program:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000400)={0x2, {{0x2, 0x4e21, @multicast1}}, {{0x2, 0x4e1f, @dev={0xac, 0x14, 0x14, 0x43}}}}, 0x108)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='ext4\x00', 0x0, 0x0)
add_key$keyring(&(0x7f00000001c0), 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x84102, 0x12b)
write(r1, &(0x7f0000000140)='6', 0x1)
ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r1, 0x8008f513, &(0x7f0000000180))
setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, 0x0, 0x0)
ioctl$DRM_IOCTL_PANTHOR_GROUP_CREATE(r1, 0xc0386447, &(0x7f0000000240)={{0x8, 0x2, &(0x7f0000000200)=[{0x2, 0x0, 0x8}, {0xa, 0x0, 0xfffffff7}]}, 0x40, 0xc, 0x7, 0x1, 0x0, 0x6, 0x2, 0x7})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01864c2, &(0x7f0000000280)={0x0, 0x1, r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01864c2, &(0x7f00000002c0)={0x0, 0x1, r1})
r2 = syz_open_dev$dri(&(0x7f0000000300), 0x1ff, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000340))
ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000380), 0x0, 0x2122deee11ccb3e5, 0x1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01864c2, &(0x7f0000000540)={0x0, 0x1, r1})
sendmsg$RDMA_NLDEV_CMD_STAT_DEL(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="20000000121401"], 0x20}, 0x1, 0x0, 0x0, 0x24000045}, 0x44000)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000b40)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000b80)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32)
setsockopt$inet6_opts(r1, 0x29, 0x36, 0xffffffffffffffff, 0x8)
writev(0xffffffffffffffff, &(0x7f0000000c00)=[{&(0x7f0000000c40)="ee", 0x1}], 0x1)
writev(r3, &(0x7f0000000c80)=[{&(0x7f0000000cc0)='l', 0x1}], 0x1)
r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0)
write$sysctl(r4, &(0x7f0000000680)='1', 0x1)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0)
ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000700)={'syzkaller0\x00', 0x1001})
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000780)={'syzkaller1\x00', 0x1001})
socket$nl_route(0x10, 0x3, 0x0)
[ 78.530830][ T5326] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 78.616515][ T1373] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 79.008133][ T5298] Bluetooth: hci0: command tx timeout
[ 76.544309][ T1337] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.545254][ T1337] ieee802154 phy1 wpan1: encryption failed: -22
[ 76.669349][ T5340] ------------[ cut here ]------------
[ 76.669360][ T5340] 1
[ 76.669372][ T5340] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5340
[ 76.677243][ T5340] Modules linked in:
[ 76.680131][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 76.684047][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 76.688686][ T5340] RIP: 0010:___kmalloc_large_node+0x10c/0x170
[ 76.691459][ T5340] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 fc e1 0b 00 c6 05 82 0e 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89
[ 76.700126][ T5340] RSP: 0018:ffffc90007ed79e0 EFLAGS: 00010246
[ 76.702765][ T5340] RAX: 0000000000000000 RBX: 000000004732cf94 RCX: 0000000000100000
[ 76.706323][ T5340] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 000000004732cf94
[ 76.709920][ T5340] RBP: 0000000000000cc0 R08: ffffffff85a5b079 R09: 0000000000000000
[ 76.713325][ T5340] R10: dffffc0000000000 R11: ffffffff85aeecf0 R12: ffffc90007ed7db0
[ 76.716709][ T5340] R13: ffffffff85aec96a R14: 000000004732cf94 R15: 000000004732cf94
[ 76.720247][ T5340] FS: 00007f97d81f66c0(0000) GS:ffff88808a9f9000(0000) knlGS:0000000000000000
[ 76.724141][ T5340] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 76.727077][ T5340] CR2: 00007f97d7392540 CR3: 0000000044505000 CR4: 0000000000352ef0
[ 76.730802][ T5340] Call Trace:
[ 76.732340][ T5340]
[ 76.733571][ T5340] __kmalloc_large_node_noprof+0x18/0x90
[ 76.735836][ T5340] __kmalloc_noprof+0x3f6/0x710
[ 76.737977][ T5340] ? drm_syncobj_array_find+0x3a/0x440
[ 76.740367][ T5340] drm_syncobj_array_find+0x3a/0x440
[ 76.742554][ T5340] drm_syncobj_query_ioctl+0x1c3/0xae0
[ 76.745173][ T5340] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 76.747660][ T5340] drm_ioctl_kernel+0x2df/0x3b0
[ 76.750279][ T5340] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 76.752897][ T5340] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 76.755384][ T5340] ? __might_fault+0xaf/0x130
[ 76.757460][ T5340] drm_ioctl+0x70e/0xba0
[ 76.759475][ T5340] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 76.762110][ T5340] ? __pfx_drm_ioctl+0x10/0x10
[ 76.764195][ T5340] ? __fget_files+0x2a/0x420
[ 76.766294][ T5340] ? bpf_lsm_file_ioctl+0x9/0x20
[ 76.768632][ T5340] ? __pfx_drm_ioctl+0x10/0x10
[ 76.770893][ T5340] __se_sys_ioctl+0xfc/0x170
[ 76.772997][ T5340] do_syscall_64+0x16a/0x530
[ 76.775162][ T5340] ? trace_irq_disable+0x3b/0x140
