./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1369318500

<...>
forked to background, child pid 3185
no interfaces have a carri[   22.001219][ T3186] 8021q: adding VLAN 0 to HW filter on device bond0
er
[   22.016665][ T3186] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.0.81' (ECDSA) to the list of known hosts.
execve("./syz-executor1369318500", ["./syz-executor1369318500"], 0x7fff6f96a000 /* 10 vars */) = 0
brk(NULL)                               = 0x5555555f6000
brk(0x5555555f6c40)                     = 0x5555555f6c40
arch_prctl(ARCH_SET_FS, 0x5555555f6300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1369318500", 4096) = 28
brk(0x555555617c40)                     = 0x555555617c40
brk(0x555555618000)                     = 0x555555618000
mprotect(0x7f11df49a000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid()                                = 3613
openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3
write(3, "10000000000", 11)             = 11
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3
write(3, "20", 2)                       = 2
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
write(3, "100", 3)                      = 3
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3
write(3, "7 4 1 3", 7)                  = 7
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3
write(3, "3613", 4)                     = 4
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000040) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "4", 1)                        = 1
mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0)                           = ?
syzkaller login: [   38.587145][ T3613] ==================================================================
[   38.595259][ T3613] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xa1/0xb0
[   38.603592][ T3613] Read of size 8 at addr ffff8881474549e8 by task syz-executor136/3613
[   38.611953][ T3613] 
[   38.614280][ T3613] CPU: 0 PID: 3613 Comm: syz-executor136 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
[   38.624349][ T3613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
[   38.634494][ T3613] Call Trace:
[   38.637773][ T3613]  <TASK>
[   38.640709][ T3613]  dump_stack_lvl+0xcd/0x134
[   38.645316][ T3613]  print_report.cold+0x2ba/0x719
[   38.650604][ T3613]  ? drm_gem_object_release_handle+0xa1/0xb0
[   38.656610][ T3613]  kasan_report+0xb1/0x1e0
[   38.661058][ T3613]  ? drm_gem_object_release_handle+0xa1/0xb0
[   38.667243][ T3613]  drm_gem_object_release_handle+0xa1/0xb0
[   38.673069][ T3613]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   38.679662][ T3613]  idr_for_each+0x113/0x220
[   38.684175][ T3613]  ? idr_find+0x50/0x50
[   38.688341][ T3613]  ? rwlock_bug.part.0+0x90/0x90
[   38.693283][ T3613]  ? wait_for_completion_io_timeout+0x20/0x20
[   38.699367][ T3613]  drm_gem_release+0x22/0x30
[   38.703968][ T3613]  drm_file_free+0x7bb/0xb90
[   38.708680][ T3613]  ? drm_close_helper.isra.0+0x16b/0x1e0
[   38.714321][ T3613]  drm_release+0x1a6/0x4d0
[   38.718842][ T3613]  __fput+0x27c/0xa90
[   38.722837][ T3613]  ? drm_lastclose+0xe0/0xe0
[   38.727442][ T3613]  task_work_run+0xdd/0x1a0
[   38.731961][ T3613]  do_exit+0xb2f/0x2a20
[   38.736184][ T3613]  ? lock_downgrade+0x6e0/0x6e0
[   38.741072][ T3613]  ? do_raw_spin_lock+0x120/0x2a0
[   38.746111][ T3613]  ? mm_update_next_owner+0x7a0/0x7a0
[   38.751490][ T3613]  ? rwlock_bug.part.0+0x90/0x90
[   38.756520][ T3613]  do_group_exit+0xd0/0x2a0
[   38.761051][ T3613]  __x64_sys_exit_group+0x3a/0x50
[   38.766077][ T3613]  do_syscall_64+0x35/0xb0
[   38.770503][ T3613]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   38.776412][ T3613] RIP: 0033:0x7f11df434709
[   38.780834][ T3613] Code: Unable to access opcode bytes at 0x7f11df4346df.
