Warning: Permanently added '[localhost]:2929' (ED25519) to the list of known hosts.
[*] Starting multi-threaded PTP cdev_put UAF race reproducer...
[+] Detected 4 online CPU cores.
[*] Searching /sys/class/ptp for base clock with n_vclocks...
[+] Found base PTP clock: ptp0, sysfs path: /sys/class/ptp/ptp0/n_vclocks
[+] Discovered PTP major number: 244 (minor: 0)
[*] Resetting any active virtual clocks on /sys/class/ptp/ptp0/n_vclocks...
[+] Active virtual clocks reset successfully.
[ 68.212654][ T6124] ptp ptp0: only physical clock in use now
[*] Creating persistent device nodes /dev/ptp_v1 .. /dev/ptp_v4...
[+] Created character device node: /dev/ptp_v1
[+] Created character device node: /dev/ptp_v2
[+] Created character device node: /dev/ptp_v3
[+] Created character device node: /dev/ptp_v4
[*] Spawning 6 race worker threads across CPU cores...
[+] All worker threads created successfully.
[*] Racing clock unregistration vs. file descriptor closure for 12 seconds...
[+] Lifecycle thread started on CPU 0.
[+] Lifecycle thread successfully opened /sys/class/ptp/ptp0/n_vclocks.
[ 68.293496][ T6126] ptp ptp0: new virtual clock ptp2
[ 68.310174][ T6126] ptp ptp0: new virtual clock ptp3
[ 68.310194][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.310626][ T6126] ptp ptp0: delete virtual clock ptp3
[ 68.330900][ T6126] ptp ptp0: delete virtual clock ptp2
[ 68.348805][ T6126] ptp ptp0: only physical clock in use now
[ 68.361381][ T6126] ptp ptp0: new virtual clock ptp3
[ 68.374505][ T6126] ptp ptp0: new virtual clock ptp4
[ 68.391835][ T6126] ptp ptp0: new virtual clock ptp5
[ 68.409163][ T6126] ptp ptp0: new virtual clock ptp6
[ 68.409181][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.410539][ T6126] ptp ptp0: delete virtual clock ptp6
[ 68.423698][ T6126] ptp ptp0: delete virtual clock ptp5
[ 68.430419][ T6126] ptp ptp0: delete virtual clock ptp4
[ 68.433931][ T6126] ptp ptp0: delete virtual clock ptp3
[ 68.437992][ T6126] ptp ptp0: only physical clock in use now
[ 68.452310][ T6126] ptp ptp0: new virtual clock ptp3
[ 68.463110][ T6126] ptp ptp0: new virtual clock ptp4
[ 68.463128][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.465504][ T6126] ptp ptp0: delete virtual clock ptp4
[ 68.478328][ T6126] ptp ptp0: delete virtual clock ptp3
[ 68.486841][ T6126] ptp ptp0: only physical clock in use now
[ 68.503469][ T6126] ptp ptp0: new virtual clock ptp4
[ 68.507292][ T6126] ptp ptp0: new virtual clock ptp5
[ 68.512476][ T6126] ptp ptp0: new virtual clock ptp6
[ 68.516049][ T6126] ptp ptp0: new virtual clock ptp7
[ 68.516060][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.516413][ T6126] ptp ptp0: delete virtual clock ptp7
[ 68.530106][ T6126] ptp ptp0: delete virtual clock ptp6
[ 68.534428][ T6126] ptp ptp0: delete virtual clock ptp5
[ 68.538689][ T6126] ptp ptp0: delete virtual clock ptp4
[ 68.547019][ T6126] ptp ptp0: only physical clock in use now
[ 68.554851][ T6126] ptp ptp0: new virtual clock ptp4
[ 68.558584][ T6126] ptp ptp0: new virtual clock ptp5
[ 68.558595][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.559277][ T6126] ptp ptp0: delete virtual clock ptp5
[ 68.572169][ T6126] ptp ptp0: delete virtual clock ptp4
