./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3342093149
<...>
Warning: Permanently added '10.128.1.91' (ECDSA) to the list of known hosts.
execve("./syz-executor3342093149", ["./syz-executor3342093149"], 0x7ffc599f84c0 /* 10 vars */) = 0
brk(NULL) = 0x555557379000
brk(0x555557379c40) = 0x555557379c40
arch_prctl(ARCH_SET_FS, 0x555557379300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3342093149", 4096) = 28
brk(0x55555739ac40) = 0x55555739ac40
brk(0x55555739b000) = 0x55555739b000
mprotect(0x7f752c595000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000080) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "4", 1) = 1
mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0) = ?
syzkaller login: [ 41.317714][ T3617] ==================================================================
[ 41.317723][ T3617] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xf2/0x110
[ 41.317755][ T3617] Read of size 8 at addr ffff8880207019e8 by task syz-executor334/3617
[ 41.317766][ T3617]
[ 41.317769][ T3617] CPU: 1 PID: 3617 Comm: syz-executor334 Not tainted 5.19.0-rc2-syzkaller #0
[ 41.317782][ T3617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 41.317795][ T3617] Call Trace:
[ 41.317799][ T3617]
[ 41.317805][ T3617] dump_stack_lvl+0xcd/0x134
[ 41.317829][ T3617] print_address_description.constprop.0.cold+0xeb/0x495
[ 41.317853][ T3617] ? drm_gem_object_release_handle+0xf2/0x110
[ 41.317867][ T3617] kasan_report.cold+0xf4/0x1c6
[ 41.317880][ T3617] ? drm_gem_object_release_handle+0xf2/0x110
[ 41.317895][ T3617] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 41.317910][ T3617] drm_gem_object_release_handle+0xf2/0x110
[ 41.317924][ T3617] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 41.317939][ T3617] idr_for_each+0x113/0x220
[ 41.317952][ T3617] ? idr_find+0x50/0x50
[ 41.317964][ T3617] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 41.317980][ T3617] drm_gem_release+0x22/0x30
[ 41.317993][ T3617] drm_file_free.part.0+0x805/0xb80
[ 41.318008][ T3617] ? fsnotify+0x13a0/0x13a0
[ 41.318020][ T3617] drm_close_helper.isra.0+0x17d/0x1f0
[ 41.318034][ T3617] drm_release+0x1e6/0x530
[ 41.318047][ T3617] __fput+0x277/0x9d0
[ 41.318059][ T3617] ? drm_release_noglobal+0x180/0x180
[ 41.318073][ T3617] task_work_run+0xdd/0x1a0
[ 41.318088][ T3617] do_exit+0xaff/0x2a00
[ 41.318104][ T3617] ? lock_downgrade+0x6e0/0x6e0
[ 41.318120][ T3617] ? mm_update_next_owner+0x7a0/0x7a0
[ 41.318134][ T3617] ? _raw_spin_unlock_irq+0x1f/0x40
[ 41.318147][ T3617] ? _raw_spin_unlock_irq+0x1f/0x40
[ 41.318161][ T3617] do_group_exit+0xd2/0x2f0
[ 41.318175][ T3617] __x64_sys_exit_group+0x3a/0x50
[ 41.318189][ T3617] do_syscall_64+0x35/0xb0
[ 41.318204][ T3617] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 41.318218][ T3617] RIP: 0033:0x7f752c5279e9
[ 41.318228][ T3617] Code: Unable to access opcode bytes at RIP 0x7f752c5279bf.
