program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='wwnn=0x1111111111111111,wwpn=0x2222222222222222', 0x2f)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='wwnn=0x3333333333333333,wwpn=0x4444444444444444,roles=32,lpwwnn=0x1111111111111111,lpwwpn=0x2222222222222222', 0x6c)
r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0)
write(r2, &(0x7f0000000a00)='transport=fc,traddr=nn-0x3333333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2222222222222222,nqn=nq', 0x7e) (fail_nth: 17)
[ 85.651581][ T4656] Bluetooth: hci0: command tx timeout
[ 85.958996][ T5326] FAULT_INJECTION: forcing a failure.
[ 85.958996][ T5326] name failslab, interval 1, probability 0, space 0, times 1
[ 85.965920][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.965939][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 85.965946][ T5326] Call Trace:
[ 85.965951][ T5326]
[ 85.965956][ T5326] dump_stack_lvl+0xe8/0x150
[ 85.966472][ T5326] should_fail_ex+0x40c/0x560
[ 85.966523][ T5326] should_failslab+0xa8/0x100
[ 85.966539][ T5326] __kmalloc_node_track_caller_noprof+0x100/0x730
[ 85.966555][ T5326] ? kobject_set_name_vargs+0x61/0x110
[ 85.966600][ T5326] ? kobject_set_name_vargs+0x61/0x110
[ 85.966620][ T5326] kvasprintf+0xeb/0x1a0
[ 85.966638][ T5326] ? __pfx_kvasprintf+0x10/0x10
[ 85.966655][ T5326] ? pcpu_alloc+0x10/0x310
[ 85.966674][ T5326] ? kvasprintf_const+0xe1/0x240
[ 85.966691][ T5326] kobject_set_name_vargs+0x61/0x110
[ 85.966708][ T5326] dev_set_name+0xe2/0x140
[ 85.966727][ T5326] ? __pfx_dev_set_name+0x10/0x10
[ 85.966746][ T5326] ? device_initialize+0x394/0x470
[ 85.966759][ T5326] nvme_add_ctrl+0x6e/0x270
[ 85.966774][ T5326] nvme_fc_init_ctrl+0xcb0/0x1450
[ 85.966799][ T5326] nvme_fc_create_ctrl+0x4cd/0x520
[ 85.966823][ T5326] nvmf_dev_write+0x24ca/0x2d90
[ 85.966863][ T5326] ? __pfx_nvmf_dev_write+0x10/0x10
[ 85.966885][ T5326] ? get_pid_task+0x20/0x1f0
[ 85.966917][ T5326] ? bpf_lsm_file_permission+0x9/0x20
[ 85.966928][ T5326] ? security_file_permission+0x75/0x260
[ 85.966946][ T5326] ? rw_verify_area+0x203/0x4c0
[ 85.966961][ T5326] ? __pfx_nvmf_dev_write+0x10/0x10
[ 85.966974][ T5326] vfs_write+0x296/0xba0
[ 85.966992][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 85.967006][ T5326] ? __fget_files+0x2a/0x420
[ 85.967020][ T5326] ? __fget_files+0x2a/0x420
[ 85.967029][ T5326] ? __fget_files+0x3a2/0x420
[ 85.967039][ T5326] ? __fget_files+0x2a/0x420
[ 85.967054][ T5326] ksys_write+0x150/0x270
[ 85.967069][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 85.967086][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.967097][ T5326] do_syscall_64+0x174/0x580
[ 85.967108][ T5326] ? trace_irq_disable+0x3b/0x140
[ 85.967121][ T5326] ? clear_bhb_loop+0x40/0x90
[ 85.967133][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.967143][ T5326] RIP: 0033:0x7fea9b39e0d9
[ 85.967154][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 85.967162][ T5326] RSP: 002b:00007fea9c299fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 85.967174][ T5326] RAX: ffffffffffffffda RBX: 00007fea9b625fa0 RCX: 00007fea9b39e0d9
[ 85.967180][ T5326] RDX: 000000000000007e RSI: 0000200000000a00 RDI: 0000000000000005
[ 85.967186][ T5326] RBP: 00007fea9c29a050 R08: 0000000000000000 R09: 0000000000000000
