==================================================================
BUG: KASAN: slab-out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: slab-out-of-bounds in atomic_inc_not_zero include/linux/atomic/atomic-instrumented.h:1536 [inline]
BUG: KASAN: slab-out-of-bounds in try_module_get+0x50/0x114 kernel/module/main.c:941
Write of size 4 at addr ffff0000cc393ef0 by task syz.5.1701/10897

CPU: 1 UID: 0 PID: 10897 Comm: syz.5.1701 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
 atomic_inc_not_zero include/linux/atomic/atomic-instrumented.h:1536 [inline]
 try_module_get+0x50/0x114 kernel/module/main.c:941
 dvb_device_open+0xf4/0x250 drivers/media/dvb-core/dvbdev.c:103
 chrdev_open+0x398/0x3e8 fs/char_dev.c:411
 do_dentry_open+0x5c8/0x10dc fs/open.c:947
 vfs_open+0x44/0x2d4 fs/open.c:1079
 do_open fs/namei.c:4699 [inline]
 path_openat+0x2234/0x2a6c fs/namei.c:4858
 do_file_open+0x1c4/0x2e4 fs/namei.c:4887
 do_sys_openat2+0x114/0x1e8 fs/open.c:1364
 do_sys_open+0xac/0xdc fs/open.c:1370
 __do_sys_openat fs/open.c:1386 [inline]
 __se_sys_openat fs/open.c:1381 [inline]
 __arm64_sys_openat+0x9c/0xb8 fs/open.c:1381
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x25c arch/arm64/kernel/entry-common.c:723
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594

Allocated by task 1:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x284/0x56c mm/slub.c:5415
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 bus_add_driver+0x94/0x4fc drivers/base/bus.c:740
 driver_register+0x220/0x30c drivers/base/driver.c:249
 __platform_driver_register+0x6c/0x80 drivers/base/platform.c:910
 vidtv_bridge_init+0x34/0x5c drivers/media/test-drivers/vidtv/vidtv_bridge.c:600
 do_one_initcall+0x274/0xc20 init/main.c:1392
 do_initcall_level+0x128/0x1c4 init/main.c:1454
 do_initcalls+0x70/0xd0 init/main.c:1470
 do_basic_setup+0x7c/0x90 init/main.c:1490
 kernel_init_freeable+0x268/0x3a8 init/main.c:1703
 kernel_init+0x24/0x1dc init/main.c:1593
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842

The buggy address belongs to the object at ffff0000cc393e00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 32 bytes to the right of
 allocated 208-byte region [ffff0000cc393e00, ffff0000cc393ed0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c392
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 05ffc00000000001 fffffdffc330e481 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000cc393d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000cc393e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000cc393e80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
                                                             ^
 ffff0000cc393f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000cc393f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================