UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
misc raw-gadget: fail, usb_gadget_register_driver returned -16
==================================================================
BUG: KASAN: slab-use-after-free in dvb_media_device_free+0x48/0x3cc drivers/media/dvb-core/dvbdev.c:210
Read of size 8 at addr ffff0000cbd608b0 by task syz.6.1391/10600

CPU: 0 UID: 0 PID: 10600 Comm: syz.6.1391 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 dvb_media_device_free+0x48/0x3cc drivers/media/dvb-core/dvbdev.c:210
 dvb_remove_device+0xa8/0x1f4 drivers/media/dvb-core/dvbdev.c:604
 dvb_unregister_frontend+0x7c/0x138 drivers/media/dvb-core/dvb_frontend.c:3080
 vidtv_bridge_remove+0x94/0x10c drivers/media/test-drivers/vidtv/vidtv_bridge.c:554
 platform_remove+0x6c/0x88 drivers/base/platform.c:1456
 device_remove+0xc4/0x134 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
 device_driver_detach+0x48/0x58 drivers/base/dd.c:1408
 unbind_store+0xc0/0xf0 drivers/base/bus.c:244
 drv_attr_store+0x80/0xa4 drivers/base/bus.c:125
 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x51c/0xa0c fs/read_write.c:687
 ksys_write+0x12c/0x228 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x84/0x98 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590

Allocated by task 1:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e8/0x5ec mm/slub.c:5489
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 dvb_register_device+0x1a4/0x16e0 drivers/media/dvb-core/dvbdev.c:472
 dvb_register_frontend+0x474/0x6d0 drivers/media/dvb-core/dvb_frontend.c:3051
 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline]
 vidtv_bridge_probe+0x5a4/0xa58 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510
 platform_probe+0x100/0x1a4 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x29c/0x800 drivers/base/dd.c:706
 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
 __driver_attach+0x168/0x384 drivers/base/dd.c:1292
 bus_for_each_dev+0x128/0x1b4 drivers/base/bus.c:383
 driver_attach+0x50/0x60 drivers/base/dd.c:1310
 bus_add_driver+0x208/0x500 drivers/base/bus.c:763
 driver_register+0x220/0x310 drivers/base/driver.c:174
 __platform_driver_register+0x90/0xa4 drivers/base/platform.c:927
 vidtv_bridge_init+0x4c/0x74 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602
 do_one_initcall+0x274/0xc38 init/main.c:1347
 do_initcall_level+0x12c/0x1c4 init/main.c:1409
 do_initcalls+0x70/0xd0 init/main.c:1425
 do_basic_setup+0x7c/0x90 init/main.c:1445
 kernel_init_freeable+0x268/0x3a8 init/main.c:1658
 kernel_init+0x24/0x1dc init/main.c:1548
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838

Freed by task 10600:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2677 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x188/0x690 mm/slub.c:6692
 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline]
 kref_put include/linux/kref.h:65 [inline]
 dvb_device_put+0x64/0xd0 drivers/media/dvb-core/dvbdev.c:629
 dvb_remove_device+0x94/0x1f4 drivers/media/dvb-core/dvbdev.c:601
 dvb_unregister_frontend+0x7c/0x138 drivers/media/dvb-core/dvb_frontend.c:3080
 vidtv_bridge_remove+0x94/0x10c drivers/media/test-drivers/vidtv/vidtv_bridge.c:554
 platform_remove+0x6c/0x88 drivers/base/platform.c:1456
 device_remove+0xc4/0x134 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
 device_driver_detach+0x48/0x58 drivers/base/dd.c:1408
 unbind_store+0xc0/0xf0 drivers/base/bus.c:244
 drv_attr_store+0x80/0xa4 drivers/base/bus.c:125
 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x51c/0xa0c fs/read_write.c:687
 ksys_write+0x12c/0x228 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x84/0x98 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590

The buggy address belongs to the object at ffff0000cbd60800
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 176 bytes inside of
 freed 256-byte region [ffff0000cbd60800, ffff0000cbd60900)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bd60
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 05ffc00000000001 fffffdffc32f5801 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000cbd60780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000cbd60800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000cbd60880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff0000cbd60900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000cbd60980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Unable to handle kernel paging request at virtual address 007140968000052d
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[007140968000052d] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 10600 Comm: syz.6.1391 Tainted: G    B        L      syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 03400005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid_or_report+0x80/0x1b8 lib/list_debug.c:62
lr : __list_del_entry_valid_or_report+0x54/0x1b8 lib/list_debug.c:50
sp : ffff8000952377f0
x29: ffff8000952377f0 x28: ffff800095237b68 x27: 1fffe0001e5f5100
x26: 1fffe0001e5f5129 x25: 1fffe0001e5f5100 x24: 1fffe000197ac105
x23: 0071c0968000052d x22: dfff800000000000 x21: 038e04b400002968
x20: ffff0000c7a42000 x19: ffff0000cbd60800 x18: 1fffe00034bb7428
x17: 00000000ffff0000 x16: ffff000000000000 x15: ffff800080c9a684
x14: ffff800080c9a504 x13: 0000000000000001 x12: 0000000000000000
x11: ffff800080156070 x10: 0000000000080000 x9 : ffff80008e879940
x8 : dead000000000122 x7 : 0000000000000000 x6 : ffff800080167508
x5 : ffff0000d80d36f0 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 __list_del_entry_valid_or_report+0x80/0x1b8 lib/list_debug.c:62 (P)
 __list_del_entry_valid include/linux/list.h:132 [inline]
 __list_del_entry include/linux/list.h:246 [inline]
 list_del include/linux/list.h:260 [inline]
 dvb_remove_device+0xd4/0x1f4 drivers/media/dvb-core/dvbdev.c:608
 dvb_unregister_frontend+0x7c/0x138 drivers/media/dvb-core/dvb_frontend.c:3080
 vidtv_bridge_remove+0x94/0x10c drivers/media/test-drivers/vidtv/vidtv_bridge.c:554
 platform_remove+0x6c/0x88 drivers/base/platform.c:1456
 device_remove+0xc4/0x134 drivers/base/dd.c:616
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
 device_driver_detach+0x48/0x58 drivers/base/dd.c:1408
 unbind_store+0xc0/0xf0 drivers/base/bus.c:244
 drv_attr_store+0x80/0xa4 drivers/base/bus.c:125
 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x51c/0xa0c fs/read_write.c:687
 ksys_write+0x12c/0x228 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x84/0x98 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Code: 91008908 eb0802bf 540005a0 d343feb7 (38766ae8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	91008908 	add	x8, x8, #0x22
   4:	eb0802bf 	cmp	x21, x8
   8:	540005a0 	b.eq	0xbc  // b.none
   c:	d343feb7 	lsr	x23, x21, #3
* 10:	38766ae8 	ldrb	w8, [x23, x22] <-- trapping instruction