program: syz_mount_image$minix(&(0x7f0000000300), &(0x7f0000000180)='./file2\x00', 0x4000, &(0x7f0000000340)=ANY=[], 0x1, 0x1ff, &(0x7f00000005c0)="$eJzs3M1O1FAYxvGn0xZGNOJH/IgrExPjRkaBhMxKuQBvwMQFwUImFjXiBmKi3IR7t668BBO9D28AFu5ccUzbQ2Y6MzCnpaXK/H8J05eZ87TnQM5h2oYRgKn1NH305KmdVsaYj3clPX8mKWi4cwBqZez20ACYPn7pqf/iaA0B8F86WPUltfXdk379/rC+b7/aju8fDlZbWeFJ+wP5C675PS/d3gny+TlJF0daj56QmC9Z/r7y+UsFjz83lNcV13w2/gf3FGogf1nSvJTu5qqka5KuS7NJ2xuSWrnjz9jv+vnb2RN7jsMAAAAAAOBEydnnwmnzE3fgS3o09pXkPHijF0fjX50stPnHJfMzNr94yvzS4JOt41p7/TLMNrM2v7D+Jn5Zsg9AWa1i83/ksqDL/D92OtiVIT//Q/fe2CuCG73PhTIAMts7u6/W4jh6V2Xx5KQ2UtEdJitCxT0cX3xNCv3J7ozUfKwyRbLYlo0f3ZCpumOfNLmNcWhznoqg2p/zD3nD8zTITaJv9ndb6SiGFgr/jBcmALXrvN9629ne2X3Y21rbjDaj18sr3e7K8tJit5O+LU8ezXzTvQRQh/4f/aZ7AgAAAAAAAAAAAAAAyrop6VZa/TwsEHP9eA8AAAAA/5Cz+KeopscIAAAAAAAAAAAAAMB59zcAAP//jf04bg==") truncate(&(0x7f0000000040)='./file2\x00', 0x80000) rename(&(0x7f0000000000)='./file2\x00', &(0x7f0000000040)='./file1\x00') r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000300), 0x3, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000580)={0x600, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r4, r3, r4], &(0x7f00000003c0), 0x0, 0x2}) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r5, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, &(0x7f0000000180)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000380)={0x1b, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, 0x80000000, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x2}, 0x50) preadv2(r8, &(0x7f0000000900)=[{&(0x7f0000000400)=""/34, 0x22}, {&(0x7f0000000440)=""/174, 0xae}, {&(0x7f0000000500)=""/124, 0x7c}, {&(0x7f00000005c0)=""/41, 0x29}, {&(0x7f0000000600)=""/37, 0x25}, {&(0x7f0000000680)=""/164, 0xa4}, {&(0x7f0000000740)=""/136, 0x88}, {&(0x7f0000000800)=""/243, 0xf3}], 0x8, 0x3, 0x3, 0x2) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000980)=@newqdisc={0x268, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0x4, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x23c, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x1000, 0x10, 0x80, 0x8, 0x8, 0x8, 0x2}}, @TCA_RED_STAB={0x104}, @TCA_RED_STAB={0x104, 0x2, "b817b482c104756a1b43388a6d4088be484625004f2af470e960a48db6692ddcecedda225dec2205fd73e0f15699dec07d34746611449ae732db32c60df2e539bd567a2114456da484bba755f483df4350da9f93ea0b5ec867d090b931c2bd889354d2de9056c2cf7bf6bec3201aa7621be1d9a8072a50982509be227c58f5e1e9a9fa9579316831096f4cc366209100d3b3d05baf310aa0bf4913c3eca33a13019c3329a3aebfcd80aabed4edcfb8440ed28d4283fcca6f55c33d8b897e7c838dacab040526df2d0839776d5dec4f886b9e5f1666ce4f07b8e56bfc5a939653613711c854a44a8b91825ab28adeb7e55c8d8fd1a39223350a6bef34c1923f46"}, @TCA_RED_FLAGS={0xc, 0x4, {0x1, 0x1}}, @TCA_RED_EARLY_DROP_BLOCK={0x8, 0x5, 0x1}, @TCA_RED_MARK_BLOCK={0x8, 0x6, 0x2}]}}]}, 0x268}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={&(0x7f0000000000), 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@getqdisc={0x24, 0x26, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}}, 0x24}}, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r5, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0], &(0x7f0000000300), 0x1, r7}) [ 94.704493][ T4645] Bluetooth: hci0: command tx timeout [ 94.792066][ T5315] loop0: detected capacity change from 0 to 64 [ 94.881166][ T5315] Trying to free