program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000040)={0x0, 0x420fb, 0x17, 0x3, 0x200, &(0x7f0000000640)="91df41d521d4413377574bc0fb894eb9479dbf8f4bc04b9c4670fdac82bc40d8150a95d829e478bda8eb649bf2304d90bdf54f2c7b3ec8587f41de49770d3495d1538011730de826b9d5e501137fc25ec0d470ad5e48ce9ff99ce56a3c6679ce83d194fa8b634ab738a003f6ad72a85c9b8b1095213e7723a94d21aa7d7cdd91ef1ef9642377c28e44cc15f94e4eb66c8155d614f63fdde4b1e4a53dc8e175c0e79eea8c044d5bfd57fb0872dc42eefabf78125935500e44b4d6f23899dde7832dbce8728a1718ba9386e21647dfc7b55353b3b7ca1ec10d223ef8aab6f6713c147adcacd30303c8a86b6e4aa096fd5011406a205a3f54c8c4d6c9c6e1e963b1279c4b31fd5db089b7aec337995dd772578c074d07cae179f337a9db13a9d8a1cf3aa7849d51b22b0fe9240964ef9ce9faad08d4de6fd398a4e13384a5baab2a8815305388353f5f77d1efd922c4d51a0b29450d6cf9709a53f3d52162489865db56460243eea757aea7f0ae49dbf9969daac7cb3749969e61758c0a96278024e80d77a56c5501632cc7d648a7fe7c9e299e1fb777d78f30a734e7d071f5b89c7331cd8e4cfbe36f9f17608eefd2cabcb4f007a479464a0ce8fb893555a957cf0838d64f689c5ec6211d59a67f33f97839174364ae5f9cb970f4b6c504a6e33c6a06d84d1966b161fc1c9b35ed9ec2f7989f75bd9e4b9594d87dd67eaeb17f71156764d2468f4e563421360e0a6dded050a4a7c8ca1f75c096015d998e6be805a1f8a5ebddfa50f228261d1b0d0a41576e857d414fb334eeb221c7966cceba6e94a02f4df97f12e0a67c5ed266fa4cff67e2ae2de7f29fb4d0abb002df029be591c38e8aedc7ac53736a8ab40fa13383f1b0b0063f8ac5107f3be4b83d1a3739f3e334ad80a40a114e55db944df1aab093c55efd48068d35fb4f34537971e3df2bcdf68b86c4d3c966f4c6ca66413311ecf23a89035cb71cfc1722a2e598f891aa74cccc001d29e254b12cdd9f1ba240232ee6ea9434b1571470d4c627d5090e6f79f528159305d981526a77ada3916f41b861d6a5146e243d3e0a95f466b11b2de8adba71753dcd2db5655aab6a99f2fc2c801e66cc72649d14e8eb615d20959a6f66b5ea081720768d7299ad084794d9a5fc6d9449699b93be246d2c4d7562b2adda4605267dfbcf9b8578bd091aeb6cf250b8eea742497a0454d02af202990731c327201f9b7ac77a8452d11aaa1f83e375ba99d7ecb6b8630773afbcaa0761608348ab20bd4ab63ae70f40534a8bc2282393255194e433132af69f7737d7080000f9513cdbae9744e8992fcfb7e5221a754d3a2db5811342ee5d671108fe493588d9ea78e8c2b32497468bf30f9efd007530f9c8f37289522ecb073d3a59b6fabd1692c81c82c90928713a00"})
mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0)
write(r1, &(0x7f0000000000)='3', 0x1) (fail_nth: 5)
[ 102.668644][ T4667] Bluetooth: hci0: command tx timeout
[ 102.808154][ T5355] FAULT_INJECTION: forcing a failure.
