program: recvmmsg(0xffffffffffffffff, &(0x7f0000004480)=[{{0x0, 0x0, &(0x7f0000000380)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000027c0)=""/4133, 0x1025}, {&(0x7f0000000400)=""/217, 0xd9}], 0x5}, 0xd}], 0x1, 0x40000100, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x301200) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='net/ip_mr_vif\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3a0800450000380000000000069078ac1414bbac1414aa00044e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="ff040000907800001ef906000000000000007f1f033d85006ced5aee51807b64dc9900e41742e66912f03e4728095e6a387c7b6f8907daab570408bfe4e69123de0a6727acf003efe2ec98b7c9d361128583b79a4cfeff1e0ece942a3e3ee4b132089962d8e3042004f7d8f2b1f228bf72e8de3f6738668c4ce0c63e81dac1dbc5020b6e5b9f6634fbaddba9"], 0x0) [ 92.999020][ T4643] Bluetooth: hci0: command tx timeout [ 93.034613][ T110] cfg80211: failed to load regulatory.db [ 93.146406][ T5316] ================================================================== [ 93.146443][ T5316] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 93.146623][ T5316] Read of size 4 at addr ffff888037eb3e3c by task syz.0.0/5316 [ 93.146642][ T5316] [ 93.146671][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.146702][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.146735][ T5316] Call Trace: [ 93.146761][ T5316] [ 93.146779][ T5316] dump_stack_lvl+0xe8/0x150 [ 93.146828][ T5316] print_address_description+0x55/0x1e0 [ 93.146844][ T5316] ? dvb_frontend_release+0x407/0x4d0 [ 93.146876][ T5316] print_report+0x58/0x70 [ 93.146888][ T5316] kasan_report+0x117/0x150 [ 93.146913][ T5316] ? dvb_frontend_release+0x407/0x4d0 [ 93.146928][ T5316] dvb_frontend_release+0x407/0x4d0 [ 93.146940][ T5316] ? __pfx_dvb_frontend_release+0x10/0x10 [ 93.146952][ T5316] __fput+0x418/0xa50 [ 93.146967][ T5316] task_work_run+0x1d9/0x270 [ 93.146981][ T5316] ? __pfx_task_work_run+0x10/0x10 [ 93.146995][ T5316] get_signal+0x1181/0x12c0 [ 93.147012][ T5316] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.147035][ T5316] arch_do_signal_or_restart+0xbb/0x860 [ 93.147051][ T5316] ? do_raw_spin_unlock+0x4d/0x200 [ 93.147065][ T5316] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 93.147083][ T5316] exit_to_user_mode_loop+0x10e/0x770 [ 93.147095][ T5316] ? rcu_is_watching+0x16/0xb0 [ 93.147110][ T5316] do_syscall_64+0x328/0x520 [ 93.147154][ T5316] ? trace_irq_disable+0x3b/0x140 [ 93.147197][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.147209][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 93.147221][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.147232][ T5316] RIP: 0033:0x7faf4b59e159 [ 93.147243][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.147252][ T5316] RSP: 002b:00007fff0d807e38 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 93.147275][ T5316] RAX: 0000000000000000 RBX: 00007fff0d807f20 RCX: 00007faf4b59e159 [ 93.147283][ T5316] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 93.147290][ T5316] RBP: 0000000000016a92 R08: 0000000000000001 R09: 0000000000000000 [ 93.147297][ T5316] R10: 00007faf4b3ff030 R11: 0000000000000246 R12: 00007fff0d807f60 [ 93.147304][ T5316] R13: 00007faf4b825fac R14: 0000000000016b65 R15: 00007faf4b825fa0 [ 93.147321][ T5316] [ 93.147325][ T5316] [ 93.147328][ T5316] Allocated by task 1: [ 93.147365][ T5316] kasan_save_track+0x3e/0x80 [ 93.147376][ T5316] __kasan_kmalloc+0x93/0xb0 [ 93.147386][ T5316] __kmalloc_cache_noprof+0x321/0x600 [ 93.147399][ T5316] dvb_register_device+0x309/0x1dd0 [ 93.147409][ T5316] dvb_register_frontend+0x603/0x900 [ 93.147415][ T5316] vidtv_bridge_probe+0x9d5/0xf60 [ 93.147435][ T5316] platform_probe+0xf9/0x190 [ 93.147480][ T5316] really_probe+0x254/0xae0 [ 93.147488][ T5316] __driver_probe_device+0x1e8/0x360 [ 93.147494][ T5316] driver_probe_device+0x4f/0x240 [ 93.147501][ T5316] __driver_attach+0x339/0x600 [ 93.147508][ T5316] bus_for_each_dev+0x23b/0x2c0 [ 93.147520][ T5316] bus_add_driver+0x345/0x670 [ 93.147532][ T5316] driver_register+0x23a/0x320 [ 93.147542][ T5316] vidtv_bridge_init+0x3d/0x60 [ 93.147698][ T5316] do_one_initcall+0x250/0x870 [ 93.147707][ T5316] do_initcall_level+0x10a/0x1a0 [ 93.147720][ T5316] do_initcalls+0x59/0xa0 [ 93.147731][ T5316] kernel_init_freeable+0x29d/0x3e0 [ 93.147743][ T5316] kernel_init+0x22/0x1d0 [ 93.147751][ T5316] ret_from_fork+0x514/0xb70 [ 93.147762][ T5316] ret_from_fork_asm+0x1a/0x30 [ 93.147775][ T5316] [ 93.147778][ T5316] Freed by task 5316: [ 93.147784][ T5316] kasan_save_track+0x3e/0x80 [ 93.147792][ T5316] kasan_save_free_info+0x40/0x50 [ 93.147804][ T5316] __kasan_slab_free+0x5c/0x80 [ 93.147811][ T5316] kfree+0x1c5/0x650 [ 93.147821][ T5316] dvb_generic_release+0x11d/0x1b0 [ 93.147833][ T5316] dvb_frontend_release+0x132/0x4d0 [ 93.147843][ T5316] __fput+0x418/0xa50 [ 93.147854][ T5316] task_work_run+0x1d9/0x270 [ 93.147864][ T5316] get_signal+0x1181/0x12c0 [ 93.147876][ T5316] arch_do_signal_or_restart+0xbb/0x860 [ 93.147890][ T5316] exit_to_user_mode_loop+0x10e/0x770 [ 93.147902][ T5316] do_syscall_64+0x328/0x520 [ 93.147914][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.147923][ T5316] [ 93.147926][ T5316] The buggy address belongs to the object at ffff888037eb3e00 [ 93.147926][ T5316] which belongs to the cache kmalloc-256 of size 256 [ 93.147934][ T5316] The buggy address is located 60 bytes inside of [ 93.147934][ T5316] freed 256-byte region [ffff888037eb3e00, ffff888037eb3f00) [ 93.147945][ T5316] [ 93.147947][ T5316] The buggy address belongs to the physical page: [ 93.147955][ T5316] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x37eb3 [ 93.147965][ T5316] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 93.147974][ T5316] page_type: f5(slab) [ 93.147983][ T5316] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 93.147992][ T5316] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 93.147997][ T5316] page dumped because: kasan: bad access detected [ 93.148003][ T5316] page_owner tracks the page as allocated [ 93.148007][ T5316] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 21503212399 [ 93.148024][ T5316] post_alloc_hook+0x1f9/0x250 [ 93.148038][ T5316] get_page_from_freelist+0x2209/0x2280 [ 93.148047][ T5316] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 93.148054][ T5316] allocate_slab+0x7d/0x620 [ 93.148061][ T5316] refill_objects+0x2d5/0x350 [ 93.148068][ T5316] __pcs_replace_empty_main+0x2c8/0x6c0 [ 93.148075][ T5316] __kmalloc_cache_noprof+0x39b/0x600 [ 93.148084][ T5316] bus_add_driver+0x162/0x670 [ 93.148092][ T5316] driver_register+0x23a/0x320 [ 93.148099][ T5316] do_one_initcall+0x250/0x870 [ 93.148107][ T5316] do_initcall_level+0x10a/0x1a0 [ 93.148115][ T5316] do_initcalls+0x59/0xa0 [ 93.148122][ T5316] kernel_init_freeable+0x29d/0x3e0 [ 93.148131][ T5316] kernel_init+0x22/0x1d0 [ 93.148139][ T5316] ret_from_fork+0x514/0xb70 [ 93.148146][ T5316] ret_from_fork_asm+0x1a/0x30 [ 93.148158][ T5316] page last free pid 1370 tgid 1370 ts 20903588076 stack trace: [ 93.148166][ T5316] __free_frozen_pages+0xc93/0xd90 [ 93.148178][ T5316] kasan_depopulate_vmalloc_pte+0x6d/0x90 [ 93.148191][ T5316] __apply_to_page_range+0xbd8/0x1420 [ 93.148202][ T5316] __kasan_release_vmalloc+0xa2/0xd0 [ 93.148215][ T5316] purge_vmap_node+0x220/0x960 [ 93.148223][ T5316] __purge_vmap_area_lazy+0x783/0xb40 [ 93.148238][ T5316] drain_vmap_area_work+0x27/0x40 [ 93.148252][ T5316] process_scheduled_works+0xc3d/0x1630 [ 93.148261][ T5316] worker_thread+0xa47/0xfb0 [ 93.148269][ T5316] kthread+0x38b/0x480 [ 93.148275][ T5316] ret_from_fork+0x514/0xb70 [ 93.148280][ T5316] ret_from_fork_asm+0x1a/0x30 [ 93.148289][ T5316] [ 93.148291][ T5316] Memory state around the buggy address: [ 93.148295][ T5316] ffff888037eb3d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.148299][ T5316] ffff888037eb3d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.148303][ T5316] >ffff888037eb3e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.148306][ T5316] ^ [ 93.148310][ T5316] ffff888037eb3e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.148321][ T5316] ffff888037eb3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.148326][ T5316] ================================================================== [ 93.148383][ T5316] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.465293][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.468833][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.473135][ T5316] Call Trace: [ 93.474666][ T5316] [ 93.475957][ T5316] vpanic+0x56d/0xa60 [ 93.477673][ T5316] ? rcu_is_watching+0x16/0xb0 [ 93.479776][ T5316] ? __pfx_vpanic+0x10/0x10 [ 93.481680][ T5316] panic+0xc5/0xd0 [ 93.483338][ T5316] ? __pfx_panic+0x10/0x10 [ 93.485281][ T5316] ? dvb_frontend_release+0x407/0x4d0 [ 93.487517][ T5316] ? dvb_frontend_release+0x407/0x4d0 [ 93.489689][ T5316] check_panic_on_warn+0x89/0xb0 [ 93.491844][ T5316] ? dvb_frontend_release+0x407/0x4d0 [ 93.494175][ T5316] end_report+0x73/0x170 [ 93.496181][ T5316] ? dvb_frontend_release+0x407/0x4d0 [ 93.498668][ T5316] kasan_report+0x128/0x150 [ 93.500301][ T5316] ? dvb_frontend_release+0x407/0x4d0 [ 93.502582][ T5316] dvb_frontend_release+0x407/0x4d0 [ 93.504878][ T5316] ? __pfx_dvb_frontend_release+0x10/0x10 [ 93.507206][ T5316] __fput+0x418/0xa50 [ 93.508742][ T5316] task_work_run+0x1d9/0x270 [ 93.510722][ T5316] ? __pfx_task_work_run+0x10/0x10 [ 93.512995][ T5316] get_signal+0x1181/0x12c0 [ 93.515034][ T5316] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.517209][ T5316] arch_do_signal_or_restart+0xbb/0x860 [ 93.519664][ T5316] ? do_raw_spin_unlock+0x4d/0x200 [ 93.521901][ T5316] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 93.524578][ T5316] exit_to_user_mode_loop+0x10e/0x770 [ 93.526730][ T5316] ? rcu_is_watching+0x16/0xb0 [ 93.528787][ T5316] do_syscall_64+0x328/0x520 [ 93.530751][ T5316] ? trace_irq_disable+0x3b/0x140 [ 93.532886][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.535408][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 93.537342][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.539772][ T5316] RIP: 0033:0x7faf4b59e159 [ 93.544166][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.552224][ T5316] RSP: 002b:00007fff0d807e38 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 93.555848][ T5316] RAX: 0000000000000000 RBX: 00007fff0d807f20 RCX: 00007faf4b59e159 [ 93.559506][ T5316] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 93.562838][ T5316] RBP: 0000000000016a92 R08: 0000000000000001 R09: 0000000000000000 [ 93.566321][ T5316] R10: 00007faf4b3ff030 R11: 0000000000000246 R12: 00007fff0d807f60 [ 93.569691][ T5316] R13: 00007faf4b825fac R14: 0000000000016b65 R15: 00007faf4b825fa0 [ 93.573125][ T5316] [ 93.574927][ T5316] Kernel Offset: disabled [ 93.576855][ T5316] Rebooting in 86400 seconds..