./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4052624263
<...>
[ 28.834022][ T3187] 8021q: adding VLAN 0 to HW filter on device bond0
[ 28.848428][ T3187] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
syzkaller login: [ 39.535603][ T27] kauditd_printk_skb: 37 callbacks suppressed
[ 39.535619][ T27] audit: type=1400 audit(1657622986.933:73): avc: denied { transition } for pid=3395 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 39.564611][ T27] audit: type=1400 audit(1657622986.943:74): avc: denied { write } for pid=3395 comm="sh" path="pipe:[27297]" dev="pipefs" ino=27297 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
Warning: Permanently added '10.128.0.171' (ECDSA) to the list of known hosts.
execve("./syz-executor4052624263", ["./syz-executor4052624263"], 0x7ffc5f15c660 /* 10 vars */) = 0
brk(NULL) = 0x555556a61000
brk(0x555556a61c40) = 0x555556a61c40
arch_prctl(ARCH_SET_FS, 0x555556a61300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor4052624263", 4096) = 28
brk(0x555556a82c40) = 0x555556a82c40
brk(0x555556a83000) = 0x555556a83000
mprotect(0x7f1fe906d000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556a615d0) = 3609
./strace-static-x86_64: Process 3609 attached
[pid 3609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3609] setpgid(0, 0) = 0
[pid 3609] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3609] write(3, "1000", 4) = 4
[pid 3609] close(3) = 0
[pid 3609] openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
[pid 3609] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000080) = 0
[pid 3609] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3609] write(4, "4", 1) = 1
[ 50.421812][ T27] audit: type=1400 audit(1657622997.823:75): avc: denied { execmem } for pid=3608 comm="syz-executor405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 50.447864][ T27] audit: type=1400 audit(1657622997.853:76): avc: denied { read } for pid=3609 comm="syz-executor405" name="card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 50.456956][ T3609] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64
[ 50.471098][ T27] audit: type=1400 audit(1657622997.853:77): avc: denied { open } for pid=3609 comm="syz-executor405" path="/dev/dri/card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 50.479346][ T3609] audit: out of memory in audit_log_start
[pid 3609] mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = 0x20ffc000
[pid 3609] exit_group(0) = ?
[pid 3609] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3609, si_uid=0, si_status=0, si_utime=0, si_stime=9} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3610 attached
, child_tidptr=0x555556a615d0) = 3610
[pid 3610] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3610] setpgid(0, 0) = 0
[pid 3610] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3610] write(3, "1000", 4) = 4
[pid 3610] close(3) = 0
[pid 3610] openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
[pid 3610] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000080) = 0
[pid 3610] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3610] write(4, "4", 1) = 1
[pid 3610] mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
[pid 3610] exit_group(0) = ?
[ 50.503035][ T27] audit: type=1400 audit(1657622997.853:78): avc: denied { ioctl } for pid=3609 comm="syz-executor405" path="/dev/dri/card0" dev="devtmpfs" ino=624 ioctlcmd=0x64b2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 50.566035][ T3610] ==================================================================
[ 50.574116][ T3610] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xf2/0x110
[ 50.582561][ T3610] Read of size 8 at addr ffff88802001c9e8 by task syz-executor405/3610
[ 50.590782][ T3610]
[ 50.593111][ T3610] CPU: 1 PID: 3610 Comm: syz-executor405 Not tainted 5.19.0-rc6-syzkaller-00026-g5a29232d870d #0
[ 50.603615][ T3610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 50.613657][ T3610] Call Trace:
[ 50.616924][ T3610]
[ 50.619842][ T3610] dump_stack_lvl+0xcd/0x134
[ 50.624423][ T3610] print_address_description.constprop.0.cold+0xeb/0x467
[ 50.631435][ T3610] ? drm_gem_object_release_handle+0xf2/0x110
[ 50.637492][ T3610] kasan_report.cold+0xf4/0x1c6
[ 50.642338][ T3610] ? drm_gem_object_release_handle+0xf2/0x110
[ 50.648413][ T3610] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 50.654995][ T3610] drm_gem_object_release_handle+0xf2/0x110
[ 50.660904][ T3610] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 50.667493][ T3610] idr_for_each+0x113/0x220
[ 50.672001][ T3610] ? idr_find+0x50/0x50
[ 50.676160][ T3610] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 50.681970][ T3610] drm_gem_release+0x22/0x30
[ 50.686559][ T3610] drm_file_free.part.0+0x805/0xb80
[ 50.691756][ T3610] ? fsnotify+0x13a0/0x13a0
[ 50.696270][ T3610] drm_close_helper.isra.0+0x17d/0x1f0
[ 50.701728][ T3610] drm_release+0x1e6/0x530
[ 50.706141][ T3610] __fput+0x277/0x9d0
[ 50.710126][ T3610] ? drm_release_noglobal+0x180/0x180
[ 50.715496][ T3610] task_work_run+0xdd/0x1a0
[ 50.719998][ T3610] do_exit+0xade/0x29d0
[ 50.724154][ T3610] ? mm_update_next_owner+0x7a0/0x7a0
[ 50.729529][ T3610] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.734730][ T3610] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.739943][ T3610] do_group_exit+0xd2/0x2f0
[ 50.744445][ T3610] __x64_sys_exit_group+0x3a/0x50
[ 50.749469][ T3610] do_syscall_64+0x35/0xb0
[ 50.753884][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 50.759801][ T3610] RIP: 0033:0x7f1fe8fff349
[ 50.764222][ T3610] Code: Unable to access opcode bytes at RIP 0x7f1fe8fff31f.
