program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x9, 0x803, 0x3) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) r3 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) ioctl$DM_DEV_CREATE(r3, 0xc138fd03, &(0x7f0000000700)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88001, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r3, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x178, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r4}, [@snapshot={0x0, 0x1008, 0x0, 0x40, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'P', 0x20, '0'}}]}) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f00000009c0)={0x4, 0x0, 0x0, 0x188, 0x138, 0x1, 0x0, 0x610, 0x0, 0x0, @by_dev={r4}, [@snapshot={0x0, 0x8, 0x0, 0x50, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'PO', 0x20, '7'}}]}) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, 0x1, 0xc000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x404c084}, 0x24040010) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000001c0)={0x0, 0x12, 0xfa00, {0x3, &(0x7f0000000200)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r7, &(0x7f0000000380)={0x15, 0x110, 0xfa00, {r8, 0x0, 0x0, 0x30, 0x0, @in={0x1b, 0x0, @multicast2}, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x3ff}}}, 0x118) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001400)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x440}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x3c}}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)=@ipv6_newroute={0xb0, 0x18, 0x800, 0x70bd2b, 0x25dfdbff, {0xa, 0x80, 0x20, 0x10, 0xfd, 0x4, 0x0, 0x2, 0x2800}, [@RTA_METRICS={0x46, 0x8, 0x0, 0x1, "5e5fcca39a8f658873ced7be2c4a679c2d5b56b7cc86e7d77bcd6deb0f752449d59738c13cae63d13e43410aab9451da0f2a2865b248d7c647c5a1dc4390df2142c1"}, @RTA_METRICS={0x39, 0x8, 0x0, 0x1, "7a907bd24b9470b9ea2ac53fb90c6244166d2f1a5e17368e05910c39ed69be4767217e0b33b11f625d2947c710a19a70130a9d72c7"}, @RTA_PRIORITY={0x8, 0x6, 0x8}, @RTA_PRIORITY={0x8, 0x6, 0xa682}]}, 0xb0}, 0x1, 0x0, 0x0, 0x1bd48c7e78948174}, 0x4000801) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000000000000000410001cebe0958bb1f00000200000000000000", @ANYRES32=r5, @ANYBLOB="1100000001120000"], 0x20}}, 0x0) [ 95.433548][ T4664] Bluetooth: hci0: command tx timeout [ 95.606248][ T5351] ================================================================== [ 95.606262][ T5351] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x5cb/0x1340 [ 95.606467][ T5351] Read of size 8 at addr ffff888035d32b18 by task syz.0.0/5351 [ 95.606478][ T5351] [ 95.606485][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.606498][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.606505][ T5351] Call Trace: [ 95.606510][ T5351] [ 95.606515][ T5351] dump_stack_lvl+0xe8/0x150 [ 95.606591][ T5351] print_address_description+0x55/0x1e0 [ 95.606612][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 95.606624][ T5351] print_report+0x58/0x70 [ 95.606642][ T5351] kasan_report+0x117/0x150 [ 95.606681][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 95.606694][ T5351] snapshot_ctr+0x5cb/0x1340 [ 95.606708][ T5351] ? __pfx_snapshot_ctr+0x10/0x10 [ 95.606718][ T5351] ? skip_spaces+0x8a/0xa0 [ 95.606817][ T5351] ? dm_split_args+0x50b/0x5d0 [ 95.606836][ T5351] dm_table_add_target+0x58d/0xc70 [ 95.606855][ T5351] table_load+0x325/0x8a0 [ 95.606872][ T5351] ? __pfx_table_load+0x10/0x10 [ 95.606886][ T5351] ? __might_fault+0xaf/0x130 [ 95.606903][ T5351] dm_ctl_ioctl+0x9ec/0xe10 [ 95.606918][ T5351] ? __pfx_table_load+0x10/0x10 [ 95.606932][ T5351] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 95.606952][ T5351] ? __fget_files+0x2a/0x420 [ 95.606983][ T5351] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.607023][ T5351] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 