program: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) request_key(&(0x7f0000000180)='big_key\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000280)='syz\xe4\xf3(\x89\xcd\xf7\x044N\xa4{`\x1a:\x14m(\x9a\xf1\xb9\xb2\x87\xeev', 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r1, &(0x7f0000001580)={0x2020}, 0x2020) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0xfe, 0x7fff0006}]}) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa8203, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x20004, r2, 0x2}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000440)={0x0, 0x0, r4}) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCRTC(r5, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r5, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x3}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r4, 0xc01864b0, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x694, 0x80000000}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x59, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000280)={0x1, r6, 0xff, 0x7, 0xa, 0x1ff, 0x1}) (fail_nth: 15) [ 161.168947][ T5348] FAULT_INJECTION: forcing a failure. [ 161.168947][ T5348] name failslab, interval 1, probability 0, space 0, times 1 [ 161.187358][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 161.187380][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 161.187386][ T5348] Call Trace: [ 161.187391][ T5348] [ 161.187396][ T5348] dump_stack_lvl+0xe8/0x150 [ 161.187463][ T5348] should_fail_ex+0x40c/0x560 [ 161.187525][ T5348] should_failslab+0xa8/0x100 [ 161.187541][ T5348] __kmalloc_cache_node_noprof+0xaa/0x630 [ 161.187554][ T5348] ? __get_vm_area_node+0x136/0x300 [ 161.187568][ T5348] ? __get_vm_area_node+0x136/0x300 [ 161.187588][ T5348] __get_vm_area_node+0x136/0x300 [ 161.187606][ T5348] __vmalloc_node_range_noprof+0x358/0x1730 [ 161.187618][ T5348] ? system_heap_vmap+0x1b5/0x570 [ 161.187657][ T5348] ? rcu_is_watching+0x15/0xb0 [ 161.187675][ T5348] ? trace_contention_end+0x3d/0x140 [ 161.187696][ T5348] ? system_heap_vmap+0xaa/0x570 [ 161.187709][ T5348] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 161.187726][ T5348] ? system_heap_vmap+0x1b5/0x570 [ 161.187739][ T5348] vmalloc_noprof+0xb2/0xe0 [ 161.187750][ T5348] ? system_heap_vmap+0x1b5/0x570 [ 161.187771][ T5348] system_heap_vmap+0x1b5/0x570 [ 161.187784][ T5348] ? __pfx___mutex_trylock_common+0x10/0x10 [ 161.187798][ T5348] ? __pfx_system_heap_vmap+0x10/0x10 [ 161.187811][ T5348] ? trace_contention_end+0x3d/0x140 [ 161.187827][ T5348] ? __pfx_system_heap_vmap+0x10/0x10 [ 161.187860][ T5348] dma_buf_vmap+0x244/0x3c0 [ 161.187875][ T5348] ? __pfx_dma_buf_vmap+0x10/0x10 [ 161.187885][ T5348] ? drm_gem_vmap+0x4c/0x1d0 [ 161.187909][ T5348] drm_gem_shmem_vmap_locked+0x15c/0x7d0 [ 161.187927][ T5348] ? __pfx_drm_gem_shmem_vmap_locked+0x10/0x10 [ 161.187940][ T5348] ? drm_gem_vmap+0x25/0x1d0 [ 161.187959][ T5348] drm_gem_vmap+0x10a/0x1d0 [ 161.187976][ T5348] drm_gem_fb_vmap+0xa6/0x8e0 [ 161.187991][ T5348] drm_atomic_helper_prepare_planes+0x2de/0xb50 [ 161.188012][ T5348] drm_atomic_helper_commit+0x19d/0xb10 [ 161.188030][ T5348] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 161.188045][ T5348] drm_atomic_commit+0x24e/0x2b0 [ 161.188059][ T5348] ? __pfx_drm_atomic_commit+0x10/0x10 [ 161.188070][ T5348] ? drm_atomic_get_crtc_state+0x36c/0x570 [ 161.188080][ T5348] ? __pfx___drm_printfn_info+0x10/0x10 [ 161.188100][ T5348] ? drm_mode_object_get+0xcf/0x140 [ 161.188114][ T5348] ? drm_atomic_set_fb_for_plane+0x1f7/0x280 [ 161.188129][ T5348] drm_atomic_helper_update_plane+0x248/0x3b0 [ 161.188143][ T5348] drm_mode_cursor_common+0xe1a/0x15e0 [ 161.188171][ T5348] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 161.188181][ T5348] ? kasan_save_free_info+0x40/0x50 [ 161.188218][ T5348] ? __lock_acquire+0x683/0x2cf0 [ 161.188231][ T5348] ? drm_mode_cursor_ioctl+0xbb/0x130 [ 161.188245][ T5348] drm_mode_cursor_ioctl+0xd4/0x130 [ 161.188259][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.188273][ T5348] ? do_raw_spin_unlock+0x4d/0x210 [ 161.188286][ T5348] ? _raw_spin_unlock+0x28/0x50 [ 161.188338][ T5348] ? drm_is_current_master+0x19f/0x200 [ 161.188353][ T5348] drm_ioctl_kernel+0x2df/0x3b0 [ 161.188365][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.188376][ T5348] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 161.188393][ T5348] drm_ioctl+0x70e/0xba0 [ 161.188409][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.188420][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 161.188438][ T5348] ? __fget_files+0x2a/0x420 [ 161.188453][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20 [ 161.188465][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 161.188474][ T5348] __se_sys_ioctl+0xfc/0x170 [ 161.188490][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.188501][ T5348] do_syscall_64+0x174/0x580 [ 161.188516][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.188527][ T5348] ? clear_bhb_loop+0x40/0x90 [ 161.188540][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.188551][ T5348] RIP: 0033:0x7efc3ad9de99 [ 161.188563][ T5348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.188571][ T5348] RSP: 002b:00007efc3bc64fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 161.188584][ T5348] RAX: ffffffffffffffda RBX: 00007efc3b025fa0 RCX: 00007efc3ad9de99 [ 161.188591][ T5348] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000003 [ 161.188597][ T5348] RBP: 00007efc3bc65050 R08: 0000000000000000 R09: 0000000000000000 [ 161.188604][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 161.188610][ T5348] R13: 00007efc3b026038 R14: 00007efc3b025fa0 R15: 00007ffcecd1e548 [ 161.188626][ T5348] [ 161.188806][ T5348] syz.0.0: vmalloc error: size 264, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null) [ 161.379321][ T44] Bluetooth: hci0: command tx timeout [ 161.395074][ T5348] ,cpuset=/,mems_allowed=0-1 [ 161.398194][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 161.398209][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 161.398215][ T5348] Call Trace: [ 161.398219][ T5348] [ 161.398224][ T5348] dump_stack_lvl+0xe8/0x150 [ 161.398271][ T5348] warn_alloc+0x24c/0x270 [ 161.398285][ T5348] ? __kasan_kmalloc+0x22/0xb0 [ 161.398301][ T5348] ? __pfx_warn_alloc+0x10/0x10 [ 161.398318][ T5348] ? __get_vm_area_node+0x2af/0x300 [ 161.398339][ T5348] __vmalloc_node_range_noprof+0x37d/0x1730 [ 161.398352][ T5348] ? rcu_is_watching+0x15/0xb0 [ 161.398368][ T5348] ? trace_contention_end+0x3d/0x140 [ 161.398389][ T5348] ? system_heap_vmap+0xaa/0x570 [ 161.398405][ T5348] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 161.398421][ T5348] ? system_heap_vmap+0x1b5/0x570 [ 161.398433][ T5348] vmalloc_noprof+0xb2/0xe0 [ 161.398444][ T5348] ? system_heap_vmap+0x1b5/0x570 [ 161.398457][ T5348] system_heap_vmap+0x1b5/0x570 [ 161.398470][ T5348] ? __pfx___mutex_trylock_common+0x10/0x10 [ 161.398482][ T5348] ? __pfx_system_heap_vmap+0x10/0x10 [ 161.398494][ T5348] ? trace_contention_end+0x3d/0x140 [ 161.398509][ T5348] ? __pfx_system_heap_vmap+0x10/0x10 [ 161.398522][ T5348] dma_buf_vmap+0x244/0x3c0 [ 161.398537][ T5348] ? __pfx_dma_buf_vmap+0x10/0x10 [ 161.398548][ T5348] ? drm_gem_vmap+0x4c/0x1d0 [ 161.398566][ T5348] drm_gem_shmem_vmap_locked+0x15c/0x7d0 [ 161.398590][ T5348] ? __pfx_drm_gem_shmem_vmap_locked+0x10/0x10 [ 161.398598][ T5348] ? drm_gem_vmap+0x25/0x1d0 [ 161.398611][ T5348] drm_gem_vmap+0x10a/0x1d0 [ 161.398622][ T5348] drm_gem_fb_vmap+0xa6/0x8e0 [ 161.398631][ T5348] drm_atomic_helper_prepare_planes+0x2de/0xb50 [ 161.398651][ T5348] drm_atomic_helper_commit+0x19d/0xb10 [ 161.398667][ T5348] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 161.398681][ T5348] drm_atomic_commit+0x24e/0x2b0 [ 161.398697][ T5348] ? __pfx_drm_atomic_commit+0x10/0x10 [ 161.398707][ T5348] ? drm_atomic_get_crtc_state+0x36c/0x570 [ 161.398716][ T5348] ? __pfx___drm_printfn_info+0x10/0x10 [ 161.398737][ T5348] ? drm_mode_object_get+0xcf/0x140 [ 161.398752][ T5348] ? drm_atomic_set_fb_for_plane+0x1f7/0x280 [ 161.398767][ T5348] drm_atomic_helper_update_plane+0x248/0x3b0 [ 161.398781][ T5348] drm_mode_cursor_common+0xe1a/0x15e0 [ 161.398802][ T5348] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 161.398808][ T5348] ? kasan_save_free_info+0x40/0x50 [ 161.398832][ T5348] ? __lock_acquire+0x683/0x2cf0 [ 161.398840][ T5348] ? drm_mode_cursor_ioctl+0xbb/0x130 [ 161.398849][ T5348] drm_mode_cursor_ioctl+0xd4/0x130 [ 161.398858][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.398867][ T5348] ? do_raw_spin_unlock+0x4d/0x210 [ 161.398876][ T5348] ? _raw_spin_unlock+0x28/0x50 [ 161.398885][ T5348] ? drm_is_current_master+0x19f/0x200 [ 161.398894][ T5348] drm_ioctl_kernel+0x2df/0x3b0 [ 161.398902][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.398909][ T5348] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 161.398920][ T5348] drm_ioctl+0x70e/0xba0 [ 161.398933][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.398944][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 161.398963][ T5348] ? __fget_files+0x2a/0x420 [ 161.398979][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20 [ 161.398990][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 161.399000][ T5348] __se_sys_ioctl+0xfc/0x170 [ 161.399015][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.399027][ T5348] do_syscall_64+0x174/0x580 [ 161.399043][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.399054][ T5348] ? clear_bhb_loop+0x40/0x90 [ 161.399067][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.399078][ T5348] RIP: 0033:0x7efc3ad9de99 [ 161.399087][ T5348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.399093][ T5348] RSP: 002b:00007efc3bc64fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 161.399101][ T5348] RAX: ffffffffffffffda RBX: 00007efc3b025fa0 RCX: 00007efc3ad9de99 [ 161.399106][ T5348] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000003 [ 161.399111][ T5348] RBP: 00007efc3bc65050 R08: 0000000000000000 R09: 0000000000000000 [ 161.399115][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 161.399119][ T5348] R13: 00007efc3b026038 R14: 00007efc3b025fa0 R15: 00007ffcecd1e548 [ 161.399130][ T5348] [ 161.399180][ T5348] Mem-Info: [ 161.590703][ T5348] active_anon:2929 inactive_anon:56 isolated_anon:0 [ 161.590703][ T5348] active_file:95 inactive_file:39313 isolated_file:0 [ 161.590703][ T5348] unevictable:1768 dirty:17 writeback:0 [ 161.590703][ T5348] slab_reclaimable:6809 slab_unreclaimable:30620 [ 161.590703][ T5348] mapped:9896 shmem:2196 pagetables:649 [ 161.590703][ T5348] sec_pagetables:291 bounce:0 [ 161.590703][ T5348] kernel_misc_reclaimable:0 [ 161.590703][ T5348] free:33940 free_pcp:1027 free_cma:0 [ 161.636243][ T5348] Node 0 active_anon:524kB inactive_anon:32kB active_file:368kB inactive_file:104kB unevictable:0kB isolated(anon):0kB isolated(file):12kB mapped:472kB dirty:8kB writeback:0kB shmem:48kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:2400kB pagetables:784kB sec_pagetables:1060kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 161.656576][ T5348] Node 1 active_anon:11372kB inactive_anon:12kB active_file:0kB inactive_file:157148kB unevictable:7072kB isolated(anon):0kB isolated(file):0kB mapped:39100kB dirty:60kB writeback:0kB shmem:8736kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7232kB pagetables:1812kB sec_pagetables:104kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 161.670010][ T5348] Node 0 DMA free:1264kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:552kB local_pcp:552kB free_cma:0kB [ 161.682567][ T5348] lowmem_reserve[]: 0 109 109 109 109 [ 161.685082][ T5348] Node 0 DMA32 free:4640kB boost:0kB min:4132kB low:5164kB high:6196kB reserved_highatomic:0KB free_highatomic:0KB active_anon:524kB inactive_anon:8kB active_file:380kB inactive_file:104kB unevictable:0kB writepending:8kB zspages:0kB present:770052kB managed:111992kB mlocked:0kB bounce:0kB free_pcp:1036kB local_pcp:1036kB free_cma:0kB [ 161.701392][ T5348] lowmem_reserve[]: 0 0 0 0 0 [ 161.703573][ T5348] Node 1 DMA32 free:128928kB boost:0kB min:34304kB low:42880kB high:51456kB reserved_highatomic:0KB free_highatomic:0KB active_anon:11372kB inactive_anon:12kB active_file:0kB inactive_file:157148kB unevictable:7072kB writepending:60kB zspages:1368kB present:786288kB managed:690812kB mlocked:0kB bounce:0kB free_pcp:3356kB local_pcp:3356kB free_cma:0kB [ 161.717781][ T5348] lowmem_reserve[]: 0 0 0 0 0 [ 161.719910][ T5348] Node 0 DMA: 4*4kB (U) 4*8kB (U) 2*16kB (U) 1*32kB (E) 2*64kB (U) 2*128kB (UE) 1*256kB (E) 1*512kB (E) 0*1024kB 0*2048kB 0*4096kB = 1264kB [ 161.726484][ T5348] Node 0 DMA32: 120*4kB (UME) 66*8kB (UME) 35*16kB (UM) 18*32kB (UME) 5*64kB (UME) 3*128kB (UM) 3*256kB (M) 2*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 4640kB [ 161.733374][ T5348] Node 1 DMA32: 2*4kB (ME) 3*8kB (UME) 2*16kB (ME) 1*32kB (M) 1*64kB (E) 0*128kB 1*256kB (M) 1*512kB (M) 1*1024kB (U) 2*2048kB (ME) 30*4096kB (M) = 128928kB [ 161.740531][ T5348] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 161.744606][ T5348] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 161.749300][ T5348] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 161.753940][ T5348] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 161.757778][ T5348] 41616 total pagecache pages [ 161.759600][ T5348] 12 pages in swap cache [ 161.761226][ T5348] Free swap = 123924kB [ 161.762860][ T5348] Total swap = 124996kB [ 