./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1400363689
<...>
Warning: Permanently added '10.128.1.17' (ECDSA) to the list of known hosts.
execve("./syz-executor1400363689", ["./syz-executor1400363689"], 0x7fffeb751360 /* 10 vars */) = 0
brk(NULL) = 0x5555559cd000
brk(0x5555559cdc40) = 0x5555559cdc40
arch_prctl(ARCH_SET_FS, 0x5555559cd300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1400363689", 4096) = 28
brk(0x5555559eec40) = 0x5555559eec40
brk(0x5555559ef000) = 0x5555559ef000
mprotect(0x7fdcf633b000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000080) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "4", 1) = 1
mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0) = ?
[ 48.993206][ T3607] ==================================================================
[ 49.001283][ T3607] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0x3d/0xb0
[ 49.009605][ T3607] Read of size 8 at addr ffff8880744389e8 by task syz-executor140/3607
[ 49.017819][ T3607]
[ 49.020125][ T3607] CPU: 1 PID: 3607 Comm: syz-executor140 Not tainted 6.0.0-rc6-syzkaller #0
[ 49.028869][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 49.038919][ T3607] Call Trace:
[ 49.042187][ T3607]
[ 49.045111][ T3607] dump_stack_lvl+0x1e3/0x2cb
[ 49.049798][ T3607] ? io_alloc_page_table+0x110/0x110
[ 49.055071][ T3607] ? __wake_up_klogd+0xcd/0x100
[ 49.059905][ T3607] ? panic+0x76b/0x76b
[ 49.063958][ T3607] ? _printk+0xcf/0x10f
[ 49.068093][ T3607] print_address_description+0x65/0x4b0
[ 49.073619][ T3607] print_report+0x108/0x220
[ 49.078103][ T3607] ? drm_gem_object_release_handle+0x3d/0xb0
[ 49.084093][ T3607] kasan_report+0xfb/0x130
[ 49.088498][ T3607] ? drm_gem_object_release_handle+0x3d/0xb0
[ 49.094464][ T3607] drm_gem_object_release_handle+0x3d/0xb0
[ 49.100256][ T3607] idr_for_each+0x1f8/0x2e0
[ 49.104752][ T3607] ? drm_gem_handle_delete+0x130/0x130
[ 49.110204][ T3607] ? idr_find+0x60/0x60
[ 49.114343][ T3607] ? _raw_spin_unlock+0x40/0x40
[ 49.119178][ T3607] drm_gem_release+0x21/0x30
[ 49.123748][ T3607] drm_file_free+0x6ac/0x920
[ 49.128331][ T3607] drm_release+0x33e/0x5c0
[ 49.132725][ T3607] ? drm_lastclose+0xa0/0xa0
[ 49.137306][ T3607] __fput+0x3b9/0x820
[ 49.141272][ T3607] task_work_run+0x146/0x1c0
[ 49.145844][ T3607] do_exit+0x55e/0x20a0
[ 49.149996][ T3607] ? ptrace_notify+0x245/0x340
[ 49.154738][ T3607] ? mm_update_next_owner+0x6d0/0x6d0
[ 49.160086][ T3607] ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[ 49.166050][ T3607] ? __ct_user_exit+0x81/0xe0
[ 49.170712][ T3607] do_group_exit+0x23b/0x2f0
[ 49.175280][ T3607] __x64_sys_exit_group+0x3b/0x40
[ 49.180282][ T3607] do_syscall_64+0x2b/0x70
[ 49.184678][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 49.190552][ T3607] RIP: 0033:0x7fdcf62cd9e9
[ 49.194945][ T3607] Code: Unable to access opcode bytes at RIP 0x7fdcf62cd9bf.
