program:
memfd_secret(0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94)
prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x3, 0x46576, 0xd})
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000)

[   76.876896][ T1312] ieee802154 phy0 wpan0: encryption failed: -22
[   76.879598][ T1312] ieee802154 phy1 wpan1: encryption failed: -22
[   77.150927][ T5315] ==================================================================
[   77.154318][ T5315] BUG: KASAN: slab-out-of-bounds in change_page_attr_set_clr+0x625/0xfc0
[   77.157858][ T5315] Read of size 8 at addr ffff888012072ab8 by task syz.0.0/5315
[   77.160987][ T5315] 
[   77.162050][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   77.162065][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   77.162073][ T5315] Call Trace:
[   77.162080][ T5315]  <TASK>
[   77.162085][ T5315]  dump_stack_lvl+0x189/0x250
[   77.162102][ T5315]  ? __kasan_check_byte+0x12/0x40
[   77.162157][ T5315]  ? __pfx_dump_stack_lvl+0x10/0x10
[   77.162169][ T5315]  ? lock_release+0x4b/0x3e0
[   77.162186][ T5315]  ? __virt_addr_valid+0x4a5/0x5c0
[   77.162223][ T5315]  print_report+0xca/0x240
[   77.162238][ T5315]  ? change_page_attr_set_clr+0x625/0xfc0
[   77.162253][ T5315]  kasan_report+0x118/0x150
[   77.162266][ T5315]  ? change_page_attr_set_clr+0x625/0xfc0
[   77.162283][ T5315]  change_page_attr_set_clr+0x625/0xfc0
[   77.162293][ T5315]  ? __pfx_change_page_attr_set_clr+0x10/0x10
[   77.162302][ T5315]  ? __pfx_pagerange_is_ram_callback+0x10/0x10
[   77.162311][ T5315]  ? memtype_reserve+0x874/0xb30
[   77.162321][ T5315]  ? __pfx___ww_mutex_lock+0x10/0x10
[   77.162364][ T5315]  _set_pages_array+0x145/0x270
[   77.162380][ T5315]  drm_gem_shmem_get_pages_locked+0x2d0/0x440
[   77.162398][ T5315]  ? __pfx_drm_gem_shmem_get_pages_locked+0x10/0x10
[   77.162415][ T5315]  ? ww_mutex_lock+0x3f/0x1c0
[   77.162426][ T5315]  drm_gem_shmem_mmap+0x193/0x460
[   77.162441][ T5315]  drm_gem_mmap_obj+0x18a/0x4e0
[   77.162452][ T5315]  drm_gem_mmap+0x384/0x640
[   77.162463][ T5315]  ? __pfx_drm_gem_mmap+0x10/0x10
[   77.162474][ T5315]  ? __mas_set_range+0x12f/0x3c0
[   77.162489][ T5315]  mmap_region+0x18b4/0x2110
[   77.162507][ T5315]  ? __pfx_mmap_region+0x10/0x10
[   77.162518][ T5315]  ? __schedule+0x17ae/0x4cc0
[   77.162532][ T5315]  ? drm_gem_handle_create_tail+0x20d/0x490
[   77.162552][ T5315]  ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10
[   77.162571][ T5315]  ? bpf_lsm_mmap_addr+0x9/0x20
[   77.162584][ T5315]  ? security_mmap_addr+0x71/0x270
[   77.162598][ T5315]  ? shmem_mapping+0xd/0x50
[   77.162609][ T5315]  ? memfd_check_seals_mmap+0xc5/0x200
[   77.162622][ T5315]  do_mmap+0xc45/0x10d0
[   77.162639][ T5315]  ? __pfx_do_mmap+0x10/0x10
[   77.162650][ T5315]  ? down_write_killable+0x178/0x230
[   77.162663][ T5315]  ? __pfx_down_write_killable+0x10/0x10
[   77.162674][ T5315]  ? common_file_perm+0x1b5/0x230
[   77.162692][ T5315]  vm_mmap_pgoff+0x2a6/0x4d0
[   77.162706][ T5315]  ? __pfx_vm_mmap_pgoff+0x10/0x10
[   77.162719][ T5315]  ? __fget_files+0x2a/0x420
[   77.162729][ T5315]  ? __fget_files+0x2a/0x420
[   77.162740][ T5315]  ? __fget_files+0x2a/0x420
[   77.162751][ T5315]  ksys_mmap_pgoff+0x51f/0x760
