./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3565939365

<...>
DUID 00:04:9f:e8:07:f9:ba:36:1f:d4:05:68:5a:d1:6a:7f:90:cd
forked to background, child pid 3176
[   24.912912][ T3177] 8021q: adding VLAN 0 to HW filter on device bond0
[   24.922965][ T3177] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.1.51' (ECDSA) to the list of known hosts.
execve("./syz-executor3565939365", ["./syz-executor3565939365"], 0x7ffcb8640c90 /* 10 vars */) = 0
brk(NULL)                               = 0x555556726000
brk(0x555556726d00)                     = 0x555556726d00
arch_prctl(ARCH_SET_FS, 0x5555567263c0) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3565939365", 4096) = 28
brk(0x555556747d00)                     = 0x555556747d00
brk(0x555556748000)                     = 0x555556748000
mprotect(0x7fe09e94c000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7fe09e89e2c0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fe09e89e630}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7fe09e89e2c0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fe09e89e630}, NULL, 8) = 0
openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000040) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "6", 1)                        = 1
syzkaller login: [   45.761014][ T3604] FAULT_INJECTION: forcing a failure.
[   45.761014][ T3604] name failslab, interval 1, probability 0, space 0, times 1
[   45.774057][ T3604] CPU: 0 PID: 3604 Comm: syz-executor356 Not tainted 5.18.0-rc7-syzkaller-00119-gb015dcd62b86 #0
[   45.784540][ T3604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.794574][ T3604] Call Trace:
[   45.797838][ T3604]  <TASK>
[   45.800752][ T3604]  dump_stack_lvl+0x1e3/0x2cb
[   45.805432][ T3604]  ? bfq_pos_tree_add_move+0x436/0x436
[   45.810870][ T3604]  ? panic+0x76e/0x76e
[   45.814919][ T3604]  ? __might_sleep+0xc0/0xc0
[   45.819494][ T3604]  should_fail+0x384/0x4b0
[   45.823891][ T3604]  ? kvmalloc_node+0x6e/0x160
[   45.828546][ T3604]  should_failslab+0x5/0x20
[   45.833029][ T3604]  __kmalloc_node+0x8e/0x400
[   45.837619][ T3604]  kvmalloc_node+0x6e/0x160
[   45.842113][ T3604]  drm_gem_get_pages+0x167/0x650
[   45.847043][ T3604]  ? drm_gem_create_mmap_offset_size+0x80/0x80
[   45.853194][ T3604]  ? drm_vma_node_is_allowed+0xb7/0xe0
[   45.858639][ T3604]  ? __lock_acquire+0x1f80/0x1f80
[   45.863654][ T3604]  drm_gem_shmem_get_pages+0xbb/0x210
[   45.869013][ T3604]  drm_gem_shmem_mmap+0x86/0x210
[   45.873940][ T3604]  drm_gem_mmap_obj+0x18a/0x360
[   45.878782][ T3604]  drm_gem_mmap+0x43d/0x760
[   45.883275][ T3604]  ? drm_gem_mmap_obj+0x360/0x360
[   45.888287][ T3604]  ? kmem_cache_alloc+0x1ed/0x2f0
[   45.893298][ T3604]  ? memset+0x1f/0x40
[   45.897270][ T3604]  mmap_region+0x11ff/0x1730
[   45.901860][ T3604]  ? file_mmap_ok+0x150/0x150
[   45.906518][ T3604]  ? cap_mmap_addr+0x164/0x2d0
[   45.911269][ T3604]  ? bpf_lsm_mmap_addr+0x5/0x10
[   45.916107][ T3604]  ? get_unmapped_area+0x316/0x380
[   45.921209][ T3604]  do_mmap+0x7a7/0xdf0
[   45.925274][ T3604]  vm_mmap_pgoff+0x1e5/0x2f0
[   45.929857][ T3604]  ? account_locked_vm+0xd0/0xd0
[   45.934793][ T3604]  ksys_mmap_pgoff+0x48c/0x6d0
[   45.939548][ T3604]  do_syscall_64+0x2b/0x70
[   45.943968][ T3604]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   45.949881][ T3604] RIP: 0033:0x7fe09e8e0119
[   45.954291][ T3604] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   45.973885][ T3604] RSP: 002b:00007ffea6f5dec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[   45.982290][ T3604] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe09e8e0119
[   45.990248][ T3604] RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffc000
[   45.998204][ T3604] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000100000000
mmap(0x20ffc000, 12288, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0)                           = ?
