================================================================== BUG: KFENCE: use-after-free read in dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Use-after-free read at 0xffff88823bf04f18 (in kfence-#129): dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x741/0x1c10 fs/open.c:964 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:3887 [inline] path_openat+0x1de4/0x2cb0 fs/namei.c:4046 do_filp_open+0x20b/0x470 fs/namei.c:4073 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#129: 0xffff88823bf04000-0xffff88823bf0403f, size=64, cache=page->ptl allocated by task 15364 on cpu 0 at 547.586826s (3.939182s ago): ptlock_alloc+0x1f/0x70 mm/memory.c:7192 ptlock_init include/linux/mm.h:2934 [inline] pagetable_pte_ctor include/linux/mm.h:2983 [inline] __pte_alloc_one_noprof include/asm-generic/pgalloc.h:78 [inline] pte_alloc_one+0x82/0x3a0 arch/x86/mm/pgtable.c:18 do_fault_around mm/memory.c:5560 [inline] do_read_fault mm/memory.c:5599 [inline] do_fault mm/memory.c:5742 [inline] do_pte_missing mm/memory.c:4249 [inline] handle_pte_fault mm/memory.c:6087 [inline] __handle_mm_fault+0x3a36/0x53d0 mm/memory.c:6230 handle_mm_fault+0x589/0xd10 mm/memory.c:6399 do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 freed by task 15338 on cpu 0 at 547.796288s (3.773868s ago): ptlock_free+0x45/0x60 mm/memory.c:7202 pagetable_dtor+0x14/0x260 include/linux/mm.h:2969 pagetable_dtor_free include/linux/mm.h:2976 [inline] __tlb_remove_table include/asm-generic/tlb.h:215 [inline] __tlb_remove_table_free mm/mmu_gather.c:227 [inline] tlb_remove_table_rcu+0xa4/0x1a0 mm/mmu_gather.c:290 rcu_do_batch kernel/rcu/tree.c:2576 [inline] rcu_core+0x79c/0x14e0 kernel/rcu/tree.c:2832 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5836 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock_sched include/linux/rcupdate.h:932 [inline] pfn_valid+0x15c/0x4d0 include/linux/mmzone.h:2142 page_table_check_clear+0x21/0x740 mm/page_table_check.c:70 __page_table_check_pte_clear+0xf1/0x100 mm/page_table_check.c:154 page_table_check_pte_clear include/linux/page_table_check.h:51 [inline] ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1317 [inline] get_and_clear_full_ptes include/linux/pgtable.h:714 [inline] zap_present_folio_ptes mm/memory.c:1503 [inline] zap_present_ptes mm/memory.c:1588 [inline] do_zap_pte_range mm/memory.c:1689 [inline] zap_pte_range mm/memory.c:1733 [inline] zap_pmd_range mm/memory.c:1825 [inline] zap_pud_range mm/memory.c:1854 [inline] zap_p4d_range mm/memory.c:1875 [inline] unmap_page_range+0x24d3/0x47c0 mm/memory.c:1896 unmap_single_vma.constprop.0+0x153/0x240 mm/memory.c:1939 unmap_vmas+0x218/0x470 mm/memory.c:1983 exit_mmap+0x1b9/0xb90 mm/mmap.c:1284 __mmput+0x12a/0x410 kernel/fork.c:1121 mmput+0x62/0x70 kernel/fork.c:1144 exit_mm kernel/exit.c:581 [inline] do_exit+0x7bc/0x2bd0 kernel/exit.c:943 do_group_exit+0xd3/0x2a0 kernel/exit.c:1104 get_signal+0x2673/0x26d0 kernel/signal.c:3034 arch_do_signal_or_restart+0x8f/0x790 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x84/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x3f6/0x490 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 15438 Comm: syz.2.3746 Tainted: G U 6.15.0-syzkaller-10820-gcd2e103d57e5 #0 PREEMPT(full) Tainted: [U]=USER Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:dvb_device_open+0xee/0x3b0 drivers/media/dvb-core/dvbdev.c:99 Code: 0f 84 3f 02 00 00 e8 d1 5f e8 f9 48 8d 7d 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 77 02 00 00 <4c> 8b 6d 18 4d 85 ed 0f 84 0e 02 00 00 e8 a0 5f e8 f9 4c 89 ea 48 RSP: 0018:ffffc9000d05f930 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000c4fc000 RDX: 1ffff110477e09e3 RSI: ffffffff87d30ddf RDI: ffff88823bf04f18 RBP: ffff88823bf04f00 R08: 0000000000000001 R09: fffffbfff1f457d1 R10: ffffffff8fa2be8f R11: 0000000000000001 R12: ffff88807f634c40 R13: ffffffff87d30d10 R14: ffff88802a3b7710 R15: ffff88807f634c88 FS: 00007f838b9226c0(0000) GS:ffff888124a75000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bf04f18 CR3: 0000000076c50000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x741/0x1c10 fs/open.c:964 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:3887 [inline] path_openat+0x1de4/0x2cb0 fs/namei.c:4046 do_filp_open+0x20b/0x470 fs/namei.c:4073 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f838ab8e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f838b922038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f838adb5fa0 RCX: 00007f838ab8e969 RDX: 0000000000000001 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f838ac10ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f838adb5fa0 R15: 00007ffdf8ccb888 ================================================================== ---------------- Code disassembly (best guess): 0: 0f 84 3f 02 00 00 je 0x245 6: e8 d1 5f e8 f9 call 0xf9e85fdc b: 48 8d 7d 18 lea 0x18(%rbp),%rdi f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 48 89 fa mov %rdi,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 77 02 00 00 jne 0x2a1 * 2a: 4c 8b 6d 18 mov 0x18(%rbp),%r13 <-- trapping instruction 2e: 4d 85 ed test %r13,%r13 31: 0f 84 0e 02 00 00 je 0x245 37: e8 a0 5f e8 f9 call 0xf9e85fdc 3c: 4c 89 ea mov %r13,%rdx 3f: 48 rex.W