./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2850729319
<...>
forked to background, child pid 3183
no interfaces have a carrier
[ 22.975646][ T3184] 8021q: adding VLAN 0 to HW filter on device bond0
[ 22.985109][ T3184] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.110' (ECDSA) to the list of known hosts.
execve("./syz-executor2850729319", ["./syz-executor2850729319"], 0x7ffeed9c5160 /* 10 vars */) = 0
brk(NULL) = 0x555555ff2000
brk(0x555555ff2c40) = 0x555555ff2c40
arch_prctl(ARCH_SET_FS, 0x555555ff2300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2850729319", 4096) = 28
brk(0x555556013c40) = 0x555556013c40
brk(0x555556014000) = 0x555556014000
mprotect(0x7fc9c9730000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000040) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "5", 1) = 1
mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0) = ?
syzkaller login: [ 39.514339][ T3611] ==================================================================
[ 39.522509][ T3611] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xa1/0xb0
[ 39.530842][ T3611] Read of size 8 at addr ffff88802007d9e8 by task syz-executor285/3611
[ 39.539057][ T3611]
[ 39.541360][ T3611] CPU: 0 PID: 3611 Comm: syz-executor285 Not tainted 6.0.0-rc3-syzkaller-00299-gd895ec7938c4 #0
[ 39.551746][ T3611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 39.561781][ T3611] Call Trace:
[ 39.565041][ T3611]
[ 39.567950][ T3611] dump_stack_lvl+0xcd/0x134
[ 39.572524][ T3611] print_report.cold+0x2ba/0x719
[ 39.577448][ T3611] ? drm_gem_object_release_handle+0xa1/0xb0
[ 39.583414][ T3611] kasan_report+0xb1/0x1e0
[ 39.587813][ T3611] ? drm_gem_object_release_handle+0xa1/0xb0
[ 39.593772][ T3611] drm_gem_object_release_handle+0xa1/0xb0
[ 39.599558][ T3611] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 39.606125][ T3611] idr_for_each+0x113/0x220
[ 39.610612][ T3611] ? idr_find+0x50/0x50
[ 39.614750][ T3611] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 39.620533][ T3611] drm_gem_release+0x22/0x30
[ 39.625105][ T3611] drm_file_free.part.0+0x805/0xb80
[ 39.630297][ T3611] ? fsnotify+0x1680/0x1680
[ 39.634795][ T3611] drm_close_helper.isra.0+0x17d/0x1f0
[ 39.640242][ T3611] drm_release+0x1e6/0x530
[ 39.644650][ T3611] __fput+0x277/0x9d0
[ 39.648623][ T3611] ? drm_release_noglobal+0x180/0x180
[ 39.653986][ T3611] task_work_run+0xdd/0x1a0
[ 39.658483][ T3611] do_exit+0xad5/0x29b0
[ 39.662628][ T3611] ? mm_update_next_owner+0x7a0/0x7a0
[ 39.667988][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40
[ 39.673176][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40
[ 39.678365][ T3611] do_group_exit+0xd2/0x2f0
[ 39.682864][ T3611] __x64_sys_exit_group+0x3a/0x50
[ 39.687880][ T3611] do_syscall_64+0x35/0xb0
[ 39.692288][ T3611] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 39.698171][ T3611] RIP: 0033:0x7fc9c96c29e9
[ 39.702572][ T3611] Code: Unable to access opcode bytes at RIP 0x7fc9c96c29bf.
