From: syzbot <syzbot+b2e951687503f32f74ce@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_gem_object_release_handle
Date: Mon, 13 Apr 2026 22:26:01 -0700 [thread overview]
Message-ID: <69ddcfe9.a00a0220.475f0.0035.GAE@google.com> (raw)
In-Reply-To: <20260414050005.1782-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KFENCE: use-after-free read in drm_gem_object_release_handle
==================================================================
BUG: KFENCE: use-after-free read in drm_gem_object_release_handle+0x47/0x1e0 drivers/gpu/drm/drm_gem.c:374
Use-after-free read at 0xffff88823be98e88 (in kfence-#75):
drm_gem_object_release_handle+0x47/0x1e0 drivers/gpu/drm/drm_gem.c:374
drm_gem_object_release_idr_handle+0x69/0x80 drivers/gpu/drm/drm_gem.c:403
idr_for_each+0x1c6/0x2a0 lib/idr.c:210
drm_gem_release+0x28/0x40 drivers/gpu/drm/drm_gem.c:1105
drm_file_free+0x729/0xa00 drivers/gpu/drm/drm_file.c:261
drm_close_helper drivers/gpu/drm/drm_file.c:290 [inline]
drm_release+0x2de/0x3f0 drivers/gpu/drm/drm_file.c:438
__fput+0x44f/0xa60 fs/file_table.c:510
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
kfence-#75: 0xffff88823be98c00-0xffff88823be98ee7, size=744, cache=kmalloc-1k
allocated by task 6583 on cpu 0 at 133.209896s (0.096709s ago):
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
__drm_gem_shmem_create+0xc4/0x2e0 drivers/gpu/drm/drm_gem_shmem_helper.c:130
drm_gem_shmem_create drivers/gpu/drm/drm_gem_shmem_helper.c:157 [inline]
drm_gem_shmem_create_with_handle drivers/gpu/drm/drm_gem_shmem_helper.c:460 [inline]
drm_gem_shmem_dumb_create+0x72/0x120 drivers/gpu/drm/drm_gem_shmem_helper.c:549
drm_mode_create_dumb drivers/gpu/drm/drm_dumb_buffers.c:227 [inline]
drm_mode_create_dumb_ioctl+0x2bd/0x340 drivers/gpu/drm/drm_dumb_buffers.c:236
drm_ioctl_kernel+0x2df/0x3b0 drivers/gpu/drm/drm_ioctl.c:804
drm_ioctl+0x6ba/0xb80 drivers/gpu/drm/drm_ioctl.c:901
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
freed by task 6585 on cpu 1 at 133.211010s (0.147010s ago):
drm_gem_handle_delete+0x7b/0xb0 drivers/gpu/drm/drm_gem.c:430
drm_ioctl_kernel+0x2df/0x3b0 drivers/gpu/drm/drm_ioctl.c:804
drm_ioctl+0x6ba/0xb80 drivers/gpu/drm/drm_ioctl.c:901
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 1 UID: 0 PID: 6581 Comm: syz.1.67 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
RIP: 0010:drm_gem_object_release_handle+0x47/0x1e0 drivers/gpu/drm/drm_gem.c:374
Code: 5f 6c 62 fc 4d 85 f6 0f 84 9e 00 00 00 4c 8d bb 88 02 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 59 c1 cc fc <4d> 8b 3f 49 83 c7 10 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c
RSP: 0018:ffffc90003f27ad8 EFLAGS: 00010246
RAX: 1ffff110477d31d1 RBX: ffff88823be98c00 RCX: ffff888054fa1e80
RDX: 0000000000000000 RSI: ffff88823be98c00 RDI: 0000000000000080
RBP: 0000000000000080 R08: ffff8880321950e3 R09: 1ffff11006432a1c
R10: dffffc0000000000 R11: ffffed1006432a1d R12: ffff8880321950e0
R13: dffffc0000000000 R14: ffff888032195000 R15: ffff88823be98e88
FS: 000055557167a500(0000) GS:ffff88812554b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823be98e88 CR3: 000000006dd68000 CR4: 00000000003526f0
Call Trace:
<TASK>
drm_gem_object_release_idr_handle+0x69/0x80 drivers/gpu/drm/drm_gem.c:403
idr_for_each+0x1c6/0x2a0 lib/idr.c:210
drm_gem_release+0x28/0x40 drivers/gpu/drm/drm_gem.c:1105
drm_file_free+0x729/0xa00 drivers/gpu/drm/drm_file.c:261
