./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3418779034
<...>
[ 22.924926][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0
[ 22.937396][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
syzkaller login: [ 32.218364][ T27] kauditd_printk_skb: 37 callbacks suppressed
[ 32.218379][ T27] audit: type=1400 audit(1665993200.042:73): avc: denied { transition } for pid=3391 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 32.246730][ T27] audit: type=1400 audit(1665993200.052:74): avc: denied { write } for pid=3391 comm="sh" path="pipe:[28582]" dev="pipefs" ino=28582 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
Warning: Permanently added '10.128.1.113' (ECDSA) to the list of known hosts.
execve("./syz-executor3418779034", ["./syz-executor3418779034"], 0x7ffec02a40b0 /* 10 vars */) = 0
brk(NULL) = 0x55555653e000
brk(0x55555653ec40) = 0x55555653ec40
arch_prctl(ARCH_SET_FS, 0x55555653e300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3418779034", 4096) = 28
brk(0x55555655fc40) = 0x55555655fc40
brk(0x555556560000) = 0x555556560000
mprotect(0x7fa05d43b000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555653e5d0) = 3605
./strace-static-x86_64: Process 3605 attached
[pid 3605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3605] setpgid(0, 0) = 0
[pid 3605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3605] write(3, "1000", 4) = 4
[pid 3605] close(3) = 0
[pid 3605] openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
[pid 3605] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000040) = 0
[pid 3605] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3605] write(4, "4", 1) = 1
[ 40.315353][ T27] audit: type=1400 audit(1665993208.142:75): avc: denied { execmem } for pid=3604 comm="syz-executor341" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 40.330424][ T3605] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64
[ 40.335796][ T27] audit: type=1400 audit(1665993208.142:76): avc: denied { read } for pid=3605 comm="syz-executor341" name="card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 40.342588][ T3605] audit: out of memory in audit_log_start
[ 40.371509][ T27] audit: type=1400 audit(1665993208.142:77): avc: denied { open } for pid=3605 comm="syz-executor341" path="/dev/dri/card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[pid 3605] mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = 0x20ffc000
[pid 3605] exit_group(0) = ?
[pid 3605] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3605, si_uid=0, si_status=0, si_utime=0, si_stime=9} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3606 attached
, child_tidptr=0x55555653e5d0) = 3606
[pid 3606] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3606] setpgid(0, 0) = 0
[pid 3606] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3606] write(3, "1000", 4) = 4
[pid 3606] close(3) = 0
[pid 3606] openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
[pid 3606] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000040) = 0
[pid 3606] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3606] write(4, "4", 1) = 1
[pid 3606] mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
[pid 3606] exit_group(0) = ?
[ 40.395921][ T27] audit: type=1400 audit(1665993208.142:78): avc: denied { ioctl } for pid=3605 comm="syz-executor341" path="/dev/dri/card0" dev="devtmpfs" ino=624 ioctlcmd=0x64b2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 40.430618][ T3606] ==================================================================
[ 40.438676][ T3606] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xa1/0xb0
[ 40.446996][ T3606] Read of size 8 at addr ffff8880216811e8 by task syz-executor341/3606
[ 40.455213][ T3606]
[ 40.457523][ T3606] CPU: 0 PID: 3606 Comm: syz-executor341 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
[ 40.467572][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
[ 40.477625][ T3606] Call Trace:
[ 40.480902][ T3606]
[ 40.483835][ T3606] dump_stack_lvl+0xcd/0x134
[ 40.488435][ T3606] print_report.cold+0x2ba/0x6e9
[ 40.493381][ T3606] ? drm_gem_object_release_handle+0xa1/0xb0
[ 40.499353][ T3606] kasan_report+0xb1/0x1e0
[ 40.503764][ T3606] ? drm_gem_object_release_handle+0xa1/0xb0
[ 40.509776][ T3606] drm_gem_object_release_handle+0xa1/0xb0
[ 40.515579][ T3606] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 40.522164][ T3606] idr_for_each+0x113/0x220
[ 40.526675][ T3606] ? idr_find+0x50/0x50
[ 40.530817][ T3606] ? rwlock_bug.part.0+0x90/0x90
[ 40.535740][ T3606] ? wait_for_completion_io_timeout+0x20/0x20
[ 40.541802][ T3606] drm_gem_release+0x22/0x30
[ 40.546394][ T3606] drm_file_free+0x7bb/0xb90
[ 40.550990][ T3606] ? drm_close_helper.isra.0+0x16b/0x1e0
[ 40.556611][ T3606] drm_release+0x1a6/0x4d0
[ 40.561021][ T3606] __fput+0x27c/0xa90
[ 40.564987][ T3606] ? drm_lastclose+0xe0/0xe0
[ 40.569569][ T3606] task_work_run+0xdd/0x1a0
[ 40.574062][ T3606] do_exit+0xb2f/0x2a20
[ 40.578217][ T3606] ? lock_downgrade+0x6e0/0x6e0
[ 40.583068][ T3606] ? do_raw_spin_lock+0x120/0x2a0
[ 40.588076][ T3606] ? mm_update_next_owner+0x7a0/0x7a0
[ 40.593440][ T3606] ? rwlock_bug.part.0+0x90/0x90
[ 40.598361][ T3606] do_group_exit+0xd0/0x2a0
[ 40.602856][ T3606] __x64_sys_exit_group+0x3a/0x50
[ 40.607873][ T3606] do_syscall_64+0x35/0xb0
[ 40.612277][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 40.618161][ T3606] RIP: 0033:0x7fa05d3cd349
[ 40.622555][ T3606] Code: Unable to access opcode bytes at 0x7fa05d3cd31f.
