program:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004cc311ec8500000075000000a70000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
fsetxattr$security_capability(r1, &(0x7f0000000240), &(0x7f0000000280)=@v2={0x2000000, [{0x7fffffff, 0xfb}, {0x2, 0x7}]}, 0x14, 0x1) (async)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) (async)
sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x6c, 0x2, 0x9, 0x201, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1e}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x5}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8}}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0xde20}}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x39}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x1}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x440c1}, 0x80) (async, rerun: 32)
syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) (rerun: 32)
[ 94.454885][ T45] Bluetooth: hci0: command tx timeout
[ 94.574741][ T5329] ==================================================================
[ 94.579009][ T5329] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc4/0x340
[ 94.582714][ T5329] Read of size 8 at addr ffff888035c06018 by task syz.0.0/5329
[ 94.586056][ T5329]
[ 94.587185][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.587200][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.587205][ T5329] Call Trace:
[ 94.587212][ T5329]
[ 94.587219][ T5329] dump_stack_lvl+0xe8/0x150
[ 94.587242][ T5329] print_address_description+0x55/0x1e0
[ 94.587258][ T5329] ? dvb_device_open+0xc4/0x340
[ 94.587269][ T5329] print_report+0x58/0x70
[ 94.587281][ T5329] kasan_report+0x117/0x150
[ 94.587296][ T5329] ? dvb_device_open+0xc4/0x340
[ 94.587308][ T5329] dvb_device_open+0xc4/0x340
[ 94.587317][ T5329] ? do_raw_spin_unlock+0x4d/0x210
[ 94.587333][ T5329] chrdev_open+0x4d9/0x600
[ 94.587345][ T5329] ? __pfx_chrdev_open+0x10/0x10
[ 94.587354][ T5329] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0
[ 94.587370][ T5329] ? __pfx_chrdev_open+0x10/0x10
[ 94.587379][ T5329] do_dentry_open+0x816/0x1380
[ 94.587393][ T5329] vfs_open+0x3b/0x340
[ 94.587403][ T5329] ? path_openat+0x2e2d/0x3830
[ 94.587419][ T5329] path_openat+0x2e44/0x3830
[ 94.587435][ T5329] ? kasan_save_track+0x3e/0x80
[ 94.587447][ T5329] ? do_sys_openat2+0xcc/0x200
[ 94.587459][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.587473][ T5329] do_file_open+0x23e/0x4a0
[ 94.587488][ T5329] ? __pfx_do_file_open+0x10/0x10
[ 94.587509][ T5329] ? _raw_spin_unlock+0x28/0x50
[ 94.587524][ T5329] ? alloc_fd+0x651/0x6c0
[ 94.587539][ T5329] do_sys_openat2+0x115/0x200
[ 94.587556][ T5329] ? __pfx_do_sys_openat2+0x10/0x10
[ 94.587565][ T5329] ? __task_pid_nr_ns+0x28/0x470
[ 94.587576][ T5329] __x64_sys_openat+0x138/0x170
[ 94.587584][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.587591][ T5329] do_syscall_64+0x174/0x580
[ 94.587599][ T5329] ? trace_irq_disable+0x3b/0x140
[ 94.587609][ T5329] ? clear_bhb_loop+0x40/0x90
[ 94.587616][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.587624][ T5329] RIP: 0033:0x7fec8215e7ce
[ 94.587633][ T5329] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 94.587639][ T5329] RSP: 002b:00007fec82fe8ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 94.587649][ T5329] RAX: ffffffffffffffda RBX: 00007fec82fe96c0 RCX: 00007fec8215e7ce
[ 94.587654][ T5329] RDX: 0000000000040002 RSI: 00007fec82fe8bc0 RDI: ffffffffffffff9c
[ 94.587660][ T5329] RBP: 00007fec82fe8bc0 R08: 0000000000000000 R09: 0000000000000000
[ 94.587664][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
[ 94.587669][ T5329] R13: 00007fec82426218 R14: 00007fec82426180 R15: 00007ffc31b09a18
[ 94.587676][ T5329]
[ 94.587679][ T5329]
[ 94.714078][ T5329] Allocated by task 1:
[ 94.716316][ T5329] kasan_save_track+0x3e/0x80
[ 94.718598][ T5329] __kasan_kmalloc+0x93/0xb0
[ 94.720779][ T5329] __kmalloc_cache_noprof+0x32d/0x660
