program: r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./debug/failslab/task-filter\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./debug/failslab/probability\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='N', 0x1) write(r2, &(0x7f0000000440)='100', 0x3) lsetxattr$trusted_overlay_origin(0x0, &(0x7f0000000480), &(0x7f00000004c0), 0x2, 0x2) mount$9p_fd(0x0, 0x0, 0x0, 0x1000, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="5500000018007f5f00fe01b2a4a2809302060000fd41fd01020400000a00120002002800000019002d007fffffff0022de1330d54400009b84136ef75afb83de066a5900e1baac968300000000f2ff000001000000", 0x55}], 0x1, 0x0, 0x0, 0x7a000000}, 0x0) r6 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000500)={0x5c, r6, 0x405, 0x70bd27, 0x25dfdbfe, {}, [{{0x8, 0x1, r7}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000401}, 0x10048040) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r7, {}, {}, {0x8, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8000) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'virt_wifi0\x00', 0x2}) syz_usb_connect(0x0, 0x24, 0x0, 0x0) [ 104.151719][ T48] Bluetooth: hci0: command tx timeout [ 104.359988][ T5342] FAULT_INJECTION: forcing a failure. [ 104.359988][ T5342] name failslab, interval 1, probability 100, space 0, times 1 [ 104.360070][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.360085][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.360093][ T5342] Call Trace: [ 104.360098][ T5342] [ 104.360104][ T5342] dump_stack_lvl+0xe8/0x150 [ 104.360297][ T5342] should_fail_ex+0x410/0x560 [ 104.360377][ T5342] should_failslab+0xa8/0x100 [ 104.360418][ T5342] __kvmalloc_node_noprof+0x171/0x820 [ 104.360434][ T5342] ? vmemdup_user+0x2b/0xd0 [ 104.360485][ T5342] ? vmemdup_user+0x2b/0xd0 [ 104.360501][ T5342] vmemdup_user+0x2b/0xd0 [ 104.360519][ T5342] path_setxattrat+0x2d0/0x450 [ 104.360549][ T5342] ? __pfx_path_setxattrat+0x10/0x10 [ 104.360563][ T5342] ? do_futex+0x3e7/0x4e0 [ 104.360607][ T5342] ? rcu_is_watching+0x16/0xb0 [ 104.360637][ T5342] __x64_sys_lsetxattr+0xbf/0xe0 [ 104.360659][ T5342] do_syscall_64+0x166/0x520 [ 104.360739][ T5342] ? trace_irq_disable+0x3b/0x140 [ 104.360754][ T5342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.360777][ T5342] ? clear_bhb_loop+0x70/0xc0 [ 104.360791][ T5342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.360803][ T5342] RIP: 0033:0x7fc43a99f559 [ 104.360815][ T5342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.360824][ T5342] RSP: 002b:00007fc43b871fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 104.360839][ T5342] RAX: ffffffffffffffda RBX: 00007fc43ac25fa0 RCX: 00007fc43a99f559 [ 104.360848][ T5342] RDX: 00002000000004c0 RSI: 0000200000000480 RDI: 0000000000000000 [ 104.360857][ T5342] RBP: 00007fc43aa36b20 R08: 0000000000000002 R09: 0000000000000000 [ 104.360864][ T5342] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 104.360871][ T5342] R13: 00007fc43ac26038 R14: 00007fc43ac25fa0 R15: 00007ffd8f288fa8 [ 104.360892][ T5342] [ 104.360990][ T812] FAULT_INJECTION: forcing a failure. [ 104.360990][ T812] name failslab, interval 1, probability 100, space 0, times 1 [ 104.361006][ T812] CPU: 0 UID: 0 PID: 812 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 104.361019][ T812] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.361026][ T812] Workqueue: events drm_fb_helper_damage_work [ 104.361080][ T812] Call Trace: [ 104.361085][ T812] [ 104.361089][ T812] dump_stack_lvl+0xe8/0x150 [ 104.361108][ T812] should_fail_ex+0x410/0x560 [ 104.361126][ T812] should_failslab+0xa8/0x100 [ 104.361142][ T812] __kmalloc_cache_noprof+0x9e/0x600 [ 104.361154][ T812] ? drm_atomic_commit_alloc+0xa9/0x100 [ 104.361178][ T812] ? drm_atomic_commit_alloc+0xa9/0x100 [ 104.361199][ T812] drm_atomic_commit_alloc+0xa9/0x100 [ 104.361216][ T812] drm_atomic_helper_dirtyfb+0x129/0xfd0 [ 104.361235][ T812] ? __lock_acquire+0x747/0x2de0 [ 104.361253][ T812] ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10 [ 104.361279][ T812] ? do_raw_spin_lock+0x12b/0x2f0 [ 104.361297][ T812] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 104.361316][ T812] drm_fb_helper_damage_work+0x84c/0xf20 [ 104.361335][ T812] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 104.361360][ T812] ? lock_acquire+0x115/0x350 [ 104.361379][ T812] ? rcu_is_watching+0x16/0xb0 [ 104.361395][ T812] ? process_scheduled_works+0x97a/0x1630 [ 104.361413][ T812] process_scheduled_works+0xc3d/0x1630 [ 104.361447][ T812] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.361467][ T812] ? assign_work+0x3cf/0x5d0 [ 104.361486][ T812] worker_thread+0xa47/0xfb0 [ 104.361516][ T812] ? __kthread_parkme+0x71/0x1f0 [ 104.361540][ T812] kthread+0x38b/0x480 [ 104.361553][ T812] ? __pfx_worker_thread+0x10/0x10 [ 104.361568][ T812] ? __pfx_kthread+0x10/0x10 [ 104.361582][ T812] ret_from_fork+0x514/0xb70 [ 104.361598][ T812] ? __pfx_ret_from_fork+0x10/0x10 [ 104.361610][ T812] ? __switch_to+0xc78/0x1410 [ 104.361628][ T812] ? __pfx_kthread+0x10/0x10 [ 104.361641][ T812] ret_from_fork_asm+0x1a/0x30 [ 104.361684][ T812] [ 104.361763][ T812] ------------[ cut here ]------------ [ 104.361769][ T812] virtio-pci 0000:00:01.0: [drm] Dirty helper failed: ret=-12 [ 104.361777][ T812] WARNING: drivers/gpu/drm/drm_fbdev_shmem.c:118 at drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310, CPU#0: kworker/0:2/812 [ 104.543938][ T812] Modules linked in: [ 104.545638][ T812] CPU: 0 UID: 0 PID: 812 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 104.549554][ T812] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.553812][ T812] Workqueue: events drm_fb_helper_damage_work [ 104.556514][ T812] RIP: 0010:drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 104.559314][ T812] Code: 1e fc 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 9a 39 96 fc 4d 8b 27 48 89 df 4c 89 f6 4c 89 e2 8b 5c 24 04 89 d9 <67> 48 0f b9 3a 89 d8 e9 f7 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f [ 104.567262][ T812] RSP: 0018:ffffc9000459f898 EFLAGS: 00010246 [ 104.569588][ T812] RAX: 1ffff1100617141a RBX: 00000000fffffff4 RCX: 00000000fffffff4 [ 104.573034][ T812] RDX: ffff888030417020 RSI: ffffffff8c9a9340 RDI: ffffffff91a8cbc0 [ 104.576586][ T812] RBP: ffff88805b2c4008 R08: 0000000000000dc0 R09: 00000000ffffffff [ 104.579615][ T812] R10: dffffc0000000000 R11: fffffbfff2016b9f R12: ffff888030417020 [ 104.582870][ T812] R13: dffffc0000000000 R14: ffffffff8c9a9340 R15: ffff888030b8a0d0 [ 104.586350][ T812] FS: 0000000000000000(0000) GS:ffff88808ac38000(0000) knlGS:0000000000000000 [ 104.590132][ T812] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.592921][ T812] CR2: 00002000000001c0 CR3: 000000000c180000 CR4: 0000000000352ef0 [ 104.596250][ T812] Call Trace: [ 104.597586][ T812] [ 104.598747][ T812] drm_fb_helper_damage_work+0x84c/0xf20 [ 104.601008][ T812] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 104.603198][ T812] ? lock_acquire+0x115/0x350 [ 104.605106][ T812] ? rcu_is_watching+0x16/0xb0 [ 104.607066][ T812] ? process_scheduled_works+0x97a/0x1630 [ 104.609670][ T812] process_scheduled_works+0xc3d/0x1630 [ 104.612564][ T812] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.615580][ T812] ? assign_work+0x3cf/0x5d0 [ 104.618728][ T812] worker_thread+0xa47/0xfb0 [ 104.620695][ T812] ? __kthread_parkme+0x71/0x1f0 [ 104.622661][ T812] kthread+0x38b/0x480 [ 104.624742][ T812] ? __pfx_worker_thread+0x10/0x10 [ 104.627237][ T812] ? __pfx_kthread+0x10/0x10 [ 104.629285][ T812] ret_from_fork+0x514/0xb70 [ 104.631291][ T812] ? __pfx_ret_from_fork+0x10/0x10 [ 104.633553][ T812] ? __switch_to+0xc78/0x1410 [ 104.635414][ T812] ? __pfx_kthread+0x10/0x10 [ 104.637465][ T812] ret_from_fork_asm+0x1a/0x30 [ 104.639473][ T812] [ 104.640926][ T812] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 104.643998][ T812] CPU: 0 UID: 0 PID: 812 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 104.647743][ T812] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.651615][ T812] Workqueue: events drm_fb_helper_damage_work [ 104.654073][ T812] Call Trace: [ 104.655403][ T812] [ 104.656698][ T812] vpanic+0x56d/0xa60 [ 104.658403][ T812] ? __pfx__printk+0x10/0x10 [ 104.660350][ T812] ? __pfx_vpanic+0x10/0x10 [ 104.662123][ T812] ? is_bpf_text_address+0x292/0x2b0 [ 104.664206][ T812] ? is_bpf_text_address+0x26/0x2b0 [ 104.666264][ T812] panic+0xc5/0xd0 [ 104.667923][ T812] ? __pfx_panic+0x10/0x10 [ 104.669798][ T812] ? ret_from_fork_asm+0x1a/0x30 [ 104.671656][ T812] __warn+0x315/0x4c0 [ 104.673434][ T812] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 104.676235][ T812] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 104.678835][ T812] __report_bug+0x276/0x570 [ 104.680652][ T812] ? drm_modeset_acquire_fini+0x27/0x180 [ 104.682679][ T812] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 104.685042][ T812] ? __pfx___report_bug+0x10/0x10 [ 104.687200][ T812] ? drm_atomic_helper_dirtyfb+0xf27/0xfd0 [ 104.689807][ T812] ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10 [ 104.692370][ T812] report_bug_entry+0x19b/0x290 [ 104.694649][ T812] ? drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 104.697344][ T812] ? drm_fbdev_shmem_helper_fb_dirty+0x28d/0x310 [ 104.700031][ T812] handle_bug+0xce/0x200 [ 104.701854][ T812] exc_invalid_op+0x1a/0x50 [ 104.703880][ T812] asm_exc_invalid_op+0x1a/0x20 [ 104.705969][ T812] RIP: 0010:drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 104.708832][ T812] Code: 1e fc 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 9a 39 96 fc 4d 8b 27 48 89 df 4c 89 f6 4c 89 e2 8b 5c 24 04 89 d9 <67> 48 0f b9 3a 89 d8 e9 f7 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f [ 104.716519][ T812] RSP: 0018:ffffc9000459f898 EFLAGS: 00010246 [ 104.719009][ T812] RAX: 1ffff1100617141a RBX: 00000000fffffff4 RCX: 00000000fffffff4 [ 104.722421][ T812] RDX: ffff888030417020 RSI: ffffffff8c9a9340 RDI: ffffffff91a8cbc0 [ 104.725805][ T812] RBP: ffff88805b2c4008 R08: 0000000000000dc0 R09: 00000000ffffffff [ 104.729323][ T812] R10: dffffc0000000000 R11: fffffbfff2016b9f R12: ffff888030417020 [ 104.732771][ T812] R13: dffffc0000000000 R14: ffffffff8c9a9340 R15: ffff888030b8a0d0 [ 104.736108][ T812] ? drm_fbdev_shmem_helper_fb_dirty+0x260/0x310 [ 104.738978][ T812] drm_fb_helper_damage_work+0x84c/0xf20 [ 104.741783][ T812] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 104.744715][ T812] ? lock_acquire+0x115/0x350 [ 104.746739][ T812] ? rcu_is_watching+0x16/0xb0 [ 104.748772][ T812] ? process_scheduled_works+0x97a/0x1630 [ 104.751218][ T812] process_scheduled_works+0xc3d/0x1630 [ 104.753691][ T812] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.756358][ T812] ? assign_work+0x3cf/0x5d0 [ 104.758388][ T812] worker_thread+0xa47/0xfb0 [ 104.760416][ T812] ? __kthread_parkme+0x71/0x1f0 [ 104.762584][ T812] kthread+0x38b/0x480 [ 104.764400][ T812] ? __pfx_worker_thread+0x10/0x10 [ 104.766633][ T812] ? __pfx_kthread+0x10/0x10 [ 104.768644][ T812] ret_from_fork+0x514/0xb70 [ 104.770766][ T812] ? __pfx_ret_from_fork+0x10/0x10 [ 104.773017][ T812] ? __switch_to+0xc78/0x1410 [ 104.775089][ T812] ? __pfx_kthread+0x10/0x10 [ 104.777152][ T812] ret_from_fork_asm+0x1a/0x30 [ 104.779187][ T812] [ 104.780933][ T812] Kernel Offset: disabled [ 104.782853][ T812] Rebooting in 86400 seconds..