161.764692][ T5348] 393083 pages RAM [ 161.767270][ T5348] 0 pages HighMem/MovableOnly [ 161.769433][ T5348] 188542 pages reserved [ 161.771096][ T5348] 0 pages cma reserved [ 161.772754][ T5348] ------------[ cut here ]------------ [ 161.775425][ T5348] ret [ 161.775432][ T5348] WARNING: drivers/dma-buf/dma-buf.c:1653 at dma_buf_vmap+0x30f/0x3c0, CPU#0: syz.0.0/5348 [ 161.780359][ T5348] Modules linked in: [ 161.782972][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 161.786898][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 161.790939][ T5348] RIP: 0010:dma_buf_vmap+0x30f/0x3c0 [ 161.793160][ T5348] Code: 8a 05 cc e8 b3 50 7c fb 90 0f 0b 90 b8 ea ff ff ff eb b4 e8 a3 50 7c fb 90 0f 0b 90 e9 11 fe ff ff e8 95 50 7c fb 44 89 f0 90 <0f> 0b 90 49 bc 00 00 00 00 00 fc ff df eb 8e e8 9d a2 87 05 48 c7 [ 161.801184][ T5348] RSP: 0018:ffffc9000e1173a0 EFLAGS: 00010293 [ 161.803720][ T5348] RAX: 00000000fffffff4 RBX: 1ffff92001c22e78 RCX: ffff8880367e0000 [ 161.807594][ T5348] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 161.811125][ T5348] RBP: ffffc9000e117450 R08: ffffc9000e117227 R09: 1ffff92001c22e44 [ 161.814454][ T5348] R10: dffffc0000000000 R11: fffff52001c22e45 R12: 1ffff110035a1a05 [ 161.817737][ T5348] R13: ffffffff864bc780 R14: 00000000fffffff4 R15: ffff88801ad0d030 [ 161.820897][ T5348] FS: 00007efc3bc656c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 161.824577][ T5348] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 161.827325][ T5348] CR2: 00007fbfd71713a0 CR3: 00000000442ed000 CR4: 0000000000352ef0 [ 161.831747][ T5348] Call Trace: [ 161.833258][ T5348] [ 161.834692][ T5348] ? __pfx_dma_buf_vmap+0x10/0x10 [ 161.837512][ T5348] ? drm_gem_vmap+0x4c/0x1d0 [ 161.839499][ T5348] drm_gem_shmem_vmap_locked+0x15c/0x7d0 [ 161.842079][ T5348] ? __pfx_drm_gem_shmem_vmap_locked+0x10/0x10 [ 161.844719][ T5348] ? drm_gem_vmap+0x25/0x1d0 [ 161.849021][ T5348] drm_gem_vmap+0x10a/0x1d0 [ 161.850852][ T5348] drm_gem_fb_vmap+0xa6/0x8e0 [ 161.852659][ T5348] drm_atomic_helper_prepare_planes+0x2de/0xb50 [ 161.855109][ T5348] drm_atomic_helper_commit+0x19d/0xb10 [ 161.857898][ T5348] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 161.860568][ T5348] drm_atomic_commit+0x24e/0x2b0 [ 161.862564][ T5348] ? __pfx_drm_atomic_commit+0x10/0x10 [ 161.864840][ T5348] ? drm_atomic_get_crtc_state+0x36c/0x570 [ 161.867386][ T5348] ? __pfx___drm_printfn_info+0x10/0x10 [ 161.869809][ T5348] ? drm_mode_object_get+0xcf/0x140 [ 161.872210][ T5348] ? drm_atomic_set_fb_for_plane+0x1f7/0x280 [ 161.874702][ T5348] drm_atomic_helper_update_plane+0x248/0x3b0 [ 161.877406][ T5348] drm_mode_cursor_common+0xe1a/0x15e0 [ 161.879876][ T5348] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 161.882646][ T5348] ? kasan_save_free_info+0x40/0x50 [ 161.885075][ T5348] ? __lock_acquire+0x683/0x2cf0 [ 161.887555][ T5348] ? drm_mode_cursor_ioctl+0xbb/0x130 [ 161.889965][ T5348] drm_mode_cursor_ioctl+0xd4/0x130 [ 161.892164][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.894639][ T5348] ? do_raw_spin_unlock+0x4d/0x210 [ 161.896868][ T5348] ? _raw_spin_unlock+0x28/0x50 [ 161.898992][ T5348] ? drm_is_current_master+0x19f/0x200 [ 161.901360][ T5348] drm_ioctl_kernel+0x2df/0x3b0 [ 161.903486][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.906137][ T5348] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 