[ 94.723293][ T5329] dvb_register_device+0x309/0x1dd0
[ 94.725857][ T5329] dvb_register_frontend+0x603/0x900
[ 94.728574][ T5329] vidtv_bridge_probe+0x9d5/0xf60
[ 94.731062][ T5329] platform_probe+0xf9/0x190
[ 94.733326][ T5329] really_probe+0x254/0xae0
[ 94.735541][ T5329] __driver_probe_device+0x1e8/0x360
[ 94.738421][ T5329] driver_probe_device+0x4f/0x240
[ 94.741060][ T5329] __driver_attach+0x339/0x600
[ 94.743289][ T5329] bus_for_each_dev+0x23b/0x2c0
[ 94.745508][ T5329] bus_add_driver+0x345/0x670
[ 94.747809][ T5329] driver_register+0x23a/0x320
[ 94.750555][ T5329] vidtv_bridge_init+0x3d/0x60
[ 94.753055][ T5329] do_one_initcall+0x250/0x870
[ 94.755213][ T5329] do_initcall_level+0x10a/0x1a0
[ 94.757548][ T5329] do_initcalls+0x59/0xa0
[ 94.759863][ T5329] kernel_init_freeable+0x29d/0x3e0
[ 94.762788][ T5329] kernel_init+0x1d/0x1d0
[ 94.764862][ T5329] ret_from_fork+0x514/0xb70
[ 94.766981][ T5329] ret_from_fork_asm+0x1a/0x30
[ 94.769143][ T5329]
[ 94.770475][ T5329] Freed by task 5329:
[ 94.773061][ T5329] kasan_save_track+0x3e/0x80
[ 94.775472][ T5329] kasan_save_free_info+0x40/0x50
[ 94.777708][ T5329] __kasan_slab_free+0x5c/0x80
[ 94.779713][ T5329] kfree+0x1c5/0x640
[ 94.781655][ T5329] dvb_device_open+0x2b8/0x340
[ 94.784302][ T5329] chrdev_open+0x4d9/0x600
[ 94.786720][ T5329] do_dentry_open+0x816/0x1380
[ 94.789124][ T5329] vfs_open+0x3b/0x340
[ 94.790967][ T5329] path_openat+0x2e44/0x3830
[ 94.793110][ T5329] do_file_open+0x23e/0x4a0
[ 94.795353][ T5329] do_sys_openat2+0x115/0x200
[ 94.797828][ T5329] __x64_sys_openat+0x138/0x170
[ 94.800266][ T5329] do_syscall_64+0x174/0x580
[ 94.802421][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.805014][ T5329]
[ 94.806139][ T5329] The buggy address belongs to the object at ffff888035c06000
[ 94.806139][ T5329] which belongs to the cache kmalloc-256 of size 256
[ 94.813205][ T5329] The buggy address is located 24 bytes inside of
[ 94.813205][ T5329] freed 256-byte region [ffff888035c06000, ffff888035c06100)
[ 94.818912][ T5329]
[ 94.819984][ T5329] The buggy address belongs to the physical page:
[ 94.823160][ T5329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35c06
[ 94.827186][ T5329] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 94.830227][ T5329] page_type: f5(slab)
[ 94.832134][ T5329] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000
[ 94.836091][ T5329] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 94.839543][ T5329] page dumped because: kasan: bad access detected
[ 94.842259][ T5329] page_owner tracks the page as allocated
[ 94.844866][ T5329] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20646327205, free_ts 20423279697
[ 94.853441][ T5329] post_alloc_hook+0x1f9/0x250
[ 94.855882][ T5329] get_page_from_freelist+0x21fa/0x2270
[ 94.858715][ T5329] __alloc_frozen_pages_noprof+0x18d/0x380
[ 94.861000][ T5329] allocate_slab+0x79/0x5e0
[ 94.862798][ T5329] refill_objects+0x2d5/0x350
[ 94.864744][ T5329] __pcs_replace_empty_main+0x2bf/0x6b0
[ 94.867617][ T5329] __kmalloc_cache_noprof+0x3a7/0x660
[ 94.870258][ T5329] bus_add_driver+0x162/0x670
[ 94.872336][ T5329] driver_register+0x23a/0x320
[ 94.874334][ T5329] usb_register_driver+0x1e4/0x390
[ 94.876682][ T5329] do_one_initcall+0x250/0x870
[ 94.879197][ T5329] do_initcall_level+0x10a/0x1a0
[ 94.881767][ T5329] do_initcalls+0x59/0xa0
[ 94.883990][ T5329] kernel_init_freeable+0x29d/0x3e0
[ 94.886408][ T5329] kernel_init+0x1d/0x1d0
[ 94.888357][ T5329] ret_from_fork+0x514/0xb70
[ 94.890699][ T5329] page last free pid 1 tgid 1 stack trace:
[ 94.893705][ T5329] __free_frozen_pages+0xc1e/0xd10
[ 94.896017][ T5329] __slab_free+0x274/0x2c0
[ 94.897925][ T5329] qlist_free_all+0x99/0x100
[ 94.899812][ T5329] kasan_quarantine_reduce+0x148/0x160
[ 94.902176][ T5329] __kasan_slab_alloc+0x22/0x80
[ 94.904506][ T5329] __kmalloc_cache_noprof+0x2ab/0x660
[ 94.906734][ T5329] bus_add_driver+0x162/0x670
[ 94.908572][ T5329] driver_register+0x23a/0x320