[ 68.576097][ T6126] ptp ptp0: only physical clock in use now
[ 68.581297][ T6126] ptp ptp0: new virtual clock ptp2
[ 68.594333][ T6126] ptp ptp0: new virtual clock ptp5
[ 68.602391][ T6126] ptp ptp0: new virtual clock ptp6
[ 68.611608][ T6126] ptp ptp0: new virtual clock ptp7
[ 68.611621][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.613057][ T6126] ptp ptp0: delete virtual clock ptp7
[ 68.615851][ T6126] ptp ptp0: delete virtual clock ptp6
[ 68.620706][ T6126] ptp ptp0: delete virtual clock ptp5
[ 68.627290][ T6126] ptp ptp0: delete virtual clock ptp2
[ 68.634207][ T6126] ptp ptp0: only physical clock in use now
[ 68.649929][ T6126] ptp ptp0: new virtual clock ptp2
[ 68.658486][ T6126] ptp ptp0: new virtual clock ptp5
[ 68.658499][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.659118][ T6126] ptp ptp0: delete virtual clock ptp5
[ 68.671662][ T6126] ptp ptp0: delete virtual clock ptp2
[ 68.673894][ T6126] ptp ptp0: only physical clock in use now
[ 68.682832][ T6126] ptp ptp0: new virtual clock ptp4
[ 68.688597][ T6126] ptp ptp0: new virtual clock ptp5
[ 68.692259][ T6126] ptp ptp0: new virtual clock ptp6
[ 68.705065][ T6126] ptp ptp0: new virtual clock ptp7
[ 68.705078][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.705782][ T6126] ptp ptp0: delete virtual clock ptp7
[ 68.709960][ T6126] ptp ptp0: delete virtual clock ptp6
[ 68.717287][ T6126] ptp ptp0: delete virtual clock ptp5
[ 68.727190][ T6126] ptp ptp0: delete virtual clock ptp4
[ 68.733410][ T6126] ptp ptp0: only physical clock in use now
[ 68.737921][ T6126] ptp ptp0: new virtual clock ptp3
[ 68.745408][ T6126] ptp ptp0: new virtual clock ptp4
[ 68.745420][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.745763][ T6126] ptp ptp0: delete virtual clock ptp4
[ 68.747281][ T6126] ptp ptp0: delete virtual clock ptp3
[ 68.753870][ T6126] ptp ptp0: only physical clock in use now
[ 68.765132][ T6126] ptp ptp0: new virtual clock ptp3
[ 68.780501][ T6126] ptp ptp0: new virtual clock ptp4
[ 68.786690][ T6126] ptp ptp0: new virtual clock ptp5
[ 68.795013][ T6126] ptp ptp0: new virtual clock ptp6
[ 68.795030][ T6126] ptp ptp0: guarantee physical clock free running
[ 68.797161][ T6126] ptp ptp0: delete virtual clock ptp6
[ 68.809592][ T6126] ptp ptp0: delete virtual clock ptp5
[ 68.813789][ T6126] ptp ptp0: delete virtual clock ptp4
[ 68.821167][ T6126] ptp ptp0: delete virtual clock ptp3
[ 68.831131][ T6199] =========================
** replaying previous printk message **
[ 68.831131][ T6199] ==================================================================
[ 68.831146][ T6199] BUG: KASAN: slab-use-after-free in cdev_put+0x58/0x60
[ 68.831198][ T6199] Read of size 8 at addr ffff888043a4a090 by task syz-executor804/6199
[ 68.831216][ T6199]
[ 68.831226][ T6199] CPU: 2 UID: 0 PID: 6199 Comm: syz-executor804 Not tainted syzkaller #0 PREEMPT(full)
[ 68.831246][ T6199] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 68.831256][ T6199] Call Trace:
[ 68.831262][ T6199]
[ 68.831269][ T6199] dump_stack_lvl+0x100/0x190
[ 68.831301][ T6199] print_report+0x13d/0x4b0
[ 68.831334][ T6199] ? __virt_addr_valid+0x239/0x430
[ 68.831361][ T6199] ? cdev_put+0x58/0x60
[ 68.831384][ T6199] kasan_report+0xdf/0x1c0
