program: r0 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x40502) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f00000004c0)={0x0, 0x0, 0xfffffffffffffde6}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0x21, &(0x7f0000000280)="dc8daf8d760c0b8caa98fa19c6a35a18", 0x10) getsockopt$inet_tcp_buf(r1, 0x6, 0x21, 0x0, &(0x7f0000000040)) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x20, 0x14, 0x503, 0x0, 0x3, {0x2, 0x8, 0x0, 0xfd, r4}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x38, 0x10, 0x49920d862a92153b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xff7f}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r7}]}}}]}, 0x38}}, 0x0) [ 101.056235][ T4665] Bluetooth: hci0: command tx timeout [ 101.112818][ T5328] ------------[ cut here ]------------ [ 101.116018][ T5328] 1 [ 101.116032][ T5328] WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof+0x2d1/0x380, CPU#0: syz.0.0/5328 [ 101.122811][ T5328] Modules linked in: [ 101.125401][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.130153][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.135725][ T5328] RIP: 0010:__alloc_frozen_pages_noprof+0x2d1/0x380 [ 101.139009][ T5328] Code: 74 10 4c 89 e7 89 54 24 0c e8 8b 4b 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a8 fe ff ff e9 a9 fe ff ff c6 05 09 8d d8 0d 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 101.148523][ T5328] RSP: 0018:ffffc9000de678a0 EFLAGS: 00010246 [ 101.151532][ T5328] RAX: ffffc9000de67800 RBX: 0000000000000016 RCX: 0000000000000000 [ 101.155482][ T5328] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000de67908 [ 101.159482][ T5328] RBP: ffffc9000de67988 R08: ffffc9000de67907 R09: 0000000000000000 [ 101.163720][ T5328] R10: ffffc9000de678e0 R11: fffff52001bccf21 R12: 0000000000000000 [ 101.167352][ T5328] R13: 1ffff92001bccf18 R14: 0000000000040cc0 R15: dffffc0000000000 [ 101.170885][ T5328] FS: 00007fd73daa56c0(0000) GS:ffff88808ca49000(0000) knlGS:0000000000000000 [ 101.176095][ T5328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 101.179353][ T5328] CR2: 00007fd73ce04120 CR3: 000000001cdab000 CR4: 0000000000352ef0 [ 101.182575][ T5328] Call Trace: [ 101.184229][ T5328] [ 101.185598][ T5328] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 101.188560][ T5328] ? __pfx_policy_nodemask+0x10/0x10 [ 101.191403][ T5328] ? kasan_save_track+0x4f/0x80 [ 101.193720][ T5328] ? kasan_save_track+0x3e/0x80 [ 101.196375][ T5328] ? kasan_save_free_info+0x46/0x50 [ 101.198836][ T5328] ? kfree+0x1c1/0x630 [ 101.201183][ T5328] ? tomoyo_path_number_perm+0x501/0x630 [ 101.204622][ T5328] ? security_file_ioctl+0xc3/0x2a0 [ 101.207055][ T5328] alloc_pages_mpol+0x232/0x4a0 [ 101.209455][ T5328] ___kmalloc_large_node+0x4e/0x150 [ 101.211841][ T5328] __kmalloc_large_node_noprof+0x18/0x90 [ 101.214917][ T5328] __kmalloc_noprof+0x3e8/0x760 [ 101.217601][ T5328] ? drm_syncobj_array_find+0x3a/0x440 [ 101.220460][ T5328] drm_syncobj_array_find+0x3a/0x440 [ 101.222960][ T5328] ? __lock_acquire+0x6b5/0x2cf0 [ 101.225664][ T5328] drm_syncobj_query_ioctl+0x1c3/0xb70 [ 101.228721][ T5328] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 101.232375][ T5328] drm_ioctl_kernel+0x2df/0x3b0 [ 101.235052][ T5328] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 101.239122][ T5328] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 101.241930][ T5328] drm_ioctl+0x6ba/0xb80 [ 101.245445][ T5328] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 101.248797][ T5328] ? __pfx_drm_ioctl+0x10/0x10 [ 101.251367][ T5328] ? __fget_files+0x2a/0x420 [ 101.253828][ T5328] ? bpf_lsm_file_ioctl+0x9/0x20 [ 101.256518][ T5328] ? __pfx_drm_ioctl+0x10/0x10 [ 101.258954][ T5328] __se_sys_ioctl+0xfc/0x170 [ 101.261715][ T5328] do_syscall_64+0x14d/0xf80 [ 101.264408][ T5328] ? trace_irq_disable+0x3b/0x150 [ 101.266732][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.269517][ T5328] ? clear_bhb_loop+0x40/0x90 [ 101.271930][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.275245][ T5328] RIP: 0033:0x7fd73cb9c819 [ 101.277493][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.286730][ T5328] RSP: 002b:00007fd73daa4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 101.290916][ T5328] RAX: ffffffffffffffda RBX: 00007fd73ce15fa0 RCX: 00007fd73cb9c819 [ 101.294696][ T5328] RDX: 00002000000004c0 RSI: 00000000c01864cb RDI: 0000000000000003 [ 101.298361][ T5328] RBP: 00007fd73cc32c91 R08: 0000000000000000 R09: 0000000000000000 [ 101.302730][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.306908][ T5328] R13: 00007fd73ce16038 R14: 00007fd73ce15fa0 R15: 00007ffce4975438 [ 101.310656][ T5328] [ 101.312100][ T5328] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 