./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1154853473

<...>
forked to background, child pid 3184
no interfaces have a carrier
[   21.938801][ T3185] 8021q: adding VLAN 0 to HW filter on device bond0
[   21.948144][ T3185] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.1.83' (ECDSA) to the list of known hosts.
execve("./syz-executor1154853473", ["./syz-executor1154853473"], 0x7fffd837c9f0 /* 10 vars */) = 0
brk(NULL)                               = 0x55555594d000
brk(0x55555594dc40)                     = 0x55555594dc40
arch_prctl(ARCH_SET_FS, 0x55555594d300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1154853473", 4096) = 28
brk(0x55555596ec40)                     = 0x55555596ec40
brk(0x55555596f000)                     = 0x55555596f000
mprotect(0x7f5af5b1d000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 3
ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000080) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "4", 1)                        = 1
mmap(0x20ffc000, 12328, PROT_NONE, MAP_PRIVATE|MAP_FIXED, 3, 0x100000000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0)                           = ?
syzkaller login: [   39.282634][ T3606] ==================================================================
[   39.290807][ T3606] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xf2/0x110
[   39.299233][ T3606] Read of size 8 at addr ffff88814b1969e8 by task syz-executor115/3606
[   39.307544][ T3606] 
[   39.309856][ T3606] CPU: 0 PID: 3606 Comm: syz-executor115 Not tainted 5.19.0-rc7-syzkaller-00190-g70664fc10c0d #0
[   39.320341][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[   39.330428][ T3606] Call Trace:
[   39.333695][ T3606]  <TASK>
[   39.336615][ T3606]  dump_stack_lvl+0xcd/0x134
[   39.341288][ T3606]  print_address_description.constprop.0.cold+0xeb/0x495
[   39.348303][ T3606]  ? drm_gem_object_release_handle+0xf2/0x110
[   39.354367][ T3606]  kasan_report.cold+0xf4/0x1c6
[   39.359207][ T3606]  ? drm_gem_object_release_handle+0xf2/0x110
[   39.365266][ T3606]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   39.371933][ T3606]  drm_gem_object_release_handle+0xf2/0x110
[   39.377820][ T3606]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   39.384399][ T3606]  idr_for_each+0x113/0x220
[   39.388979][ T3606]  ? idr_find+0x50/0x50
[   39.393127][ T3606]  ? _raw_spin_unlock_irqrestore+0x50/0x70
[   39.398932][ T3606]  drm_gem_release+0x22/0x30
[   39.403518][ T3606]  drm_file_free.part.0+0x805/0xb80
[   39.408797][ T3606]  ? fsnotify+0x13a0/0x13a0
[   39.413292][ T3606]  drm_close_helper.isra.0+0x17d/0x1f0
[   39.418744][ T3606]  drm_release+0x1e6/0x530
[   39.423152][ T3606]  __fput+0x277/0x9d0
[   39.427297][ T3606]  ? drm_release_noglobal+0x180/0x180
[   39.432841][ T3606]  task_work_run+0xdd/0x1a0
[   39.437337][ T3606]  do_exit+0xade/0x29d0
[   39.441485][ T3606]  ? mm_update_next_owner+0x7a0/0x7a0
[   39.446849][ T3606]  ? _raw_spin_unlock_irq+0x1f/0x40
[   39.452564][ T3606]  ? _raw_spin_unlock_irq+0x1f/0x40
[   39.457931][ T3606]  do_group_exit+0xd2/0x2f0
[   39.462426][ T3606]  __x64_sys_exit_group+0x3a/0x50
[   39.467445][ T3606]  do_syscall_64+0x35/0xb0
[   39.471853][ T3606]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   39.477826][ T3606] RIP: 0033:0x7f5af5aaf9e9
[   39.482227][ T3606] Code: Unable to access opcode bytes at RIP 0x7f5af5aaf9bf.
