forked to background, child pid 3172
no interfaces have a carrier
[   23.761387][ T3173] 8021q: adding VLAN 0 to HW filter on device bond0
[   23.771652][ T3173] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.1.81' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   39.116913][ T3586] FAULT_INJECTION: forcing a failure.
[   39.116913][ T3586] name failslab, interval 1, probability 0, space 0, times 1
[   39.130430][ T3586] CPU: 1 PID: 3586 Comm: syz-executor156 Not tainted 5.18.0-rc3-syzkaller-00190-gc00c5e1d157b #0
[   39.141035][ T3586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   39.151224][ T3586] Call Trace:
[   39.154516][ T3586]  <TASK>
[   39.157443][ T3586]  dump_stack_lvl+0xcd/0x134
[   39.162055][ T3586]  should_fail.cold+0x5/0xa
[   39.166543][ T3586]  ? kvmalloc_node+0x3e/0x130
[   39.171207][ T3586]  should_failslab+0x5/0x10
[   39.175878][ T3586]  __kmalloc_node+0x75/0x390
[   39.180470][ T3586]  kvmalloc_node+0x3e/0x130
[   39.184964][ T3586]  drm_gem_get_pages+0x14e/0x590
[   39.189895][ T3586]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[   39.195862][ T3586]  ? drm_gem_shmem_get_pages+0x56/0x250
[   39.201396][ T3586]  ? drm_gem_object_lookup+0xc0/0xc0
[   39.206711][ T3586]  ? mutex_lock_io_nested+0x1150/0x1150
[   39.212250][ T3586]  ? find_held_lock+0x2d/0x110
[   39.217004][ T3586]  ? drm_vma_node_is_allowed+0xc4/0x100
[   39.222538][ T3586]  ? lock_downgrade+0x6e0/0x6e0
[   39.227385][ T3586]  drm_gem_shmem_get_pages+0xd6/0x250
[   39.232833][ T3586]  ? drm_gem_shmem_mmap+0x2b0/0x2b0
[   39.238132][ T3586]  drm_gem_shmem_mmap+0x137/0x2b0
[   39.243230][ T3586]  ? drm_gem_shmem_mmap+0x2b0/0x2b0
[   39.248411][ T3586]  drm_gem_mmap_obj+0x1b8/0x450
[   39.253248][ T3586]  drm_gem_mmap+0x419/0x770
[   39.257736][ T3586]  ? drm_gem_lock_reservations+0xe00/0xe00
[   39.263527][ T3586]  ? kmem_cache_alloc+0x2ef/0x3b0
[   39.268539][ T3586]  mmap_region+0xba5/0x14a0
[   39.273029][ T3586]  ? vm_munmap+0x20/0x20
[   39.277255][ T3586]  ? cap_mmap_addr+0x50/0x300
[   39.281930][ T3586]  ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70
[   39.288157][ T3586]  ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[   39.294379][ T3586]  ? get_unmapped_area+0x2ae/0x3d0
[   39.299652][ T3586]  do_mmap+0x863/0xfa0
[   39.303718][ T3586]  vm_mmap_pgoff+0x1b7/0x290
[   39.308328][ T3586]  ? randomize_stack_top+0x100/0x100
[   39.313600][ T3586]  ? __fget_files+0x286/0x470
[   39.318268][ T3586]  ksys_mmap_pgoff+0x40d/0x5a0
[   39.323054][ T3586]  do_syscall_64+0x35/0xb0
[   39.327634][ T3586]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   39.333517][ T3586] RIP: 0033:0x7fe554578cf9
[   39.337920][ T3586] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   39.357649][ T3586] RSP: 002b:00007fff1b350298 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[   39.366251][ T3586] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fe554578cf9
[   39.374206][ T3586] RDX: 0000000000000000 RSI: 0000000000003028 RDI: 0000000020ffc000
[   39.382168][ T3586] RBP: 00007fff1b3502b0 R08: 0000000000000003 R09: 0000000100000000
[   39.390129][ T3586] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000004
[   39.398085][ T3586] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   39.406048][ T3586]  </TASK>
[   39.413365][ T3586] ==================================================================