[   38.787879][ T3613] RSP: 002b:00007ffe6b342388 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   38.796305][ T3613] RAX: ffffffffffffffda RBX: 00007f11df4a03d0 RCX: 00007f11df434709
[   38.804727][ T3613] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   38.812808][ T3613] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[   38.820798][ T3613] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f11df4a03d0
[   38.828786][ T3613] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   38.836776][ T3613]  </TASK>
[   38.839797][ T3613] 
[   38.842121][ T3613] Allocated by task 3613:
[   38.846463][ T3613]  kasan_save_stack+0x1e/0x40
[   38.851335][ T3613]  __kasan_kmalloc+0xa9/0xd0
[   38.855933][ T3613]  vgem_gem_create_object+0x38/0xb0
[   38.861135][ T3613]  __drm_gem_shmem_create+0x80/0x480
[   38.866449][ T3613]  drm_gem_shmem_dumb_create+0x13c/0x380
[   38.872113][ T3613]  drm_mode_create_dumb+0x26c/0x2f0
[   38.877346][ T3613]  drm_ioctl_kernel+0x27d/0x4e0
[   38.882987][ T3613]  drm_ioctl+0x3e2/0xa30
[   38.887238][ T3613]  __x64_sys_ioctl+0x193/0x200
[   38.892009][ T3613]  do_syscall_64+0x35/0xb0
[   38.896449][ T3613]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   38.902378][ T3613] 
[   38.904729][ T3613] Freed by task 3613:
[   38.908712][ T3613]  kasan_save_stack+0x1e/0x40
[   38.913407][ T3613]  kasan_set_track+0x21/0x30
[   38.918084][ T3613]  kasan_set_free_info+0x20/0x30
[   38.923032][ T3613]  ____kasan_slab_free+0x166/0x1c0
[   38.928162][ T3613]  slab_free_freelist_hook+0x8b/0x1c0
[   38.933544][ T3613]  kfree+0xe2/0x580
[   38.937368][ T3613]  drm_gem_mmap+0x4fc/0x770
[   38.942046][ T3613]  mmap_region+0xbff/0x1460
[   38.946569][ T3613]  do_mmap+0x863/0xfa0
[   38.950666][ T3613]  vm_mmap_pgoff+0x1ab/0x270
[   38.955277][ T3613]  ksys_mmap_pgoff+0x41b/0x5a0
[   38.960071][ T3613]  do_syscall_64+0x35/0xb0
[   38.964505][ T3613]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   38.970405][ T3613] 
[   38.972722][ T3613] The buggy address belongs to the object at ffff888147454800
[   38.972722][ T3613]  which belongs to the cache kmalloc-1k of size 1024
[   38.986801][ T3613] The buggy address is located 488 bytes inside of
[   38.986801][ T3613]  1024-byte region [ffff888147454800, ffff888147454c00)
[   39.000196][ T3613] 
[   39.002520][ T3613] The buggy address belongs to the physical page:
[   39.008946][ T3613] page:ffffea00051d1400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147450
[   39.019189][ T3613] head:ffffea00051d1400 order:3 compound_mapcount:0 compound_pincount:0
[   39.027523][ T3613] flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff)
[   39.035704][ T3613] raw: 057ff00000010200 ffffea000502cc00 dead000000000002 ffff888011841dc0
[   39.044307][ T3613] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   39.052890][ T3613] page dumped because: kasan: bad access detected
[   39.059389][ T3613] page_owner tracks the page as allocated
[   39.065097][ T3613] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 7647585359, free_ts 0
[   39.084730][ T3613]  get_page_from_freelist+0x109b/0x2ce0
[   39.090301][ T3613]  __alloc_pages+0x1c7/0x510
[   39.094909][ T3613]  alloc_page_interleave+0x1e/0x200
[   39.100200][ T3613]  alloc_pages+0x22f/0x270
[   39.104635][ T3613]  allocate_slab+0x27e/0x3d0
[   39.109234][ T3613]  ___slab_alloc+0x84f/0xe80
[   39.113831][ T3613]  __slab_alloc.constprop.0+0x4d/0xa0
[   39.119233][ T3613]  kmem_cache_alloc_trace+0x323/0x3e0
[   39.124626][ T3613]  loop_add+0x4b/0xaf0
[   39.128706][ T3613]  loop_init+0x1f4/0x216
[   39.132948][ T3613]  do_one_initcall+0xfe/0x650
[   39.137632][ T3613]  kernel_init_freeable+0x6b1/0x73a
[   39.142847][ T3613]  kernel_init+0x1a/0x1d0
[   39.147226][ T3613]  ret_from_fork+0x1f/0x30
[   39.151656][ T3613] page_owner free stack trace missing
[   39.157016][ T3613] 
[   39.159337][ T3613] Memory state around the buggy address:
[   39.165055][ T3613]  ffff888147454880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.173208][ T3613]  ffff888147454900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.181268][ T3613] >ffff888147454980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.189325][ T3613]                                                           ^
[   39.196863][ T3613]  ffff888147454a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.204931][ T3613]  ffff888147454a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.212988][ T3613] ==================================================================
[   39.226220][ T3613] Kernel panic - not syncing: panic_on_warn set ...
