program:
r0 = io_uring_setup(0x113d, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x5, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}, 0x20) (async)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000000700000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f000000a300)={&(0x7f000000a280)='kfree\x00', r1}, 0x18) (async)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r2 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb0, 0x1c080, 0x0, 0x119})
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'wlan1\x00', 0x0}) (async)
io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async, rerun: 64)
r3 = syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x202) (async, rerun: 64)
r4 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r4, &(0x7f0000000000)={0xa, 0x3, 0x10, @loopback}, 0x1c)
connect$inet6(r4, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c)
r5 = syz_mount_image$hfs(&(0x7f0000000080), &(0x7f0000000240)='./file0\x00', 0x200000, &(0x7f0000000280)={[{@uid}, {@dir_umask={'dir_umask', 0x3d, 0x7}}, {@gid}, {@type={'type', 0x3d, "9d119198"}}, {@codepage={'codepage', 0x3d, 'cp950'}}, {}, {@iocharset={'iocharset', 0x3d, 'cp864'}}, {@file_umask={'file_umask', 0x3d, 0x3}}]}, 0x4, 0x337, &(0x7f0000000540)="$eJzs3U1r1EAYB/D/ZN9tqbGtVDxWC55KWw+KCIr05hfwIMXabqE0VrAVrChWzyLeBMGjN8+iX0Ev4hfQUw/Fk16KSCMzmWRntzPZTV82u/T/g+7rPJlnkkwysxIDIjq2bsz+eH9xS/6JEoACgCuAB6AKFAGcxlj14er68npQX0xbUEFFyD+BKFLsKbOwWreFyjgVofnyXRGD5md0NMIwDH+2LfW7K7lQfkTU9/fwgIruner7atcz25fNDgpUupNKDzG2sNjBDh5hKM90iIgof/r87+mzxKAev3seMKHH4f10/o+ZM4im8c0O8ORk9/PpGcn534veh0KuH7VGRGO+p6Zwch168SzRtizrPhE2VncZ0Z7VtAFEu1mlysWrLS0H9clNtYAXuKYZxUbV4yLihiiubMvR07hlbpoire3pBlQbSrINJUf+I5lr/LyNN/bq5r52kJP4Ir6JOeHjLRaT8V8xFHLlqPXjAzUzIMp/yr1E1Uo/KtXUykbvO6UqORtvgU8fGq2sudZrFQWZi41cimgdv/txnq/L7igMNx8UdOum3a1TUSPWqJnk/V9r1GhrVG2pFNQnF+4HqT+lHBrrjE68ErfEOH7hI2aN8b8nS0/A3TOberlQJfWekdqeoirp2I5NVAe+l6lnEvAvjGQMe4m7uIyhtY3HK/NBUH+Q/4u4q/RIPtGOqHdH+Yl8NsqgKl+UABxapbthGFq/KuIQqijHqbpyLqmmXnqXNFkdZvVPKQerHZvROjS+uu4u3Dhsyk/iI0LGSlX4syRKni2yhP/Rta9t2HdIYWRYPtodMq5qPgjOJBuugEpHPaW2j0pvPl2ZD/ZzLKJ+Y/SXsdvbV/NOh7pPjrtENP8z5itT6qgjH/yU2UjbUYexxGnHDGhYPZ7obAaXLNY5ThyIXwT1mbQ517kLwPmWGj3ENT5vXayv80Qv/qtkxZZWLS1CzOI77vD3fyIiIiIiIiIiIiIiIiIiIiIiIiKifpP1agT35QS7+jok+5UYDVvH8D/eICIiIiIiIiIiIiIiIiIiIiIiIiIiIiI6GOP+v0BB3TGmnPv9fwsd3P9XtL3FJxG18T8AAP//uTRlfg==") (async, rerun: 64)