161.908419][ T5348] drm_ioctl+0x70e/0xba0 [ 161.910135][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 161.912524][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 161.914576][ T5348] ? __fget_files+0x2a/0x420 [ 161.916411][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20 [ 161.918397][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 161.920446][ T5348] __se_sys_ioctl+0xfc/0x170 [ 161.922355][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.924964][ T5348] do_syscall_64+0x174/0x580 [ 161.927562][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.930222][ T5348] ? clear_bhb_loop+0x40/0x90 [ 161.932247][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.934754][ T5348] RIP: 0033:0x7efc3ad9de99 [ 161.936836][ T5348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.945033][ T5348] RSP: 002b:00007efc3bc64fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 161.948619][ T5348] RAX: ffffffffffffffda RBX: 00007efc3b025fa0 RCX: 00007efc3ad9de99 [ 161.951735][ T5348] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000003 [ 161.954821][ T5348] RBP: 00007efc3bc65050 R08: 0000000000000000 R09: 0000000000000000 [ 161.958350][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 161.961671][ T5348] R13: 00007efc3b026038 R14: 00007efc3b025fa0 R15: 00007ffcecd1e548 [ 161.964904][ T5348] [ 161.966245][ T5348] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 161.968929][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 161.972605][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 161.976686][ T5348] Call Trace: [ 161.978060][ T5348] [ 161.979288][ T5348] vpanic+0x56c/0xa60 [ 161.981017][ T5348] ? __pfx__printk+0x10/0x10 [ 161.982923][ T5348] ? __pfx_vpanic+0x10/0x10 [ 161.984785][ T5348] ? is_bpf_text_address+0x292/0x2b0 [ 161.986835][ T5348] ? is_bpf_text_address+0x26/0x2b0 [ 161.988976][ T5348] panic+0xc5/0xd0 [ 161.990384][ T5348] ? __pfx_panic+0x10/0x10 [ 161.992332][ T5348] __warn+0x315/0x4c0 [ 161.994034][ T5348] ? dma_buf_vmap+0x30f/0x3c0 [ 161.996113][ T5348] ? dma_buf_vmap+0x30f/0x3c0 [ 161.998169][ T5348] __report_bug+0x276/0x570 [ 162.000167][ T5348] ? dma_buf_vmap+0x30f/0x3c0 [ 162.002129][ T5348] ? __pfx___report_bug+0x10/0x10 [ 162.004317][ T5348] ? __mutex_unlock_slowpath+0x731/0x900 [ 162.006534][ T5348] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 162.008851][ T5348] ? system_heap_vmap+0x1b5/0x570 [ 162.010769][ T5348] ? dma_buf_vmap+0x30f/0x3c0 [ 162.012565][ T5348] report_bug+0x16a/0x220 [ 162.014328][ T5348] ? dma_buf_vmap+0x30f/0x3c0 [ 162.016230][ T5348] ? dma_buf_vmap+0x311/0x3c0 [ 162.018126][ T5348] handle_bug+0x9c/0x200 [ 162.019873][ T5348] exc_invalid_op+0x1a/0x50 [ 162.021764][ T5348] asm_exc_invalid_op+0x1a/0x20 [ 162.023721][ T5348] RIP: 0010:dma_buf_vmap+0x30f/0x3c0 [ 162.025935][ T5348] Code: 8a 05 cc e8 b3 50 7c fb 90 0f 0b 90 b8 ea ff ff ff eb b4 e8 a3 50 7c fb 90 0f 0b 90 e9 11 fe ff ff e8 95 50 7c fb 44 89 f0 90 <0f> 0b 90 49 bc 00 00 00 00 00 fc ff df eb 8e e8 9d a2 87 05 48 c7 [ 162.033561][ T5348] RSP: 0018:ffffc9000e1173a0 EFLAGS: 00010293 [ 162.036040][ T5348] RAX: 00000000fffffff4 RBX: 1ffff92001c22e78 RCX: ffff8880367e0000 [ 162.039279][ T5348] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 162.042540][ T5348] RBP: ffffc9000e117450 R08: ffffc9000e117227 R09: 1ffff92001c22e44 [ 162.045700][ T5348] R10: dffffc0000000000 