block not in datazone [ 94.970102][ T5316] Trying to free block not in datazone [ 94.970266][ T5316] minix_free_inode: bit 5 already cleared [ 95.032000][ T1059] ================================================================== [ 95.032031][ T1059] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.032127][ T1059] Read of size 1 at addr ffff88800becf009 by task kworker/u4:12/1059 [ 95.032133][ T1059] [ 95.032139][ T1059] CPU: 0 UID: 0 PID: 1059 Comm: kworker/u4:12 Not tainted syzkaller #0 PREEMPT(full) [ 95.032148][ T1059] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.032153][ T1059] Workqueue: events_unbound commit_work [ 95.032164][ T1059] Call Trace: [ 95.032169][ T1059] [ 95.032174][ T1059] dump_stack_lvl+0xe8/0x150 [ 95.032191][ T1059] print_address_description+0x55/0x1e0 [ 95.032207][ T1059] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.032223][ T1059] print_report+0x58/0x70 [ 95.032236][ T1059] kasan_report+0x117/0x150 [ 95.032249][ T1059] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.032262][ T1059] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.032274][ T1059] ? preempt_schedule_thunk+0x16/0x40 [ 95.032283][ T1059] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 95.032295][ T1059] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 95.032342][ T1059] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 95.032361][ T1059] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 95.032380][ T1059] commit_tail+0x2b1/0x3c0 [ 95.032391][ T1059] ? process_scheduled_works+0x97a/0x1630 [ 95.032402][ T1059] process_scheduled_works+0xc3d/0x1630 [ 95.032422][ T1059] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.032437][ T1059] ? assign_work+0x3cf/0x5d0 [ 95.032452][ T1059] worker_thread+0xa47/0xfb0 [ 95.032469][ T1059] ? __kthread_parkme+0x71/0x1f0 [ 95.032487][ T1059] kthread+0x38b/0x480 [ 95.032496][ T1059] ? __pfx_worker_thread+0x10/0x10 [ 95.032506][ T1059] ? __pfx_kthread+0x10/0x10 [ 95.032516][ T1059] ret_from_fork+0x514/0xb70 [ 95.032526][ T1059] ? __pfx_ret_from_fork+0x10/0x10 [ 95.032537][ T1059] ? __switch_to+0xc89/0x1420 [ 95.032552][ T1059] ? __pfx_kthread+0x10/0x10 [ 95.032563][ T1059] ret_from_fork_asm+0x1a/0x30 [ 95.032584][ T1059] [ 95.032588][ T1059] [ 95.032590][ T1059] Allocated by task 5315: [ 95.032595][ T1059] kasan_save_track+0x3e/0x80 [ 95.032612][ T1059] __kasan_kmalloc+0x93/0xb0 [ 95.032626][ T1059] __kmalloc_cache_noprof+0x321/0x600 [ 95.032642][ T1059] drm_atomic_helper_crtc_duplicate_state+0x72/0xb0 [ 95.032654][ T1059] drm_atomic_get_crtc_state+0x1b3/0x570 [ 95.032686][ T1059] drm_atomic_set_property+0x17b/0x4040 [ 95.032699][ T1059] drm_mode_atomic_ioctl+0x817/0x2550 [ 95.032711][ T1059] drm_ioctl_kernel+0x2df/0x3b0 [ 95.032723][ T1059] drm_ioctl+0x70e/0xba0 [ 95.032731][ T1059] __se_sys_ioctl+0xfc/0x170 [ 95.032746][ T1059] do_syscall_64+0x166/0x520 [ 95.032760][ T1059] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.032770][ T1059] [ 95.032773][ T1059] Freed by task 5314: [ 95.032778][ T1059] kasan_save_track+0x3e/0x80 [ 95.032791][ T1059] kasan_save_free_info+0x40/0x50 [ 95.032803][ T1059] __kasan_slab_free+0x5c/0x80 [ 95.032817][ T1059] kfree+0x1c5/0x650 [ 95.032828][ T1059] drm_atomic_commit_default_clear+0x47f/0xf00 [ 95.032839][ T1059] __drm_atomic_commit_free+0xb4/0x230 [ 95.032848][ T1059] drm_client_modeset_commit_atomic+0x6ec/0x7e0 [ 95.032860][ T1059] drm_client_modeset_commit_locked+0xcb/0x4d0 [ 95.032872][ T1059] drm_client_modeset_commit+0x4a/0x70 [ 95.032883][ T1059] __drm_fb_helper_restore_fbdev_mode_unlocked+0x9c/0x1c0 [ 95.032900][ T1059] drm_fbdev_client_restore+0x1b/0x30 [ 95.032914][ T1059] drm_client_dev_restore+0x14c/0x290 [ 95.032925][ T1059] drm_release+0x32d/0x400 [ 95.032934][ T1059] __fput+0x418/0xa50 [ 95.032944][ T1059] task_work_run+0x1d9/0x270 [ 95.032954][ T1059] exit_to_user_mode_loop+0x204/0x770 [ 95.032965][ T1059] do_syscall_64+0x328/0x520 [ 95.032978][ T1059] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.032987][ T1059] [ 95.032991][ T1059] The buggy address belongs to the object at ffff88800becf000 [ 95.032991][ T1059] which belongs to the cache kmalloc-512 of size 512 [ 95.033000][ T1059] The buggy address is located 9 bytes inside of [ 95.033000][ T1059] freed 512-byte region [ffff88800becf000, ffff88800becf200) [ 95.033011][ T1059] [ 95.033014][ T1059] The buggy address belongs to the physical page: [ 95.033019][ T1059] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbece [ 95.033030][ T1059] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.033038][ T1059] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 95.033048][ T1059] page_type: f5(slab) [ 95.033058][ T1059] raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122 [ 95.033067][ T1059] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 95.033077][ T1059] head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122 [ 95.033095][ T1059] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 95.033104][ T1059] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 95.033113][ T1059] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 95.033118][ T1059] page dumped because: kasan: bad access detected [ 95.033123][ T1059] page_owner tracks the page as allocated [ 95.033127][ T1059] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5278, tgid 5278 (syz-executor), ts 92771702729 [ 95.033146][ T1059] post_alloc_hook+0x1f9/0x250 [ 95.033159][ T1059] get_page_from_freelist+0x2209/0x2280 [ 95.033174][ T1059] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 95.033188][ T1059] allocate_slab+0x7d/0x620 [ 95.033198][ T1059] refill_objects+0x2d5/0x350 [ 95.033209][ T1059] __pcs_replace_empty_main+0x2c8/0x6c0 [ 95.033218][ T1059] __kmalloc_flags_noprof+0x5c6/0x7a0 [ 95.033232][ T1059] alloc_slab_obj_exts+0x5c/0x180 [ 95.033243][ T1059] __memcg_slab_post_alloc_hook+0x64e/0xf80 [ 95.033257][ T1059] __kmalloc_noprof+0x3d4/0x720 [ 95.033269][ T1059] security_prepare_creds+0x52/0x360 [ 95.033284][ T1059] prepare_creds+0x57d/0x820 [ 95.033294][ T1059] copy_creds+0x109/0x9f0 [ 95.033304][ T1059] copy_process+0xd1f/0x43e0 [ 95.033317][ T1059] kernel_clone+0x2d7/0x940 [ 95.033330][ T1059] __x64_sys_clone+0x1b6/0x230 [ 95.033343][ T1059] page last free pid 4987 tgid 4987 ts 61644751019 stack trace: [ 95.033351][ T1059] free_unref_folios+0xdc2/0x14e0 [ 95.033363][ T1059] folios_put_refs+0x9e9/0xb30 [ 95.033376][ T1059] free_pages_and_swap_cache+0x2ba/0x490 [ 95.033388][ T1059] tlb_flush_mmu+0x6d3/0xa30 [ 95.033401][ T1059] tlb_finish_mmu+0xf4/0x220 [ 95.033414][ T1059] exit_mmap+0x4b2/0x9f0 [ 95.033425][ T1059] __mmput+0x118/0x420 [ 95.033437][ T1059] exit_mm+0x221/0x2d0 [ 