program: r0 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r0, 0xc0106407, &(0x7f0000000000)={0x1, 0x1}) ioctl$DRM_IOCTL_GET_UNIQUE(r0, 0xc0106401, &(0x7f00000004c0)={0x7, 0x0}) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)={0x0, 0xfb, 0x15, 0x4, 0x10, "00f2d028d9ea4eeb047588647e6993fd"}, 0x15, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f00000001c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r3}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000580)={0x601, 0x1, &(0x7f0000000180)=[r3], &(0x7f0000000400)=[0x3], &(0x7f0000000640)=[r5, r4, r4], &(0x7f0000000340), 0x0, 0xffffffffffffffff}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000000240)={0x1, &(0x7f00000002c0)=[{0x16, 0x3, 0x5, 0xfffffffd}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005345c0f63cdc2e828"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x94) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000140)={&(0x7f0000000040)=[r4], 0x1, 0xc00}) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x1b, 0xa, 0x100, "05fcff410400001bf9585253af00c495f2bc83827f0f00bd31002000", 0x20363059}) [ 86.796890][ T5271] Bluetooth: hci0: command tx timeout [ 87.147700][ T1050] ================================================================== [ 87.152598][ T1050] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 87.172365][ T1050] Read of size 1 at addr ffff88801fd9b409 by task kworker/u4:7/1050 [ 87.192086][ T1050] [ 87.193536][ T1050] CPU: 0 UID: 0 PID: 1050 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full) [ 87.193551][ T1050] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.193559][ T1050] Workqueue: events_unbound commit_work [ 87.193580][ T1050] Call Trace: [ 87.193587][ T1050] [ 87.193593][ T1050] dump_stack_lvl+0xe8/0x150 [ 87.193610][ T1050] print_address_description+0x55/0x1e0 [ 87.193623][ T1050] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 87.193636][ T1050] print_report+0x58/0x70 [ 87.193646][ T1050] kasan_report+0x117/0x150 [ 87.193659][ T1050] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 87.193675][ T1050] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 87.193689][ T1050] ? preempt_schedule_thunk+0x16/0x40 [ 87.193701][ T1050] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 87.193717][ T1050] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 87.193784][ T1050] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 87.193798][ T1050] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 87.193814][ T1050] commit_tail+0x2b1/0x3c0 [ 87.193827][ T1050] ? process_scheduled_works+0xa20/0x14e0 [ 87.193838][ T1050] process_scheduled_works+0xa8e/0x14e0 [ 87.193852][ T1050] ? __pfx_process_scheduled_works+0x10/0x10 [ 87.193864][ T1050] ? assign_work+0x3cf/0x5d0 [ 87.193874][ T1050] worker_thread+0xa47/0xfb0 [ 87.193890][ T1050] kthread+0x388/0x470 [ 87.193903][ T1050] ? __pfx_worker_thread+0x10/0x10 [ 87.193912][ T1050] ? __pfx_kthread+0x10/0x10 [ 87.193924][ T1050] ret_from_fork+0x514/0xb70 [ 87.193944][ T1050] ? __pfx_ret_from_fork+0x10/0x10 [ 87.193955][ T1050] ? __switch_to+0xc89/0x1420 [ 87.193966][ T1050] ? __pfx_kthread+0x10/0x10 [ 87.193977][ T1050] ret_from_fork_asm+0x1a/0x30 [ 87.193993][ T1050] [ 87.193997][ T1050] [ 87.435364][ T1050] Allocated by task 5307: [ 87.437464][ T1050] kasan_save_track+0x3e/0x80 [ 87.440229][ T1050] __kasan_kmalloc+0x93/0xb0 [ 87.451116][ T1050] __kmalloc_cache_noprof+0x32d/0x660 [ 87.454460][ T1050] drm_atomic_helper_crtc_duplicate_state+0x72/0xb0 [ 