./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3038499528
<...>
forked to background, child pid 3185
no interfaces have a carrier
[ 26.962770][ T3186] 8021q: adding VLAN 0 to HW filter on device bond0
[ 26.977893][ T3186] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.162' (ECDSA) to the list of known hosts.
execve("./syz-executor3038499528", ["./syz-executor3038499528"], 0x7ffea5b027e0 /* 10 vars */) = 0
brk(NULL) = 0x555557077000
brk(0x555557077c40) = 0x555557077c40
arch_prctl(ARCH_SET_FS, 0x555557077300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3038499528", 4096) = 28
brk(0x555557098c40) = 0x555557098c40
brk(0x555557099000) = 0x555557099000
mprotect(0x7fe51ad83000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000100) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "4", 1) = 1
mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0) = ?
syzkaller login: [ 50.021342][ T3606] ==================================================================
[ 50.029438][ T3606] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xf2/0x110
[ 50.037883][ T3606] Read of size 8 at addr ffff8880209c11e8 by task syz-executor303/3606
[ 50.046110][ T3606]
[ 50.048422][ T3606] CPU: 1 PID: 3606 Comm: syz-executor303 Not tainted 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0
[ 50.058556][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[ 50.068739][ T3606] Call Trace:
[ 50.072005][ T3606]
[ 50.074926][ T3606] dump_stack_lvl+0xcd/0x134
[ 50.079513][ T3606] print_report.cold+0x2ba/0x719
[ 50.084444][ T3606] ? drm_gem_object_release_handle+0xf2/0x110
[ 50.090498][ T3606] kasan_report+0xb1/0x1e0
[ 50.094907][ T3606] ? drm_gem_object_release_handle+0xf2/0x110
[ 50.100984][ T3606] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 50.107576][ T3606] drm_gem_object_release_handle+0xf2/0x110
[ 50.113492][ T3606] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 50.120084][ T3606] idr_for_each+0x113/0x220
[ 50.124594][ T3606] ? idr_find+0x50/0x50
[ 50.128758][ T3606] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 50.134571][ T3606] drm_gem_release+0x22/0x30
[ 50.139161][ T3606] drm_file_free.part.0+0x805/0xb80
[ 50.144364][ T3606] ? fsnotify+0x1680/0x1680
[ 50.148874][ T3606] drm_close_helper.isra.0+0x17d/0x1f0
[ 50.154338][ T3606] drm_release+0x1e6/0x530
[ 50.158761][ T3606] __fput+0x277/0x9d0
[ 50.162745][ T3606] ? drm_release_noglobal+0x180/0x180
[ 50.168119][ T3606] task_work_run+0xdd/0x1a0
[ 50.172622][ T3606] do_exit+0xad5/0x29b0
[ 50.176798][ T3606] ? mm_update_next_owner+0x7a0/0x7a0
[ 50.182194][ T3606] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.187429][ T3606] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.192651][ T3606] do_group_exit+0xd2/0x2f0
[ 50.197169][ T3606] __x64_sys_exit_group+0x3a/0x50
[ 50.202216][ T3606] do_syscall_64+0x35/0xb0
[ 50.206638][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 50.212541][ T3606] RIP: 0033:0x7fe51ad159e9
[ 50.216963][ T3606] Code: Unable to access opcode bytes at RIP 0x7fe51ad159bf.
