./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2730841917
<...>
[ 24.052228][ T3184] 8021q: adding VLAN 0 to HW filter on device bond0
[ 24.065072][ T3184] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
syzkaller login: [ 33.784884][ T27] kauditd_printk_skb: 37 callbacks suppressed
[ 33.784899][ T27] audit: type=1400 audit(1665864894.049:73): avc: denied { transition } for pid=3392 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 33.813068][ T27] audit: type=1400 audit(1665864894.059:74): avc: denied { write } for pid=3392 comm="sh" path="pipe:[28198]" dev="pipefs" ino=28198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
Warning: Permanently added '10.128.0.133' (ECDSA) to the list of known hosts.
execve("./syz-executor2730841917", ["./syz-executor2730841917"], 0x7ffef3afdb20 /* 10 vars */) = 0
brk(NULL) = 0x555555f98000
brk(0x555555f98c40) = 0x555555f98c40
arch_prctl(ARCH_SET_FS, 0x555555f98300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2730841917", 4096) = 28
brk(0x555555fb9c40) = 0x555555fb9c40
brk(0x555555fba000) = 0x555555fba000
mprotect(0x7f40207fc000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555f985d0) = 3606
./strace-static-x86_64: Process 3606 attached
[pid 3606] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3606] setpgid(0, 0) = 0
[pid 3606] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3606] write(3, "1000", 4) = 4
[pid 3606] close(3) = 0
[pid 3606] openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
[pid 3606] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000080) = 0
[pid 3606] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3606] write(4, "4", 1) = 1
[ 43.313479][ T27] audit: type=1400 audit(1665864903.579:75): avc: denied { execmem } for pid=3605 comm="syz-executor273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 43.333418][ T27] audit: type=1400 audit(1665864903.599:76): avc: denied { read } for pid=3606 comm="syz-executor273" name="card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 43.337704][ T3606] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64
[ 43.357018][ T27] audit: type=1400 audit(1665864903.599:77): avc: denied { open } for pid=3606 comm="syz-executor273" path="/dev/dri/card0" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 43.364724][ T3606] audit: out of memory in audit_log_start
[pid 3606] mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = 0x20ffc000
[pid 3606] exit_group(0) = ?
[pid 3606] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3606, si_uid=0, si_status=0, si_utime=0, si_stime=9} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555f985d0) = 3607
./strace-static-x86_64: Process 3607 attached
[pid 3607] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3607] setpgid(0, 0) = 0
[pid 3607] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3607] write(3, "1000", 4) = 4
[pid 3607] close(3) = 0
[pid 3607] openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
[pid 3607] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000080) = 0
[pid 3607] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3607] write(4, "4", 1) = 1
[pid 3607] mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
[pid 3607] exit_group(0) = ?
[ 43.388496][ T27] audit: type=1400 audit(1665864903.599:78): avc: denied { ioctl } for pid=3606 comm="syz-executor273" path="/dev/dri/card0" dev="devtmpfs" ino=624 ioctlcmd=0x64b2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1
[ 43.437930][ T3607] ==================================================================