87.457102][ T1050] drm_atomic_get_crtc_state+0x1b3/0x570 [ 87.459371][ T1050] drm_atomic_set_property+0x17b/0x3fb0 [ 87.478048][ T1050] drm_mode_atomic_ioctl+0x80c/0x24b0 [ 87.480927][ T1050] drm_ioctl_kernel+0x2df/0x3b0 [ 87.483024][ T1050] drm_ioctl+0x70e/0xba0 [ 87.484794][ T1050] __se_sys_ioctl+0xfc/0x170 [ 87.487507][ T1050] do_syscall_64+0x174/0x580 [ 87.489921][ T1050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.492343][ T1050] [ 87.493618][ T1050] Freed by task 5305: [ 87.495432][ T1050] kasan_save_track+0x3e/0x80 [ 87.511360][ T1050] kasan_save_free_info+0x40/0x50 [ 87.514295][ T1050] __kasan_slab_free+0x5c/0x80 [ 87.517489][ T1050] kfree+0x1c5/0x640 [ 87.520088][ T1050] drm_atomic_commit_default_clear+0x47f/0xf00 [ 87.522576][ T1050] __drm_atomic_commit_free+0xb4/0x230 [ 87.524773][ T1050] drm_atomic_helper_dirtyfb+0xee3/0xfd0 [ 87.527057][ T1050] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 87.546088][ T1050] drm_fb_helper_damage_work+0x84c/0xf20 [ 87.548607][ T1050] process_scheduled_works+0xa8e/0x14e0 [ 87.565327][ T1050] worker_thread+0xa47/0xfb0 [ 87.567243][ T1050] kthread+0x388/0x470 [ 87.568929][ T1050] ret_from_fork+0x514/0xb70 [ 87.572618][ T1050] ret_from_fork_asm+0x1a/0x30 [ 87.575430][ T1050] [ 87.576836][ T1050] The buggy address belongs to the object at ffff88801fd9b400 [ 87.576836][ T1050] which belongs to the cache kmalloc-512 of size 512 [ 87.588661][ T1050] The buggy address is located 9 bytes inside of [ 87.588661][ T1050] freed 512-byte region [ffff88801fd9b400, ffff88801fd9b600) [ 87.607887][ T1050] [ 87.608880][ T1050] The buggy address belongs to the physical page: [ 87.611554][ T1050] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fd9a [ 87.615103][ T1050] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 87.634360][ T1050] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 87.637904][ T1050] page_type: f5(slab) [ 87.640324][ T1050] raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122 [ 87.644559][ T1050] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 87.647963][ T1050] head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122 [ 87.652009][ T1050] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 87.668756][ T1050] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 87.683899][ T1050] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 87.687647][ T1050] page dumped because: kasan: bad access detected [ 87.699114][ T1050] page_owner tracks the page as allocated [ 87.701396][ T1050] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5270, tgid 5270 (syz-executor), ts 84995520556, free_ts 84894992793 [ 87.725347][ T1050] post_alloc_hook+0x1f9/0x250 [ 87.727271][ T1050] get_page_from_freelist+0x21fa/0x2270 [ 87.729530][ T1050] __alloc_frozen_pages_noprof+0x18d/0x380 [ 87.731834][ T1050] allocate_slab+0x79/0x5e0 [ 87.746285][ T1050] refill_objects+0x2d5/0x350 [ 87.748556][ T1050] __pcs_replace_empty_main+0x2bf/0x6b0 [ 87.751160][ T1050] __kmalloc_cache_noprof+0x3a7/0x660 [ 87.753678][ T1050] cgrp_css_alloc+0x46/0x60 [ 87.755792][ T1050] cgroup_apply_control_enable+0x5bb/0xda0 [ 87.758503][ T1050] cgroup_mkdir+0xd2c/0xf90 [ 87.775615][ T1050] kernfs_iop_mkdir+0x213/0x360 [ 87.777968][ T1050] vfs_mkdir+0x406/0x620 [ 87.779848][ T1050] filename_mkdirat+0x285/0x510 [ 87.782055][ T1050] __se_sys_mkdirat+0x35/0x150 [ 87.785181][ T1050] do_syscall_64+0x174/0x580 [ 87.788267][ T1050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.803597][ T1050] page last free