[ 39.709921][ T3611] RSP: 002b:00007ffea0e85978 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 39.718323][ T3611] RAX: ffffffffffffffda RBX: 00007fc9c97363f0 RCX: 00007fc9c96c29e9
[ 39.726282][ T3611] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 39.734242][ T3611] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 39.742201][ T3611] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fc9c97363f0
[ 39.750160][ T3611] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 39.758124][ T3611]
[ 39.761128][ T3611]
[ 39.763443][ T3611] Allocated by task 3611:
[ 39.767754][ T3611] kasan_save_stack+0x1e/0x40
[ 39.772427][ T3611] __kasan_kmalloc+0xa9/0xd0
[ 39.777007][ T3611] vgem_gem_create_object+0x38/0xb0
[ 39.782197][ T3611] __drm_gem_shmem_create+0x80/0x480
[ 39.787475][ T3611] drm_gem_shmem_dumb_create+0x13c/0x380
[ 39.793095][ T3611] drm_mode_create_dumb+0x26c/0x2f0
[ 39.798292][ T3611] drm_ioctl_kernel+0x27d/0x4e0
[ 39.803137][ T3611] drm_ioctl+0x51e/0x9d0
[ 39.807365][ T3611] __x64_sys_ioctl+0x193/0x200
[ 39.812124][ T3611] do_syscall_64+0x35/0xb0
[ 39.816529][ T3611] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 39.822431][ T3611]
[ 39.824742][ T3611] Freed by task 3611:
[ 39.828707][ T3611] kasan_save_stack+0x1e/0x40
[ 39.833379][ T3611] kasan_set_track+0x21/0x30
[ 39.837956][ T3611] kasan_set_free_info+0x20/0x30
[ 39.842916][ T3611] ____kasan_slab_free+0x166/0x1c0
[ 39.848016][ T3611] slab_free_freelist_hook+0x8b/0x1c0
[ 39.853379][ T3611] kfree+0xe2/0x580
[ 39.857179][ T3611] drm_gem_mmap+0x4fc/0x770
[ 39.861758][ T3611] mmap_region+0xbff/0x1460
[ 39.866255][ T3611] do_mmap+0x863/0xfa0
[ 39.870314][ T3611] vm_mmap_pgoff+0x1ab/0x270
[ 39.874899][ T3611] ksys_mmap_pgoff+0x41b/0x5a0
[ 39.879655][ T3611] do_syscall_64+0x35/0xb0
[ 39.884061][ T3611] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 39.889943][ T3611]
[ 39.892251][ T3611] The buggy address belongs to the object at ffff88802007d800
[ 39.892251][ T3611] which belongs to the cache kmalloc-1k of size 1024
[ 39.906291][ T3611] The buggy address is located 488 bytes inside of
[ 39.906291][ T3611] 1024-byte region [ffff88802007d800, ffff88802007dc00)
[ 39.919648][ T3611]
[ 39.921959][ T3611] The buggy address belongs to the physical page:
[ 39.928359][ T3611] page:ffffea0000801e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20078
[ 39.938506][ T3611] head:ffffea0000801e00 order:3 compound_mapcount:0 compound_pincount:0
[ 39.946818][ T3611] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 39.954792][ T3611] raw: 00fff00000010200 ffffea000073c200 dead000000000002 ffff888011841dc0
[ 39.963365][ T3611] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 39.971932][ T3611] page dumped because: kasan: bad access detected
[ 39.978330][ T3611] page_owner tracks the page as allocated
[ 39.984026][ T3611] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1018, tgid 1018 (kworker/u4:5), ts 6593590844, free_ts 0
[ 40.004432][ T3611] get_page_from_freelist+0x109b/0x2ce0
[ 40.009980][ T3611] __alloc_pages+0x1c7/0x510
[ 40.014561][ T3611] alloc_pages+0x1a6/0x270
[ 40.018967][ T3611] allocate_slab+0x27e/0x3d0
[ 40.023548][ T3611] ___slab_alloc+0x7f1/0xe10
[ 40.028124][ T3611] __slab_alloc.constprop.0+0x4d/0xa0
[ 40.033642][ T3611] kmem_cache_alloc_node_trace+0x185/0x410
[ 40.039446][ T3611] blk_throtl_init+0x85/0x660
[ 40.044114][ T3611] blkcg_init_queue+0x15f/0x620
[ 40.048949][ T3611] __alloc_disk_node+0x29d/0x650
[ 40.053875][ T3611] blk_mq_alloc_disk_for_queue+0x40/0x60
[ 40.059497][ T3611] sd_probe+0x1b1/0xfe0
[ 40.063643][ T3611] really_probe+0x249/0xb90
[ 40.068135][ T3611] __driver_probe_device+0x1df/0x4d0
[ 40.073412][ T3611] driver_probe_device+0x4c/0x1a0
[ 40.078422][ T3611] __device_attach_driver+0x1d0/0x2e0
[ 40.083782][ T3611] page_owner free stack trace missing
[ 40.089127][ T3611]
[ 40.091434][ T3611] Memory state around the buggy address:
[ 40.097046][ T3611] ffff88802007d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.105090][ T3611] ffff88802007d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.113133][ T3611] >ffff88802007d980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.121175][ T3611] ^
[ 40.128611][ T3611] ffff88802007da00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.136659][ T3611] ffff88802007da80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.144702][ T3611] ==================================================================
[ 40.157889][ T3611] Kernel panic - not syncing: panic_on_warn set ...
