Hi, We would like to report the following bug which has been found by our modified version of syzkaller. ====================================================== description: KASAN: use-after-free Read in drm_gem_object_release affected file: drivers/gpu/drm/drm_gem.c kernel version: 5.4.206 kernel commit: 981f87403bb9841f1e0b7953e12a51f09a47a4f0 git tree: upstream kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=1aab6d4187ddf667 crash reproducer: attached ====================================================== Crash log: ====================================================== BUG: KASAN: use-after-free in drm_gem_object_release+0xf7/0x120 drivers/gpu/drm/drm_gem.c:952 Read of size 8 at addr ffff888069f2d110 by task syz-executor.2/9649 CPU: 0 PID: 9649 Comm: syz-executor.2 Tainted: G OE 5.4.206+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1a0/0x217 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x343 mm/kasan/report.c:374 __kasan_report.cold+0x75/0x8d mm/kasan/report.c:506 kasan_report+0x10/0x20 mm/kasan/common.c:645 drm_gem_object_release+0xf7/0x120 drivers/gpu/drm/drm_gem.c:952 drm_gem_vram_init drivers/gpu/drm/drm_gem_vram_helper.c:106 [inline] drm_gem_vram_create+0x180/0x1f0 drivers/gpu/drm/drm_gem_vram_helper.c:135 drm_gem_vram_fill_create_dumb+0x13b/0x2c0 drivers/gpu/drm/drm_gem_vram_helper.c:382 drm_gem_vram_driver_dumb_create+0x5e/0xe0 drivers/gpu/drm/drm_gem_vram_helper.c:509 drm_mode_create_dumb+0x2a0/0x330 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x21a/0x2e0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x52f/0xa70 drivers/gpu/drm/drm_ioctl.c:890 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:510 [inline] do_vfs_ioctl+0xd30/0x1340 fs/ioctl.c:697 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:714 __do_sys_ioctl fs/ioctl.c:721 [inline] __se_sys_ioctl fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:719 do_syscall_64+0xf6/0x7b0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f6b40bd24ed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6b3eb82be8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f6b40cf0f60 RCX: 00007f6b40bd24ed RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000003 RBP: 00007f6b3eb82c40 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 R13: 00007ffc4fb462af R14: 00007f6b40cf0f60 R15: 00007f6b3eb82d80 Allocated by task 9649: save_stack+0x1b/0x80 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_kmalloc+0xd2/0xe0 mm/kasan/common.c:521 kmem_cache_alloc_trace+0x13a/0x4e0 mm/slab.c:3550 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:690 [inline] drm_gem_vram_create+0x53/0x1f0 drivers/gpu/drm/drm_gem_vram_helper.c:131 drm_gem_vram_fill_create_dumb+0x13b/0x2c0 drivers/gpu/drm/drm_gem_vram_helper.c:382 drm_gem_vram_driver_dumb_create+0x5e/0xe0 drivers/gpu/drm/drm_gem_vram_helper.c:509 drm_mode_create_dumb+0x2a0/0x330 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x21a/0x2e0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x52f/0xa70 drivers/gpu/drm/drm_ioctl.c:890 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:510 [inline] do_vfs_ioctl+0xd30/0x1340 fs/ioctl.c:697 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:714 __do_sys_ioctl fs/ioctl.c:721 [inline] __se_sys_ioctl fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:719 do_syscall_64+0xf6/0x7b0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9649: save_stack+0x1b/0x80 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] kasan_set_free_info mm/kasan/common.c:334 [inline] __kasan_slab_free+0x103/0x150 mm/kasan/common.c:478 __cache_free mm/slab.c:3425 [inline] kfree+0x10b/0x330 mm/slab.c:3756 ttm_bo_release_list+0x335/0x4e0 drivers/gpu/drm/ttm/ttm_bo.c:166 kref_put include/linux/kref.h:65 [inline] kref_put include/linux/kref.h:62 [inline] ttm_bo_release+0x44c/0xf60 drivers/gpu/drm/ttm/ttm_bo.c:686 kref_put include/linux/kref.h:65 [inline] kref_put include/linux/kref.h:62 [inline] ttm_bo_put drivers/gpu/drm/ttm/ttm_bo.c:691 [inline] ttm_bo_init_reserved+0x8c1/0x10c0 drivers/gpu/drm/ttm/ttm_bo.c:1390 ttm_bo_init+0x10e/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:1419 drm_gem_vram_init drivers/gpu/drm/drm_gem_vram_helper.c:97 [inline] drm_gem_vram_create+0x15c/0x1f0 drivers/gpu/drm/drm_gem_vram_helper.c:135 drm_gem_vram_fill_create_dumb+0x13b/0x2c0 drivers/gpu/drm/drm_gem_vram_helper.c:382 drm_gem_vram_driver_dumb_create+0x5e/0xe0 drivers/gpu/drm/drm_gem_vram_helper.c:509 drm_mode_create_dumb+0x2a0/0x330 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x21a/0x2e0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x52f/0xa70 drivers/gpu/drm/drm_ioctl.c:890 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:510 [inline] do_vfs_ioctl+0xd30/0x1340 fs/ioctl.c:697 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:714 __do_sys_ioctl fs/ioctl.c:721 [inline] __se_sys_ioctl fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:719 do_syscall_64+0xf6/0x7b0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888069f2d000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 272 bytes inside of 1024-byte region [ffff888069f2d000, ffff888069f2d400) The buggy address belongs to the page: page:ffffea0001a7cb40 refcount:1 mapcount:0 mapping:ffff888119400c40 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002831748 ffffea00019062c8 ffff888119400c40 raw: 0000000000000000 ffff888069f2d000 