[   46.006157][ T3604] R10: 0000000000000012 R11: 0000000000000246 R12: 00007ffea6f5def0
[   46.014112][ T3604] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   46.022083][ T3604]  </TASK>
[   46.029179][ T3604] ==================================================================
[   46.037245][ T3604] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0x3b/0xf0
[   46.045550][ T3604] Read of size 8 at addr ffff8880228f8a28 by task syz-executor356/3604
[   46.053756][ T3604] 
[   46.056053][ T3604] CPU: 0 PID: 3604 Comm: syz-executor356 Not tainted 5.18.0-rc7-syzkaller-00119-gb015dcd62b86 #0
[   46.066517][ T3604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   46.076543][ T3604] Call Trace:
[   46.079799][ T3604]  <TASK>
[   46.082708][ T3604]  dump_stack_lvl+0x1e3/0x2cb
[   46.087368][ T3604]  ? bfq_pos_tree_add_move+0x436/0x436
[   46.092804][ T3604]  ? wake_up_klogd+0xb2/0xf0
[   46.097369][ T3604]  ? panic+0x76e/0x76e
[   46.101413][ T3604]  ? _printk+0xcf/0x10f
[   46.105542][ T3604]  print_address_description+0x65/0x4b0
[   46.111063][ T3604]  print_report+0xf4/0x210
[   46.115453][ T3604]  ? drm_gem_object_release_handle+0x3b/0xf0
[   46.121409][ T3604]  kasan_report+0xfb/0x130
[   46.125799][ T3604]  ? drm_gem_object_release_handle+0x3b/0xf0
[   46.131761][ T3604]  drm_gem_object_release_handle+0x3b/0xf0
[   46.137558][ T3604]  idr_for_each+0x1f8/0x2e0
[   46.142043][ T3604]  ? drm_gem_handle_delete+0x180/0x180
[   46.147483][ T3604]  ? idr_find+0x60/0x60
[   46.151618][ T3604]  ? _raw_spin_unlock+0x40/0x40
[   46.156450][ T3604]  drm_gem_release+0x21/0x30
[   46.161025][ T3604]  drm_file_free+0x6ac/0x920
[   46.165606][ T3604]  drm_release+0x33e/0x5c0
[   46.170005][ T3604]  ? drm_lastclose+0xa0/0xa0
[   46.174575][ T3604]  __fput+0x3b9/0x820
[   46.178540][ T3604]  task_work_run+0x146/0x1c0
[   46.183117][ T3604]  do_exit+0x547/0x1eb0
[   46.187256][ T3604]  ? _raw_spin_unlock_irq+0x2a/0x40
[   46.192436][ T3604]  ? mm_update_next_owner+0x6d0/0x6d0
[   46.197790][ T3604]  ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[   46.203752][ T3604]  ? print_irqtrace_events+0x220/0x220
[   46.209192][ T3604]  ? vtime_user_exit+0x2b2/0x3e0
[   46.214115][ T3604]  do_group_exit+0x23b/0x2f0
[   46.218688][ T3604]  __x64_sys_exit_group+0x3b/0x40
[   46.223697][ T3604]  do_syscall_64+0x2b/0x70
[   46.228094][ T3604]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   46.233968][ T3604] RIP: 0033:0x7fe09e8dee19
[   46.238364][ T3604] Code: Unable to access opcode bytes at RIP 0x7fe09e8dedef.
