program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async, rerun: 64) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async, rerun: 64) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/video4linux/video0/dev_debug\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='3', 0x1) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0205649, &(0x7f0000000180)={0x0, 0x10, 0x2, r0, 0x0, &(0x7f00000001c0)={0x990a67, 0xd, '\x00', @p_u8=0x0}}) (async) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000ec0), 0x2, 0x0) (async) ioctl$SNDCTL_DSP_GETOSPACE(r0, 0x8010500c, &(0x7f0000000200)) (async, rerun: 32) openat(r0, &(0x7f0000000540)='./sys/class/video4linux/video0/dev_debug\x00', 0x80000, 0xa1) (rerun: 32) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f0000000f00)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x8011, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt\x00', 0x1cc) (async) mount(0x0, &(0x7f0000000280)='./proc_mnt\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt/irq/1/smp_affinity\x00', 0x1, 0x0) write$binfmt_script(r3, &(0x7f0000000340)={'#! ', './proc_mnt/irq/1/smp_affinity', [{0x20, ',000000\x00'}]}, 0x2a) (async) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f0000000380)={0x4, 0x0, 0x0, 0x188, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r2}, [@snapshot={0x0, 0x1008, 0x0, 0x50, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'PO', 0x20, '128'}}]}) [ 93.670459][ T5304] Bluetooth: hci0: command tx timeout [ 93.693275][ T9] cfg80211: failed to load regulatory.db [ 93.833135][ T5354] ================================================================== [ 93.833191][ T5354] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 93.833374][ T5354] Read of size 8 at addr ffff888035a64f98 by task syz.0.0/5354 [ 93.833384][ T5354] [ 93.833402][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.833425][ T5354] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.833441][ T5354] Call Trace: [ 93.833447][ T5354] [ 93.833453][ T5354] dump_stack_lvl+0xe8/0x150 [ 93.833503][ T5354] print_address_description+0x55/0x1e0 [ 93.833515][ T5354] ? snapshot_ctr+0x5cb/0x1340 [ 93.833522][ T5354] print_report+0x58/0x70 [ 93.833530][ T5354] kasan_report+0x117/0x150 [ 93.833573][ T5354] ? snapshot_ctr+0x5cb/0x1340 [ 93.833581][ T5354] snapshot_ctr+0x5cb/0x1340 [ 93.833593][ T5354] ? __pfx_snapshot_ctr+0x10/0x10 [ 93.833604][ T5354] ? skip_spaces+0x8a/0xa0 [ 93.833679][ T5354] ? dm_split_args+0x50b/0x5d0 [ 93.833697][ T5354] dm_table_add_target+0x58d/0xc70 [ 93.833716][ T5354] table_load+0x325/0x8a0 [ 93.833731][ T5354] ? __pfx_table_load+0x10/0x10 [ 93.833769][ T5354] dm_ctl_ioctl+0x9ec/0xe10 [ 93.833785][ T5354] ? __pfx_table_load+0x10/0x10 [ 93.833798][ T5354] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 93.833818][ T5354] ? __fget_files+0x2a/0x420 [ 93.833836][ T5354] ? bpf_lsm_file_ioctl+0x9/0x20 [ 93.833858][ T5354] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 93.833871][ T5354] __se_sys_ioctl+0xfc/0x170 [ 93.833883][ T5354] do_syscall_64+0x166/0x520 [ 93.833929][ T5354] ? trace_irq_disable+0x3b/0x140 [ 93.833943][ T5354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.833964][ T5354] ? clear_bhb_loop+0x70/0xc0 [ 93.833976][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.833986][ T5354] RIP: 0033:0x7fa45c99f559 [ 93.834004][ T5354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.834013][ T5354] RSP: 002b:00007fa45d869fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.834029][ T5354] RAX: ffffffffffffffda RBX: 00007fa45cc26180 RCX: 00007fa45c99f559 [ 93.834037][ T5354] RDX: 0000200000000380 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 93.834044][ T5354] RBP: 00007fa45ca36b20 R08: 0000000000000000 R09: 0000000000000000 [ 93.834050][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.834057][ T5354] R13: 00007fa45cc26218 R14: 00007fa45cc26180 R15: 00007ffd776dce78 [ 93.834069][ T5354] [ 93.834074][ T5354] [ 93.834077][ T5354] Allocated by task 5354: [ 93.834091][ T5354] kasan_save_track+0x3e/0x80 [ 93.834101][ T5354] __kasan_kmalloc+0x93/0xb0 [ 93.834110][ T5354] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 93.834121][ T5354] dm_get_table_device+0x23e/0x730 [ 93.834130][ T5354] dm_get_device+0x327/0x760 [ 93.834141][ T5354] snapshot_ctr+0x2b2/0x1340 [ 93.834151][ T5354] dm_table_add_target+0x58d/0xc70 [ 93.834164][ T5354] table_load+0x325/0x8a0 [ 93.834176][ T5354] dm_ctl_ioctl+0x9ec/0xe10 [ 93.834187][ T5354] __se_sys_ioctl+0xfc/0x170 [ 93.834197][ T5354] do_syscall_64+0x166/0x520 [ 93.834211][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.834221][ T5354] [ 93.834230][ T5354] Freed by task 5354: [ 93.834235][ T5354] kasan_save_track+0x3e/0x80 [ 93.834245][ T5354] kasan_save_free_info+0x40/0x50 [ 93.834257][ T5354] __kasan_slab_free+0x5c/0x80 [ 93.834267][ T5354] kfree+0x1c5/0x650 [ 93.834279][ T5354] dm_put_table_device+0x255/0x2a0 [ 93.834288][ T5354] dm_get_device+0x56f/0x760 [ 93.834301][ T5354] snapshot_ctr+0x471/0x1340 [ 93.834310][ T5354] dm_table_add_target+0x58d/0xc70 [ 93.834322][ T5354] table_load+0x325/0x8a0 [ 93.834333][ T5354] dm_ctl_ioctl+0x9ec/0xe10 [ 93.834345][ T5354] __se_sys_ioctl+0xfc/0x170 [ 93.834355][ T5354] do_syscall_64+0x166/0x520 [ 93.834368][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.834379][ T5354] [ 93.834381][ T5354] The buggy address belongs to the object at ffff888035a64f80 [ 93.834381][ T5354] which belongs to the cache kmalloc-96 of size 96 [ 93.834390][ T5354] The buggy address is located 24 bytes inside of [ 93.834390][ T5354] freed 96-byte region [ffff888035a64f80, ffff888035a64fe0) [ 93.834398][ T5354] [ 93.834400][ T5354] The buggy address belongs to the physical page: [ 93.834404][ T5354] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35a64 [ 93.834412][ T5354] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 93.834419][ T5354] page_type: f5(slab) [ 93.834429][ T5354] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 93.834450][ T5354] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 93.834456][ T5354] page dumped because: kasan: bad access detected [ 93.834470][ T5354] page_owner tracks the page as allocated [ 93.834474][ T5354] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 88, tgid 88 (kworker/u4:5), ts 10988542553 [ 93.834491][ T5354] post_alloc_hook+0x1f9/0x250 [ 93.834506][ T5354] get_page_from_freelist+0x220f/0x2280 [ 93.834516][ T5354] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 93.834526][ T5354] allocate_slab+0x7d/0x5e0 [ 93.834537][ T5354] refill_objects+0x2d5/0x350 [ 93.834548][ T5354] __pcs_replace_empty_main+0x2c8/0x6c0 [ 93.834559][ T5354] __kmalloc_cache_node_noprof+0x446/0x620 [ 93.834568][ T5354] __get_vm_area_node+0x155/0x2f0 [ 93.834613][ T5354] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 93.834626][ T5354] __vmalloc_node_noprof+0xc2/0x100 [ 93.834639][ T5354] dup_task_struct+0x2c6/0xa00 [ 93.834661][ T5354] copy_process+0x7ea/0x44b0 [ 93.834714][ T5354] kernel_clone+0x2d7/0x940 [ 93.834729][ T5354] user_mode_thread+0x115/0x180 [ 93.834742][ T5354] call_usermodehelper_exec_work+0x5c/0x230 [ 93.834754][ T5354] process_scheduled_works+0xc3d/0x1630 [ 93.834769][ T5354] page_owner free stack trace missing [ 93.834773][ T5354] [ 93.834775][ T5354] Memory state around the buggy address: [ 93.834781][ T5354] ffff888035a64e80: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 93.834788][ T5354] ffff888035a64f00: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 93.834794][ T5354] >ffff888035a64f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 93.834799][ T5354] ^ [ 93.834804][ T5354] ffff888035a65000: 05 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc [ 93.834811][ T5354] ffff888035a65080: 05 fc fc fc 06 fc fc fc 06 fc fc fc 06 fc fc fc [ 93.834816][ T5354] ================================================================== [ 93.834888][ T5354] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.109560][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.113357][ T5354] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.117589][ T5354] Call Trace: [ 94.119100][ T5354] [ 94.120379][ T5354] vpanic+0x56d/0xa60 [ 94.122074][ T5354] ? __pfx_vpanic+0x10/0x10 [ 94.124061][ T5354] panic+0xc5/0xd0 [ 94.125583][ T5354] ? __pfx_panic+0x10/0x10 [ 94.127448][ T5354] ? preempt_schedule_thunk+0x16/0x40 [ 94.129816][ T5354] ? snapshot_ctr+0x5cb/0x1340 [ 94.131811][ T5354] ? preempt_schedule_thunk+0x16/0x40 [ 94.134121][ T5354] ? snapshot_ctr+0x5cb/0x1340 [ 94.136215][ T5354] check_panic_on_warn+0x89/0xb0 [ 94.138427][ T5354] ? snapshot_ctr+0x5cb/0x1340 [ 94.140556][ T5354] end_report+0x73/0x170 [ 94.142413][ T5354] ? snapshot_ctr+0x5cb/0x1340 [ 94.144472][ T5354] kasan_report+0x128/0x150 [ 94.146467][ T5354] ? snapshot_ctr+0x5cb/0x1340 [ 94.148605][ T5354] snapshot_ctr+0x5cb/0x1340 [ 94.150618][ T5354] ? __pfx_snapshot_ctr+0x10/0x10 [ 94.152804][ T5354] ? skip_spaces+0x8a/0xa0 [ 94.154725][ T5354] ? dm_split_args+0x50b/0x5d0 [ 94.156748][ T5354] dm_table_add_target+0x58d/0xc70 [ 94.158958][ T5354] table_load+0x325/0x8a0 [ 94.160674][ T5354] ? __pfx_table_load+0x10/0x10 [ 94.162601][ T5354] dm_ctl_ioctl+0x9ec/0xe10 [ 94.164441][ T5354] ? __pfx_table_load+0x10/0x10 [ 94.166460][ T5354] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 94.168621][ T5354] ? __fget_files+0x2a/0x420 [ 94.170687][ T5354] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.172853][ T5354] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 94.175065][ T5354] __se_sys_ioctl+0xfc/0x170 [ 94.177039][ T5354] do_syscall_64+0x166/0x520 [ 94.179119][ T5354] ? trace_irq_disable+0x3b/0x140 [ 94.181297][ T5354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.183861][ T5354] ? clear_bhb_loop+0x70/0xc0 [ 94.185877][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.188503][ T5354] RIP: 0033:0x7fa45c99f559 [ 94.190374][ T5354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.198246][ T5354] RSP: 002b:00007fa45d869fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.201755][ T5354] RAX: ffffffffffffffda RBX: 00007fa45cc26180 RCX: 00007fa45c99f559 [ 94.205104][ T5354] RDX: 0000200000000380 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 94.208528][ T5354] RBP: 00007fa45ca36b20 R08: 0000000000000000 R09: 0000000000000000 [ 94.211890][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.215295][ T5354] R13: 00007fa45cc26218 R14: 00007fa45cc26180 R15: 00007ffd776dce78 [ 94.218613][ T5354] [ 94.220385][ T5354] Kernel Offset: disabled [ 94.222261][ T5354] Rebooting in 86400 seconds..