[ 40.629556][ T3606] RSP: 002b:00007ffd9724e868 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 40.637956][ T3606] RAX: ffffffffffffffda RBX: 00007fa05d4413f0 RCX: 00007fa05d3cd349
[ 40.645914][ T3606] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 40.653873][ T3606] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 40.661830][ T3606] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fa05d4413f0
[ 40.669793][ T3606] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 40.677764][ T3606]
[ 40.680783][ T3606]
[ 40.683092][ T3606] Allocated by task 3606:
[ 40.687400][ T3606] kasan_save_stack+0x1e/0x40
[ 40.692063][ T3606] __kasan_kmalloc+0xa6/0xd0
[ 40.696636][ T3606] kmem_cache_alloc_trace+0x25a/0x460
[ 40.701999][ T3606] vgem_gem_create_object+0x38/0xb0
[ 40.707190][ T3606] __drm_gem_shmem_create+0x80/0x480
[ 40.712468][ T3606] drm_gem_shmem_dumb_create+0x13c/0x380
[ 40.718111][ T3606] drm_mode_create_dumb+0x26c/0x2f0
[ 40.723307][ T3606] drm_ioctl_kernel+0x27d/0x4e0
[ 40.728145][ T3606] drm_ioctl+0x3e2/0xa30
[ 40.732374][ T3606] __x64_sys_ioctl+0x193/0x200
[ 40.737145][ T3606] do_syscall_64+0x35/0xb0
[ 40.741571][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 40.747473][ T3606]
[ 40.749778][ T3606] Freed by task 3606:
[ 40.753736][ T3606] kasan_save_stack+0x1e/0x40
[ 40.758396][ T3606] kasan_set_track+0x21/0x30
[ 40.762975][ T3606] kasan_set_free_info+0x20/0x30
[ 40.767926][ T3606] ____kasan_slab_free+0x13d/0x1a0
[ 40.773040][ T3606] kfree+0x173/0x390
[ 40.776935][ T3606] drm_gem_mmap+0x4fc/0x770
[ 40.781441][ T3606] mmap_region+0xbff/0x1460
[ 40.785951][ T3606] do_mmap+0x863/0xfa0
[ 40.790007][ T3606] vm_mmap_pgoff+0x1ab/0x270
[ 40.794587][ T3606] ksys_mmap_pgoff+0x41b/0x5a0
[ 40.799338][ T3606] do_syscall_64+0x35/0xb0
[ 40.803751][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 40.809652][ T3606]
[ 40.811957][ T3606] The buggy address belongs to the object at ffff888021681000
[ 40.811957][ T3606] which belongs to the cache kmalloc-1k of size 1024
[ 40.826000][ T3606] The buggy address is located 488 bytes inside of
[ 40.826000][ T3606] 1024-byte region [ffff888021681000, ffff888021681400)
[ 40.839383][ T3606]
[ 40.841693][ T3606] The buggy address belongs to the physical page:
[ 40.848089][ T3606] page:ffffea000085a040 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21681
[ 40.858229][ T3606] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 40.865781][ T3606] raw: 00fff00000000200 ffffea00005dfdc8 ffffea0000758308 ffff888011840700
[ 40.874361][ T3606] raw: 0000000000000000 ffff888021681000 0000000100000002 0000000000000000
[ 40.882947][ T3606] page dumped because: kasan: bad access detected
[ 40.889349][ T3606] page_owner tracks the page as allocated
[ 40.895044][ T3606] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2c20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_THISNODE), pid 2970, tgid 2970 (udevd), ts 15958838761, free_ts 15956736676
[ 40.915951][ T3606] get_page_from_freelist+0x109b/0x2ce0
[ 40.921501][ T3606] __alloc_pages+0x1c7/0x510
[ 40.926085][ T3606] cache_grow_begin+0x75/0x360
[ 40.930864][ T3606] cache_alloc_refill+0x27f/0x380
[ 40.935881][ T3606] kmem_cache_alloc_node_trace+0x50a/0x570
[ 40.941679][ T3606] __kmalloc_node_track_caller+0x38/0x60
[ 40.947307][ T3606] __alloc_skb+0xd9/0x2f0
[ 40.951624][ T3606] netlink_sendmsg+0x9a2/0xe10
[ 40.956372][ T3606] sock_sendmsg+0xcf/0x120
[ 40.960787][ T3606] ____sys_sendmsg+0x712/0x8c0
[ 40.965556][ T3606] ___sys_sendmsg+0x110/0x1b0
[ 40.970258][ T3606] __sys_sendmsg+0xf3/0x1c0
[ 40.974748][ T3606] do_syscall_64+0x35/0xb0
[ 40.979165][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 40.985069][ T3606] page last free stack trace:
[ 40.989721][ T3606] free_pcp_prepare+0x5e4/0xd20
[ 40.994558][ T3606] free_unref_page+0x19/0x4d0
[ 40.999222][ T3606] inode_doinit_with_dentry+0x868/0x12e0