[ 94.910333][ T5329] usb_register_driver+0x1e4/0x390
[ 94.912428][ T5329] do_one_initcall+0x250/0x870
[ 94.914736][ T5329] do_initcall_level+0x10a/0x1a0
[ 94.917104][ T5329] do_initcalls+0x59/0xa0
[ 94.919168][ T5329] kernel_init_freeable+0x29d/0x3e0
[ 94.921691][ T5329] kernel_init+0x1d/0x1d0
[ 94.923707][ T5329] ret_from_fork+0x514/0xb70
[ 94.925971][ T5329] ret_from_fork_asm+0x1a/0x30
[ 94.928422][ T5329]
[ 94.929571][ T5329] Memory state around the buggy address:
[ 94.931737][ T5329] ffff888035c05f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.935031][ T5329] ffff888035c05f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 94.938995][ T5329] >ffff888035c06000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.942683][ T5329] ^
[ 94.944828][ T5329] ffff888035c06080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 94.948260][ T5329] ffff888035c06100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.952427][ T5329] ==================================================================
[ 95.001193][ T5329] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.004383][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.008154][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.012287][ T5329] Call Trace:
[ 95.014193][ T5329]
[ 95.015924][ T5329] vpanic+0x56c/0xa60
[ 95.018026][ T5329] ? __pfx_vpanic+0x10/0x10
[ 95.020031][ T5329] ? __pfx___schedule+0x10/0x10
[ 95.022058][ T5329] panic+0xc5/0xd0
[ 95.023675][ T5329] ? __pfx_panic+0x10/0x10
[ 95.025543][ T5329] ? preempt_schedule_thunk+0x16/0x40
[ 95.028688][ T5329] ? dvb_device_open+0xc4/0x340
[ 95.031419][ T5329] check_panic_on_warn+0x89/0xb0
[ 95.033809][ T5329] ? dvb_device_open+0xc4/0x340
[ 95.036040][ T5329] end_report+0x73/0x170
[ 95.037880][ T5329] ? dvb_device_open+0xc4/0x340
[ 95.040170][ T5329] kasan_report+0x128/0x150
[ 95.042559][ T5329] ? dvb_device_open+0xc4/0x340
[ 95.044961][ T5329] dvb_device_open+0xc4/0x340
[ 95.046991][ T5329] ? do_raw_spin_unlock+0x4d/0x210
[ 95.049250][ T5329] chrdev_open+0x4d9/0x600
[ 95.051339][ T5329] ? __pfx_chrdev_open+0x10/0x10
[ 95.053783][ T5329] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0
[ 95.056934][ T5329] ? __pfx_chrdev_open+0x10/0x10
[ 95.059079][ T5329] do_dentry_open+0x816/0x1380
[ 95.061162][ T5329] vfs_open+0x3b/0x340
[ 95.063076][ T5329] ? path_openat+0x2e2d/0x3830
[ 95.065373][ T5329] path_openat+0x2e44/0x3830
[ 95.067707][ T5329] ? kasan_save_track+0x3e/0x80
[ 95.070064][ T5329] ? do_sys_openat2+0xcc/0x200
[ 95.072227][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.074938][ T5329] do_file_open+0x23e/0x4a0
[ 95.077049][ T5329] ? __pfx_do_file_open+0x10/0x10
[ 95.079576][ T5329] ? _raw_spin_unlock+0x28/0x50
[ 95.082178][ T5329] ? alloc_fd+0x651/0x6c0
[ 95.084112][ T5329] do_sys_openat2+0x115/0x200
[ 95.086160][ T5329] ? __pfx_do_sys_openat2+0x10/0x10
[ 95.088659][ T5329] ? __task_pid_nr_ns+0x28/0x470
[ 95.091263][ T5329] __x64_sys_openat+0x138/0x170
[ 95.093734][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.096301][ T5329] do_syscall_64+0x174/0x580
[ 95.098314][ T5329] ? trace_irq_disable+0x3b/0x140
[ 95.100614][ T5329] ? clear_bhb_loop+0x40/0x90
[ 95.103357][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.106161][ T5329] RIP: 0033:0x7fec8215e7ce
[ 95.108109][ T5329] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 95.116271][ T5329] RSP: 002b:00007fec82fe8ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 95.120920][ T5329] RAX: ffffffffffffffda RBX: 00007fec82fe96c0 RCX: 00007fec8215e7ce
[ 95.124575][ T5329] RDX: 0000000000040002 RSI: 00007fec82fe8bc0 RDI: ffffffffffffff9c
[ 95.128107][ T5329] RBP: 00007fec82fe8bc0 R08: 0000000000000000 R09: 0000000000000000
[ 95.132508][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
[ 95.136324][ T5329] R13: 00007fec82426218 R14: 00007fec82426180 R15: 00007ffc31b09a18
[ 95.139722][ T5329]
[ 95.141580][ T5329] Kernel Offset: disabled
[ 95.143497][ T5329] Rebooting in 86400 seconds..