program: r0 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x800) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f00000001c0)={r1, r1, 0x1, 0x5, 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000280)) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000140)={&(0x7f00000002c0), &(0x7f0000000200)=[0x0, 0x7fff, 0x40, 0x6, 0x4, 0x9, 0x1, 0x5c, 0x3, 0x3], 0x21a6309f748a0e39}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x4240, 0x0) ioctl$BLKPG(r2, 0x1269, &(0x7f0000000100)={0x1, 0x0, 0x98, &(0x7f0000000040)={0x0, 0x10000, 0xc}}) [ 127.230418][ T5327] Bluetooth: hci0: command tx timeout [ 127.368341][ T5348] ------------[ cut here ]------------ [ 127.370696][ T5348] WARNING: mm/page_alloc.c:5186 at __alloc_frozen_pages_noprof+0x2c8/0x370, CPU#0: syz.0.0/5348 [ 127.375200][ T5348] Modules linked in: [ 127.376719][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 127.379976][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 127.384103][ T5348] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 127.387079][ T5348] Code: 74 10 4c 89 e7 89 54 24 0c e8 c4 ad 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b3 58 51 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 127.395681][ T5348] RSP: 0018:ffffc9000e307940 EFLAGS: 00010246 [ 127.398857][ T5348] RAX: ffffc9000e307900 RBX: 0000000000000015 RCX: 0000000000000000 [ 127.403192][ T5348] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000e3079a8 [ 127.407146][ T5348] RBP: ffffc9000e307a40 R08: ffffc9000e3079a7 R09: 0000000000000000 [ 127.410289][ T5348] R10: ffffc9000e307980 R11: fffff52001c60f35 R12: 0000000000000000 [ 127.413610][ T5348] R13: 1ffff92001c60f2c R14: 0000000000040cc0 R15: dffffc0000000000 [ 127.417344][ T5348] FS: 00007f870d9d46c0(0000) GS:ffff88808d416000(0000) knlGS:0000000000000000 [ 127.420947][ T5348] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.423681][ T5348] CR2: 00007f870d9d3fc8 CR3: 0000000011bc9000 CR4: 0000000000352ef0 [ 127.427123][ T5348] Call Trace: [ 127.428393][ T5348] [ 127.429690][ T5348] ? kasan_save_track+0x3e/0x80 [ 127.431824][ T5348] ? __kasan_slab_free+0x5c/0x80 [ 127.434544][ T5348] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 127.437606][ T5348] ? do_syscall_64+0xec/0xf80 [ 127.439852][ T5348] ? policy_nodemask+0x27c/0x720 [ 127.442280][ T5348] alloc_pages_mpol+0x232/0x4a0 [ 127.444528][ T5348] ___kmalloc_large_node+0x4e/0x150 [ 127.447161][ T5348] __kmalloc_large_node_noprof+0x18/0x90 [ 127.449816][ T5348] __kmalloc_noprof+0x4c9/0x800 [ 127.451980][ T5348] ? drm_syncobj_array_find+0x3a/0x450 [ 127.454248][ T5348] ? drm_dev_enter+0x49/0x150 [ 127.456425][ T5348] drm_syncobj_array_find+0x3a/0x450 [ 127.458820][ T5348] drm_syncobj_timeline_signal_ioctl+0x14e/0x7d0 [ 127.461902][ T5348] ? drm_dev_exit+0x3a/0x60 [ 127.464062][ T5348] drm_ioctl_kernel+0x2cf/0x390 [ 127.466422][ T5348] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 127.469366][ T5348] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 127.471738][ T5348] drm_ioctl+0x67f/0xb10 [ 127.473523][ T5348] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 127.476465][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 127.478423][ T5348] ? __fget_files+0x2a/0x420 [ 127.480325][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20 [ 127.482638][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 127.484419][ T5348] __se_sys_ioctl+0xfc/0x170 [ 127.486171][ T5348] do_syscall_64+0xec/0xf80 [ 127.487829][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.490024][ T5348] ? trace_irq_disable+0x37/0x100 [ 127.492032][ T5348] ? clear_bhb_loop+0x60/0xb0 [ 127.493778][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.496214][ T5348] RIP: 0033:0x7f871158f7c9 [ 127.498033][ T5348] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 127.508919][ T5348] RSP: 002b:00007f870d9d4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 127.512140][ T5348] RAX: ffffffffffffffda RBX: 00007f87117e6090 RCX: 00007f871158f7c9 [ 127.515399][ T5348] RDX: 0000200000000140 RSI: 00000000c01864cd RDI: 0000000000000003 [ 127.518429][ T5348] RBP: 00007f8711613f91 R08: 0000000000000000 R09: 0000000000000000 [ 127.521722][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.524945][ T5348] R13: 00007f87117e6128 R14: 00007f87117e6090 R15: 00007ffde92d9398 [ 127.528071][ T5348] [ 127.529424][ T5348] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 127.532150][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 