program: r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x203, 0x2202) r1 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0xc8d03) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r1, 0xc01864cd, &(0x7f0000000180)={&(0x7f0000000080)=[r2], 0x0, 0x40000036}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r1, 0xc01064c1, &(0x7f0000000240)={r2, 0x1, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r3, 0xc0383e04, &(0x7f0000000140)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) ioctl$SYNC_IOC_FILE_INFO(r3, 0xc0383e04, &(0x7f00000001c0)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f00000000c0)=[{}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x10, r0, 0x0) [ 85.039448][ T5304] Bluetooth: hci0: command tx timeout [ 85.105633][ T5329] ------------[ cut here ]------------ [ 85.108010][ T5329] WARNING: CPU: 0 PID: 5329 at mm/page_alloc.c:5159 __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.112694][ T5329] Modules linked in: [ 85.114322][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.118059][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.123571][ T5329] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.126205][ T5329] Code: 74 10 4c 89 e7 89 54 24 0c e8 24 bc 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 a7 70 4d 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 85.134956][ T5329] RSP: 0018:ffffc9000d377920 EFLAGS: 00010246 [ 85.137730][ T5329] RAX: ffffc9000d377900 RBX: 0000000000000015 RCX: 0000000000000000 [ 85.141622][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d377988 [ 85.145086][ T5329] RBP: ffffc9000d377a10 R08: ffffc9000d377987 R09: 0000000000000000 [ 85.148609][ T5329] R10: ffffc9000d377960 R11: fffff52001a6ef31 R12: 0000000000000000 [ 85.152179][ T5329] R13: 1ffff92001a6ef28 R14: 0000000000040cc0 R15: dffffc0000000000 [ 85.155871][ T5329] FS: 00007ff6ed20d6c0(0000) GS:ffff88808d732000(0000) knlGS:0000000000000000 [ 85.160516][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.163748][ T5329] CR2: 00005579b5552168 CR3: 000000004341b000 CR4: 0000000000352ef0 [ 85.168095][ T5329] Call Trace: [ 85.169949][ T5329] [ 85.171212][ T5329] ? kasan_save_track+0x3e/0x80 [ 85.173271][ T5329] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 85.176075][ T5329] ? security_file_ioctl+0xcb/0x2d0 [ 85.178308][ T5329] alloc_pages_mpol+0x232/0x4a0 [ 85.180583][ T5329] ___kmalloc_large_node+0x5f/0x1b0 [ 85.182721][ T5329] __kmalloc_large_node_noprof+0x18/0x90 [ 85.185159][ T5329] __kmalloc_noprof+0x4bd/0x7f0 [ 85.187402][ T5329] ? drm_syncobj_array_find+0x3a/0x450 [ 85.189856][ T5329] drm_syncobj_array_find+0x3a/0x450 [ 85.191909][ T5329] drm_syncobj_timeline_signal_ioctl+0x14e/0x7d0 [ 85.194711][ T5329] ? drm_dev_exit+0x3a/0x60 [ 85.196988][ T5329] drm_ioctl_kernel+0x2cf/0x390 [ 85.199892][ T5329] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 85.203689][ T5329] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 85.206746][ T5329] drm_ioctl+0x67f/0xb10 [ 85.209240][ T5329] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 85.212756][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 85.214922][ T5329] ? __fget_files+0x3a0/0x420 [ 85.217209][ T5329] ? __fget_files+0x2a/0x420 [ 85.219801][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 85.222387][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 85.224621][ T5329] __se_sys_ioctl+0xfc/0x170 [ 85.226637][ T5329] do_syscall_64+0xfa/0xfa0 [ 85.228853][ T5329] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.231408][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.234039][ T5329] ? clear_bhb_loop+0x60/0xb0 [ 85.236114][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.238656][ T5329] RIP: 0033:0x7ff6ec38efc9 [ 85.240664][ T5329] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.249245][ T5329] RSP: 002b:00007ff6ed20d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.252800][ T5329] RAX: ffffffffffffffda RBX: 00007ff6ec5e5fa0 RCX: 00007ff6ec38efc9 [ 85.256239][ T5329] RDX: 0000200000000180 RSI: 00000000c01864cd RDI: 0000000000000004 [ 85.259759][ T5329] RBP: 00007ff6ec411f91 R08: 0000000000000000 R09: 0000000000000000 [ 85.262985][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.266021][ T5329] R13: 00007ff6ec5e6038 