program:
r0 = io_uring_setup(0x12b9, &(0x7f00000002c0)={0x0, 0x48c7, 0x810, 0xfffffffc, 0x1000168}) (async)
r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) (async)
r2 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2)
ftruncate(r2, 0xffff) (async)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x9, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000040), &(0x7f0000000080)=r4}, 0x20) (async)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async)
fcntl$addseals(r2, 0x409, 0x7)
ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r2, 0x0, 0x4000, 0x8000}) (async)
close_range(r0, 0xffffffffffffffff, 0x0)
[ 114.743808][ T5333] ==================================================================
[ 114.746423][ T5333] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40
[ 114.748954][ T5333] Read of size 1 at addr ffff888012582068 by task syz.0.0/5333
[ 114.751695][ T5333]
[ 114.752671][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 114.752685][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 114.752692][ T5333] Call Trace:
[ 114.752699][ T5333]
[ 114.752705][ T5333] dump_stack_lvl+0xe8/0x150
[ 114.752723][ T5333] print_address_description+0x55/0x1e0
[ 114.752734][ T5333] ? _raw_spin_lock+0x2e/0x40
[ 114.752743][ T5333] print_report+0x58/0x70
[ 114.752749][ T5333] kasan_report+0x117/0x150
[ 114.752759][ T5333] ? _raw_spin_lock+0x2e/0x40
[ 114.752768][ T5333] ? dma_buf_fd+0xb0/0x330
[ 114.752828][ T5333] __kasan_check_byte+0x2a/0x40
[ 114.752842][ T5333] lock_acquire+0x84/0x350
[ 114.752854][ T5333] ? preempt_schedule_thunk+0x16/0x30
[ 114.752867][ T5333] ? fd_install+0x94/0x3d0
[ 114.752876][ T5333] ? fd_install+0x381/0x3d0
[ 114.752887][ T5333] _raw_spin_lock+0x2e/0x40
[ 114.752898][ T5333] ? dma_buf_fd+0xb0/0x330
[ 114.752910][ T5333] dma_buf_fd+0xb0/0x330
[ 114.752924][ T5333] udmabuf_create+0xf17/0xfd0
[ 114.752941][ T5333] ? __pfx_udmabuf_create+0x10/0x10
[ 114.752954][ T5333] udmabuf_ioctl+0x1f3/0x300
[ 114.752962][ T5333] ? __pfx_udmabuf_ioctl+0x10/0x10
[ 114.752971][ T5333] ? __fget_files+0x2a/0x420
[ 114.752981][ T5333] ? __fget_files+0x2a/0x420
[ 114.752991][ T5333] ? bpf_lsm_file_ioctl+0x9/0x20
[ 114.753005][ T5333] ? __pfx_udmabuf_ioctl+0x10/0x10
[ 114.753015][ T5333] __se_sys_ioctl+0xfc/0x170
[ 114.753029][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.753040][ T5333] do_syscall_64+0x15f/0xf80
[ 114.753053][ T5333] ? trace_irq_disable+0x3b/0x140
[ 114.753063][ T5333] ? clear_bhb_loop+0x40/0x90
[ 114.753071][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.753078][ T5333] RIP: 0033:0x7fddfdf9ce59
[ 114.753086][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 114.753092][ T5333] RSP: 002b:00007fddfee0ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 114.753101][ T5333] RAX: ffffffffffffffda RBX: 00007fddfe216090 RCX: 00007fddfdf9ce59
[ 114.753107][ T5333] RDX: 0000200000000100 RSI: 0000000040187542 RDI: 0000000000000003
[ 114.753111][ T5333] RBP: 00007fddfe032d6f R08: 0000000000000000 R09: 0000000000000000
[ 114.753116][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 114.753120][ T5333] R13: 00007fddfe216128 R14: 00007fddfe216090 R15: 00007ffe6bf20418
[ 114.753128][ T5333]
[ 114.753130][ T5333]
[ 114.857530][ T5333] Allocated by task 5333:
[ 114.859369][ T5333] kasan_save_track+0x3e/0x80
[ 114.861434][ T5333] __kasan_kmalloc+0x93/0xb0
[ 114.863517][ T5333] __kmalloc_noprof+0x35c/0x760
[ 114.865629][ T5333] dma_buf_export+0x3ba/0xac0
[ 114.867649][ T5333] udmabuf_create+0xed6/0xfd0
[ 114.869757][ T5333] udmabuf_ioctl+0x1f3/0x300