r6 = memfd_create(&(0x7f0000000380)='D\xa3\xd5Wj\x00\x00x0\xc1\xac*\x1a\vG\xa9~vB\xbc\t\x00\x00\x00VoA\xaa\xbc\xee[\xe1\xa2\xe0\xff\x04\x00\x00\x00\\i\xcf\t\xb0\xa9 +H/\x1a\xe7\x95\xce\"\"\xbd\xf9\xd0\xc0\xa9\b\x98\xfc:\x1b\xc4\x80!\xfd\xa4\xcaN\x84\xadS\x8bqE\x99\x01t\xb1\x1f|\x99PL\x92\x8f\xc2\xf9\xcd\x8cj\x03X\x05\x17mwI\xf0\x01\xe5z\xcdJ)\xc7\xfa)\xaa}\xef\xbb\xf5\xcd\xb1o5\x18\xd6\v\x85q\x98\x9bB\xb9\xea\xe7\xff\x7f\x00\x00T\xc0\xd2\t?\bpBl\xf4*8\xc6\xe5\x06P\xc11\f^\x7f\x8e\xc1\xd1Wra\x19)\xe3\x8f\xd9\x9f\x15\x1e\xf2\x18\r\xad\b\xe0\x96NH\x85\r+\xfc\xb3\xdd\xddhg \x03\xa7\x92\xff\x00+h\xb7@#K\x9cMY\xd3\x9b\b-G\xb1\xdaS\x81\xb2\x93\xb83\x8a\x94*\x8d\\\b\xff/\xa1\xc0\xf9&\xd3M\xf6\n\xff\x83k\xe6\rDa\x16\xbd\x00\x02\xdf\b~\xd5)\xa4\x80\xad\x97\'\x1b\xfd}\x96&\xd2\x0eGp\x8e\x1a\x19o\xf1\x14\xe2]J\xf2\xb5h\x9bt*\xd2\xfbT\x01ci\x87\x18\xc9\x13=\x1b\xadl;}\x9d\xbe\x9a\xee\x1a\xfc\x96 \x93\x12@\x19|f\x98\xdc,\x82SlA\x19\xcb\xfe\xccSKO}\xb2U\xd6\xc5\xa7=\xf8s\x1dp\xe0\x14\xe5\x92\xfd)\bB\xcd\xc2\xb6\x85$%nV\xd3*\x00`OE\x8e\xf0\xf9\xd2!KZ%\xad\xa1\x92b\x1e%\x9f!\xd8mV$\x1d?\xc2\f\xcc\xc5x\x9fJ#\xce\x90\xc5\x82\xfb\x97\xd2\xb7\xb5\xed\xb5\'J\xfc\xf4Z.\rS\x88\f\xd0zK\xc7\x81\xbe\xd5\xc2\xce\x89\xbc\x1e\xb78\xf6Z\xd5\x1b\xf1\x9bMD\f\xf6\xc5V\xe1\x12j\xdfW\x87\xf09\n\x1e\x1b\f\xe5p\xab\x9e\xe5}\x96\x9b\xea\x86\x0f\xca\xcf\x16\x96\x0e6\x8d\x11\xd2&\"eKKV\x8b?]<\xa7]\x93\xad\x1d\xfe\x13\xee\xca\xdc\x97\xa9\a\b\xac\xdd\xa0\xfe\x97\xa1?\xa2F\xae\xb7f\x85\xda', 0x0) (rerun: 64)
write(r6, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190", 0x1f) (async)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x0) (async)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x8a)
r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000e00)=@bpf_lsm={0x1d, 0x1c, &(0x7f0000000b40)=ANY=[@ANYBLOB="1800000004000000000000000f00000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7020000000000008500000086000000180000007800000000000000050000002da6f0ff0100000067125000f0ffffff18120000", @ANYRES32=r7, @ANYBLOB="000000000000000018130000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000b70800000d0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7050000080000000000a500000095e1ff00000000000000"], &(0x7f0000000c40)='GPL\x00', 0xffff85fa, 0xbb, &(0x7f0000000c80)=""/187, 0x41000, 0x26, '\x00', 0x0, 0x1b, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000d40)={0x1, 0x1, 0x0, 0x81}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000d80)=[0x1, r7], &(0x7f0000000dc0)=[{0x3, 0x3, 0x6, 0x6}, {0x5, 0x2, 0x5, 0x6}], 0x10, 0x92}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000b00)=ANY=[@ANYRES32=r7, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r7, @ANYBLOB, @ANYRES32=r8, @ANYBLOB, @ANYRES64=0x0], 0x20) (async)
setsockopt$inet6_int(r4, 0x29, 0x4, &(0x7f0000000380)=0x8000, 0x4)
r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_int(r9, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) (async)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r9, 0x0, 0x1a, &(0x7f0000000200)={0x1, 'vlan0\x00'}, 0x20) (async)
