program: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = getpgid(0x0) kcmp(r1, r1, 0x266b12d42586f26e, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000480)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x1a8, 0x138, 0x1, 0x0, 0x4200, 0x0, 0x0, @by_dev={r2}, [@thin_pool={0x0, 0x8, 0x0, 0x70, 'thin-pool\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, '64', 0x20, 0x18, ' 1 read_only'}}]}) [ 102.941768][ T5310] Bluetooth: hci0: command tx timeout [ 103.086768][ T5358] ================================================================== [ 103.086782][ T5358] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 [ 103.086974][ T5358] Read of size 1 at addr ffff88803fe99834 by task syz.0.0/5358 [ 103.086985][ T5358] [ 103.087001][ T5358] CPU: 0 UID: 0 PID: 5358 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.087023][ T5358] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.087030][ T5358] Call Trace: [ 103.087045][ T5358] [ 103.087063][ T5358] dump_stack_lvl+0xe8/0x150 [ 103.087095][ T5358] print_address_description+0x55/0x1e0 [ 103.087114][ T5358] ? string+0x216/0x2d0 [ 103.087125][ T5358] print_report+0x58/0x70 [ 103.087140][ T5358] kasan_report+0x117/0x150 [ 103.087156][ T5358] ? string+0x216/0x2d0 [ 103.087179][ T5358] string+0x216/0x2d0 [ 103.087193][ T5358] vsnprintf+0x74a/0xef0 [ 103.087211][ T5358] vprintk_store+0x3be/0xd90 [ 103.087231][ T5358] ? __pfx_vprintk_store+0x10/0x10 [ 103.087247][ T5358] ? lockdep_hardirqs_on+0x7b/0x110 [ 103.087262][ T5358] ? irqentry_exit+0x2a0/0x9b0 [ 103.087280][ T5358] ? panic_on_this_cpu+0x32/0x40 [ 103.087293][ T5358] vprintk_emit+0x192/0x5f0 [ 103.087311][ T5358] ? __pfx_vprintk_emit+0x10/0x10 [ 103.087325][ T5358] ? kfree+0x1c5/0x650 [ 103.087339][ T5358] ? dm_put_table_device+0x255/0x2a0 [ 103.087391][ T5358] _printk+0xdd/0x130 [ 103.087411][ T5358] ? __pfx__printk+0x10/0x10 [ 103.087424][ T5358] ? _parse_integer_limit+0x18f/0x1e0 [ 103.087487][ T5358] ? dm_put_device+0x236/0x280 [ 103.087500][ T5358] pool_ctr+0x752/0xd60 [ 103.087518][ T5358] ? __pfx_pool_ctr+0x10/0x10 [ 103.087534][ T5358] ? rcu_is_watching+0x16/0xb0 [ 103.087551][ T5358] ? kfree+0x4d/0x650 [ 103.087564][ T5358] ? skip_spaces+0x8a/0xa0 [ 103.087590][ T5358] ? dm_split_args+0x50b/0x5d0 [ 103.087603][ T5358] dm_table_add_target+0x58d/0xc70 [ 103.087618][ T5358] table_load+0x325/0x8a0 [ 103.087636][ T5358] ? __pfx_table_load+0x10/0x10 [ 103.087656][ T5358] dm_ctl_ioctl+0x9ec/0xe10 [ 103.087673][ T5358] ? __pfx_table_load+0x10/0x10 [ 103.087689][ T5358] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.087712][ T5358] ? __fget_files+0x2a/0x420 [ 103.087747][ T5358] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.087763][ T5358] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.087780][ T5358] __se_sys_ioctl+0xfc/0x170 [ 103.087794][ T5358] do_syscall_64+0x166/0x520 [ 103.087809][ T5358] ? trace_irq_disable+0x3b/0x140 [ 103.087852][ T5358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.087865][ T5358] ? clear_bhb_loop+0x70/0xc0 [ 103.087878][ T5358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.087889][ T5358] RIP: 0033:0x7ff2af19f559 [ 103.087900][ T5358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.087910][ T5358] RSP: 002b:00007ff2b0005fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.087924][ T5358] RAX: ffffffffffffffda RBX: 00007ff2af425fa0 RCX: 00007ff2af19f559 [ 103.087934][ T5358] RDX: 00002000000002c0 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 103.087943][ T5358] RBP: 00007ff2af236b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.087950][ T5358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.087956][ T5358] R13: 00007ff2af426038 R14: 00007ff2af425fa0 R15: 00007ffe8e6374c8 [ 103.087967][ T5358] [ 103.087971][ T5358] [ 103.087974][ T5358] Allocated by task 5358: [ 103.087988][ T5358] kasan_save_track+0x3e/0x80 [ 103.088000][ T5358] __kasan_kmalloc+0x93/0xb0 [ 103.088011][ T5358] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 103.088023][ T5358] dm_get_table_device+0x23e/0x730 [ 103.088034][ T5358] dm_get_device+0x327/0x760 [ 103.088043][ T5358] pool_ctr+0x4ae/0xd60 [ 103.088056][ T5358] dm_table_add_target+0x58d/0xc70 [ 103.088066][ T5358] table_load+0x325/0x8a0 [ 103.088080][ T5358] dm_ctl_ioctl+0x9ec/0xe10 [ 103.088094][ T5358] __se_sys_ioctl+0xfc/0x170 [ 103.088105][ T5358] do_syscall_64+0x166/0x520 [ 103.088118][ T5358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.088128][ T5358] [ 103.088130][ T5358] Freed by task 5358: [ 103.088135][ T5358] kasan_save_track+0x3e/0x80 [ 103.088146][ T5358] kasan_save_free_info+0x40/0x50 [ 103.088159][ T5358] __kasan_slab_free+0x5c/0x80 [ 103.088169][ T5358] kfree+0x1c5/0x650 [ 103.088182][ T5358] dm_put_table_device+0x255/0x2a0 [ 103.088192][ T5358] dm_get_device+0x56f/0x760 [ 103.088201][ T5358] pool_ctr+0x585/0xd60 [ 103.088214][ T5358] dm_table_add_target+0x58d/0xc70 [ 103.088224][ T5358] table_load+0x325/0x8a0 [ 103.088238][ T5358] dm_ctl_ioctl+0x9ec/0xe10 [ 103.088252][ T5358] __se_sys_ioctl+0xfc/0x170 [ 103.088263][ T5358] do_syscall_64+0x166/0x520 [ 103.088272][ T5358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.088278][ T5358] [ 103.088280][ T5358] The buggy address belongs to the object at ffff88803fe99800 [ 103.088280][ T5358] which belongs to the cache kmalloc-96 of size 96 [ 103.088294][ T5358] The buggy address is located 52 bytes inside of [ 103.088294][ T5358] freed 96-byte region [ffff88803fe99800, ffff88803fe99860) [ 103.088302][ T5358] [ 103.088304][ T5358] The buggy address belongs to the physical page: [ 103.088311][ T5358] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fe99 [ 103.088319][ T5358] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 103.088333][ T5358] page_type: f5(slab) [ 103.088341][ T5358] raw: 04fff00000000000 ffff88801c441280 dead000000000100 dead000000000122 [ 103.088351][ T5358] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 103.088356][ T5358] page dumped because: kasan: bad access detected [ 103.088363][ T5358] page_owner tracks the page as allocated [ 103.088367][ T5358] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 44, tgid 44 (kworker/u4:3), ts 25723268350 [ 103.088386][ T5358] post_alloc_hook+0x1f9/0x250 [ 103.088403][ T5358] get_page_from_freelist+0x220f/0x2280 [ 103.088416][ T5358] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 103.088427][ T5358] allocate_slab+0x7d/0x5e0 [ 103.088441][ T5358] refill_objects+0x2d5/0x350 [ 103.088454][ T5358] __pcs_replace_empty_main+0x2c8/0x6c0 [ 103.088466][ T5358] __kmalloc_cache_node_noprof+0x446/0x620 [ 103.088476][ T5358] __get_vm_area_node+0x155/0x2f0 [ 103.088490][ T5358] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 103.088504][ T5358] __vmalloc_node_noprof+0xc2/0x100 [ 103.088518][ T5358] dup_task_struct+0x2c6/0xa00 [ 103.088532][ T5358] copy_process+0x7ea/0x44b0 [ 103.088545][ T5358] kernel_clone+0x2d7/0x940 [ 103.088558][ T5358] user_mode_thread+0x115/0x180 [ 103.088572][ T5358] call_usermodehelper_exec_work+0x5c/0x230 [ 103.088585][ T5358] process_scheduled_works+0xc3d/0x1630 [ 103.088600][ T5358] page_owner free stack trace missing [ 103.088603][ T5358] [ 103.088606][ T5358] Memory state around the buggy address: [ 103.088611][ T5358] ffff88803fe99700: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 103.088618][ T5358] ffff88803fe99780: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 103.088626][ T5358] >ffff88803fe99800: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 103.088631][ T5358] ^ [ 103.088638][ T5358] ffff88803fe99880: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 103.088645][ T5358] ffff88803fe99900: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 103.088651][ T5358] ================================================================== [ 103.088658][ T5358] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.392890][ T5358] CPU: 0 UID: 0 PID: 5358 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.396517][ T5358] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.400569][ T5358] Call Trace: [ 103.402060][ T5358] [ 103.403342][ T5358] vpanic+0x56d/0xa60 [ 103.405067][ T5358] ? __pfx_vpanic+0x10/0x10 [ 103.407090][ T5358] panic+0xc5/0xd0 [ 103.408688][ T5358] ? __pfx_panic+0x10/0x10 [ 103.410632][ T5358] ? string+0x216/0x2d0 [ 103.412439][ T5358] ? rcu_is_watching+0x16/0xb0 [ 103.414500][ T5358] ? string+0x216/0x2d0 [ 103.416277][ T5358] ? string+0x216/0x2d0 [ 103.418074][ T5358] check_panic_on_warn+0x89/0xb0 [ 103.420197][ T5358] ? string+0x216/0x2d0 [ 103.421946][ T5358] end_report+0x73/0x170 [ 103.423739][ T5358] ? string+0x216/0x2d0 [ 103.425539][ T5358] kasan_report+0x128/0x150 [ 103.427545][ T5358] ? string+0x216/0x2d0 [ 103.429360][ T5358] string+0x216/0x2d0 [ 103.431146][ T5358] vsnprintf+0x74a/0xef0 [ 103.433147][ T5358] vprintk_store+0x3be/0xd90 [ 103.435184][ T5358] ? __pfx_vprintk_store+0x10/0x10 [ 103.437394][ T5358] ? lockdep_hardirqs_on+0x7b/0x110 [ 103.439693][ T5358] ? irqentry_exit+0x2a0/0x9b0 [ 103.441904][ T5358] ? panic_on_this_cpu+0x32/0x40 [ 103.444124][ T5358] vprintk_emit+0x192/0x5f0 [ 103.446429][ T5358] ? __pfx_vprintk_emit+0x10/0x10 [ 103.448865][ T5358] ? kfree+0x1c5/0x650 [ 103.450622][ T5358] ? dm_put_table_device+0x255/0x2a0 [ 103.453052][ T5358] _printk+0xdd/0x130 [ 103.454729][ T5358] ? __pfx__printk+0x10/0x10 [ 103.456768][ T5358] ? _parse_integer_limit+0x18f/0x1e0 [ 103.459051][ T5358] ? dm_put_device+0x236/0x280 [ 103.461141][ T5358] pool_ctr+0x752/0xd60 [ 103.462912][ T5358] ? __pfx_pool_ctr+0x10/0x10 [ 103.464940][ T5358] ? rcu_is_watching+0x16/0xb0 [ 103.466995][ T5358] ? kfree+0x4d/0x650 [ 103.468791][ T5358] ? skip_spaces+0x8a/0xa0 [ 103.470630][ T5358] ? dm_split_args+0x50b/0x5d0 [ 103.472611][ T5358] dm_table_add_target+0x58d/0xc70 [ 103.474771][ T5358] table_load+0x325/0x8a0 [ 103.476587][ T5358] ? __pfx_table_load+0x10/0x10 [ 103.478697][ T5358] dm_ctl_ioctl+0x9ec/0xe10 [ 103.480683][ T5358] ? __pfx_table_load+0x10/0x10 [ 103.482764][ T5358] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.484877][ T5358] ? __fget_files+0x2a/0x420 [ 103.486860][ T5358] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.488953][ T5358] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 103.491082][ T5358] __se_sys_ioctl+0xfc/0x170 [ 103.493053][ T5358] do_syscall_64+0x166/0x520 [ 103.495040][ T5358] ? trace_irq_disable+0x3b/0x140 [ 103.497230][ T5358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.499903][ T5358] ? clear_bhb_loop+0x70/0xc0 [ 103.501907][ T5358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.504375][ T5358] RIP: 0033:0x7ff2af19f559 [ 103.506191][ T5358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.514166][ T5358] RSP: 002b:00007ff2b0005fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.517626][ T5358] RAX: ffffffffffffffda RBX: 00007ff2af425fa0 RCX: 00007ff2af19f559 [ 103.520882][ T5358] RDX: 00002000000002c0 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 103.524248][ T5358] RBP: 00007ff2af236b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.527420][ T5358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.530653][ T5358] R13: 00007ff2af426038 R14: 00007ff2af425fa0 R15: 00007ffe8e6374c8 [ 103.533839][ T5358] [ 103.535516][ T5358] Kernel Offset: disabled [ 103.537540][ T5358] Rebooting in 86400 seconds..