program:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc03064ca, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfffffff9, 0x7})
[ 102.799817][ T4666] Bluetooth: hci0: command tx timeout
[ 102.853393][ T5351] ------------[ cut here ]------------
[ 102.853402][ T5351] 1
[ 102.853416][ T5351] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5351
[ 102.861145][ T5351] Modules linked in:
[ 102.863101][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.867208][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.871683][ T5351] RIP: 0010:___kmalloc_large_node+0x10c/0x170
[ 102.874583][ T5351] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 ed 40 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 92 88 d2 09 cc 89 ef 89
[ 102.883275][ T5351] RSP: 0018:ffffc9000c21fa00 EFLAGS: 00010246
[ 102.885848][ T5351] RAX: 0000000000000000 RBX: 00000003ffffffe4 RCX: 0000000000100000
[ 102.888914][ T5351] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000003ffffffe4
[ 102.892348][ T5351] RBP: 0000000000000cc0 R08: ffffffff85a33b49 R09: 0000000000000000
[ 102.896004][ T5351] R10: dffffc0000000000 R11: ffffffff85ac5720 R12: 1ffff92001843fb9
[ 102.899651][ T5351] R13: ffffffff85ac530a R14: 00000003ffffffe4 R15: 00000003ffffffe4
[ 102.903093][ T5351] FS: 00007f680c6d76c0(0000) GS:ffff88808aa11000(0000) knlGS:0000000000000000
[ 102.907012][ T5351] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 102.909859][ T5351] CR2: 00007f680ba18c58 CR3: 00000000541fb000 CR4: 0000000000352ef0
[ 102.913293][ T5351] Call Trace:
[ 102.915004][ T5351]
[ 102.917011][ T5351] __kmalloc_large_node_noprof+0x18/0x90
[ 102.919450][ T5351] __kmalloc_noprof+0x3f6/0x710
[ 102.921578][ T5351] ? drm_syncobj_array_find+0x3a/0x440
[ 102.924395][ T5351] drm_syncobj_array_find+0x3a/0x440
[ 102.927233][ T5351] drm_syncobj_timeline_wait_ioctl+0x18a/0x640
[ 102.930266][ T5351] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
[ 102.933461][ T5351] drm_ioctl_kernel+0x2df/0x3b0
[ 102.935543][ T5351] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
[ 102.938308][ T5351] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 102.940702][ T5351] ? __might_fault+0xaf/0x130
[ 102.942702][ T5351] drm_ioctl+0x70e/0xba0
[ 102.944715][ T5351] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
[ 102.947656][ T5351] ? __pfx_drm_ioctl+0x10/0x10
[ 102.949819][ T5351] ? __fget_files+0x2a/0x420
[ 102.951927][ T5351] ? bpf_lsm_file_ioctl+0x9/0x20
[ 102.954247][ T5351] ? __pfx_drm_ioctl+0x10/0x10
[ 102.956306][ T5351] __se_sys_ioctl+0xfc/0x170
[ 102.958297][ T5351] do_syscall_64+0x166/0x520
[ 102.960298][ T5351] ? trace_irq_disable+0x3b/0x140
[ 102.962273][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.964955][ T5351] ? clear_bhb_loop+0x70/0xc0
[ 102.967076][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.969627][ T5351] RIP: 0033:0x7f680b79f559
[ 102.971593][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.979387][ T5351] RSP: 002b:00007f680c6d6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 102.982811][ T5351] RAX: ffffffffffffffda RBX: 00007f680ba25fa0 RCX: 00007f680b79f559
[ 102.986380][ T5351] RDX: 0000200000000040 RSI: 00000000c03064ca RDI: 0000000000000003
[ 102.989612][ T5351] RBP: 00007f680b836b20 R08: 0000000000000000 R09: 0000000000000000
[ 102.993127][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.996496][ T5351] R13: 00007f680ba26038 R14: 00007f680ba25fa0 R15: 00007fff99e00918
[ 102.999888][ T5351]
[ 103.001305][ T5351] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 103.004543][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.008213][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.012320][ T5351] Call Trace:
[ 103.013731][ T5351]
[ 103.014984][ T5351] vpanic+0x26f/0x710
[ 103.016645][ T5351] panic+0xc5/0xd0
