program: prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x14, r3, 0x701, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x8814) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r4, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), 0xffffffffffffffff) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd, 0x0, 0x0}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000080)={r6}) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff7ffb}]}) close_range(r7, 0xffffffffffffffff, 0x0) [ 76.468155][ T4666] Bluetooth: hci0: command tx timeout [ 76.471569][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.474320][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.776362][ T5324] ================================================================== [ 76.779443][ T5324] BUG: KASAN: slab-out-of-bounds in change_page_attr_set_clr+0x625/0xfc0 [ 76.782813][ T5324] Read of size 8 at addr ffff8880231b7ef8 by task syz.0.0/5324 [ 76.786085][ T5324] [ 76.787177][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.787192][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 76.787200][ T5324] Call Trace: [ 76.787208][ T5324] [ 76.787214][ T5324] dump_stack_lvl+0x189/0x250 [ 76.787229][ T5324] ? __kasan_check_byte+0x12/0x40 [ 76.787279][ T5324] ? __pfx_dump_stack_lvl+0x10/0x10 [ 76.787291][ T5324] ? lock_release+0x4b/0x3e0 [ 76.787308][ T5324] ? __virt_addr_valid+0x4a5/0x5c0 [ 76.787321][ T5324] print_report+0xca/0x240 [ 76.787333][ T5324] ? change_page_attr_set_clr+0x625/0xfc0 [ 76.787346][ T5324] kasan_report+0x118/0x150 [ 76.787358][ T5324] ? change_page_attr_set_clr+0x625/0xfc0 [ 76.787372][ T5324] change_page_attr_set_clr+0x625/0xfc0 [ 76.787386][ T5324] ? __pfx_change_page_attr_set_clr+0x10/0x10 [ 76.787406][ T5324] ? __pfx_pagerange_is_ram_callback+0x10/0x10 [ 76.787420][ T5324] ? memtype_reserve+0x874/0xb30 [ 76.787434][ T5324] ? __pfx___ww_mutex_lock+0x10/0x10 [ 76.787478][ T5324] _set_pages_array+0x145/0x270 [ 76.787495][ T5324] drm_gem_shmem_get_pages_locked+0x2d0/0x440 [ 76.787512][ T5324] ? __pfx_drm_gem_shmem_get_pages_locked+0x10/0x10 [ 76.787528][ T5324] ? ww_mutex_lock+0x3f/0x1c0 [ 76.787540][ T5324] drm_gem_shmem_mmap+0x193/0x460 [ 76.787557][ T5324] drm_gem_mmap_obj+0x18a/0x4e0 [ 76.787569][ T5324] drm_gem_mmap+0x384/0x640 [ 76.787579][ T5324] ? __pfx_drm_gem_mmap+0x10/0x10 [ 76.787590][ T5324] ? __mas_set_range+0x12f/0x3c0 [ 76.787604][ T5324] mmap_region+0x18b4/0x2110 [ 76.787622][ T5324] ? __pfx_mmap_region+0x10/0x10 [ 76.787635][ T5324] ? __schedule+0x17ae/0x4cc0 [ 76.787651][ T5324] ? drm_gem_handle_create_tail+0x20d/0x490 [ 76.787669][ T5324] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 76.787681][ T5324] ? bpf_lsm_mmap_addr+0x9/0x20 [ 76.787689][ T5324] ? security_mmap_addr+0x71/0x270 [ 76.787698][ T5324] ? shmem_mapping+0xd/0x50 [ 76.787706][ T5324] ? memfd_check_seals_mmap+0xc5/0x200 [ 76.787715][ T5324] do_mmap+0xc45/0x10d0 [ 76.787725][ T5324] ? __pfx_do_mmap+0x10/0x10 [ 76.787733][ T5324] ? down_write_killable+0x178/0x230 [ 