RBP: 00007fc708bc5f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc7ce59f8f R14: 00007fc7060e1300 R15: 0000000000022000
==================================================================
BUG: KASAN: use-after-free in get_kprobe kernel/kprobes.c:372 [inline]
BUG: KASAN: use-after-free in get_optimized_kprobe+0x184/0x1c0 kernel/kprobes.c:489
Read of size 8 at addr ffff888041723e28 by task syz-executor.7/26515

CPU: 1 PID: 26515 Comm: syz-executor.7 Not tainted 5.10.109 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
sysfs: cannot create duplicate filename '/class/ieee80211/€˜
§°ÇÛ ”uòQÇC	!'
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 print_address_description.constprop.0+0x1c/0x210 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report.cold+0x37/0x7c mm/kasan/report.c:562
 get_kprobe kernel/kprobes.c:372 [inline]
 get_optimized_kprobe+0x184/0x1c0 kernel/kprobes.c:489
 __disarm_kprobe+0x80/0x120 kernel/kprobes.c:978
 disarm_kprobe kernel/kprobes.c:1154 [inline]
 __disable_kprobe+0x235/0x350 kernel/kprobes.c:1793
 disable_kprobe+0x25/0x70 kernel/kprobes.c:2299
 __disable_trace_kprobe+0xef/0x180 kernel/trace/trace_kprobe.c:344
 disable_trace_kprobe+0x231/0x2d0 kernel/trace/trace_kprobe.c:422
 kprobe_register+0x61/0xb0 kernel/trace/trace_kprobe.c:1713
 perf_trace_event_unreg.isra.0+0xb0/0x210 kernel/trace/trace_event_perf.c:162
 perf_kprobe_destroy+0xc0/0x130 kernel/trace/trace_event_perf.c:294
 _free_event+0x159/0xc70 kernel/events/core.c:4951
 put_event kernel/events/core.c:5045 [inline]
 perf_event_release_kernel+0x899/0xc20 kernel/events/core.c:5160
 perf_release+0x33/0x40 kernel/events/core.c:5170
 __fput+0x285/0x980 fs/file_table.c:281
 task_work_run+0xe2/0x1a0 kernel/task_work.c:151
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0xc1b/0x2770 kernel/exit.c:811
 do_group_exit+0x125/0x310 kernel/exit.c:908
 get_signal+0x469/0x2200 kernel/signal.c:2748
 arch_do_signal+0x88/0x1b70 arch/x86/kernel/signal.c:805
 exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
 exit_to_user_mode_prepare+0xf7/0x160 kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x38/0x230 kernel/entry/common.c:266
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fa3a807ab19
Code: Unable to access opcode bytes at RIP 0x7fa3a807aaef.
RSP: 002b:00007fa3a55cf218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fa3a818e028 RCX: 00007fa3a807ab19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa3a818e028
RBP: 00007fa3a818e020 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa3a818e02c
R13: 00007ffe6801d2ef R14: 00007fa3a55cf300 R15: 0000000000022000

CPU: 0 PID: 26542 Comm: syz-executor.6 Not tainted 5.10.109 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Allocated by task 26511:
Call Trace:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc include/linux/slab.h:664 [inline]
 alloc_aggr_kprobe+0x41/0x190 kernel/kprobes.c:822
 sysfs_warn_dup.cold+0x1c/0x29 fs/sysfs/dir.c:30
 try_to_optimize_kprobe kernel/kprobes.c:853 [inline]
 register_kprobe kernel/kprobes.c:1740 [inline]
 register_kprobe+0xb78/0x1330 kernel/kprobes.c:1682
 __register_trace_kprobe kernel/trace/trace_kprobe.c:514 [inline]
 __register_trace_kprobe+0x262/0x2d0 kernel/trace/trace_kprobe.c:482
 sysfs_do_create_link_sd+0x11e/0x140 fs/sysfs/symlink.c:51
 create_local_trace_kprobe+0x1e6/0x3b0 kernel/trace/trace_kprobe.c:1840
 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:272
 sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
 sysfs_create_link+0x5f/0xc0 fs/sysfs/symlink.c:92
 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9663
 perf_try_init_event+0x130/0x570 kernel/events/core.c:11041
 device_add_class_symlinks drivers/base/core.c:2704 [inline]
 device_add+0x6ff/0x1bc0 drivers/base/core.c:2912
 perf_init_event kernel/events/core.c:11093 [inline]
 perf_event_alloc.part.0+0xd96/0x2b30 kernel/events/core.c:11371
 perf_event_alloc kernel/events/core.c:11750 [inline]
 __do_sys_perf_event_open+0x57c/0x2d00 kernel/events/core.c:11848
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 14424:
 wiphy_register+0x1da2/0x2850 net/wireless/core.c:915
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0x110/0x150 mm/kasan/common.c:422
 slab_free_hook mm/slub.c:1542 [inline]
 slab_free_freelist_hook+0xa9/0x180 mm/slub.c:1576
 ieee80211_register_hw+0x23c1/0x3870 net/mac80211/main.c:1293
 slab_free mm/slub.c:3149 [inline]
 kfree+0xd7/0x380 mm/slub.c:4125
 free_aggr_kprobe kernel/kprobes.c:434 [inline]
 do_free_cleaned_kprobes kernel/kprobes.c:586 [inline]
 kprobe_optimizer+0x56f/0x7e0 kernel/kprobes.c:624
 process_one_work+0x9a9/0x1590 kernel/workqueue.c:2279
 worker_thread+0x61d/0x1310 kernel/workqueue.c:2425
 kthread+0x38f/0x470 kernel/kthread.c:313
 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:296