[ 41.318233][ T3617] RSP: 002b:00007ffdee538088 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 41.318245][ T3617] RAX: ffffffffffffffda RBX: 00007f752c59b3f0 RCX: 00007f752c5279e9
[ 41.318254][ T3617] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 41.318261][ T3617] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 41.318269][ T3617] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f752c59b3f0
[ 41.318277][ T3617] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 41.318288][ T3617]
[ 41.318291][ T3617]
[ 41.318293][ T3617] Allocated by task 3617:
[ 41.318298][ T3617] kasan_save_stack+0x1e/0x40
[ 41.318309][ T3617] __kasan_kmalloc+0xa9/0xd0
[ 41.318318][ T3617] vgem_gem_create_object+0x38/0xb0
[ 41.318330][ T3617] __drm_gem_shmem_create+0x80/0x480
[ 41.318344][ T3617] drm_gem_shmem_dumb_create+0x13c/0x380
[ 41.318356][ T3617] drm_mode_create_dumb+0x26c/0x2f0
[ 41.318370][ T3617] drm_ioctl_kernel+0x27d/0x4e0
[ 41.318382][ T3617] drm_ioctl+0x51e/0x9d0
[ 41.318393][ T3617] __x64_sys_ioctl+0x193/0x200
[ 41.318405][ T3617] do_syscall_64+0x35/0xb0
[ 41.318417][ T3617] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 41.318430][ T3617]
[ 41.318431][ T3617] Freed by task 3617:
[ 41.318436][ T3617] kasan_save_stack+0x1e/0x40
[ 41.318445][ T3617] kasan_set_track+0x21/0x30
[ 41.318454][ T3617] kasan_set_free_info+0x20/0x30
[ 41.318466][ T3617] ____kasan_slab_free+0x166/0x1a0
[ 41.318475][ T3617] slab_free_freelist_hook+0x8b/0x1c0
[ 41.318488][ T3617] kfree+0xd6/0x4d0
[ 41.318499][ T3617] drm_gem_mmap+0x4fc/0x770
[ 41.318510][ T3617] mmap_region+0xbe7/0x1460
[ 41.318521][ T3617] do_mmap+0x863/0xfa0
[ 41.318530][ T3617] vm_mmap_pgoff+0x1b7/0x290
[ 41.318543][ T3617] ksys_mmap_pgoff+0x40d/0x5a0
[ 41.318553][ T3617] do_syscall_64+0x35/0xb0
[ 41.318564][ T3617] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 41.318577][ T3617]
[ 41.318579][ T3617] The buggy address belongs to the object at ffff888020701800
[ 41.318579][ T3617] which belongs to the cache kmalloc-1k of size 1024
[ 41.318587][ T3617] The buggy address is located 488 bytes inside of
[ 41.318587][ T3617] 1024-byte region [ffff888020701800, ffff888020701c00)
[ 41.318598][ T3617]
[ 41.318600][ T3617] The buggy address belongs to the physical page:
[ 41.318604][ T3617] page:ffffea000081c000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20700
[ 41.318617][ T3617] head:ffffea000081c000 order:3 compound_mapcount:0 compound_pincount:0
[ 41.318626][ T3617] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 41.318643][ T3617] raw: 00fff00000010200 ffffea00007fac00 dead000000000002 ffff888011841dc0
[ 41.318654][ T3617] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 41.318660][ T3617] page dumped because: kasan: bad access detected
[ 41.318664][ T3617] page_owner tracks the page as allocated
[ 41.318667][ T3617] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3000, tgid 3000 (udevd), ts 16904955980, free_ts 16904395685
[ 41.318689][ T3617] get_page_from_freelist+0x1290/0x3b70
[ 41.318701][ T3617] __alloc_pages+0x1c7/0x510
[ 41.318711][ T3617] alloc_pages+0x1aa/0x310
[ 41.318720][ T3617] allocate_slab+0x26c/0x3c0
[ 41.318732][ T3617] ___slab_alloc+0x985/0xd90
[ 41.318743][ T3617] __slab_alloc.constprop.0+0x4d/0xa0
[ 41.318756][ T3617] __kmalloc+0x318/0x350
[ 41.318768][ T3617] load_elf_phdrs+0x103/0x210
[ 41.318779][ T3617] load_elf_binary+0x1dc/0x4ec0
[ 41.318797][ T3617] bprm_execve+0x7ef/0x1970
[ 41.318810][ T3617] do_execveat_common+0x727/0x890
[ 41.318823][ T3617] __x64_sys_execve+0x8f/0xc0
[ 41.318835][ T3617] do_syscall_64+0x35/0xb0
[ 41.318847][ T3617] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 41.318860][ T3617] page last free stack trace:
[ 41.318862][ T3617] free_pcp_prepare+0x549/0xd20
[ 41.318872][ T3617] free_unref_page+0x19/0x6a0
[ 41.318882][ T3617] __unfreeze_partials+0x17c/0x1a0
[ 41.318895][ T3617] qlist_free_all+0x6a/0x170
[ 41.318905][ T3617] kasan_quarantine_reduce+0x180/0x200
[ 41.318917][ T3617] __kasan_slab_alloc+0xa2/0xc0
[ 41.318927][ T3617] kmem_cache_alloc+0x204/0x3b0
[ 41.318939][ T3617] getname_flags.part.0+0x50/0x4f0
[ 41.318950][ T3617] getname+0x8e/0xd0
[ 41.318959][ T3617] __x64_sys_execve+0x75/0xc0
[ 41.318971][ T3617] do_syscall_64+0x35/0xb0
[ 41.318983][ T3617] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 41.318995][ T3617]
[ 41.318997][ T3617] Memory state around the buggy address:
[ 41.319002][ T3617] ffff888020701880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.319009][ T3617] ffff888020701900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.319017][ T3617] >ffff888020701980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.319022][ T3617] ^
[ 41.319028][ T3617] ffff888020701a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.319036][ T3617] ffff888020701a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.319041][ T3617] ==================================================================
[ 41.319046][ T3617] Kernel panic - not syncing: panic_on_warn set ...