[ 50.771576][ T3610] RSP: 002b:00007fff9da8e328 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 50.779985][ T3610] RAX: ffffffffffffffda RBX: 00007f1fe90733f0 RCX: 00007f1fe8fff349
[ 50.787956][ T3610] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 50.795923][ T3610] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 50.803893][ T3610] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f1fe90733f0
[ 50.811860][ T3610] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 50.819833][ T3610]
[ 50.822844][ T3610]
[ 50.825157][ T3610] Allocated by task 3610:
[ 50.829474][ T3610] kasan_save_stack+0x1e/0x40
[ 50.834154][ T3610] __kasan_kmalloc+0xa6/0xd0
[ 50.838738][ T3610] kmem_cache_alloc_trace+0x1ea/0x4a0
[ 50.844111][ T3610] vgem_gem_create_object+0x38/0xb0
[ 50.849303][ T3610] __drm_gem_shmem_create+0x80/0x480
[ 50.854586][ T3610] drm_gem_shmem_dumb_create+0x13c/0x380
[ 50.860217][ T3610] drm_mode_create_dumb+0x26c/0x2f0
[ 50.865412][ T3610] drm_ioctl_kernel+0x27d/0x4e0
[ 50.870262][ T3610] drm_ioctl+0x51e/0x9d0
[ 50.874500][ T3610] __x64_sys_ioctl+0x193/0x200
[ 50.879260][ T3610] do_syscall_64+0x35/0xb0
[ 50.883670][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 50.889564][ T3610]
[ 50.891877][ T3610] Freed by task 3610:
[ 50.895861][ T3610] kasan_save_stack+0x1e/0x40
[ 50.900537][ T3610] kasan_set_track+0x21/0x30
[ 50.905125][ T3610] kasan_set_free_info+0x20/0x30
[ 50.910063][ T3610] ____kasan_slab_free+0x13d/0x180
[ 50.915173][ T3610] kfree+0x113/0x310
[ 50.919080][ T3610] drm_gem_mmap+0x4fc/0x770
[ 50.923579][ T3610] mmap_region+0xbe7/0x1460
[ 50.928080][ T3610] do_mmap+0x863/0xfa0
[ 50.932150][ T3610] vm_mmap_pgoff+0x1b7/0x290
[ 50.936739][ T3610] ksys_mmap_pgoff+0x40d/0x5a0
[ 50.941508][ T3610] do_syscall_64+0x35/0xb0
[ 50.945922][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 50.951815][ T3610]
[ 50.954129][ T3610] The buggy address belongs to the object at ffff88802001c800
[ 50.954129][ T3610] which belongs to the cache kmalloc-1k of size 1024
[ 50.968175][ T3610] The buggy address is located 488 bytes inside of
[ 50.968175][ T3610] 1024-byte region [ffff88802001c800, ffff88802001cc00)
[ 50.981529][ T3610]
[ 50.983841][ T3610] The buggy address belongs to the physical page:
[ 50.990238][ T3610] page:ffffea0000800700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2001c
[ 51.000384][ T3610] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 51.007947][ T3610] raw: 00fff00000000200 ffffea0001d87cc8 ffffea0000707508 ffff888011840700
[ 51.016527][ T3610] raw: 0000000000000000 ffff88802001c000 0000000100000002 0000000000000000
[ 51.025101][ T3610] page dumped because: kasan: bad access detected
[ 51.031504][ T3610] page_owner tracks the page as allocated
[ 51.037204][ T3610] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 3610, tgid 3610 (syz-executor405), ts 50561118866, free_ts 50542682620
[ 51.057531][ T3610] get_page_from_freelist+0x1290/0x3b70
[ 51.063080][ T3610] __alloc_pages+0x1c7/0x510
[ 51.067664][ T3610] cache_grow_begin+0x75/0x350
[ 51.072424][ T3610] cache_alloc_refill+0x27f/0x380
[ 51.077449][ T3610] kmem_cache_alloc_trace+0x380/0x4a0
[ 51.082821][ T3610] vgem_gem_create_object+0x38/0xb0
[ 51.088020][ T3610] __drm_gem_shmem_create+0x80/0x480
[ 51.093301][ T3610] drm_gem_shmem_dumb_create+0x13c/0x380
[ 51.098930][ T3610] drm_mode_create_dumb+0x26c/0x2f0
[ 51.104126][ T3610] drm_ioctl_kernel+0x27d/0x4e0
[ 51.108973][ T3610] drm_ioctl+0x51e/0x9d0
[ 51.113213][ T3610] __x64_sys_ioctl+0x193/0x200
[ 51.117975][ T3610] do_syscall_64+0x35/0xb0
[ 51.122386][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 51.128277][ T3610] page last free stack trace:
[ 51.132936][ T3610] free_pcp_prepare+0x549/0xd20
[ 51.137788][ T3610] free_unref_page_list+0x16f/0xf80
[ 51.142982][ T3610] release_pages+0xff1/0x2290
[ 51.147656][ T3610] __pagevec_release+0x77/0x100
[ 51.152503][ T3610] shmem_undo_range+0x6d4/0x1560
