program: syz_mount_image$erofs(&(0x7f0000000080), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000001a00)=ANY=[], 0x0, 0x1f6, &(0x7f0000000600)="$eJzsmb+LE0EUx78zu5fcHXJwjYWNhRHPH7fZ3XhyCFco2Av+7i6Y9Tjdu5O9FZKARbCxsbQQbG38E1Lb2Yi1hQqCTcpgI4zMj0zGJCvGiIr3PpDJd96bnZn3hnkLCQiCOLB8/NB//+Ti+tUzAA6hgrKxf/aGY7gz/t2zB6efblx6Xjn/4tXu0sPu6HzlKddfANA4BeRKAcu+EK6/Ihu9l6VNY7sGjpNG3wDDcaM3wXHd6AQMt4y+6+i9BSPSJLi9lzbubKdJKJs1a6+56/sAeh2GBoB5AEIIwRz/fqt9r56mSTYq5oROxgTXtOJH+VP7u8CxYfpyf/K8bj5+JF0IjD0E17kEEIEjMroGhitGr6OMIAhsSiIn/iPecH7vZ+K34suM8Xu//vjy6m/I/v8jBnfzX9nP3xJs1CIvtLUc7nVfjz/1afbV2XdXRvbk5w+ErArXpHN/uzjbzCUTkbW87AuFHCMdb5Sb+cAJpz75qqpoqvnO/ep+q726vVPfSraS3TiunQvPhuFaXFWFSLdjde+rrX/zqj4tOvPPFdTKEiuhWc/zLGoCeRbZfqxbGZIcl9nKqt99vQ7HyjE9hzwyFXbBi25wrFx9S7XiFWyHIAiCIAiCIAiCIAiCIAhiSo6CQajfQdUfVaKA+LIa/S0AAP//lKZXCA==") r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000003c000180060001000a00000008000500000000000c000700000000000000deff0800090064000000090006006e6f6e65000000000800080000000000"], 0x50}}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="554b00000000000000000800000014000080060001e9090000000800050000000000"], 0x28}}, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000000c0)={0xf642, 0xe51e, 0x6, 0x9dfe, 0x11}) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000180)={0x0, 0x0, 0xfffffff9, 0x6, 0x16, "0062007d8200f7ffffff00"}) r4 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000200)=0x17) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000080)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0], 0x4, 0x0, 0xdededede}) ioctl$DRM_IOCTL_MODE_GETCRTC(r5, 0xc06864a1, &(0x7f0000000100)={&(0x7f00000000c0)}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000300), 0x3, r8}) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, &(0x7f0000000580)={0x600, 0x1, &(0x7f0000000180)=[r8], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r10, r9, r10], &(0x7f00000003c0), 0x0, 0x2}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r11, 0x4018aee2, &(0x7f0000000000)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x523, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) [ 142.216756][ T46] Bluetooth: hci0: command tx timeout [ 142.267756][ T5329] loop0: detected capacity change from 0 to 16 [ 142.362066][ T5329] erofs (device loop0): invalid ishare xattr prefix id 0 [ 142.483592][ T13] IPVS: starting estimator thread 0... [ 142.565921][ T5331] IPVS: using max 94 ests per chain, 225600 per kthread [ 142.623819][ T13] ================================================================== [ 142.623832][ T13] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 142.623931][ T13] Read of size 1 at addr ffff88803c391809 by task kworker/u4:1/13 [ 142.623941][ T13] [ 142.623949][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 142.623962][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 142.623969][ T13] Workqueue: events_unbound commit_work [ 142.623984][ T13] Call Trace: [ 142.624001][ T13] [ 142.624007][ T13] dump_stack_lvl+0xe8/0x150 [ 142.624025][ T13] print_address_description+0x55/0x1e0 [ 142.624041][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 142.624052][ T13] print_report+0x58/0x70 [ 142.624064][ T13] kasan_report+0x117/0x150 [ 142.624097][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 142.624112][ T13] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 142.624124][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 142.624137][ T13] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 142.624150][ T13] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 142.625885][ T13] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 142.625899][ T13] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 142.625914][ T13] commit_tail+0x2b1/0x3c0 [ 142.625925][ T13] ? process_scheduled_works+0x97a/0x1630 [ 142.625940][ T13] process_scheduled_works+0xc3d/0x1630 [ 