./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2760283165
<...>
Warning: Permanently added '10.128.0.86' (ECDSA) to the list of known hosts.
execve("./syz-executor2760283165", ["./syz-executor2760283165"], 0x7ffe31888790 /* 10 vars */) = 0
brk(NULL) = 0x55555667e000
brk(0x55555667ec40) = 0x55555667ec40
arch_prctl(ARCH_SET_FS, 0x55555667e300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2760283165", 4096) = 28
brk(0x55555669fc40) = 0x55555669fc40
brk(0x5555566a0000) = 0x5555566a0000
mprotect(0x7f2ddbb78000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3610 attached
, child_tidptr=0x55555667e5d0) = 3610
[pid 3610] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3610] setpgid(0, 0) = 0
[pid 3610] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3610] write(3, "1000", 4) = 4
[pid 3610] close(3) = 0
[pid 3610] openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
[pid 3610] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000040) = 0
[ 49.035518][ T26] audit: type=1400 audit(1656421586.530:75): avc: denied { execmem } for pid=3609 comm="syz-executor276" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 49.060253][ T26] audit: type=1400 audit(1656421586.550:76): avc: denied { read } for pid=3610 comm="syz-executor276" name="card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[pid 3610] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3610] write(4, "6", 1) = 1
[ 49.084721][ T26] audit: type=1400 audit(1656421586.550:77): avc: denied { open } for pid=3610 comm="syz-executor276" path="/dev/dri/card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 49.109634][ T26] audit: type=1400 audit(1656421586.550:78): avc: denied { ioctl } for pid=3610 comm="syz-executor276" path="/dev/dri/card0" dev="devtmpfs" ino=624 ioctlcmd=0x64b2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[pid 3610] mmap(0x20ffc000, 12288, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = 0x20ffc000
[pid 3610] exit_group(0) = ?
[pid 3610] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3610, si_uid=0, si_status=0, si_utime=0, si_stime=8} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3611 attached
, child_tidptr=0x55555667e5d0) = 3611
[pid 3611] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3611] setpgid(0, 0) = 0
[pid 3611] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3611] write(3, "1000", 4) = 4
[pid 3611] close(3) = 0
[pid 3611] openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
[pid 3611] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000040) = 0
[pid 3611] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3611] write(4, "6", 1) = 1
[pid 3611] mmap(0x20ffc000, 12288, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
[pid 3611] exit_group(0) = ?
[ 49.135438][ T26] audit: type=1400 audit(1656421586.580:79): avc: denied { map } for pid=3610 comm="syz-executor276" path="/dev/dri/card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 49.176522][ T3611] ==================================================================
[ 49.184599][ T3611] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xf2/0x110
[ 49.193024][ T3611] Read of size 8 at addr ffff888075fbf9e8 by task syz-executor276/3611
[ 49.201267][ T3611]
[ 49.203586][ T3611] CPU: 0 PID: 3611 Comm: syz-executor276 Not tainted 5.19.0-rc4-syzkaller-00014-g941e3e791269 #0
[ 49.214080][ T3611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 49.224132][ T3611] Call Trace:
[ 49.227417][ T3611]
[ 49.230346][ T3611] dump_stack_lvl+0xcd/0x134
[ 49.234940][ T3611] print_address_description.constprop.0.cold+0xeb/0x467
[ 49.241978][ T3611] ? drm_gem_object_release_handle+0xf2/0x110
[ 49.248061][ T3611] kasan_report.cold+0xf4/0x1c6
[ 49.252936][ T3611] ? drm_gem_object_release_handle+0xf2/0x110
[ 49.259029][ T3611] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 49.265625][ T3611] drm_gem_object_release_handle+0xf2/0x110
[ 49.271525][ T3611] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 49.278116][ T3611] idr_for_each+0x113/0x220
[ 49.282624][ T3611] ? idr_find+0x50/0x50
[ 49.286780][ T3611] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 49.292591][ T3611] drm_gem_release+0x22/0x30
[ 49.297184][ T3611] drm_file_free.part.0+0x805/0xb80
[ 49.302386][ T3611] ? fsnotify+0x13a0/0x13a0
[ 49.306894][ T3611] drm_close_helper.isra.0+0x17d/0x1f0
[ 49.312354][ T3611] drm_release+0x1e6/0x530
[ 49.316770][ T3611] __fput+0x277/0x9d0
[ 49.320755][ T3611] ? drm_release_noglobal+0x180/0x180
[ 49.326129][ T3611] task_work_run+0xdd/0x1a0
[ 49.330637][ T3611] do_exit+0xaff/0x2a00
[ 49.334810][ T3611] ? lock_downgrade+0x6e0/0x6e0
[ 49.339687][ T3611] ? mm_update_next_owner+0x7a0/0x7a0
[ 49.345077][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40
[ 49.350287][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40
[ 49.355496][ T3611] do_group_exit+0xd2/0x2f0
[ 49.360012][ T3611] __x64_sys_exit_group+0x3a/0x50
[ 49.365042][ T3611] do_syscall_64+0x35/0xb0
[ 49.369458][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.375354][ T3611] RIP: 0033:0x7f2ddbb0a349
[ 49.379766][ T3611] Code: Unable to access opcode bytes at RIP 0x7f2ddbb0a31f.