[ 76.777427][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.780313][ T5340] ? clear_bhb_loop+0x70/0xc0
[ 76.782460][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.785091][ T5340] RIP: 0033:0x7f97d73a8f19
[ 76.787032][ T5340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 76.794906][ T5340] RSP: 002b:00007f97d81f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 76.798748][ T5340] RAX: ffffffffffffffda RBX: 00007f97d7625fa0 RCX: 00007f97d73a8f19
[ 76.802215][ T5340] RDX: 00002000000003c0 RSI: 00000000c01864cb RDI: 0000000000000004
[ 76.805570][ T5340] RBP: 00007f97d7437f6d R08: 0000000000000000 R09: 0000000000000000
[ 76.809088][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 76.812656][ T5340] R13: 00007f97d7626038 R14: 00007f97d7625fa0 R15: 00007fff1fc6daa8
[ 76.815934][ T5340]
[ 76.817324][ T5340] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 76.820446][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 76.824416][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 76.828805][ T5340] Call Trace:
[ 76.830337][ T5340]
[ 76.831773][ T5340] vpanic+0x26f/0x710
[ 76.833676][ T5340] panic+0xc5/0xd0
[ 76.835463][ T5340] ? __pfx_panic+0x10/0x10
[ 76.837442][ T5340] __warn+0x315/0x4c0
[ 76.839518][ T5340] ? ___kmalloc_large_node+0x10c/0x170
[ 76.842440][ T5340] ? ___kmalloc_large_node+0x10c/0x170
[ 76.845083][ T5340] __report_bug+0x276/0x570
[ 76.847093][ T5340] ? ___kmalloc_large_node+0x10c/0x170
[ 76.849477][ T5340] ? __pfx___report_bug+0x10/0x10
[ 76.851800][ T5340] ? arch_stack_walk+0xfb/0x150
[ 76.854053][ T5340] ? stack_trace_save+0xa9/0x100
[ 76.856240][ T5340] ? ___kmalloc_large_node+0x10c/0x170
[ 76.858447][ T5340] report_bug+0x16b/0x220
[ 76.860318][ T5340] ? ___kmalloc_large_node+0x10c/0x170
[ 76.862800][ T5340] ? ___kmalloc_large_node+0x10e/0x170
[ 76.865277][ T5340] handle_bug+0x9c/0x200
[ 76.867199][ T5340] exc_invalid_op+0x1a/0x50
[ 76.869273][ T5340] asm_exc_invalid_op+0x1a/0x20
[ 76.871476][ T5340] RIP: 0010:___kmalloc_large_node+0x10c/0x170
[ 76.874205][ T5340] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 fc e1 0b 00 c6 05 82 0e 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89
[ 76.882066][ T5340] RSP: 0018:ffffc90007ed79e0 EFLAGS: 00010246
[ 76.884689][ T5340] RAX: 0000000000000000 RBX: 000000004732cf94 RCX: 0000000000100000
[ 76.888019][ T5340] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 000000004732cf94
[ 76.891313][ T5340] RBP: 0000000000000cc0 R08: ffffffff85a5b079 R09: 0000000000000000
[ 76.894732][ T5340] R10: dffffc0000000000 R11: ffffffff85aeecf0 R12: ffffc90007ed7db0
[ 76.898132][ T5340] R13: ffffffff85aec96a R14: 000000004732cf94 R15: 000000004732cf94
[ 76.901460][ T5340] ? drm_syncobj_array_find+0x3a/0x440
[ 76.903912][ T5340] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 76.906476][ T5340] ? drm_dev_enter+0x49/0x150
[ 76.908456][ T5340] __kmalloc_large_node_noprof+0x18/0x90
[ 76.910914][ T5340] __kmalloc_noprof+0x3f6/0x710
[ 76.913080][ T5340] ? drm_syncobj_array_find+0x3a/0x440
[ 76.915455][ T5340] drm_syncobj_array_find+0x3a/0x440
[ 76.917821][ T5340] drm_syncobj_query_ioctl+0x1c3/0xae0
[ 76.920189][ T5340] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 76.922721][ T5340] drm_ioctl_kernel+0x2df/0x3b0
[ 76.924767][ T5340] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 76.927339][ T5340] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 76.929627][ T5340] ? __might_fault+0xaf/0x130
[ 76.931684][ T5340] drm_ioctl+0x70e/0xba0
[ 76.933665][ T5340] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 76.936323][ T5340] ? __pfx_drm_ioctl+0x10/0x10
[ 76.938432][ T5340] ? __fget_files+0x2a/0x420
[ 76.940429][ T5340] ? bpf_lsm_file_ioctl+0x9/0x20
[ 76.942623][ T5340] ? __pfx_drm_ioctl+0x10/0x10
[ 76.944590][ T5340] __se_sys_ioctl+0xfc/0x170
[ 76.946718][ T5340] do_syscall_64+0x16a/0x530
[ 76.948773][ T5340] ? trace_irq_disable+0x3b/0x140
[ 76.950963][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.953699][ T5340] ? clear_bhb_loop+0x70/0xc0
[ 76.955876][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.958437][ T5340] RIP: 0033:0x7f97d73a8f19
[ 76.960350][ T5340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 76.968464][ T5340] RSP: 002b:00007f97d81f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 76.972056][ T5340] RAX: ffffffffffffffda RBX: 00007f97d7625fa0 RCX: 00007f97d73a8f19
[ 76.975460][ T5340] RDX: 00002000000003c0 RSI: 00000000c01864cb RDI: 0000000000000004
[ 76.978860][ T5340] RBP: 00007f97d7437f6d R08: 0000000000000000 R09: 0000000000000000
[ 76.982228][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 76.985611][ T5340] R13: 00007f97d7626038 R14: 00007f97d7625fa0 R15: 00007fff1fc6daa8
[ 76.989000][ T5340]
[ 76.990799][ T5340] Kernel Offset: disabled
[ 76.992716][ T5340] Rebooting in 86400 seconds..