program: r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x545641, 0x0) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f00000000c0)={0x0, &(0x7f0000000040)=""/114}) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) r4 = ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000180)={r2, 0x0, 0x4000, 0x1000000000000}) r5 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@o_path={&(0x7f00000001c0)='./file0\x00', 0x0, 0x10, r3}, 0x18) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r2, 0x0, 0x1, 0xff3, &(0x7f0000000240)=[0x0], 0x1, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0], 0x0}, 0x40) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x4, &(0x7f00000003c0)=@raw=[@cb_func={0x18, 0xb, 0x4, 0x0, 0x1}, @call={0x85, 0x0, 0x0, 0x9e}, @call={0x85, 0x0, 0x0, 0x44}], &(0x7f0000000400)='syzkaller\x00', 0x7fff, 0xf7, &(0x7f0000000440)=""/247, 0x41100, 0x0, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000540)={0x2, 0xe, 0x8000, 0x8}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000580)=[r2], &(0x7f00000005c0)=[{0x3, 0x3, 0x3, 0x6}, {0x0, 0x4, 0xc, 0xa}, {0x0, 0x1, 0x0, 0x2}, {0x5, 0x1, 0xe, 0xb}, {0x5, 0x4, 0x6, 0x6}, {0x2, 0x5, 0x9, 0x6}, {0x1, 0x4, 0x5, 0xa}, {0x3, 0x3, 0x8, 0xf}, {0x3, 0x5, 0xf, 0x5}], 0x10, 0x9562}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000380)={@fallback=r0, r5, 0x29, 0x10, 0x0, @void, @value=r8, @void, @void, r7}, 0x20) read$FUSE(r3, &(0x7f0000000740)={0x2020}, 0x2020) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f00000027c0), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000002800)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000002840)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000002880)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000028c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000002900)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f0000002940)=0x0) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000002a40)={&(0x7f0000002780)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002a00)={&(0x7f0000002980)={0x54, r10, 0x1, 0x70bd25, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r12}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r13}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r14}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r15}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r16}]}, 0x54}, 0x1, 0x0, 0x0, 0x8180}, 0x40840) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000002a80)={r6}) ioctl(r3, 0x0, &(0x7f0000002ac0)) write$binfmt_script(r3, &(0x7f0000002b00)={'#! ', './file0', [{0x20, ']$-\x89'}, {0x20, '-\xf2\\#'}, {0x20, '/dev/dri/renderD128\x00'}, {0x20, ')&/'}, {0x20, '-#\xd6]$^&^'}], 0xa, "6feb179d15a8dd8046376bbab3f9f6d764c608e15ef91efea6daa23d2bc1799f7a29b40b5489456c97589a91779345798e2d076b55206f1160f6429be80242f0609911d7272998cf6cda559841f674011cfdbb23d68547552a65e6655eafe21c4c25246c60852b4d39da8910928d131fad2e79fd5bb4ca22740e288fb329b2d4c979338d04c2afe69836dc61bfd9342b80f4e1fee43f55d184276e0776a6ff8740e03538ad62"}, 0xdd) r17 = syz_genetlink_get_family_id$nfc(&(0x7f0000002c40), r9) sendmsg$NFC_CMD_VENDOR(r9, &(0x7f0000002e00)={&(0x7f0000002c00)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002c80)={0x108, r17, 0x2, 0x70bd25, 0x25dfdbff, {}, [@NFC_ATTR_VENDOR_DATA={0xf2, 0x1f, "3c92391d6275a25d607698b15196d2c25f4ece8defdd0bbe9c2dda222d72b73eee07fd65df3d02b115e150463a8a6ea381d455479dad0e75ea82528bee755c5096c5b50d1bb2b3bd4b4d9638ab14a1c101e0e7a1ad61f7b1a6c16db9896ad807c64a8279c81273fd0579f9def9e7528e5d6d7020c6ff61bb213c07e5b35402083f441d476c0cc62b78a3160aa49034d649f45a5779bad7bf2e9270a34c6e5a6af5f2929ae2466040a6924eb372c42d36d24d0a6f6b8448345a36bae189a07e8a87ddab8bbf7377d1f6f6a4964623b8e52255b8285be1e69b7e9770c82b5238ffc92b7bbb0f064bcfca8d9f673637"}]}, 0x108}}, 0x24008000) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000002f00)={&(0x7f0000002e40)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000002ec0)={&(0x7f0000002e80)={0x28, 0x464, 