R11: fffff52001c22e45 R12: 1ffff110035a1a05 [ 162.048870][ T5348] R13: ffffffff864bc780 R14: 00000000fffffff4 R15: ffff88801ad0d030 [ 162.052091][ T5348] ? __pfx_system_heap_vmap+0x10/0x10 [ 162.054191][ T5348] ? __pfx_dma_buf_vmap+0x10/0x10 [ 162.056266][ T5348] ? drm_gem_vmap+0x4c/0x1d0 [ 162.058276][ T5348] drm_gem_shmem_vmap_locked+0x15c/0x7d0 [ 162.060817][ T5348] ? __pfx_drm_gem_shmem_vmap_locked+0x10/0x10 [ 162.063371][ T5348] ? drm_gem_vmap+0x25/0x1d0 [ 162.065375][ T5348] drm_gem_vmap+0x10a/0x1d0 [ 162.067318][ T5348] drm_gem_fb_vmap+0xa6/0x8e0 [ 162.069296][ T5348] drm_atomic_helper_prepare_planes+0x2de/0xb50 [ 162.071865][ T5348] drm_atomic_helper_commit+0x19d/0xb10 [ 162.074187][ T5348] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 162.076749][ T5348] drm_atomic_commit+0x24e/0x2b0 [ 162.078861][ T5348] ? __pfx_drm_atomic_commit+0x10/0x10 [ 162.081220][ T5348] ? drm_atomic_get_crtc_state+0x36c/0x570 [ 162.083926][ T5348] ? __pfx___drm_printfn_info+0x10/0x10 [ 162.086380][ T5348] ? drm_mode_object_get+0xcf/0x140 [ 162.088626][ T5348] ? drm_atomic_set_fb_for_plane+0x1f7/0x280 [ 162.091255][ T5348] drm_atomic_helper_update_plane+0x248/0x3b0 [ 162.093868][ T5348] drm_mode_cursor_common+0xe1a/0x15e0 [ 162.096239][ T5348] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 162.098543][ T5348] ? kasan_save_free_info+0x40/0x50 [ 162.100712][ T5348] ? __lock_acquire+0x683/0x2cf0 [ 162.102717][ T5348] ? drm_mode_cursor_ioctl+0xbb/0x130 [ 162.104814][ T5348] drm_mode_cursor_ioctl+0xd4/0x130 [ 162.106820][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 162.108946][ T5348] ? do_raw_spin_unlock+0x4d/0x210 [ 162.111008][ T5348] ? _raw_spin_unlock+0x28/0x50 [ 162.112958][ T5348] ? drm_is_current_master+0x19f/0x200 [ 162.114916][ T5348] drm_ioctl_kernel+0x2df/0x3b0 [ 162.116713][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 162.119033][ T5348] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 162.121304][ T5348] drm_ioctl+0x70e/0xba0 [ 162.123070][ T5348] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 162.125430][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 162.127395][ T5348] ? __fget_files+0x2a/0x420 [ 162.129323][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20 [ 162.131433][ T5348] ? __pfx_drm_ioctl+0x10/0x10 [ 162.133426][ T5348] __se_sys_ioctl+0xfc/0x170 [ 162.135237][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.137620][ T5348] do_syscall_64+0x174/0x580 [ 162.139490][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.141895][ T5348] ? clear_bhb_loop+0x40/0x90 [ 162.143836][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.146229][ T5348] RIP: 0033:0x7efc3ad9de99 [ 162.148072][ T5348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 162.156028][ T5348] RSP: 002b:00007efc3bc64fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 162.159482][ T5348] RAX: ffffffffffffffda RBX: 00007efc3b025fa0 RCX: 00007efc3ad9de99 [ 162.162900][ T5348] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000003 [ 162.166137][ T5348] RBP: 00007efc3bc65050 R08: 0000000000000000 R09: 0000000000000000 [ 162.169130][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 162.172670][ T5348] R13: 00007efc3b026038 R14: 00007efc3b025fa0 R15: 00007ffcecd1e548 [ 162.176380][ T5348] [ 162.178274][ T5348] Kernel Offset: disabled [ 162.180363][ T5348] Rebooting in 86400 seconds..