================================================================== BUG: KFENCE: use-after-free read in dvb_frontend_release+0x16e/0x5d0 drivers/media/dvb-core/dvb_frontend.c:2916 Use-after-free read at 0xffff88816da2c03c (in kfence-#21): dvb_frontend_release+0x16e/0x5d0 drivers/media/dvb-core/dvb_frontend.c:2916 __fput+0x3ff/0xb40 fs/file_table.c:469 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x829/0x2a90 kernel/exit.c:971 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034 arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] ret_from_fork+0x95b/0xd80 arch/x86/kernel/process.c:167 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 kfence-#21: 0xffff88816da2c000-0xffff88816da2c0d7, size=216, cache=kmalloc-256 allocated by task 1 on cpu 3 at 17.537513s (552.802001s ago): kmalloc_noprof include/linux/slab.h:962 [inline] kzalloc_noprof include/linux/slab.h:1204 [inline] dvb_register_device+0x1d6/0x1e60 drivers/media/dvb-core/dvbdev.c:475 dvb_register_frontend+0x5a8/0x8a0 drivers/media/dvb-core/dvb_frontend.c:3051 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:436 [inline] vidtv_bridge_probe+0x44b/0xa30 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508 platform_probe+0x106/0x1d0 drivers/base/platform.c:1446 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:661 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:803 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833 __driver_attach+0x2f4/0x6a0 drivers/base/dd.c:1227 bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:383 bus_add_driver+0x305/0x5b0 drivers/base/bus.c:715 driver_register+0x1e2/0x360 drivers/base/driver.c:249 vidtv_bridge_init+0x38/0x70 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598 do_one_initcall+0x11d/0x760 init/main.c:1382 do_initcall_level init/main.c:1444 [inline] do_initcalls init/main.c:1460 [inline] do_basic_setup init/main.c:1479 [inline] kernel_init_freeable+0x6e5/0x7a0 init/main.c:1692 kernel_init+0x1f/0x1e0 init/main.c:1582 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 freed by task 25143 on cpu 2 at 570.314287s (0.025554s ago): dvb_free_device drivers/media/dvb-core/dvbdev.c:619 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put.part.0+0x57/0x90 drivers/media/dvb-core/dvbdev.c:632 dvb_device_put drivers/media/dvb-core/dvbdev.c:171 [inline] dvb_generic_release+0xe2/0x160 drivers/media/dvb-core/dvbdev.c:169 dvb_frontend_release+0x13d/0x5d0 drivers/media/dvb-core/dvb_frontend.c:2914 __fput+0x3ff/0xb40 fs/file_table.c:469 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x829/0x2a90 kernel/exit.c:971 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034 arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] ret_from_fork+0x95b/0xd80 arch/x86/kernel/process.c:167 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 CPU: 2 UID: 0 PID: 25143 Comm: syz.0.5453 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:dvb_frontend_release+0x16e/0x5d0 drivers/media/dvb-core/dvb_frontend.c:2916 Code: fa 89 c3 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 80 03 00 00 <45> 8b 6c 24 3c bf ff ff ff ff 44 89 ee e8 70 8b 1c fa 41 83 fd ff RSP: 0018:ffffc90003ef79e0 EFLAGS: 00010246 RAX: 0000000000000007 RBX: 0000000000000000 RCX: ffffffff82751b85 RDX: 0000000000000000 RSI: ffffffff87e9c597 RDI: ffff88816da2c03c RBP: ffff88802fc5f000 R08: 0000000000000001 R09: fffffbfff363d95e R10: ffffffff9b1ecaf7 R11: 0000000000000000 R12: ffff88816da2c000 R13: 0000000000000000 R14: ffff88802f9b9800 R15: ffff88802f8fe900 FS: 0000000000000000(0000) GS:ffff8880d6558000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88816da2c03c CR3: 0000000037575000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000080000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: __fput+0x3ff/0xb40 fs/file_table.c:469 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x829/0x2a90 kernel/exit.c:971 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112 get_signal+0x1ec7/0x21e0 kernel/signal.c:3034 arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x4a0 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] ret_from_fork+0x95b/0xd80 arch/x86/kernel/process.c:167 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ================================================================== ---------------- Code disassembly (best guess): 0: fa cli 1: 89 c3 mov %eax,%ebx 3: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax a: fc ff df d: 48 c1 ea 03 shr $0x3,%rdx 11: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx 15: 48 89 f8 mov %rdi,%rax 18: 83 e0 07 and $0x7,%eax 1b: 83 c0 03 add $0x3,%eax 1e: 38 d0 cmp %dl,%al 20: 7c 08 jl 0x2a 22: 84 d2 test %dl,%dl 24: 0f 85 80 03 00 00 jne 0x3aa * 2a: 45 8b 6c 24 3c mov 0x3c(%r12),%r13d <-- trapping instruction 2f: bf ff ff ff ff mov $0xffffffff,%edi 34: 44 89 ee mov %r13d,%esi 37: e8 70 8b 1c fa call 0xfa1c8bac 3c: 41 83 fd ff cmp $0xffffffff,%r13d