syz_emit_ethernet(0xc2, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffff0000000000000800450000b40000000008019078ac1e0001ac1414aa0300907803240000450200000000000000000001ac1414aa00001400867100000000000ce256b28c599d1681fb520009789607671442eb000e7434954373561de584b703c80009e706d30bd224f80007cfa11cab1a00108475be675d1844050a176a9b320a05a0dc91e4c6000a6580a5e97612fe86001273bc2300ad9d19a30000000000000000000cc8f46976e79e56c7a95e860c0000000000067f36000000"], 0x0) (async)
ioctl$FE_DISHNETWORK_SEND_LEGACY_CMD(r3, 0x6f50, 0xfffffffffffffffc) (async)
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x2, 0x500, &(0x7f0000000500)="$eJzs3U9sI1cZAPBvJn/sTdMmhR4AFbqUwoJWayfeNqp6oZwqhCoheuSwDYkTRbHjKHZKE/aQPXJHohInOHHmgMQBqSfuSBzgxqUckAqsQA0SByOP7V3njzfWbmzvxr+fNJo38+L53tvRvGd91s4LYGJdj4ijiJiNiPcjYqFzPuls8XZ7a/3dZ/fvrh3fv7uWRLP53j+TrL51Lno+0/Jc55r5iPjBOxE/Sk4F/VNE/eBwe7VSKe91ThUb1d1i/eDw1lZ1dbO8Wd4plVaWV5bevP1G6dL6+kr1N59ei4jf/+7Ln/zx6Fs/aTVrvlPX24/L1O76zIM4LdMR8b1hBBuDqU5/Zh/nw4/1IS5TGhGfi4hXs+d/Iaayu3nSydv07RG2DgAYhmZzIZoLvccAwFWXZjmwJC10cgHzkaaFQjuH91LMpZVavXFzo7a/s97OlS3GTLqxVSkvdXKFizGTbGxNl5ezcve4Ui6dOr4dES9GxM9y17Ljwlqtsj7OLz4AMMGeOzX//yfXnv8BgCsu/7CYG2c7AIDRyY+7AQDAyJn/AWDymP8BYPKY/wFg8pj/AWDymP8BYKJ8/913W1vzuPP+6/UPDva3ax/cWi/XtwvV/bXCWm1vt7BZq21m7+ypXnS9Sq22u/x67H9YbJTrjWL94PBOtba/07iTvdf7TnlmJL0CAB7lxVc+/ksSEUdvXcu26Hnf/4Vz9cvDbh0wTOm4GwCMzdS4GwCMzdnVvoBJIR8P9CzRe6/ndP5M4bSPBrp8at1QePrc+OIT5P+BZ5r8P0yux8v/+y4PV4H8P0yuZjOx5j8ATBg5fiC5oL739/+lZs/BYL//AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJU0n21JWuisBT4faVooRDwfEYsxk2xsVcpLEfFCRPw5N5NrHS9HhHWDAOBZlv496az/dWPhtfnTtbO5/+ayfUT8+Bfv/fzD1UZjbzliNvnXg/ONjzrnS+NoPwBwke483Z3Huz67f3etu42yPZ9+p724aCvucWdr10zHdLbPZ7mGuX8nneO21veVqUuIf3QvIr5wXv+TLDey2Fn59HT8VuznRxo/PRE/zera+9a/xecvoS0waT5ujT9vn/f8pXE925///OezEerJdce/4zPjX/pg/JvqM/5dHzTG63/47pmTzYV23b2IL01HHHcv3jP+dOMnfeK/NmD8v778lVf71TV/GXEjzut/ciJWsVHdLdYPDm9tVVc3y5vlnVJpZXll6c3bb5SKWY662M1Un/WPt26+0C9+q/9zfeLnL+j/1wfs/6/+9/4Pv/qI+N/82vn3/6VHxG/Nid8YMP7q3G/z/epa8df79P+i+39zwPif/O1wfcA/BQBGoH5wuL1aqZT3hl1Ihx8iKyQRRyPoTruQ+/VP3xlVrCEW4ulohsLTVBj3yAQM28OHftwtAQAAAAAAAAAAAAAA+hnFfycadx8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4uv4fAAD//5iA1Hs=")
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="8feb01001800000000000000200000002000000002000000f026d0000000000100000d00000000e5ffffff01000000000000000000000a020000000000"], 0x0, 0x3a}, 0x28)
creat(&(0x7f0000000100)='./file0/file0\x00', 0x0) (async)
rename(&(0x7f0000000080)='./file0/file0\x00', &(0x7f0000000040)='./file2\x00')
[ 109.719421][ T5285] Bluetooth: hci0: command tx timeout
[ 109.876806][ T5328] ==================================================================