[ 42.022027][ T3617] CPU: 1 PID: 3617 Comm: syz-executor334 Not tainted 5.19.0-rc2-syzkaller #0
[ 42.030791][ T3617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 42.040853][ T3617] Call Trace:
[ 42.044127][ T3617]
[ 42.047059][ T3617] dump_stack_lvl+0xcd/0x134
[ 42.051658][ T3617] panic+0x2d7/0x636
[ 42.055554][ T3617] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 42.061541][ T3617] ? drm_gem_object_release_handle+0xf2/0x110
[ 42.067614][ T3617] ? drm_gem_object_release_handle+0xf2/0x110
[ 42.073684][ T3617] end_report.part.0+0x3f/0x7c
[ 42.078448][ T3617] kasan_report.cold+0x93/0x1c6
[ 42.083299][ T3617] ? drm_gem_object_release_handle+0xf2/0x110
[ 42.089386][ T3617] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 42.095976][ T3617] drm_gem_object_release_handle+0xf2/0x110
[ 42.101872][ T3617] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 42.108464][ T3617] idr_for_each+0x113/0x220
[ 42.112970][ T3617] ? idr_find+0x50/0x50
[ 42.117129][ T3617] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 42.122944][ T3617] drm_gem_release+0x22/0x30
[ 42.127541][ T3617] drm_file_free.part.0+0x805/0xb80
[ 42.132756][ T3617] ? fsnotify+0x13a0/0x13a0
[ 42.137277][ T3617] drm_close_helper.isra.0+0x17d/0x1f0
[ 42.142760][ T3617] drm_release+0x1e6/0x530
[ 42.147201][ T3617] __fput+0x277/0x9d0
[ 42.151192][ T3617] ? drm_release_noglobal+0x180/0x180
[ 42.156582][ T3617] task_work_run+0xdd/0x1a0
[ 42.161104][ T3617] do_exit+0xaff/0x2a00
[ 42.165274][ T3617] ? lock_downgrade+0x6e0/0x6e0
[ 42.170133][ T3617] ? mm_update_next_owner+0x7a0/0x7a0
[ 42.175513][ T3617] ? _raw_spin_unlock_irq+0x1f/0x40
[ 42.180719][ T3617] ? _raw_spin_unlock_irq+0x1f/0x40
[ 42.185925][ T3617] do_group_exit+0xd2/0x2f0
[ 42.190433][ T3617] __x64_sys_exit_group+0x3a/0x50
[ 42.195462][ T3617] do_syscall_64+0x35/0xb0
[ 42.199881][ T3617] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 42.205775][ T3617] RIP: 0033:0x7f752c5279e9
[ 42.210186][ T3617] Code: Unable to access opcode bytes at RIP 0x7f752c5279bf.
[ 42.217558][ T3617] RSP: 002b:00007ffdee538088 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 42.225974][ T3617] RAX: ffffffffffffffda RBX: 00007f752c59b3f0 RCX: 00007f752c5279e9
[ 42.233981][ T3617] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 42.241957][ T3617] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 42.250029][ T3617] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f752c59b3f0
[ 42.258019][ T3617] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 42.266005][ T3617]
[ 42.269080][ T3617] Kernel Offset: disabled
[ 42.273398][ T3617] Rebooting in 86400 seconds..