bisecting cause commit starting from 5ff2756afde08b266fbb673849899fec694f39f1
building syzkaller on 858ea628800647d5e5b68b11441e42b8ef5652c1
testing commit 5ff2756afde08b266fbb673849899fec694f39f1 with gcc (GCC) 10.2.1 20210217
kernel signature: 56ad88b02b953f3f9ceaee62efb0eedf48407d23727a394c013403fa3d9e6e64
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.12
testing commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 with gcc (GCC) 10.2.1 20210217
kernel signature: 20a3195b0c2adea39c30d2e9f830a6fa425a34f031f28cd84a5fc4bf09ce8f4d
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.11
testing commit f40ddce88593482919761f74910f42f4b84c004b with gcc (GCC) 10.2.1 20210217
kernel signature: 22b26ae1e3be417e2ad324e47433a262e845b6471dfc09f4fa2f647b3330df8e
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.10
testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 with gcc (GCC) 10.2.1 20210217
kernel signature: 8f55ba93fd53951cac9b68b979c728becbef461543abacbe99727324ff41baf6
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.9
testing commit bbf5c979011a099af5dc76498918ed7df445635b with gcc (GCC) 10.2.1 20210217
kernel signature: f654d07eeb7c456b884d4afbd5bc4d393d1b1677ed42327eee0eaef482a1d4de
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.8
testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.4.1 20210217
kernel signature: 1063ebaf54671db7804acf12269942e9a5933d00bfb78bb5cf898a218f3c1d07
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.7
testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 with gcc (GCC) 8.4.1 20210217
kernel signature: 3856a09b3d94850025e3ae49dd0f33b972955333e09df445983a6a278d85997d
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.6
testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.4.1 20210217
kernel signature: a3b93acd1315ac27fd28df3f64d6ec371b03ab2c3dca6caf01eeb51039157802
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.5
testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.4.1 20210217
kernel signature: 56b75590080ebce41771eb20fb3a18a21250479d609f5cd866a9e9cf93705477
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.4
testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.4.1 20210217
kernel signature: c6858008ba2dd87e1e0dfa3f7b77c43b09b0dc43a2a0142524db4f19e9503c6e
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.3
testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.4.1 20210217
kernel signature: aae18b99c108d4b86fb7c39080c3a8373862416e546d19d54d8a47dcb2701455
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.2
testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.4.1 20210217
kernel signature: e13f671b39135f0fd02c29412f7240f2d07a062c4a49e605a3f48631956d18cb
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.1
testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.4.1 20210217
kernel signature: 1e42e1e588ea7d5fe6accbe13bfa4221a4f9f3d4fb725780ca1567cc27b907dc
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v5.0
testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.4.1 20210217
kernel signature: 456ab9d42a47fc3d91f08b7c50f5c4ec701f7eb218a74b092e90c30f2478d7da
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v4.20
testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.4.1 20210217
kernel signature: 994cee150f7059f60e1166fd111ffd790e804ee96e1ad5f7f83dfc6169d90697
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v4.19
testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.4.1 20210217
kernel signature: 1002e1d12c8e9746b4fe2c4dd7e2ab14f8a386b521890d2c30d26ffcb1e1e34c
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v4.18
testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.4.1 20210217
kernel signature: fa65721f68c32827a44fd49e6431feb55eb7d1e44ea06422f1a12adb0048760a
all runs: crashed: KASAN: use-after-free Read in drm_getunique
testing release v4.17
testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.4.1 20210217
failed to run ["make" "-j" "64" "ARCH=x86_64" "CC=/syzkaller/shared/bisect_bin/gcc-8.1.0/bin/gcc" "bzImage"]: exit status 2
testing release v4.16
testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.4.1 20210217
orc_dump.c:106:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
orc_dump.c:111:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
elf.c:135:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:140:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
testing release v4.15
testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.4.1 20210217
orc_dump.c:106:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
orc_dump.c:111:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:36:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
elf.c:135:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:140:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
testing release v4.14
testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.4.1 20210217
orc_dump.c:105:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
orc_dump.c:110:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:36:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
elf.c:134:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:139:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
testing release v4.13
testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.4.1 20210217
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
elf.c:144:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:149:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
testing release v4.12
testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.4.1 20210217
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
elf.c:141:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:146:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
testing release v4.11
testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.5.0
elf.c:141:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:146:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.10
testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
elf.c:129:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:134:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.9
testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
elf.c:129:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:134:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.8
testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
elf.c:129:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:134:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:33:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.7
testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
elf.c:122:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:127:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:33:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.6
testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
pager.c:33:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
revisions tested: 17, total time: 3h15m30.856701136s (build: 2h18m11.897750554s, test: 52m28.387488342s)
the crash already happened on the oldest tested release
commit msg: Linux 4.18
crash: KASAN: use-after-free Read in drm_getunique
IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
==================================================================
BUG: KASAN: use-after-free in drm_getunique+0x19e/0x250 drivers/gpu/drm/drm_ioctl.c:117
Read of size 4 at addr ffff8800ab872018 by task syz-executor.2/10279

CPU: 0 PID: 10279 Comm: syz-executor.2 Not tainted 4.18.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x15a/0x20d lib/dump_stack.c:113
 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 drm_getunique+0x19e/0x250 drivers/gpu/drm/drm_ioctl.c:117
 drm_ioctl_kernel+0x1b7/0x240 drivers/gpu/drm/drm_ioctl.c:744
 drm_ioctl+0x66a/0xa30 drivers/gpu/drm/drm_ioctl.c:840
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x196/0x1050 fs/ioctl.c:684
 ksys_ioctl+0x62/0x90 fs/ioctl.c:701
 __do_sys_ioctl fs/ioctl.c:708 [inline]
 __se_sys_ioctl fs/ioctl.c:706 [inline]
 __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:706
 do_syscall_64+0xda/0x540 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4665d9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 
RSP: 002b:00007f5aa666d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665d9
RDX: 0000000020000180 RSI: 00000000c0145401 RDI: 0000000000000003
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c038
R13: 00007ffdc996b9df R14: 00007f5aa666d300 R15: 0000000000022000

