program: io_uring_setup(0x664b, &(0x7f0000000500)) io_setup(0x6, &(0x7f00000003c0)) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000300), 0x3, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000580)={0x600, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r4, r3, r4], &(0x7f00000003c0), 0x0, 0x2}) tee(0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffc01, 0x0) [ 78.396071][ T4650] Bluetooth: hci0: command tx timeout [ 78.554469][ T130] ================================================================== [ 78.554509][ T130] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.554626][ T130] Read of size 1 at addr ffff88803ee34409 by task kworker/u4:5/130 [ 78.554636][ T130] [ 78.554654][ T130] CPU: 0 UID: 0 PID: 130 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) [ 78.554674][ T130] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.554723][ T130] Workqueue: events_unbound commit_work [ 78.554740][ T130] Call Trace: [ 78.554745][ T130] [ 78.554752][ T130] dump_stack_lvl+0xe8/0x150 [ 78.554796][ T130] print_address_description+0x55/0x1e0 [ 78.554825][ T130] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.554846][ T130] print_report+0x58/0x70 [ 78.554857][ T130] kasan_report+0x117/0x150 [ 78.554887][ T130] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.554902][ T130] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.554914][ T130] ? try_to_wake_up+0x8c5/0x14d0 [ 78.554944][ T130] ? preempt_schedule_thunk+0x16/0x40 [ 78.554958][ T130] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 78.554972][ T130] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 78.555026][ T130] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 78.555035][ T130] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 78.555045][ T130] commit_tail+0x2b1/0x3c0 [ 78.555053][ T130] ? process_scheduled_works+0x97a/0x1630 [ 78.555069][ T130] process_scheduled_works+0xc3d/0x1630 [ 78.555087][ T130] ? __pfx_process_scheduled_works+0x10/0x10 [ 78.555101][ T130] ? assign_work+0x3cf/0x5d0 [ 78.555115][ T130] worker_thread+0xa47/0xfb0 [ 78.555131][ T130] ? __kthread_parkme+0x71/0x1f0 [ 78.555148][ T130] kthread+0x38b/0x480 [ 78.555158][ T130] ? __pfx_worker_thread+0x10/0x10 [ 78.555171][ T130] ? __pfx_kthread+0x10/0x10 [ 78.555181][ T130] ret_from_fork+0x514/0xb70 [ 78.555201][ T130] ? __pfx_ret_from_fork+0x10/0x10 [ 78.555211][ T130] ? __switch_to+0xc89/0x1420 [ 78.555233][ T130] ? __pfx_kthread+0x10/0x10 [ 78.555244][ T130] ret_from_fork_asm+0x1a/0x30 [ 78.555263][ T130] [ 78.555268][ T130] [ 78.555271][ T130] Allocated by task 5318: [ 78.555284][ T130] kasan_save_track+0x3e/0x80 [ 78.555294][ T130] __kasan_kmalloc+0x93/0xb0 [ 78.555301][ T130] __kmalloc_cache_noprof+0x321/0x600 [ 78.555318][ T130] drm_atomic_helper_crtc_duplicate_state+0x72/0xb0 [ 78.555328][ T130] drm_atomic_get_crtc_state+0x1b3/0x570 [ 78.555341][ T130] drm_atomic_set_property+0x17b/0x4040 [ 78.555355][ T130] drm_mode_atomic_ioctl+0x817/0x25b0 [ 78.555370][ T130] drm_ioctl_kernel+0x2df/0x3b0 [ 78.555382][ T130] drm_ioctl+0x70e/0xba0 [ 78.555393][ T130] __se_sys_ioctl+0xfc/0x170 [ 78.555411][ T130] do_syscall_64+0x166/0x520 [ 78.555424][ T130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.555434][ T130] [ 78.555437][ T130] Freed by task 5316: [ 78.555442][ T130] kasan_save_track+0x3e/0x80 [ 78.555451][ T130] kasan_save_free_info+0x40/0x50 [ 