142.625960][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 142.625975][ T13] ? assign_work+0x3cf/0x5d0 [ 142.625989][ T13] worker_thread+0xa47/0xfb0 [ 142.626008][ T13] kthread+0x38b/0x480 [ 142.626018][ T13] ? __pfx_worker_thread+0x10/0x10 [ 142.626032][ T13] ? __pfx_kthread+0x10/0x10 [ 142.626042][ T13] ret_from_fork+0x514/0xb70 [ 142.626053][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 142.626063][ T13] ? __switch_to+0xc89/0x1420 [ 142.626077][ T13] ? __pfx_kthread+0x10/0x10 [ 142.626087][ T13] ret_from_fork_asm+0x1a/0x30 [ 142.626108][ T13] [ 142.626113][ T13] [ 142.626116][ T13] Allocated by task 5330: [ 142.626123][ T13] kasan_save_track+0x3e/0x80 [ 142.626139][ T13] __kasan_kmalloc+0x93/0xb0 [ 142.626147][ T13] __kmalloc_cache_noprof+0x321/0x600 [ 142.626161][ T13] drm_atomic_helper_crtc_duplicate_state+0x72/0xb0 [ 142.626174][ T13] drm_atomic_get_crtc_state+0x1b3/0x570 [ 142.626186][ T13] drm_atomic_set_property+0x17b/0x4040 [ 142.626198][ T13] drm_mode_atomic_ioctl+0x817/0x2550 [ 142.626211][ T13] drm_ioctl_kernel+0x2df/0x3b0 [ 142.626221][ T13] drm_ioctl+0x70e/0xba0 [ 142.626231][ T13] __se_sys_ioctl+0xfc/0x170 [ 142.626246][ T13] do_syscall_64+0x166/0x520 [ 142.626254][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.626263][ T13] [ 142.626266][ T13] Freed by task 5322: [ 142.626271][ T13] kasan_save_track+0x3e/0x80 [ 142.626284][ T13] kasan_save_free_info+0x40/0x50 [ 142.626297][ T13] __kasan_slab_free+0x5c/0x80 [ 142.626304][ T13] kfree+0x1c5/0x650 [ 142.626314][ T13] drm_atomic_commit_default_clear+0x47f/0xf00 [ 142.626325][ T13] __drm_atomic_commit_free+0xb4/0x230 [ 142.626335][ T13] drm_atomic_helper_dirtyfb+0xee3/0xfd0 [ 142.626349][ T13] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 142.626363][ T13] drm_fb_helper_damage_work+0x84c/0xf20 [ 142.626374][ T13] process_scheduled_works+0xc3d/0x1630 [ 142.626385][ T13] worker_thread+0xa47/0xfb0 [ 142.626397][ T13] kthread+0x38b/0x480 [ 142.626406][ T13] ret_from_fork+0x514/0xb70 [ 142.626415][ T13] ret_from_fork_asm+0x1a/0x30 [ 142.626428][ T13] [ 142.626431][ T13] The buggy address belongs to the object at ffff88803c391800 [ 142.626431][ T13] which belongs to the cache kmalloc-512 of size 512 [ 142.626439][ T13] The buggy address is located 9 bytes inside of [ 142.626439][ T13] freed 512-byte region [ffff88803c391800, ffff88803c391a00) [ 142.626449][ T13] [ 142.626452][ T13] The buggy address belongs to the physical page: [ 142.626459][ T13] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c390 [ 142.627602][ T13] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 142.627612][ T13] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 142.627623][ T13] page_type: f5(slab) [ 142.627634][ T13] raw: 04fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122 [ 142.627644][ T13] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 142.627652][ T13] head: 04fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122 [ 142.627660][ T13] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 142.627669][ T13] head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 142.627678][ T13] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 142.627683][ T13] page dumped because: kasan: bad access detected [ 142.627707][ T13] page_owner tracks the page as allocated [ 142.627711][ T13] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5285, tgid 5285 (syz-executor), ts 135687090113 [ 142.627728][ T13] post_alloc_hook+0x1f9/0x250 [ 142.627746][ T13] get_page_from_freelist+0x2209/0x2280 [ 142.627761][ T13] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 142.627781][ T13] allocate_slab+0x7d/0x620 [ 142.627792][ T13] refill_objects+0x2d5/0x350 [ 142.627802][ T13] __pcs_replace_empty_main+0x2c8/0x6c0 [ 142.627813][ T13] __kmalloc_cache_noprof+0x39b/0x600 [ 142.627827][ T13] device_add+0xb6/0xb80 [ 142.627841][ T13] rfkill_register+0x170/0x9b0 [ 142.627854][ T13] hci_register_dev+0x3fe/0x8c0 [ 142.627864][ T13] vhci_create_device+0x409/0x6f0 [ 142.627871][ T13] vhci_write+0x3d1/0x4a0 [ 142.627880][ T13] vfs_write+0x612/0xba0 [ 142.627891][ T13] ksys_write+0x150/0x270 [ 142.627902][ T13] do_syscall_64+0x166/0x520 [ 142.627912][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.627922][ T13] page last free pid 5226 tgid 5226 ts 120746039413 stack trace: [ 142.627929][ T13] __free_frozen_pages+0xc93/0xd90 [ 142.627946][ T13] __slab_free+0x274/0x2c0 [ 142.627959][ T13] qlist_free_all+0x99/0x100 [ 142.627971][ T13] kasan_quarantine_reduce+0x148/0x160 [ 142.627986][ T13] __kasan_slab_alloc+0x22/0x80 [ 142.627995][ T13] kmem_cache_alloc_noprof+0x2b9/0x600 [ 142.628008][ T13] do_getname+0x2e/0x250 [ 142.628017][ T13] vfs_fstatat+0x45/0x170 [ 142.628027][ T13] __x64_sys_newfstatat+0x151/0x200 [ 142.628039][ T13] do_syscall_64+0x166/0x520 [ 142.628048][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.628057][ T13] [ 142.628060][ T13] Memory state around the buggy address: [ 142.628066][ T13] ffff88803c391700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 142.628075][ T13] ffff88803c391780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 142.628082][ T13] >ffff88803c391800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 142.628088][ T13] ^ [ 142.628094][ T13] ffff88803c391880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 142.628100][ T13] ffff88803c391900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 142.628107][ T13] ================================================================== [ 142.994021][ T13] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 142.997262][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 143.001190][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 143.005464][ T13] Workqueue: events_unbound commit_work [ 143.007906][ T13] Call Trace: [ 143.009371][ T13] [ 143.010667][ T13] vpanic+0x56d/0xa60 [ 143.012459][ T13] ? __pfx_vpanic+0x10/0x10 [ 143.014463][ T13] panic+0xc5/0xd0 [ 143.016105][ T13] ? __pfx_panic+0x10/0x10 [ 143.018142][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 143.021001][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 143.024244][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 143.026529][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 143.029319][ T13] check_panic_on_warn+0x89/0xb0 [ 143.031477][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 143.034244][ T13] end_report+0x73/0x170 [ 143.036049][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 143.038892][ T13] kasan_report+0x128/0x150 [ 143.040901][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 143.043805][ T13] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 143.046647][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 143.048976][ T13] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 143.051983][ T13] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 143.054467][ T13] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 143.057259][ T13] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 143.059802][ T13] commit_tail+0x2b1/0x3c0 [ 143.061632][ T13] ? process_scheduled_works+0x97a/0x1630 [ 143.064131][ T13] process_scheduled_works+0xc3d/0x1630 [ 143.066641][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 143.069501][ T13] ? assign_work+0x3cf/0x5d0 [ 143.071619][ T13] worker_thread+0xa47/0xfb0 [ 143.073764][ T13] kthread+0x38b/0x480 [ 143.075671][ T13] ? __pfx_worker_thread+0x10/0x10 [ 143.078173][ T13] ? __pfx_kthread+0x10/0x10 [ 143.080294][ T13] ret_from_fork+0x514/0xb70 [ 143.082119][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 143.084225][ T13] ? __switch_to+0xc89/0x1420 [ 143.086070][ T13] ? __pfx_kthread+0x10/0x10 [ 143.088271][ T13] ret_from_fork_asm+0x1a/0x30 [ 143.090725][ T13] [ 143.092833][ T13] Kernel Offset: disabled [ 143.094892][ T13] Rebooting in 86400 seconds..