program: r0 = syz_open_dev$dvb_dvr(&(0x7f00000027c0), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) fanotify_init(0x20, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) dup(r1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000000040), 0x0, 0x8000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x48}, 0x40000100) readv(r2, &(0x7f0000000280)=[{&(0x7f00000002c0)=""/13, 0xd}, {0x0, 0xffb6}], 0x2) r5 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r6 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$DM_DEV_CREATE(r6, 0xc138fd03, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88001, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r6, 0xc138fd09, &(0x7f0000000a40)={0x4, 0x0, 0x0, 0x1b0, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r7}, [@thin_pool={0x0, 0x80, 0x0, 0x78, 'thin-pool\x00', {@rnull={'/dev/syzrnull', 0x0}, 0x20, @rnull={'/dev/syzrnull', 0x0}, 0x20, '64', 0x20, 0x11, ' 1 skip_block_zeroing'}}]}) ioctl$DM_TABLE_LOAD(r5, 0xc138fd09, &(0x7f0000000600)={0x4, 0x0, 0x0, 0x188, 0x138, 0x1, 0x0, 0x610, 0x0, 0x0, @by_dev={r7}, [@snapshot={0x0, 0x8, 0x0, 0x50, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'PO', 0x20, '7'}}]}) socketpair$unix(0x1, 0x3, 0x0, 0x0) r8 = gettid() tkill(r8, 0x21) perf_event_open(&(0x7f00000007c0)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80102, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x4, 0x3fe, 0x7ffffffc, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0200000000080000000100000080000000000000ef7393adb423232b148875b94c2ef9508f095ba9e823fb05a4be6df1ca63bc449c879ddb118d603d6d79768cb49281c37ceb0bf3e8c0e43d925468bb3c3c85630c350bc66c7a1de37596e80d55a5aa61bb612257f689be2f7fc6a83ed0ef5e1101a960288b898bbe02f01135113974a94773f34d6aeb8b72d85c091d746d5b215bc48c4f3a24a79b6f2d63c6ceac6a747f5b530469772abff70fa59e198f179c5a9e05dfce4274aca6b9d25827fa052bb94b41b056850803a55815f75a2fa548320547bb2a59dd962d36c3fcf92303fb678bc4e9950c861bc6e0b9c58d208dbf6330a75afa3c3b64784a8dd74846039e03546b17e885197dab93c75da102", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000008c0)={r9, 0x0, 0x0}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000900)={0x6, 0x5, &(0x7f00000009c0)=ANY=[@ANYBLOB="186000000000000000000000000000001857000000000000000000000000000095"], &(0x7f0000000a00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)}, 0x94) ioctl$DVB_DVR_DMX_SET_BUFFER_SIZE(r0, 0x6f2d, 0x1d6000) [ 102.965961][ T5311] Bluetooth: hci0: command tx timeout qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xa8000) [ 103.214119][ T1029] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 103.214136][ T1029] ata1: failed to read log page 10h (errno=-5) [ 103.214151][ T1029] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0 [ 103.214162][ T1029] ata1.00: irq_stat 0x40000000 [ 103.214173][ T1029] ata1.00: failed command: WRITE FPDMA QUEUED [ 103.214180][ T1029] ata1.00: cmd 61/40:70:ae:09:08/05:00:00:00:00/40 tag 14 ncq dma 688128 out [ 103.214180][ T1029] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 103.214212][ T1029] ata1.00: status: { DRDY } [ 103.214220][ T1029] ata1.00: failed command: WRITE FPDMA QUEUED [ 103.214224][ T1029] ata1.00: cmd 61/c0:78:ee:0e:08/02:00:00:00:00/40 tag 15 ncq dma 360448 out [ 103.214224][ T1029] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 103.214243][ T1029] ata1.00: status: { DRDY } [ 103.215163][ T1029] ata1.00: configured for UDMA/100 [ 103.215922][ T1029] ata1: EH complete [ 103.289405][ T5356] device-mapper: table: 248:0: thin-pool: Error setting metadata or data device (-EINVAL) [ 103.289426][ T5356] device-mapper: ioctl: error adding target to table [ 103.298288][ T5356] ================================================================== [ 103.298315][ T5356] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 103.298581][ T5356] Read of size 8 at addr ffff888040418618 by task syz.0.0/5356 [ 103.298603][ T5356] [ 103.298622][ T5356] CPU: 0 UID: 0 PID: 5356 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.298649][ T5356] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.298678][ T5356] Call Trace: [ 103.298701][ T5356] [ 103.298718][ T5356] dump_stack_lvl+0xe8/0x150 [ 103.298803][ T5356] print_address_description+0x55/0x1e0 [ 103.298824][ T5356] ? snapshot_ctr+0x5cb/0x1340 [ 103.298846][ T5356] print_report+0x58/0x70 [ 103.298863][ T5356] kasan_report+0x117/0x150 [ 103.298903][ T5356] ? snapshot_ctr+0x5cb/0x1340 [ 103.298919][ T5356] snapshot_ctr+0x5cb/0x1340 [ 103.298936][ T5356] ? __pfx_snapshot_ctr+0x10/0x10 [ 103.298948][ T5356] ? skip_spaces+0x8a/0xa0 [ 103.299067][ T5356] ? dm_split_args+0x50b/0x5d0 [ 103.299082][ T5356] dm_table_add_target+0x58d/0xc70 [ 103.299098][ T5356] table_load+0x325/0x8a0 [ 103.299118][ T5356] ? __pfx_table_load+0x10/0x10 [ 103.299135][ T5356] ? __might_fault+0xaf/0x130 [ 103.299154][ T5356] dm_ctl_ioctl+0x9ec/0xe10 [ 103.299191][ T5356] ? __pfx_table_load+0x10/0x10 [ 103.299209][ T5356] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.299231][ T5356] ? __fget_files+0x2a/0x420 [ 103.299245][ T5356] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.299286][ T5356] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.299304][ T5356] __se_sys_ioctl+0xfc/0x170 [ 103.299319][ T5356] do_syscall_64+0x166/0x520 [ 103.299438][ T5356] ? trace_irq_disable+0x3b/0x140 [ 103.299465][ T5356] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.299491][ T5356] ? clear_bhb_loop+0x70/0xc0 [ 103.299505][ T5356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.299517][ T5356] RIP: 0033:0x7f3fd819f559 [ 103.299530][ T5356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.299541][ T5356] RSP: 002b:00007f3fd90e1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.299567][ T5356] RAX: ffffffffffffffda RBX: 00007f3fd8426090 RCX: 00007f3fd819f559 [ 103.299576][ T5356] RDX: 0000200000000600 RSI: 00000000c138fd09 RDI: 000000000000000f [ 103.299585][ T5356] RBP: 00007f3fd8236b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.299592][ T5356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.299598][ T5356] R13: 00007f3fd8426128 R14: 00007f3fd8426090 R15: 00007ffd30b0b9f8 [ 103.299611][ T5356] [ 103.299615][ T5356] [ 103.299618][ T5356] Allocated by task 5356: [ 103.299643][ T5356] kasan_save_track+0x3e/0x80 [ 103.299659][ T5356] __kasan_kmalloc+0x93/0xb0 [ 103.299707][ T5356] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 103.299722][ T5356] dm_get_table_device+0x23e/0x730 [ 103.299735][ T5356] dm_get_device+0x327/0x760 [ 103.299744][ T5356] snapshot_ctr+0x2b2/0x1340 [ 103.299755][ T5356] dm_table_add_target+0x58d/0xc70 [ 103.299764][ T5356] table_load+0x325/0x8a0 [ 103.299777][ T5356] dm_ctl_ioctl+0x9ec/0xe10 [ 103.299790][ T5356] __se_sys_ioctl+0xfc/0x170 [ 103.299804][ T5356] do_syscall_64+0x166/0x520 [ 103.299816][ T5356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.299827][ T5356] [ 103.299830][ T5356] Freed by task 5356: [ 103.299835][ T5356] kasan_save_track+0x3e/0x80 [ 103.299858][ T5356] kasan_save_free_info+0x40/0x50 [ 103.299867][ T5356] __kasan_slab_free+0x5c/0x80 [ 103.299879][ T5356] kfree+0x1c5/0x650 [ 103.299887][ T5356] dm_put_table_device+0x255/0x2a0 [ 103.299897][ T5356] dm_get_device+0x56f/0x760 [ 103.299906][ T5356] snapshot_ctr+0x471/0x1340 [ 103.299918][ T5356] dm_table_add_target+0x58d/0xc70 [ 103.299926][ T5356] table_load+0x325/0x8a0 [ 103.299939][ T5356] dm_ctl_ioctl+0x9ec/0xe10 [ 103.299953][ T5356] __se_sys_ioctl+0xfc/0x170 [ 103.299965][ T5356] do_syscall_64+0x166/0x520 [ 103.299978][ T5356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.299988][ T5356] [ 103.299991][ T5356] The buggy address belongs to the object at ffff888040418600 [ 103.299991][ T5356] which belongs to the cache kmalloc-96 of size 96 [ 103.300017][ T5356] The buggy address is located 24 bytes inside of [ 103.300017][ T5356] freed 96-byte region [ffff888040418600, ffff888040418660) [ 103.300030][ T5356] [ 103.300034][ T5356] The buggy address belongs to the physical page: [ 103.300041][ T5356] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x40418 [ 103.300054][ T5356] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 103.300064][ T5356] page_type: f5(slab) [ 103.300076][ T5356] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 103.300086][ T5356] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 103.300091][ T5356] page dumped because: kasan: bad access detected [ 103.300097][ T5356] page_owner tracks the page as allocated [ 103.300101][ T5356] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 25738608023 [ 103.300120][ T5356] post_alloc_hook+0x1f9/0x250 [ 103.300131][ T5356] get_page_from_freelist+0x220f/0x2280 [ 103.300145][ T5356] __alloc_frozen_pages_noprof+0x1fe/0x410 [ 103.300159][ T5356] allocate_slab+0x7d/0x5e0 [ 103.300174][ T5356] refill_objects+0x2d5/0x350 [ 103.300191][ T5356] __pcs_replace_empty_main+0x2c8/0x6c0 [ 103.300207][ T5356] __kmalloc_cache_noprof+0x396/0x600 [ 103.300217][ T5356] lookup_or_create_module_kobject+0x75/0x170 [ 103.300234][ T5356] module_add_driver+0x79/0x320 [ 103.300302][ T5356] bus_add_driver+0x3e5/0x6e0 [ 103.300329][ T5356] driver_register+0x23a/0x320 [ 103.300342][ T5356] usb_register_driver+0x1e4/0x390 [ 103.300376][ T5356] do_one_initcall+0x250/0x870 [ 103.300387][ T5356] do_initcall_level+0x10a/0x1a0 [ 103.300452][ T5356] do_initcalls+0x59/0xa0 [ 103.300463][ T5356] kernel_init_freeable+0x29d/0x3e0 [ 103.300477][ T5356] page last free pid 1 tgid 1 ts 25710281241 stack trace: [ 103.300485][ T5356] register_failure_stack+0x98/0x100 [ 103.300501][ T5356] init_page_owner+0x33/0x600 [ 103.300515][ T5356] page_ext_init+0x50c/0x550 [ 103.300524][ T5356] mm_core_init+0x97/0xb0 [ 103.300538][ T5356] [ 103.300540][ T5356] Memory state around the buggy address: [ 103.300547][ T5356] ffff888040418500: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 103.300555][ T5356] ffff888040418580: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 103.300562][ T5356] >ffff888040418600: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 103.300569][ T5356] ^ [ 103.300575][ T5356] ffff888040418680: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 103.300581][ T5356] ffff888040418700: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 103.300587][ T5356] ================================================================== [ 103.629459][ T5356] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.632593][ T5356] CPU: 0 UID: 0 PID: 5356 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.636360][ T5356] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.640567][ T5356] Call Trace: [ 103.641967][ T5356] [ 103.643340][ T5356] vpanic+0x26f/0x710 [ 103.645081][ T5356] panic+0xc5/0xd0 [ 103.646730][ T5356] ? __pfx_panic+0x10/0x10 [ 103.648644][ T5356] ? preempt_schedule_thunk+0x16/0x40 [ 103.650916][ T5356] ? snapshot_ctr+0x5cb/0x1340 [ 103.652998][ T5356] ? preempt_schedule_thunk+0x16/0x40 [ 103.655270][ T5356] ? snapshot_ctr+0x5cb/0x1340 [ 103.657325][ T5356] check_panic_on_warn+0x89/0xb0 [ 103.659426][ T5356] ? snapshot_ctr+0x5cb/0x1340 [ 103.661506][ T5356] end_report+0x73/0x170 [ 103.663414][ T5356] ? snapshot_ctr+0x5cb/0x1340 [ 103.665519][ T5356] kasan_report+0x128/0x150 [ 103.667478][ T5356] ? snapshot_ctr+0x5cb/0x1340 [ 103.669569][ T5356] snapshot_ctr+0x5cb/0x1340 [ 103.671586][ T5356] ? __pfx_snapshot_ctr+0x10/0x10 [ 103.673923][ T5356] ? skip_spaces+0x8a/0xa0 [ 103.675823][ T5356] ? dm_split_args+0x50b/0x5d0 [ 103.677831][ T5356] dm_table_add_target+0x58d/0xc70 [ 103.679966][ T5356] table_load+0x325/0x8a0 [ 103.681798][ T5356] ? __pfx_table_load+0x10/0x10 [ 103.683893][ T5356] ? __might_fault+0xaf/0x130 [ 103.685864][ T5356] dm_ctl_ioctl+0x9ec/0xe10 [ 103.687747][ T5356] ? __pfx_table_load+0x10/0x10 [ 103.689820][ T5356] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.691989][ T5356] ? __fget_files+0x2a/0x420 [ 103.693900][ T5356] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.696051][ T5356] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.698171][ T5356] __se_sys_ioctl+0xfc/0x170 [ 103.700103][ T5356] do_syscall_64+0x166/0x520 [ 103.701946][ T5356] ? trace_irq_disable+0x3b/0x140 [ 103.704092][ T5356] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.706627][ T5356] ? clear_bhb_loop+0x70/0xc0 [ 103.708608][ T5356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.711145][ T5356] RIP: 0033:0x7f3fd819f559 [ 103.713198][ T5356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.721876][ T5356] RSP: 002b:00007f3fd90e1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.725993][ T5356] RAX: ffffffffffffffda RBX: 00007f3fd8426090 RCX: 00007f3fd819f559 [ 103.729580][ T5356] RDX: 0000200000000600 RSI: 00000000c138fd09 RDI: 000000000000000f [ 103.732782][ T5356] RBP: 00007f3fd8236b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.736028][ T5356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.739390][ T5356] R13: 00007f3fd8426128 R14: 00007f3fd8426090 R15: 00007ffd30b0b9f8 [ 103.742703][ T5356] [ 103.744552][ T5356] Kernel Offset: disabled [ 103.746368][ T5356] Rebooting in 86400 seconds..