Warning: Permanently added '10.128.0.41' (ECDSA) to the list of known hosts. executing program [ 42.200743] ================================================================== [ 42.210821] BUG: KASAN: null-ptr-deref in refcount_sub_and_test_checked+0x9d/0x310 [ 42.218518] Read of size 4 at addr 0000000000000020 by task syz-executor933/5986 [ 42.226040] [ 42.227658] CPU: 1 PID: 5986 Comm: syz-executor933 Not tainted 4.20.0-rc1-next-20181109+ #110 [ 42.236505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.245845] Call Trace: [ 42.248427] dump_stack+0x244/0x39d [ 42.252057] ? dump_stack_print_info.cold.1+0x20/0x20 [ 42.257238] ? do_group_exit+0x177/0x440 [ 42.261283] ? __x64_sys_exit_group+0x3e/0x50 [ 42.265763] ? vprintk_func+0x85/0x181 [ 42.269637] kasan_report.cold.8+0x6d/0x309 [ 42.273954] ? refcount_sub_and_test_checked+0x9d/0x310 [ 42.279311] check_memory_region+0x13e/0x1b0 [ 42.283706] kasan_check_read+0x11/0x20 [ 42.287679] refcount_sub_and_test_checked+0x9d/0x310 [ 42.292852] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 42.297420] ? refcount_dec_if_one+0x180/0x180 [ 42.301996] ? vb2_vmalloc_put+0x5f/0x80 [ 42.306062] ? trace_hardirqs_off_caller+0x300/0x300 [ 42.311169] ? __kasan_slab_free+0x119/0x150 [ 42.315565] refcount_dec_and_test_checked+0x1a/0x20 [ 42.320661] vb2_vmalloc_put+0x19/0x80 [ 42.324535] __vb2_buf_mem_free+0x112/0x210 [ 42.328841] ? vb2_vmalloc_get_dmabuf+0x300/0x300 [ 42.333683] __vb2_queue_free+0x830/0xa30 [ 42.337827] ? trace_hardirqs_off_caller+0x300/0x300 [ 42.342945] ? __vb2_plane_dmabuf_put.isra.5+0x310/0x310 [ 42.348392] vb2_core_queue_release+0x62/0x80 [ 42.352874] _vb2_fop_release+0x1d2/0x2b0 [ 42.357047] vb2_fop_release+0x77/0xc0 [ 42.360919] vivid_fop_release+0x18e/0x440 [ 42.365138] ? vivid_remove+0x460/0x460 [ 42.369105] v4l2_release+0x224/0x3a0 [ 42.372938] __fput+0x3bc/0xa70 [ 42.376239] ? dev_debug_store+0x140/0x140 [ 42.380463] ? get_max_files+0x20/0x20 [ 42.384337] ? trace_hardirqs_on+0xbd/0x310 [ 42.388674] ? kasan_check_read+0x11/0x20 [ 42.392805] ? task_work_run+0x1af/0x2a0 [ 42.396852] ? trace_hardirqs_off_caller+0x300/0x300 [ 42.401945] ____fput+0x15/0x20 [ 42.405208] task_work_run+0x1e8/0x2a0 [ 42.409095] ? task_work_cancel+0x240/0x240 [ 42.413403] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 42.418934] ? switch_task_namespaces+0x9d/0xd0 [ 42.423637] do_exit+0x1a48/0x2620 [ 42.427183] ? kvfree+0x21/0x70 [ 42.430448] ? mm_update_next_owner+0x990/0x990 [ 42.435149] ? video_usercopy+0x79b/0x1750 [ 42.439381] ? v4l_s_fmt+0x990/0x990 [ 42.443090] ? v4l_enumstd+0x70/0x70 [ 42.446791] ? rcu_softirq_qs+0x20/0x20 [ 42.450793] ? is_bpf_text_address+0xd3/0x170 [ 42.455282] ? __kernel_text_address+0xd/0x40 [ 42.459766] ? unwind_get_return_address+0x61/0xa0 [ 42.464679] ? __save_stack_trace+0x8d/0xf0 [ 42.468993] ? save_stack+0x43/0xd0 [ 42.472601] ? __kasan_slab_free+0x102/0x150 [ 42.477043] ? kasan_slab_free+0xe/0x10 [ 42.481010] ? kmem_cache_free+0x83/0x290 [ 42.485147] ? do_sys_open+0x54d/0x700 [ 42.489015] ? __x64_sys_open+0x7e/0xc0 [ 42.492993] ? do_syscall_64+0x1b9/0x820 [ 42.497162] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.502533] ? trace_hardirqs_off+0xb8/0x310 [ 42.506931] ? kasan_check_read+0x11/0x20 [ 42.511069] ? do_raw_spin_unlock+0xa7/0x330 [ 42.515471] ? trace_hardirqs_on+0x310/0x310 [ 42.519893] ? video_usercopy+0x1750/0x1750 [ 42.524213] ? video_ioctl2+0x2c/0x33 [ 42.528000] ? v4l2_ioctl+0x15c/0x1b0 [ 42.531794] ? video_devdata+0xa0/0xa0 [ 42.535674] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 