program: mkdir(&(0x7f0000000280)='./sys\x00', 0x0) mount(0x0, &(0x7f00000002c0)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) r1 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) close(r1) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r3, &(0x7f0000000140)='6', 0x32) ioctl$FBIOPUT_VSCREENINFO(r2, 0x4601, &(0x7f0000000180)={0x400, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x1, 0x0, 0x7, 0x0, 0x5, 0x6, 0x0, 0x9, 0x10001, 0x0, 0xd, 0x16, 0x0, 0x0, 0x5}) r4 = syz_open_dev$dri(&(0x7f00000003c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000400)={0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000480)={0x0, 0x0, r5, 0x0, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0xfffffffe, "65366a50432b7ee2c7feddd91df868e7cfc6fa7272f3bf0a71b5d0c19323a260"}}) write(r0, &(0x7f0000000500)='1', 0x1) [ 86.007468][ T5278] Bluetooth: hci0: command tx timeout [ 86.146558][ T5329] FAULT_INJECTION: forcing a failure. [ 86.146558][ T5329] name failslab, interval 1, probability 0, space 0, times 1 [ 86.146609][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.146646][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.146654][ T5329] Call Trace: [ 86.146669][ T5329] [ 86.146709][ T5329] dump_stack_lvl+0xe8/0x150 [ 86.146839][ T5329] should_fail_ex+0x410/0x560 [ 86.146906][ T5329] should_failslab+0xa8/0x100 [ 86.146935][ T5329] __kmalloc_cache_noprof+0xa3/0x600 [ 86.146948][ T5329] ? drm_atomic_commit_alloc+0xa9/0x100 [ 86.146976][ T5329] ? drm_atomic_commit_alloc+0xa9/0x100 [ 86.147000][ T5329] drm_atomic_commit_alloc+0xa9/0x100 [ 86.147019][ T5329] drm_client_modeset_commit_atomic+0x122/0x7e0 [ 86.147035][ T5329] ? rcu_is_watching+0x16/0xb0 [ 86.147061][ T5329] ? trace_contention_end+0x3d/0x140 [ 86.147080][ T5329] ? __mutex_lock+0x30b/0x1550 [ 86.147148][ T5329] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 86.147179][ T5329] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 86.147193][ T5329] ? __pfx_fbcon_resize+0x10/0x10 [ 86.147214][ T5329] drm_client_modeset_commit_locked+0xcb/0x4d0 [ 86.147230][ T5329] drm_fb_helper_pan_display+0x3e9/0xbe0 [ 86.147257][ T5329] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 86.147272][ T5329] fb_pan_display+0x3a3/0x6a0 [ 86.147290][ T5329] bit_update_start+0x4c/0x1e0 [ 86.147308][ T5329] fbcon_modechanged+0xbfb/0x12e0 [ 86.147330][ T5329] fb_set_var_from_user+0x99/0xc0 [ 86.147345][ T5329] do_fb_ioctl+0x5d9/0x750 [ 86.147365][ T5329] ? __pfx_do_fb_ioctl+0x10/0x10 [ 86.147406][ T5329] ? __fget_files+0x2a/0x420 [ 86.147427][ T5329] ? __fget_files+0x3a2/0x420 [ 86.147442][ T5329] ? __fget_files+0x2a/0x420 [ 86.147459][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 86.147477][ T5329] ? __pfx_fb_ioctl+0x10/0x10 [ 86.147493][ T5329] __se_sys_ioctl+0xfc/0x170 [ 86.147508][ T5329] do_syscall_64+0x166/0x520 [ 86.147521][ T5329] ? trace_irq_disable+0x3b/0x140 [ 86.147534][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.147547][ T5329] ? clear_bhb_loop+0x70/0xc0 [ 86.147563][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.147574][ T5329] RIP: 0033:0x7fae88f9e559 [ 86.147602][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.147613][ T5329] RSP: 002b:00007fae89ef7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.147636][ T5329] RAX: ffffffffffffffda RBX: 00007fae89225fa0 RCX: 00007fae88f9e559 [ 86.147645][ T5329] RDX: 0000200000000180 RSI: 0000000000004601 RDI: 0000000000000004 [ 86.147653][ T5329] RBP: 00007fae890358b0 R08: 0000000000000000 R09: 0000000000000000 [ 86.147662][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.147670][ T5329] R13: 00007fae89226038 R14: 00007fae89225fa0 R15: 00007fff01502e78 [ 86.147692][ T5329] [ 86.437261][ T5329] Console: switching to colour dummy device 80x25 [ 86.901698][ T5328] ------------[ cut here ]------------ [ 86.901711][ T5328] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 86.901717][ T5328] WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e2/0x1550, CPU#0: syz.0.0/5328 [ 86.911676][ T5328] Modules linked in: [ 86.913594][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.917371][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.921703][ T5328] RIP: 0010:__mutex_lock+0x12e9/0x1550 [ 86.924091][ T5328] Code: c8 7a 91 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d 6b 76 8e 05 00 75 13 48 8d 3d 5e 73 91 05 48 c7 c6 a0 12 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f [ 86.933349][ T5328] RSP: 0018:ffffc9000e1dfae0 EFLAGS: 00010246 [ 86.935992][ T5328] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8880002f2580 [ 86.939339][ T5328] RDX: 0000000000000000 RSI: ffffffff8c0d12a0 RDI: ffffffff917dc580 [ 86.943645][ T5328] RBP: ffffc9000e1dfc80 R08: ffffffff917ac883 R09: 1ffffffff22f5910 [ 86.947706][ T5328] R10: dffffc0000000000 R11: fffffbfff22f5911 R12: ffff8880362f51c0 [ 86.951576][ T5328] R13: 0000000000000000 R14: 1ffff92001c3bf70 R15: 0000000000000000 [ 86.955591][ T5328] FS: 000055557621e540(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 86.959383][ T5328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.962278][ T5328] CR2: 00007fae891ef0b0 CR3: 0000000012eff000 CR4: 0000000000352ef0 [ 86.965797][ T5328] Call Trace: [ 86.967303][ T5328] [ 86.968714][ T5328] ? kfree+0x1c5/0x650 [ 86.970463][ T5328] ? drm_mode_rmfb+0x561/0x7a0 [ 86.972545][ T5328] ? drm_gem_fb_destroy+0x1c9/0x200 [ 86.974972][ T5328] ? virtio_gpu_free_object+0x90/0x1d0 [ 86.977367][ T5328] ? drm_mode_rmfb+0x561/0x7a0 [ 86.979412][ T5328] ? __pfx___mutex_lock+0x10/0x10 [ 86.981647][ T5328] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 86.984313][ T5328] virtio_gpu_free_object+0x90/0x1d0 [ 86.986741][ T5328] drm_client_buffer_delete+0x183/0x2d0 [ 86.989180][ T5328] drm_fbdev_shmem_fb_destroy+0xb5/0xe0 [ 86.991572][ T5328] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10 [ 86.994486][ T5328] fb_release+0x11d/0x140 [ 86.996284][ T5328] ? __pfx_fb_release+0x10/0x10 [ 86.998052][ T5328] __fput+0x40d/0xa50 [ 86.999842][ T5328] task_work_run+0x1d9/0x270 [ 87.001928][ T5328] ? __pfx_task_work_run+0x10/0x10 [ 87.004318][ T5328] exit_to_user_mode_loop+0x204/0x770 [ 87.006556][ T5328] ? rcu_is_watching+0x16/0xb0 [ 87.008535][ T5328] do_syscall_64+0x328/0x520 [ 87.010374][ T5328] ? trace_irq_disable+0x3b/0x140 [ 87.012437][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.014957][ T5328] ? clear_bhb_loop+0x70/0xc0 [ 87.017045][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.019635][ T5328] RIP: 0033:0x7fae88f9e559 [ 87.021644][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.033057][ T5328] RSP: 002b:00007fff01502fd8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 87.036983][ T5328] RAX: 0000000000000000 RBX: 00007fae89227da0 RCX: 00007fae88f9e559 [ 87.040426][ T5328] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 87.043995][ T5328] RBP: 00007fae89227da0 R08: 00007fae89226038 R09: 0000000000000000 [ 87.047500][ T5328] R10: 0000000000de5708 R11: 0000000000000246 R12: 00000000000152df [ 87.050988][ T5328] R13: 00007fae89225fac R14: 00000000000150f6 R15: 00007fff015030e0 [ 87.054574][ T5328] [ 87.055964][ T5328] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 87.059109][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.063063][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.067392][ T5328] Call Trace: [ 87.068886][ T5328] [ 87.070187][ T5328] vpanic+0x56d/0xa60 [ 87.071953][ T5328] ? __pfx__printk+0x10/0x10 [ 87.074001][ T5328] ? __pfx_vpanic+0x10/0x10 [ 87.075993][ T5328] ? is_bpf_text_address+0x292/0x2b0 [ 87.078312][ T5328] ? is_bpf_text_address+0x26/0x2b0 [ 87.080624][ T5328] panic+0xc5/0xd0 [ 87.082319][ T5328] ? __pfx_panic+0x10/0x10 [ 87.084516][ T5328] __warn+0x315/0x4c0 [ 87.086299][ T5328] ? __mutex_lock+0x12e2/0x1550 [ 87.088446][ T5328] ? __mutex_lock+0x12e2/0x1550 [ 87.090561][ T5328] __report_bug+0x276/0x570 [ 87.092511][ T5328] ? __mutex_lock+0x12e2/0x1550 [ 87.094523][ T5328] ? __pfx___report_bug+0x10/0x10 [ 87.096712][ T5328] ? drm_client_buffer_delete+0x113/0x2d0 [ 87.099128][ T5328] report_bug_entry+0x19b/0x290 [ 87.101314][ T5328] ? __mutex_lock+0x12e9/0x1550 [ 87.103463][ T5328] ? __mutex_lock+0x12ee/0x1550 [ 87.105612][ T5328] handle_bug+0xce/0x200 [ 87.107465][ T5328] exc_invalid_op+0x1a/0x50 [ 87.109475][ T5328] asm_exc_invalid_op+0x1a/0x20 [ 87.111671][ T5328] RIP: 0010:__mutex_lock+0x12e9/0x1550 [ 87.114119][ T5328] Code: c8 7a 91 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d 6b 76 8e 05 00 75 13 48 8d 3d 5e 73 91 05 48 c7 c6 a0 12 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f [ 87.122270][ T5328] RSP: 0018:ffffc9000e1dfae0 EFLAGS: 00010246 [ 87.124854][ T5328] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff8880002f2580 [ 87.128151][ T5328] RDX: 0000000000000000 RSI: ffffffff8c0d12a0 RDI: ffffffff917dc580 [ 87.131628][ T5328] RBP: ffffc9000e1dfc80 R08: ffffffff917ac883 R09: 1ffffffff22f5910 [ 87.135084][ T5328] R10: dffffc0000000000 R11: fffffbfff22f5911 R12: ffff8880362f51c0 [ 87.138558][ T5328] R13: 0000000000000000 R14: 1ffff92001c3bf70 R15: 0000000000000000 [ 87.142820][ T5328] ? kfree+0x1c5/0x650 [ 87.144965][ T5328] ? drm_mode_rmfb+0x561/0x7a0 [ 87.147086][ T5328] ? drm_gem_fb_destroy+0x1c9/0x200 [ 87.149336][ T5328] ? virtio_gpu_free_object+0x90/0x1d0 [ 87.151760][ T5328] ? drm_mode_rmfb+0x561/0x7a0 [ 87.154089][ T5328] ? __pfx___mutex_lock+0x10/0x10 [ 87.156346][ T5328] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 87.159031][ T5328] virtio_gpu_free_object+0x90/0x1d0 [ 87.161315][ T5328] drm_client_buffer_delete+0x183/0x2d0 [ 87.163844][ T5328] drm_fbdev_shmem_fb_destroy+0xb5/0xe0 [ 87.166441][ T5328] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10 [ 87.169085][ T5328] fb_release+0x11d/0x140 [ 87.170739][ T5328] ? __pfx_fb_release+0x10/0x10 [ 87.172952][ T5328] __fput+0x40d/0xa50 [ 87.174734][ T5328] task_work_run+0x1d9/0x270 [ 87.176806][ T5328] ? __pfx_task_work_run+0x10/0x10 [ 87.179032][ T5328] exit_to_user_mode_loop+0x204/0x770 [ 87.181540][ T5328] ? rcu_is_watching+0x16/0xb0 [ 87.183931][ T5328] do_syscall_64+0x328/0x520 [ 87.186108][ T5328] ? trace_irq_disable+0x3b/0x140 [ 87.188390][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.190997][ T5328] ? clear_bhb_loop+0x70/0xc0 [ 87.193032][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.195547][ T5328] RIP: 0033:0x7fae88f9e559 [ 87.197523][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.206231][ T5328] RSP: 002b:00007fff01502fd8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 87.210095][ T5328] RAX: 0000000000000000 RBX: 00007fae89227da0 RCX: 00007fae88f9e559 [ 87.213544][ T5328] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 87.216955][ T5328] RBP: 00007fae89227da0 R08: 00007fae89226038 R09: 0000000000000000 [ 87.220332][ T5328] R10: 0000000000de5708 R11: 0000000000000246 R12: 00000000000152df [ 87.223865][ T5328] R13: 00007fae89225fac R14: 00000000000150f6 R15: 00007fff015030e0 [ 87.227349][ T5328] [ 87.232210][ T5328] Kernel Offset: disabled [ 87.234147][ T5328] Rebooting in 86400 seconds..