================================================================== BUG: KFENCE: use-after-free read in dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Use-after-free read at 0xffff88823beb2018 (in kfence-#88): dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0x735/0x1c40 fs/open.c:956 vfs_open+0x82/0x3f0 fs/open.c:1086 do_open fs/namei.c:3830 [inline] path_openat+0x1e88/0x2d80 fs/namei.c:3989 do_filp_open+0x20c/0x470 fs/namei.c:4016 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#88: 0xffff88823beb2000-0xffff88823beb20d7, size=216, cache=kmalloc-256 allocated by task 1 on cpu 1 at 17.069035s (148.274675s ago): kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] dvb_register_device+0x1d8/0x2310 drivers/media/dvb-core/dvbdev.c:475 dvb_register_frontend+0x5a7/0x880 drivers/media/dvb-core/dvb_frontend.c:3051 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:436 [inline] vidtv_bridge_probe+0x45e/0xa90 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508 platform_probe+0xff/0x1f0 drivers/base/platform.c:1404 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x23e/0xa90 drivers/base/dd.c:658 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:800 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830 __driver_attach+0x283/0x580 drivers/base/dd.c:1216 bus_for_each_dev+0x13c/0x1d0 drivers/base/bus.c:370 bus_add_driver+0x2e9/0x690 drivers/base/bus.c:678 driver_register+0x15c/0x4b0 drivers/base/driver.c:249 vidtv_bridge_init+0x45/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598 do_one_initcall+0x128/0x700 init/main.c:1257 do_initcall_level init/main.c:1319 [inline] do_initcalls init/main.c:1335 [inline] do_basic_setup init/main.c:1354 [inline] kernel_init_freeable+0x5c7/0x900 init/main.c:1568 kernel_init+0x1c/0x2b0 init/main.c:1457 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 freed by task 7345 on cpu 0 at 165.257314s (0.179170s ago): dvb_free_device drivers/media/dvb-core/dvbdev.c:619 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put.part.0+0x60/0x90 drivers/media/dvb-core/dvbdev.c:632 dvb_device_put drivers/media/dvb-core/dvbdev.c:631 [inline] dvb_device_open+0x2a4/0x3b0 drivers/media/dvb-core/dvbdev.c:113 chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0x735/0x1c40 fs/open.c:956 vfs_open+0x82/0x3f0 fs/open.c:1086 do_open fs/namei.c:3830 [inline] path_openat+0x1e88/0x2d80 fs/namei.c:3989 do_filp_open+0x20c/0x470 fs/namei.c:4016 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7346 Comm: syz.3.417 Not tainted 6.14.0-rc3-syzkaller-00079-g87a132e73910 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 RIP: 0010:dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Code: 0f 84 3f 02 00 00 e8 31 87 03 fa 48 8d 7d 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 77 02 00 00 <4c> 8b 6d 18 4d 85 ed 0f 84 0e 02 00 00 e8 00 87 03 fa 4c 89 ea 48 RSP: 0018:ffffc90004f4f920 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 1ffff110477d6403 RSI: ffffffff87b6570f RDI: ffff88823beb2018 RBP: ffff88823beb2000 R08: 0000000000000001 R09: fffffbfff1efe515 R10: ffffffff8f7f28af R11: 0000000000000001 R12: ffff88802b68b340 R13: ffffffff87b65640 R14: ffff88802ab88808 R15: ffff88802b68b390 FS: 00007f827aa0c6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823beb2018 CR3: 00000000642de000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0x735/0x1c40 fs/open.c:956 vfs_open+0x82/0x3f0 fs/open.c:1086 do_open fs/namei.c:3830 [inline] path_openat+0x1e88/0x2d80 fs/namei.c:3989 do_filp_open+0x20c/0x470 fs/namei.c:4016 do_sys_openat2+0x17a/0x1e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8279b8cde9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f827aa0c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f8279da6080 RCX: 00007f8279b8cde9 RDX: 0000000000000001 RSI: 0000400000000000 RDI: ffffffffffffff9c RBP: 00007f8279c0e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f8279da6080 R15: 00007ffdc2d127e8 ================================================================== ---------------- Code disassembly (best guess): 0: 0f 84 3f 02 00 00 je 0x245 6: e8 31 87 03 fa call 0xfa03873c b: 48 8d 7d 18 lea 0x18(%rbp),%rdi f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 48 89 fa mov %rdi,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 77 02 00 00 jne 0x2a1 * 2a: 4c 8b 6d 18 mov 0x18(%rbp),%r13 <-- trapping instruction 2e: 4d 85 ed test %r13,%r13 31: 0f 84 0e 02 00 00 je 0x245 37: e8 00 87 03 fa call 0xfa03873c 3c: 4c 89 ea mov %r13,%rdx 3f: 48 rex.W