[   77.162765][ T5315]  do_syscall_64+0xfa/0xfa0
[   77.162774][ T5315]  ? lockdep_hardirqs_on+0x9c/0x150
[   77.162790][ T5315]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.162802][ T5315]  ? clear_bhb_loop+0x60/0xb0
[   77.162814][ T5315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.162824][ T5315] RIP: 0033:0x7fe4ff98eec9
[   77.162842][ T5315] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   77.162852][ T5315] RSP: 002b:00007fe500782038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[   77.162865][ T5315] RAX: ffffffffffffffda RBX: 00007fe4ffbe5fa0 RCX: 00007fe4ff98eec9
[   77.162875][ T5315] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 0000200000001000
[   77.162882][ T5315] RBP: 00007fe4ffa11f91 R08: 0000000000000006 R09: 0000000100000000
[   77.162889][ T5315] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000
[   77.162896][ T5315] R13: 00007fe4ffbe6038 R14: 00007fe4ffbe5fa0 R15: 00007ffeb8c7a918
[   77.162906][ T5315]  </TASK>
[   77.162910][ T5315] 
[   77.311799][ T5315] Allocated by task 5315:
[   77.313760][ T5315]  kasan_save_track+0x3e/0x80
[   77.315951][ T5315]  __kasan_kmalloc+0x93/0xb0
[   77.318070][ T5315]  __kvmalloc_node_noprof+0x5cd/0x910
[   77.320567][ T5315]  drm_gem_get_pages+0x166/0xa20
[   77.322938][ T5315]  drm_gem_shmem_get_pages_locked+0x201/0x440
[   77.325668][ T5315]  drm_gem_shmem_mmap+0x193/0x460
[   77.327946][ T5315]  drm_gem_mmap_obj+0x18a/0x4e0
[   77.330070][ T5315]  drm_gem_mmap+0x384/0x640
[   77.332063][ T5315]  mmap_region+0x18b4/0x2110
[   77.334096][ T5315]  do_mmap+0xc45/0x10d0
[   77.335985][ T5315]  vm_mmap_pgoff+0x2a6/0x4d0
[   77.337934][ T5315]  ksys_mmap_pgoff+0x51f/0x760
[   77.339943][ T5315]  do_syscall_64+0xfa/0xfa0
[   77.341905][ T5315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.344382][ T5315] 
[   77.345410][ T5315] The buggy address belongs to the object at ffff888012072000
[   77.345410][ T5315]  which belongs to the cache kmalloc-4k of size 4096
[   77.351185][ T5315] The buggy address is located 0 bytes to the right of
[   77.351185][ T5315]  allocated 2744-byte region [ffff888012072000, ffff888012072ab8)
[   77.357135][ T5315] 
[   77.358168][ T5315] The buggy address belongs to the physical page:
[   77.360835][ T5315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12070
[   77.364508][ T5315] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   77.367995][ T5315] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   77.371216][ T5315] page_type: f5(slab)
[   77.372851][ T5315] raw: 00fff00000000040 ffff88801a442140 ffffea0000482400 dead000000000002
[   77.376462][ T5315] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000
[   77.380072][ T5315] head: 00fff00000000040 ffff88801a442140 ffffea0000482400 dead000000000002
[   77.383596][ T5315] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000
[   77.387169][ T5315] head: 00fff00000000003 ffffea0000481c01 00000000ffffffff 00000000ffffffff
[   77.390738][ T5315] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   77.394307][ T5315] page dumped because: kasan: bad access detected
[   77.397060][ T5315] page_owner tracks the page as allocated
[   77.399488][ T5315] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4723, tgid 4723 (udevd), ts 37529380233, free_ts 28483212427
