program: ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000080)='mem\x00\x10\x00\x00\x00\x00\x00\x00I\xa2l') timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) (async) syz_open_dev$dvb_frontend(&(0x7f0000000540), 0x0, 0x200200) (async, rerun: 64) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (rerun: 64) r1 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) sendmsg$IEEE802154_START_REQ(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000a40)={0x44, r3, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_SF_ORD={0x5}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}, @IEEE802154_ATTR_BCN_ORD={0x5}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}, @IEEE802154_ATTR_COORD_PAN_ID={0x6}, @IEEE802154_ATTR_CHANNEL={0x5}]}, 0x44}}, 0x0) (async) pread64(r1, 0x0, 0x0, 0xfff) [ 108.465432][ T44] Bluetooth: hci0: command tx timeout [ 108.520909][ T5330] ================================================================== [ 108.524607][ T5330] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x407/0x4d0 [ 108.528737][ T5330] Read of size 4 at addr ffff88803620b23c by task syz.0.0/5330 [ 108.532257][ T5330] [ 108.533307][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 108.533324][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.533331][ T5330] Call Trace: [ 108.533339][ T5330] [ 108.533345][ T5330] dump_stack_lvl+0xe8/0x150 [ 108.533364][ T5330] print_address_description+0x55/0x1e0 [ 108.533377][ T5330] ? dvb_frontend_release+0x407/0x4d0 [ 108.533389][ T5330] print_report+0x58/0x70 [ 108.533399][ T5330] kasan_report+0x117/0x150 [ 108.533409][ T5330] ? dvb_frontend_release+0x407/0x4d0 [ 108.533421][ T5330] dvb_frontend_release+0x407/0x4d0 [ 108.533432][ T5330] ? __pfx_dvb_frontend_release+0x10/0x10 [ 108.533442][ T5330] __fput+0x418/0xa50 [ 108.533458][ T5330] task_work_run+0x1d9/0x270 [ 108.533470][ T5330] ? __pfx_task_work_run+0x10/0x10 [ 108.533481][ T5330] ? do_raw_spin_unlock+0x4d/0x210 [ 108.533497][ T5330] do_exit+0x73a/0x2360 [ 108.533511][ T5330] ? __pfx_do_exit+0x10/0x10 [ 108.533522][ T5330] ? do_raw_spin_lock+0x12b/0x2f0 [ 108.533536][ T5330] do_group_exit+0x22d/0x2f0 [ 108.533547][ T5330] ? _raw_spin_unlock_irq+0x23/0x50 [ 108.533564][ T5330] get_signal+0x121b/0x12c0 [ 108.533583][ T5330] arch_do_signal_or_restart+0xbb/0x860 [ 108.533600][ T5330] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 108.533618][ T5330] exit_to_user_mode_loop+0x104/0x730 [ 108.533629][ T5330] ? rcu_is_watching+0x15/0xb0 [ 108.533641][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.533652][ T5330] do_syscall_64+0x353/0x580 [ 108.533664][ T5330] ? clear_bhb_loop+0x40/0x90 [ 108.533676][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.533687][ T5330] RIP: 0033:0x7f0d9059ce59 [ 108.533697][ T5330] Code: Unable to access opcode bytes at 0x7f0d9059ce2f. [ 108.533703][ T5330] RSP: 002b:00007f0d914060a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 108.533716][ T5330] RAX: fffffffffffffe00 RBX: 00007f0d90815fa8 RCX: 00007f0d9059ce59 [ 108.533724][ T5330] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0d90815fa8 [ 108.533730][ T5330] RBP: 00007f0d90815fa0 R08: 0000000000000000 R09: 0000000000000000 [ 108.533737][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 108.533743][ T5330] R13: 00007f0d90816038 R14: 00007ffee9407380 R15: 00007ffee9407468 [ 108.533754][ T5330] [ 108.533758][ T5330] [ 108.636159][ T5330] Allocated by task 1: [ 108.637921][ T5330] kasan_save_track+0x3e/0x80 [ 108.639861][ T5330] __kasan_kmalloc+0x93/0xb0 [ 108.641649][ T5330] __kmalloc_cache_noprof+0x32d/0x660 [ 108.643955][ T5330] dvb_register_device+0x309/0x1dd0 [ 108.646490][ T5330] dvb_register_frontend+0x603/0x900 [ 108.649286][ T5330] vidtv_bridge_probe+0x9d5/0xf60 [ 108.651406][ T5330] platform_probe+0xf9/0x190 [ 108.653295][ T5330] really_probe+0x254/0xae0 [ 108.655250][ T5330] __driver_probe_device+0x1e8/0x360 [ 108.657537][ T5330] driver_probe_device+0x4f/0x240 [ 108.659657][ T5330] __driver_attach+0x339/0x600 [ 108.661538][ T5330] bus_for_each_dev+0x23b/0x2c0 [ 108.663652][ T5330] bus_add_driver+0x345/0x670 [ 108.665872][ T5330] driver_register+0x23a/0x320 [ 108.668690][ T5330] vidtv_bridge_init+0x3d/0x60 [ 108.671619][ T5330] do_one_initcall+0x250/0x870 [ 108.673902][ T5330] do_initcall_level+0x10a/0x1a0 [ 108.676114][ T5330] do_initcalls+0x59/0xa0 [ 108.678012][ T5330] kernel_init_freeable+0x29d/0x3e0 [ 108.680289][ T5330] kernel_init+0x1d/0x1d0 [ 108.682143][ T5330] ret_from_fork+0x514/0xb70 [ 108.684082][ T5330] ret_from_fork_asm+0x1a/0x30 [ 108.686200][ T5330] [ 108.687434][ T5330] Freed by task 5330: [ 108.689486][ T5330] kasan_save_track+0x3e/0x80 [ 108.692013][ T5330] kasan_save_free_info+0x40/0x50 [ 108.694398][ T5330] __kasan_slab_free+0x5c/0x80 [ 108.696488][ T5330] kfree+0x1c5/0x640 [ 108.698144][ T5330] dvb_generic_release+0x11d/0x1b0 [ 108.700347][ T5330] dvb_frontend_release+0x132/0x4d0 [ 108.702532][ T5330] __fput+0x418/0xa50 [ 108.704249][ T5330] task_work_run+0x1d9/0x270 [ 108.706302][ T5330] do_exit+0x73a/0x2360 [ 108.708408][ T5330] do_group_exit+0x22d/0x2f0 [ 108.711150][ T5330] get_signal+0x121b/0x12c0 [ 108.713331][ T5330] arch_do_signal_or_restart+0xbb/0x860 [ 108.715727][ T5330] exit_to_user_mode_loop+0x104/0x730 [ 108.717914][ T5330] do_syscall_64+0x353/0x580 [ 108.719849][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.722222][ T5330] [ 108.723558][ T5330] The buggy address belongs to the object at ffff88803620b200 [ 108.723558][ T5330] which belongs to the cache kmalloc-256 of size 256 [ 108.730693][ T5330] The buggy address is located 60 bytes inside of [ 108.730693][ T5330] freed 256-byte region [ffff88803620b200, ffff88803620b300) [ 108.736355][ T5330] [ 108.737465][ T5330] The buggy address belongs to the physical page: [ 108.740234][ T5330] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3620b [ 108.744414][ T5330] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 108.747729][ T5330] page_type: f5(slab) [ 108.749396][ T5330] raw: 04fff00000000000 ffff88801ac41b40 dead000000000122 0000000000000000 [ 108.753208][ T5330] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 108.757195][ T5330] page dumped because: kasan: bad access detected [ 108.760037][ T5330] page_owner tracks the page as allocated [ 108.762395][ T5330] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 27563552373, free_ts 27336816297 [ 108.771417][ T5330] post_alloc_hook+0x1f9/0x250 [ 108.773676][ T5330] get_page_from_freelist+0x21fa/0x2270 [ 108.776114][ T5330] __alloc_frozen_pages_noprof+0x18d/0x380 [ 108.778594][ T5330] allocate_slab+0x79/0x5e0 [ 108.780557][ T5330] refill_objects+0x2d5/0x350 [ 108.782616][ T5330] __pcs_replace_empty_main+0x2bf/0x6b0 [ 108.785089][ T5330] __kmalloc_cache_noprof+0x3a7/0x660 [ 108.787818][ T5330] bus_add_driver+0x162/0x670 [ 108.790136][ T5330] driver_register+0x23a/0x320 [ 108.792474][ T5330] usb_register_driver+0x1e4/0x390 [ 108.794751][ T5330] do_one_initcall+0x250/0x870 [ 108.796801][ T5330] do_initcall_level+0x10a/0x1a0 [ 108.798966][ T5330] do_initcalls+0x59/0xa0 [ 108.800795][ T5330] kernel_init_freeable+0x29d/0x3e0 [ 108.803217][ T5330] kernel_init+0x1d/0x1d0 [ 108.805424][ T5330] ret_from_fork+0x514/0xb70 [ 108.807890][ T5330] page last free pid 1 tgid 1 stack trace: [ 108.810513][ T5330] __free_frozen_pages+0xc1e/0xd10 [ 108.812778][ T5330] __slab_free+0x274/0x2c0 [ 108.814675][ T5330] qlist_free_all+0x99/0x100 [ 108.816547][ T5330] kasan_quarantine_reduce+0x148/0x160 [ 108.818680][ T5330] __kasan_slab_alloc+0x22/0x80 [ 108.820754][ T5330] __kmalloc_cache_noprof+0x2ab/0x660 [ 108.823217][ T5330] lookup_or_create_module_kobject+0x75/0x170 [ 108.826023][ T5330] module_add_driver+0x79/0x320 [ 108.827939][ T5330] bus_add_driver+0x391/0x670 [ 108.829813][ T5330] driver_register+0x23a/0x320 [ 108.831781][ T5330] usb_register_driver+0x1e4/0x390 [ 108.834180][ T5330] do_one_initcall+0x250/0x870 [ 108.836427][ T5330] do_initcall_level+0x10a/0x1a0 [ 108.838878][ T5330] do_initcalls+0x59/0xa0 [ 108.840927][ T5330] kernel_init_freeable+0x29d/0x3e0 [ 108.843127][ T5330] kernel_init+0x1d/0x1d0 [ 108.845093][ T5330] [ 108.846169][ T5330] Memory state around the buggy address: [ 108.848855][ T5330] ffff88803620b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 108.853649][ T5330] ffff88803620b180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 108.857410][ T5330] >ffff88803620b200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.860165][ T5330] ^ [ 108.862322][ T5330] ffff88803620b280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.865581][ T5330] ffff88803620b300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 108.868753][ T5330] ================================================================== [ 108.950035][ T5330] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 108.953653][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 108.957874][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.962338][ T5330] Call Trace: [ 108.963870][ T5330] [ 108.965244][ T5330] vpanic+0x56c/0xa60 [ 108.967089][ T5330] ? __pfx_vpanic+0x10/0x10 [ 108.969408][ T5330] ? __pfx___schedule+0x10/0x10 [ 108.972061][ T5330] panic+0xc5/0xd0 [ 108.973952][ T5330] ? __pfx_panic+0x10/0x10 [ 108.976175][ T5330] ? preempt_schedule_common+0x82/0xd0 [ 108.978845][ T5330] ? dvb_frontend_release+0x407/0x4d0 [ 108.981322][ T5330] check_panic_on_warn+0x89/0xb0 [ 108.983483][ T5330] ? dvb_frontend_release+0x407/0x4d0 [ 108.985872][ T5330] end_report+0x73/0x170 [ 108.987651][ T5330] ? dvb_frontend_release+0x407/0x4d0 [ 108.989993][ T5330] kasan_report+0x128/0x150 [ 108.992125][ T5330] ? dvb_frontend_release+0x407/0x4d0 [ 108.995628][ T5330] dvb_frontend_release+0x407/0x4d0 [ 108.998396][ T5330] ? __pfx_dvb_frontend_release+0x10/0x10 [ 109.001047][ T5330] __fput+0x418/0xa50 [ 109.002771][ T5330] task_work_run+0x1d9/0x270 [ 109.004754][ T5330] ? __pfx_task_work_run+0x10/0x10 [ 109.006886][ T5330] ? do_raw_spin_unlock+0x4d/0x210 [ 109.009063][ T5330] do_exit+0x73a/0x2360 [ 109.010712][ T5330] ? __pfx_do_exit+0x10/0x10 [ 109.012918][ T5330] ? do_raw_spin_lock+0x12b/0x2f0 [ 109.015239][ T5330] do_group_exit+0x22d/0x2f0 [ 109.017749][ T5330] ? _raw_spin_unlock_irq+0x23/0x50 [ 109.019902][ T5330] get_signal+0x121b/0x12c0 [ 109.021708][ T5330] arch_do_signal_or_restart+0xbb/0x860 [ 109.023900][ T5330] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 109.026320][ T5330] exit_to_user_mode_loop+0x104/0x730 [ 109.028584][ T5330] ? rcu_is_watching+0x15/0xb0 [ 109.030933][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.034405][ T5330] do_syscall_64+0x353/0x580 [ 109.036796][ T5330] ? clear_bhb_loop+0x40/0x90 [ 109.039000][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.041584][ T5330] RIP: 0033:0x7f0d9059ce59 [ 109.043535][ T5330] Code: Unable to access opcode bytes at 0x7f0d9059ce2f. [ 109.046768][ T5330] RSP: 002b:00007f0d914060a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 109.050298][ T5330] RAX: fffffffffffffe00 RBX: 00007f0d90815fa8 RCX: 00007f0d9059ce59 [ 109.053647][ T5330] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0d90815fa8 [ 109.057142][ T5330] RBP: 00007f0d90815fa0 R08: 0000000000000000 R09: 0000000000000000 [ 109.061045][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.065049][ T5330] R13: 00007f0d90816038 R14: 00007ffee9407380 R15: 00007ffee9407468 [ 109.068629][ T5330] [ 109.070199][ T5330] Kernel Offset: disabled [ 109.072121][ T5330] Rebooting in 86400 seconds..