------------[ cut here ]------------ [CRTC:35:crtc-0] vblank wait timed out WARNING: drivers/gpu/drm/drm_atomic_helper.c:1920 at drm_atomic_helper_wait_for_vblanks.part.0+0x738/0x8a0 drivers/gpu/drm/drm_atomic_helper.c:1920, CPU#3: syz.6.2505/15446 Modules linked in: CPU: 3 UID: 0 PID: 15446 Comm: syz.6.2505 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:drm_atomic_helper_wait_for_vblanks.part.0+0x73e/0x8a0 drivers/gpu/drm/drm_atomic_helper.c:1920 Code: 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 0f b6 04 01 84 c0 74 08 3c 03 0f 8e 44 01 00 00 48 8d 3d d8 f3 31 0b 8b b3 d8 00 00 00 <67> 48 0f b9 3a e9 e1 fc ff ff e8 53 e0 75 fc e9 7c fe ff ff e8 99 RSP: 0018:ffffc9000ea57798 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888044659318 RCX: 1ffff110088cb27e RDX: ffff888025506100 RSI: 0000000000000023 RDI: ffffffff90c26270 RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88804eb99f00 FS: 0000000000000000(0000) GS:ffff8880976e5000(0063) knlGS:0000000056d00480 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000562943c9a7b8 CR3: 000000005b802000 CR4: 0000000000352ef0 Call Trace: drm_atomic_helper_wait_for_vblanks drivers/gpu/drm/drm_atomic_helper.c:1894 [inline] drm_atomic_helper_commit_tail+0xff/0x130 drivers/gpu/drm/drm_atomic_helper.c:1996 commit_tail+0x338/0x430 drivers/gpu/drm/drm_atomic_helper.c:2073 drm_atomic_helper_commit+0x303/0x380 drivers/gpu/drm/drm_atomic_helper.c:2311 drm_atomic_commit+0x230/0x300 drivers/gpu/drm/drm_atomic.c:1743 drm_client_modeset_commit_atomic+0x6a6/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1103 drm_client_modeset_commit_locked+0x14d/0x580 drivers/gpu/drm/drm_client_modeset.c:1206 drm_client_modeset_commit+0x4f/0x80 drivers/gpu/drm/drm_client_modeset.c:1232 __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x137/0x160 drivers/gpu/drm/drm_fb_helper.c:235 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:223 [inline] drm_fb_helper_restore_fbdev_mode_unlocked+0x93/0xc0 drivers/gpu/drm/drm_fb_helper.c:266 drm_fbdev_client_restore+0x1b/0x30 drivers/gpu/drm/clients/drm_fbdev_client.c:45 drm_client_dev_restore+0x205/0x2a0 drivers/gpu/drm/drm_client_event.c:118 drm_lastclose drivers/gpu/drm/drm_file.c:408 [inline] drm_release+0x2c6/0x360 drivers/gpu/drm/drm_file.c:441 __fput+0x3ff/0xb40 fs/file_table.c:468 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x100/0x4b0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] __do_fast_syscall_32+0x4b6/0x660 arch/x86/entry/syscall_32.c:310 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf740d579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 RSP: 002b:00000000ff9c4a7c EFLAGS: 00000202 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 fc add %bh,%ah 4: ff lcall (bad) 5: df 48 89 fisttps -0x77(%rax) 8: f9 stc 9: 48 c1 e9 03 shr $0x3,%rcx d: 0f b6 04 01 movzbl (%rcx,%rax,1),%eax 11: 84 c0 test %al,%al 13: 74 08 je 0x1d 15: 3c 03 cmp $0x3,%al 17: 0f 8e 44 01 00 00 jle 0x161 1d: 48 8d 3d d8 f3 31 0b lea 0xb31f3d8(%rip),%rdi # 0xb31f3fc 24: 8b b3 d8 00 00 00 mov 0xd8(%rbx),%esi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: e9 e1 fc ff ff jmp 0xfffffd15 34: e8 53 e0 75 fc call 0xfc75e08c 39: e9 7c fe ff ff jmp 0xfffffeba 3e: e8 .byte 0xe8 3f: 99 cltd