[   39.232836][ T3613] CPU: 0 PID: 3613 Comm: syz-executor136 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
[   39.242979][ T3613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
[   39.253024][ T3613] Call Trace:
[   39.256291][ T3613]  <TASK>
[   39.259210][ T3613]  dump_stack_lvl+0xcd/0x134
[   39.263797][ T3613]  panic+0x2c8/0x622
[   39.267684][ T3613]  ? panic_print_sys_info.part.0+0x10b/0x10b
[   39.273680][ T3613]  ? preempt_schedule_common+0x59/0xc0
[   39.279145][ T3613]  ? preempt_schedule_thunk+0x16/0x18
[   39.284516][ T3613]  ? drm_gem_object_release_handle+0xa1/0xb0
[   39.290490][ T3613]  end_report.part.0+0x3f/0x7c
[   39.295256][ T3613]  kasan_report.cold+0xa/0xf
[   39.299857][ T3613]  ? drm_gem_object_release_handle+0xa1/0xb0
[   39.306022][ T3613]  drm_gem_object_release_handle+0xa1/0xb0
[   39.311840][ T3613]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   39.318438][ T3613]  idr_for_each+0x113/0x220
[   39.322975][ T3613]  ? idr_find+0x50/0x50
[   39.327243][ T3613]  ? rwlock_bug.part.0+0x90/0x90
[   39.332371][ T3613]  ? wait_for_completion_io_timeout+0x20/0x20
[   39.338491][ T3613]  drm_gem_release+0x22/0x30
[   39.343105][ T3613]  drm_file_free+0x7bb/0xb90
[   39.347705][ T3613]  ? drm_close_helper.isra.0+0x16b/0x1e0
[   39.353347][ T3613]  drm_release+0x1a6/0x4d0
[   39.357768][ T3613]  __fput+0x27c/0xa90
[   39.361759][ T3613]  ? drm_lastclose+0xe0/0xe0
[   39.366466][ T3613]  task_work_run+0xdd/0x1a0
[   39.370989][ T3613]  do_exit+0xb2f/0x2a20
[   39.375159][ T3613]  ? lock_downgrade+0x6e0/0x6e0
[   39.380011][ T3613]  ? do_raw_spin_lock+0x120/0x2a0
[   39.385039][ T3613]  ? mm_update_next_owner+0x7a0/0x7a0
[   39.390414][ T3613]  ? rwlock_bug.part.0+0x90/0x90
[   39.395362][ T3613]  do_group_exit+0xd0/0x2a0
[   39.399877][ T3613]  __x64_sys_exit_group+0x3a/0x50
[   39.404905][ T3613]  do_syscall_64+0x35/0xb0
[   39.409343][ T3613]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   39.415255][ T3613] RIP: 0033:0x7f11df434709
[   39.419678][ T3613] Code: Unable to access opcode bytes at 0x7f11df4346df.
[   39.426695][ T3613] RSP: 002b:00007ffe6b342388 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   39.435117][ T3613] RAX: ffffffffffffffda RBX: 00007f11df4a03d0 RCX: 00007f11df434709
[   39.443095][ T3613] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   39.451069][ T3613] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[   39.459116][ T3613] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f11df4a03d0
[   39.467089][ T3613] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   39.475070][ T3613]  </TASK>
[   39.478277][ T3613] Kernel Offset: disabled
[   39.482597][ T3613] Rebooting in 86400 seconds..