78.555463][ T130] __kasan_slab_free+0x5c/0x80 [ 78.555472][ T130] kfree+0x1c5/0x650 [ 78.555483][ T130] drm_atomic_commit_default_clear+0x47f/0xf00 [ 78.555496][ T130] __drm_atomic_commit_free+0xb4/0x230 [ 78.555507][ T130] drm_atomic_helper_dirtyfb+0xee3/0xfd0 [ 78.555516][ T130] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 78.555526][ T130] drm_fb_helper_damage_work+0x84c/0xf20 [ 78.555538][ T130] process_scheduled_works+0xc3d/0x1630 [ 78.555551][ T130] worker_thread+0xa47/0xfb0 [ 78.555563][ T130] kthread+0x38b/0x480 [ 78.555572][ T130] ret_from_fork+0x514/0xb70 [ 78.555580][ T130] ret_from_fork_asm+0x1a/0x30 [ 78.555590][ T130] [ 78.555592][ T130] The buggy address belongs to the object at ffff88803ee34400 [ 78.555592][ T130] which belongs to the cache kmalloc-512 of size 512 [ 78.555601][ T130] The buggy address is located 9 bytes inside of [ 78.555601][ T130] freed 512-byte region [ffff88803ee34400, ffff88803ee34600) [ 78.555611][ T130] [ 78.555614][ T130] The buggy address belongs to the physical page: [ 78.555620][ T130] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803ee35000 pfn:0x3ee34 [ 78.555646][ T130] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 78.555654][ T130] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) [ 78.555665][ T130] page_type: f5(slab) [ 78.555675][ T130] raw: 04fff00000000240 ffff88801b041c80 ffffea0000d29a90 ffff8880304007c8 [ 78.555683][ T130] raw: ffff88803ee35000 0000000000080004 00000000f5000000 0000000000000000 [ 78.555692][ T130] head: 04fff00000000240 ffff88801b041c80 ffffea0000d29a90 ffff8880304007c8 [ 78.555701][ T130] head: ffff88803ee35000 0000000000080004 00000000f5000000 0000000000000000 [ 78.555711][ T130] head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 78.555720][ T130] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 78.555725][ T130] page dumped because: kasan: bad access detected [ 78.555730][ T130] page_owner tracks the page as allocated [ 78.555734][ T130] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5325, tgid 5317 (syz.0.0), ts 78472387919 [ 78.555752][ T130] post_alloc_hook+0x1f9/0x250 [ 78.555763][ T130] get_page_from_freelist+0x2209/0x2280 [ 78.555769][ T130] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 78.555775][ T130] allocate_slab+0x7d/0x620 [ 78.555783][ T130] refill_objects+0x2d5/0x350 [ 78.555791][ T130] __pcs_replace_empty_main+0x2c8/0x6c0 [ 78.555798][ T130] __kmalloc_cache_noprof+0x39b/0x600 [ 78.555807][ T130] drm_master_create+0x51/0x3c0 [ 78.555812][ T130] drm_new_set_master+0xe3/0x380 [ 78.555818][ T130] drm_master_open+0x12e/0x170 [ 78.555823][ T130] drm_open_helper+0x33b/0x470 [ 78.555832][ T130] drm_open+0x1c8/0x340 [ 78.555839][ T130] drm_stub_open+0x207/0x250 [ 78.555851][ T130] chrdev_open+0x4d9/0x600 [ 78.555869][ T130] do_dentry_open+0x816/0x1380 [ 78.555879][ T130] vfs_open+0x3b/0x340 [ 78.555889][ T130] page last free pid 13 tgid 13 ts 75645261625 stack trace: [ 78.555897][ T130] __free_frozen_pages+0xc93/0xd90 [ 78.555910][ T130] __slab_free+0x274/0x2c0 [ 78.555918][ T130] qlist_free_all+0x99/0x100 [ 78.555926][ T130] kasan_quarantine_reduce+0x148/0x160 [ 78.555940][ T130] __kasan_slab_alloc+0x22/0x80 [ 78.555949][ T130] kmem_cache_alloc_node_noprof+0x354/0x610 [ 78.555962][ T130] __alloc_skb+0x1db/0x7a0 [ 78.555990][ T130] rtmsg_ifinfo_build_skb+0x7f/0x260 [ 78.556000][ T130] rtmsg_ifinfo+0x8c/0x1a0 [ 78.556009][ T130] netif_state_change+0x297/0x3a0 [ 78.556022][ T130] __linkwatch_run_queue+0x52a/0x800 [ 78.556031][ T130] linkwatch_event+0x4c/0x60 [ 78.556040][ T130] process_scheduled_works+0xc3d/0x1630 [ 78.556048][ T130] worker_thread+0xa47/0xfb0 [ 78.556056][ T130] kthread+0x38b/0x480 [ 78.556061][ T130] ret_from_fork+0x514/0xb70 [ 78.556067][ T130] [ 78.556068][ T130] Memory state around the buggy address: [ 78.556072][ T130] ffff88803ee34300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.556077][ T130] ffff88803ee34380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.556081][ T130] >ffff88803ee34400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.556084][ T130] ^ [ 78.556088][ T130] ffff88803ee34480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.556094][ T130] ffff88803ee34500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.556099][ T130] ================================================================== [ 78.927667][ T130] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 78.930818][ T130] CPU: 0 UID: 0 PID: 130 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) [ 78.934849][ T130] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.939455][ T130] Workqueue: events_unbound commit_work [ 78.942276][ T130] Call Trace: [ 78.943748][ T130] [ 78.945142][ T130] vpanic+0x56d/0xa60 [ 78.946908][ T130] ? __pfx_vpanic+0x10/0x10 [ 78.948828][ T130] panic+0xc5/0xd0 [ 78.950540][ T130] ? __pfx_panic+0x10/0x10 [ 78.952553][ T130] ? preempt_schedule_thunk+0x16/0x40 [ 78.954913][ T130] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.957692][ T130] ? preempt_schedule_thunk+0x16/0x40 [ 78.960021][ T130] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.963465][ T130] check_panic_on_warn+0x89/0xb0 [ 78.966127][ T130] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.969631][ T130] end_report+0x73/0x170 [ 78.972058][ T130] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.974783][ T130] kasan_report+0x128/0x150 [ 78.976706][ T130] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.979471][ T130] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 78.982043][ T130] ? try_to_wake_up+0x8c5/0x14d0 [ 78.984184][ T130] ? preempt_schedule_thunk+0x16/0x40 [ 78.986484][ T130] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 78.989400][ T130] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 78.991927][ T130] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 78.994725][ T130] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 78.997156][ T130] commit_tail+0x2b1/0x3c0 [ 78.998990][ T130] ? process_scheduled_works+0x97a/0x1630 [ 79.001252][ T130] process_scheduled_works+0xc3d/0x1630 [ 79.003442][ T130] ? __pfx_process_scheduled_works+0x10/0x10 [ 79.005921][ T130] ? assign_work+0x3cf/0x5d0 [ 79.007831][ T130] worker_thread+0xa47/0xfb0 [ 79.009656][ T130] ? __kthread_parkme+0x71/0x1f0 [ 79.011746][ T130] kthread+0x38b/0x480 [ 79.013580][ T130] ? __pfx_worker_thread+0x10/0x10 [ 79.015758][ T130] ? __pfx_kthread+0x10/0x10 [ 79.017746][ T130] ret_from_fork+0x514/0xb70 [ 79.019756][ T130] ? __pfx_ret_from_fork+0x10/0x10 [ 79.021987][ T130] ? __switch_to+0xc89/0x1420 [ 79.024102][ T130] ? __pfx_kthread+0x10/0x10 [ 79.026027][ T130] ret_from_fork_asm+0x1a/0x30 [ 79.028152][ T130] [ 79.029971][ T130] Kernel Offset: disabled [ 79.031884][ T130] Rebooting in 86400 seconds..