[ 43.446228][ T3607] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xa1/0xb0
[ 43.454550][ T3607] Read of size 8 at addr ffff88801d3ff9e8 by task syz-executor273/3607
[ 43.462771][ T3607]
[ 43.465078][ T3607] CPU: 0 PID: 3607 Comm: syz-executor273 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
[ 43.475125][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
[ 43.485247][ T3607] Call Trace:
[ 43.488516][ T3607] <TASK>
[ 43.491438][ T3607] dump_stack_lvl+0xcd/0x134
[ 43.496019][ T3607] print_report.cold+0x2ba/0x6e9
[ 43.500952][ T3607] ? drm_gem_object_release_handle+0xa1/0xb0
[ 43.506925][ T3607] kasan_report+0xb1/0x1e0
[ 43.511334][ T3607] ? drm_gem_object_release_handle+0xa1/0xb0
[ 43.517305][ T3607] drm_gem_object_release_handle+0xa1/0xb0
[ 43.523104][ T3607] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 43.529688][ T3607] idr_for_each+0x113/0x220
[ 43.534185][ T3607] ? idr_find+0x50/0x50
[ 43.538332][ T3607] ? rwlock_bug.part.0+0x90/0x90
[ 43.543256][ T3607] ? wait_for_completion_io_timeout+0x20/0x20
[ 43.549316][ T3607] drm_gem_release+0x22/0x30
[ 43.553905][ T3607] drm_file_free+0x7bb/0xb90
[ 43.558495][ T3607] ? drm_close_helper.isra.0+0x16b/0x1e0
[ 43.564121][ T3607] drm_release+0x1a6/0x4d0
[ 43.568525][ T3607] __fput+0x27c/0xa90
[ 43.572507][ T3607] ? drm_lastclose+0xe0/0xe0
[ 43.577095][ T3607] task_work_run+0xdd/0x1a0
[ 43.581598][ T3607] do_exit+0xb2f/0x2a20
[ 43.585756][ T3607] ? lock_downgrade+0x6e0/0x6e0
[ 43.590598][ T3607] ? do_raw_spin_lock+0x120/0x2a0
[ 43.595617][ T3607] ? mm_update_next_owner+0x7a0/0x7a0
[ 43.601600][ T3607] ? rwlock_bug.part.0+0x90/0x90
[ 43.606535][ T3607] do_group_exit+0xd0/0x2a0
[ 43.611035][ T3607] __x64_sys_exit_group+0x3a/0x50
[ 43.616058][ T3607] do_syscall_64+0x35/0xb0
[ 43.620470][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 43.626353][ T3607] RIP: 0033:0x7f402078e349
[ 43.630750][ T3607] Code: Unable to access opcode bytes at 0x7f402078e31f.
[ 43.637748][ T3607] RSP: 002b:00007ffd2d9d1c18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 43.646163][ T3607] RAX: ffffffffffffffda RBX: 00007f40208023f0 RCX: 00007f402078e349
[ 43.654134][ T3607] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 43.662089][ T3607] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 43.670043][ T3607] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f40208023f0
[ 43.677996][ T3607] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 43.685951][ T3607] </TASK>
[ 43.688952][ T3607]
[ 43.691266][ T3607] Allocated by task 3607:
[ 43.695753][ T3607] kasan_save_stack+0x1e/0x40
[ 43.700434][ T3607] __kasan_kmalloc+0xa6/0xd0
[ 43.705005][ T3607] kmem_cache_alloc_trace+0x25a/0x460
[ 43.710369][ T3607] vgem_gem_create_object+0x38/0xb0
[ 43.715556][ T3607] __drm_gem_shmem_create+0x80/0x480
[ 43.720825][ T3607] drm_gem_shmem_dumb_create+0x13c/0x380
[ 43.726440][ T3607] drm_mode_create_dumb+0x26c/0x2f0
[ 43.731621][ T3607] drm_ioctl_kernel+0x27d/0x4e0
[ 43.736451][ T3607] drm_ioctl+0x3e2/0xa30
[ 43.740680][ T3607] __x64_sys_ioctl+0x193/0x200
[ 43.745432][ T3607] do_syscall_64+0x35/0xb0
[ 43.749835][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 43.755713][ T3607]
[ 43.758020][ T3607] Freed by task 3607:
[ 43.761975][ T3607] kasan_save_stack+0x1e/0x40
[ 43.766633][ T3607] kasan_set_track+0x21/0x30
[ 43.771203][ T3607] kasan_set_free_info+0x20/0x30
[ 43.776124][ T3607] ____kasan_slab_free+0x13d/0x1a0
[ 43.781217][ T3607] kfree+0x173/0x390
[ 43.785100][ T3607] drm_gem_mmap+0x4fc/0x770