[ 51.157444][ T3610] shmem_evict_inode+0x3c6/0xc20
[ 51.162381][ T3610] evict+0x2ed/0x6b0
[ 51.166274][ T3610] iput.part.0+0x562/0x820
[ 51.170691][ T3610] iput+0x58/0x70
[ 51.174328][ T3610] dentry_unlink_inode+0x2b1/0x460
[ 51.179438][ T3610] __dentry_kill+0x3c0/0x640
[ 51.184027][ T3610] dput+0x806/0xdb0
[ 51.187834][ T3610] __fput+0x39c/0x9d0
[ 51.191815][ T3610] task_work_run+0xdd/0x1a0
[ 51.196319][ T3610] do_exit+0xade/0x29d0
[ 51.200473][ T3610] do_group_exit+0xd2/0x2f0
[ 51.204975][ T3610]
[ 51.207291][ T3610] Memory state around the buggy address:
[ 51.212911][ T3610] ffff88802001c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 51.220970][ T3610] ffff88802001c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 51.229021][ T3610] >ffff88802001c980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 51.237069][ T3610] ^
[ 51.244511][ T3610] ffff88802001ca00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 51.252564][ T3610] ffff88802001ca80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 51.260611][ T3610] ==================================================================
[ 51.269214][ T3610] Kernel panic - not syncing: panic_on_warn set ...
[ 51.275806][ T3610] CPU: 1 PID: 3610 Comm: syz-executor405 Not tainted 5.19.0-rc6-syzkaller-00026-g5a29232d870d #0
[ 51.286318][ T3610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 51.296368][ T3610] Call Trace:
[ 51.299647][ T3610]
[ 51.302570][ T3610] dump_stack_lvl+0xcd/0x134
[ 51.307165][ T3610] panic+0x2d7/0x636
[ 51.311058][ T3610] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 51.317038][ T3610] ? preempt_schedule_common+0x59/0xc0
[ 51.322493][ T3610] ? drm_gem_object_release_handle+0xf2/0x110
[ 51.328570][ T3610] ? preempt_schedule_thunk+0x16/0x18
[ 51.333965][ T3610] ? drm_gem_object_release_handle+0xf2/0x110
[ 51.340035][ T3610] end_report.part.0+0x3f/0x7c
[ 51.344809][ T3610] kasan_report.cold+0x93/0x1c6
[ 51.349664][ T3610] ? drm_gem_object_release_handle+0xf2/0x110
[ 51.355744][ T3610] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 51.362336][ T3610] drm_gem_object_release_handle+0xf2/0x110
[ 51.368229][ T3610] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 51.374816][ T3610] idr_for_each+0x113/0x220
[ 51.379323][ T3610] ? idr_find+0x50/0x50
[ 51.383478][ T3610] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 51.389288][ T3610] drm_gem_release+0x22/0x30
[ 51.393889][ T3610] drm_file_free.part.0+0x805/0xb80
[ 51.399087][ T3610] ? fsnotify+0x13a0/0x13a0
[ 51.403600][ T3610] drm_close_helper.isra.0+0x17d/0x1f0
[ 51.409073][ T3610] drm_release+0x1e6/0x530
[ 51.413502][ T3610] __fput+0x277/0x9d0
[ 51.417492][ T3610] ? drm_release_noglobal+0x180/0x180
[ 51.422869][ T3610] task_work_run+0xdd/0x1a0
[ 51.427379][ T3610] do_exit+0xade/0x29d0
[ 51.431545][ T3610] ? mm_update_next_owner+0x7a0/0x7a0
[ 51.436927][ T3610] ? _raw_spin_unlock_irq+0x1f/0x40
[ 51.442130][ T3610] ? _raw_spin_unlock_irq+0x1f/0x40
[ 51.447334][ T3610] do_group_exit+0xd2/0x2f0
[ 51.451844][ T3610] __x64_sys_exit_group+0x3a/0x50
[ 51.456870][ T3610] do_syscall_64+0x35/0xb0
[ 51.461297][ T3610] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 51.467198][ T3610] RIP: 0033:0x7f1fe8fff349
[ 51.471610][ T3610] Code: Unable to access opcode bytes at RIP 0x7f1fe8fff31f.
[ 51.478964][ T3610] RSP: 002b:00007fff9da8e328 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 51.487376][ T3610] RAX: ffffffffffffffda RBX: 00007f1fe90733f0 RCX: 00007f1fe8fff349
[ 51.495342][ T3610] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 51.503305][ T3610] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 51.511271][ T3610] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f1fe90733f0
[ 51.519238][ T3610] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 51.527203][ T3610]
[ 51.530419][ T3610] Kernel Offset: disabled
[ 51.534740][ T3610] Rebooting in 86400 seconds..