[ 109.880181][ T5328] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc4/0x340
[ 109.883578][ T5328] Read of size 8 at addr ffff8880334ba418 by task syz.0.0/5328
[ 109.887046][ T5328]
[ 109.888638][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 109.888661][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 109.888672][ T5328] Call Trace:
[ 109.888683][ T5328]
[ 109.888691][ T5328] dump_stack_lvl+0xe8/0x150
[ 109.888722][ T5328] print_address_description+0x55/0x1e0
[ 109.888747][ T5328] ? dvb_device_open+0xc4/0x340
[ 109.888770][ T5328] print_report+0x58/0x70
[ 109.888792][ T5328] kasan_report+0x117/0x150
[ 109.888817][ T5328] ? dvb_device_open+0xc4/0x340
[ 109.888842][ T5328] dvb_device_open+0xc4/0x340
[ 109.888865][ T5328] ? do_raw_spin_unlock+0x4d/0x210
[ 109.888888][ T5328] chrdev_open+0x4d9/0x600
[ 109.888916][ T5328] ? __pfx_chrdev_open+0x10/0x10
[ 109.888940][ T5328] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0
[ 109.888968][ T5328] ? __pfx_chrdev_open+0x10/0x10
[ 109.888992][ T5328] do_dentry_open+0x816/0x1380
[ 109.889016][ T5328] vfs_open+0x3b/0x340
[ 109.889033][ T5328] ? path_openat+0x2e2d/0x3830
[ 109.889057][ T5328] path_openat+0x2e44/0x3830
[ 109.889081][ T5328] ? kasan_save_track+0x3e/0x80
[ 109.889100][ T5328] ? do_sys_openat2+0xcc/0x200
[ 109.889117][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.889145][ T5328] do_file_open+0x23e/0x4a0
[ 109.889170][ T5328] ? __pfx_do_file_open+0x10/0x10
[ 109.889203][ T5328] ? _raw_spin_unlock+0x28/0x50
[ 109.889221][ T5328] ? alloc_fd+0x651/0x6c0
[ 109.889242][ T5328] do_sys_openat2+0x115/0x200
[ 109.889262][ T5328] ? __pfx_do_sys_openat2+0x10/0x10
[ 109.889281][ T5328] ? __task_pid_nr_ns+0x28/0x470
[ 109.889304][ T5328] __x64_sys_openat+0x138/0x170
[ 109.889322][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.889338][ T5328] do_syscall_64+0x174/0x580
[ 109.889360][ T5328] ? trace_irq_disable+0x3b/0x140
[ 109.889381][ T5328] ? clear_bhb_loop+0x40/0x90
[ 109.889400][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.889418][ T5328] RIP: 0033:0x7fa11a55e68e
[ 109.889436][ T5328] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 109.889452][ T5328] RSP: 002b:00007fa11b513ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 109.889472][ T5328] RAX: ffffffffffffffda RBX: 00007fa11b5146c0 RCX: 00007fa11a55e68e
[ 109.889486][ T5328] RDX: 0000000000000202 RSI: 00007fa11b513bc0 RDI: ffffffffffffff9c
[ 109.889498][ T5328] RBP: 00007fa11b513bc0 R08: 0000000000000000 R09: 0000000000000000
[ 109.889509][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
[ 109.889520][ T5328] R13: 00007fa11a826128 R14: 00007fa11a826090 R15: 00007ffe3c827cc8
[ 109.889547][ T5328]
