program: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x7, r3, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x48, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000002c0)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0xb, 0xffffffffffffffff, 0x0, r4}) ioctl$IOMMU_IOAS_COPY(r2, 0x3b83, &(0x7f0000000300)={0x28, 0x0, r3, r4, 0x0, 0x10001, 0x2}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r1, 0xc01864b0, &(0x7f0000000dc0)={r5, r6, 0x1, 0x0, 0x400000d4}) close_range(r0, 0xffffffffffffffff, 0x3f00000000000000) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r10, @ANYBLOB="0c009985f2330fd547793c000800a0003a0900080500390104000000080026"], 0x40}}, 0x0) ioctl$FIBMAP(r7, 0x1, &(0x7f00000004c0)=0x8000) [ 101.856012][ T4641] Bluetooth: hci0: command tx timeout [ 101.994023][ T13] ================================================================== [ 101.994038][ T13] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 101.994277][ T13] Read of size 1 at addr ffff888013980409 by task kworker/u4:1/13 [ 101.994286][ T13] [ 101.994321][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 101.994333][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.994341][ T13] Workqueue: events_unbound commit_work [ 101.994359][ T13] Call Trace: [ 101.994365][ T13] [ 101.994370][ T13] dump_stack_lvl+0xe8/0x150 [ 101.994450][ T13] print_address_description+0x55/0x1e0 [ 101.994487][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 101.994503][ T13] print_report+0x58/0x70 [ 101.994516][ T13] kasan_report+0x117/0x150 [ 101.994558][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 101.994575][ T13] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 101.994590][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 101.994603][ T13] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 101.994619][ T13] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 101.994759][ T13] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 101.994777][ T13] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 101.994794][ T13] commit_tail+0x2b1/0x3c0 [ 101.994809][ T13] ? process_scheduled_works+0x97a/0x1630 [ 101.994845][ T13] process_scheduled_works+0xc3d/0x1630 [ 101.994866][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 101.994881][ T13] ? assign_work+0x3cf/0x5d0 [ 101.994895][ T13] worker_thread+0xa47/0xfb0 [ 101.994915][ T13] kthread+0x38b/0x480 [ 101.994925][ T13] ? __pfx_worker_thread+0x10/0x10 [ 101.994938][ T13] ? __pfx_kthread+0x10/0x10 [ 101.994949][ T13] ret_from_fork+0x514/0xb70 [ 101.994961][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 101.994971][ T13] ? __switch_to+0xc89/0x1420 [ 101.994987][ T13] ? __pfx_kthread+0x10/0x10 [ 101.994997][ T13] ret_from_fork_asm+0x1a/0x30 [ 101.995011][ T13] [ 101.995015][ T13] [ 101.995018][ T13] Allocated by task 5322: [ 101.995024][ T13] kasan_save_track+0x3e/0x80 [ 101.995034][ T13] __kasan_kmalloc+0x93/0xb0 [ 101.995044][ T13] __kmalloc_cache_noprof+0x321/0x600 [ 101.995055][ T13] drm_atomic_helper_crtc_duplicate_state+0x72/0xb0 [ 101.995065][ T13] drm_atomic_get_crtc_state+0x1b3/0x570 [ 101.995081][ T13] page_flip_common+0x56/0x2a0 [ 101.995095][ T13] drm_atomic_helper_page_flip+0xa5/0x160 [ 101.995110][ T13] drm_mode_page_flip_ioctl+0xe2d/0x13d0 [ 101.995121][ T13] drm_ioctl_kernel+0x2df/0x3b0 [ 101.995134][ T13] drm_ioctl+0x70e/0xba0 [ 101.995147][ T13] __se_sys_ioctl+0xfc/0x170 [ 101.995159][ T13] do_syscall_64+0x166/0x520 [ 101.995169][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.995186][ T13] [ 101.995189][ T13] Freed by task 1374: [ 101.995194][ T13] kasan_save_track+0x3e/0x80 [ 101.995204][ T13] kasan_save_free_info+0x40/0x50 [ 101.995217][ T13] __kasan_slab_free+0x5c/0x80 [ 101.995227][ T13] kfree+0x1c5/0x650 [ 101.995240][ T13] drm_atomic_commit_default_clear+0x47f/0xf00 [ 101.995253][ T13] __drm_atomic_commit_free+0xb4/0x230 [ 101.995267][ T13] drm_atomic_helper_dirtyfb+0xee3/0xfd0 [ 101.995278][ T13] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 101.995289][ T13] drm_fb_helper_damage_work+0x84c/0xf20 [ 101.995302][ T13] process_scheduled_works+0xc3d/0x1630 [ 101.995315][ T13] worker_thread+0xa47/0xfb0 [ 101.995326][ T13] kthread+0x38b/0x480 [ 101.995335][ T13] ret_from_fork+0x514/0xb70 [ 101.995343][ T13] ret_from_fork_asm+0x1a/0x30 [ 101.995352][ T13] [ 101.995355][ T13] The buggy address belongs to the object at ffff888013980400 [ 101.995355][ T13] which belongs to the cache kmalloc-512 of size 512 [ 101.995383][ T13] The buggy address is located 9 bytes inside of [ 101.995383][ T13] freed 512-byte region [ffff888013980400, ffff888013980600) [ 101.995394][ T13] [ 101.995397][ T13] The buggy address belongs to the physical page: [ 101.995403][ T13] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888013981800 pfn:0x13980 [ 101.995415][ T13] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 101.995424][ T13] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 101.995435][ T13] page_type: f5(slab) [ 101.995461][ T13] raw: 00fff00000000240 ffff88801c041c80 ffffea00004e7a90 