[ 49.387123][ T3611] RSP: 002b:00007fff09d22b38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 49.395537][ T3611] RAX: ffffffffffffffda RBX: 00007f2ddbb7e3f0 RCX: 00007f2ddbb0a349
[ 49.403507][ T3611] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 49.411476][ T3611] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 49.419444][ T3611] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f2ddbb7e3f0
[ 49.427414][ T3611] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 49.435384][ T3611]
[ 49.438397][ T3611]
[ 49.440713][ T3611] Allocated by task 3611:
[ 49.445035][ T3611] kasan_save_stack+0x1e/0x40
[ 49.449717][ T3611] __kasan_kmalloc+0xa6/0xd0
[ 49.454309][ T3611] kmem_cache_alloc_trace+0x1ea/0x4a0
[ 49.459681][ T3611] vgem_gem_create_object+0x38/0xb0
[ 49.464896][ T3611] __drm_gem_shmem_create+0x80/0x480
[ 49.470193][ T3611] drm_gem_shmem_dumb_create+0x13c/0x380
[ 49.475839][ T3611] drm_mode_create_dumb+0x26c/0x2f0
[ 49.481045][ T3611] drm_ioctl_kernel+0x27d/0x4e0
[ 49.485905][ T3611] drm_ioctl+0x51e/0x9d0
[ 49.490148][ T3611] __x64_sys_ioctl+0x193/0x200
[ 49.494909][ T3611] do_syscall_64+0x35/0xb0
[ 49.499326][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.505222][ T3611]
[ 49.507542][ T3611] Freed by task 3611:
[ 49.511517][ T3611] kasan_save_stack+0x1e/0x40
[ 49.516194][ T3611] kasan_set_track+0x21/0x30
[ 49.520784][ T3611] kasan_set_free_info+0x20/0x30
[ 49.525726][ T3611] ____kasan_slab_free+0x13d/0x180
[ 49.530840][ T3611] kfree+0x113/0x310
[ 49.534731][ T3611] drm_gem_mmap+0x4fc/0x770
[ 49.539244][ T3611] mmap_region+0xbe7/0x1460
[ 49.543759][ T3611] do_mmap+0x863/0xfa0
[ 49.547833][ T3611] vm_mmap_pgoff+0x1b7/0x290
[ 49.552425][ T3611] ksys_mmap_pgoff+0x40d/0x5a0
[ 49.557193][ T3611] do_syscall_64+0x35/0xb0
[ 49.561612][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.567508][ T3611]
[ 49.569824][ T3611] The buggy address belongs to the object at ffff888075fbf800
[ 49.569824][ T3611] which belongs to the cache kmalloc-1k of size 1024
[ 49.583872][ T3611] The buggy address is located 488 bytes inside of
[ 49.583872][ T3611] 1024-byte region [ffff888075fbf800, ffff888075fbfc00)
[ 49.602181][ T3611]
[ 49.604500][ T3611] The buggy address belongs to the physical page:
[ 49.610904][ T3611] page:ffffea0001d7efc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x75fbf
[ 49.621052][ T3611] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 49.628601][ T3611] raw: 00fff00000000200 ffffea0000718588 ffffea0000869888 ffff888011840700
[ 49.637188][ T3611] raw: 0000000000000000 ffff888075fbf000 0000000100000002 0000000000000000
[ 49.645763][ T3611] page dumped because: kasan: bad access detected
[ 49.652168][ T3611] page_owner tracks the page as allocated
[ 49.662648][ T3611] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 3611, tgid 3611 (syz-executor276), ts 49171674294, free_ts 43692343199
[ 49.683054][ T3611] get_page_from_freelist+0x1290/0x3b70
[ 49.688601][ T3611] __alloc_pages+0x1c7/0x510
[ 49.693192][ T3611] cache_grow_begin+0x75/0x350
[ 49.697954][ T3611] cache_alloc_refill+0x27f/0x380
[ 49.702982][ T3611] kmem_cache_alloc_trace+0x380/0x4a0
[ 49.708353][ T3611] vgem_gem_create_object+0x38/0xb0
[ 49.713554][ T3611] __drm_gem_shmem_create+0x80/0x480
[ 49.718840][ T3611] drm_gem_shmem_dumb_create+0x13c/0x380
[ 49.724476][ T3611] drm_mode_create_dumb+0x26c/0x2f0
[ 49.729677][ T3611] drm_ioctl_kernel+0x27d/0x4e0
[ 49.734528][ T3611] drm_ioctl+0x51e/0x9d0
[ 49.738768][ T3611] __x64_sys_ioctl+0x193/0x200
[ 49.743620][ T3611] do_syscall_64+0x35/0xb0
[ 49.748034][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.754018][ T3611] page last free stack trace:
[ 49.758686][ T3611] free_pcp_prepare+0x549/0xd20
[ 49.763538][ T3611] free_unref_page_list+0x16f/0xf80
[ 49.768734][ T3611] release_pages+0xff1/0x2290
[ 49.773416][ T3611] tlb_batch_pages_flush+0xa8/0x1a0