[ 109.889552][ T5328]
[ 110.009426][ T5328] Allocated by task 1:
[ 110.011227][ T5328] kasan_save_track+0x3e/0x80
[ 110.013431][ T5328] __kasan_kmalloc+0x93/0xb0
[ 110.015940][ T5328] __kmalloc_cache_noprof+0x32d/0x660
[ 110.018607][ T5328] dvb_register_device+0x309/0x1dd0
[ 110.020947][ T5328] dvb_register_frontend+0x603/0x900
[ 110.023138][ T5328] vidtv_bridge_probe+0x9d5/0xf60
[ 110.025303][ T5328] platform_probe+0xf9/0x190
[ 110.027353][ T5328] really_probe+0x254/0xae0
[ 110.029289][ T5328] __driver_probe_device+0x1e8/0x360
[ 110.031630][ T5328] driver_probe_device+0x4f/0x240
[ 110.034422][ T5328] __driver_attach+0x339/0x600
[ 110.037780][ T5328] bus_for_each_dev+0x23b/0x2c0
[ 110.040262][ T5328] bus_add_driver+0x345/0x670
[ 110.042309][ T5328] driver_register+0x23a/0x320
[ 110.044306][ T5328] vidtv_bridge_init+0x3d/0x60
[ 110.046418][ T5328] do_one_initcall+0x250/0x870
[ 110.048503][ T5328] do_initcall_level+0x10a/0x1a0
[ 110.050499][ T5328] do_initcalls+0x59/0xa0
[ 110.052309][ T5328] kernel_init_freeable+0x29d/0x3e0
[ 110.054703][ T5328] kernel_init+0x1d/0x1d0
[ 110.056733][ T5328] ret_from_fork+0x514/0xb70
[ 110.059119][ T5328] ret_from_fork_asm+0x1a/0x30
[ 110.061495][ T5328]
[ 110.062573][ T5328] Freed by task 5328:
[ 110.064241][ T5328] kasan_save_track+0x3e/0x80
[ 110.066221][ T5328] kasan_save_free_info+0x40/0x50
[ 110.068403][ T5328] __kasan_slab_free+0x5c/0x80
[ 110.070572][ T5328] kfree+0x1c5/0x640
[ 110.072570][ T5328] dvb_device_open+0x2b8/0x340
[ 110.075111][ T5328] chrdev_open+0x4d9/0x600
[ 110.077421][ T5328] do_dentry_open+0x816/0x1380
[ 110.079659][ T5328] vfs_open+0x3b/0x340
[ 110.081431][ T5328] path_openat+0x2e44/0x3830
[ 110.083416][ T5328] do_file_open+0x23e/0x4a0
[ 110.085382][ T5328] do_sys_openat2+0x115/0x200
[ 110.087447][ T5328] __x64_sys_openat+0x138/0x170
[ 110.089505][ T5328] do_syscall_64+0x174/0x580
[ 110.091773][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.094812][ T5328]
[ 110.095995][ T5328] The buggy address belongs to the object at ffff8880334ba400
[ 110.095995][ T5328] which belongs to the cache kmalloc-256 of size 256
[ 110.101675][ T5328] The buggy address is located 24 bytes inside of
[ 110.101675][ T5328] freed 256-byte region [ffff8880334ba400, ffff8880334ba500)
[ 110.108073][ T5328]
[ 110.109400][ T5328] The buggy address belongs to the physical page:
[ 110.112676][ T5328] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x334ba
[ 110.116206][ T5328] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 110.119183][ T5328] page_type: f5(slab)
[ 110.121003][ T5328] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000
[ 110.124730][ T5328] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 110.128795][ T5328] page dumped because: kasan: bad access detected