[ 85.967191][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 85.967196][ T5326] R13: 00007fea9b626038 R14: 00007fea9b625fa0 R15: 00007ffe156ed1b8
[ 85.967212][ T5326]
[ 85.967681][ T5326] ==================================================================
[ 86.098867][ T5326] BUG: KASAN: slab-use-after-free in nvmf_free_options+0x30/0x190
[ 86.102360][ T5326] Read of size 8 at addr ffff88801f4a2550 by task syz.0.0/5326
[ 86.106231][ T5326]
[ 86.107508][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.107527][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.107535][ T5326] Call Trace:
[ 86.107544][ T5326]
[ 86.107551][ T5326] dump_stack_lvl+0xe8/0x150
[ 86.107578][ T5326] print_address_description+0x55/0x1e0
[ 86.107598][ T5326] ? nvmf_free_options+0x30/0x190
[ 86.107616][ T5326] print_report+0x58/0x70
[ 86.107631][ T5326] kasan_report+0x117/0x150
[ 86.107648][ T5326] ? nvme_fc_create_ctrl+0x4f3/0x520
[ 86.107664][ T5326] ? nvmf_free_options+0x30/0x190
[ 86.107684][ T5326] nvmf_free_options+0x30/0x190
[ 86.107701][ T5326] nvmf_dev_write+0x267f/0x2d90
[ 86.107730][ T5326] ? __pfx_nvmf_dev_write+0x10/0x10
[ 86.107752][ T5326] ? get_pid_task+0x20/0x1f0
[ 86.107777][ T5326] ? bpf_lsm_file_permission+0x9/0x20
[ 86.107790][ T5326] ? security_file_permission+0x75/0x260
[ 86.107808][ T5326] ? rw_verify_area+0x203/0x4c0
[ 86.107832][ T5326] ? __pfx_nvmf_dev_write+0x10/0x10
[ 86.107849][ T5326] vfs_write+0x296/0xba0
[ 86.107868][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 86.107885][ T5326] ? __fget_files+0x2a/0x420
[ 86.107900][ T5326] ? __fget_files+0x2a/0x420
[ 86.107914][ T5326] ? __fget_files+0x3a2/0x420
[ 86.107927][ T5326] ? __fget_files+0x2a/0x420
[ 86.107943][ T5326] ksys_write+0x150/0x270
[ 86.107961][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 86.107980][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.107992][ T5326] do_syscall_64+0x174/0x580
[ 86.108009][ T5326] ? trace_irq_disable+0x3b/0x140
[ 86.108025][ T5326] ? clear_bhb_loop+0x40/0x90
[ 86.108039][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.108052][ T5326] RIP: 0033:0x7fea9b39e0d9
[ 86.108068][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.108079][ T5326] RSP: 002b:00007fea9c299fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.108095][ T5326] RAX: ffffffffffffffda RBX: 00007fea9b625fa0 RCX: 00007fea9b39e0d9
[ 86.108104][ T5326] RDX: 000000000000007e RSI: 0000200000000a00 RDI: 0000000000000005
[ 86.108112][ T5326] RBP: 00007fea9c29a050 R08: 0000000000000000 R09: 0000000000000000
[ 86.108120][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 86.108127][ T5326] R13: 00007fea9b626038 R14: 00007fea9b625fa0 R15: 00007ffe156ed1b8
[ 86.108142][ T5326]
[ 86.108146][ T5326]
[ 86.225567][ T5326] Allocated by task 5326:
[ 86.227353][ T5326] kasan_save_track+0x3e/0x80
[ 86.229807][ T5326] __kasan_kmalloc+0x93/0xb0
[ 86.232235][ T5326] __kmalloc_cache_noprof+0x32d/0x660
[ 86.235208][ T5326] nvmf_dev_write+0x243/0x2d90
[ 86.237500][ T5326] vfs_write+0x296/0xba0
[ 86.239454][ T5326] ksys_write+0x150/0x270
[ 86.241375][ T5326] do_syscall_64+0x174/0x580
[ 86.243517][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.246288][ T5326]
[ 86.247484][ T5326] Freed by task 5326:
