================================================================== BUG: KFENCE: use-after-free read in dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Use-after-free read at 0xffff88823bef2f18 (in kfence-#120): dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x231/0x6a0 fs/char_dev.c:414 do_dentry_open+0x744/0x1c10 fs/open.c:964 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:3896 [inline] path_openat+0x1de4/0x2cb0 fs/namei.c:4055 do_filp_open+0x20b/0x470 fs/namei.c:4082 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#120: 0xffff88823bef2f00-0xffff88823bef2fd7, size=216, cache=kmalloc-256 allocated by task 1 on cpu 0 at 23.827850s (1859.922191s ago): kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] dvb_register_device+0x1e4/0x2370 drivers/media/dvb-core/dvbdev.c:475 dvb_register_frontend+0x5a6/0x880 drivers/media/dvb-core/dvb_frontend.c:3051 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:436 [inline] vidtv_bridge_probe+0x459/0xa90 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508 platform_probe+0x102/0x1f0 drivers/base/platform.c:1404 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x23e/0xa90 drivers/base/dd.c:657 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:799 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829 __driver_attach+0x283/0x580 drivers/base/dd.c:1215 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:370 bus_add_driver+0x2e9/0x690 drivers/base/bus.c:678 driver_register+0x15c/0x4b0 drivers/base/driver.c:249 vidtv_bridge_init+0x45/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598 do_one_initcall+0x120/0x6e0 init/main.c:1274 do_initcall_level init/main.c:1336 [inline] do_initcalls init/main.c:1352 [inline] do_basic_setup init/main.c:1371 [inline] kernel_init_freeable+0x5c2/0x900 init/main.c:1584 kernel_init+0x1c/0x2b0 init/main.c:1474 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 freed by task 13921 on cpu 0 at 1878.171942s (5.670963s ago): dvb_free_device drivers/media/dvb-core/dvbdev.c:619 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put.part.0+0x60/0x90 drivers/media/dvb-core/dvbdev.c:632 dvb_device_put drivers/media/dvb-core/dvbdev.c:631 [inline] dvb_device_open+0x2a4/0x3b0 drivers/media/dvb-core/dvbdev.c:113 chrdev_open+0x231/0x6a0 fs/char_dev.c:414 do_dentry_open+0x744/0x1c10 fs/open.c:964 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:3896 [inline] path_openat+0x1de4/0x2cb0 fs/namei.c:4055 do_filp_open+0x20b/0x470 fs/namei.c:4082 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 14047 Comm: syz.3.6730 Tainted: G U 6.16.0-rc3-syzkaller-00044-g7595b66ae9de #0 PREEMPT(full) Tainted: [U]=USER Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Code: 0f 84 3f 02 00 00 e8 91 1b e6 f9 48 8d 7d 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 77 02 00 00 <4c> 8b 6d 18 4d 85 ed 0f 84 0e 02 00 00 e8 60 1b e6 f9 4c 89 ea 48 RSP: 0018:ffffc90004c9f930 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc900140bb000 RDX: 1ffff110477de5e3 RSI: ffffffff87d56e6f RDI: ffff88823bef2f18 RBP: ffff88823bef2f00 R08: 0000000000000001 R09: fffffbfff1f86565 R10: ffffffff8fc32b2f R11: 0000000000000001 R12: ffff888027c96fc0 R13: ffffffff87d56da0 R14: ffff88802ab542d0 R15: ffff888027c97008 FS: 00007ff6cd4cd6c0(0000) GS:ffff888124760000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bef2f18 CR3: 00000000765f6000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: chrdev_open+0x231/0x6a0 fs/char_dev.c:414 do_dentry_open+0x744/0x1c10 fs/open.c:964 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:3896 [inline] path_openat+0x1de4/0x2cb0 fs/namei.c:4055 do_filp_open+0x20b/0x470 fs/namei.c:4082 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff6cc58e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff6cd4cd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007ff6cc7b5fa0 RCX: 00007ff6cc58e929 RDX: 0000000000000001 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007ff6cc610b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ff6cc7b5fa0 R15: 00007fffc78d0c68 ================================================================== ---------------- Code disassembly (best guess): 0: 0f 84 3f 02 00 00 je 0x245 6: e8 91 1b e6 f9 call 0xf9e61b9c b: 48 8d 7d 18 lea 0x18(%rbp),%rdi f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 48 89 fa mov %rdi,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 77 02 00 00 jne 0x2a1 * 2a: 4c 8b 6d 18 mov 0x18(%rbp),%r13 <-- trapping instruction 2e: 4d 85 ed test %r13,%r13 31: 0f 84 0e 02 00 00 je 0x245 37: e8 60 1b e6 f9 call 0xf9e61b9c 3c: 4c 89 ea mov %r13,%rdx 3f: 48 rex.W