drm_close_helper drivers/gpu/drm/drm_file.c:290 [inline]
drm_release+0x2de/0x3f0 drivers/gpu/drm/drm_file.c:438
__fput+0x44f/0xa60 fs/file_table.c:510
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f246c99c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd35630618 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffd35630700 RCX: 00007f246c99c819
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000002082e R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32820000 R11: 0000000000000246 R12: 00007ffd35630740
R13: 00007f246cc1609c R14: 0000000000020866 R15: 00007f246cc16090
</TASK>
==================================================================
----------------
Code disassembly (best guess), 3 bytes skipped:
0: fc cld
1: 4d 85 f6 test %r14,%r14
4: 0f 84 9e 00 00 00 je 0xa8
a: 4c 8d bb 88 02 00 00 lea 0x288(%rbx),%r15
11: 4c 89 f8 mov %r15,%rax
14: 48 c1 e8 03 shr $0x3,%rax
18: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
1d: 74 08 je 0x27
1f: 4c 89 ff mov %r15,%rdi
22: e8 59 c1 cc fc call 0xfcccc180
* 27: 4d 8b 3f mov (%r15),%r15 <-- trapping instruction
2a: 49 83 c7 10 add $0x10,%r15
2e: 4c 89 f8 mov %r15,%rax
31: 48 c1 e8 03 shr $0x3,%rax
35: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
3a: 74 08 je 0x44
3c: 4c rex.WR
Tested on:
commit: d60bc140 Merge tag 'pwrseq-updates-for-v7.1-rc1' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=157e7cd2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=85bd86f990609a1
dashboard link: https://syzkaller.appspot.com/bug?extid=b2e951687503f32f74ce
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=12673036580000
next prev parent reply other threads:[~2026-04-14 5:26 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-13 17:16 [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_gem_object_release_handle syzbot
2026-04-14 0:16 ` Forwarded: [PATCH] drm/gem: fix use-after-free in drm_gem_release syzbot
2026-04-14 1:32 ` syzbot
2026-04-14 5:00 ` [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_gem_object_release_handle Hillf Danton
2026-04-14 5:26 ` syzbot [this message]
2026-04-14 5:49 ` Forwarded: [PATCH] drm/gem: fix use-after-free in drm_gem_release syzbot
2026-04-14 8:46 ` [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_gem_object_release_handle Hillf Danton
2026-04-14 9:04 ` syzbot
2026-04-14 10:03 ` Hillf Danton
2026-04-14 10:20 ` syzbot
2026-04-15 0:33 ` Hillf Danton
2026-04-15 3:54 ` syzbot
2026-04-15 7:50 ` Hillf Danton
2026-04-15 8:50 ` syzbot
2026-04-15 11:19 ` Hillf Danton
2026-04-15 11:44 ` syzbot
2026-04-16 0:44 ` Hillf Danton
2026-04-16 4:52 ` syzbot
2026-04-16 2:59 ` Edward Adam Davis
2026-04-16 5:13 ` syzbot
2026-04-16 8:19 ` Hillf Danton
2026-04-16 9:03 ` syzbot
2026-04-16 8:57 ` [PATCH] drm: Avoid the chaotic interleaving of change and delete handle Edward Adam Davis
[not found] <20260414001626.60471-1-kartikey406@gmail.com>
2026-04-14 0:36 ` [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_gem_object_release_handle syzbot
[not found] <20260414013225.64095-1-kartikey406@gmail.com>
2026-04-14 1:50 ` syzbot
[not found] <20260414054951.69728-1-kartikey406@gmail.com>
2026-04-14 6:22 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69ddcfe9.a00a0220.475f0.0035.GAE@google.com \
--to=syzbot+b2e951687503f32f74ce@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.