pid 76 tgid 76 stack trace: [ 87.806018][ T1050] free_unref_folios+0xd84/0x14a0 [ 87.808001][ T1050] shrink_folio_list+0x4b16/0x5330 [ 87.810061][ T1050] evict_folios+0x3821/0x49e0 [ 87.811886][ T1050] try_to_shrink_lruvec+0xb4f/0xed0 [ 87.826933][ T1050] shrink_one+0x233/0x730 [ 87.829108][ T1050] shrink_node+0x3303/0x3b60 [ 87.831725][ T1050] kswapd+0x17b6/0x31c0 [ 87.833973][ T1050] kthread+0x388/0x470 [ 87.835803][ T1050] ret_from_fork+0x514/0xb70 [ 87.837879][ T1050] ret_from_fork_asm+0x1a/0x30 [ 87.840075][ T1050] [ 87.841195][ T1050] Memory state around the buggy address: [ 87.858037][ T1050] ffff88801fd9b300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.862120][ T1050] ffff88801fd9b380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.866240][ T1050] >ffff88801fd9b400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.871114][ T1050] ^ [ 87.886015][ T1050] ffff88801fd9b480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.889773][ T1050] ffff88801fd9b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.893556][ T1050] ================================================================== [ 88.096746][ T1050] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 88.113539][ T1050] CPU: 0 UID: 0 PID: 1050 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full) [ 88.118818][ T1050] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.134377][ T1050] Workqueue: events_unbound commit_work [ 88.136978][ T1050] Call Trace: [ 88.139038][ T1050] [ 88.140605][ T1050] vpanic+0x56c/0xa60 [ 88.142907][ T1050] ? __pfx_vpanic+0x10/0x10 [ 88.155018][ T1050] panic+0xc5/0xd0 [ 88.157051][ T1050] ? __pfx_panic+0x10/0x10 [ 88.159560][ T1050] ? preempt_schedule_thunk+0x16/0x40 [ 88.162156][ T1050] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 88.173401][ T1050] ? preempt_schedule_thunk+0x16/0x40 [ 88.175525][ T1050] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 88.179415][ T1050] check_panic_on_warn+0x89/0xb0 [ 88.184655][ T1050] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 88.190564][ T1050] end_report+0x73/0x170 [ 88.193500][ T1050] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 88.212835][ T1050] kasan_report+0x128/0x150 [ 88.215213][ T1050] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 88.225181][ T1050] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 88.228675][ T1050] ? preempt_schedule_thunk+0x16/0x40 [ 88.231098][ T1050] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 88.244206][ T1050] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 88.247002][ T1050] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 88.249874][ T1050] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 88.252377][ T1050] commit_tail+0x2b1/0x3c0 [ 88.274541][ T1050] ? process_scheduled_works+0xa20/0x14e0 [ 88.277119][ T1050] process_scheduled_works+0xa8e/0x14e0 [ 88.279508][ T1050] ? __pfx_process_scheduled_works+0x10/0x10 [ 88.282852][ T1050] ? assign_work+0x3cf/0x5d0 [ 88.292395][ T1050] worker_thread+0xa47/0xfb0 [ 88.294820][ T1050] kthread+0x388/0x470 [ 88.296899][ T1050] ? __pfx_worker_thread+0x10/0x10 [ 88.299862][ T1050] ? __pfx_kthread+0x10/0x10 [ 88.304905][ T1050] ret_from_fork+0x514/0xb70 [ 88.314466][ T1050] ? __pfx_ret_from_fork+0x10/0x10 [ 88.316658][ T1050] ? __switch_to+0xc89/0x1420 [ 88.318945][ T1050] ? __pfx_kthread+0x10/0x10 [ 88.322797][ T1050] ret_from_fork_asm+0x1a/0x30 [ 88.333825][ T1050] [ 88.335778][ T1050] Kernel Offset: disabled [ 88.338799][ T1050] Rebooting in 86400 seconds..