[ 102.808154][ T5355] name fail_page_alloc, interval 1, probability 0, space 0, times 1
[ 102.808183][ T5355] CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.808196][ T5355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.808215][ T5355] Call Trace:
[ 102.808221][ T5355]
[ 102.808237][ T5355] dump_stack_lvl+0xe8/0x150
[ 102.808423][ T5355] should_fail_ex+0x410/0x560
[ 102.808489][ T5355] prepare_alloc_pages+0x21e/0x5f0
[ 102.808515][ T5355] __alloc_frozen_pages_noprof+0x17a/0x400
[ 102.808530][ T5355] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 102.808581][ T5355] ? rcu_is_watching+0x16/0xb0
[ 102.808616][ T5355] alloc_pages_mpol+0x21e/0x390
[ 102.808634][ T5355] ? vc_do_resize+0x345/0x1550
[ 102.808660][ T5355] ___kmalloc_large_node+0x7b/0x170
[ 102.808680][ T5355] __kmalloc_large_node_noprof+0x18/0x90
[ 102.808698][ T5355] __kmalloc_noprof+0x3f6/0x710
[ 102.808715][ T5355] ? irqentry_exit+0x2a0/0x9b0
[ 102.808802][ T5355] ? trace_irq_disable+0x3b/0x140
[ 102.808817][ T5355] ? vc_do_resize+0x345/0x1550
[ 102.808839][ T5355] vc_do_resize+0x345/0x1550
[ 102.808862][ T5355] ? __sanitizer_cov_trace_const_cmp4+0x9e/0xb0
[ 102.808878][ T5355] ? font_data_rotate+0x806/0x840
[ 102.808897][ T5355] ? __pfx_vc_do_resize+0x10/0x10
[ 102.808909][ T5355] ? fb_match_mode+0x5f9/0x730
[ 102.808928][ T5355] fbcon_modechanged+0x7fe/0x12e0
[ 102.808949][ T5355] rotate_all_store+0x539/0x630
[ 102.808967][ T5355] ? __pfx_sysfs_kf_write+0x10/0x10
[ 102.808995][ T5355] kernfs_fop_write_iter+0x3a4/0x540
[ 102.809010][ T5355] vfs_write+0x612/0xba0
[ 102.809021][ T5355] ? __pfx_vfs_write+0x10/0x10
[ 102.809030][ T5355] ? __fget_files+0x3a2/0x420
[ 102.809041][ T5355] ? __fget_files+0x2a/0x420
[ 102.809055][ T5355] ? fdget+0x1ac/0x250
[ 102.809074][ T5355] ksys_write+0x150/0x270
[ 102.809088][ T5355] ? __pfx_ksys_write+0x10/0x10
[ 102.809106][ T5355] do_syscall_64+0x166/0x520
[ 102.809120][ T5355] ? trace_irq_disable+0x3b/0x140
[ 102.809134][ T5355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.809145][ T5355] ? clear_bhb_loop+0x70/0xc0
[ 102.809159][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.809171][ T5355] RIP: 0033:0x7f10bff9f559
[ 102.809184][ T5355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.809194][ T5355] RSP: 002b:00007f10c0ea3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.809208][ T5355] RAX: ffffffffffffffda RBX: 00007f10c0226090 RCX: 00007f10bff9f559
[ 102.809215][ T5355] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000004
[ 102.809220][ T5355] RBP: 00007f10c0ea4050 R08: 0000000000000000 R09: 0000000000000000
[ 102.809224][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 102.809229][ T5355] R13: 00007f10c0226128 R14: 00007f10c0226090 R15: 00007fff0efa7f88
[ 102.809241][ T5355]
[ 103.002499][ T5355] ==================================================================
[ 103.002513][ T5355] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1592/0x1e40
[ 103.002543][ T5355] Write of size 8 at addr ffffc90024008000 by task syz.0.0/5355
[ 103.002553][ T5355]
[ 103.002560][ T5355] CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.002573][ T5355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.002580][ T5355] Call Trace:
[ 103.002585][ T5355]