101.316336][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.320667][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.325078][ T5328] Call Trace: [ 101.326631][ T5328] [ 101.328038][ T5328] vpanic+0x56c/0xa60 [ 101.330196][ T5328] ? __pfx__printk+0x10/0x10 [ 101.333021][ T5328] ? __pfx_vpanic+0x10/0x10 [ 101.335659][ T5328] ? is_bpf_text_address+0x292/0x2b0 [ 101.338178][ T5328] ? is_bpf_text_address+0x26/0x2b0 [ 101.340530][ T5328] panic+0xc5/0xd0 [ 101.342273][ T5328] ? __pfx_panic+0x10/0x10 [ 101.344424][ T5328] __warn+0x315/0x4f0 [ 101.346313][ T5328] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 101.349391][ T5328] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 101.352573][ T5328] __report_bug+0x29a/0x540 [ 101.355044][ T5328] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 101.358045][ T5328] ? __pfx___report_bug+0x10/0x10 [ 101.360372][ T5328] ? is_bpf_text_address+0x26/0x2b0 [ 101.362794][ T5328] ? is_bpf_text_address+0x292/0x2b0 [ 101.365220][ T5328] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 101.368004][ T5328] report_bug+0x16a/0x220 [ 101.370035][ T5328] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 101.372751][ T5328] ? __alloc_frozen_pages_noprof+0x2d3/0x380 [ 101.375284][ T5328] handle_bug+0x9c/0x200 [ 101.377158][ T5328] exc_invalid_op+0x1a/0x50 [ 101.379422][ T5328] asm_exc_invalid_op+0x1a/0x20 [ 101.381735][ T5328] RIP: 0010:__alloc_frozen_pages_noprof+0x2d1/0x380 [ 101.385122][ T5328] Code: 74 10 4c 89 e7 89 54 24 0c e8 8b 4b 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a8 fe ff ff e9 a9 fe ff ff c6 05 09 8d d8 0d 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 101.393967][ T5328] RSP: 0018:ffffc9000de678a0 EFLAGS: 00010246 [ 101.397860][ T5328] RAX: ffffc9000de67800 RBX: 0000000000000016 RCX: 0000000000000000 [ 101.401743][ T5328] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000de67908 [ 101.405408][ T5328] RBP: ffffc9000de67988 R08: ffffc9000de67907 R09: 0000000000000000 [ 101.409360][ T5328] R10: ffffc9000de678e0 R11: fffff52001bccf21 R12: 0000000000000000 [ 101.413306][ T5328] R13: 1ffff92001bccf18 R14: 0000000000040cc0 R15: dffffc0000000000 [ 101.416992][ T5328] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 101.419960][ T5328] ? __pfx_policy_nodemask+0x10/0x10 [ 101.422750][ T5328] ? kasan_save_track+0x4f/0x80 [ 101.425411][ T5328] ? kasan_save_track+0x3e/0x80 [ 101.427707][ T5328] ? kasan_save_free_info+0x46/0x50 [ 101.430068][ T5328] ? kfree+0x1c1/0x630 [ 101.431967][ T5328] ? tomoyo_path_number_perm+0x501/0x630 [ 101.435029][ T5328] ? security_file_ioctl+0xc3/0x2a0 [ 101.437689][ T5328] alloc_pages_mpol+0x232/0x4a0 [ 101.440080][ T5328] ___kmalloc_large_node+0x4e/0x150 [ 101.442593][ T5328] __kmalloc_large_node_noprof+0x18/0x90 [ 101.445118][ T5328] __kmalloc_noprof+0x3e8/0x760 [ 101.447455][ T5328] ? drm_syncobj_array_find+0x3a/0x440 [ 101.450240][ T5328] drm_syncobj_array_find+0x3a/0x440 [ 101.452654][ T5328] ? __lock_acquire+0x6b5/0x2cf0 [ 101.454964][ T5328] drm_syncobj_query_ioctl+0x1c3/0xb70 [ 101.457604][ T5328] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 101.460393][ T5328] drm_ioctl_kernel+0x2df/0x3b0 [ 101.462806][ T5328] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 101.465786][ T5328] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 101.468278][ T5328] drm_ioctl+0x6ba/0xb80 [ 101.470204][ T5328] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 101.473325][ T5328] ? __pfx_drm_ioctl+0x10/0x10 [ 101.476144][ T5328] ? __fget_files+0x2a/0x420 [ 101.478664][ T5328] ? bpf_lsm_file_ioctl+0x9/0x20 [ 101.480892][ T5328] ? __pfx_drm_ioctl+0x10/0x10 [ 101.483085][ T5328] __se_sys_ioctl+0xfc/0x170 [ 101.485422][ T5328] do_syscall_64+0x14d/0xf80 [ 101.487967][ T5328] ? trace_irq_disable+0x3b/0x150 [ 101.490716][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.493535][ T5328] ? clear_bhb_loop+0x40/0x90 [ 101.495826][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.498597][ T5328] RIP: 0033:0x7fd73cb9c819 [ 101.500684][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.510083][ T5328] RSP: 002b:00007fd73daa4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 101.513884][ T5328] RAX: ffffffffffffffda RBX: 00007fd73ce15fa0 RCX: 00007fd73cb9c819 [ 101.518319][ T5328] RDX: 00002000000004c0 RSI: 00000000c01864cb RDI: 0000000000000003 [ 101.522237][ T5328] RBP: 00007fd73cc32c91 R08: 0000000000000000 R09: 0000000000000000 [ 101.525604][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.529037][ T5328] R13: 00007fd73ce16038 R14: 00007fd73ce15fa0 R15: 00007ffce4975438 [ 101.533127][ T5328] [ 101.535139][ T5328] Kernel Offset: disabled [ 101.537006][ T5328] Rebooting in 86400 seconds..