[   39.421433][ T3586] BUG: KASAN: use-after-free in drm_gem_object_release_handle+0xf2/0x110
[   39.429843][ T3586] Read of size 8 at addr ffff88801df01a28 by task syz-executor156/3586
[   39.438065][ T3586] 
[   39.440371][ T3586] CPU: 0 PID: 3586 Comm: syz-executor156 Not tainted 5.18.0-rc3-syzkaller-00190-gc00c5e1d157b #0
[   39.450976][ T3586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   39.461017][ T3586] Call Trace:
[   39.464280][ T3586]  <TASK>
[   39.467189][ T3586]  dump_stack_lvl+0xcd/0x134
[   39.471780][ T3586]  print_address_description.constprop.0.cold+0xeb/0x495
[   39.478791][ T3586]  ? drm_gem_object_release_handle+0xf2/0x110
[   39.484840][ T3586]  kasan_report.cold+0xf4/0x1c6
[   39.489677][ T3586]  ? drm_gem_object_release_handle+0xf2/0x110
[   39.495728][ T3586]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   39.502390][ T3586]  drm_gem_object_release_handle+0xf2/0x110
[   39.508497][ T3586]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   39.515244][ T3586]  idr_for_each+0x113/0x220
[   39.519736][ T3586]  ? idr_find+0x50/0x50
[   39.523887][ T3586]  drm_gem_release+0x22/0x30
[   39.528468][ T3586]  drm_file_free.part.0+0x805/0xb80
[   39.533660][ T3586]  ? fsnotify+0x13d0/0x13d0
[   39.538162][ T3586]  drm_close_helper.isra.0+0x17d/0x1f0
[   39.543615][ T3586]  drm_release+0x1e6/0x530
[   39.548026][ T3586]  __fput+0x277/0x9d0
[   39.551998][ T3586]  ? drm_release_noglobal+0x180/0x180
[   39.557359][ T3586]  task_work_run+0xdd/0x1a0
[   39.561860][ T3586]  do_exit+0xaff/0x2a00
[   39.566009][ T3586]  ? lock_downgrade+0x6e0/0x6e0
[   39.570854][ T3586]  ? mm_update_next_owner+0x7a0/0x7a0
[   39.576222][ T3586]  do_group_exit+0xd2/0x2f0
[   39.580722][ T3586]  __x64_sys_exit_group+0x3a/0x50
[   39.585739][ T3586]  do_syscall_64+0x35/0xb0
[   39.590152][ T3586]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   39.596047][ T3586] RIP: 0033:0x7fe5545779f9
[   39.600494][ T3586] Code: Unable to access opcode bytes at RIP 0x7fe5545779cf.
[   39.607876][ T3586] RSP: 002b:00007fff1b350288 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   39.616538][ T3586] RAX: ffffffffffffffda RBX: 00007fe5545eb3f0 RCX: 00007fe5545779f9
[   39.624501][ T3586] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   39.632462][ T3586] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[   39.640428][ T3586] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fe5545eb3f0
[   39.648388][ T3586] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   39.656356][ T3586]  </TASK>
[   39.659360][ T3586] 
[   39.661671][ T3586] Allocated by task 3586:
[   39.665978][ T3586]  kasan_save_stack+0x1e/0x40
[   39.670653][ T3586]  __kasan_kmalloc+0xa9/0xd0
[   39.675320][ T3586]  vgem_gem_create_object+0x38/0xb0
[   39.680515][ T3586]  __drm_gem_shmem_create+0x80/0x480
[   39.685790][ T3586]  drm_gem_shmem_dumb_create+0x13c/0x380
[   39.691414][ T3586]  drm_mode_create_dumb+0x26c/0x2f0
[   39.696607][ T3586]  drm_ioctl_kernel+0x27d/0x4e0
[   39.701446][ T3586]  drm_ioctl+0x51e/0x9d0
[   39.705679][ T3586]  __x64_sys_ioctl+0x193/0x200
[   39.710435][ T3586]  do_syscall_64+0x35/0xb0
[   39.714845][ T3586]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   39.720727][ T3586] 
[   39.723035][ T3586] Freed by task 3586:
[   39.726992][ T3586]  kasan_save_stack+0x1e/0x40
[   39.731661][ T3586]  kasan_set_track+0x21/0x30