[   77.407865][ T5315]  post_alloc_hook+0x240/0x2a0
[   77.409888][ T5315]  get_page_from_freelist+0x2365/0x2440
[   77.412276][ T5315]  __alloc_frozen_pages_noprof+0x181/0x370
[   77.414682][ T5315]  alloc_pages_mpol+0x232/0x4a0
[   77.416739][ T5315]  allocate_slab+0x96/0x3a0
[   77.418706][ T5315]  ___slab_alloc+0xe94/0x18a0
[   77.420698][ T5315]  __slab_alloc+0x65/0x100
[   77.422603][ T5315]  __kmalloc_noprof+0x471/0x7f0
[   77.424809][ T5315]  tomoyo_realpath_from_path+0xe3/0x5d0
[   77.427309][ T5315]  tomoyo_check_open_permission+0x1c1/0x3b0
[   77.429925][ T5315]  security_file_open+0xb1/0x270
[   77.432065][ T5315]  do_dentry_open+0x384/0x13f0
[   77.434312][ T5315]  vfs_open+0x3b/0x340
[   77.436187][ T5315]  path_openat+0x2ee5/0x3830
[   77.438275][ T5315]  do_filp_open+0x1fa/0x410
[   77.440263][ T5315]  do_sys_openat2+0x121/0x1c0
[   77.442403][ T5315] page last free pid 4715 tgid 4715 stack trace:
[   77.445094][ T5315]  __free_frozen_pages+0xbc4/0xd30
[   77.447366][ T5315]  __put_partials+0x146/0x170
[   77.449419][ T5315]  put_cpu_partial+0x1f2/0x2e0
[   77.451604][ T5315]  __slab_free+0x2b9/0x390
[   77.453657][ T5315]  qlist_free_all+0x97/0x140
[   77.455676][ T5315]  kasan_quarantine_reduce+0x148/0x160
[   77.457983][ T5315]  __kasan_slab_alloc+0x22/0x80
[   77.460019][ T5315]  kmem_cache_alloc_noprof+0x367/0x6e0
[   77.462418][ T5315]  getname_flags+0xb8/0x540
[   77.464347][ T5315]  do_sys_openat2+0xbc/0x1c0
[   77.466343][ T5315]  __x64_sys_openat+0x138/0x170
[   77.468447][ T5315]  do_syscall_64+0xfa/0xfa0
[   77.470473][ T5315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.472923][ T5315] 
[   77.474012][ T5315] Memory state around the buggy address:
[   77.476454][ T5315]  ffff888012072980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   77.479692][ T5315]  ffff888012072a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   77.483043][ T5315] >ffff888012072a80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[   77.486369][ T5315]                                         ^
[   77.488792][ T5315]  ffff888012072b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   77.492099][ T5315]  ffff888012072b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   77.495437][ T5315] ==================================================================
[   77.499508][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   77.502348][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   77.505932][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   77.510379][ T5315] Call Trace:
[   77.511801][ T5315]  <TASK>
[   77.513070][ T5315]  dump_stack_lvl+0x99/0x250
[   77.515064][ T5315]  ? __asan_memcpy+0x40/0x70
[   77.517321][ T5315]  ? __pfx_dump_stack_lvl+0x10/0x10
[   77.519978][ T5315]  ? __pfx__printk+0x10/0x10
[   77.521926][ T5315]  vpanic+0x237/0x6d0
[   77.523656][ T5315]  ? __pfx_vpanic+0x10/0x10
[   77.525683][ T5315]  ? preempt_schedule+0xae/0xc0
[   77.527731][ T5315]  ? __pfx_preempt_schedule+0x10/0x10
[   77.530037][ T5315]  panic+0xb9/0xc0
[   77.531785][ T5315]  ? __pfx_panic+0x10/0x10
[   77.533800][ T5315]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[   77.536431][ T5315]  ? change_page_attr_set_clr+0x625/0xfc0