[ 49.778614][ T3611] tlb_finish_mmu+0x147/0x7e0
[ 49.784063][ T3611] exit_mmap+0x1de/0x4a0
[ 49.788307][ T3611] __mmput+0x122/0x4b0
[ 49.792376][ T3611] mmput+0x56/0x60
[ 49.796098][ T3611] do_exit+0xa12/0x2a00
[ 49.800255][ T3611] do_group_exit+0xd2/0x2f0
[ 49.804765][ T3611] __x64_sys_exit_group+0x3a/0x50
[ 49.809791][ T3611] do_syscall_64+0x35/0xb0
[ 49.814204][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.820124][ T3611]
[ 49.822440][ T3611] Memory state around the buggy address:
[ 49.828067][ T3611] ffff888075fbf880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.836132][ T3611] ffff888075fbf900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.844189][ T3611] >ffff888075fbf980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.852243][ T3611] ^
[ 49.859693][ T3611] ffff888075fbfa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.867751][ T3611] ffff888075fbfa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.875805][ T3611] ==================================================================
[ 49.884115][ T3611] Kernel panic - not syncing: panic_on_warn set ...
[ 49.890711][ T3611] CPU: 1 PID: 3611 Comm: syz-executor276 Not tainted 5.19.0-rc4-syzkaller-00014-g941e3e791269 #0
[ 49.901342][ T3611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 49.911414][ T3611] Call Trace:
[ 49.914699][ T3611]
[ 49.917628][ T3611] dump_stack_lvl+0xcd/0x134
[ 49.922228][ T3611] panic+0x2d7/0x636
[ 49.926128][ T3611] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 49.932119][ T3611] ? preempt_schedule_common+0x59/0xc0
[ 49.937581][ T3611] ? drm_gem_object_release_handle+0xf2/0x110
[ 49.943651][ T3611] ? preempt_schedule_thunk+0x16/0x18
[ 49.949031][ T3611] ? drm_gem_object_release_handle+0xf2/0x110
[ 49.955102][ T3611] end_report.part.0+0x3f/0x7c
[ 49.959868][ T3611] kasan_report.cold+0x93/0x1c6
[ 49.964723][ T3611] ? drm_gem_object_release_handle+0xf2/0x110
[ 49.970794][ T3611] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 49.977386][ T3611] drm_gem_object_release_handle+0xf2/0x110
[ 49.983301][ T3611] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 49.989896][ T3611] idr_for_each+0x113/0x220
[ 49.994406][ T3611] ? idr_find+0x50/0x50
[ 49.998573][ T3611] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 50.004388][ T3611] drm_gem_release+0x22/0x30
[ 50.008981][ T3611] drm_file_free.part.0+0x805/0xb80
[ 50.014184][ T3611] ? fsnotify+0x13a0/0x13a0
[ 50.018703][ T3611] drm_close_helper.isra.0+0x17d/0x1f0
[ 50.024169][ T3611] drm_release+0x1e6/0x530
[ 50.028594][ T3611] __fput+0x277/0x9d0
[ 50.032580][ T3611] ? drm_release_noglobal+0x180/0x180
[ 50.037955][ T3611] task_work_run+0xdd/0x1a0
[ 50.042462][ T3611] do_exit+0xaff/0x2a00
[ 50.046626][ T3611] ? lock_downgrade+0x6e0/0x6e0
[ 50.051487][ T3611] ? mm_update_next_owner+0x7a0/0x7a0
[ 50.056862][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.062063][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.067267][ T3611] do_group_exit+0xd2/0x2f0
[ 50.071808][ T3611] __x64_sys_exit_group+0x3a/0x50
[ 50.076837][ T3611] do_syscall_64+0x35/0xb0
[ 50.081261][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 50.087165][ T3611] RIP: 0033:0x7f2ddbb0a349
[ 50.091578][ T3611] Code: Unable to access opcode bytes at RIP 0x7f2ddbb0a31f.
[ 50.098936][ T3611] RSP: 002b:00007fff09d22b38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 50.107363][ T3611] RAX: ffffffffffffffda RBX: 00007f2ddbb7e3f0 RCX: 00007f2ddbb0a349
[ 50.115422][ T3611] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 50.123390][ T3611] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 50.131359][ T3611] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f2ddbb7e3f0
[ 50.139328][ T3611] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 50.147305][ T3611]
[ 50.150385][ T3611] Kernel Offset: disabled
[ 50.154706][ T3611] Rebooting in 86400 seconds..