[ 68.831408][ T6199] ? cdev_put+0x58/0x60
[ 68.831436][ T6199] cdev_put+0x58/0x60
[ 68.831457][ T6199] __fput+0x904/0xb50
[ 68.831486][ T6199] fput_close_sync+0x118/0x250
[ 68.831511][ T6199] ? __pfx_fput_close_sync+0x10/0x10
[ 68.831539][ T6199] filp_close_sync+0x75/0xa0
[ 68.831564][ T6199] put_files_struct+0x1f7/0x390
[ 68.831595][ T6199] exit_files+0x85/0xb0
[ 68.831618][ T6199] do_exit+0x896/0x2a00
[ 68.831643][ T6199] ? lock_acquire+0x1d1/0x380
[ 68.831666][ T6199] ? do_raw_spin_lock+0x128/0x260
[ 68.831688][ T6199] ? __pfx_do_exit+0x10/0x10
[ 68.831706][ T6199] ? do_group_exit+0x1bd/0x2a0
[ 68.831726][ T6199] ? rcu_is_watching+0x13/0xc0
[ 68.831750][ T6199] do_group_exit+0xd5/0x2a0
[ 68.831770][ T6199] __ia32_sys_exit_group+0x3e/0x50
[ 68.831789][ T6199] ia32_sys_call+0x1a39/0x1a40
[ 68.831809][ T6199] __do_fast_syscall_32+0x14d/0x8e0
[ 68.831826][ T6199] ? lockdep_hardirqs_on+0x7d/0x110
[ 68.831851][ T6199] do_fast_syscall_32+0x32/0x70
[ 68.831867][ T6199] entry_SYSENTER_compat_after_hwframe+0x84/0x8e
[ 68.831888][ T6199] RIP: 0023:0xf7e91fbc
[ 68.831899][ T6199] Code: Unable to access opcode bytes at 0xf7e91f92.
[ 68.831906][ T6199] RSP: 002b:00000000f5e85688 EFLAGS: 00000292 ORIG_RAX: 00000000000000fc
[ 68.831921][ T6199] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000ffffffe8
[ 68.831931][ T6199] RDX: 00000000000000fc RSI: 00000000f5e856d0 RDI: 00000000f5e856d0
[ 68.831942][ T6199] RBP: 00000000f5e856d0 R08: 0000000000000000 R09: 0000000000000000
[ 68.831957][ T6199] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 68.831967][ T6199] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 68.831981][ T6199]
[ 68.831987][ T6199]
[ 68.831990][ T6199] Allocated by task 6126:
[ 68.831998][ T6199] kasan_save_stack+0x30/0x50
[ 68.832015][ T6199] kasan_save_track+0x14/0x30
[ 68.832031][ T6199] __kasan_kmalloc+0xaa/0xb0
[ 68.832046][ T6199] __kmalloc_cache_noprof+0x2f8/0x6d0
[ 68.832068][ T6199] ptp_clock_register+0x187/0x1780
[ 68.832086][ T6199] ptp_vclock_register+0x51f/0xa10
[ 68.832107][ T6199] n_vclocks_store+0x1b1/0x600
[ 68.832126][ T6199] dev_attr_store+0x58/0x80
[ 68.832143][ T6199] sysfs_kf_write+0xf2/0x150
[ 68.832161][ T6199] kernfs_fop_write_iter+0x3e0/0x5f0
[ 68.832177][ T6199] vfs_write+0x6af/0x1040
[ 68.832192][ T6199] ksys_pwrite64+0x113/0x230
[ 68.832207][ T6199] do_int80_emulation+0x16a/0x670
[ 68.832221][ T6199] asm_int80_emulation+0x1a/0x20
[ 68.832236][ T6199]
[ 68.832239][ T6199] Freed by task 6199:
[ 68.832246][ T6199] kasan_save_stack+0x30/0x50
[ 68.832261][ T6199] kasan_save_track+0x14/0x30
[ 68.832277][ T6199] kasan_save_free_info+0x3b/0x70
[ 68.832298][ T6199] __kasan_slab_free+0x5f/0x80
[ 68.832315][ T6199] kfree+0x22b/0x6d0
[ 68.832334][ T6199] device_release+0xd2/0x270
[ 68.832354][ T6199] kobject_put+0x1f7/0x640
[ 68.832372][ T6199] put_device+0x1f/0x30
[ 68.832389][ T6199] posix_clock_release+0xd5/0x150
[ 68.832408][ T6199] __fput+0x3fb/0xb50
[ 68.832426][ T6199] fput_close_sync+0x118/0x250
[ 68.832446][ T6199] filp_close_sync+0x75/0xa0
[ 68.832467][ T6199] put_files_struct+0x1f7/0x390
[ 68.832485][ T6199] exit_files+0x85/0xb0
[ 68.832502][ T6199] do_exit+0x896/0x2a00
[ 68.832519][ T6199] do_group_exit+0xd5/0x2a0