95.607037][ T5351] __se_sys_ioctl+0xfc/0x170 [ 95.607061][ T5351] do_syscall_64+0x166/0x520 [ 95.607149][ T5351] ? trace_irq_disable+0x3b/0x140 [ 95.607165][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.607177][ T5351] ? clear_bhb_loop+0x70/0xc0 [ 95.607199][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.607211][ T5351] RIP: 0033:0x7f0a1d99f559 [ 95.607222][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.607242][ T5351] RSP: 002b:00007f0a1e867fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.607256][ T5351] RAX: ffffffffffffffda RBX: 00007f0a1dc25fa0 RCX: 00007f0a1d99f559 [ 95.607265][ T5351] RDX: 00002000000009c0 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 95.607273][ T5351] RBP: 00007f0a1da36b20 R08: 0000000000000000 R09: 0000000000000000 [ 95.607278][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.607285][ T5351] R13: 00007f0a1dc26038 R14: 00007f0a1dc25fa0 R15: 00007fff8c12a2e8 [ 95.607306][ T5351] [ 95.607310][ T5351] [ 95.607313][ T5351] Allocated by task 5351: [ 95.607319][ T5351] kasan_save_track+0x3e/0x80 [ 95.607332][ T5351] __kasan_kmalloc+0x93/0xb0 [ 95.607343][ T5351] __kmalloc_cache_node_noprof+0x3cc/0x620 [ 95.607355][ T5351] dm_get_table_device+0x23e/0x730 [ 95.607366][ T5351] dm_get_device+0x327/0x760 [ 95.607377][ T5351] snapshot_ctr+0x2b2/0x1340 [ 95.607387][ T5351] dm_table_add_target+0x58d/0xc70 [ 95.607400][ T5351] table_load+0x325/0x8a0 [ 95.607412][ T5351] dm_ctl_ioctl+0x9ec/0xe10 [ 95.607424][ T5351] __se_sys_ioctl+0xfc/0x170 [ 95.607435][ T5351] do_syscall_64+0x166/0x520 [ 95.607446][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.607455][ T5351] [ 95.607458][ T5351] Freed by task 5351: [ 95.607462][ T5351] kasan_save_track+0x3e/0x80 [ 95.607472][ T5351] kasan_save_free_info+0x40/0x50 [ 95.607480][ T5351] __kasan_slab_free+0x5c/0x80 [ 95.607491][ T5351] kfree+0x1c5/0x650 [ 95.607499][ T5351] dm_put_table_device+0x255/0x2a0 [ 95.607508][ T5351] dm_get_device+0x56f/0x760 [ 95.607520][ T5351] snapshot_ctr+0x471/0x1340 [ 95.607530][ T5351] dm_table_add_target+0x58d/0xc70 [ 95.607543][ T5351] table_load+0x325/0x8a0 [ 95.607554][ T5351] dm_ctl_ioctl+0x9ec/0xe10 [ 95.607566][ T5351] __se_sys_ioctl+0xfc/0x170 [ 95.607577][ T5351] do_syscall_64+0x166/0x520 [ 95.607588][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.607597][ T5351] [ 95.607600][ T5351] The buggy address belongs to the object at ffff888035d32b00 [ 95.607600][ T5351] which belongs to the cache kmalloc-96 of size 96 [ 95.607619][ T5351] The buggy address is located 24 bytes inside of [ 95.607619][ T5351] freed 96-byte region [ffff888035d32b00, ffff888035d32b60) [ 95.607629][ T5351] [ 95.607633][ T5351] The buggy address belongs to the physical page: [ 95.607640][ T5351] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035d32c00 pfn:0x35d32 [ 95.607652][ T5351] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 95.607662][ T5351] page_type: f5(slab) [ 95.607672][ T5351] raw: 04fff00000000200 ffff88801c841280 ffff8880304001c8 ffffea0000da6d90 [ 95.607682][ T5351] raw: ffff888035d32c00 0000000000200016 00000000f5000000 0000000000000000 [ 95.607687][ T5351] page dumped because: kasan: bad access detected [ 95.607693][ T5351] page_owner tracks the page as allocated [ 95.607697][ T5351] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 24, tgid 24 (kworker/u4:2), ts 10818022155 [ 95.607736][ T5351] post_alloc_hook+0x1f9/0x250 [ 95.607746][ T5351] get_page_from_freelist+0x220f/0x2280 [ 95.607758][ T5351] __alloc_frozen_pages_noprof+0x1fe/0x410 [ 95.607771][ T5351] allocate_slab+0x7d/0x5e0 [ 95.607783][ T5351] refill_objects+0x2d5/0x350 [ 95.607796][ T5351] __pcs_replace_empty_main+0x2c8/0x6c0 [ 95.607809][ T5351] __kmalloc_noprof+0x476/0x710 [ 95.607818][ T5351] security_task_alloc+0x4d/0x330 [ 95.607842][ T5351] copy_process+0x1c75/0x44b0 [ 95.607857][ T5351] kernel_clone+0x2d7/0x940 [ 95.607871][ T5351] user_mode_thread+0x115/0x180 [ 95.607884][ T5351] call_usermodehelper_exec_work+0x5c/0x230 [ 95.607897][ T5351] process_scheduled_works+0xc3d/0x1630 [ 95.607910][ T5351] worker_thread+0xa47/0xfb0 [ 95.607923][ T5351] kthread+0x38b/0x480 [ 95.607933][ T5351] ret_from_fork+0x514/0xb70 [ 95.607944][ T5351] page_owner free stack trace missing [ 95.607947][ T5351] [ 95.607950][ T5351] Memory state around the buggy address: [ 95.607955][ T5351] ffff888035d32a00: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 95.607962][ T5351] ffff888035d32a80: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 95.607968][ T5351] >ffff888035d32b00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 95.607974][ T5351] ^ [ 95.607980][ T5351] ffff888035d32b80: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 95.607987][ T5351] ffff888035d32c00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 95.607992][ T5351] ================================================================== [ 95.608328][ T5351] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.880192][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.883395][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.887050][ T5351] Call Trace: [ 95.888422][ T5351] [ 95.889693][ T5351] vpanic+0x26f/0x710 [ 95.891304][ T5351] panic+0xc5/0xd0 [ 95.892708][ T5351] ? __pfx_panic+0x10/0x10 [ 95.894390][ T5351] ? preempt_schedule_thunk+0x16/0x40 [ 95.896380][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 95.898299][ T5351] ? preempt_schedule_thunk+0x16/0x40 [ 95.900432][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 95.902323][ T5351] check_panic_on_warn+0x89/0xb0 [ 95.904501][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 95.906659][ T5351] end_report+0x73/0x170 [ 95.908596][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 95.910654][ T5351] kasan_report+0x128/0x150 [ 95.912740][ T5351] ? snapshot_ctr+0x5cb/0x1340 [ 95.914922][ T5351] snapshot_ctr+0x5cb/0x1340 [ 95.917070][ T5351] ? __pfx_snapshot_ctr+0x10/0x10 [ 95.919381][ T5351] ? skip_spaces+0x8a/0xa0 [ 95.921426][ T5351] ? dm_split_args+0x50b/0x5d0 [ 95.923576][ T5351] dm_table_add_target+0x58d/0xc70 [ 95.925931][ T5351] table_load+0x325/0x8a0 [ 95.927843][ T5351] ? __pfx_table_load+0x10/0x10 [ 95.930013][ T5351] ? __might_fault+0xaf/0x130 [ 95.932151][ T5351] dm_ctl_ioctl+0x9ec/0xe10 [ 95.934227][ T5351] ? __pfx_table_load+0x10/0x10 [ 95.936434][ T5351] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 95.938734][ T5351] ? __fget_files+0x2a/0x420 [ 95.940870][ T5351] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.943040][ T5351] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 95.945229][ T5351] __se_sys_ioctl+0xfc/0x170 [ 95.947350][ T5351] do_syscall_64+0x166/0x520 [ 95.949497][ T5351] ? trace_irq_disable+0x3b/0x140 [ 95.951834][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.954560][ T5351] ? clear_bhb_loop+0x70/0xc0 [ 95.956608][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.959182][ T5351] RIP: 0033:0x7f0a1d99f559 [ 95.961113][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.969709][ T5351] RSP: 002b:00007f0a1e867fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.973468][ T5351] RAX: ffffffffffffffda RBX: 00007f0a1dc25fa0 RCX: 00007f0a1d99f559 [ 95.977011][ T5351] RDX: 00002000000009c0 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 95.980507][ T5351] RBP: 00007f0a1da36b20 R08: 0000000000000000 R09: 0000000000000000 [ 95.984002][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.987519][ T5351] R13: 00007f0a1dc26038 R14: 00007f0a1dc25fa0 R15: 00007fff8c12a2e8 [ 95.991093][ T5351] [ 95.992927][ T5351] Kernel Offset: disabled [ 95.994893][ T5351] Rebooting in 86400 seconds..