The buggy address belongs to the object at ffff888041723e00
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 40 bytes inside of
 192-byte region [ffff888041723e00, ffff888041723ec0)
The buggy address belongs to the page:
 mac80211_hwsim_new_radio+0x1f54/0x4600 drivers/net/wireless/mac80211_hwsim.c:3293
page:00000000e8243491 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x41723
flags: 0x100000000000200(slab)
raw: 0100000000000200 ffffea00010a4a80 0000000b0000000b ffff888007c41500
 hwsim_new_radio_nl+0x991/0x1080 drivers/net/wireless/mac80211_hwsim.c:3868
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888041723d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739
 ffff888041723d80: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888041723e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff888041723e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff888041723f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x33c/0x5a0 net/netlink/genetlink.c:800
==================================================================
 netlink_rcv_skb+0x14b/0x430 net/netlink/af_netlink.c:2507
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x53a/0x7e0 net/netlink/af_netlink.c:1337
 netlink_sendmsg+0x901/0xdf0 net/netlink/af_netlink.c:1932
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0x150/0x190 net/socket.c:671
 ____sys_sendmsg+0x709/0x870 net/socket.c:2342
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2396
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2429
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fcc8a645b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcc87bbb188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fcc8a758f60 RCX: 00007fcc8a645b19
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 00007fcc8a69ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd78efc1cf R14: 00007fcc87bbb300 R15: 0000000000022000
sysfs: cannot create duplicate filename '/class/ieee80211/€˜
§°ÇÛ ”uòQÇC	!'
CPU: 0 PID: 26549 Comm: syz-executor.0 Tainted: G    B             5.10.109 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 sysfs_warn_dup.cold+0x1c/0x29 fs/sysfs/dir.c:30
 sysfs_do_create_link_sd+0x11e/0x140 fs/sysfs/symlink.c:51
 sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
 sysfs_create_link+0x5f/0xc0 fs/sysfs/symlink.c:92
 device_add_class_symlinks drivers/base/core.c:2704 [inline]
 device_add+0x6ff/0x1bc0 drivers/base/core.c:2912
 wiphy_register+0x1da2/0x2850 net/wireless/core.c:915
 ieee80211_register_hw+0x23c1/0x3870 net/mac80211/main.c:1293
 mac80211_hwsim_new_radio+0x1f54/0x4600 drivers/net/wireless/mac80211_hwsim.c:3293
 hwsim_new_radio_nl+0x991/0x1080 drivers/net/wireless/mac80211_hwsim.c:3868
 genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x33c/0x5a0 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x14b/0x430 net/netlink/af_netlink.c:2507
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x53a/0x7e0 net/netlink/af_netlink.c:1337
 netlink_sendmsg+0x901/0xdf0 net/netlink/af_netlink.c:1932
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0x150/0x190 net/socket.c:671
 ____sys_sendmsg+0x709/0x870 net/socket.c:2342
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2396
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2429
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f5ba9afcb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5ba7072188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f5ba9c0ff60 RCX: 00007f5ba9afcb19
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 00007f5ba9b56f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffef6f9e1ff R14: 00007f5ba7072300 R15: 0000000000022000
sysfs: cannot create duplicate filename '/class/ieee80211/€˜
§°ÇÛ ”uòQÇC	!'
CPU: 1 PID: 26542 Comm: syz-executor.6 Tainted: G    B             5.10.109 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 sysfs_warn_dup.cold+0x1c/0x29 fs/sysfs/dir.c:30
 sysfs_do_create_link_sd+0x11e/0x140 fs/sysfs/symlink.c:51
 sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
 sysfs_create_link+0x5f/0xc0 fs/sysfs/symlink.c:92
 device_add_class_symlinks drivers/base/core.c:2704 [inline]
 device_add+0x6ff/0x1bc0 drivers/base/core.c:2912
 wiphy_register+0x1da2/0x2850 net/wireless/core.c:915
 ieee80211_register_hw+0x23c1/0x3870 net/mac80211/main.c:1293
 mac80211_hwsim_new_radio+0x1f54/0x4600 drivers/net/wireless/mac80211_hwsim.c:3293
 hwsim_new_radio_nl+0x991/0x1080 drivers/net/wireless/mac80211_hwsim.c:3868
 genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x33c/0x5a0 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x14b/0x430 net/netlink/af_netlink.c:2507
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x53a/0x7e0 net/netlink/af_netlink.c:1337
 netlink_sendmsg+0x901/0xdf0 net/netlink/af_netlink.c:1932
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0x150/0x190 net/socket.c:671
 ____sys_sendmsg+0x709/0x870 net/socket.c:2342
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2396
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2429
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fcc8a645b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcc87bbb188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fcc8a758f60 RCX: 00007fcc8a645b19
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 00007fcc8a69ff6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd78efc1cf R14: 00007fcc87bbb300 R15: 0000000000022000