[ 103.002591][ T5355] dump_stack_lvl+0xe8/0x150
[ 103.002609][ T5355] print_address_description+0x55/0x1e0
[ 103.002630][ T5355] ? sys_imageblit+0x1592/0x1e40
[ 103.002645][ T5355] print_report+0x58/0x70
[ 103.002659][ T5355] kasan_report+0x117/0x150
[ 103.002673][ T5355] ? sys_imageblit+0x1592/0x1e40
[ 103.002719][ T5355] sys_imageblit+0x1592/0x1e40
[ 103.002737][ T5355] ? __mutex_unlock_slowpath+0x731/0x900
[ 103.002754][ T5355] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 103.002768][ T5355] drm_fbdev_shmem_defio_imageblit+0x2c/0x110
[ 103.002785][ T5355] ccw_putcs+0xf48/0x1210
[ 103.002807][ T5355] ? __pfx_ccw_putcs+0x10/0x10
[ 103.002823][ T5355] ? fb_get_color_depth+0x162/0x280
[ 103.002845][ T5355] fbcon_putcs+0x3c5/0x5a0
[ 103.002858][ T5355] ? __pfx_ccw_putcs+0x10/0x10
[ 103.002872][ T5355] do_update_region+0x389/0x440
[ 103.002891][ T5355] redraw_screen+0xa3d/0x1020
[ 103.002901][ T5355] ? fbcon_set_palette+0x690/0x800
[ 103.002909][ T5355] ? fbcon_modechanged+0xc0f/0x12e0
[ 103.002916][ T5355] ? __pfx_redraw_screen+0x10/0x10
[ 103.002926][ T5355] rotate_all_store+0x539/0x630
[ 103.002935][ T5355] ? __pfx_sysfs_kf_write+0x10/0x10
[ 103.002943][ T5355] kernfs_fop_write_iter+0x3a4/0x540
[ 103.002980][ T5355] vfs_write+0x612/0xba0
[ 103.002993][ T5355] ? __pfx_vfs_write+0x10/0x10
[ 103.003004][ T5355] ? __fget_files+0x3a2/0x420
[ 103.003018][ T5355] ? __fget_files+0x2a/0x420
[ 103.003033][ T5355] ? fdget+0x1ac/0x250
[ 103.003048][ T5355] ksys_write+0x150/0x270
[ 103.003058][ T5355] ? __pfx_ksys_write+0x10/0x10
[ 103.003072][ T5355] do_syscall_64+0x166/0x520
[ 103.003085][ T5355] ? trace_irq_disable+0x3b/0x140
[ 103.003099][ T5355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.003111][ T5355] ? clear_bhb_loop+0x70/0xc0
[ 103.003123][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.003134][ T5355] RIP: 0033:0x7f10bff9f559
[ 103.003145][ T5355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.003153][ T5355] RSP: 002b:00007f10c0ea3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 103.003167][ T5355] RAX: ffffffffffffffda RBX: 00007f10c0226090 RCX: 00007f10bff9f559
[ 103.003175][ T5355] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000004
[ 103.003182][ T5355] RBP: 00007f10c0ea4050 R08: 0000000000000000 R09: 0000000000000000
[ 103.003189][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 103.003195][ T5355] R13: 00007f10c0226128 R14: 00007f10c0226090 R15: 00007fff0efa7f88
[ 103.003207][ T5355]
[ 103.003211][ T5355]
[ 103.003214][ T5355] The buggy address belongs to a 2048-page vmalloc region starting at 0xffffc90023808000 allocated at kcov_ioctl+0x55/0x630
[ 103.003306][ T5355] Memory state around the buggy address:
[ 103.003313][ T5355] ffffc90024007f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 103.003320][ T5355] ffffc90024007f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 103.003327][ T5355] >ffffc90024008000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[ 103.003332][ T5355] ^
[ 103.003337][ T5355] ffffc90024008080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[ 103.003343][ T5355] ffffc90024008100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[ 103.003348][ T5355] ==================================================================