[ 40.164470][ T3611] CPU: 0 PID: 3611 Comm: syz-executor285 Not tainted 6.0.0-rc3-syzkaller-00299-gd895ec7938c4 #0
[ 40.174855][ T3611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 40.184885][ T3611] Call Trace:
[ 40.188139][ T3611]
[ 40.191047][ T3611] dump_stack_lvl+0xcd/0x134
[ 40.195623][ T3611] panic+0x2c8/0x627
[ 40.199497][ T3611] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 40.205460][ T3611] ? preempt_schedule_common+0x59/0xc0
[ 40.210905][ T3611] ? preempt_schedule_thunk+0x16/0x18
[ 40.216263][ T3611] ? drm_gem_object_release_handle+0xa1/0xb0
[ 40.222222][ T3611] end_report.part.0+0x3f/0x7c
[ 40.226966][ T3611] kasan_report.cold+0xa/0xf
[ 40.231534][ T3611] ? drm_gem_object_release_handle+0xa1/0xb0
[ 40.237496][ T3611] drm_gem_object_release_handle+0xa1/0xb0
[ 40.243291][ T3611] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 40.249860][ T3611] idr_for_each+0x113/0x220
[ 40.254342][ T3611] ? idr_find+0x50/0x50
[ 40.258478][ T3611] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 40.264267][ T3611] drm_gem_release+0x22/0x30
[ 40.268847][ T3611] drm_file_free.part.0+0x805/0xb80
[ 40.274033][ T3611] ? fsnotify+0x1680/0x1680
[ 40.278529][ T3611] drm_close_helper.isra.0+0x17d/0x1f0
[ 40.284151][ T3611] drm_release+0x1e6/0x530
[ 40.288555][ T3611] __fput+0x277/0x9d0
[ 40.292526][ T3611] ? drm_release_noglobal+0x180/0x180
[ 40.297886][ T3611] task_work_run+0xdd/0x1a0
[ 40.302376][ T3611] do_exit+0xad5/0x29b0
[ 40.306525][ T3611] ? mm_update_next_owner+0x7a0/0x7a0
[ 40.311883][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40
[ 40.317068][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40
[ 40.322252][ T3611] do_group_exit+0xd2/0x2f0
[ 40.326743][ T3611] __x64_sys_exit_group+0x3a/0x50
[ 40.331755][ T3611] do_syscall_64+0x35/0xb0
[ 40.336161][ T3611] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 40.342040][ T3611] RIP: 0033:0x7fc9c96c29e9
[ 40.346439][ T3611] Code: Unable to access opcode bytes at RIP 0x7fc9c96c29bf.
[ 40.353786][ T3611] RSP: 002b:00007ffea0e85978 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 40.362184][ T3611] RAX: ffffffffffffffda RBX: 00007fc9c97363f0 RCX: 00007fc9c96c29e9
[ 40.370143][ T3611] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 40.378100][ T3611] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 40.386057][ T3611] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fc9c97363f0
[ 40.394015][ T3611] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 40.401979][ T3611]
[ 40.405059][ T3611] Kernel Offset: disabled
[ 40.409456][ T3611] Rebooting in 86400 seconds..