0x1, 0x70bd2d, 0x25dfdbfc, "d8d109870469c95e06e6d3b82dd97deff7894ea2e91c", [""]}, 0x28}}, 0x20004000) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x10, r4, 0x5d1d2000) ioctl$DRM_IOCTL_DMA(r0, 0xc0406429, &(0x7f0000003040)={0x0, 0x4, &(0x7f0000002f40)=[0x8000, 0x8, 0x10001, 0x1], &(0x7f0000002f80)=[0x7ff, 0xe, 0x5, 0x9, 0x1, 0x3, 0x5], 0x12, 0x7, 0x2, &(0x7f0000002fc0)=[0x38, 0x5, 0x3, 0x98, 0x40, 0x8, 0xffffff44], &(0x7f0000003000)=[0x3, 0x2, 0x200, 0xfffffff7, 0xa, 0x1, 0xb37, 0x3, 0x61e48ef6]}) ioctl$DRM_IOCTL_RES_CTX(r6, 0xc0106426, &(0x7f00000030c0)={0x5, &(0x7f0000003080)=[{}, {0x0}, {}, {}, {}]}) ioctl$DRM_IOCTL_SWITCH_CTX(r3, 0x40086424, &(0x7f0000003100)={r18, 0x1}) ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000003140)={0x2, {0x2, 0xbb5, 0x2a, 0x7, 0x4, 0x10}}) [ 95.154787][ T5319] ------------[ cut here ]------------ [ 95.154807][ T5319] !(flags & __GFP_NOWARN) [ 95.154821][ T5319] WARNING: mm/slub.c:7022 at __kvmalloc_node_noprof+0x798/0x820, CPU#0: syz.0.0/5319 [ 95.162397][ T5319] Modules linked in: [ 95.164259][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.168288][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.172416][ T5319] RIP: 0010:__kvmalloc_node_noprof+0x798/0x820 [ 95.175046][ T5319] Code: ff 48 c7 c7 30 95 e9 8e 48 89 de e8 62 69 f0 02 e9 1b fc ff ff 48 c7 c7 70 95 e9 8e 48 89 de e8 4e 69 f0 02 e9 4c fc ff ff 90 <0f> 0b 90 31 db e9 06 fe ff ff 90 0f 0b 90 e9 55 ff ff ff 49 83 7f [ 95.182935][ T5319] RSP: 0018:ffffc9000dca7ae0 EFLAGS: 00010246 [ 95.185438][ T5319] RAX: 0000000000000100 RBX: 0000000000000000 RCX: 8000000000000001 [ 95.190342][ T5319] RDX: 0000008000000000 RSI: ffffffff8c6dcd60 RDI: ffffffff8c6dcd20 [ 95.194026][ T5319] RBP: 00000000ffffffff R08: 00000000000028c0 R09: 00000000ffffffff [ 95.197652][ T5319] R10: 0000000000000006 R11: 0000000000000002 R12: 0000008000000000 [ 95.200995][ T5319] R13: 00000000000028c0 R14: 0000001000000000 R15: ffffffff8659b11c [ 95.204338][ T5319] FS: 00007f67557c36c0(0000) GS:ffff88808c2be000(0000) knlGS:0000000000000000 [ 95.208277][ T5319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.211102][ T5319] CR2: 00007f6754c21a28 CR3: 0000000043142000 CR4: 0000000000352ef0 [ 95.214624][ T5319] Call Trace: [ 95.216145][ T5319] [ 95.217430][ T5319] ? __kmalloc_cache_noprof+0x321/0x600 [ 95.219773][ T5319] ? udmabuf_create+0xd0/0xf50 [ 95.221996][ T5319] ? udmabuf_create+0x2dc/0xf50 [ 95.223989][ T5319] udmabuf_create+0x2dc/0xf50 [ 95.226661][ T5319] ? tomoyo_path_number_perm+0x219/0x5f0 [ 95.229130][ T5319] ? do_vfs_ioctl+0x116f/0x1530 [ 95.231375][ T5319] ? __pfx_udmabuf_create+0x10/0x10 [ 95.233658][ T5319] udmabuf_ioctl+0x1f3/0x300 [ 95.235799][ T5319] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 95.237839][ T5319] ? __fget_files+0x2a/0x420 [ 95.239808][ T5319] ? __fget_files+0x2a/0x420 [ 95.241923][ T5319] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.244097][ T5319] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 95.246378][ T5319] __se_sys_ioctl+0xfc/0x170 [ 95.248289][ T5319] do_syscall_64+0x166/0x520 [ 95.250296][ T5319] ? trace_irq_disable+0x3b/0x140 [ 95.253783][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.256469][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 95.258495][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.260981][ T5319] RIP: 0033:0x7f675499e159 [ 95.262891][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.271075][ T5319] RSP: 002b:00007f67557c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.274581][ T5319] RAX: ffffffffffffffda RBX: 00007f6754c25fa0 RCX: 00007f675499e159 [ 95.278035][ T5319] RDX: 0000200000000180 RSI: 0000000040187542 RDI: 0000000000000003 [ 95.281503][ T5319] RBP: 00007f6754a3506b R08: 0000000000000000 R09: 0000000000000000 [ 95.284871][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.288216][ T5319] R13: 00007f6754c26038 R14: 00007f6754c25fa0 R15: 00007ffd256ce528 [ 95.291768][ T5319] [ 95.293276][ T5319] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.296607][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.300417][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.304694][ T5319] Call Trace: [ 95.306129][ T5319] [ 95.307408][ T5319] vpanic+0x56d/0xa60 [ 95.309120][ T5319] ? __pfx__printk+0x10/0x10 [ 95.311107][ T5319] ? __pfx_vpanic+0x10/0x10 [ 95.313079][ T5319] ? is_bpf_text_address+0x292/0x2b0 [ 95.315406][ T5319] ? is_bpf_text_address+0x26/0x2b0 [ 95.317654][ T5319] panic+0xc5/0xd0 [ 95.319310][ T5319] ? __pfx_panic+0x10/0x10 [ 95.321224][ T5319] __warn+0x315/0x4c0 [ 95.322979][ T5319] ? __kvmalloc_node_noprof+0x798/0x820 [ 95.325254][ T5319] ? __kvmalloc_node_noprof+0x798/0x820 [ 95.327566][ T5319] __report_bug+0x276/0x570 [ 95.329489][ T5319] ? __kvmalloc_node_noprof+0x798/0x820 [ 95.331867][ T5319] ? __pfx___report_bug+0x10/0x10 [ 95.333995][ T5319] ? __asan_memset+0x22/0x50 [ 95.335962][ T5319] ? __alloc_frozen_pages_noprof+0xa7/0x5a0 [ 95.338430][ T5319] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 95.341055][ T5319] ? __kvmalloc_node_noprof+0x798/0x820 [ 95.343405][ T5319] report_bug+0x16b/0x220 [ 95.345239][ T5319] ? __kvmalloc_node_noprof+0x798/0x820 [ 95.347605][ T5319] ? __kvmalloc_node_noprof+0x79a/0x820 [ 95.349992][ T5319] handle_bug+0x9c/0x200 [ 95.351789][ T5319] exc_invalid_op+0x1a/0x50 [ 95.353764][ T5319] asm_exc_invalid_op+0x1a/0x20 [ 95.355798][ T5319] RIP: 0010:__kvmalloc_node_noprof+0x798/0x820 [ 95.358348][ T5319] Code: ff 48 c7 c7 30 95 e9 8e 48 89 de e8 62 69 f0 02 e9 1b fc ff ff 48 c7 c7 70 95 e9 8e 48 89 de e8 4e 69 f0 02 e9 4c fc ff ff 90 <0f> 0b 90 31 db e9 06 fe ff ff 90 0f 0b 90 e9 55 ff ff ff 49 83 7f [ 95.366144][ T5319] RSP: 0018:ffffc9000dca7ae0 EFLAGS: 00010246 [ 95.368670][ T5319] RAX: 0000000000000100 RBX: 0000000000000000 RCX: 8000000000000001 [ 95.371995][ T5319] RDX: 0000008000000000 RSI: ffffffff8c6dcd60 RDI: ffffffff8c6dcd20 [ 95.375292][ T5319] RBP: 00000000ffffffff R08: 00000000000028c0 R09: 00000000ffffffff [ 95.378606][ T5319] R10: 0000000000000006 R11: 0000000000000002 R12: 0000008000000000 [ 95.381955][ T5319] R13: 00000000000028c0 R14: 0000001000000000 R15: ffffffff8659b11c [ 95.385235][ T5319] ? udmabuf_create+0x2dc/0xf50 [ 95.387324][ T5319] ? __kmalloc_cache_noprof+0x321/0x600 [ 95.389642][ T5319] ? udmabuf_create+0xd0/0xf50 [ 95.391700][ T5319] ? udmabuf_create+0x2dc/0xf50 [ 95.393778][ T5319] udmabuf_create+0x2dc/0xf50 [ 95.395796][ T5319] ? tomoyo_path_number_perm+0x219/0x5f0 [ 95.398125][ T5319] ? do_vfs_ioctl+0x116f/0x1530 [ 95.400152][ T5319] ? __pfx_udmabuf_create+0x10/0x10 [ 95.402397][ T5319] udmabuf_ioctl+0x1f3/0x300 [ 95.404342][ T5319] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 95.406546][ T5319] ? __fget_files+0x2a/0x420 [ 95.408448][ T5319] ? __fget_files+0x2a/0x420 [ 95.410434][ T5319] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.412561][ T5319] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 95.414690][ T5319] __se_sys_ioctl+0xfc/0x170 [ 95.416645][ T5319] do_syscall_64+0x166/0x520 [ 95.418666][ T5319] ? trace_irq_disable+0x3b/0x140 [ 95.420726][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.423279][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 95.425204][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.427639][ T5319] RIP: 0033:0x7f675499e159 [ 95.429535][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.437528][ T5319] RSP: 002b:00007f67557c2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.440991][ T5319] RAX: ffffffffffffffda RBX: 00007f6754c25fa0 RCX: 00007f675499e159 [ 95.444398][ T5319] RDX: 0000200000000180 RSI: 0000000040187542 RDI: 0000000000000003 [ 95.447673][ T5319] RBP: 00007f6754a3506b R08: 0000000000000000 R09: 0000000000000000 [ 95.451041][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.454208][ T5319] R13: 00007f6754c26038 R14: 00007f6754c25fa0 R15: 00007ffd256ce528 [ 95.458099][ T5319] [ 95.459818][ T5319] Kernel Offset: disabled [ 95.461741][ T5319] Rebooting in 86400 seconds..