103.091895][ T5323] dup_task_struct+0x2c6/0xa00 [ 103.091907][ T5323] copy_process+0x7e0/0x4400 [ 103.091918][ T5323] kernel_clone+0x2d7/0x940 [ 103.091930][ T5323] user_mode_thread+0x115/0x180 [ 103.091942][ T5323] call_usermodehelper_exec_work+0x5c/0x230 [ 103.091954][ T5323] process_scheduled_works+0xc3d/0x1630 [ 103.091966][ T5323] worker_thread+0xa47/0xfb0 [ 103.091978][ T5323] kthread+0x38b/0x480 [ 103.091986][ T5323] ret_from_fork+0x514/0xb70 [ 103.091994][ T5323] ret_from_fork_asm+0x1a/0x30 [ 103.092008][ T5323] [ 103.092010][ T5323] Memory state around the buggy address: [ 103.092016][ T5323] ffff888037d91900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.092027][ T5323] ffff888037d91980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.092034][ T5323] >ffff888037d91a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.092038][ T5323] ^ [ 103.092044][ T5323] ffff888037d91a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.092050][ T5323] ffff888037d91b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.092055][ T5323] ================================================================== [ 103.092062][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.420887][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.424772][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.429103][ T5323] Call Trace: [ 103.430570][ T5323] [ 103.431822][ T5323] vpanic+0x56d/0xa60 [ 103.433474][ T5323] ? __pfx_vpanic+0x10/0x10 [ 103.435287][ T5323] panic+0xc5/0xd0 [ 103.436905][ T5323] ? __pfx_panic+0x10/0x10 [ 103.438740][ T5323] ? dvb_frontend_release+0x407/0x4d0 [ 103.440922][ T5323] ? rcu_is_watching+0x16/0xb0 [ 103.442855][ T5323] ? dvb_frontend_release+0x407/0x4d0 [ 103.445006][ T5323] ? dvb_frontend_release+0x407/0x4d0 [ 103.447346][ T5323] check_panic_on_warn+0x89/0xb0 [ 103.449478][ T5323] ? dvb_frontend_release+0x407/0x4d0 [ 103.451657][ T5323] end_report+0x73/0x170 [ 103.453369][ T5323] ? dvb_frontend_release+0x407/0x4d0 [ 103.455751][ T5323] kasan_report+0x128/0x150 [ 103.457780][ T5323] ? dvb_frontend_release+0x407/0x4d0 [ 103.460173][ T5323] dvb_frontend_release+0x407/0x4d0 [ 103.462498][ T5323] ? __pfx_dvb_frontend_release+0x10/0x10 [ 103.465017][ T5323] __fput+0x418/0xa50 [ 103.466840][ T5323] task_work_run+0x1d9/0x270 [ 103.468894][ T5323] ? __pfx_task_work_run+0x10/0x10 [ 103.471142][ T5323] get_signal+0x1181/0x12c0 [ 103.473205][ T5323] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.475377][ T5323] arch_do_signal_or_restart+0xbb/0x860 [ 103.477833][ T5323] ? do_raw_spin_unlock+0x4d/0x200 [ 103.480120][ T5323] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 103.482809][ T5323] exit_to_user_mode_loop+0x10e/0x770 [ 103.485194][ T5323] ? rcu_is_watching+0x16/0xb0 [ 103.487295][ T5323] do_syscall_64+0x328/0x520 [ 103.489269][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.491884][ T5323] ? clear_bhb_loop+0x70/0xc0 [ 103.493875][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.496435][ T5323] RIP: 0033:0x7f800a79e159 [ 103.498454][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.506785][ T5323] RSP: 002b:00007ffc61bad608 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.510213][ T5323] RAX: 0000000000000000 RBX: 00007f800aa27da0 RCX: 00007f800a79e159 [ 103.513477][ T5323] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.516706][ T5323] RBP: 00007f800aa27da0 R08: 00007f800aa26038 R09: 0000000000000000 [ 103.520038][ T5323] R10: 0000000000de25a0 R11: 0000000000000246 R12: 000000000001923f [ 103.523480][ T5323] R13: 00007f800aa2609c R14: 0000000000019020 R15: 00007f800aa26090 [ 103.526903][ T5323] [ 103.528541][ T5323] Kernel Offset: disabled [ 103.530470][ T5323] Rebooting in 86400 seconds..