127.535495][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 127.539578][ T5348] Call Trace: [ 127.540798][ T5348] [ 127.541816][ T5348] vpanic+0x1e0/0x670 [ 127.543254][ T5348] panic+0xb9/0xc0 [ 127.544580][ T5348] ? __pfx_panic+0x10/0x10 [ 127.546355][ T5348] __warn+0x317/0x4b0 [ 127.547955][ T5348] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 127.550181][ T5348] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 127.552377][ T5348] __report_bug+0x288/0x500 [ 127.554071][ T5348] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 127.556217][ T5348] ? __pfx___report_bug+0x10/0x10 [ 127.558099][ T5348] ? is_bpf_text_address+0x292/0x2b0 [ 127.560038][ T5348] ? is_bpf_text_address+0x26/0x2b0 [ 127.561997][ T5348] ? kernel_text_address+0xa5/0xe0 [ 127.563786][ T5348] ? __kernel_text_address+0xd/0x40 [ 127.565679][ T5348] ? unwind_get_return_address+0x4d/0x90 [ 127.567760][ T5348] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 127.570411][ T5348] report_bug+0x16a/0x220 [ 127.571990][ T5348] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 127.574183][ T5348] ? __alloc_frozen_pages_noprof+0x2ca/0x370 [ 127.576390][ T5348] handle_bug+0x98/0x200 [ 127.578046][ T5348] exc_invalid_op+0x1a/0x50 [ 127.579637][ T5348] asm_exc_invalid_op+0x1a/0x20 [ 127.581411][ T5348] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 127.583738][ T5348] Code: 74 10 4c 89 e7 89 54 24 0c e8 c4 ad 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b3 58 51 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 127.590215][ T5348] RSP: 0018:ffffc9000e307940 EFLAGS: 00010246 [ 127.592335][ T5348] RAX: ffffc9000e307900 RBX: 0000000000000015 RCX: 0000000000000000 [ 127.595013][ T5348] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000e3079a8 [ 127.597845][ T5348] RBP: ffffc9000e307a40 R08: ffffc9000e3079a7 R09: 0000000000000000 [ 127.600778][ T5348] R10: ffffc9000e307980 R11: fffff52001c60f35 R12: 0000000000000000 [ 127.603915][ T5348] R13: 1ffff92001c60f2c R14: 0000000000040cc0 R15: dffffc0000000000 [ 127.607331][ T5348] ? kasan_save_track+0x3e/0x80 [ 127.609358][ T5348] ? __kasan_slab_free+0x5c/0x80 [ 127.611345][ T5348] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 127.613777][ T5348] ? do_syscall_64+0xec/0xf80 [ 127.615597][ T5348] ? policy_nodemask+0x27c/0x720 [ 127.617614][ T5348] alloc_pages_mpol+0x232/0x4a0 [ 127.619500][ T5348] ___kmalloc_large_node+0x4e/0x150 [ 127.621598][ T5348] __kmalloc_large_node_noprof+0x18/0x90 [ 127.623633][ T5348] __kmalloc_noprof+0x4c9/0x800 [ 127.625670][ T5348] ? drm_syncobj_array_find+0x3a/0x450 [ 127.627829][ T5348] ? drm_dev_enter+0x49/0x150 [ 127.629590][ T5348] drm_syncobj_array_find+0x3a/0x450 [ 127.631639][ T5348] drm_syncobj_timeline_signal_ioctl+0x14e/0x7d0 [ 127.634234][ T5348] ? drm_dev_exit+0x3a/0x60 [ 127.636259][ T5348] drm_ioctl_kernel+0x2cf/0x390 [ 127.638497][ T5348] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 127.641417][ T5348] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 127.643479][ T5348] drm_ioctl+0x67f/0xb10 [ 127.645120][ T5348] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 127.648146][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 127.650213][ T5348] ? __fget_files+0x2a/0x420 [ 127.651982][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20 [ 127.653962][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 127.655842][ T5348] __se_sys_ioctl+0xfc/0x170 [ 127.657747][ T5348] do_syscall_64+0xec/0xf80 [ 127.659543][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.662051][ T5348] ? trace_irq_disable+0x37/0x100 [ 127.664020][ T5348] ? clear_bhb_loop+0x60/0xb0 [ 127.666025][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.668558][ T5348] RIP: 0033:0x7f871158f7c9 [ 127.670367][ T5348] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 127.678590][ T5348] RSP: 002b:00007f870d9d4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 127.682113][ T5348] RAX: ffffffffffffffda RBX: 00007f87117e6090 RCX: 00007f871158f7c9 [ 127.685474][ T5348] RDX: 0000200000000140 RSI: 00000000c01864cd RDI: 0000000000000003 [ 127.688787][ T5348] RBP: 00007f8711613f91 R08: 0000000000000000 R09: 0000000000000000 [ 127.691862][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.695236][ T5348] R13: 00007f87117e6128 R14: 00007f87117e6090 R15: 00007ffde92d9398 [ 127.698537][ T5348] [ 127.700044][ T5348] Kernel Offset: disabled [ 127.701811][ T5348] Rebooting in 86400 seconds..