[ 110.131856][ T5328] page_owner tracks the page as allocated
[ 110.134437][ T5328] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 28211835070, free_ts 27501499673
[ 110.142765][ T5328] post_alloc_hook+0x1f9/0x250
[ 110.145209][ T5328] get_page_from_freelist+0x21fa/0x2270
[ 110.148086][ T5328] __alloc_frozen_pages_noprof+0x18d/0x380
[ 110.150557][ T5328] allocate_slab+0x79/0x5e0
[ 110.152469][ T5328] refill_objects+0x2d5/0x350
[ 110.154466][ T5328] __pcs_replace_empty_main+0x2bf/0x6b0
[ 110.156798][ T5328] __kmalloc_cache_noprof+0x3a7/0x660
[ 110.159483][ T5328] bus_add_driver+0x162/0x670
[ 110.162055][ T5328] driver_register+0x23a/0x320
[ 110.164513][ T5328] usb_register_driver+0x1e4/0x390
[ 110.166687][ T5328] do_one_initcall+0x250/0x870
[ 110.168703][ T5328] do_initcall_level+0x10a/0x1a0
[ 110.170812][ T5328] do_initcalls+0x59/0xa0
[ 110.172648][ T5328] kernel_init_freeable+0x29d/0x3e0
[ 110.175107][ T5328] kernel_init+0x1d/0x1d0
[ 110.177328][ T5328] ret_from_fork+0x514/0xb70
[ 110.179775][ T5328] page last free pid 805 tgid 805 stack trace:
[ 110.182454][ T5328] __free_frozen_pages+0xc1e/0xd10
[ 110.184661][ T5328] kasan_depopulate_vmalloc_pte+0x6d/0x90
[ 110.187004][ T5328] __apply_to_page_range+0xbd8/0x1420
[ 110.189228][ T5328] __kasan_release_vmalloc+0xa2/0xd0
[ 110.191414][ T5328] purge_vmap_node+0x220/0x960
[ 110.194009][ T5328] __purge_vmap_area_lazy+0x783/0xb40
[ 110.196945][ T5328] drain_vmap_area_work+0x27/0x40
[ 110.199437][ T5328] process_scheduled_works+0xa8e/0x14e0
[ 110.201877][ T5328] worker_thread+0xa47/0xfb0
[ 110.203989][ T5328] kthread+0x388/0x470
[ 110.205722][ T5328] ret_from_fork+0x514/0xb70
[ 110.207669][ T5328] ret_from_fork_asm+0x1a/0x30
[ 110.209721][ T5328]
[ 110.210758][ T5328] Memory state around the buggy address:
[ 110.213260][ T5328] ffff8880334ba300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 110.217463][ T5328] ffff8880334ba380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 110.221570][ T5328] >ffff8880334ba400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 110.225130][ T5328] ^
[ 110.227170][ T5328] ffff8880334ba480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 110.230645][ T5328] ffff8880334ba500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 110.234087][ T5328] ==================================================================
[ 110.350829][ T5328] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 110.353934][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 110.357625][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 110.362124][ T5328] Call Trace:
[ 110.364201][ T5328]
[ 110.365854][ T5328] vpanic+0x56c/0xa60