42.541265] ? do_vfs_ioctl+0x201/0x1790 [ 42.545318] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 42.550841] ? ioctl_preallocate+0x300/0x300 [ 42.555281] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 42.560809] ? __fget_light+0x2e9/0x430 [ 42.564765] ? fget_raw+0x20/0x20 [ 42.568200] ? rcu_read_lock_sched_held+0x14f/0x180 [ 42.573204] ? kmem_cache_free+0x24f/0x290 [ 42.577421] ? putname+0xf7/0x130 [ 42.580866] do_group_exit+0x177/0x440 [ 42.584785] ? trace_hardirqs_on+0xbd/0x310 [ 42.589098] ? __ia32_sys_exit+0x50/0x50 [ 42.593244] ? trace_hardirqs_off_caller+0x300/0x300 [ 42.598336] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 42.603885] ? ksys_ioctl+0x81/0xd0 [ 42.607574] __x64_sys_exit_group+0x3e/0x50 [ 42.611890] do_syscall_64+0x1b9/0x820 [ 42.615762] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 42.621118] ? syscall_return_slowpath+0x5e0/0x5e0 [ 42.626038] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 42.630868] ? trace_hardirqs_on_caller+0x310/0x310 [ 42.635886] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 42.640892] ? prepare_exit_to_usermode+0x291/0x3b0 [ 42.645961] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 42.650791] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 42.656103] RIP: 0033:0x442c78 [ 42.659321] Code: Bad RIP value. [ 42.662671] RSP: 002b:00007ffedabae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 42.670358] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442c78 [ 42.677607] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 42.684934] RBP: 00000000004c2848 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 42.692190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 42.699555] R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 [ 42.706868] ================================================================== [ 42.714215] Disabling lock debugging due to kernel taint [ 42.719979] Kernel panic - not syncing: panic_on_warn set ... [ 42.725946] CPU: 1 PID: 5986 Comm: syz-executor933 Tainted: G B 4.20.0-rc1-next-20181109+ #110 [ 42.735980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.745315] Call Trace: [ 42.747957] dump_stack+0x244/0x39d [ 42.751641] ? dump_stack_print_info.cold.1+0x20/0x20 [ 42.756839] panic+0x2ad/0x55c [ 42.760016] ? add_taint.cold.5+0x16/0x16 [ 42.764183] ? preempt_schedule+0x4d/0x60 [ 42.768317] ? ___preempt_schedule+0x16/0x18 [ 42.772763] ? trace_hardirqs_on+0xb4/0x310 [ 42.777080] kasan_end_report+0x47/0x4f [ 42.781042] kasan_report.cold.8+0x76/0x309 [ 42.785351] ? refcount_sub_and_test_checked+0x9d/0x310 [ 42.790698] check_memory_region+0x13e/0x1b0 [ 42.795090] kasan_check_read+0x11/0x20 [ 42.799055] refcount_sub_and_test_checked+0x9d/0x310 [ 42.804237] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 42.808806] ? refcount_dec_if_one+0x180/0x180 [ 42.813374] ? vb2_vmalloc_put+0x5f/0x80 [ 42.817491] ? trace_hardirqs_off_caller+0x300/0x300 [ 42.822588] ? __kasan_slab_free+0x119/0x150 [ 42.826977] refcount_dec_and_test_checked+0x1a/0x20 [ 42.832062] vb2_vmalloc_put+0x19/0x80 [ 42.835930] __vb2_buf_mem_free+0x112/0x210 [ 42.840233] ? vb2_vmalloc_get_dmabuf+0x300/0x300 [ 42.845058] __vb2_queue_free+0x830/0xa30 [ 42.849188] ? trace_hardirqs_off_caller+0x300/0x300 [ 42.854279] ? __vb2_plane_dmabuf_put.isra.5+0x310/0x310 [ 42.859723] vb2_core_queue_release+0x62/0x80 [ 42.864211] _vb2_fop_release+0x1d2/0x2b0 [ 42.868346] vb2_fop_release+0x77/0xc0 [ 42.872221] vivid_fop_release+0x18e/0x440 [ 42.876447] ? vivid_remove+0x460/0x460 [ 42.880412] v4l2_release+0x224/0x3a0 [ 