[ 50.224338][ T3606] RSP: 002b:00007ffc0ce97528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 50.232772][ T3606] RAX: ffffffffffffffda RBX: 00007fe51ad893f0 RCX: 00007fe51ad159e9
[ 50.240767][ T3606] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 50.248746][ T3606] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 50.256732][ T3606] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fe51ad893f0
[ 50.264720][ T3606] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 50.272706][ T3606]
[ 50.275732][ T3606]
[ 50.278050][ T3606] Allocated by task 3606:
[ 50.282369][ T3606] kasan_save_stack+0x1e/0x40
[ 50.287052][ T3606] __kasan_kmalloc+0xa9/0xd0
[ 50.291654][ T3606] vgem_gem_create_object+0x38/0xb0
[ 50.296872][ T3606] __drm_gem_shmem_create+0x80/0x480
[ 50.302172][ T3606] drm_gem_shmem_dumb_create+0x13c/0x380
[ 50.307816][ T3606] drm_mode_create_dumb+0x26c/0x2f0
[ 50.313021][ T3606] drm_ioctl_kernel+0x27d/0x4e0
[ 50.317873][ T3606] drm_ioctl+0x51e/0x9d0
[ 50.322131][ T3606] __x64_sys_ioctl+0x193/0x200
[ 50.326894][ T3606] do_syscall_64+0x35/0xb0
[ 50.331309][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 50.337207][ T3606]
[ 50.339525][ T3606] Freed by task 3606:
[ 50.343496][ T3606] kasan_save_stack+0x1e/0x40
[ 50.348173][ T3606] kasan_set_track+0x21/0x30
[ 50.352774][ T3606] kasan_set_free_info+0x20/0x30
[ 50.357807][ T3606] ____kasan_slab_free+0x166/0x1c0
[ 50.362919][ T3606] slab_free_freelist_hook+0x8b/0x1c0
[ 50.368293][ T3606] kfree+0xe2/0x580
[ 50.372098][ T3606] drm_gem_mmap+0x4fc/0x770
[ 50.376598][ T3606] mmap_region+0xbff/0x1460
[ 50.381101][ T3606] do_mmap+0x863/0xfa0
[ 50.385169][ T3606] vm_mmap_pgoff+0x1ab/0x270
[ 50.389760][ T3606] ksys_mmap_pgoff+0x41b/0x5a0
[ 50.394526][ T3606] do_syscall_64+0x35/0xb0
[ 50.398941][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 50.404837][ T3606]
[ 50.407154][ T3606] The buggy address belongs to the object at ffff8880209c1000
[ 50.407154][ T3606] which belongs to the cache kmalloc-1k of size 1024
[ 50.421201][ T3606] The buggy address is located 488 bytes inside of
[ 50.421201][ T3606] 1024-byte region [ffff8880209c1000, ffff8880209c1400)
[ 50.434560][ T3606]
[ 50.436894][ T3606] The buggy address belongs to the physical page:
[ 50.443299][ T3606] page:ffffea0000827000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x209c0
[ 50.453448][ T3606] head:ffffea0000827000 order:3 compound_mapcount:0 compound_pincount:0
[ 50.461766][ T3606] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 50.469840][ T3606] raw: 00fff00000010200 ffffea0000815200 dead000000000002 ffff888011841dc0
[ 50.478425][ T3606] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 50.487002][ T3606] page dumped because: kasan: bad access detected
[ 50.493410][ T3606] page_owner tracks the page as allocated
[ 50.499131][ T3606] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3238, tgid 3238 (dhcpcd-run-hook), ts 26486197247, free_ts 26339792737
[ 50.520756][ T3606] get_page_from_freelist+0x109b/0x2ce0
[ 50.526310][ T3606] __alloc_pages+0x1c7/0x510
[ 50.530901][ T3606] alloc_pages+0x1a6/0x270
[ 50.535316][ T3606] allocate_slab+0x27e/0x3d0
[ 50.539908][ T3606] ___slab_alloc+0x7f1/0xe10
[ 50.544505][ T3606] __slab_alloc.constprop.0+0x4d/0xa0
[ 50.549876][ T3606] __kmalloc+0x32b/0x340
[ 50.554120][ T3606] load_elf_phdrs+0x103/0x210
[ 50.558802][ T3606] load_elf_binary+0x1dc/0x4da0
[ 50.563654][ T3606] bprm_execve+0x7ef/0x1960
[ 50.568156][ T3606] do_execveat_common+0x727/0x890
[ 50.573180][ T3606] __x64_sys_execve+0x8f/0xc0
[ 50.577856][ T3606] do_syscall_64+0x35/0xb0
[ 50.582275][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 50.588173][ T3606] page last free stack trace:
[ 50.592838][ T3606] free_pcp_prepare+0x5e4/0xd20
[ 50.597691][ T3606] free_unref_page+0x19/0x4d0
[ 50.602369][ T3606] qlist_free_all+0x6a/0x170
[ 50.606960][ T3606] kasan_quarantine_reduce+0x180/0x200
[ 50.612422][ T3606] __kasan_slab_alloc+0xa2/0xc0
[ 50.617277][ T3606] kmem_cache_alloc+0x267/0x3b0
[ 50.622126][ T3606] getname_flags.part.0+0x50/0x4f0
[ 50.627239][ T3606] getname_flags+0x9a/0xe0
[ 50.631665][ T3606] vfs_fstatat+0x73/0xb0
[ 50.635909][ T3606] __do_sys_newfstatat+0x91/0x110
[ 50.640933][ T3606] do_syscall_64+0x35/0xb0
[ 50.645352][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 50.651253][ T3606]
[ 50.653572][ T3606] Memory state around the buggy address:
[ 50.659219][ T3606] ffff8880209c1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 50.667281][ T3606] ffff8880209c1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 50.675338][ T3606] >ffff8880209c1180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 50.683390][ T3606] ^
[ 50.690837][ T3606] ffff8880209c1200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 50.698892][ T3606] ffff8880209c1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 50.706944][ T3606] ==================================================================
[ 50.715625][ T3606] Kernel panic - not syncing: panic_on_warn set ...
