program: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x100, 0x40) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) fstat(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETQUOTA(r1, 0xffffffff80000700, r3, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(0xffffffffffffffff, 0xc01064bd, &(0x7f0000000280)={&(0x7f0000000200)="8a840038e2ad769f027c59615a069ae9d7f21f9e83f3b54f4cb3705e566b7a0de1e8ca74fdfffbbb8a1f15771b57bd445c934f8e752f13a295cfdc9a9e4001f0b4735fe1a16ff7b3716f4038e3ad0e14e98ee199d13021c62c0c6c73385475a1c27f22f6499055b5e7bb8ec0b3a6824a5b69b3", 0x73, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000400)={&(0x7f0000000380)=[0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0], 0x1, 0x0, 0xe0e0e0e0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000500)={&(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, 0xcccccccc}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f00000005c0)={&(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0, 0x0], 0x9, 0x0, 0xb0b0b0b0}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000780)={&(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[{}, {}], &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0], 0x2, 0x4, 0x7}) r9 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r9, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r9, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r9, 0xc02064b6, &(0x7f00000001c0)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r9, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000300), 0x3, r11}) ioctl$DRM_IOCTL_MODE_ATOMIC(r9, 0xc03864bc, &(0x7f0000000580)={0x600, 0x1, &(0x7f0000000180)=[r11], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r13, r12, r13], &(0x7f00000003c0), 0x0, 0x2}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000b00)={&(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000840)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000a80)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000ac0)=[0x0, 0x0, 0x0, 0x0], 0x8, 0x5, 0x6}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000dc0)={&(0x7f0000000b80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000bc0)=[{}, {}, {}, {}, {}], &(0x7f0000000d40)=[0x0, 0x0], &(0x7f0000000d80)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x2, 0x8}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000ec0)={0x300, 0x2, &(0x7f00000002c0)=[0x0, r4], &(0x7f0000000300)=[0x54e], &(0x7f0000000e40)=[r5, 0x0, r6, r7, r8, r13, r14, r15], &(0x7f0000000e80)=[0x100000001], 0x0, 0x5b}) pwritev2(r0, 0x0, 0x0, 0x8000000, 0x0, 0x0) r16 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r17, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r16, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r18, 0x64e98, 0x16ac1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_ISOLATED={0x5, 0x21, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) r19 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) ioctl$COMEDI_INSN(r19, 0x8028640c, &(0x7f0000000000)={0xc000003, 0xf, &(0x7f0000000180)=[0x1388, 0x9, 0xf909, 0x899d, 0x80, 0x98a, 0x7, 0x1010, 0xfffffe01, 0x1, 0x4, 0x2, 0x6, 0x4, 0x0], 0x1, 0x4000007}) [ 93.427245][ T5284] Bluetooth: hci0: command tx timeout [ 93.443592][ T1914] cfg80211: failed to load regulatory.db [ 93.523436][ T109] ================================================================== [ 93.523473][ T109] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.523573][ T109] Read of size 1 at addr ffff8880404fe009 by task kworker/u4:6/109 [ 93.523584][ T109] [ 93.523603][ T109] CPU: 0 UID: 0 PID: 109 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full) [ 93.523617][ T109] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.523625][ T109] Workqueue: events_unbound commit_work [ 93.523640][ T109] Call Trace: [ 93.523646][ T109] [ 93.523652][ T109] dump_stack_lvl+0xe8/0x150 [ 93.523670][ T109] print_address_description+0x55/0x1e0 [ 93.523686][ T109] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.523704][ T109] print_report+0x58/0x70 [ 93.523717][ T109] kasan_report+0x117/0x150 [ 93.523731][ T109] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.523750][ T109] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.523768][ T109] ? try_to_wake_up+0x8c5/0x14d0 [ 93.523780][ T109] ? preempt_schedule_thunk+0x16/0x40 [ 93.523795][ T109] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 93.523814][ T109] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 93.523884][ T109] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 93.523898][ T109] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 93.523918][ T109] commit_tail+0x2b1/0x3c0 [ 93.523930][ T109] ? process_scheduled_works+0x97a/0x1630 [ 93.523946][ T109] process_scheduled_works+0xc3d/0x1630 [ 93.523961][ T109] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.523971][ T109] ? assign_work+0x3cf/0x5d0 [ 93.523980][ T109] worker_thread+0xa47/0xfb0 [ 93.523993][ T109] kthread+0x38b/0x480 [ 93.524001][ T109] ? __pfx_worker_thread+0x10/0x10 [ 93.524013][ T109] ? __pfx_kthread+0x10/0x10 [ 93.524023][ T109] ret_from_fork+0x514/0xb70 [ 93.524034][ T109] ? __pfx_ret_from_fork+0x10/0x10 [ 93.524045][ T109] ? __switch_to+0xc89/0x1420 [ 93.524062][ T109] ? __pfx_kthread+0x10/0x10 [ 93.524072][ T109] ret_from_fork_asm+0x1a/0x30 [ 93.524093][ T109] [ 93.524097][ T109] [ 93.524100][ T109] Allocated by task 5320: [ 93.524107][ T109] kasan_save_track+0x3e/0x80 [ 93.524124][ T109] __kasan_kmalloc+0x93/0xb0 [ 93.524133][ T109] __kmalloc_cache_noprof+0x321/0x600 [ 93.524149][ T109] drm_atomic_helper_crtc_duplicate_state+0x72/0xb0 [ 93.524161][ T109] drm_atomic_get_crtc_state+0x1b3/0x570 [ 93.524172][ T109] drm_atomic_set_property+0x17b/0x4040 [ 93.524186][ T109] drm_mode_atomic_ioctl+0x817/0x2550 [ 93.524198][ T109] drm_ioctl_kernel+0x2df/0x3b0 [ 93.524213][ T109] drm_ioctl+0x70e/0xba0 [ 93.524223][ T109] __se_sys_ioctl+0xfc/0x170 [ 93.524238][ T109] do_syscall_64+0x166/0x520 [ 93.524254][ T109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.524265][ T109] [ 93.524268][ T109] Freed by task 1914: [ 93.524274][ T109] kasan_save_track+0x3e/0x80 [ 93.524284][ T109] kasan_save_free_info+0x40/0x50 [ 93.524292][ T109] __kasan_slab_free+0x5c/0x80 [ 93.524298][ T109] kfree+0x1c5/0x650 [ 93.524305][ T109] drm_atomic_commit_default_clear+0x47f/0xf00 [ 93.524312][ T109] __drm_atomic_commit_free+0xb4/0x230 [ 93.524318][ T109] drm_atomic_helper_dirtyfb+0xee3/0xfd0 [ 93.524328][ T109] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 93.524336][ T109] drm_fb_helper_damage_work+0x84c/0xf20 [ 93.524342][ T109] process_scheduled_works+0xc3d/0x1630 [ 93.524351][ T109] worker_thread+0xa47/0xfb0 [ 93.524360][ T109] kthread+0x38b/0x480 [ 93.524367][ T109] ret_from_fork+0x514/0xb70 [ 93.524372][ T109] ret_from_fork_asm+0x1a/0x30 [ 93.524381][ T109] [ 93.524383][ T109] The buggy address belongs to the object at ffff8880404fe000 [ 93.524383][ T109] which belongs to the cache kmalloc-512 of size 512 [ 93.524390][ T109] The buggy address is located 9 bytes inside of [ 93.524390][ T109] freed 512-byte region [ffff8880404fe000, ffff8880404fe200) [ 93.524397][ T109] [ 93.524399][ T109] The buggy address belongs to the physical page: [ 93.524404][ T109] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880404fec00 pfn:0x404fe [ 93.524412][ T109] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 93.524418][ T109] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) [ 93.524426][ T109] page_type: f5(slab) [ 93.524443][ T109] raw: 04fff00000000240 ffff88801b041c80 ffffea0000fd9c90 ffff8880304007c8 [ 93.524452][ T109] raw: ffff8880404fec00 0000000000080003 00000000f5000000 0000000000000000 [ 93.524461][ T109] head: 04fff00000000240 ffff88801b041c80 ffffea0000fd9c90 ffff8880304007c8 [ 93.524470][ T109] head: ffff8880404fec00 0000000000080003 00000000f5000000 0000000000000000 [ 93.524479][ T109] head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 93.524489][ T109] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 93.524495][ T109] page dumped because: kasan: bad access detected [ 93.524512][ T109] page_owner tracks the page as allocated [ 93.524517][ T109] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5318, tgid 5318 (kworker/0:6), ts 91578673572 [ 93.524535][ T109] post_alloc_hook+0x1f9/0x250 [ 93.524549][ T109] get_page_from_freelist+0x2209/0x2280 [ 93.524564][ T109] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 93.524579][ T109] allocate_slab+0x7d/0x620 [ 93.524590][ T109] refill_objects+0x2d5/0x350 [ 93.524602][ T109] __pcs_replace_empty_main+0x2c8/0x6c0 [ 93.524613][ T109] __kmalloc_cache_noprof+0x39b/0x600 [ 93.524624][ T109] drm_atomic_helper_setup_commit+0x1b2/0x1a30 [ 93.524630][ T109] drm_atomic_helper_commit+0x6a/0xb10 [ 93.524636][ T109] drm_atomic_commit+0x24e/0x2b0 [ 93.524643][ T109] drm_atomic_helper_dirtyfb+0xe2f/0xfd0 [ 93.524652][ T109] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 93.524660][ T109] drm_fb_helper_damage_work+0x84c/0xf20 [ 93.524666][ T109] process_scheduled_works+0xc3d/0x1630 [ 93.524674][ T109] worker_thread+0xa47/0xfb0 [ 93.524683][ T109] kthread+0x38b/0x480 [ 93.524688][ T109] page last free pid 5213 tgid 5213 ts 76486853675 stack trace: [ 93.524694][ T109] __free_frozen_pages+0xc93/0xd90 [ 93.524702][ T109] __slab_free+0x274/0x2c0 [ 93.524711][ T109] qlist_free_all+0x99/0x100 [ 93.524719][ T109] kasan_quarantine_reduce+0x148/0x160 [ 93.524728][ T109] __kasan_slab_alloc+0x22/0x80 [ 93.524734][ T109] __kmalloc_node_track_caller_noprof+0x44b/0x720 [ 93.524743][ T109] kstrdup+0x42/0x100 [ 93.524753][ T109] bprm_change_interp+0x88/0xc0 [ 93.524761][ T109] load_script+0x717/0x8a0 [ 93.524809][ T109] bprm_execve+0x930/0x1590 [ 93.524822][ T109] do_execveat_common+0x4f4/0x670 [ 93.524835][ T109] __x64_sys_execve+0x97/0xc0 [ 93.524848][ T109] do_syscall_64+0x166/0x520 [ 93.524869][ T109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.524879][ T109] [ 93.524882][ T109] Memory state around the buggy address: [ 93.524888][ T109] ffff8880404fdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.524894][ T109] ffff8880404fdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.524902][ T109] >ffff8880404fe000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.524907][ T109] ^ [ 93.524914][ T109] ffff8880404fe080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.524921][ T109] ffff8880404fe100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.524927][ T109] ================================================================== [ 93.529962][ T109] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.852529][ T109] CPU: 0 UID: 0 PID: 109 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full) [ 93.856635][ T109] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.861328][ T109] Workqueue: events_unbound commit_work [ 93.863950][ T109] Call Trace: [ 93.865450][ T109] [ 93.866769][ T109] vpanic+0x56d/0xa60 [ 93.868571][ T109] ? __pfx_vpanic+0x10/0x10 [ 93.870523][ T109] panic+0xc5/0xd0 [ 93.872124][ T109] ? __pfx_panic+0x10/0x10 [ 93.874061][ T109] ? preempt_schedule_thunk+0x16/0x40 [ 93.876292][ T109] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.879036][ T109] ? preempt_schedule_thunk+0x16/0x40 [ 93.881480][ T109] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.884582][ T109] check_panic_on_warn+0x89/0xb0 [ 93.886917][ T109] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.889856][ T109] end_report+0x73/0x170 [ 93.891759][ T109] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.894804][ T109] kasan_report+0x128/0x150 [ 93.897049][ T109] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.900198][ T109] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 93.902997][ T109] ? try_to_wake_up+0x8c5/0x14d0 [ 93.905268][ T109] ? preempt_schedule_thunk+0x16/0x40 [ 93.907552][ T109] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 93.910477][ T109] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 93.913161][ T109] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 93.916210][ T109] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 93.918987][ T109] commit_tail+0x2b1/0x3c0 [ 93.920941][ T109] ? process_scheduled_works+0x97a/0x1630 [ 93.923413][ T109] process_scheduled_works+0xc3d/0x1630 [ 93.925806][ T109] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.928700][ T109] ? assign_work+0x3cf/0x5d0 [ 93.930956][ T109] worker_thread+0xa47/0xfb0 [ 93.933246][ T109] kthread+0x38b/0x480 [ 93.935052][ T109] ? __pfx_worker_thread+0x10/0x10 [ 93.937313][ T109] ? __pfx_kthread+0x10/0x10 [ 93.939354][ T109] ret_from_fork+0x514/0xb70 [ 93.941434][ T109] ? __pfx_ret_from_fork+0x10/0x10 [ 93.943631][ T109] ? __switch_to+0xc89/0x1420 [ 93.945668][ T109] ? __pfx_kthread+0x10/0x10 [ 93.947687][ T109] ret_from_fork_asm+0x1a/0x30 [ 93.949732][ T109] [ 93.951550][ T109] Kernel Offset: disabled [ 93.953606][ T109] Rebooting in 86400 seconds..