[ 49.202285][ T3607] RSP: 002b:00007ffc2785fc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 49.210677][ T3607] RAX: ffffffffffffffda RBX: 00007fdcf63413f0 RCX: 00007fdcf62cd9e9
[ 49.218626][ T3607] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 49.226574][ T3607] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 49.234535][ T3607] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fdcf63413f0
[ 49.242486][ T3607] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 49.250529][ T3607]
[ 49.253536][ T3607]
[ 49.255837][ T3607] Allocated by task 3607:
[ 49.260143][ T3607] ____kasan_kmalloc+0xdc/0x110
[ 49.264986][ T3607] kmem_cache_alloc_trace+0x97/0x310
[ 49.270251][ T3607] vgem_gem_create_object+0x46/0xa0
[ 49.275424][ T3607] __drm_gem_shmem_create+0x7c/0x310
[ 49.280685][ T3607] drm_gem_shmem_dumb_create+0x243/0x420
[ 49.286298][ T3607] drm_ioctl_kernel+0x33e/0x4f0
[ 49.291148][ T3607] drm_ioctl+0x626/0xa10
[ 49.295367][ T3607] __se_sys_ioctl+0xfb/0x170
[ 49.299953][ T3607] do_syscall_64+0x2b/0x70
[ 49.304346][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 49.310217][ T3607]
[ 49.312519][ T3607] Freed by task 3607:
[ 49.316475][ T3607] kasan_set_track+0x4c/0x70
[ 49.321042][ T3607] kasan_set_free_info+0x1f/0x40
[ 49.325959][ T3607] ____kasan_slab_free+0xd8/0x120
[ 49.330959][ T3607] slab_free_freelist_hook+0x12e/0x1a0
[ 49.336399][ T3607] kfree+0xda/0x210
[ 49.340186][ T3607] drm_gem_mmap+0x4c9/0x760
[ 49.344683][ T3607] mmap_region+0x10b2/0x16f0
[ 49.349251][ T3607] do_mmap+0x7a7/0xdf0
[ 49.353295][ T3607] vm_mmap_pgoff+0x1e5/0x2f0
[ 49.357880][ T3607] ksys_mmap_pgoff+0x48c/0x6d0
[ 49.362630][ T3607] do_syscall_64+0x2b/0x70
[ 49.367021][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 49.372896][ T3607]
[ 49.375196][ T3607] The buggy address belongs to the object at ffff888074438800
[ 49.375196][ T3607] which belongs to the cache kmalloc-1k of size 1024
[ 49.389223][ T3607] The buggy address is located 488 bytes inside of
[ 49.389223][ T3607] 1024-byte region [ffff888074438800, ffff888074438c00)
[ 49.402556][ T3607]
[ 49.404859][ T3607] The buggy address belongs to the physical page:
[ 49.411247][ T3607] page:ffffea0001d10e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x74438
[ 49.421370][ T3607] head:ffffea0001d10e00 order:3 compound_mapcount:0 compound_pincount:0
[ 49.429673][ T3607] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 49.437631][ T3607] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888012041dc0
[ 49.446191][ T3607] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 49.454749][ T3607] page dumped because: kasan: bad access detected
[ 49.461136][ T3607] page_owner tracks the page as allocated
[ 49.466826][ T3607] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3602, tgid 3602 (sshd), ts 48988351516, free_ts 48987162272
[ 49.487466][ T3607] get_page_from_freelist+0x72b/0x7a0
[ 49.492819][ T3607] __alloc_pages+0x259/0x560
[ 49.497387][ T3607] alloc_slab_page+0x70/0xf0
[ 49.501968][ T3607] allocate_slab+0x5e/0x520
[ 49.506578][ T3607] ___slab_alloc+0x42e/0xce0
[ 49.511156][ T3607] __kmalloc_node_track_caller+0x2bd/0x3f0
[ 49.516984][ T3607] __alloc_skb+0x11d/0x620
[ 49.521395][ T3607] tcp_stream_alloc_skb+0x3c/0x300
[ 49.526492][ T3607] tcp_sendmsg_locked+0xdcf/0x41b0
[ 49.531587][ T3607] tcp_sendmsg+0x2c/0x40
[ 49.535812][ T3607] sock_write_iter+0x3d4/0x540
[ 49.540557][ T3607] vfs_write+0x7b5/0xbb0
[ 49.544779][ T3607] ksys_write+0x19b/0x2c0
[ 49.549087][ T3607] do_syscall_64+0x2b/0x70
[ 49.553480][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 49.559355][ T3607] page last free stack trace:
[ 49.564003][ T3607] free_pcp_prepare+0x812/0x900
[ 49.568831][ T3607] free_unref_page+0x7d/0x630
[ 49.573488][ T3607] page_to_skb+0x661/0xb80
[ 49.577883][ T3607] receive_mergeable+0x34e/0x26e0
[ 49.582895][ T3607] receive_buf+0x15c/0x1c80
[ 49.587373][ T3607] virtnet_poll+0x64e/0x12a0
[ 49.591941][ T3607] __napi_poll+0xbe/0x4b0
[ 49.596269][ T3607] net_rx_action+0x76c/0x10b0
[ 49.600934][ T3607] __do_softirq+0x382/0x793
[ 49.605416][ T3607]
[ 49.607720][ T3607] Memory state around the buggy address:
[ 49.613331][ T3607] ffff888074438880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.621393][ T3607] ffff888074438900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.629438][ T3607] >ffff888074438980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.637485][ T3607] ^
[ 49.644929][ T3607] ffff888074438a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.652969][ T3607] ffff888074438a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.661006][ T3607] ==================================================================
[ 49.669551][ T3607] Kernel panic - not syncing: panic_on_warn set ...