42.884199] __fput+0x3bc/0xa70 [ 42.887460] ? dev_debug_store+0x140/0x140 [ 42.891692] ? get_max_files+0x20/0x20 [ 42.895559] ? trace_hardirqs_on+0xbd/0x310 [ 42.899928] ? kasan_check_read+0x11/0x20 [ 42.904069] ? task_work_run+0x1af/0x2a0 [ 42.908118] ? trace_hardirqs_off_caller+0x300/0x300 [ 42.913357] ____fput+0x15/0x20 [ 42.916624] task_work_run+0x1e8/0x2a0 [ 42.920492] ? task_work_cancel+0x240/0x240 [ 42.924795] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 42.930332] ? switch_task_namespaces+0x9d/0xd0 [ 42.934985] do_exit+0x1a48/0x2620 [ 42.938507] ? kvfree+0x21/0x70 [ 42.941776] ? mm_update_next_owner+0x990/0x990 [ 42.946432] ? video_usercopy+0x79b/0x1750 [ 42.950650] ? v4l_s_fmt+0x990/0x990 [ 42.954345] ? v4l_enumstd+0x70/0x70 [ 42.958043] ? rcu_softirq_qs+0x20/0x20 [ 42.962009] ? is_bpf_text_address+0xd3/0x170 [ 42.966519] ? __kernel_text_address+0xd/0x40 [ 42.971010] ? unwind_get_return_address+0x61/0xa0 [ 42.976012] ? __save_stack_trace+0x8d/0xf0 [ 42.980345] ? save_stack+0x43/0xd0 [ 42.983953] ? __kasan_slab_free+0x102/0x150 [ 42.988341] ? kasan_slab_free+0xe/0x10 [ 42.992297] ? kmem_cache_free+0x83/0x290 [ 42.996482] ? do_sys_open+0x54d/0x700 [ 43.000375] ? __x64_sys_open+0x7e/0xc0 [ 43.004446] ? do_syscall_64+0x1b9/0x820 [ 43.008501] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.013895] ? trace_hardirqs_off+0xb8/0x310 [ 43.018296] ? kasan_check_read+0x11/0x20 [ 43.022429] ? do_raw_spin_unlock+0xa7/0x330 [ 43.026828] ? trace_hardirqs_on+0x310/0x310 [ 43.031266] ? video_usercopy+0x1750/0x1750 [ 43.035618] ? video_ioctl2+0x2c/0x33 [ 43.039409] ? v4l2_ioctl+0x15c/0x1b0 [ 43.043198] ? video_devdata+0xa0/0xa0 [ 43.047075] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 43.052595] ? do_vfs_ioctl+0x201/0x1790 [ 43.056641] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 43.062163] ? ioctl_preallocate+0x300/0x300 [ 43.066555] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 43.072082] ? __fget_light+0x2e9/0x430 [ 43.076048] ? fget_raw+0x20/0x20 [ 43.079484] ? rcu_read_lock_sched_held+0x14f/0x180 [ 43.084489] ? kmem_cache_free+0x24f/0x290 [ 43.088708] ? putname+0xf7/0x130 [ 43.092147] do_group_exit+0x177/0x440 [ 43.096026] ? trace_hardirqs_on+0xbd/0x310 [ 43.100331] ? __ia32_sys_exit+0x50/0x50 [ 43.104374] ? trace_hardirqs_off_caller+0x300/0x300 [ 43.109456] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 43.114972] ? ksys_ioctl+0x81/0xd0 [ 43.118579] __x64_sys_exit_group+0x3e/0x50 [ 43.122884] do_syscall_64+0x1b9/0x820 [ 43.126753] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 43.132107] ? syscall_return_slowpath+0x5e0/0x5e0 [ 43.137028] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 43.141853] ? trace_hardirqs_on_caller+0x310/0x310 [ 43.146851] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 43.151856] ? prepare_exit_to_usermode+0x291/0x3b0 [ 43.156863] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 43.161759] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.166943] RIP: 0033:0x442c78 [ 43.170127] Code: Bad RIP value. [ 43.173470] RSP: 002b:00007ffedabae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 43.181161] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442c78 [ 43.188414] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 43.195665] RBP: 00000000004c2848 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 43.202914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 43.210164] R13: 00000000006d4180 R14: 0000000000000000 R15: 0000000000000000 [ 43.218341] Kernel Offset: disabled [ 43.221962] Rebooting in 86400 seconds..