[ 68.832537][ T6199] __ia32_sys_exit_group+0x3e/0x50
[ 68.832555][ T6199] ia32_sys_call+0x1a39/0x1a40
[ 68.832573][ T6199] __do_fast_syscall_32+0x14d/0x8e0
[ 68.832588][ T6199] do_fast_syscall_32+0x32/0x70
[ 68.832603][ T6199] entry_SYSENTER_compat_after_hwframe+0x84/0x8e
[ 68.832621][ T6199]
[ 68.832625][ T6199] The buggy address belongs to the object at ffff888043a4a000
[ 68.832625][ T6199] which belongs to the cache kmalloc-4k of size 4096
[ 68.832637][ T6199] The buggy address is located 144 bytes inside of
[ 68.832637][ T6199] freed 4096-byte region [ffff888043a4a000, ffff888043a4b000)
[ 68.832651][ T6199]
[ 68.832655][ T6199] The buggy address belongs to the physical page:
[ 68.832663][ T6199] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43a48
[ 68.832677][ T6199] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 68.832689][ T6199] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 68.832703][ T6199] page_type: f5(slab)
[ 68.832718][ T6199] raw: 04fff00000000040 ffff88801d443040 dead000000000122 0000000000000000
[ 68.832731][ T6199] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 68.832745][ T6199] head: 04fff00000000040 ffff88801d443040 dead000000000122 0000000000000000
[ 68.832759][ T6199] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 68.832773][ T6199] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 68.832787][ T6199] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 68.832795][ T6199] page dumped because: kasan: bad access detected
[ 68.832802][ T6199] page_owner tracks the page as allocated
[ 68.832808][ T6199] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6143, tgid 6143 (udevd), ts 68631299502
[ 68.832833][ T6199] post_alloc_hook+0xfd/0x120
[ 68.832880][ T6199] get_page_from_freelist+0xdae/0x2c80
[ 68.832902][ T6199] __alloc_frozen_pages_noprof+0x2ad/0x31e0
[ 68.832924][ T6199] new_slab+0xb1/0x6d0
[ 68.832949][ T6199] refill_objects+0xe3/0x410
[ 68.832969][ T6199] __pcs_replace_empty_main+0x35e/0x650
[ 68.832990][ T6199] __kmalloc_noprof+0x677/0x840
[ 68.833004][ T6199] tomoyo_realpath_from_path+0xb6/0x690
[ 68.833021][ T6199] tomoyo_path_perm+0x276/0x460
[ 68.833041][ T6199] tomoyo_path_unlink+0x91/0xe0
[ 68.833057][ T6199] security_path_unlink+0x145/0x2b0
[ 68.833073][ T6199] filename_unlinkat+0x316/0x770
[ 68.833092][ T6199] __x64_sys_unlink+0x46/0x70
[ 68.833111][ T6199] do_syscall_64+0x123/0x780
[ 68.833125][ T6199] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.833140][ T6199] page last free pid 5200 tgid 5200 ts 68611259383 stack trace:
[ 68.833150][ T6199] __free_frozen_pages+0x7b1/0x10f0
[ 68.833171][ T6199] qlist_free_all+0x47/0xf0
[ 68.833185][ T6199] kasan_quarantine_reduce+0x1a0/0x1f0
[ 68.833200][ T6199] __kasan_slab_alloc+0x69/0x90
[ 68.833217][ T6199] kmem_cache_alloc_lru_noprof+0x265/0x6a0
[ 68.833232][ T6199] shmem_alloc_inode+0x25/0x50
[ 68.833252][ T6199] alloc_inode+0x68/0x250
[ 68.833274][ T6199] new_inode+0x22/0x1c0
[ 68.833295][ T6199] shmem_get_inode+0x1e3/0xff0
[ 68.833316][ T6199] shmem_mknod+0x217/0x480
[ 68.833336][ T6199] lookup_open+0xd8a/0x19e0
[ 68.833349][ T6199] path_openat+0xe75/0x23f0
[ 68.833365][ T6199] do_file_open+0x20e/0x430
[ 68.833383][ T6199] do_sys_openat2+0x163/0x1d0