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888069f2d000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888069f2d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888069f2d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888069f2d180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888069f2d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ================================================================== BUG: KASAN: double-free or invalid-free in drm_gem_vram_create+0x1b7/0x1f0 drivers/gpu/drm/drm_gem_vram_helper.c:142 CPU: 0 PID: 9649 Comm: syz-executor.2 Tainted: G B OE 5.4.206+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1a0/0x217 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x343 mm/kasan/report.c:374 kasan_report_invalid_free+0x61/0xa0 mm/kasan/report.c:468 __kasan_slab_free+0x135/0x150 mm/kasan/common.c:457 __cache_free mm/slab.c:3425 [inline] kfree+0x10b/0x330 mm/slab.c:3756 drm_gem_vram_create+0x1b7/0x1f0 drivers/gpu/drm/drm_gem_vram_helper.c:142 drm_gem_vram_fill_create_dumb+0x13b/0x2c0 drivers/gpu/drm/drm_gem_vram_helper.c:382 drm_gem_vram_driver_dumb_create+0x5e/0xe0 drivers/gpu/drm/drm_gem_vram_helper.c:509 drm_mode_create_dumb+0x2a0/0x330 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x21a/0x2e0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x52f/0xa70 drivers/gpu/drm/drm_ioctl.c:890 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:510 [inline] do_vfs_ioctl+0xd30/0x1340 fs/ioctl.c:697 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:714 __do_sys_ioctl fs/ioctl.c:721 [inline] __se_sys_ioctl fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:719 do_syscall_64+0xf6/0x7b0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f6b40bd24ed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6b3eb82be8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f6b40cf0f60 RCX: 00007f6b40bd24ed RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000003 RBP: 00007f6b3eb82c40 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 R13: 00007ffc4fb462af R14: 00007f6b40cf0f60 R15: 00007f6b3eb82d80 Allocated by task 9649: save_stack+0x1b/0x80 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_kmalloc+0xd2/0xe0 mm/kasan/common.c:521 kmem_cache_alloc_trace+0x13a/0x4e0 mm/slab.c:3550 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:690 [inline] drm_gem_vram_create+0x53/0x1f0 drivers/gpu/drm/drm_gem_vram_helper.c:131 drm_gem_vram_fill_create_dumb+0x13b/0x2c0 drivers/gpu/drm/drm_gem_vram_helper.c:382 drm_gem_vram_driver_dumb_create+0x5e/0xe0 drivers/gpu/drm/drm_gem_vram_helper.c:509 drm_mode_create_dumb+0x2a0/0x330 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x21a/0x2e0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x52f/0xa70 drivers/gpu/drm/drm_ioctl.c:890 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:510 [inline] do_vfs_ioctl+0xd30/0x1340 fs/ioctl.c:697 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:714 __do_sys_ioctl fs/ioctl.c:721 [inline] __se_sys_ioctl fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:719 do_syscall_64+0xf6/0x7b0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9649: save_stack+0x1b/0x80 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] kasan_set_free_info mm/kasan/common.c:334 [inline] __kasan_slab_free+0x103/0x150 mm/kasan/common.c:478 __cache_free mm/slab.c:3425 [inline] kfree+0x10b/0x330 mm/slab.c:3756 ttm_bo_release_list+0x335/0x4e0 drivers/gpu/drm/ttm/ttm_bo.c:166 kref_put include/linux/kref.h:65 [inline] kref_put include/linux/kref.h:62 [inline] ttm_bo_release+0x44c/0xf60 drivers/gpu/drm/ttm/ttm_bo.c:686 kref_put include/linux/kref.h:65 [inline] kref_put include/linux/kref.h:62 [inline] ttm_bo_put drivers/gpu/drm/ttm/ttm_bo.c:691 [inline] ttm_bo_init_reserved+0x8c1/0x10c0 drivers/gpu/drm/ttm/ttm_bo.c:1390 ttm_bo_init+0x10e/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:1419 drm_gem_vram_init drivers/gpu/drm/drm_gem_vram_helper.c:97 [inline] drm_gem_vram_create+0x15c/0x1f0 drivers/gpu/drm/drm_gem_vram_helper.c:135 drm_gem_vram_fill_create_dumb+0x13b/0x2c0 drivers/gpu/drm/drm_gem_vram_helper.c:382 drm_gem_vram_driver_dumb_create+0x5e/0xe0 drivers/gpu/drm/drm_gem_vram_helper.c:509 drm_mode_create_dumb+0x2a0/0x330 drivers/gpu/drm/drm_dumb_buffers.c:94 drm_ioctl_kernel+0x21a/0x2e0 drivers/gpu/drm/drm_ioctl.c:787 drm_ioctl+0x52f/0xa70 drivers/gpu/drm/drm_ioctl.c:890 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:510 [inline] do_vfs_ioctl+0xd30/0x1340 fs/ioctl.c:697 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:714 __do_sys_ioctl fs/ioctl.c:721 [inline] __se_sys_ioctl fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:719 do_syscall_64+0xf6/0x7b0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888069f2d000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 0 bytes inside of 1024-byte region [ffff888069f2d000, ffff888069f2d400) The buggy address belongs to the page: page:ffffea0001a7cb40 refcount:1 mapcount:0 mapping:ffff888119400c40 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002831748 ffffea00019062c8 ffff888119400c40 raw: 0000000000000000 ffff888069f2d000 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888069f2cf00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ffff888069f2cf80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888069f2d000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888069f2d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888069f2d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== -- Thanks and Regards, Dipanjan