[ 41.004842][ T3606] selinux_d_instantiate+0x23/0x30
[ 41.009942][ T3606] security_d_instantiate+0x50/0xe0
[ 41.015156][ T3606] d_splice_alias+0x8c/0xd30
[ 41.019729][ T3606] kernfs_iop_lookup+0x27f/0x320
[ 41.024651][ T3606] __lookup_slow+0x24c/0x460
[ 41.029228][ T3606] walk_component+0x33f/0x5a0
[ 41.033890][ T3606] path_lookupat+0x1ba/0x840
[ 41.038472][ T3606] filename_lookup+0x1ce/0x590
[ 41.043242][ T3606] vfs_statx+0x14c/0x430
[ 41.047471][ T3606] vfs_fstatat+0x8c/0xb0
[ 41.051700][ T3606] __do_sys_newfstatat+0x94/0x120
[ 41.056714][ T3606] do_syscall_64+0x35/0xb0
[ 41.061118][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.066999][ T3606]
[ 41.069312][ T3606] Memory state around the buggy address:
[ 41.074934][ T3606] ffff888021681080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.082977][ T3606] ffff888021681100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.091020][ T3606] >ffff888021681180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.099061][ T3606] ^
[ 41.106498][ T3606] ffff888021681200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.114539][ T3606] ffff888021681280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.122575][ T3606] ==================================================================
[ 41.130858][ T3606] Kernel panic - not syncing: panic_on_warn set ...
[ 41.137443][ T3606] CPU: 0 PID: 3606 Comm: syz-executor341 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
[ 41.147505][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
[ 41.157552][ T3606] Call Trace:
[ 41.160824][ T3606]
[ 41.163754][ T3606] dump_stack_lvl+0xcd/0x134
[ 41.168353][ T3606] panic+0x2c8/0x622
[ 41.172258][ T3606] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 41.178351][ T3606] ? preempt_schedule_common+0x59/0xc0
[ 41.183819][ T3606] ? preempt_schedule_thunk+0x16/0x18
[ 41.189204][ T3606] ? drm_gem_object_release_handle+0xa1/0xb0
[ 41.195197][ T3606] end_report.part.0+0x3f/0x7c
[ 41.199973][ T3606] kasan_report.cold+0xa/0xf
[ 41.204576][ T3606] ? drm_gem_object_release_handle+0xa1/0xb0
[ 41.210567][ T3606] drm_gem_object_release_handle+0xa1/0xb0
[ 41.216385][ T3606] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 41.222985][ T3606] idr_for_each+0x113/0x220
[ 41.227487][ T3606] ? idr_find+0x50/0x50
[ 41.231650][ T3606] ? rwlock_bug.part.0+0x90/0x90
[ 41.236592][ T3606] ? wait_for_completion_io_timeout+0x20/0x20
[ 41.242679][ T3606] drm_gem_release+0x22/0x30
[ 41.247282][ T3606] drm_file_free+0x7bb/0xb90
[ 41.251881][ T3606] ? drm_close_helper.isra.0+0x16b/0x1e0
[ 41.257525][ T3606] drm_release+0x1a6/0x4d0
[ 41.261952][ T3606] __fput+0x27c/0xa90
[ 41.265933][ T3606] ? drm_lastclose+0xe0/0xe0
[ 41.270530][ T3606] task_work_run+0xdd/0x1a0
[ 41.275043][ T3606] do_exit+0xb2f/0x2a20
[ 41.279211][ T3606] ? lock_downgrade+0x6e0/0x6e0
[ 41.284058][ T3606] ? do_raw_spin_lock+0x120/0x2a0
[ 41.289085][ T3606] ? mm_update_next_owner+0x7a0/0x7a0
[ 41.294469][ T3606] ? rwlock_bug.part.0+0x90/0x90
[ 41.299407][ T3606] do_group_exit+0xd0/0x2a0
[ 41.303925][ T3606] __x64_sys_exit_group+0x3a/0x50
[ 41.308959][ T3606] do_syscall_64+0x35/0xb0
[ 41.313384][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.319283][ T3606] RIP: 0033:0x7fa05d3cd349
[ 41.323694][ T3606] Code: Unable to access opcode bytes at 0x7fa05d3cd31f.
[ 41.330701][ T3606] RSP: 002b:00007ffd9724e868 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 41.339114][ T3606] RAX: ffffffffffffffda RBX: 00007fa05d4413f0 RCX: 00007fa05d3cd349
[ 41.347084][ T3606] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 41.355137][ T3606] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 41.363106][ T3606] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fa05d4413f0
[ 41.371075][ T3606] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 41.379043][ T3606]
[ 41.382223][ T3606] Kernel Offset: disabled
[ 41.386538][ T3606] Rebooting in 86400 seconds..