[   39.736238][ T3586]  kasan_set_free_info+0x20/0x30
[   39.741170][ T3586]  ____kasan_slab_free+0x166/0x1a0
[   39.746534][ T3586]  slab_free_freelist_hook+0x8b/0x1c0
[   39.751898][ T3586]  kfree+0xd6/0x4d0
[   39.755696][ T3586]  drm_gem_mmap+0x4fc/0x770
[   39.760191][ T3586]  mmap_region+0xba5/0x14a0
[   39.764805][ T3586]  do_mmap+0x863/0xfa0
[   39.768863][ T3586]  vm_mmap_pgoff+0x1b7/0x290
[   39.773442][ T3586]  ksys_mmap_pgoff+0x40d/0x5a0
[   39.778281][ T3586]  do_syscall_64+0x35/0xb0
[   39.782866][ T3586]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   39.788875][ T3586] 
[   39.791197][ T3586] The buggy address belongs to the object at ffff88801df01800
[   39.791197][ T3586]  which belongs to the cache kmalloc-1k of size 1024
[   39.805828][ T3586] The buggy address is located 552 bytes inside of
[   39.805828][ T3586]  1024-byte region [ffff88801df01800, ffff88801df01c00)
[   39.819218][ T3586] 
[   39.821539][ T3586] The buggy address belongs to the physical page:
[   39.827932][ T3586] page:ffffea000077c000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1df00
[   39.838072][ T3586] head:ffffea000077c000 order:3 compound_mapcount:0 compound_pincount:0
[   39.846380][ T3586] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   39.854638][ T3586] raw: 00fff00000010200 ffffea0001ef2e00 dead000000000002 ffff888010c41dc0
[   39.863400][ T3586] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   39.871981][ T3586] page dumped because: kasan: bad access detected
[   39.879071][ T3586] page_owner tracks the page as allocated
[   39.884918][ T3586] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 947, tgid 947 (kworker/u4:4), ts 7392766728, free_ts 0
[   39.903787][ T3586]  get_page_from_freelist+0xba2/0x3e00
[   39.909265][ T3586]  __alloc_pages+0x1b2/0x500
[   39.913848][ T3586]  allocate_slab+0x80/0x3c0
[   39.918487][ T3586]  ___slab_alloc+0x8df/0xf20
[   39.923075][ T3586]  __slab_alloc.constprop.0+0x4d/0xa0
[   39.928910][ T3586]  __kmalloc_node+0x2cb/0x390
[   39.933751][ T3586]  blk_alloc_flush_queue+0x121/0x320
[   39.939131][ T3586]  blk_mq_alloc_and_init_hctx+0xc3e/0x1190
[   39.944948][ T3586]  blk_mq_realloc_hw_ctxs+0x43d/0x590
[   39.950397][ T3586]  blk_mq_init_allocated_queue+0x457/0x13d0
[   39.956368][ T3586]  blk_mq_init_queue+0xc3/0x140
[   39.961382][ T3586]  scsi_alloc_sdev+0x852/0xcc0
[   39.966384][ T3586]  scsi_probe_and_add_lun+0x1e44/0x35e0
[   39.972012][ T3586]  __scsi_scan_target+0x21f/0xdb0
[   39.977039][ T3586]  scsi_scan_channel+0x148/0x1e0
[   39.982054][ T3586]  scsi_scan_host_selected+0x2df/0x3b0
[   39.987505][ T3586] page_owner free stack trace missing
[   39.993204][ T3586] 
[   39.995510][ T3586] Memory state around the buggy address:
[   40.001334][ T3586]  ffff88801df01900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.009596][ T3586]  ffff88801df01980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.017744][ T3586] >ffff88801df01a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.025928][ T3586]                                   ^
[   40.031312][ T3586]  ffff88801df01a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.039591][ T3586]  ffff88801df01b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.047733][ T3586] ==================================================================
[   40.057487][ T3586] Kernel panic - not syncing: panic_on_warn set ...