[ 103.003649][ T5355] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 103.165854][ T5355] CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.169707][ T5355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.173934][ T5355] Call Trace:
[ 103.175414][ T5355]
[ 103.176696][ T5355] vpanic+0x56d/0xa60
[ 103.178547][ T5355] ? rcu_is_watching+0x16/0xb0
[ 103.180764][ T5355] ? __pfx_vpanic+0x10/0x10
[ 103.182731][ T5355] ? __pfx___schedule+0x10/0x10
[ 103.184823][ T5355] panic+0xc5/0xd0
[ 103.186454][ T5355] ? __pfx_panic+0x10/0x10
[ 103.188376][ T5355] ? preempt_schedule_thunk+0x16/0x40
[ 103.190712][ T5355] ? sys_imageblit+0x1592/0x1e40
[ 103.192834][ T5355] check_panic_on_warn+0x89/0xb0
[ 103.194992][ T5355] ? sys_imageblit+0x1592/0x1e40
[ 103.197128][ T5355] end_report+0x73/0x170
[ 103.199007][ T5355] ? sys_imageblit+0x1592/0x1e40
[ 103.201317][ T5355] kasan_report+0x128/0x150
[ 103.203370][ T5355] ? sys_imageblit+0x1592/0x1e40
[ 103.205537][ T5355] sys_imageblit+0x1592/0x1e40
[ 103.207710][ T5355] ? __mutex_unlock_slowpath+0x731/0x900
[ 103.210253][ T5355] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 103.212958][ T5355] drm_fbdev_shmem_defio_imageblit+0x2c/0x110
[ 103.215511][ T5355] ccw_putcs+0xf48/0x1210
[ 103.217290][ T5355] ? __pfx_ccw_putcs+0x10/0x10
[ 103.219320][ T5355] ? fb_get_color_depth+0x162/0x280
[ 103.221466][ T5355] fbcon_putcs+0x3c5/0x5a0
[ 103.223500][ T5355] ? __pfx_ccw_putcs+0x10/0x10
[ 103.225590][ T5355] do_update_region+0x389/0x440
[ 103.227731][ T5355] redraw_screen+0xa3d/0x1020
[ 103.229744][ T5355] ? fbcon_set_palette+0x690/0x800
[ 103.231984][ T5355] ? fbcon_modechanged+0xc0f/0x12e0
[ 103.234164][ T5355] ? __pfx_redraw_screen+0x10/0x10
[ 103.236280][ T5355] rotate_all_store+0x539/0x630
[ 103.238291][ T5355] ? __pfx_sysfs_kf_write+0x10/0x10
[ 103.240484][ T5355] kernfs_fop_write_iter+0x3a4/0x540
[ 103.242727][ T5355] vfs_write+0x612/0xba0
[ 103.244486][ T5355] ? __pfx_vfs_write+0x10/0x10
[ 103.246532][ T5355] ? __fget_files+0x3a2/0x420
[ 103.248557][ T5355] ? __fget_files+0x2a/0x420
[ 103.250779][ T5355] ? fdget+0x1ac/0x250
[ 103.252523][ T5355] ksys_write+0x150/0x270
[ 103.254393][ T5355] ? __pfx_ksys_write+0x10/0x10
[ 103.256516][ T5355] do_syscall_64+0x166/0x520
[ 103.258541][ T5355] ? trace_irq_disable+0x3b/0x140
[ 103.260717][ T5355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.263260][ T5355] ? clear_bhb_loop+0x70/0xc0
[ 103.265282][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.267647][ T5355] RIP: 0033:0x7f10bff9f559
[ 103.269563][ T5355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.279127][ T5355] RSP: 002b:00007f10c0ea3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 103.283704][ T5355] RAX: ffffffffffffffda RBX: 00007f10c0226090 RCX: 00007f10bff9f559
[ 103.287147][ T5355] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000004
[ 103.290513][ T5355] RBP: 00007f10c0ea4050 R08: 0000000000000000 R09: 0000000000000000
[ 103.293815][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 103.297287][ T5355] R13: 00007f10c0226128 R14: 00007f10c0226090 R15: 00007fff0efa7f88
[ 103.300528][ T5355]
[ 103.302215][ T5355] Kernel Offset: disabled
[ 103.304033][ T5355] Rebooting in 86400 seconds..