================================================================== BUG: KFENCE: use-after-free read in dvb_frontend_release+0x16e/0x5d0 drivers/media/dvb-core/dvb_frontend.c:2916 Use-after-free read at 0xffff88816dac6f3c (in kfence-#98): dvb_frontend_release+0x16e/0x5d0 drivers/media/dvb-core/dvb_frontend.c:2916 __fput+0x3ff/0xb40 fs/file_table.c:469 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0x100/0x4a0 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x67c/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#98: 0xffff88816dac6f00-0xffff88816dac6fd7, size=216, cache=kmalloc-256 allocated by task 1 on cpu 2 at 19.464074s (192.169193s ago): kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] dvb_register_device+0x1d6/0x1e20 drivers/media/dvb-core/dvbdev.c:472 dvb_register_frontend+0x5a8/0x8a0 drivers/media/dvb-core/dvb_frontend.c:3051 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:436 [inline] vidtv_bridge_probe+0x44b/0xa30 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508 platform_probe+0x106/0x1d0 drivers/base/platform.c:1446 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:661 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:803 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833 __driver_attach+0x2f4/0x6a0 drivers/base/dd.c:1227 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:715 driver_register+0x1e2/0x360 drivers/base/driver.c:249 vidtv_bridge_init+0x38/0x70 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598 do_one_initcall+0x11d/0x760 init/main.c:1382 do_initcall_level init/main.c:1444 [inline] do_initcalls init/main.c:1460 [inline] do_basic_setup init/main.c:1479 [inline] kernel_init_freeable+0x6e5/0x7a0 init/main.c:1692 kernel_init+0x1f/0x1e0 init/main.c:1582 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 freed by task 12561 on cpu 3 at 211.613234s (0.020352s ago): dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put.part.0+0x57/0x90 drivers/media/dvb-core/dvbdev.c:629 dvb_device_put drivers/media/dvb-core/dvbdev.c:171 [inline] dvb_generic_release+0xe2/0x160 drivers/media/dvb-core/dvbdev.c:169 dvb_frontend_release+0x13d/0x5d0 drivers/media/dvb-core/dvb_frontend.c:2914 __fput+0x3ff/0xb40 fs/file_table.c:469 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0x100/0x4a0 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x67c/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 3 UID: 0 PID: 12561 Comm: syz.4.1784 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:dvb_frontend_release+0x16e/0x5d0 drivers/media/dvb-core/dvb_frontend.c:2916 Code: fa 89 c3 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 80 03 00 00 <45> 8b 6c 24 3c bf ff ff ff ff 44 89 ee e8 e0 7f 1a fa 41 83 fd ff RSP: 0018:ffffc900038dfd80 EFLAGS: 00010246 RAX: 0000000000000007 RBX: 0000000000000000 RCX: ffffffff82757aa5 RDX: 0000000000000000 RSI: ffffffff87ebfc57 RDI: ffff88816dac6f3c RBP: ffff88802f515000 R08: 0000000000000001 R09: fffffbfff363fd76 R10: ffffffff9b1febb7 R11: 0000000000000000 R12: ffff88816dac6f00 R13: 0000000000000000 R14: ffff88802efd5000 R15: ffff88802bdf4230 FS: 000055555da39500(0000) GS:ffff8880d6646000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88816dac6f3c CR3: 000000005df95000 CR4: 0000000000352ef0 DR0: 0000000040000005 DR1: 0000000100000000 DR2: 0000000000000898 DR3: 0000000000000006 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: __fput+0x3ff/0xb40 fs/file_table.c:469 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0x100/0x4a0 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x67c/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7b2ff9c799 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc24792c48 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f7b30217da0 RCX: 00007f7b2ff9c799 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f7b30217da0 R08: 00007f7b30216038 R09: 0000000000000000 R10: 00000000003ffd5c R11: 0000000000000246 R12: 0000000000033cd4 R13: 00007f7b30215fac R14: 00000000000339e5 R15: 00007ffc24792d50 ================================================================== ---------------- Code disassembly (best guess): 0: fa cli 1: 89 c3 mov %eax,%ebx 3: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax a: fc ff df d: 48 c1 ea 03 shr $0x3,%rdx 11: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx 15: 48 89 f8 mov %rdi,%rax 18: 83 e0 07 and $0x7,%eax 1b: 83 c0 03 add $0x3,%eax 1e: 38 d0 cmp %dl,%al 20: 7c 08 jl 0x2a 22: 84 d2 test %dl,%dl 24: 0f 85 80 03 00 00 jne 0x3aa * 2a: 45 8b 6c 24 3c mov 0x3c(%r12),%r13d <-- trapping instruction 2f: bf ff ff ff ff mov $0xffffffff,%edi 34: 44 89 ee mov %r13d,%esi 37: e8 e0 7f 1a fa call 0xfa1a801c 3c: 41 83 fd ff cmp $0xffffffff,%r13d