[ 110.368371][ T5328] ? __pfx_vpanic+0x10/0x10
[ 110.370596][ T5328] ? __pfx___schedule+0x10/0x10
[ 110.372829][ T5328] panic+0xc5/0xd0
[ 110.374525][ T5328] ? __pfx_panic+0x10/0x10
[ 110.376487][ T5328] ? preempt_schedule_thunk+0x16/0x40
[ 110.378891][ T5328] ? dvb_device_open+0xc4/0x340
[ 110.381045][ T5328] check_panic_on_warn+0x89/0xb0
[ 110.383091][ T5328] ? dvb_device_open+0xc4/0x340
[ 110.385140][ T5328] end_report+0x73/0x170
[ 110.387010][ T5328] ? dvb_device_open+0xc4/0x340
[ 110.389254][ T5328] kasan_report+0x128/0x150
[ 110.391313][ T5328] ? dvb_device_open+0xc4/0x340
[ 110.393510][ T5328] dvb_device_open+0xc4/0x340
[ 110.395467][ T5328] ? do_raw_spin_unlock+0x4d/0x210
[ 110.397543][ T5328] chrdev_open+0x4d9/0x600
[ 110.399663][ T5328] ? __pfx_chrdev_open+0x10/0x10
[ 110.402238][ T5328] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0
[ 110.405207][ T5328] ? __pfx_chrdev_open+0x10/0x10
[ 110.407582][ T5328] do_dentry_open+0x816/0x1380
[ 110.410259][ T5328] vfs_open+0x3b/0x340
[ 110.412316][ T5328] ? path_openat+0x2e2d/0x3830
[ 110.414455][ T5328] path_openat+0x2e44/0x3830
[ 110.416385][ T5328] ? kasan_save_track+0x3e/0x80
[ 110.418409][ T5328] ? do_sys_openat2+0xcc/0x200
[ 110.420561][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.423279][ T5328] do_file_open+0x23e/0x4a0
[ 110.425471][ T5328] ? __pfx_do_file_open+0x10/0x10
[ 110.427851][ T5328] ? _raw_spin_unlock+0x28/0x50
[ 110.430196][ T5328] ? alloc_fd+0x651/0x6c0
[ 110.432373][ T5328] do_sys_openat2+0x115/0x200
[ 110.434432][ T5328] ? __pfx_do_sys_openat2+0x10/0x10
[ 110.436503][ T5328] ? __task_pid_nr_ns+0x28/0x470
[ 110.438536][ T5328] __x64_sys_openat+0x138/0x170
[ 110.440499][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.444515][ T5328] do_syscall_64+0x174/0x580
[ 110.447241][ T5328] ? trace_irq_disable+0x3b/0x140
[ 110.449730][ T5328] ? clear_bhb_loop+0x40/0x90
[ 110.451803][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.454350][ T5328] RIP: 0033:0x7fa11a55e68e
[ 110.456215][ T5328] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 110.464772][ T5328] RSP: 002b:00007fa11b513ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 110.469068][ T5328] RAX: ffffffffffffffda RBX: 00007fa11b5146c0 RCX: 00007fa11a55e68e
[ 110.472267][ T5328] RDX: 0000000000000202 RSI: 00007fa11b513bc0 RDI: ffffffffffffff9c
[ 110.475769][ T5328] RBP: 00007fa11b513bc0 R08: 0000000000000000 R09: 0000000000000000
[ 110.479067][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
[ 110.482401][ T5328] R13: 00007fa11a826128 R14: 00007fa11a826090 R15: 00007ffe3c827cc8
[ 110.485796][ T5328]
[ 110.487746][ T5328] Kernel Offset: disabled
[ 110.489837][ T5328] Rebooting in 86400 seconds..