program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) (async, rerun: 32) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) (rerun: 32) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x5a, 0xa, 0x0, "05fcff410400001bf9585253b800c495f2bc838200", 0x968294cb}) syz_open_dev$dvb_frontend(&(0x7f0000000540), 0x0, 0x200200) (async, rerun: 32) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (rerun: 32) [ 93.387347][ T4656] Bluetooth: hci0: command tx timeout [ 93.415720][ T1059] cfg80211: failed to load regulatory.db [ 93.657374][ T5327] ================================================================== [ 93.660730][ T5327] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x40a/0x4d0 [ 93.664188][ T5327] Read of size 4 at addr ffff8880394ccc3c by task syz.0.0/5327 [ 93.667407][ T5327] [ 93.668484][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.668498][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.668505][ T5327] Call Trace: [ 93.668512][ T5327] [ 93.668518][ T5327] dump_stack_lvl+0xe8/0x150 [ 93.668535][ T5327] print_address_description+0x55/0x1e0 [ 93.668546][ T5327] ? dvb_frontend_release+0x40a/0x4d0 [ 93.668558][ T5327] print_report+0x58/0x70 [ 93.668567][ T5327] kasan_report+0x117/0x150 [ 93.668581][ T5327] ? dvb_frontend_release+0x40a/0x4d0 [ 93.668594][ T5327] dvb_frontend_release+0x40a/0x4d0 [ 93.668605][ T5327] ? __pfx_dvb_frontend_release+0x10/0x10 [ 93.668617][ T5327] __fput+0x44f/0xa60 [ 93.668630][ T5327] task_work_run+0x1d9/0x270 [ 93.668651][ T5327] ? __pfx_task_work_run+0x10/0x10 [ 93.668663][ T5327] ? do_raw_spin_unlock+0x4d/0x210 [ 93.668679][ T5327] do_exit+0x70f/0x22c0 [ 93.668693][ T5327] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 93.668753][ T5327] ? __pfx_do_exit+0x10/0x10 [ 93.668765][ T5327] ? preempt_schedule_thunk+0x16/0x30 [ 93.668780][ T5327] ? preempt_schedule_common+0x82/0xd0 [ 93.668795][ T5327] ? preempt_schedule_thunk+0x16/0x30 [ 93.668810][ T5327] do_group_exit+0x21b/0x2d0 [ 93.668823][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.668834][ T5327] __x64_sys_exit_group+0x3f/0x40 [ 93.668845][ T5327] x64_sys_call+0x221a/0x2240 [ 93.668857][ T5327] do_syscall_64+0x174/0x580 [ 93.668867][ T5327] ? clear_bhb_loop+0x40/0x90 [ 93.668877][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.668888][ T5327] RIP: 0033:0x7f447579ce59 [ 93.668898][ T5327] Code: Unable to access opcode bytes at 0x7f447579ce2f. [ 93.668904][ T5327] RSP: 002b:00007fffbc4ccff8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 93.668916][ T5327] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f447579ce59 [ 93.668923][ T5327] RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.668929][ T5327] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f44759e73e0 [ 93.668935][ T5327] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 93.668941][ T5327] R13: 00007f44759e73e0 R14: 0000000000000003 R15: 00007fffbc4cd0b0 [ 93.668950][ T5327] [ 93.668953][ T5327] [ 93.760480][ T5327] Allocated by task 1: [ 93.762199][ T5327] kasan_save_track+0x3e/0x80 [ 93.764126][ T5327] __kasan_kmalloc+0x93/0xb0 [ 93.766090][ T5327] __kmalloc_cache_noprof+0x31c/0x660 [ 93.768207][ T5327] dvb_register_device+0x2fd/0x21e0 [ 93.770264][ T5327] dvb_register_frontend+0x61b/0x920 [ 93.772323][ T5327] vidtv_bridge_probe+0x9aa/0xf80 [ 93.774444][ T5327] platform_probe+0xf9/0x190 [ 93.776376][ T5327] really_probe+0x267/0xaf0 [ 93.778336][ T5327] __driver_probe_device+0x1ef/0x380 [ 93.780313][ T5327] driver_probe_device+0x4f/0x240 [ 93.782346][ T5327] __driver_attach+0x34c/0x640 [ 93.784276][ T5327] bus_for_each_dev+0x23b/0x2c0 [ 93.786254][ T5327] bus_add_driver+0x345/0x670 [ 93.788135][ T5327] driver_register+0x23a/0x320 [ 93.790093][ T5327] vidtv_bridge_init+0x28/0x50 [ 93.792011][ T5327] do_one_initcall+0x250/0x870 [ 93.793932][ T5327] do_initcall_level+0x104/0x190 [ 93.795900][ T5327] do_initcalls+0x59/0xa0 [ 93.797749][ T5327] kernel_init_freeable+0x2a6/0x3e0 [ 93.799955][ T5327] kernel_init+0x1d/0x1d0 [ 93.801776][ T5327] ret_from_fork+0x514/0xb70 [ 93.803673][ T5327] ret_from_fork_asm+0x1a/0x30 [ 93.805703][ T5327] [ 93.806686][ T5327] Freed by task 5327: [ 93.808360][ T5327] kasan_save_track+0x3e/0x80 [ 93.810357][ T5327] kasan_save_free_info+0x46/0x50 [ 93.812457][ T5327] __kasan_slab_free+0x5c/0x80 [ 93.814431][ T5327] kfree+0x1c5/0x640 [ 93.815974][ T5327] dvb_generic_release+0x11d/0x1b0 [ 93.818068][ T5327] dvb_frontend_release+0x132/0x4d0 [ 93.820149][ T5327] __fput+0x44f/0xa60 [ 93.821770][ T5327] task_work_run+0x1d9/0x270 [ 93.823666][ T5327] do_exit+0x70f/0x22c0 [ 93.825380][ T5327] do_group_exit+0x21b/0x2d0 [ 93.827206][ T5327] __x64_sys_exit_group+0x3f/0x40 [ 93.829293][ T5327] x64_sys_call+0x221a/0x2240 [ 93.831246][ T5327] do_syscall_64+0x174/0x580 [ 93.833181][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.835588][ T5327] [ 93.836634][ T5327] The buggy address belongs to the object at ffff8880394ccc00 [ 93.836634][ T5327] which belongs to the cache kmalloc-256 of size 256 [ 93.842456][ T5327] The buggy address is located 60 bytes inside of [ 93.842456][ T5327] freed 256-byte region [ffff8880394ccc00, ffff8880394ccd00) [ 93.847769][ T5327] [ 93.848768][ T5327] The buggy address belongs to the physical page: [ 93.851323][ T5327] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x394cc [ 93.854912][ T5327] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 93.857882][ T5327] page_type: f5(slab) [ 93.859574][ T5327] raw: 04fff00000000000 ffff88801ac41b40 dead000000000100 dead000000000122 [ 93.863219][ T5327] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 93.866713][ T5327] page dumped because: kasan: bad access detected [ 93.869259][ T5327] page_owner tracks the page as allocated [ 93.871690][ T5327] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 24043988185, free_ts 24043839376 [ 93.879511][ T5327] post_alloc_hook+0x22d/0x280 [ 93.881435][ T5327] get_page_from_freelist+0x2593/0x2610 [ 93.883628][ T5327] __alloc_frozen_pages_noprof+0x18d/0x380 [ 93.886019][ T5327] allocate_slab+0x77/0x660 [ 93.887917][ T5327] refill_objects+0x339/0x3d0 [ 93.889899][ T5327] __pcs_replace_empty_main+0x321/0x720 [ 93.892137][ T5327] __kmalloc_cache_noprof+0x392/0x660 [ 93.894267][ T5327] bus_add_driver+0x162/0x670 [ 93.896192][ T5327] driver_register+0x23a/0x320 [ 93.898133][ T5327] usb_register_driver+0x1e4/0x390 [ 93.900174][ T5327] do_one_initcall+0x250/0x870 [ 93.902140][ T5327] do_initcall_level+0x104/0x190 [ 93.904363][ T5327] do_initcalls+0x59/0xa0 [ 93.906112][ T5327] kernel_init_freeable+0x2a6/0x3e0 [ 93.908207][ T5327] kernel_init+0x1d/0x1d0 [ 93.909985][ T5327] ret_from_fork+0x514/0xb70 [ 93.911851][ T5327] page last free pid 803 tgid 803 stack trace: [ 93.914236][ T5327] __free_frozen_pages+0xc1c/0xd30 [ 93.916199][ T5327] vfree+0x1d1/0x2f0 [ 93.917768][ T5327] delayed_vfree_work+0x55/0x80 [ 93.919641][ T5327] process_scheduled_works+0xb5d/0x1860 [ 93.921776][ T5327] worker_thread+0xa53/0xfc0 [ 93.923559][ T5327] kthread+0x389/0x470 [ 93.925260][ T5327] ret_from_fork+0x514/0xb70 [ 93.927149][ T5327] ret_from_fork_asm+0x1a/0x30 [ 93.929072][ T5327] [ 93.930026][ T5327] Memory state around the buggy address: [ 93.932192][ T5327] ffff8880394ccb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.935259][ T5327] ffff8880394ccb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.938339][ T5327] >ffff8880394ccc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.941422][ T5327] ^ [ 93.943621][ T5327] ffff8880394ccc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.946652][ T5327] ffff8880394ccd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.949905][ T5327] ================================================================== [ 93.973441][ T5327] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.976647][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.980672][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.984669][ T5327] Call Trace: [ 93.985970][ T5327] [ 93.987243][ T5327] vpanic+0x56c/0xa60 [ 93.988972][ T5327] ? __pfx_vpanic+0x10/0x10 [ 93.990959][ T5327] ? __pfx___schedule+0x10/0x10 [ 93.993138][ T5327] panic+0xc5/0xd0 [ 93.994890][ T5327] ? __pfx_panic+0x10/0x10 [ 93.996909][ T5327] ? preempt_schedule_common+0x82/0xd0 [ 93.999289][ T5327] ? dvb_frontend_release+0x40a/0x4d0 [ 94.001535][ T5327] check_panic_on_warn+0x89/0xb0 [ 94.003660][ T5327] ? dvb_frontend_release+0x40a/0x4d0 [ 94.005901][ T5327] end_report+0x73/0x170 [ 94.007716][ T5327] ? dvb_frontend_release+0x40a/0x4d0 [ 94.009776][ T5327] kasan_report+0x128/0x150 [ 94.011407][ T5327] ? dvb_frontend_release+0x40a/0x4d0 [ 94.013577][ T5327] dvb_frontend_release+0x40a/0x4d0 [ 94.015667][ T5327] ? __pfx_dvb_frontend_release+0x10/0x10 [ 94.018026][ T5327] __fput+0x44f/0xa60 [ 94.019701][ T5327] task_work_run+0x1d9/0x270 [ 94.021580][ T5327] ? __pfx_task_work_run+0x10/0x10 [ 94.023621][ T5327] ? do_raw_spin_unlock+0x4d/0x210 [ 94.025707][ T5327] do_exit+0x70f/0x22c0 [ 94.027429][ T5327] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.029802][ T5327] ? __pfx_do_exit+0x10/0x10 [ 94.031692][ T5327] ? preempt_schedule_thunk+0x16/0x30 [ 94.033969][ T5327] ? preempt_schedule_common+0x82/0xd0 [ 94.036209][ T5327] ? preempt_schedule_thunk+0x16/0x30 [ 94.038473][ T5327] do_group_exit+0x21b/0x2d0 [ 94.040397][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.042933][ T5327] __x64_sys_exit_group+0x3f/0x40 [ 94.045051][ T5327] x64_sys_call+0x221a/0x2240 [ 94.046920][ T5327] do_syscall_64+0x174/0x580 [ 94.048845][ T5327] ? clear_bhb_loop+0x40/0x90 [ 94.050762][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.053243][ T5327] RIP: 0033:0x7f447579ce59 [ 94.055070][ T5327] Code: Unable to access opcode bytes at 0x7f447579ce2f. [ 94.058009][ T5327] RSP: 002b:00007fffbc4ccff8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 94.061367][ T5327] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f447579ce59 [ 94.064564][ T5327] RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 [ 94.067866][ T5327] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f44759e73e0 [ 94.071188][ T5327] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 94.074506][ T5327] R13: 00007f44759e73e0 R14: 0000000000000003 R15: 00007fffbc4cd0b0 [ 94.077732][ T5327] [ 94.079395][ T5327] Kernel Offset: disabled [ 94.081203][ T5327] Rebooting in 86400 seconds..