program: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0), 0x111, 0x5}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) mkdir(&(0x7f0000000400)='./trace\x00', 0x0) mount(0x0, &(0x7f0000000440)='./trace\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffff9c, &(0x7f00000004c0)='./trace/events/mac80211/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000500)='1', 0x1) mkdirat(0xffffff9c, 0x0, 0x1ed) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wlan1\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r4, 0x8b2a, &(0x7f0000000740)) listen(r2, 0x5) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000080)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44) r6 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r6, &(0x7f0000000100)={0x2, 0x15, @loopback}, 0x10) write(r6, &(0x7f0000000140)='PASV\r\n', 0x6) r7 = accept4(r2, 0x0, 0x0, 0x0) write(r7, &(0x7f00000003c0)="32323720456e74f1f1771367205061737369766530", 0x15) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e}, 0x94) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x8000001, &(0x7f0000000340), 0x2, 0x1}}, 0x20) writev(r1, &(0x7f0000000380)=[{&(0x7f00000003c0), 0x86}], 0x2) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000001100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88001, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000580)={0x4, 0x0, 0x0, 0x1a0, 0x138, 0x1, 0x0, 0x28800, 0x0, 0x0, @by_dev={r8}, [@snapshot={0x0, 0x1c18, 0x0, 0x68, 'snapshot\x00', {@ram_num={'1:', 0x0}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'n', 0x20, '32', ' 1 discard_zeroes_cow'}}]}) [ 85.920329][ T4668] Bluetooth: hci0: command tx timeout [ 86.166525][ T1066] IPVS: starting estimator thread 0... [ 86.193412][ T5351] ================================================================== [ 86.193425][ T5351] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 86.193712][ T5351] Read of size 8 at addr ffff88804045e398 by task syz.0.0/5351 [ 86.193723][ T5351] [ 86.193747][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.193759][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.193790][ T5351] Call Trace: [ 86.193796][ T5351] [ 86.193802][ T5351] dump_stack_lvl+0xe8/0x150 [ 86.193842][ T5351] print_address_description+0x55/0x1e0 [ 86.193860][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 86.193872][ T5351] print_report+0x58/0x70 [ 86.193887][ T5351] kasan_report+0x117/0x150 [ 86.193902][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 86.193914][ T5351] snapshot_ctr+0x5cb/0x1340 [ 86.193923][ T5351] ? __pfx_snapshot_ctr+0x10/0x10 [ 86.193930][ T5351] ? skip_spaces+0x8a/0xa0 [ 86.194014][ T5351] ? dm_split_args+0x50b/0x5d0 [ 86.194027][ T5351] dm_table_add_target+0x58d/0xc70 [ 86.194042][ T5351] table_load+0x325/0x8a0 [ 86.194066][ T5351] ? __pfx_table_load+0x10/0x10 [ 86.194086][ T5351] ? __might_fault+0xaf/0x130 [ 86.194101][ T5351] dm_ctl_ioctl+0x9ec/0xe10 [ 86.194117][ T5351] ? __pfx_table_load+0x10/0x10 [ 86.194132][ T5351] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 86.194152][ T5351] ? __fget_files+0x2a/0x420 [ 86.194187][ T5351] ? bpf_lsm_file_ioctl+0x9/0x20 [ 86.194201][ T5351] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 86.194216][ T5351] __se_sys_ioctl+0xfc/0x170 [ 86.194231][ T5351] do_syscall_64+0x166/0x520 [ 86.194281][ T5351] ? trace_irq_disable+0x3b/0x140 [ 86.194297][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.194309][ T5351] ? clear_bhb_loop+0x70/0xc0 [ 86.194320][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.194357][ T5351] RIP: 0033:0x7fbdc7d9f559 [ 86.194369][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.194378][ T5351] RSP: 002b:00007fbdc8cc8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.194393][ T5351] RAX: ffffffffffffffda RBX: 00007fbdc8026090 RCX: 00007fbdc7d9f559 [ 86.194402][ T5351] RDX: 0000200000000580 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 