76.787741][ T5324] ? __pfx_down_write_killable+0x10/0x10 [ 76.787748][ T5324] ? common_file_perm+0x1b5/0x230 [ 76.787755][ T5324] vm_mmap_pgoff+0x2a6/0x4d0 [ 76.787765][ T5324] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 76.787773][ T5324] ? __fget_files+0x2a/0x420 [ 76.787780][ T5324] ? __fget_files+0x2a/0x420 [ 76.787786][ T5324] ? __fget_files+0x2a/0x420 [ 76.787793][ T5324] ksys_mmap_pgoff+0x51f/0x760 [ 76.787804][ T5324] do_syscall_64+0xfa/0xfa0 [ 76.787814][ T5324] ? lockdep_hardirqs_on+0x9c/0x150 [ 76.787823][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.787834][ T5324] ? clear_bhb_loop+0x60/0xb0 [ 76.787846][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.787857][ T5324] RIP: 0033:0x7fd7a658efc9 [ 76.787869][ T5324] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 76.787877][ T5324] RSP: 002b:00007fd7a740f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 76.787890][ T5324] RAX: ffffffffffffffda RBX: 00007fd7a67e6180 RCX: 00007fd7a658efc9 [ 76.787899][ T5324] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 0000200000001000 [ 76.787906][ T5324] RBP: 00007fd7a6611f91 R08: 0000000000000006 R09: 0000000100000000 [ 76.787915][ T5324] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000 [ 76.787921][ T5324] R13: 00007fd7a67e6218 R14: 00007fd7a67e6180 R15: 00007ffcb9b914c8 [ 76.787933][ T5324] [ 76.787937][ T5324] [ 76.941035][ T5324] Allocated by task 5324: [ 76.942782][ T5324] kasan_save_track+0x3e/0x80 [ 76.944860][ T5324] __kasan_kmalloc+0x93/0xb0 [ 76.946843][ T5324] __kvmalloc_node_noprof+0x5cd/0x910 [ 76.949096][ T5324] drm_gem_get_pages+0x166/0xa20 [ 76.951193][ T5324] drm_gem_shmem_get_pages_locked+0x201/0x440 [ 76.953902][ T5324] drm_gem_shmem_mmap+0x193/0x460 [ 76.956136][ T5324] drm_gem_mmap_obj+0x18a/0x4e0 [ 76.958268][ T5324] drm_gem_mmap+0x384/0x640 [ 76.960296][ T5324] mmap_region+0x18b4/0x2110 [ 76.962389][ T5324] do_mmap+0xc45/0x10d0 [ 76.964328][ T5324] vm_mmap_pgoff+0x2a6/0x4d0 [ 76.966444][ T5324] ksys_mmap_pgoff+0x51f/0x760 [ 76.968600][ T5324] do_syscall_64+0xfa/0xfa0 [ 76.970600][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.973185][ T5324] [ 76.974228][ T5324] The buggy address belongs to the object at ffff8880231b7e00 [ 76.974228][ T5324] which belongs to the cache kmalloc-256 of size 256 [ 76.979675][ T5324] The buggy address is located 0 bytes to the right of [ 76.979675][ T5324] allocated 248-byte region [ffff8880231b7e00, ffff8880231b7ef8) [ 76.985459][ T5324] [ 76.986488][ T5324] The buggy address belongs to the physical page: [ 76.989056][ T5324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x231b7 [ 76.992549][ T5324] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 76.995413][ T5324] page_type: f5(slab) [ 76.997060][ T5324] raw: 00fff00000000000 ffff88801a441b40 dead000000000100 dead000000000122 [ 77.000607][ T5324] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 77.004348][ T5324] page dumped because: kasan: bad access detected [ 77.008855][ T5324] page_owner tracks the page as