[ 43.789599][ T3607] mmap_region+0xbff/0x1460
[ 43.794089][ T3607] do_mmap+0x863/0xfa0
[ 43.798141][ T3607] vm_mmap_pgoff+0x1ab/0x270
[ 43.802722][ T3607] ksys_mmap_pgoff+0x41b/0x5a0
[ 43.807477][ T3607] do_syscall_64+0x35/0xb0
[ 43.811884][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 43.817763][ T3607]
[ 43.820074][ T3607] The buggy address belongs to the object at ffff88801d3ff800
[ 43.820074][ T3607] which belongs to the cache kmalloc-1k of size 1024
[ 43.834105][ T3607] The buggy address is located 488 bytes inside of
[ 43.834105][ T3607] 1024-byte region [ffff88801d3ff800, ffff88801d3ffc00)
[ 43.847447][ T3607]
[ 43.849762][ T3607] The buggy address belongs to the physical page:
[ 43.856150][ T3607] page:ffffea000074ffc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d3ff
[ 43.866282][ T3607] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 43.873899][ T3607] raw: 00fff00000000200 ffffea000074ff88 ffffea00008c8f88 ffff888011840700
[ 43.882468][ T3607] raw: 0000000000000000 ffff88801d3ff000 0000000100000002 0000000000000000
[ 43.891027][ T3607] page dumped because: kasan: bad access detected
[ 43.897416][ T3607] page_owner tracks the page as allocated
[ 43.903106][ T3607] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 3607, tgid 3607 (syz-executor273), ts 43433794900, free_ts 43426593008
[ 43.923502][ T3607] get_page_from_freelist+0x109b/0x2ce0
[ 43.929043][ T3607] __alloc_pages+0x1c7/0x510
[ 43.933624][ T3607] cache_grow_begin+0x75/0x360
[ 43.938382][ T3607] cache_alloc_refill+0x27f/0x380
[ 43.943401][ T3607] kmem_cache_alloc_trace+0x362/0x460
[ 43.948770][ T3607] vgem_gem_create_object+0x38/0xb0
[ 43.953966][ T3607] __drm_gem_shmem_create+0x80/0x480
[ 43.959240][ T3607] drm_gem_shmem_dumb_create+0x13c/0x380
[ 43.964858][ T3607] drm_mode_create_dumb+0x26c/0x2f0
[ 43.970039][ T3607] drm_ioctl_kernel+0x27d/0x4e0
[ 43.974879][ T3607] drm_ioctl+0x3e2/0xa30
[ 43.979100][ T3607] __x64_sys_ioctl+0x193/0x200
[ 43.983853][ T3607] do_syscall_64+0x35/0xb0
[ 43.988293][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 43.994187][ T3607] page last free stack trace:
[ 43.998836][ T3607] free_pcp_prepare+0x5e4/0xd20
[ 44.003675][ T3607] free_unref_page_list+0x16f/0xb90
[ 44.008880][ T3607] release_pages+0xbd3/0x1400
[ 44.013544][ T3607] __pagevec_release+0x77/0x100
[ 44.018383][ T3607] shmem_undo_range+0x88f/0x1500
[ 44.023307][ T3607] shmem_evict_inode+0x3c6/0xc20
[ 44.028232][ T3607] evict+0x2ed/0x6b0
[ 44.032112][ T3607] iput.part.0+0x55d/0x810
[ 44.036523][ T3607] iput+0x58/0x70
[ 44.040146][ T3607] dentry_unlink_inode+0x2b1/0x460
[ 44.045241][ T3607] __dentry_kill+0x3c0/0x640
[ 44.049811][ T3607] dput+0x806/0xdb0
[ 44.053603][ T3607] __fput+0x3cc/0xa90
[ 44.057567][ T3607] task_work_run+0xdd/0x1a0
[ 44.062057][ T3607] do_exit+0xb2f/0x2a20
[ 44.066204][ T3607] do_group_exit+0xd0/0x2a0
[ 44.070733][ T3607]
[ 44.073039][ T3607] Memory state around the buggy address:
[ 44.078647][ T3607] ffff88801d3ff880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.086991][ T3607] ffff88801d3ff900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.095036][ T3607] >ffff88801d3ff980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.103075][ T3607] ^
[ 44.110504][ T3607] ffff88801d3ffa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.118570][ T3607] ffff88801d3ffa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 44.126610][ T3607] ==================================================================
[ 44.135076][ T3607] Kernel panic - not syncing: panic_on_warn set ...