[   77.538917][ T5315]  check_panic_on_warn+0x89/0xb0
[   77.541137][ T5315]  ? change_page_attr_set_clr+0x625/0xfc0
[   77.543545][ T5315]  end_report+0x78/0x160
[   77.545397][ T5315]  kasan_report+0x129/0x150
[   77.547452][ T5315]  ? change_page_attr_set_clr+0x625/0xfc0
[   77.549898][ T5315]  change_page_attr_set_clr+0x625/0xfc0
[   77.552353][ T5315]  ? __pfx_change_page_attr_set_clr+0x10/0x10
[   77.555006][ T5315]  ? __pfx_pagerange_is_ram_callback+0x10/0x10
[   77.557783][ T5315]  ? memtype_reserve+0x874/0xb30
[   77.560012][ T5315]  ? __pfx___ww_mutex_lock+0x10/0x10
[   77.562253][ T5315]  _set_pages_array+0x145/0x270
[   77.564368][ T5315]  drm_gem_shmem_get_pages_locked+0x2d0/0x440
[   77.567071][ T5315]  ? __pfx_drm_gem_shmem_get_pages_locked+0x10/0x10
[   77.569925][ T5315]  ? ww_mutex_lock+0x3f/0x1c0
[   77.571994][ T5315]  drm_gem_shmem_mmap+0x193/0x460
[   77.574184][ T5315]  drm_gem_mmap_obj+0x18a/0x4e0
[   77.576322][ T5315]  drm_gem_mmap+0x384/0x640
[   77.578287][ T5315]  ? __pfx_drm_gem_mmap+0x10/0x10
[   77.580390][ T5315]  ? __mas_set_range+0x12f/0x3c0
[   77.582574][ T5315]  mmap_region+0x18b4/0x2110
[   77.584579][ T5315]  ? __pfx_mmap_region+0x10/0x10
[   77.586663][ T5315]  ? __schedule+0x17ae/0x4cc0
[   77.588571][ T5315]  ? drm_gem_handle_create_tail+0x20d/0x490
[   77.590936][ T5315]  ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10
[   77.593492][ T5315]  ? bpf_lsm_mmap_addr+0x9/0x20
[   77.595464][ T5315]  ? security_mmap_addr+0x71/0x270
[   77.597508][ T5315]  ? shmem_mapping+0xd/0x50
[   77.599352][ T5315]  ? memfd_check_seals_mmap+0xc5/0x200
[   77.601644][ T5315]  do_mmap+0xc45/0x10d0
[   77.603436][ T5315]  ? __pfx_do_mmap+0x10/0x10
[   77.605462][ T5315]  ? down_write_killable+0x178/0x230
[   77.607740][ T5315]  ? __pfx_down_write_killable+0x10/0x10
[   77.610172][ T5315]  ? common_file_perm+0x1b5/0x230
[   77.612325][ T5315]  vm_mmap_pgoff+0x2a6/0x4d0
[   77.614277][ T5315]  ? __pfx_vm_mmap_pgoff+0x10/0x10
[   77.616427][ T5315]  ? __fget_files+0x2a/0x420
[   77.618450][ T5315]  ? __fget_files+0x2a/0x420
[   77.620385][ T5315]  ? __fget_files+0x2a/0x420
[   77.622345][ T5315]  ksys_mmap_pgoff+0x51f/0x760
[   77.624389][ T5315]  do_syscall_64+0xfa/0xfa0
[   77.626373][ T5315]  ? lockdep_hardirqs_on+0x9c/0x150
[   77.628530][ T5315]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.631159][ T5315]  ? clear_bhb_loop+0x60/0xb0
[   77.633186][ T5315]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.635753][ T5315] RIP: 0033:0x7fe4ff98eec9
[   77.637655][ T5315] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   77.645714][ T5315] RSP: 002b:00007fe500782038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[   77.649212][ T5315] RAX: ffffffffffffffda RBX: 00007fe4ffbe5fa0 RCX: 00007fe4ff98eec9
[   77.652609][ T5315] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 0000200000001000
[   77.655985][ T5315] RBP: 00007fe4ffa11f91 R08: 0000000000000006 R09: 0000000100000000
[   77.659305][ T5315] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000000
[   77.662707][ T5315] R13: 00007fe4ffbe6038 R14: 00007fe4ffbe5fa0 R15: 00007ffeb8c7a918
[   77.666138][ T5315]  </TASK>
[   77.667906][ T5315] Kernel Offset: disabled
[   77.669842][ T5315] Rebooting in 86400 seconds..