./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3628022062
<...>
Warning: Permanently added '10.128.0.54' (ECDSA) to the list of known hosts.
execve("./syz-executor3628022062", ["./syz-executor3628022062"], 0x7ffe29b80470 /* 10 vars */) = 0
brk(NULL) = 0x555557317000
brk(0x555557317c40) = 0x555557317c40
arch_prctl(ARCH_SET_FS, 0x555557317300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3628022062", 4096) = 28
brk(0x555557338c40) = 0x555557338c40
brk(0x555557339000) = 0x555557339000
mprotect(0x7f40dece5000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000080) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "4", 1) = 1
mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0) = ?
syzkaller login: [ 41.443640][ T3610] ==================================================================
[ 41.443648][ T3610] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0x3b/0xf0
[ 41.443677][ T3610] Read of size 8 at addr ffff888140a039e8 by task syz-executor362/3610
[ 41.443685][ T3610]
[ 41.443688][ T3610] CPU: 1 PID: 3610 Comm: syz-executor362 Not tainted 5.19.0-rc1-syzkaller-00238-gaa3398fb4b3f #0
[ 41.443699][ T3610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 41.443704][ T3610] Call Trace:
[ 41.443708][ T3610]
[ 41.443711][ T3610] dump_stack_lvl+0x1e3/0x2cb
[ 41.443733][ T3610] ? bfq_pos_tree_add_move+0x436/0x436
[ 41.443745][ T3610] ? __wake_up_klogd+0xcd/0x100
[ 41.443755][ T3610] ? panic+0x76e/0x76e
[ 41.443764][ T3610] ? _printk+0xcf/0x10f
[ 41.443773][ T3610] print_address_description+0x65/0x4b0
[ 41.443785][ T3610] print_report+0xf4/0x210
[ 41.443795][ T3610] ? trace_lock_release+0x7a/0x190
[ 41.443805][ T3610] ? drm_gem_object_release_handle+0x3b/0xf0
[ 41.443815][ T3610] kasan_report+0xfb/0x130
[ 41.443824][ T3610] ? drm_gem_object_release_handle+0x3b/0xf0
[ 41.443835][ T3610] drm_gem_object_release_handle+0x3b/0xf0
[ 41.443846][ T3610] idr_for_each+0x1f8/0x2e0
[ 41.443856][ T3610] ? drm_gem_handle_delete+0x180/0x180
[ 41.443866][ T3610] ? idr_find+0x60/0x60
[ 41.443875][ T3610] ? _raw_spin_unlock+0x40/0x40
[ 41.443888][ T3610] drm_gem_release+0x21/0x30
[ 41.443896][ T3610] drm_file_free+0x6ac/0x920
[ 41.443913][ T3610] drm_release+0x33e/0x5c0
[ 41.443931][ T3610] ? drm_lastclose+0xa0/0xa0
[ 41.443945][ T3610] __fput+0x3b9/0x820
[ 41.443963][ T3610] task_work_run+0x146/0x1c0
[ 41.443982][ T3610] do_exit+0x547/0x1ed0
[ 41.443991][ T3610] ? _raw_spin_unlock_irq+0x2a/0x40
[ 41.444001][ T3610] ? mm_update_next_owner+0x6d0/0x6d0
[ 41.444009][ T3610] ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[ 41.444019][ T3610] ? print_irqtrace_events+0x220/0x220
[ 41.444028][ T3610] ? vtime_user_exit+0x2b2/0x3e0
[ 41.444038][ T3610] ? vtime_user_enter+0x1ea/0x2d0
[ 41.444048][ T3610] do_group_exit+0x23b/0x2f0
[ 41.444057][ T3610] __x64_sys_exit_group+0x3b/0x40
[ 41.444065][ T3610] do_syscall_64+0x2b/0x70
[ 41.444074][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 41.444083][ T3610] RIP: 0033:0x7f40dec779e9
[ 41.444091][ T3610] Code: Unable to access opcode bytes at RIP 0x7f40dec779bf.