[   39.489833][ T3606] RSP: 002b:00007ffc566be7b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   39.498238][ T3606] RAX: ffffffffffffffda RBX: 00007f5af5b233f0 RCX: 00007f5af5aaf9e9
[   39.506302][ T3606] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   39.514285][ T3606] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[   39.522245][ T3606] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f5af5b233f0
[   39.530202][ T3606] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   39.538167][ T3606]  </TASK>
[   39.541172][ T3606] 
[   39.543481][ T3606] Allocated by task 3606:
[   39.547788][ T3606]  kasan_save_stack+0x1e/0x40
[   39.552460][ T3606]  __kasan_kmalloc+0xa9/0xd0
[   39.557051][ T3606]  vgem_gem_create_object+0x38/0xb0
[   39.562337][ T3606]  __drm_gem_shmem_create+0x80/0x480
[   39.567615][ T3606]  drm_gem_shmem_dumb_create+0x13c/0x380
[   39.573235][ T3606]  drm_mode_create_dumb+0x26c/0x2f0
[   39.578430][ T3606]  drm_ioctl_kernel+0x27d/0x4e0
[   39.583361][ T3606]  drm_ioctl+0x51e/0x9d0
[   39.587592][ T3606]  __x64_sys_ioctl+0x193/0x200
[   39.592345][ T3606]  do_syscall_64+0x35/0xb0
[   39.596752][ T3606]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   39.602985][ T3606] 
[   39.605292][ T3606] Freed by task 3606:
[   39.609250][ T3606]  kasan_save_stack+0x1e/0x40
[   39.613921][ T3606]  kasan_set_track+0x21/0x30
[   39.618503][ T3606]  kasan_set_free_info+0x20/0x30
[   39.623429][ T3606]  ____kasan_slab_free+0x166/0x1a0
[   39.628529][ T3606]  slab_free_freelist_hook+0x8b/0x1c0
[   39.633895][ T3606]  kfree+0xd6/0x4d0
[   39.637691][ T3606]  drm_gem_mmap+0x4fc/0x770
[   39.642184][ T3606]  mmap_region+0xbe7/0x1460
[   39.646672][ T3606]  do_mmap+0x863/0xfa0
[   39.650727][ T3606]  vm_mmap_pgoff+0x1b7/0x290
[   39.655303][ T3606]  ksys_mmap_pgoff+0x40d/0x5a0
[   39.660052][ T3606]  do_syscall_64+0x35/0xb0
[   39.664463][ T3606]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   39.670349][ T3606] 
[   39.672654][ T3606] The buggy address belongs to the object at ffff88814b196800
[   39.672654][ T3606]  which belongs to the cache kmalloc-1k of size 1024
[   39.687042][ T3606] The buggy address is located 488 bytes inside of
[   39.687042][ T3606]  1024-byte region [ffff88814b196800, ffff88814b196c00)
[   39.700565][ T3606] 
[   39.703056][ T3606] The buggy address belongs to the physical page:
[   39.709538][ T3606] page:ffffea00052c6400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14b190
[   39.719855][ T3606] head:ffffea00052c6400 order:3 compound_mapcount:0 compound_pincount:0
[   39.728167][ T3606] flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff)
[   39.736228][ T3606] raw: 057ff00000010200 ffffea00052aac00 dead000000000002 ffff888011841dc0
[   39.745147][ T3606] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[   39.753715][ T3606] page dumped because: kasan: bad access detected
[   39.760111][ T3606] page_owner tracks the page as allocated
[   39.765809][ T3606] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 10214363224, free_ts 0
[   39.785506][ T3606]  get_page_from_freelist+0x1290/0x3b70
[   39.791049][ T3606]  __alloc_pages+0x1c7/0x510
[   39.795628][ T3606]  alloc_page_interleave+0x1e/0x200
[   39.800833][ T3606]  alloc_pages+0x2b1/0x310
[   39.805234][ T3606]  allocate_slab+0x26c/0x3c0
[   39.809811][ T3606]  ___slab_alloc+0x9c4/0xe20
[   39.814389][ T3606]  __slab_alloc.constprop.0+0x4d/0xa0
[   39.819760][ T3606]  kmem_cache_alloc_trace+0x310/0x3f0
[   39.825123][ T3606]  alloc_workspace+0x14f/0x350
[   39.829872][ T3606]  btrfs_init_workspace_manager+0x136/0x2b6
[   39.835754][ T3606]  btrfs_init_compress+0xc/0x25
[   39.840598][ T3606]  init_btrfs_fs+0x30/0x24f
[   39.845175][ T3606]  do_one_initcall+0x103/0x650
[   39.849928][ T3606]  kernel_init_freeable+0x6b1/0x73a
[   39.855198][ T3606]  kernel_init+0x1a/0x1d0
[   39.859514][ T3606]  ret_from_fork+0x1f/0x30
[   39.863934][ T3606] page_owner free stack trace missing
[   39.869283][ T3606] 
[   39.871595][ T3606] Memory state around the buggy address:
[   39.877206][ T3606]  ffff88814b196880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.885251][ T3606]  ffff88814b196900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.893390][ T3606] >ffff88814b196980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.901518][ T3606]                                                           ^
[   39.908954][ T3606]  ffff88814b196a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.916997][ T3606]  ffff88814b196a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.925041][ T3606] ==================================================================
[   39.933913][ T3606] Kernel panic - not syncing: panic_on_warn set ...