[ 114.871829][ T5333] __se_sys_ioctl+0xfc/0x170
[ 114.873924][ T5333] do_syscall_64+0x15f/0xf80
[ 114.875976][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.878493][ T5333]
[ 114.879443][ T5333] Freed by task 5334:
[ 114.881085][ T5333] kasan_save_track+0x3e/0x80
[ 114.883134][ T5333] kasan_save_free_info+0x46/0x50
[ 114.885300][ T5333] __kasan_slab_free+0x5c/0x80
[ 114.887392][ T5333] kfree+0x1c5/0x640
[ 114.889158][ T5333] __dentry_kill+0x211/0x690
[ 114.891193][ T5333] finish_dput+0xc9/0x480
[ 114.893104][ T5333] __fput+0x691/0xa60
[ 114.894877][ T5333] task_work_run+0x1d9/0x270
[ 114.896989][ T5333] exit_to_user_mode_loop+0xf3/0x4d0
[ 114.899303][ T5333] do_syscall_64+0x33e/0xf80
[ 114.901362][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 114.903897][ T5333]
[ 114.904988][ T5333] The buggy address belongs to the object at ffff888012582000
[ 114.904988][ T5333] which belongs to the cache kmalloc-512 of size 512
[ 114.910757][ T5333] The buggy address is located 104 bytes inside of
[ 114.910757][ T5333] freed 512-byte region [ffff888012582000, ffff888012582200)
[ 114.916292][ T5333]
[ 114.917347][ T5333] The buggy address belongs to the physical page:
[ 114.919930][ T5333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888012582c00 pfn:0x12582
[ 114.924163][ T5333] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 114.927830][ T5333] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[ 114.931420][ T5333] page_type: f5(slab)
[ 114.933162][ T5333] raw: 00fff00000000240 ffff88801ac41c80 ffffea000047d390 ffff88801ac407c8
[ 114.936804][ T5333] raw: ffff888012582c00 0000000800080003 00000000f5000000 0000000000000000
[ 114.940539][ T5333] head: 00fff00000000240 ffff88801ac41c80 ffffea000047d390 ffff88801ac407c8
[ 114.943686][ T5333] head: ffff888012582c00 0000000800080003 00000000f5000000 0000000000000000
[ 114.946817][ T5333] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 114.949973][ T5333] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 114.953075][ T5333] page dumped because: kasan: bad access detected
[ 114.955400][ T5333] page_owner tracks the page as allocated
[ 114.957502][ T5333] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1376, tgid 1376 (kworker/0:3), ts 113021056213, free_ts 36787768196
[ 114.965087][ T5333] post_alloc_hook+0x231/0x280
[ 114.966853][ T5333] get_page_from_freelist+0x24ba/0x2540
[ 114.969064][ T5333] __alloc_frozen_pages_noprof+0x18d/0x380
[ 114.971277][ T5333] allocate_slab+0x77/0x660
[ 114.973056][ T5333] refill_objects+0x339/0x3d0
[ 114.974920][ T5333] __pcs_replace_empty_main+0x321/0x720
[ 114.977029][ T5333] __kmalloc_cache_noprof+0x392/0x660
[ 114.979094][ T5333] drm_atomic_helper_setup_commit+0x1c8/0x1a90
[ 114.981402][ T5333] drm_atomic_helper_commit+0x6a/0xb10
[ 114.983544][ T5333] drm_atomic_commit+0x246/0x2b0
[ 114.985422][ T5333] drm_atomic_helper_dirtyfb+0xdec/0xf80
[ 114.987573][ T5333] drm_fbdev_shmem_helper_fb_dirty+0x160/0x2d0
[ 114.989876][ T5333] drm_fb_helper_damage_work+0x2b3/0x750
[ 114.991947][ T5333] process_scheduled_works+0xb5d/0x1860
[ 114.994052][ T5333] worker_thread+0xa53/0xfc0
[ 114.995823][ T5333] kthread+0x388/0x470
[ 114.997351][ T5333] page last free pid 4701 tgid 4701 stack trace:
[ 114.999822][ T5333] __free_frozen_pages+0xbc7/0xd30
[ 115.001894][ T5333] __slab_free+0x274/0x2c0
[ 115.003878][ T5333] qlist_free_all+0x99/0x100
[ 115.005942][ T5333] kasan_quarantine_reduce+0x148/0x160
[ 115.008245][ T5333] __kasan_slab_alloc+0x22/0x80
[ 115.010265][ T5333] kmem_cache_alloc_noprof+0x2bc/0x650
[ 115.012614][ T5333] do_getname+0x2e/0x250