86.194410][ T5351] RBP: 00007fbdc7e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 86.194418][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.194425][ T5351] R13: 00007fbdc8026128 R14: 00007fbdc8026090 R15: 00007ffc520a6ec8 [ 86.194449][ T5351] [ 86.194452][ T5351] [ 86.194454][ T5351] Allocated by task 5351: [ 86.194459][ T5351] kasan_save_track+0x3e/0x80 [ 86.194467][ T5351] __kasan_kmalloc+0x93/0xb0 [ 86.194475][ T5351] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 86.194482][ T5351] dm_get_table_device+0x23e/0x730 [ 86.194489][ T5351] dm_get_device+0x327/0x760 [ 86.194495][ T5351] snapshot_ctr+0x2b2/0x1340 [ 86.194503][ T5351] dm_table_add_target+0x58d/0xc70 [ 86.194508][ T5351] table_load+0x325/0x8a0 [ 86.194517][ T5351] dm_ctl_ioctl+0x9ec/0xe10 [ 86.194526][ T5351] __se_sys_ioctl+0xfc/0x170 [ 86.194535][ T5351] do_syscall_64+0x166/0x520 [ 86.194543][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.194549][ T5351] [ 86.194551][ T5351] Freed by task 5351: [ 86.194556][ T5351] kasan_save_track+0x3e/0x80 [ 86.194563][ T5351] kasan_save_free_info+0x40/0x50 [ 86.194568][ T5351] __kasan_slab_free+0x5c/0x80 [ 86.194578][ T5351] kfree+0x1c5/0x650 [ 86.194585][ T5351] dm_put_table_device+0x255/0x2a0 [ 86.194594][ T5351] dm_get_device+0x56f/0x760 [ 86.194601][ T5351] snapshot_ctr+0x471/0x1340 [ 86.194611][ T5351] dm_table_add_target+0x58d/0xc70 [ 86.194626][ T5351] table_load+0x325/0x8a0 [ 86.194644][ T5351] dm_ctl_ioctl+0x9ec/0xe10 [ 86.194657][ T5351] __se_sys_ioctl+0xfc/0x170 [ 86.194670][ T5351] do_syscall_64+0x166/0x520 [ 86.194678][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.194684][ T5351] [ 86.194687][ T5351] The buggy address belongs to the object at ffff88804045e380 [ 86.194687][ T5351] which belongs to the cache kmalloc-96 of size 96 [ 86.194694][ T5351] The buggy address is located 24 bytes inside of [ 86.194694][ T5351] freed 96-byte region [ffff88804045e380, ffff88804045e3e0) [ 86.194701][ T5351] [ 86.194703][ T5351] The buggy address belongs to the physical page: [ 86.194710][ T5351] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4045e [ 86.194746][ T5351] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 86.194757][ T5351] page_type: f5(slab) [ 86.194767][ T5351] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 86.194777][ T5351] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 86.194783][ T5351] page dumped because: kasan: bad access detected [ 86.194790][ T5351] page_owner tracks the page as allocated [ 86.194794][ T5351] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 23429746971 [ 86.194810][ T5351] post_alloc_hook+0x1f9/0x250 [ 86.194820][ T5351] get_page_from_freelist+0x220f/0x2280 [ 86.194831][ T5351] __alloc_frozen_pages_noprof+0x1fe/0x410 [ 86.194843][ T5351] allocate_slab+0x7d/0x5e0 [ 86.194857][ T5351] ___slab_alloc+0x16a/0x960 [ 86.194870][ T5351] __kmalloc_cache_node_noprof+0x1d6/0x620 [ 86.194882][ T5351] __alloc_workqueue+0x7dc/0x21d0 [ 86.194895][ T5351] alloc_workqueue_noprof+0xe3/0x210 [ 86.194903][ T5351] mlx4_ib_init+0x1b/0x90 [ 86.195059][ T5351] do_one_initcall+0x250/0x870 [ 86.195070][ T5351] do_initcall_level+0x10a/0x1a0 [ 86.195083][ T5351] do_initcalls+0x59/0xa0 [ 86.195094][ T5351] kernel_init_freeable+0x29d/0x3e0 [ 86.195107][ T5351] kernel_init+0x22/0x1d0 [ 86.195113][ T5351] ret_from_fork+0x514/0xb70 [ 86.195122][ T5351] ret_from_fork_asm+0x1a/0x30 [ 86.195128][ T5351] page last free pid 57 tgid 57 ts 23429062814 stack trace: [ 86.195134][ T5351] __free_frozen_pages+0xc97/0xd90 [ 86.195141][ T5351] __kasan_populate_vmalloc+0x1a8/0x1c0 [ 86.195147][ T5351] alloc_vmap_area+0xd10/0x1410 [ 86.195156][ T5351] __get_vm_area_node+0x200/0x2f0 [ 86.195165][ T5351] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 86.195174][ T5351] __vmalloc_node_noprof+0xc2/0x100 [ 86.195179][ T5351] dup_task_struct+0x2c6/0xa00 [ 86.195188][ T5351] copy_process+0x7ea/0x44b0 [ 86.195199][ T5351] kernel_clone+0x2d7/0x940 [ 86.195208][ T5351] user_mode_thread+0x115/0x180 [ 86.195217][ T5351] call_usermodehelper_exec_work+0x5c/0x230 [ 86.195229][ T5351] process_scheduled_works+0xc3d/0x1630 [ 86.195242][ T5351] worker_thread+0xa47/0xfb0 [ 86.195250][ T5351] kthread+0x38b/0x480 [ 86.195259][ T5351] ret_from_fork+0x514/0xb70 [ 86.195269][ T5351] ret_from_fork_asm+0x1a/0x30 [ 86.195278][ T5351] [ 86.195281][ T5351] Memory state around the buggy address: [ 86.195286][ T5351] ffff88804045e280: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 86.195293][ T5351] ffff88804045e300: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 86.195299][ T5351] >ffff88804045e380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 86.195304][ T5351] ^ [ 86.195310][ T5351] ffff88804045e400: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 86.195317][ T5351] ffff88804045e480: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 86.195322][ T5351] ================================================================== [ 86.261244][ T5354] IPVS: using max 93 ests per chain, 223200 per kthread [ 86.560929][ T5351] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 86.564206][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.568157][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.572609][ T5351] Call Trace: [ 86.574120][ T5351] [ 86.575468][ T5351] vpanic+0x26f/0x710 [ 86.577276][ T5351] panic+0xc5/0xd0 [ 86.578955][ T5351] ? __pfx_panic+0x10/0x10 [ 86.580879][ T5351] ? preempt_schedule_thunk+0x16/0x40 [ 86.583335][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 86.585482][ T5351] ? preempt_schedule_thunk+0x16/0x40 [ 86.587773][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 86.589834][ T5351] check_panic_on_warn+0x89/0xb0 [ 86.591899][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 86.593874][ T5351] end_report+0x73/0x170 [ 86.596096][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 86.598287][ T5351] kasan_report+0x128/0x150 [ 86.600308][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 86.602490][ T5351] snapshot_ctr+0x5cb/0x1340 [ 86.604479][ T5351] ? __pfx_snapshot_ctr+0x10/0x10 [ 86.606745][ T5351] ? skip_spaces+0x8a/0xa0 [ 86.608722][ T5351] ? dm_split_args+0x50b/0x5d0 [ 86.610919][ T5351] dm_table_add_target+0x58d/0xc70 [ 86.613168][ T5351] table_load+0x325/0x8a0 [ 86.615091][ T5351] ? __pfx_table_load+0x10/0x10 [ 86.617218][ T5351] ? __might_fault+0xaf/0x130 [ 86.619219][ T5351] dm_ctl_ioctl+0x9ec/0xe10 [ 86.621155][ T5351] ? __pfx_table_load+0x10/0x10 [ 86.623273][ T5351] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 86.625507][ T5351] ? __fget_files+0x2a/0x420 [ 86.627442][ T5351] ? bpf_lsm_file_ioctl+0x9/0x20 [ 86.629552][ T5351] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 86.632370][ T5351] __se_sys_ioctl+0xfc/0x170 [ 86.634682][ T5351] do_syscall_64+0x166/0x520 [ 86.636830][ T5351] ? trace_irq_disable+0x3b/0x140 [ 86.639127][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.641745][ T5351] ? clear_bhb_loop+0x70/0xc0 [ 86.643805][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.646256][ T5351] RIP: 0033:0x7fbdc7d9f559 [ 86.648188][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.656194][ T5351] RSP: 002b:00007fbdc8cc8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.659744][ T5351] RAX: ffffffffffffffda RBX: 00007fbdc8026090 RCX: 00007fbdc7d9f559 [ 86.662961][ T5351] RDX: 0000200000000580 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 86.666212][ T5351] RBP: 00007fbdc7e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 86.669462][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.672785][ T5351] R13: 00007fbdc8026128 R14: 00007fbdc8026090 R15: 00007ffc520a6ec8 [ 86.676037][ T5351] [ 86.677824][ T5351] Kernel Offset: disabled [ 86.679760][ T5351] Rebooting in 86400 seconds..