[ 41.444096][ T3610] RSP: 002b:00007ffc868d01d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 41.444107][ T3610] RAX: ffffffffffffffda RBX: 00007f40deceb3f0 RCX: 00007f40dec779e9
[ 41.444114][ T3610] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 41.444119][ T3610] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 41.444125][ T3610] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f40deceb3f0
[ 41.444131][ T3610] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 41.444140][ T3610]
[ 41.444142][ T3610]
[ 41.444144][ T3610] Allocated by task 3610:
[ 41.444148][ T3610] ____kasan_kmalloc+0xdc/0x110
[ 41.444157][ T3610] kmem_cache_alloc_trace+0x94/0x310
[ 41.444165][ T3610] vgem_gem_create_object+0x46/0xa0
[ 41.444173][ T3610] __drm_gem_shmem_create+0x7c/0x310
[ 41.444181][ T3610] drm_gem_shmem_dumb_create+0x243/0x420
[ 41.444188][ T3610] drm_ioctl_kernel+0x33e/0x4f0
[ 41.444195][ T3610] drm_ioctl+0x626/0xa10
[ 41.444202][ T3610] __se_sys_ioctl+0xfb/0x170
[ 41.444211][ T3610] do_syscall_64+0x2b/0x70
[ 41.444219][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 41.444226][ T3610]
[ 41.444228][ T3610] Freed by task 3610:
[ 41.444231][ T3610] kasan_set_track+0x4c/0x70
[ 41.444239][ T3610] kasan_set_free_info+0x1f/0x40
[ 41.444248][ T3610] ____kasan_slab_free+0xd8/0x110
[ 41.444255][ T3610] slab_free_freelist_hook+0x12e/0x1a0
[ 41.444263][ T3610] kfree+0xc6/0x210
[ 41.444270][ T3610] drm_gem_mmap+0x4c9/0x760
[ 41.444276][ T3610] mmap_region+0x10da/0x16e0
[ 41.444284][ T3610] do_mmap+0x7a7/0xdf0
[ 41.444291][ T3610] vm_mmap_pgoff+0x1e5/0x2f0
[ 41.444300][ T3610] ksys_mmap_pgoff+0x48c/0x6d0
[ 41.444307][ T3610] do_syscall_64+0x2b/0x70
[ 41.444315][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 41.444323][ T3610]
[ 41.444325][ T3610] The buggy address belongs to the object at ffff888140a03800
[ 41.444325][ T3610] which belongs to the cache kmalloc-1k of size 1024
[ 41.444331][ T3610] The buggy address is located 488 bytes inside of
[ 41.444331][ T3610] 1024-byte region [ffff888140a03800, ffff888140a03c00)
[ 41.444340][ T3610]
[ 41.444341][ T3610] The buggy address belongs to the physical page:
[ 41.444346][ T3610] page:ffffea0005028000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x140a00
[ 41.444355][ T3610] head:ffffea0005028000 order:3 compound_mapcount:0 compound_pincount:0
[ 41.444362][ T3610] flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff)
[ 41.444376][ T3610] raw: 057ff00000010200 ffffea00051af000 dead000000000002 ffff888011c41dc0
[ 41.444383][ T3610] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 41.444387][ T3610] page dumped because: kasan: bad access detected
[ 41.444391][ T3610] page_owner tracks the page as allocated
[ 41.444393][ T3610] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2891900317, free_ts 0
[ 41.444414][ T3610] get_page_from_freelist+0x72b/0x7a0
[ 41.444423][ T3610] __alloc_pages+0x259/0x560
[ 41.444431][ T3610] alloc_page_interleave+0x22/0x1c0
[ 41.444439][ T3610] alloc_slab_page+0x70/0xf0
[ 41.444447][ T3610] allocate_slab+0x5e/0x520
[ 41.444454][ T3610] ___slab_alloc+0x41e/0xcd0
[ 41.444461][ T3610] kmem_cache_alloc_trace+0x25c/0x310
[ 41.444468][ T3610] __class_register+0x58/0x350
[ 41.444475][ T3610] init_scsi+0x34/0xda
[ 41.444484][ T3610] do_one_initcall+0xbd/0x2b0
[ 41.444493][ T3610] do_initcall_level+0x168/0x218
[ 41.444502][ T3610] do_initcalls+0x4b/0x8c
[ 41.444510][ T3610] kernel_init_freeable+0x43a/0x5c3
[ 41.444518][ T3610] kernel_init+0x19/0x2b0
[ 41.444526][ T3610] ret_from_fork+0x1f/0x30
[ 41.444533][ T3610] page_owner free stack trace missing
[ 41.444536][ T3610]
[ 41.444537][ T3610] Memory state around the buggy address:
[ 41.444541][ T3610] ffff888140a03880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.444546][ T3610] ffff888140a03900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.444551][ T3610] >ffff888140a03980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.444554][ T3610] ^
[ 41.444559][ T3610] ffff888140a03a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.444564][ T3610] ffff888140a03a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.444567][ T3610] ==================================================================
[ 41.444571][ T3610] Kernel panic - not syncing: panic_on_warn set ...