allocated [ 77.011379][ T5324] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5297, tgid 5297 (syz-executor), ts 74783529876, free_ts 74754240407 [ 77.019534][ T5324] post_alloc_hook+0x240/0x2a0 [ 77.021688][ T5324] get_page_from_freelist+0x2365/0x2440 [ 77.024144][ T5324] __alloc_frozen_pages_noprof+0x181/0x370 [ 77.026706][ T5324] alloc_pages_mpol+0x232/0x4a0 [ 77.028907][ T5324] allocate_slab+0x96/0x3a0 [ 77.030976][ T5324] ___slab_alloc+0xe94/0x18a0 [ 77.032946][ T5324] __slab_alloc+0x65/0x100 [ 77.034943][ T5324] __kmalloc_noprof+0x471/0x7f0 [ 77.037015][ T5324] __list_lru_init+0xba/0x5c0 [ 77.038912][ T5324] alloc_super+0x787/0x930 [ 77.040755][ T5324] sget_fc+0x329/0xa40 [ 77.042476][ T5324] get_tree_single+0x2f/0x150 [ 77.044696][ T5324] vfs_get_tree+0x92/0x2b0 [ 77.046919][ T5324] do_new_mount+0x302/0xa10 [ 77.049133][ T5324] __se_sys_mount+0x313/0x410 [ 77.051432][ T5324] do_syscall_64+0xfa/0xfa0 [ 77.053741][ T5324] page last free pid 79 tgid 79 stack trace: [ 77.056853][ T5324] free_unref_folios+0xdb3/0x14f0 [ 77.059238][ T5324] shrink_folio_list+0x44ab/0x4c70 [ 77.061473][ T5324] evict_folios+0x471e/0x57c0 [ 77.063534][ T5324] try_to_shrink_lruvec+0x8a3/0xb50 [ 77.065838][ T5324] shrink_one+0x21b/0x7c0 [ 77.068107][ T5324] shrink_node+0x315d/0x3780 [ 77.070500][ T5324] kswapd+0x147c/0x2800 [ 77.072645][ T5324] kthread+0x711/0x8a0 [ 77.074634][ T5324] ret_from_fork+0x4bc/0x870 [ 77.076767][ T5324] ret_from_fork_asm+0x1a/0x30 [ 77.078828][ T5324] [ 77.079886][ T5324] Memory state around the buggy address: [ 77.082119][ T5324] ffff8880231b7d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.085576][ T5324] ffff8880231b7e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 77.089038][ T5324] >ffff8880231b7e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 77.092503][ T5324] ^ [ 77.096094][ T5324] ffff8880231b7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.100387][ T5324] ffff8880231b7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 77.104678][ T5324] ================================================================== [ 77.109034][ T5324] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 77.111883][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 77.115778][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 77.120175][ T5324] Call Trace: [ 77.121578][ T5324] [ 77.122891][ T5324] dump_stack_lvl+0x99/0x250 [ 77.124843][ T5324] ? __asan_memcpy+0x40/0x70 [ 77.126895][ T5324] ? __pfx_dump_stack_lvl+0x10/0x10 [ 77.129087][ T5324] ? __pfx__printk+0x10/0x10 [ 77.131084][ T5324] vpanic+0x237/0x6d0 [ 77.132685][ T5324] ? __pfx_vpanic+0x10/0x10 [ 77.134620][ T5324] ? preempt_schedule+0xae/0xc0 [ 77.136700][ T5324] ? __pfx_preempt_schedule+0x10/0x10 [ 77.139120][ T5324] panic+0xb9/0xc0 [ 77.140708][ T5324] ? __pfx_panic+0x10/0x10 [ 77.142658][ T5324] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 77.145228][ T5324] ? change_page_attr_set_clr+0x625/0xfc0 [ 77.147590][ T5324] check_panic_on_warn+0x89/0xb0 [ 77.149504][ T5324] ? change_page_attr_set_clr+0x625/0xfc0 [ 77.151843][ T5324] end_report+0x78/0x160 [ 77.153669][ T5324] kasan_report+0x129/0x150 [ 77.155616][ T5324] ? change_page_attr_set_clr+0x625/0xfc0 [ 77.158083][ T5324] change_page_attr_set_clr+0x625/0xfc0 [ 77.160480][ T5324] ? __pfx_change_page_attr_set_clr+0x10/0x10 [ 77.162890][ T5324] ? __pfx_pagerange_is_ram_callback+0x10/0x10 [ 77.165634][ T5324] ? memtype_reserve+0x874/0xb30 [ 77.167925][ T5324] ? __pfx___ww_mutex_lock+0x10/0x10 [ 77.170372][ T5324] _set_pages_array+0x145/0x270 [ 77.172586][ T5324] drm_gem_shmem_get_pages_locked+0x2d0/0x440 [ 77.175362][ T5324] ? __pfx_drm_gem_shmem_get_pages_locked+0x10/0x10 [ 77.178308][ T5324] ? ww_mutex_lock+0x3f/0x1c0 [ 77.180321][ T5324] drm_gem_shmem_mmap+0x193/0x460 [ 77.182592][ T5324] drm_gem_mmap_obj+0x18a/0x4e0 [ 77.184825][ T5324] drm_gem_mmap+0x384/0x640 [ 77.186901][ T5324] ? __pfx_drm_gem_mmap+0x10/0x10 [ 77.189242][ T5324] ? __mas_set_range+0x12f/0x3c0 [ 77.191487][ T5324] mmap_region+0x18b4/0x2110 [ 77.193391][ T5324] ? __pfx_mmap_region+0x10/0x10 [ 77.195439][ T5324] ? __schedule+0x17ae/0x4cc0 [ 77.197376][ T5324] ? drm_gem_handle_create_tail+0x20d/0x490 [ 77.199809][ T5324] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 77.202518][ T5324] ? bpf_lsm_mmap_addr+0x9/0x20 [ 77.204547][ T5324] ? security_mmap_addr+0x71/0x270 [ 77.206656][ T5324] ? shmem_mapping+0xd/0x50 [ 77.208602][ T5324] ? memfd_check_seals_mmap+0xc5/0x200 [ 77.211042][ T5324] do_mmap+0xc45/0x10d0 [ 77.212890][ T5324] ? __pfx_do_mmap+0x10/0x10 [ 77.215009][ T5324] ? down_write_killable+0x178/0x230 [ 77.217374][ T5324] ? __pfx_down_write_killable+0x10/0x10 [ 77.219924][ T5324] ? common_file_perm+0x1b5/0x230 [ 77.222144][ T5324] vm_mmap_pgoff+0x2a6/0x4d0 [ 77.224298][ T5324] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 77.226622][ T5324] ? __fget_files+0x2a/0x420 [ 77.228689][ T5324] ? __fget_files+0x2a/0x420 [ 77.230732][ T5324] ? __fget_files+0x2a/0x420 [ 77.232887][ T5324] ksys_mmap_pgoff+0x51f/0x760 [ 77.235101][ T5324] do_syscall_64+0xfa/0xfa0 [ 77.237161][ T5324] ? lockdep_hardirqs_on+0x9c/0x150 [ 77.239496][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.241993][ T5324] ? clear_bhb_loop+0x60/0xb0 [ 77.243789][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.245857][ T5324] RIP: 0033:0x7fd7a658efc9 [ 77.247720][ T5324] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 77.254946][ T5324] RSP: 002b:00007fd7a740f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 77.258751][ T5324] RAX: ffffffffffffffda RBX: 00007fd7a67e6180 RCX: 00007fd7a658efc9 [ 77.262109][ T5324] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 0000200000001000 [ 77.265314][ T5324] RBP: 00007fd7a6611f91 R08: 0000000000000006 R09: 0000000100000000 [ 77.268516][ T5324] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000 [ 77.271626][ T5324] R13: 00007fd7a67e6218 R14: 00007fd7a67e6180 R15: 00007ffcb9b914c8 [ 77.274697][ T5324] [ 77.276242][ T5324] Kernel Offset: disabled [ 77.277830][ T5324] Rebooting in 86400 seconds..