[ 44.141677][ T3607] CPU: 0 PID: 3607 Comm: syz-executor273 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
[ 44.151750][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
[ 44.161791][ T3607] Call Trace:
[ 44.165064][ T3607] <TASK>
[ 44.167992][ T3607] dump_stack_lvl+0xcd/0x134
[ 44.172573][ T3607] panic+0x2c8/0x622
[ 44.176459][ T3607] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 44.182437][ T3607] ? preempt_schedule_common+0x59/0xc0
[ 44.187897][ T3607] ? preempt_schedule_thunk+0x16/0x18
[ 44.193261][ T3607] ? drm_gem_object_release_handle+0xa1/0xb0
[ 44.199239][ T3607] end_report.part.0+0x3f/0x7c
[ 44.203996][ T3607] kasan_report.cold+0xa/0xf
[ 44.208579][ T3607] ? drm_gem_object_release_handle+0xa1/0xb0
[ 44.214555][ T3607] drm_gem_object_release_handle+0xa1/0xb0
[ 44.220357][ T3607] ? drm_gem_object_handle_put_unlocked+0x390/0x390
[ 44.227024][ T3607] idr_for_each+0x113/0x220
[ 44.231519][ T3607] ? idr_find+0x50/0x50
[ 44.235662][ T3607] ? rwlock_bug.part.0+0x90/0x90
[ 44.240589][ T3607] ? wait_for_completion_io_timeout+0x20/0x20
[ 44.246651][ T3607] drm_gem_release+0x22/0x30
[ 44.251237][ T3607] drm_file_free+0x7bb/0xb90
[ 44.255823][ T3607] ? drm_close_helper.isra.0+0x16b/0x1e0
[ 44.261450][ T3607] drm_release+0x1a6/0x4d0
[ 44.265856][ T3607] __fput+0x27c/0xa90
[ 44.269830][ T3607] ? drm_lastclose+0xe0/0xe0
[ 44.274439][ T3607] task_work_run+0xdd/0x1a0
[ 44.278935][ T3607] do_exit+0xb2f/0x2a20
[ 44.283085][ T3607] ? lock_downgrade+0x6e0/0x6e0
[ 44.287921][ T3607] ? do_raw_spin_lock+0x120/0x2a0
[ 44.292929][ T3607] ? mm_update_next_owner+0x7a0/0x7a0
[ 44.298299][ T3607] ? rwlock_bug.part.0+0x90/0x90
[ 44.303247][ T3607] do_group_exit+0xd0/0x2a0
[ 44.307757][ T3607] __x64_sys_exit_group+0x3a/0x50
[ 44.312778][ T3607] do_syscall_64+0x35/0xb0
[ 44.317188][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 44.323075][ T3607] RIP: 0033:0x7f402078e349
[ 44.327478][ T3607] Code: Unable to access opcode bytes at 0x7f402078e31f.
[ 44.334474][ T3607] RSP: 002b:00007ffd2d9d1c18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 44.342868][ T3607] RAX: ffffffffffffffda RBX: 00007f40208023f0 RCX: 00007f402078e349
[ 44.350825][ T3607] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 44.358782][ T3607] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[ 44.366739][ T3607] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f40208023f0
[ 44.374707][ T3607] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 44.382667][ T3607] </TASK>
[ 44.385835][ T3607] Kernel Offset: disabled
[ 44.390150][ T3607] Rebooting in 86400 seconds..