R14: 00007ff6ec5e5fa0 R15: 00007ffd9f5ba478 [ 85.269866][ T5329] [ 85.271319][ T5329] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 85.274545][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.278571][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.283371][ T5329] Call Trace: [ 85.284928][ T5329] [ 85.286278][ T5329] dump_stack_lvl+0x99/0x250 [ 85.288428][ T5329] ? __asan_memcpy+0x40/0x70 [ 85.290554][ T5329] ? __pfx_dump_stack_lvl+0x10/0x10 [ 85.292954][ T5329] ? __pfx__printk+0x10/0x10 [ 85.295025][ T5329] vpanic+0x237/0x6d0 [ 85.296901][ T5329] ? __pfx_vpanic+0x10/0x10 [ 85.298923][ T5329] panic+0xb9/0xc0 [ 85.300609][ T5329] ? __pfx_panic+0x10/0x10 [ 85.302510][ T5329] __warn+0x31b/0x4b0 [ 85.304204][ T5329] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.306762][ T5329] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.309375][ T5329] report_bug+0x2be/0x4f0 [ 85.311211][ T5329] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.313700][ T5329] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.316158][ T5329] ? __alloc_frozen_pages_noprof+0x2ca/0x370 [ 85.318727][ T5329] handle_bug+0x84/0x160 [ 85.320653][ T5329] exc_invalid_op+0x1a/0x50 [ 85.322647][ T5329] asm_exc_invalid_op+0x1a/0x20 [ 85.324935][ T5329] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.327912][ T5329] Code: 74 10 4c 89 e7 89 54 24 0c e8 24 bc 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 a7 70 4d 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 85.337301][ T5329] RSP: 0018:ffffc9000d377920 EFLAGS: 00010246 [ 85.339887][ T5329] RAX: ffffc9000d377900 RBX: 0000000000000015 RCX: 0000000000000000 [ 85.343135][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d377988 [ 85.346375][ T5329] RBP: ffffc9000d377a10 R08: ffffc9000d377987 R09: 0000000000000000 [ 85.349714][ T5329] R10: ffffc9000d377960 R11: fffff52001a6ef31 R12: 0000000000000000 [ 85.353030][ T5329] R13: 1ffff92001a6ef28 R14: 0000000000040cc0 R15: dffffc0000000000 [ 85.356486][ T5329] ? kasan_save_track+0x3e/0x80 [ 85.358632][ T5329] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 85.361417][ T5329] ? security_file_ioctl+0xcb/0x2d0 [ 85.363676][ T5329] alloc_pages_mpol+0x232/0x4a0 [ 85.365796][ T5329] ___kmalloc_large_node+0x5f/0x1b0 [ 85.367852][ T5329] __kmalloc_large_node_noprof+0x18/0x90 [ 85.370275][ T5329] __kmalloc_noprof+0x4bd/0x7f0 [ 85.372423][ T5329] ? drm_syncobj_array_find+0x3a/0x450 [ 85.374776][ T5329] drm_syncobj_array_find+0x3a/0x450 [ 85.376970][ T5329] drm_syncobj_timeline_signal_ioctl+0x14e/0x7d0 [ 85.379853][ T5329] ? drm_dev_exit+0x3a/0x60 [ 85.382457][ T5329] drm_ioctl_kernel+0x2cf/0x390 [ 85.384871][ T5329] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 85.387985][ T5329] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 85.390341][ T5329] drm_ioctl+0x67f/0xb10 [ 85.392233][ T5329] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 85.395339][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 85.397630][ T5329] ? __fget_files+0x3a0/0x420 [ 85.399762][ T5329] ? __fget_files+0x2a/0x420 [ 85.401781][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 85.403574][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 85.405284][ T5329] __se_sys_ioctl+0xfc/0x170 [ 85.407249][ T5329] do_syscall_64+0xfa/0xfa0 [ 85.413651][ T5329] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.415967][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.418641][ T5329] ? clear_bhb_loop+0x60/0xb0 [ 85.420680][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.423392][ T5329] RIP: 0033:0x7ff6ec38efc9 [ 85.425472][ T5329] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.434093][ T5329] RSP: 002b:00007ff6ed20d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.437698][ T5329] RAX: ffffffffffffffda RBX: 00007ff6ec5e5fa0 RCX: 00007ff6ec38efc9 [ 85.440970][ T5329] RDX: 0000200000000180 RSI: 00000000c01864cd RDI: 0000000000000004 [ 85.444610][ T5329] RBP: 00007ff6ec411f91 R08: 0000000000000000 R09: 0000000000000000 [ 85.448082][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.451357][ T5329] R13: 00007ff6ec5e6038 R14: 00007ff6ec5e5fa0 R15: 00007ffd9f5ba478 [ 85.454634][ T5329] [ 85.456216][ T5329] Kernel Offset: disabled [ 85.458503][ T5329] Rebooting in 86400 seconds..