[   46.245703][ T3604] RSP: 002b:00007ffea6f5df58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   46.254097][ T3604] RAX: ffffffffffffffda RBX: 00007fe09e9523f0 RCX: 00007fe09e8dee19
[   46.262052][ T3604] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   46.270001][ T3604] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[   46.277950][ T3604] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fe09e9523f0
[   46.285902][ T3604] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   46.293860][ T3604]  </TASK>
[   46.296861][ T3604] 
[   46.299165][ T3604] Allocated by task 3604:
[   46.303469][ T3604]  ____kasan_kmalloc+0xdc/0x110
[   46.308299][ T3604]  kmem_cache_alloc_trace+0x94/0x310
[   46.313563][ T3604]  vgem_gem_create_object+0x46/0xa0
[   46.318741][ T3604]  __drm_gem_shmem_create+0x7c/0x310
[   46.324003][ T3604]  drm_gem_shmem_dumb_create+0x243/0x420
[   46.329612][ T3604]  drm_ioctl_kernel+0x33e/0x4f0
[   46.334443][ T3604]  drm_ioctl+0x626/0xa10
[   46.338665][ T3604]  __se_sys_ioctl+0xfb/0x170
[   46.343236][ T3604]  do_syscall_64+0x2b/0x70
[   46.347629][ T3604]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   46.353503][ T3604] 
[   46.355804][ T3604] Freed by task 3604:
[   46.359760][ T3604]  kasan_set_track+0x4c/0x70
[   46.364330][ T3604]  kasan_set_free_info+0x1f/0x40
[   46.369244][ T3604]  ____kasan_slab_free+0xd8/0x110
[   46.374249][ T3604]  slab_free_freelist_hook+0x12e/0x1a0
[   46.379688][ T3604]  kfree+0xc6/0x210
[   46.383472][ T3604]  drm_gem_mmap+0x4c9/0x760
[   46.387954][ T3604]  mmap_region+0x11ff/0x1730
[   46.392525][ T3604]  do_mmap+0x7a7/0xdf0
[   46.396574][ T3604]  vm_mmap_pgoff+0x1e5/0x2f0
[   46.401146][ T3604]  ksys_mmap_pgoff+0x48c/0x6d0
[   46.405888][ T3604]  do_syscall_64+0x2b/0x70
[   46.410283][ T3604]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   46.416153][ T3604] 
[   46.418455][ T3604] The buggy address belongs to the object at ffff8880228f8800
[   46.418455][ T3604]  which belongs to the cache kmalloc-1k of size 1024
[   46.432483][ T3604] The buggy address is located 552 bytes inside of
[   46.432483][ T3604]  1024-byte region [ffff8880228f8800, ffff8880228f8c00)
[   46.445817][ T3604] 
[   46.448123][ T3604] The buggy address belongs to the physical page:
[   46.454511][ T3604] page:ffffea00008a3e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x228f8
[   46.464637][ T3604] head:ffffea00008a3e00 order:3 compound_mapcount:0 compound_pincount:0
[   46.472939][ T3604] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   46.480901][ T3604] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011441dc0
[   46.489460][ T3604] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   46.498017][ T3604] page dumped because: kasan: bad access detected
[   46.504400][ T3604] page_owner tracks the page as allocated
[   46.510088][ T3604] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3599, tgid 3599 (sshd), ts 45730919026, free_ts 45679182628
[   46.530724][ T3604]  get_page_from_freelist+0x72e/0x7a0
[   46.536078][ T3604]  __alloc_pages+0x26c/0x5f0
[   46.540649][ T3604]  alloc_slab_page+0x70/0xf0
[   46.545222][ T3604]  allocate_slab+0x5e/0x560
[   46.549702][ T3604]  ___slab_alloc+0x41e/0xcd0
[   46.554269][ T3604]  __kmalloc_node_track_caller+0x2bb/0x3f0
[   46.560055][ T3604]  __alloc_skb+0x11a/0x590
[   46.564450][ T3604]  tcp_stream_alloc_skb+0x67/0x480
[   46.569538][ T3604]  tcp_sendmsg_locked+0xd64/0x3fc0
[   46.574626][ T3604]  tcp_sendmsg+0x2c/0x40
[   46.578850][ T3604]  sock_write_iter+0x37c/0x4e0
[   46.583595][ T3604]  vfs_write+0xa22/0xd40
[   46.587818][ T3604]  ksys_write+0x19b/0x2c0
[   46.592122][ T3604]  do_syscall_64+0x2b/0x70
[   46.596520][ T3604]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   46.602393][ T3604] page last free stack trace:
[   46.607040][ T3604]  free_pcp_prepare+0x812/0x900
[   46.611867][ T3604]  free_unref_page+0x7d/0x390
[   46.616524][ T3604]  ___cache_free+0x118/0x1a0
[   46.621093][ T3604]  qlist_free_all+0x2b/0x70
[   46.625573][ T3604]  kasan_quarantine_reduce+0x169/0x180
[   46.631007][ T3604]  __kasan_slab_alloc+0x2f/0xe0
[   46.635836][ T3604]  kmem_cache_alloc+0x199/0x2f0
[   46.640668][ T3604]  getname_flags+0xb8/0x4e0
[   46.645154][ T3604]  __se_sys_newfstatat+0xd4/0x790
[   46.650163][ T3604]  do_syscall_64+0x2b/0x70
[   46.654559][ T3604]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   46.660431][ T3604] 
[   46.662732][ T3604] Memory state around the buggy address:
[   46.668340][ T3604]  ffff8880228f8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.676377][ T3604]  ffff8880228f8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.684414][ T3604] >ffff8880228f8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.692446][ T3604]                                   ^
[   46.697789][ T3604]  ffff8880228f8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.705826][ T3604]  ffff8880228f8b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.713868][ T3604] ==================================================================
[   46.722406][ T3604] Kernel panic - not syncing: panic_on_warn set ...