[   40.064081][ T3586] CPU: 0 PID: 3586 Comm: syz-executor156 Not tainted 5.18.0-rc3-syzkaller-00190-gc00c5e1d157b #0
[   40.074746][ T3586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   40.084807][ T3586] Call Trace:
[   40.088077][ T3586]  <TASK>
[   40.091577][ T3586]  dump_stack_lvl+0xcd/0x134
[   40.096433][ T3586]  panic+0x2d7/0x636
[   40.100951][ T3586]  ? panic_print_sys_info.part.0+0x10b/0x10b
[   40.106943][ T3586]  ? preempt_schedule_common+0x59/0xc0
[   40.112983][ T3586]  ? drm_gem_object_release_handle+0xf2/0x110
[   40.119097][ T3586]  ? preempt_schedule_thunk+0x16/0x18
[   40.124493][ T3586]  ? trace_hardirqs_on+0x38/0x1c0
[   40.130514][ T3586]  ? drm_gem_object_release_handle+0xf2/0x110
[   40.136996][ T3586]  end_report.part.0+0x3f/0x7c
[   40.141791][ T3586]  kasan_report.cold+0x93/0x1c6
[   40.146825][ T3586]  ? drm_gem_object_release_handle+0xf2/0x110
[   40.152922][ T3586]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   40.159602][ T3586]  drm_gem_object_release_handle+0xf2/0x110
[   40.166062][ T3586]  ? drm_gem_object_handle_put_unlocked+0x390/0x390
[   40.172735][ T3586]  idr_for_each+0x113/0x220
[   40.177242][ T3586]  ? idr_find+0x50/0x50
[   40.181400][ T3586]  drm_gem_release+0x22/0x30
[   40.185983][ T3586]  drm_file_free.part.0+0x805/0xb80
[   40.191178][ T3586]  ? fsnotify+0x13d0/0x13d0
[   40.195688][ T3586]  drm_close_helper.isra.0+0x17d/0x1f0
[   40.201156][ T3586]  drm_release+0x1e6/0x530
[   40.205576][ T3586]  __fput+0x277/0x9d0
[   40.209556][ T3586]  ? drm_release_noglobal+0x180/0x180
[   40.214931][ T3586]  task_work_run+0xdd/0x1a0
[   40.219441][ T3586]  do_exit+0xaff/0x2a00
[   40.223597][ T3586]  ? lock_downgrade+0x6e0/0x6e0
[   40.228447][ T3586]  ? mm_update_next_owner+0x7a0/0x7a0
[   40.233818][ T3586]  do_group_exit+0xd2/0x2f0
[   40.238401][ T3586]  __x64_sys_exit_group+0x3a/0x50
[   40.243417][ T3586]  do_syscall_64+0x35/0xb0
[   40.247829][ T3586]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   40.253730][ T3586] RIP: 0033:0x7fe5545779f9
[   40.258641][ T3586] Code: Unable to access opcode bytes at RIP 0x7fe5545779cf.
[   40.266000][ T3586] RSP: 002b:00007fff1b350288 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   40.274418][ T3586] RAX: ffffffffffffffda RBX: 00007fe5545eb3f0 RCX: 00007fe5545779f9
[   40.282389][ T3586] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[   40.290351][ T3586] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000100000000
[   40.298319][ T3586] R10: 0000000000000012 R11: 0000000000000246 R12: 00007fe5545eb3f0
[   40.306279][ T3586] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   40.314244][ T3586]  </TASK>
[   40.317321][ T3586] Kernel Offset: disabled
[   40.321657][ T3586] Rebooting in 86400 seconds..