[   39.940507][ T3606] CPU: 0 PID: 3606 Comm: syz-executor115 Not tainted 5.19.0-rc7-syzkaller-00190-g70664fc10c0d #0
[   39.951083][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[   39.961123][ T3606] Call Trace:
[   39.964388][ T3606]  <TASK>
[   39.967407][ T3606]  dump_stack_lvl+0xcd/0x134
[   39.971994][ T3606]  panic+0x2d7/0x636
[   39.975885][ T3606]  ? panic_print_sys_info.part.0+0x10b/0x10b
[   39.981854][ T3606]  ? preempt_schedule_common+0x59/0xc0
[   39.987301][ T3606]  ? drm_gem_object_release_handle+0xf2/0x110
[   39.993366][ T3606]  ? preempt_schedule_thunk+0x16/0x18
[   39.998817][ T3606]  ? drm_gem_object_release_handle+0xf2/0x110
[   40.004875][ T3606]  end_report.part.0+0x3f/0x7c
[   40.009727][ T3606]  kasan_report.cold+0x93/0x1c6
[   40.014565][ T3606]  ? drm_gem_object_release_handle+0xf2/0x110
[   40.020747][ T3606]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   40.027337][ T3606]  drm_gem_object_release_handle+0xf2/0x110
[   40.033223][ T3606]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   40.039805][ T3606]  idr_for_each+0x113/0x220
[   40.044300][ T3606]  ? idr_find+0x50/0x50
[   40.048446][ T3606]  ? _raw_spin_unlock_irqrestore+0x50/0x70
[   40.054254][ T3606]  drm_gem_release+0x22/0x30
[   40.058834][ T3606]  drm_file_free.part.0+0x805/0xb80
[   40.064023][ T3606]  ? fsnotify+0x13a0/0x13a0
[   40.068527][ T3606]  drm_close_helper.isra.0+0x17d/0x1f0
[   40.073982][ T3606]  drm_release+0x1e6/0x530
[   40.078854][ T3606]  __fput+0x277/0x9d0
[   40.082911][ T3606]  ? drm_release_noglobal+0x180/0x180
[   40.088446][ T3606]  task_work_run+0xdd/0x1a0
[   40.093067][ T3606]  do_exit+0xade/0x29d0
[   40.097221][ T3606]  ? mm_update_next_owner+0x7a0/0x7a0
[   40.102599][ T3606]  ? _raw_spin_unlock_irq+0x1f/0x40
[   40.107794][ T3606]  ? _raw_spin_unlock_irq+0x1f/0x40
[   40.112984][ T3606]  do_group_exit+0xd2/0x2f0
[   40.117484][ T3606]  __x64_sys_exit_group+0x3a/0x50
[   40.122500][ T3606]  do_syscall_64+0x35/0xb0
[   40.126908][ T3606]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   40.132793][ T3606] RIP: 0033:0x7f5af5aaf9e9
[   40.137194][ T3606] Code: Unable to access opcode bytes at RIP 0x7f5af5aaf9bf.
[   40.144541][ T3606] RSP: 002b:00007ffc566be7b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   40.152940][ T3606] RAX: ffffffffffffffda RBX: 00007f5af5b233f0 RCX: 00007f5af5aaf9e9
[   40.160901][ T3606] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   40.168861][ T3606] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[   40.176820][ T3606] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f5af5b233f0
[   40.184865][ T3606] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   40.192828][ T3606]  </TASK>
[   40.196496][ T3606] Kernel Offset: disabled
[   40.200822][ T3606] Rebooting in 86400 seconds..