95.033446][ T1059] do_exit+0x6cd/0x2360 [ 95.033455][ T1059] do_group_exit+0x22d/0x2f0 [ 95.033464][ T1059] __x64_sys_exit_group+0x3f/0x40 [ 95.033473][ T1059] x64_sys_call+0x18c6/0x18d0 [ 95.033482][ T1059] do_syscall_64+0x166/0x520 [ 95.033496][ T1059] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.033506][ T1059] [ 95.033508][ T1059] Memory state around the buggy address: [ 95.033513][ T1059] ffff88800becef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.033521][ T1059] ffff88800becef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.033527][ T1059] >ffff88800becf000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.033532][ T1059] ^ [ 95.033538][ T1059] ffff88800becf080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.033545][ T1059] ffff88800becf100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.033550][ T1059] ================================================================== [ 95.057661][ T1059] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.374331][ T1059] CPU: 0 UID: 0 PID: 1059 Comm: kworker/u4:12 Not tainted syzkaller #0 PREEMPT(full) [ 95.378478][ T1059] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.382655][ T1059] Workqueue: events_unbound commit_work [ 95.384779][ T1059] Call Trace: [ 95.386177][ T1059] [ 95.387515][ T1059] vpanic+0x56d/0xa60 [ 95.389209][ T1059] ? __pfx_vpanic+0x10/0x10 [ 95.391066][ T1059] panic+0xc5/0xd0 [ 95.392575][ T1059] ? __pfx_panic+0x10/0x10 [ 95.394381][ T1059] ? preempt_schedule_thunk+0x16/0x40 [ 95.396485][ T1059] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.399362][ T1059] ? preempt_schedule_thunk+0x16/0x40 [ 95.401683][ T1059] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.404478][ T1059] check_panic_on_warn+0x89/0xb0 [ 95.406549][ T1059] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.409263][ T1059] end_report+0x73/0x170 [ 95.411042][ T1059] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.413885][ T1059] kasan_report+0x128/0x150 [ 95.415874][ T1059] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.418654][ T1059] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.421051][ T1059] ? preempt_schedule_thunk+0x16/0x40 [ 95.423122][ T1059] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 95.426108][ T1059] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 95.428583][ T1059] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 95.431237][ T1059] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 95.433754][ T1059] commit_tail+0x2b1/0x3c0 [ 95.435739][ T1059] ? process_scheduled_works+0x97a/0x1630 [ 95.438250][ T1059] process_scheduled_works+0xc3d/0x1630 [ 95.440684][ T1059] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.443150][ T1059] ? assign_work+0x3cf/0x5d0 [ 95.445010][ T1059] worker_thread+0xa47/0xfb0 [ 95.446969][ T1059] ? __kthread_parkme+0x71/0x1f0 [ 95.448962][ T1059] kthread+0x38b/0x480 [ 95.450656][ T1059] ? __pfx_worker_thread+0x10/0x10 [ 95.452681][ T1059] ? __pfx_kthread+0x10/0x10 [ 95.454644][ T1059] ret_from_fork+0x514/0xb70 [ 95.456695][ T1059] ? __pfx_ret_from_fork+0x10/0x10 [ 95.458983][ T1059] ? __switch_to+0xc89/0x1420 [ 95.461050][ T1059] ? __pfx_kthread+0x10/0x10 [ 95.463068][ T1059] ret_from_fork_asm+0x1a/0x30 [ 95.465200][ T1059] [ 95.466903][ T1059] Kernel Offset: disabled [ 95.468563][ T1059] Rebooting in 86400 seconds..