program: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0700000004000000000900000500000028"], 0x50) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r1, 0xc01864cd, &(0x7f0000000100)={&(0x7f0000000240)=[r2, r2, r2], &(0x7f0000000140)=[0x800000000006, 0xf], 0x4000000000000285}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0xf, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000db6446b9e9ddba86842e68c33e2fbcb32e8a4cbcfbfd7cecea114776e18330613cd211c855f72573ad4df07370c57eeffaa35d9e02f43a90ce88ef88e96269179be9a74e8455e995f9b56b1ec97b5e20247dc8367e72968deefedc6ad89d266e913004329cfe9e797ffc8055dc63972a30dba0eec9d2dc5c93937e82bd0f4298bdc4cad6fac67393cef8b0d7676bb90fe23a0bc1b7e82fb6b99574c083d163e602b888e822ac67e23cf6af", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000005000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r3, r0}, 0xc) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x42402) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000580)=@urb_type_control={0x2, {}, 0xfffffffb, 0xa5, &(0x7f0000000300)={0x20, 0xc, 0x18, 0x400}, 0x8, 0x0, 0x1000004, 0x0, 0x1, 0xfffffffb, 0x0}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000440)={r0, &(0x7f0000000140), &(0x7f00000007c0)=""/235}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0700000004000000000900000500000028"], 0x50) (async) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r1, 0xc01864cd, &(0x7f0000000100)={&(0x7f0000000240)=[r2, r2, r2], &(0x7f0000000140)=[0x800000000006, 0xf], 0x4000000000000285}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0xf, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000db6446b9e9ddba86842e68c33e2fbcb32e8a4cbcfbfd7cecea114776e18330613cd211c855f72573ad4df07370c57eeffaa35d9e02f43a90ce88ef88e96269179be9a74e8455e995f9b56b1ec97b5e20247dc8367e72968deefedc6ad89d266e913004329cfe9e797ffc8055dc63972a30dba0eec9d2dc5c93937e82bd0f4298bdc4cad6fac67393cef8b0d7676bb90fe23a0bc1b7e82fb6b99574c083d163e602b888e822ac67e23cf6af", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000005000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r3, r0}, 0xc) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x42402) (async) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000580)=@urb_type_control={0x2, {}, 0xfffffffb, 0xa5, &(0x7f0000000300)={0x20, 0xc, 0x18, 0x400}, 0x8, 0x0, 0x1000004, 0x0, 0x1, 0xfffffffb, 0x0}) (async) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000440)={r0, &(0x7f0000000140), &(0x7f00000007c0)=""/235}, 0x20) (async) [ 94.855609][ T5278] Bluetooth: hci0: command tx timeout [ 95.044110][ T5319] usb usb8: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 95.044142][ T5319] vhci_hcd vhci_hcd.1: SetHubDepth req not supported for USB 2.0 roothub [ 95.093951][ T5327] ------------[ cut here ]------------ [ 95.093960][ T5327] 1 [ 95.093963][ T5327] WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0, CPU#0: syz.0.0/5327 [ 95.102618][ T5327] Modules linked in: [ 95.105245][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.109100][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.114428][ T5327] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.117203][ T5327] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 aa 9f 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 2c 11 54 0e 67 48 0f b9 3a e9 68 [ 95.124629][ T5327] RSP: 0018:ffffc9000f437920 EFLAGS: 00010246 [ 95.127232][ T5327] RAX: ffffc9000f437900 RBX: 1ffff92001e86f28 RCX: 0000000000000000 [ 95.130654][ T5327] RDX: 0000000000000000 RSI: 0000000000000014 RDI: ffffc9000f437988 [ 95.134045][ T5327] RBP: ffffc9000f437a10 R08: ffffc9000f437987 R09: 0000000000000000 [ 95.137426][ T5327] R10: ffffc9000f437960 R11: fffff52001e86f31 R12: 0000000000000000 [ 95.140853][ T5327] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000 [ 95.144265][ T5327] FS: 00007f664ad9e6c0(0000) GS:ffff88808c2c3000(0000) knlGS:0000000000000000 [ 95.148091][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.151095][ T5327] CR2: 00007f664ad9dfe8 CR3: 00000000121c9000 CR4: 0000000000352ef0 [ 95.154480][ T5327] Call Trace: [ 95.155955][ T5327] [ 95.157234][ T5327] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 95.159997][ T5327] ? __pfx_policy_nodemask+0x10/0x10 [ 95.162267][ T5327] alloc_pages_mpol+0x21e/0x390 [ 95.164311][ T5327] ? drm_syncobj_array_find+0x3a/0x440 [ 95.166658][ T5327] ___kmalloc_large_node+0x4f/0x120 [ 95.168831][ T5327] __kmalloc_large_node_noprof+0x18/0x90 [ 95.171355][ T5327] __kmalloc_noprof+0x3fb/0x720 [ 95.173354][ T5327] ? drm_syncobj_array_find+0x3a/0x440 [ 95.175756][ T5327] ? lock_acquire+0x115/0x350 [ 95.177781][ T5327] drm_syncobj_array_find+0x3a/0x440 [ 95.180137][ T5327] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 95.182893][ T5327] drm_ioctl_kernel+0x2df/0x3b0 [ 95.185071][ T5327] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 95.188142][ T5327] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 95.190523][ T5327] drm_ioctl+0x70e/0xba0 [ 95.192338][ T5327] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 95.195189][ T5327] ? __pfx_drm_ioctl+0x10/0x10 [ 95.197547][ T5327] ? __fget_files+0x2a/0x420 [ 95.199937][ T5327] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.202011][ T5327] ? __pfx_drm_ioctl+0x10/0x10 [ 95.203967][ T5327] __se_sys_ioctl+0xfc/0x170 [ 95.205875][ T5327] do_syscall_64+0x166/0x520 [ 95.208053][ T5327] ? trace_irq_disable+0x3b/0x140 [ 95.210328][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.212674][ T5327] ? clear_bhb_loop+0x70/0xc0 [ 95.214498][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.216819][ T5327] RIP: 0033:0x7f6649f9e159 [ 95.218720][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.226686][ T5327] RSP: 002b:00007f664ad9dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.230142][ T5327] RAX: ffffffffffffffda RBX: 00007f664a226270 RCX: 00007f6649f9e159 [ 95.233438][ T5327] RDX: 0000200000000100 RSI: 00000000c01864cd RDI: 0000000000000004 [ 95.236639][ T5327] RBP: 00007f664a03506b R08: 0000000000000000 R09: 0000000000000000 [ 95.240055][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.243190][ T5327] R13: 00007f664a226308 R14: 00007f664a226270 R15: 00007ffd66c16098 [ 95.246331][ T5327] [ 95.247641][ T5327] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.250594][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.254273][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.258563][ T5327] Call Trace: [ 95.260047][ T5327] [ 95.261226][ T5327] vpanic+0x56d/0xa60 [ 95.262999][ T5327] ? __pfx__printk+0x10/0x10 [ 95.265017][ T5327] ? __pfx_vpanic+0x10/0x10 [ 95.267017][ T5327] ? is_bpf_text_address+0x292/0x2b0 [ 95.269334][ T5327] ? is_bpf_text_address+0x26/0x2b0 [ 95.271570][ T5327] panic+0xc5/0xd0 [ 95.273150][ T5327] ? __pfx_panic+0x10/0x10 [ 95.275021][ T5327] __warn+0x315/0x4c0 [ 95.276734][ T5327] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.279223][ T5327] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.281729][ T5327] __report_bug+0x276/0x570 [ 95.283766][ T5327] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.286391][ T5327] ? __pfx___report_bug+0x10/0x10 [ 95.288642][ T5327] ? is_bpf_text_address+0x292/0x2b0 [ 95.291005][ T5327] ? is_bpf_text_address+0x26/0x2b0 [ 95.293290][ T5327] ? kernel_text_address+0xa5/0xe0 [ 95.295607][ T5327] ? __kernel_text_address+0xd/0x30 [ 95.297906][ T5327] ? unwind_get_return_address+0x4d/0x90 [ 95.300307][ T5327] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.302932][ T5327] report_bug+0x16b/0x220 [ 95.304834][ T5327] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.307395][ T5327] ? __alloc_frozen_pages_noprof+0x427/0x5a0 [ 95.309901][ T5327] handle_bug+0x9c/0x200 [ 95.311755][ T5327] exc_invalid_op+0x1a/0x50 [ 95.313738][ T5327] asm_exc_invalid_op+0x1a/0x20 [ 95.315753][ T5327] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.318514][ T5327] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 aa 9f 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 2c 11 54 0e 67 48 0f b9 3a e9 68 [ 95.326728][ T5327] RSP: 0018:ffffc9000f437920 EFLAGS: 00010246 [ 95.329407][ T5327] RAX: ffffc9000f437900 RBX: 1ffff92001e86f28 RCX: 0000000000000000 [ 95.332828][ T5327] RDX: 0000000000000000 RSI: 0000000000000014 RDI: ffffc9000f437988 [ 95.336319][ T5327] RBP: ffffc9000f437a10 R08: ffffc9000f437987 R09: 0000000000000000 [ 95.339814][ T5327] R10: ffffc9000f437960 R11: fffff52001e86f31 R12: 0000000000000000 [ 95.343216][ T5327] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000 [ 95.346591][ T5327] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 95.349380][ T5327] ? __pfx_policy_nodemask+0x10/0x10 [ 95.351712][ T5327] alloc_pages_mpol+0x21e/0x390 [ 95.353817][ T5327] ? drm_syncobj_array_find+0x3a/0x440 [ 95.356208][ T5327] ___kmalloc_large_node+0x4f/0x120 [ 95.358578][ T5327] __kmalloc_large_node_noprof+0x18/0x90 [ 95.361103][ T5327] __kmalloc_noprof+0x3fb/0x720 [ 95.363128][ T5327] ? drm_syncobj_array_find+0x3a/0x440 [ 95.365530][ T5327] ? lock_acquire+0x115/0x350 [ 95.367520][ T5327] drm_syncobj_array_find+0x3a/0x440 [ 95.369786][ T5327] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 95.372593][ T5327] drm_ioctl_kernel+0x2df/0x3b0 [ 95.374827][ T5327] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 95.377797][ T5327] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 95.380171][ T5327] drm_ioctl+0x70e/0xba0 [ 95.382068][ T5327] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 95.385120][ T5327] ? __pfx_drm_ioctl+0x10/0x10 [ 95.387284][ T5327] ? __fget_files+0x2a/0x420 [ 95.389310][ T5327] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.391558][ T5327] ? __pfx_drm_ioctl+0x10/0x10 [ 95.393677][ T5327] __se_sys_ioctl+0xfc/0x170 [ 95.395791][ T5327] do_syscall_64+0x166/0x520 [ 95.397819][ T5327] ? trace_irq_disable+0x3b/0x140 [ 95.399972][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.402458][ T5327] ? clear_bhb_loop+0x70/0xc0 [ 95.404476][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.407017][ T5327] RIP: 0033:0x7f6649f9e159 [ 95.409016][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.416659][ T5327] RSP: 002b:00007f664ad9dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.420068][ T5327] RAX: ffffffffffffffda RBX: 00007f664a226270 RCX: 00007f6649f9e159 [ 95.423217][ T5327] RDX: 0000200000000100 RSI: 00000000c01864cd RDI: 0000000000000004 [ 95.426559][ T5327] RBP: 00007f664a03506b R08: 0000000000000000 R09: 0000000000000000 [ 95.429976][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.433362][ T5327] R13: 00007f664a226308 R14: 00007f664a226270 R15: 00007ffd66c16098 [ 95.436743][ T5327] [ 95.438568][ T5327] Kernel Offset: disabled [ 95.440593][ T5327] Rebooting in 86400 seconds..