[ 68.833404][ T6199] __x64_sys_openat+0x12d/0x210
[ 68.833426][ T6199] do_syscall_64+0x123/0x780
[ 68.833440][ T6199]
[ 68.833443][ T6199] Memory state around the buggy address:
[ 68.833450][ T6199] ffff888043a49f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 68.833460][ T6199] ffff888043a4a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.833470][ T6199] >ffff888043a4a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.833479][ T6199] ^
[ 68.833486][ T6199] ffff888043a4a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.833496][ T6199] ffff888043a4a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 68.833505][ T6199] ==================================================================
[ 68.834642][ T6126] ptp ptp0: only physical clock in use now
[ 68.836328][ T6199] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 69.100812][ T6199] CPU: 2 UID: 0 PID: 6199 Comm: syz-executor804 Not tainted syzkaller #0 PREEMPT(full)
[ 69.103905][ T6199] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 69.107171][ T6199] Call Trace:
[ 69.108496][ T6199]
[ 69.109675][ T6199] dump_stack_lvl+0x100/0x190
[ 69.111275][ T6199] vpanic+0x2dc/0x6f8
[ 69.112564][ T6199] panic+0xd1/0xe0
[ 69.113814][ T6199] ? __pfx_panic+0x10/0x10
[ 69.115314][ T6199] ? cdev_put+0x58/0x60
[ 69.116928][ T6199] ? preempt_schedule+0x57/0xd0
[ 69.118676][ T6199] check_panic_on_warn.cold+0x19/0x34
[ 69.120381][ T6199] end_report.part.0+0x3a/0x90
[ 69.121968][ T6199] kasan_report.cold+0xe/0x18
[ 69.123444][ T6199] ? cdev_put+0x58/0x60
[ 69.124752][ T6199] cdev_put+0x58/0x60
[ 69.126062][ T6199] __fput+0x904/0xb50
[ 69.127321][ T6199] fput_close_sync+0x118/0x250
[ 69.128821][ T6199] ? __pfx_fput_close_sync+0x10/0x10
[ 69.130511][ T6199] filp_close_sync+0x75/0xa0
[ 69.131960][ T6199] put_files_struct+0x1f7/0x390
[ 69.133508][ T6199] exit_files+0x85/0xb0
[ 69.135067][ T6199] do_exit+0x896/0x2a00
[ 69.136398][ T6199] ? lock_acquire+0x1d1/0x380
[ 69.137941][ T6199] ? do_raw_spin_lock+0x128/0x260
[ 69.139788][ T6199] ? __pfx_do_exit+0x10/0x10
[ 69.141623][ T6199] ? do_group_exit+0x1bd/0x2a0
[ 69.143517][ T6199] ? rcu_is_watching+0x13/0xc0
[ 69.145360][ T6199] do_group_exit+0xd5/0x2a0
[ 69.146831][ T6199] __ia32_sys_exit_group+0x3e/0x50
[ 69.148432][ T6199] ia32_sys_call+0x1a39/0x1a40
[ 69.149946][ T6199] __do_fast_syscall_32+0x14d/0x8e0
[ 69.151609][ T6199] ? lockdep_hardirqs_on+0x7d/0x110
[ 69.153283][ T6199] do_fast_syscall_32+0x32/0x70
[ 69.154800][ T6199] entry_SYSENTER_compat_after_hwframe+0x84/0x8e
[ 69.156784][ T6199] RIP: 0023:0xf7e91fbc
[ 69.158064][ T6199] Code: Unable to access opcode bytes at 0xf7e91f92.
[ 69.160106][ T6199] RSP: 002b:00000000f5e85688 EFLAGS: 00000292 ORIG_RAX: 00000000000000fc
[ 69.162731][ T6199] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000ffffffe8
[ 69.165173][ T6199] RDX: 00000000000000fc RSI: 00000000f5e856d0 RDI: 00000000f5e856d0
[ 69.167707][ T6199] RBP: 00000000f5e856d0 R08: 0000000000000000 R09: 0000000000000000
[ 69.170680][ T6199] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 69.174008][ T6199] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 69.177148][ T6199]
[ 69.179085][ T6199] Kernel Offset: disabled
[ 69.180924][ T6199] Rebooting in 86400 seconds..