[   46.728993][ T3604] CPU: 1 PID: 3604 Comm: syz-executor356 Not tainted 5.18.0-rc7-syzkaller-00119-gb015dcd62b86 #0
[   46.739484][ T3604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   46.749516][ T3604] Call Trace:
[   46.752782][ T3604]  <TASK>
[   46.755691][ T3604]  dump_stack_lvl+0x1e3/0x2cb
[   46.760349][ T3604]  ? bfq_pos_tree_add_move+0x436/0x436
[   46.765787][ T3604]  ? panic+0x76e/0x76e
[   46.769831][ T3604]  ? preempt_schedule_common+0xb7/0xe0
[   46.775273][ T3604]  ? preempt_schedule+0xd9/0xe0
[   46.780110][ T3604]  ? vscnprintf+0x59/0x80
[   46.784421][ T3604]  panic+0x312/0x76e
[   46.788303][ T3604]  ? trace_hardirqs_on+0x30/0x80
[   46.793226][ T3604]  ? fb_is_primary_device+0xcc/0xcc
[   46.798410][ T3604]  ? _raw_spin_unlock_irqrestore+0x128/0x130
[   46.804373][ T3604]  ? print_report+0x1d0/0x210
[   46.809033][ T3604]  ? drm_gem_object_release_handle+0x3b/0xf0
[   46.814987][ T3604]  end_report+0x91/0xa0
[   46.819118][ T3604]  kasan_report+0x108/0x130
[   46.823597][ T3604]  ? drm_gem_object_release_handle+0x3b/0xf0
[   46.829554][ T3604]  drm_gem_object_release_handle+0x3b/0xf0
[   46.835338][ T3604]  idr_for_each+0x1f8/0x2e0
[   46.839815][ T3604]  ? drm_gem_handle_delete+0x180/0x180
[   46.845250][ T3604]  ? idr_find+0x60/0x60
[   46.849382][ T3604]  ? _raw_spin_unlock+0x40/0x40
[   46.854298][ T3604]  drm_gem_release+0x21/0x30
[   46.858863][ T3604]  drm_file_free+0x6ac/0x920
[   46.863427][ T3604]  drm_release+0x33e/0x5c0
[   46.867819][ T3604]  ? drm_lastclose+0xa0/0xa0
[   46.872380][ T3604]  __fput+0x3b9/0x820
[   46.876337][ T3604]  task_work_run+0x146/0x1c0
[   46.880910][ T3604]  do_exit+0x547/0x1eb0
[   46.885046][ T3604]  ? _raw_spin_unlock_irq+0x2a/0x40
[   46.890217][ T3604]  ? mm_update_next_owner+0x6d0/0x6d0
[   46.895564][ T3604]  ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[   46.901518][ T3604]  ? print_irqtrace_events+0x220/0x220
[   46.906955][ T3604]  ? vtime_user_exit+0x2b2/0x3e0
[   46.911869][ T3604]  do_group_exit+0x23b/0x2f0
[   46.916433][ T3604]  __x64_sys_exit_group+0x3b/0x40
[   46.921429][ T3604]  do_syscall_64+0x2b/0x70
[   46.925819][ T3604]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   46.931688][ T3604] RIP: 0033:0x7fe09e8dee19
[   46.936078][ T3604] Code: Unable to access opcode bytes at RIP 0x7fe09e8dedef.
[   46.943415][ T3604] RSP: 002b:00007ffea6f5df58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   46.951800][ T3604] RAX: ffffffffffffffda RBX: 00007fe09e9523f0 RCX: 00007fe09e8dee19
[   46.959747][ T3604] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   46.967811][ T3604] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[   46.975770][ T3604] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fe09e9523f0
[   46.983726][ T3604] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   46.991681][ T3604]  </TASK>
[   46.994859][ T3604] Kernel Offset: disabled
[   46.999166][ T3604] Rebooting in 86400 seconds..