Allocated by task 10271:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538
 kmem_cache_alloc_trace+0x142/0x350 mm/slub.c:2735
 kmalloc include/linux/slab.h:513 [inline]
 kzalloc include/linux/slab.h:707 [inline]
 drm_master_create+0x42/0x550 drivers/gpu/drm/drm_auth.c:101
 drm_new_set_master+0xd0/0x2e0 drivers/gpu/drm/drm_auth.c:146
 drm_master_open+0xd6/0x110 drivers/gpu/drm/drm_auth.c:255
 drm_open_helper drivers/gpu/drm/drm_file.c:251 [inline]
 drm_open+0x81c/0x1010 drivers/gpu/drm/drm_file.c:155
 drm_stub_open+0x260/0x430 drivers/gpu/drm/drm_drv.c:942
 chrdev_open+0x1ed/0x5c0 fs/char_dev.c:417
 do_dentry_open+0x3da/0xd50 fs/open.c:794
 vfs_open+0xfc/0x240 fs/open.c:908
 do_last fs/namei.c:3399 [inline]
 path_openat+0x919/0x2290 fs/namei.c:3540
 do_filp_open+0x177/0x250 fs/namei.c:3574
 do_sys_open+0x1dc/0x360 fs/open.c:1101
 __do_sys_openat fs/open.c:1128 [inline]
 __se_sys_openat fs/open.c:1122 [inline]
 __x64_sys_openat+0x98/0xf0 fs/open.c:1122
 do_syscall_64+0xda/0x540 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 10271:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x167/0x240 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 slab_free_hook mm/slub.c:1373 [inline]
 slab_free_freelist_hook mm/slub.c:1400 [inline]
 slab_free mm/slub.c:2955 [inline]
 kfree+0x130/0x3b0 mm/slub.c:3908
 drm_master_destroy drivers/gpu/drm/drm_auth.c:354 [inline]
 kref_put include/linux/kref.h:70 [inline]
 drm_master_put+0x172/0x200 drivers/gpu/drm/drm_auth.c:365
 drm_new_set_master+0x19d/0x2e0 drivers/gpu/drm/drm_auth.c:165
 drm_setmaster_ioctl+0x10c/0x190 drivers/gpu/drm/drm_auth.c:197
 drm_ioctl_kernel+0x1b7/0x240 drivers/gpu/drm/drm_ioctl.c:744
 drm_ioctl+0x66a/0xa30 drivers/gpu/drm/drm_ioctl.c:840
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x196/0x1050 fs/ioctl.c:684
 ksys_ioctl+0x62/0x90 fs/ioctl.c:701
 __do_sys_ioctl fs/ioctl.c:708 [inline]
 __se_sys_ioctl fs/ioctl.c:706 [inline]
 __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:706
 do_syscall_64+0xda/0x540 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8800ab872000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 24 bytes inside of
 512-byte region [ffff8800ab872000, ffff8800ab872200)
The buggy address belongs to the page:
page:ffffea0002ae1c80 count:1 mapcount:0 mapping:ffff8800b6002c00 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 0000000000000000 0000000100000001 ffff8800b6002c00
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page allocated via order 1, migratetype Unmovable, gfp_mask 0x152c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:1906 [inline]
 prep_new_page mm/page_alloc.c:1914 [inline]
 get_page_from_freelist+0x2f35/0x46b0 mm/page_alloc.c:3345
 __alloc_pages_nodemask+0x39e/0x2780 mm/page_alloc.c:4369
 alloc_pages_current+0xd6/0x1b0 mm/mempolicy.c:2093
 alloc_pages include/linux/gfp.h:492 [inline]
 alloc_slab_page mm/slub.c:1440 [inline]
 allocate_slab mm/slub.c:1585 [inline]
 new_slab+0x4a9/0x850 mm/slub.c:1656
 new_slab_objects mm/slub.c:2419 [inline]
 ___slab_alloc+0x609/0x940 mm/slub.c:2571
 __slab_alloc.isra.22+0x78/0xe0 mm/slub.c:2611
 slab_alloc_node mm/slub.c:2674 [inline]
 __kmalloc_node_track_caller+0xea/0x460 mm/slub.c:4322
 __kmalloc_reserve.isra.8+0x2c/0xc0 net/core/skbuff.c:137
 __alloc_skb+0xd7/0x580 net/core/skbuff.c:205
 alloc_skb include/linux/skbuff.h:987 [inline]
 alloc_uevent_skb+0x84/0x220 lib/kobject_uevent.c:288
 uevent_net_broadcast_untagged lib/kobject_uevent.c:324 [inline]
 kobject_uevent_net_broadcast lib/kobject_uevent.c:406 [inline]
 kobject_uevent_env+0x7ad/0x1080 lib/kobject_uevent.c:587
 kobject_synth_uevent+0x5d9/0x833 lib/kobject_uevent.c:208
 uevent_store+0x39/0x60 drivers/base/bus.c:614
 drv_attr_store+0x67/0xb0 drivers/base/bus.c:73
 sysfs_kf_write+0xfd/0x150 fs/sysfs/file.c:139
 kernfs_fop_write+0x255/0x410 fs/kernfs/file.c:316

Memory state around the buggy address:
 ffff8800ab871f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8800ab871f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8800ab872000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8800ab872080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8800ab872100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================