[ 86.249390][ T5326] kasan_save_track+0x3e/0x80
[ 86.251675][ T5326] kasan_save_free_info+0x40/0x50
[ 86.254240][ T5326] __kasan_slab_free+0x5c/0x80
[ 86.256718][ T5326] kfree+0x1c5/0x640
[ 86.258522][ T5326] nvme_fc_ctrl_put+0x2cc/0x340
[ 86.260769][ T5326] nvme_free_ctrl+0x38c/0x570
[ 86.262890][ T5326] device_release+0xc4/0x1f0
[ 86.265023][ T5326] kobject_put+0x222/0x550
[ 86.267076][ T5326] nvme_fc_init_ctrl+0xe17/0x1450
[ 86.269690][ T5326] nvme_fc_create_ctrl+0x4cd/0x520
[ 86.272280][ T5326] nvmf_dev_write+0x24ca/0x2d90
[ 86.274642][ T5326] vfs_write+0x296/0xba0
[ 86.276460][ T5326] ksys_write+0x150/0x270
[ 86.278359][ T5326] do_syscall_64+0x174/0x580
[ 86.280341][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.282838][ T5326]
[ 86.283958][ T5326] The buggy address belongs to the object at ffff88801f4a2500
[ 86.283958][ T5326] which belongs to the cache kmalloc-192 of size 192
[ 86.289996][ T5326] The buggy address is located 80 bytes inside of
[ 86.289996][ T5326] freed 192-byte region [ffff88801f4a2500, ffff88801f4a25c0)
[ 86.296212][ T5326]
[ 86.297478][ T5326] The buggy address belongs to the physical page:
[ 86.300828][ T5326] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f4a2
[ 86.304658][ T5326] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 86.308446][ T5326] page_type: f5(slab)
[ 86.311202][ T5326] raw: 00fff00000000000 ffff88801b0413c0 dead000000000122 0000000000000000
[ 86.316464][ T5326] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
[ 86.320110][ T5326] page dumped because: kasan: bad access detected
[ 86.322817][ T5326] page_owner tracks the page as allocated
[ 86.325626][ T5326] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5289, tgid 5289 (syz-executor), ts 83703979346, free_ts 83087386547
[ 86.335499][ T5326] post_alloc_hook+0x1f9/0x250
[ 86.337429][ T5326] get_page_from_freelist+0x21fa/0x2270
[ 86.339863][ T5326] __alloc_frozen_pages_noprof+0x18d/0x380
[ 86.342778][ T5326] allocate_slab+0x79/0x5e0
[ 86.345339][ T5326] refill_objects+0x2d5/0x350
[ 86.347902][ T5326] __pcs_replace_empty_main+0x2bf/0x6b0
[ 86.350134][ T5326] __kmalloc_node_track_caller_noprof+0x557/0x730
[ 86.352838][ T5326] kmemdup_noprof+0x2b/0x70
[ 86.354767][ T5326] ebt_register_table+0x18e/0x1190
[ 86.357288][ T5326] find_inlist_lock_noload+0x171/0x260
[ 86.360248][ T5326] do_ebt_get_ctl+0x367/0x1f30
[ 86.362618][ T5326] nf_getsockopt+0x26e/0x290
[ 86.364692][ T5326] ip_getsockopt+0x19e/0x230
[ 86.366686][ T5326] do_sock_getsockopt+0x569/0xa70
[ 86.368867][ T5326] __x64_sys_getsockopt+0x1a4/0x240
[ 86.371328][ T5326] do_syscall_64+0x174/0x580
[ 86.373928][ T5326] page last free pid 75 tgid 75 stack trace:
[ 86.377166][ T5326] free_unref_folios+0xd84/0x14a0
[ 86.379627][ T5326] shrink_folio_list+0x4b16/0x5330
[ 86.381837][ T5326] evict_folios+0x3821/0x49e0
[ 86.383985][ T5326] try_to_shrink_lruvec+0xb4f/0xed0
[ 86.386243][ T5326] shrink_one+0x233/0x730
[ 86.388436][ T5326] shrink_node+0x3303/0x3b60
[ 86.391094][ T5326] kswapd+0x17b6/0x31c0
[ 86.393351][ T5326] kthread+0x388/0x470
[ 86.395329][ T5326] ret_from_fork+0x514/0xb70
[ 86.397336][ T5326] ret_from_fork_asm+0x1a/0x30
[ 86.399426][ T5326]
[ 86.400470][ T5326] Memory state around the buggy address:
