Warning: Permanently added '10.128.1.112' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 51.792549][ T3605] FAULT_INJECTION: forcing a failure. [ 51.792549][ T3605] name failslab, interval 1, probability 0, space 0, times 1 [ 51.805451][ T3605] CPU: 1 PID: 3605 Comm: syz-executor513 Not tainted 5.16.0-rc5-next-20211216-syzkaller #0 [ 51.815419][ T3605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.825470][ T3605] Call Trace: [ 51.828735][ T3605] [ 51.831652][ T3605] dump_stack_lvl+0xcd/0x134 [ 51.836242][ T3605] should_fail.cold+0x5/0xa [ 51.840738][ T3605] ? kvmalloc_node+0x3e/0x100 [ 51.845406][ T3605] should_failslab+0x5/0x10 [ 51.849905][ T3605] __kmalloc_node+0x75/0x380 [ 51.854493][ T3605] kvmalloc_node+0x3e/0x100 [ 51.858988][ T3605] drm_gem_get_pages+0x14f/0x5d0 [ 51.863921][ T3605] ? drm_gem_shmem_get_pages+0x56/0x250 [ 51.869468][ T3605] ? drm_gem_dma_resv_wait+0x220/0x220 [ 51.874922][ T3605] ? mutex_lock_io_nested+0x1150/0x1150 [ 51.880477][ T3605] ? drm_vma_node_is_allowed+0xc4/0x100 [ 51.886007][ T3605] ? lock_downgrade+0x6e0/0x6e0 [ 51.890850][ T3605] drm_gem_shmem_get_pages+0xd6/0x250 [ 51.896229][ T3605] ? drm_gem_shmem_mmap+0x2e0/0x2e0 [ 51.901437][ T3605] drm_gem_shmem_mmap+0x137/0x2e0 [ 51.906473][ T3605] ? drm_gem_shmem_mmap+0x2e0/0x2e0 [ 51.911666][ T3605] drm_gem_mmap_obj+0x1b6/0x3e0 [ 51.916528][ T3605] drm_gem_mmap+0x419/0x680 [ 51.921042][ T3605] ? drm_gem_fence_array_add_implicit+0x150/0x150 [ 51.927465][ T3605] ? kmem_cache_alloc+0x2ec/0x3a0 [ 51.932562][ T3605] mmap_region+0xd8e/0x1660 [ 51.937072][ T3605] do_mmap+0x869/0xfb0 [ 51.941150][ T3605] vm_mmap_pgoff+0x1b7/0x290 [ 51.945751][ T3605] ? randomize_stack_top+0x100/0x100 [ 51.951042][ T3605] ? __fget_files+0x28c/0x470 [ 51.955729][ T3605] ksys_mmap_pgoff+0x40d/0x5a0 [ 51.960504][ T3605] do_syscall_64+0x35/0xb0 [ 51.964950][ T3605] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 51.970863][ T3605] RIP: 0033:0x7ff6a7191cf9 [ 51.975282][ T3605] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 51.994877][ T3605] RSP: 002b:00007ffe623d1b78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 52.003305][ T3605] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ff6a7191cf9 [ 52.011296][ T3605] RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffc000 [ 52.019252][ T3605] RBP: 00007ffe623d1b90 R08: 0000000000000003 R09: 0000000100000000 [ 52.027207][ T3605] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000004 [ 52.035247][ T3605] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 52.043226][ T3605] [ 52.050453][ T3605] ================================================================== [ 52.058639][ T3605] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xf2/0x110 [ 52.067082][ T3605] Read of size 8 at addr ffff8881473d3228 by task syz-executor513/3605 [ 52.075323][ T3605] [ 52.077640][ T3605] CPU: 1 PID: 3605 Comm: syz-executor513 Not tainted 5.16.0-rc5-next-20211216-syzkaller #0 [ 52.087614][ T3605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.097675][ T3605] Call Trace: [ 52.100952][ T3605] [ 52.103881][ T3605] dump_stack_lvl+0xcd/0x134 [ 52.108491][ T3605] print_address_description.constprop.0.cold+0xa5/0x3ed [ 52.115527][ T3605] ? drm_gem_object_release_handle+0xf2/0x110 [ 52.121608][ T3605] ? drm_gem_object_release_handle+0xf2/0x110 [ 52.127691][ T3605] kasan_report.cold+0x83/0xdf [ 52.132460][ T3605] ? drm_gem_object_release_handle+0xf2/0x110 [ 52.138547][ T3605] ? drm_gem_object_handle_put_unlocked+0x320/0x320 [ 52.145149][ T3605] drm_gem_object_release_handle+0xf2/0x110 [ 52.151060][ T3605] ? drm_gem_object_handle_put_unlocked+0x320/0x320 [ 52.157671][ T3605] idr_for_each+0x113/0x220 [ 52.162190][ T3605] ? idr_find+0x50/0x50 [ 52.166367][ T3605] drm_gem_release+0x22/0x30 [ 52.170957][ T3605] drm_file_free.part.0+0x805/0xb80 [ 52.176177][ T3605] ? fsnotify+0x13e0/0x13e0 [ 52.180695][ T3605] drm_close_helper.isra.0+0x17d/0x1f0 [ 52.186171][ T3605] drm_release+0x1e6/0x530 [ 52.190607][ T3605] __fput+0x286/0x9f0 [ 52.194599][ T3605] ? drm_release_noglobal+0x180/0x180 [ 52.199990][ T3605] task_work_run+0xdd/0x1a0 [ 52.204508][ T3605] do_exit+0xc14/0x2c20 [ 52.208685][ T3605] ? lock_downgrade+0x6e0/0x6e0 [ 52.213548][ T3605] ? lock_downgrade+0x6e0/0x6e0 [ 52.218423][ T3605] ? mm_update_next_owner+0x7a0/0x7a0 [ 52.223833][ T3605] do_group_exit+0x125/0x310 [ 52.228456][ T3605] __x64_sys_exit_group+0x3a/0x50 [ 52.233505][ T3605] do_syscall_64+0x35/0xb0 [ 52.237964][ T3605] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 52.243876][ T3605] RIP: 0033:0x7ff6a71909f9 [ 52.248293][ T3605] Code: Unable to access opcode bytes at RIP 0x7ff6a71909cf. [ 52.255650][ T3605] RSP: 002b:00007ffe623d1b68 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 52.264061][ T3605] RAX: ffffffffffffffda RBX: 00007ff6a72043f0 RCX: 00007ff6a71909f9 [ 52.272033][ T3605] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 52.280000][ T3605] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000 [ 52.287967][ T3605] R10: 0000000000000012 R11: 0000000000000246 R12: 00007ff6a72043f0 [ 52.295939][ T3605] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 52.304011][ T3605] [ 52.307024][ T3605] [ 52.309341][ T3605] Allocated by task 3605: [ 52.313661][ T3605] kasan_save_stack+0x1e/0x40 [ 52.318339][ T3605] __kasan_kmalloc+0xa9/0xd0 [ 52.322925][ T3605] vgem_gem_create_object+0x38/0xb0 [ 52.328127][ T3605] __drm_gem_shmem_create+0x80/0x480 [ 52.333419][ T3605] drm_gem_shmem_dumb_create+0x13c/0x380 [ 52.339057][ T3605] drm_mode_create_dumb+0x26c/0x2f0 [ 52.344255][ T3605] drm_ioctl_kernel+0x27d/0x4e0 [ 52.349114][ T3605] drm_ioctl+0x51e/0x9d0 [ 52.353390][ T3605] __x64_sys_ioctl+0x193/0x200 [ 52.358164][ T3605] do_syscall_64+0x35/0xb0 [ 52.362684][ T3605] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 52.368604][ T3605] [ 52.370926][ T3605] Freed by task 3605: [ 52.374906][ T3605] kasan_save_stack+0x1e/0x40 [ 52.379593][ T3605] kasan_set_track+0x21/0x30 [ 52.384198][ T3605] kasan_set_free_info+0x20/0x30 [ 52.389149][ T3605] ____kasan_slab_free+0x166/0x1a0 [ 52.394266][ T3605] slab_free_freelist_hook+0x8b/0x1c0 [ 52.399661][ T3605] kfree+0xd0/0x4b0 [ 52.403488][ T3605] drm_gem_object_free+0x58/0x80 [ 52.408462][ T3605] drm_gem_mmap+0x4aa/0x680 [ 52.412978][ T3605] mmap_region+0xd8e/0x1660 [ 52.417484][ T3605] do_mmap+0x869/0xfb0 [ 52.421551][ T3605] vm_mmap_pgoff+0x1b7/0x290 [ 52.426155][ T3605] ksys_mmap_pgoff+0x40d/0x5a0 [ 52.430918][ T3605] do_syscall_64+0x35/0xb0 [ 52.435346][ T3605] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 52.441254][ T3605] [ 52.443572][ T3605] The buggy address belongs to the object at ffff8881473d3000 [ 52.443572][ T3605] which belongs to the cache kmalloc-1k of size 1024 [ 52.457621][ T3605] The buggy address is located 552 bytes inside of [ 52.457621][ T3605] 1024-byte region [ffff8881473d3000, ffff8881473d3400) [ 52.470977][ T3605] The buggy address belongs to the page: [ 52.476710][ T3605] page:ffffea00051cf400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1473d0 [ 52.486960][ T3605] head:ffffea00051cf400 order:3 compound_mapcount:0 compound_pincount:0 [ 52.495288][ T3605] flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff) [ 52.503397][ T3605] raw: 057ff00000010200 0000000000000000 dead000000000001 ffff888010c41dc0 [ 52.511990][ T3605] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 52.520564][ T3605] page dumped because: kasan: bad access detected [ 52.526966][ T3605] page_owner tracks the page as allocated [ 52.532670][ T3605] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 7979660614, free_ts 0 [ 52.550727][ T3605] get_page_from_freelist+0xa72/0x2f40 [ 52.556195][ T3605] __alloc_pages+0x1b2/0x500 [ 52.560789][ T3605] alloc_page_interleave+0x1e/0x200 [ 52.566005][ T3605] alloc_pages+0x2b1/0x310 [ 52.570421][ T3605] new_slab+0x28d/0x3a0 [ 52.574584][ T3605] ___slab_alloc+0x6be/0xd60 [ 52.579182][ T3605] __slab_alloc.constprop.0+0x4d/0xa0 [ 52.584570][ T3605] kmem_cache_alloc_node_trace+0x116/0x300 [ 52.590384][ T3605] __alloc_disk_node+0x77/0x5c0 [ 52.595236][ T3605] __blk_mq_alloc_disk+0x12d/0x1c0 [ 52.600355][ T3605] nbd_dev_add+0x3b2/0xcd0 [ 52.604772][ T3605] nbd_init+0x297/0x2a7 [ 52.608925][ T3605] do_one_initcall+0x103/0x650 [ 52.613781][ T3605] kernel_init_freeable+0x6b1/0x73a [ 52.618980][ T3605] kernel_init+0x1a/0x1d0 [ 52.623319][ T3605] ret_from_fork+0x1f/0x30 [ 52.627754][ T3605] page_owner free stack trace missing [ 52.633110][ T3605] [ 52.635428][ T3605] Memory state around the buggy address: [ 52.641047][ T3605] ffff8881473d3100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.649103][ T3605] ffff8881473d3180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.657157][ T3605] >ffff8881473d3200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.665558][ T3605] ^ [ 52.671365][ T3605] ffff8881473d3280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.681458][ T3605] ffff8881473d3300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.691303][ T3605] ================================================================== [ 52.702485][ T3605] Disabling lock debugging due to kernel taint [ 52.709400][ T3605] Kernel panic - not syncing: panic_on_warn set ... [ 52.715985][ T3605] CPU: 1 PID: 3605 Comm: syz-executor513 Tainted: G B 5.16.0-rc5-next-20211216-syzkaller #0 [ 52.727374][ T3605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.737428][ T3605] Call Trace: [ 52.740702][ T3605] [ 52.743646][ T3605] dump_stack_lvl+0xcd/0x134 [ 52.748247][ T3605] panic+0x2b0/0x6dd [ 52.752138][ T3605] ? __warn_printk+0xf3/0xf3 [ 52.756726][ T3605] ? preempt_schedule_common+0x59/0xc0 [ 52.762188][ T3605] ? drm_gem_object_release_handle+0xf2/0x110 [ 52.768271][ T3605] ? preempt_schedule_thunk+0x16/0x18 [ 52.773653][ T3605] ? trace_hardirqs_on+0x38/0x1c0 [ 52.778671][ T3605] ? trace_hardirqs_on+0x51/0x1c0 [ 52.783691][ T3605] ? drm_gem_object_release_handle+0xf2/0x110 [ 52.789767][ T3605] ? drm_gem_object_release_handle+0xf2/0x110 [ 52.795844][ T3605] end_report.cold+0x63/0x6f [ 52.800442][ T3605] kasan_report.cold+0x71/0xdf [ 52.805205][ T3605] ? drm_gem_object_release_handle+0xf2/0x110 [ 52.811284][ T3605] ? drm_gem_object_handle_put_unlocked+0x320/0x320 [ 52.817891][ T3605] drm_gem_object_release_handle+0xf2/0x110 [ 52.823795][ T3605] ? drm_gem_object_handle_put_unlocked+0x320/0x320 [ 52.830399][ T3605] idr_for_each+0x113/0x220 [ 52.834911][ T3605] ? idr_find+0x50/0x50 [ 52.839077][ T3605] drm_gem_release+0x22/0x30 [ 52.843662][ T3605] drm_file_free.part.0+0x805/0xb80 [ 52.848958][ T3605] ? fsnotify+0x13e0/0x13e0 [ 52.853467][ T3605] drm_close_helper.isra.0+0x17d/0x1f0 [ 52.858944][ T3605] drm_release+0x1e6/0x530 [ 52.863371][ T3605] __fput+0x286/0x9f0 [ 52.867359][ T3605] ? drm_release_noglobal+0x180/0x180 [ 52.872753][ T3605] task_work_run+0xdd/0x1a0 [ 52.877260][ T3605] do_exit+0xc14/0x2c20 [ 52.881421][ T3605] ? lock_downgrade+0x6e0/0x6e0 [ 52.886278][ T3605] ? lock_downgrade+0x6e0/0x6e0 [ 52.891132][ T3605] ? mm_update_next_owner+0x7a0/0x7a0 [ 52.896518][ T3605] do_group_exit+0x125/0x310 [ 52.901113][ T3605] __x64_sys_exit_group+0x3a/0x50 [ 52.906142][ T3605] do_syscall_64+0x35/0xb0 [ 52.910559][ T3605] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 52.916472][ T3605] RIP: 0033:0x7ff6a71909f9 [ 52.920884][ T3605] Code: Unable to access opcode bytes at RIP 0x7ff6a71909cf. [ 52.928237][ T3605] RSP: 002b:00007ffe623d1b68 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 52.936651][ T3605] RAX: ffffffffffffffda RBX: 00007ff6a72043f0 RCX: 00007ff6a71909f9 [ 52.944616][ T3605] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 52.952674][ T3605] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000 [ 52.960638][ T3605] R10: 0000000000000012 R11: 0000000000000246 R12: 00007ff6a72043f0 [ 52.968601][ T3605] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 52.976566][ T3605] [ 52.979833][ T3605] Kernel Offset: disabled [ 52.984147][ T3605] Rebooting in 86400 seconds..