ffffea00004f8890 [ 101.995470][ T13] raw: ffff888013981800 0000000000080007 00000000f5000000 0000000000000000 [ 101.995480][ T13] head: 00fff00000000240 ffff88801c041c80 ffffea00004e7a90 ffffea00004f8890 [ 101.995488][ T13] head: ffff888013981800 0000000000080007 00000000f5000000 0000000000000000 [ 101.995498][ T13] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 101.995506][ T13] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 101.995512][ T13] page dumped because: kasan: bad access detected [ 101.995517][ T13] page_owner tracks the page as allocated [ 101.995521][ T13] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5283, tgid 5283 (syz-executor), ts 97082634813 [ 101.995547][ T13] post_alloc_hook+0x1f9/0x250 [ 101.995591][ T13] get_page_from_freelist+0x2209/0x2280 [ 101.995602][ T13] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 101.995612][ T13] allocate_slab+0x7d/0x620 [ 101.995624][ T13] refill_objects+0x2d5/0x350 [ 101.995636][ T13] __pcs_replace_empty_main+0x2c8/0x6c0 [ 101.995648][ T13] __kmalloc_cache_noprof+0x39b/0x600 [ 101.995658][ T13] __ipv6_dev_mc_inc+0x447/0xaf0 [ 101.995739][ T13] ipv6_add_dev+0xe45/0x13a0 [ 101.995754][ T13] addrconf_notify+0x771/0x1050 [ 101.995764][ T13] notifier_call_chain+0x1a5/0x3d0 [ 101.995773][ T13] register_netdevice+0x18a4/0x1eb0 [ 101.995824][ T13] rtnl_newlink_create+0x314/0x7b0 [ 101.995836][ T13] rtnl_newlink+0x166d/0x1c30 [ 101.995849][ T13] rtnetlink_rcv_msg+0x802/0xc00 [ 101.995862][ T13] netlink_rcv_skb+0x226/0x4a0 [ 101.995885][ T13] page last free pid 5129 tgid 5129 ts 65828587495 stack trace: [ 101.995893][ T13] __free_frozen_pages+0xc93/0xd90 [ 101.995908][ T13] __slab_free+0x274/0x2c0 [ 101.995917][ T13] qlist_free_all+0x99/0x100 [ 101.995927][ T13] kasan_quarantine_reduce+0x148/0x160 [ 101.995937][ T13] __kasan_slab_alloc+0x22/0x80 [ 101.995948][ T13] kmem_cache_alloc_noprof+0x2b9/0x600 [ 101.995962][ T13] do_getname+0x2e/0x250 [ 101.995973][ T13] do_sys_openat2+0xcc/0x200 [ 101.995985][ T13] __x64_sys_openat+0x138/0x170 [ 101.995996][ T13] do_syscall_64+0x166/0x520 [ 101.996007][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.996017][ T13] [ 101.996020][ T13] Memory state around the buggy address: [ 101.996027][ T13] ffff888013980300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.996034][ T13] ffff888013980380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 101.996041][ T13] >ffff888013980400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.996046][ T13] ^ [ 101.996051][ T13] ffff888013980480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.996058][ T13] ffff888013980500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.996062][ T13] ================================================================== [ 101.999467][ T13] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 102.301216][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 102.305168][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.309526][ T13] Workqueue: events_unbound commit_work [ 102.312012][ T13] Call Trace: [ 102.313502][ T13] [ 102.314942][ T13] vpanic+0x56d/0xa60 [ 102.316763][ T13] ? __pfx_vpanic+0x10/0x10 [ 102.318827][ T13] panic+0xc5/0xd0 [ 102.320532][ T13] ? __pfx_panic+0x10/0x10 [ 102.322506][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 102.324941][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 102.327821][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 102.330188][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 102.333115][ T13] check_panic_on_warn+0x89/0xb0 [ 102.335188][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 102.337940][ T13] end_report+0x73/0x170 [ 102.339845][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 102.346555][ T13] kasan_report+0x128/0x150 [ 102.348617][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 102.351263][ T13] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 102.354080][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 102.356442][ T13] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 102.359106][ T13] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 102.361471][ T13] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 102.363842][ T13] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 102.366336][ T13] commit_tail+0x2b1/0x3c0 [ 102.368185][ T13] ? process_scheduled_works+0x97a/0x1630 [ 102.370461][ T13] process_scheduled_works+0xc3d/0x1630 [ 102.372684][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 102.375414][ T13] ? assign_work+0x3cf/0x5d0 [ 102.377360][ T13] worker_thread+0xa47/0xfb0 [ 102.379338][ T13] kthread+0x38b/0x480 [ 102.381099][ T13] ? __pfx_worker_thread+0x10/0x10 [ 102.383262][ T13] ? __pfx_kthread+0x10/0x10 [ 102.385267][ T13] ret_from_fork+0x514/0xb70 [ 102.387097][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 102.389285][ T13] ? __switch_to+0xc89/0x1420 [ 102.391772][ T13] ? __pfx_kthread+0x10/0x10 [ 102.394153][ T13] ret_from_fork_asm+0x1a/0x30 [ 102.396239][ T13] [ 102.398074][ T13] Kernel Offset: disabled [ 102.400355][ T13] Rebooting in 86400 seconds..