[ 86.403239][ T5326] ffff88801f4a2400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.407773][ T5326] ffff88801f4a2480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 86.411679][ T5326] >ffff88801f4a2500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.415145][ T5326] ^
[ 86.418040][ T5326] ffff88801f4a2580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 86.421812][ T5326] ffff88801f4a2600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 86.425632][ T5326] ==================================================================
[ 86.472165][ T5326] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.475599][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.480026][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.484459][ T5326] Call Trace:
[ 86.486063][ T5326]
[ 86.487537][ T5326] vpanic+0x56c/0xa60
[ 86.489387][ T5326] ? __pfx_vpanic+0x10/0x10
[ 86.491506][ T5326] ? __pfx___schedule+0x10/0x10
[ 86.493815][ T5326] panic+0xc5/0xd0
[ 86.495563][ T5326] ? __pfx_panic+0x10/0x10
[ 86.497549][ T5326] ? preempt_schedule_common+0x82/0xd0
[ 86.499915][ T5326] ? nvmf_free_options+0x30/0x190
[ 86.502087][ T5326] check_panic_on_warn+0x89/0xb0
[ 86.504576][ T5326] ? nvmf_free_options+0x30/0x190
[ 86.507164][ T5326] end_report+0x73/0x170
[ 86.509190][ T5326] ? nvmf_free_options+0x30/0x190
[ 86.511494][ T5326] kasan_report+0x128/0x150
[ 86.513466][ T5326] ? nvme_fc_create_ctrl+0x4f3/0x520
[ 86.515968][ T5326] ? nvmf_free_options+0x30/0x190
[ 86.518350][ T5326] nvmf_free_options+0x30/0x190
[ 86.520696][ T5326] nvmf_dev_write+0x267f/0x2d90
[ 86.523019][ T5326] ? __pfx_nvmf_dev_write+0x10/0x10
[ 86.525425][ T5326] ? get_pid_task+0x20/0x1f0
[ 86.527488][ T5326] ? bpf_lsm_file_permission+0x9/0x20
[ 86.529732][ T5326] ? security_file_permission+0x75/0x260
[ 86.532196][ T5326] ? rw_verify_area+0x203/0x4c0
[ 86.534475][ T5326] ? __pfx_nvmf_dev_write+0x10/0x10
[ 86.537005][ T5326] vfs_write+0x296/0xba0
[ 86.539108][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 86.541343][ T5326] ? __fget_files+0x2a/0x420
[ 86.543236][ T5326] ? __fget_files+0x2a/0x420
[ 86.545313][ T5326] ? __fget_files+0x3a2/0x420
[ 86.547553][ T5326] ? __fget_files+0x2a/0x420
[ 86.549798][ T5326] ksys_write+0x150/0x270
[ 86.551893][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 86.554121][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.556746][ T5326] do_syscall_64+0x174/0x580
[ 86.558843][ T5326] ? trace_irq_disable+0x3b/0x140
[ 86.561463][ T5326] ? clear_bhb_loop+0x40/0x90
[ 86.563866][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.566601][ T5326] RIP: 0033:0x7fea9b39e0d9
[ 86.568665][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.577152][ T5326] RSP: 002b:00007fea9c299fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.580725][ T5326] RAX: ffffffffffffffda RBX: 00007fea9b625fa0 RCX: 00007fea9b39e0d9
[ 86.584037][ T5326] RDX: 000000000000007e RSI: 0000200000000a00 RDI: 0000000000000005
[ 86.587934][ T5326] RBP: 00007fea9c29a050 R08: 0000000000000000 R09: 0000000000000000
[ 86.591691][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 86.595420][ T5326] R13: 00007fea9b626038 R14: 00007fea9b625fa0 R15: 00007ffe156ed1b8
[ 86.598952][ T5326]
[ 86.600718][ T5326] Kernel Offset: disabled
[ 86.602488][ T5326] Rebooting in 86400 seconds..