[ 50.722248][ T3606] CPU: 0 PID: 3606 Comm: syz-executor303 Not tainted 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0
[ 50.732410][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[ 50.742461][ T3606] Call Trace:
[ 50.745736][ T3606]
[ 50.748667][ T3606] dump_stack_lvl+0xcd/0x134
[ 50.753266][ T3606] panic+0x2c8/0x627
[ 50.757162][ T3606] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 50.763147][ T3606] ? preempt_schedule_common+0x59/0xc0
[ 50.768608][ T3606] ? preempt_schedule_thunk+0x16/0x18
[ 50.773987][ T3606] ? drm_gem_object_release_handle+0xf2/0x110
[ 50.780058][ T3606] end_report.part.0+0x3f/0x7c
[ 50.784827][ T3606] kasan_report.cold+0xa/0xf
[ 50.789423][ T3606] ? drm_gem_object_release_handle+0xf2/0x110
[ 50.795495][ T3606] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 50.802110][ T3606] drm_gem_object_release_handle+0xf2/0x110
[ 50.808008][ T3606] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 50.814604][ T3606] idr_for_each+0x113/0x220
[ 50.819111][ T3606] ? idr_find+0x50/0x50
[ 50.823271][ T3606] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 50.829087][ T3606] drm_gem_release+0x22/0x30
[ 50.833694][ T3606] drm_file_free.part.0+0x805/0xb80
[ 50.838897][ T3606] ? fsnotify+0x1680/0x1680
[ 50.843403][ T3606] drm_close_helper.isra.0+0x17d/0x1f0
[ 50.848863][ T3606] drm_release+0x1e6/0x530
[ 50.853281][ T3606] __fput+0x277/0x9d0
[ 50.857267][ T3606] ? drm_release_noglobal+0x180/0x180
[ 50.862643][ T3606] task_work_run+0xdd/0x1a0
[ 50.867151][ T3606] do_exit+0xad5/0x29b0
[ 50.871308][ T3606] ? mm_update_next_owner+0x7a0/0x7a0
[ 50.876679][ T3606] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.881883][ T3606] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.887087][ T3606] do_group_exit+0xd2/0x2f0
[ 50.891591][ T3606] __x64_sys_exit_group+0x3a/0x50
[ 50.896616][ T3606] do_syscall_64+0x35/0xb0
[ 50.901033][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 50.906930][ T3606] RIP: 0033:0x7fe51ad159e9
[ 50.911347][ T3606] Code: Unable to access opcode bytes at RIP 0x7fe51ad159bf.
[ 50.918703][ T3606] RSP: 002b:00007ffc0ce97528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 50.927119][ T3606] RAX: ffffffffffffffda RBX: 00007fe51ad893f0 RCX: 00007fe51ad159e9
[ 50.935093][ T3606] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 50.943150][ T3606] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 50.951124][ T3606] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fe51ad893f0
[ 50.959092][ T3606] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 50.967068][ T3606]
[ 50.970246][ T3606] Kernel Offset: disabled
[ 50.974572][ T3606] Rebooting in 86400 seconds..