[ 115.014485][ T5333] do_readlinkat+0xc8/0x510
[ 115.016432][ T5333] __x64_sys_readlink+0x7f/0x90
[ 115.018611][ T5333] do_syscall_64+0x15f/0xf80
[ 115.020641][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.023220][ T5333]
[ 115.024377][ T5333] Memory state around the buggy address:
[ 115.026623][ T5333] ffff888012581f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 115.029923][ T5333] ffff888012581f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 115.033240][ T5333] >ffff888012582000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.036563][ T5333] ^
[ 115.039890][ T5333] ffff888012582080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.043364][ T5333] ffff888012582100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 115.046852][ T5333] ==================================================================
[ 115.050929][ T5333] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 115.054095][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 115.057986][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 115.062441][ T5333] Call Trace:
[ 115.063967][ T5333]
[ 115.065297][ T5333] vpanic+0x56c/0xa60
[ 115.067102][ T5333] ? __pfx_vpanic+0x10/0x10
[ 115.069205][ T5333] panic+0xc5/0xd0
[ 115.070771][ T5333] ? __pfx_panic+0x10/0x10
[ 115.072478][ T5333] ? _raw_spin_lock+0x2e/0x40
[ 115.074327][ T5333] ? _raw_spin_lock+0x2e/0x40
[ 115.076385][ T5333] check_panic_on_warn+0x89/0xb0
[ 115.078504][ T5333] ? _raw_spin_lock+0x2e/0x40
[ 115.080608][ T5333] end_report+0x73/0x170
[ 115.082572][ T5333] ? _raw_spin_lock+0x2e/0x40
[ 115.084246][ T5333] kasan_report+0x128/0x150
[ 115.085987][ T5333] ? _raw_spin_lock+0x2e/0x40
[ 115.088030][ T5333] ? dma_buf_fd+0xb0/0x330
[ 115.089878][ T5333] __kasan_check_byte+0x2a/0x40
[ 115.091796][ T5333] lock_acquire+0x84/0x350
[ 115.093776][ T5333] ? preempt_schedule_thunk+0x16/0x30
[ 115.096114][ T5333] ? fd_install+0x94/0x3d0
[ 115.098129][ T5333] ? fd_install+0x381/0x3d0
[ 115.100094][ T5333] _raw_spin_lock+0x2e/0x40
[ 115.101910][ T5333] ? dma_buf_fd+0xb0/0x330
[ 115.103781][ T5333] dma_buf_fd+0xb0/0x330
[ 115.105570][ T5333] udmabuf_create+0xf17/0xfd0
[ 115.107368][ T5333] ? __pfx_udmabuf_create+0x10/0x10
[ 115.109621][ T5333] udmabuf_ioctl+0x1f3/0x300
[ 115.111627][ T5333] ? __pfx_udmabuf_ioctl+0x10/0x10
[ 115.113748][ T5333] ? __fget_files+0x2a/0x420
[ 115.115642][ T5333] ? __fget_files+0x2a/0x420
[ 115.117545][ T5333] ? bpf_lsm_file_ioctl+0x9/0x20
[ 115.119567][ T5333] ? __pfx_udmabuf_ioctl+0x10/0x10
[ 115.121638][ T5333] __se_sys_ioctl+0xfc/0x170
[ 115.123364][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.125580][ T5333] do_syscall_64+0x15f/0xf80
[ 115.127269][ T5333] ? trace_irq_disable+0x3b/0x140
[ 115.129355][ T5333] ? clear_bhb_loop+0x40/0x90
[ 115.131336][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.133842][ T5333] RIP: 0033:0x7fddfdf9ce59
[ 115.135703][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 115.143561][ T5333] RSP: 002b:00007fddfee0ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 115.147021][ T5333] RAX: ffffffffffffffda RBX: 00007fddfe216090 RCX: 00007fddfdf9ce59
[ 115.150011][ T5333] RDX: 0000200000000100 RSI: 0000000040187542 RDI: 0000000000000003
[ 115.153475][ T5333] RBP: 00007fddfe032d6f R08: 0000000000000000 R09: 0000000000000000
[ 115.157455][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 115.161315][ T5333] R13: 00007fddfe216128 R14: 00007fddfe216090 R15: 00007ffe6bf20418
[ 115.164410][ T5333]
[ 115.166117][ T5333] Kernel Offset: disabled
[ 115.168035][ T5333] Rebooting in 86400 seconds..