[ 49.676137][ T3607] CPU: 1 PID: 3607 Comm: syz-executor140 Not tainted 6.0.0-rc6-syzkaller #0
[ 49.684796][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 49.694836][ T3607] Call Trace:
[ 49.698116][ T3607]
[ 49.701048][ T3607] dump_stack_lvl+0x1e3/0x2cb
[ 49.705729][ T3607] ? io_alloc_page_table+0x110/0x110
[ 49.710998][ T3607] ? panic+0x76b/0x76b
[ 49.715057][ T3607] ? preempt_schedule_common+0xb7/0xe0
[ 49.720503][ T3607] ? preempt_schedule+0xd9/0xe0
[ 49.725339][ T3607] ? vscnprintf+0x59/0x80
[ 49.729664][ T3607] panic+0x316/0x76b
[ 49.733562][ T3607] ? fb_is_primary_device+0xcc/0xcc
[ 49.738748][ T3607] ? _raw_spin_unlock_irqrestore+0x128/0x130
[ 49.744732][ T3607] ? print_report+0x1e0/0x220
[ 49.749396][ T3607] ? drm_gem_object_release_handle+0x3d/0xb0
[ 49.755363][ T3607] end_report+0x91/0xa0
[ 49.759504][ T3607] kasan_report+0x108/0x130
[ 49.763995][ T3607] ? drm_gem_object_release_handle+0x3d/0xb0
[ 49.769970][ T3607] drm_gem_object_release_handle+0x3d/0xb0
[ 49.775781][ T3607] idr_for_each+0x1f8/0x2e0
[ 49.780293][ T3607] ? drm_gem_handle_delete+0x130/0x130
[ 49.785757][ T3607] ? idr_find+0x60/0x60
[ 49.789906][ T3607] ? _raw_spin_unlock+0x40/0x40
[ 49.794751][ T3607] drm_gem_release+0x21/0x30
[ 49.799345][ T3607] drm_file_free+0x6ac/0x920
[ 49.803927][ T3607] drm_release+0x33e/0x5c0
[ 49.808349][ T3607] ? drm_lastclose+0xa0/0xa0
[ 49.812936][ T3607] __fput+0x3b9/0x820
[ 49.816916][ T3607] task_work_run+0x146/0x1c0
[ 49.821506][ T3607] do_exit+0x55e/0x20a0
[ 49.825686][ T3607] ? ptrace_notify+0x245/0x340
[ 49.830465][ T3607] ? mm_update_next_owner+0x6d0/0x6d0
[ 49.835850][ T3607] ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[ 49.841839][ T3607] ? __ct_user_exit+0x81/0xe0
[ 49.846524][ T3607] do_group_exit+0x23b/0x2f0
[ 49.851113][ T3607] __x64_sys_exit_group+0x3b/0x40
[ 49.856131][ T3607] do_syscall_64+0x2b/0x70
[ 49.860545][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 49.866442][ T3607] RIP: 0033:0x7fdcf62cd9e9
[ 49.870850][ T3607] Code: Unable to access opcode bytes at RIP 0x7fdcf62cd9bf.
[ 49.878206][ T3607] RSP: 002b:00007ffc2785fc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 49.886615][ T3607] RAX: ffffffffffffffda RBX: 00007fdcf63413f0 RCX: 00007fdcf62cd9e9
[ 49.894584][ T3607] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 49.902538][ T3607] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 49.910510][ T3607] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fdcf63413f0
[ 49.918473][ T3607] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 49.926441][ T3607]
[ 49.929509][ T3607] Kernel Offset: disabled
[ 49.933836][ T3607] Rebooting in 86400 seconds..