[ 42.100784][ T3610] CPU: 1 PID: 3610 Comm: syz-executor362 Not tainted 5.19.0-rc1-syzkaller-00238-gaa3398fb4b3f #0
[ 42.111271][ T3610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 42.121307][ T3610] Call Trace:
[ 42.124571][ T3610]
[ 42.127496][ T3610] dump_stack_lvl+0x1e3/0x2cb
[ 42.132160][ T3610] ? bfq_pos_tree_add_move+0x436/0x436
[ 42.137601][ T3610] ? panic+0x76e/0x76e
[ 42.141648][ T3610] ? vscnprintf+0x59/0x80
[ 42.145983][ T3610] panic+0x312/0x76e
[ 42.149875][ T3610] ? fb_is_primary_device+0xcc/0xcc
[ 42.155055][ T3610] ? _raw_spin_unlock_irqrestore+0xd9/0x130
[ 42.160935][ T3610] ? print_report+0x1d0/0x210
[ 42.165593][ T3610] ? drm_gem_object_release_handle+0x3b/0xf0
[ 42.171552][ T3610] end_report+0x91/0xa0
[ 42.175690][ T3610] kasan_report+0x108/0x130
[ 42.180178][ T3610] ? drm_gem_object_release_handle+0x3b/0xf0
[ 42.186139][ T3610] drm_gem_object_release_handle+0x3b/0xf0
[ 42.191938][ T3610] idr_for_each+0x1f8/0x2e0
[ 42.196423][ T3610] ? drm_gem_handle_delete+0x180/0x180
[ 42.201860][ T3610] ? idr_find+0x60/0x60
[ 42.206082][ T3610] ? _raw_spin_unlock+0x40/0x40
[ 42.210927][ T3610] drm_gem_release+0x21/0x30
[ 42.215496][ T3610] drm_file_free+0x6ac/0x920
[ 42.220071][ T3610] drm_release+0x33e/0x5c0
[ 42.224468][ T3610] ? drm_lastclose+0xa0/0xa0
[ 42.229034][ T3610] __fput+0x3b9/0x820
[ 42.233005][ T3610] task_work_run+0x146/0x1c0
[ 42.237581][ T3610] do_exit+0x547/0x1ed0
[ 42.241714][ T3610] ? _raw_spin_unlock_irq+0x2a/0x40
[ 42.246895][ T3610] ? mm_update_next_owner+0x6d0/0x6d0
[ 42.252254][ T3610] ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[ 42.258225][ T3610] ? print_irqtrace_events+0x220/0x220
[ 42.263660][ T3610] ? vtime_user_exit+0x2b2/0x3e0
[ 42.268576][ T3610] ? vtime_user_enter+0x1ea/0x2d0
[ 42.273582][ T3610] do_group_exit+0x23b/0x2f0
[ 42.278165][ T3610] __x64_sys_exit_group+0x3b/0x40
[ 42.283168][ T3610] do_syscall_64+0x2b/0x70
[ 42.287566][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 42.293438][ T3610] RIP: 0033:0x7f40dec779e9
[ 42.297832][ T3610] Code: Unable to access opcode bytes at RIP 0x7f40dec779bf.
[ 42.305174][ T3610] RSP: 002b:00007ffc868d01d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 42.313567][ T3610] RAX: ffffffffffffffda RBX: 00007f40deceb3f0 RCX: 00007f40dec779e9
[ 42.321518][ T3610] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 42.329469][ T3610] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 42.337418][ T3610] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f40deceb3f0
[ 42.345366][ T3610] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 42.353327][ T3610]
[ 42.356497][ T3610] Kernel Offset: disabled
[ 42.360812][ T3610] Rebooting in 86400 seconds..