program: r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x103801) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000000)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r0, 0xc00864c0, &(0x7f00000001c0)={r1}) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x21081e, &(0x7f0000000280)={[{@grpquota}, {@nogrpid}, {@quota}]}, 0x1, 0x4fa, &(0x7f00000002c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") r2 = open(&(0x7f00000007c0)='.\x00', 0x8000, 0x50) fstat(r2, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r2, r3, 0xffffffffffffffff) r4 = open(&(0x7f0000000880)='.\x00', 0x8000, 0x50) fchown(r4, 0x0, 0xffffffffffffffff) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000100)={'ni_at_a2150\x00', [0x100, 0x7ffffffc, 0x2, 0xc, 0xe, 0x5, 0x4, 0x3, 0x80008, 0x0, 0x2, 0x1, 0x7, 0x1, 0x1, 0xfd, 0xfffffffb, 0x9, 0x4, 0x7fffffff, 0x89, 0x543, 0x0, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x7, 0xa6b5, 0x0, 0x10]}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc03064ca, &(0x7f0000000040)={&(0x7f00000008c0)=[r1], 0x0, 0x2, 0x3ffffeaf, 0x7}) [ 91.958598][ T48] Bluetooth: hci0: command tx timeout [ 92.080749][ T5312] loop0: detected capacity change from 0 to 512 [ 92.240126][ T5312] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 92.240322][ T5312] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 92.293378][ T5312] ------------[ cut here ]------------ [ 92.293390][ T5312] 1 [ 92.293394][ T5312] WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0, CPU#0: syz.0.0/5312 [ 92.302427][ T5312] Modules linked in: [ 92.304643][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 92.308543][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.312525][ T5312] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 [ 92.314851][ T5312] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 86 ac 37 0f 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 8c 20 53 0f 67 48 0f b9 3a e9 68 [ 92.322529][ T5312] RSP: 0018:ffffc9000fef7880 EFLAGS: 00010246 [ 92.325199][ T5312] RAX: ffffc9000fef7800 RBX: 1ffff92001fdef14 RCX: 0000000000000000 [ 92.329162][ T5312] RDX: 0000000000000000 RSI: 0000000000000014 RDI: ffffc9000fef78e8 [ 92.333219][ T5312] RBP: ffffc9000fef7978 R08: ffffc9000fef78e7 R09: 0000000000000000 [ 92.336899][ T5312] R10: ffffc9000fef78c0 R11: fffff52001fdef1d R12: 0000000000000000 [ 92.340314][ T5312] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000 [ 92.343734][ T5312] FS: 00007f5c642876c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 92.347707][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 92.350583][ T5312] CR2: 00007f5c635f56b8 CR3: 0000000012ff2000 CR4: 0000000000352ef0 [ 92.354190][ T5312] Call Trace: [ 92.355519][ T5312] [ 92.356968][ T5312] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 92.359710][ T5312] ? __pfx_policy_nodemask+0x10/0x10 [ 92.361936][ T5312] ? kasan_save_track+0x4f/0x80 [ 92.363641][ T5312] ? kasan_save_track+0x3e/0x80 [ 92.365712][ T5312] ? kasan_save_free_info+0x40/0x50 [ 92.368186][ T5312] ? __kasan_slab_free+0x5c/0x80 [ 92.370460][ T5312] ? kfree+0x1c5/0x650 [ 92.372293][ T5312] alloc_pages_mpol+0x21e/0x390 [ 92.380823][ T5312] ? drm_syncobj_array_find+0x3a/0x440 [ 92.383567][ T5312] ___kmalloc_large_node+0x4f/0x120 [ 92.385957][ T5312] __kmalloc_large_node_noprof+0x18/0x90 [ 92.389930][ T5312] __kmalloc_noprof+0x3fb/0x720 [ 92.392208][ T5312] ? drm_syncobj_array_find+0x3a/0x440 [ 92.394634][ T5312] drm_syncobj_array_find+0x3a/0x440 [ 92.397092][ T5312] drm_syncobj_timeline_wait_ioctl+0x199/0x690 [ 92.399439][ T5312] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 92.402182][ T5312] drm_ioctl_kernel+0x2df/0x3b0 [ 92.404254][ T5312] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 92.407134][ T5312] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 92.409385][ T5312] drm_ioctl+0x70e/0xba0 [ 92.411167][ T5312] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 92.413982][ T5312] ? __pfx_drm_ioctl+0x10/0x10 [ 92.416046][ T5312] ? __fget_files+0x2a/0x420 [ 92.417907][ T5312] ? bpf_lsm_file_ioctl+0x9/0x20 [ 92.419785][ T5312] ? __pfx_drm_ioctl+0x10/0x10 [ 92.421794][ T5312] __se_sys_ioctl+0xfc/0x170 [ 92.423672][ T5312] do_syscall_64+0x166/0x520 [ 92.425551][ T5312] ? trace_irq_disable+0x3b/0x140 [ 92.427762][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.431652][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 92.433729][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.437271][ T5312] RIP: 0033:0x7f5c6339e1d9 [ 92.439298][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.447986][ T5312] RSP: 002b:00007f5c64286fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 92.451144][ T5312] RAX: ffffffffffffffda RBX: 00007f5c63625fa0 RCX: 00007f5c6339e1d9 [ 92.454752][ T5312] RDX: 0000200000000040 RSI: 00000000c03064ca RDI: 0000000000000003 [ 92.467155][ T5312] RBP: 00007f5c63435888 R08: 0000000000000000 R09: 0000000000000000 [ 92.470414][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.473653][ T5312] R13: 00007f5c63626038 R14: 00007f5c63625fa0 R15: 00007ffed042b708 [ 92.477302][ T5312] [ 92.480149][ T5312] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 92.483260][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 92.487120][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 92.491202][ T5312] Call Trace: [ 92.492544][ T5312] [ 92.493704][ T5312] vpanic+0x56d/0xa60 [ 92.495364][ T5312] ? __pfx__printk+0x10/0x10 [ 92.497395][ T5312] ? __pfx_vpanic+0x10/0x10 [ 92.499423][ T5312] ? is_bpf_text_address+0x292/0x2b0 [ 92.501740][ T5312] ? is_bpf_text_address+0x26/0x2b0 [ 92.504061][ T5312] panic+0xc5/0xd0 [ 92.505780][ T5312] ? __pfx_panic+0x10/0x10 [ 92.507717][ T5312] __warn+0x315/0x4c0 [ 92.509477][ T5312] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 92.511998][ T5312] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 92.514517][ T5312] __report_bug+0x276/0x570 [ 92.516504][ T5312] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 92.519119][ T5312] ? __pfx___report_bug+0x10/0x10 [ 92.521320][ T5312] ? lock_acquire+0x115/0x350 [ 92.523381][ T5312] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 92.526082][ T5312] report_bug+0x16b/0x220 [ 92.528021][ T5312] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 92.530386][ T5312] ? __alloc_frozen_pages_noprof+0x427/0x5a0 [ 92.532613][ T5312] handle_bug+0x9c/0x200 [ 92.534368][ T5312] exc_invalid_op+0x1a/0x50 [ 92.536365][ T5312] asm_exc_invalid_op+0x1a/0x20 [ 92.538356][ T5312] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 [ 92.541066][ T5312] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 86 ac 37 0f 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 8c 20 53 0f 67 48 0f b9 3a e9 68 [ 92.549347][ T5312] RSP: 0018:ffffc9000fef7880 EFLAGS: 00010246 [ 92.552009][ T5312] RAX: ffffc9000fef7800 RBX: 1ffff92001fdef14 RCX: 0000000000000000 [ 92.555355][ T5312] RDX: 0000000000000000 RSI: 0000000000000014 RDI: ffffc9000fef78e8 [ 92.558598][ T5312] RBP: ffffc9000fef7978 R08: ffffc9000fef78e7 R09: 0000000000000000 [ 92.562021][ T5312] R10: ffffc9000fef78c0 R11: fffff52001fdef1d R12: 0000000000000000 [ 92.565446][ T5312] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000 [ 92.568809][ T5312] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 92.571541][ T5312] ? __pfx_policy_nodemask+0x10/0x10 [ 92.578660][ T5312] ? kasan_save_track+0x4f/0x80 [ 92.580904][ T5312] ? kasan_save_track+0x3e/0x80 [ 92.583038][ T5312] ? kasan_save_free_info+0x40/0x50 [ 92.585343][ T5312] ? __kasan_slab_free+0x5c/0x80 [ 92.587457][ T5312] ? kfree+0x1c5/0x650 [ 92.589221][ T5312] alloc_pages_mpol+0x21e/0x390 [ 92.591465][ T5312] ? drm_syncobj_array_find+0x3a/0x440 [ 92.593797][ T5312] ___kmalloc_large_node+0x4f/0x120 [ 92.595988][ T5312] __kmalloc_large_node_noprof+0x18/0x90 [ 92.598253][ T5312] __kmalloc_noprof+0x3fb/0x720 [ 92.600088][ T5312] ? drm_syncobj_array_find+0x3a/0x440 [ 92.602370][ T5312] drm_syncobj_array_find+0x3a/0x440 [ 92.604750][ T5312] drm_syncobj_timeline_wait_ioctl+0x199/0x690 [ 92.607339][ T5312] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 92.610258][ T5312] drm_ioctl_kernel+0x2df/0x3b0 [ 92.612381][ T5312] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 92.615210][ T5312] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 92.617581][ T5312] drm_ioctl+0x70e/0xba0 [ 92.619436][ T5312] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 92.622344][ T5312] ? __pfx_drm_ioctl+0x10/0x10 [ 92.624432][ T5312] ? __fget_files+0x2a/0x420 [ 92.626470][ T5312] ? bpf_lsm_file_ioctl+0x9/0x20 [ 92.628560][ T5312] ? __pfx_drm_ioctl+0x10/0x10 [ 92.630570][ T5312] __se_sys_ioctl+0xfc/0x170 [ 92.632579][ T5312] do_syscall_64+0x166/0x520 [ 92.634732][ T5312] ? trace_irq_disable+0x3b/0x140 [ 92.636835][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.639166][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 92.641123][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.643553][ T5312] RIP: 0033:0x7f5c6339e1d9 [ 92.645582][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.653850][ T5312] RSP: 002b:00007f5c64286fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 92.657333][ T5312] RAX: ffffffffffffffda RBX: 00007f5c63625fa0 RCX: 00007f5c6339e1d9 [ 92.660615][ T5312] RDX: 0000200000000040 RSI: 00000000c03064ca RDI: 0000000000000003 [ 92.664159][ T5312] RBP: 00007f5c63435888 R08: 0000000000000000 R09: 0000000000000000 [ 92.667484][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.670813][ T5312] R13: 00007f5c63626038 R14: 00007f5c63625fa0 R15: 00007ffed042b708 [ 92.674163][ T5312] [ 92.676013][ T5312] Kernel Offset: disabled [ 92.677814][ T5312] Rebooting in 86400 seconds..