[ 103.018229][ T5351] ? __pfx_panic+0x10/0x10
[ 103.020129][ T5351] __warn+0x315/0x4c0
[ 103.021735][ T5351] ? ___kmalloc_large_node+0x10c/0x170
[ 103.023941][ T5351] ? ___kmalloc_large_node+0x10c/0x170
[ 103.026117][ T5351] __report_bug+0x276/0x570
[ 103.027931][ T5351] ? kernel_text_address+0xa5/0xe0
[ 103.030141][ T5351] ? ___kmalloc_large_node+0x10c/0x170
[ 103.032595][ T5351] ? __pfx___report_bug+0x10/0x10
[ 103.034915][ T5351] ? stack_trace_save+0xa9/0x100
[ 103.037158][ T5351] ? __pfx_stack_trace_save+0x10/0x10
[ 103.039924][ T5351] ? kasan_save_track+0x4f/0x80
[ 103.042482][ T5351] ? ___kmalloc_large_node+0x10c/0x170
[ 103.044947][ T5351] report_bug+0x16b/0x220
[ 103.046973][ T5351] ? ___kmalloc_large_node+0x10c/0x170
[ 103.049628][ T5351] ? ___kmalloc_large_node+0x10e/0x170
[ 103.052277][ T5351] handle_bug+0x9c/0x200
[ 103.054443][ T5351] exc_invalid_op+0x1a/0x50
[ 103.056640][ T5351] asm_exc_invalid_op+0x1a/0x20
[ 103.058964][ T5351] RIP: 0010:___kmalloc_large_node+0x10c/0x170
[ 103.061823][ T5351] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 ed 40 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 92 88 d2 09 cc 89 ef 89
[ 103.069804][ T5351] RSP: 0018:ffffc9000c21fa00 EFLAGS: 00010246
[ 103.072529][ T5351] RAX: 0000000000000000 RBX: 00000003ffffffe4 RCX: 0000000000100000
[ 103.075764][ T5351] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000003ffffffe4
[ 103.079073][ T5351] RBP: 0000000000000cc0 R08: ffffffff85a33b49 R09: 0000000000000000
[ 103.082451][ T5351] R10: dffffc0000000000 R11: ffffffff85ac5720 R12: 1ffff92001843fb9
[ 103.085642][ T5351] R13: ffffffff85ac530a R14: 00000003ffffffe4 R15: 00000003ffffffe4
[ 103.088524][ T5351] ? drm_syncobj_array_find+0x3a/0x440
[ 103.090425][ T5351] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
[ 103.092737][ T5351] ? drm_dev_enter+0x49/0x150
[ 103.094458][ T5351] __kmalloc_large_node_noprof+0x18/0x90
[ 103.096733][ T5351] __kmalloc_noprof+0x3f6/0x710
[ 103.098745][ T5351] ? drm_syncobj_array_find+0x3a/0x440
[ 103.100908][ T5351] drm_syncobj_array_find+0x3a/0x440
[ 103.102932][ T5351] drm_syncobj_timeline_wait_ioctl+0x18a/0x640
[ 103.105436][ T5351] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
[ 103.108192][ T5351] drm_ioctl_kernel+0x2df/0x3b0
[ 103.110138][ T5351] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
[ 103.112793][ T5351] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 103.115069][ T5351] ? __might_fault+0xaf/0x130
[ 103.116918][ T5351] drm_ioctl+0x70e/0xba0
[ 103.118516][ T5351] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
[ 103.121244][ T5351] ? __pfx_drm_ioctl+0x10/0x10
[ 103.123225][ T5351] ? __fget_files+0x2a/0x420
[ 103.125271][ T5351] ? bpf_lsm_file_ioctl+0x9/0x20
[ 103.127449][ T5351] ? __pfx_drm_ioctl+0x10/0x10
[ 103.129451][ T5351] __se_sys_ioctl+0xfc/0x170
[ 103.131308][ T5351] do_syscall_64+0x166/0x520
[ 103.133063][ T5351] ? trace_irq_disable+0x3b/0x140
[ 103.135117][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.137523][ T5351] ? clear_bhb_loop+0x70/0xc0
[ 103.139429][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.141778][ T5351] RIP: 0033:0x7f680b79f559
[ 103.143658][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.151262][ T5351] RSP: 002b:00007f680c6d6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 103.154207][ T5351] RAX: ffffffffffffffda RBX: 00007f680ba25fa0 RCX: 00007f680b79f559
[ 103.157050][ T5351] RDX: 0000200000000040 RSI: 00000000c03064ca RDI: 0000000000000003
[ 103.160352][ T5351] RBP: 00007f680b836b20 R08: 0000000000000000 R09: 0000000000000000
[ 103.163748][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.167048][ T5351] R13: 00007f680ba26038 R14: 00007f680ba25fa0 R15: 00007fff99e00918
[ 103.170247][ T5351]
[ 103.172131][ T5351] Kernel Offset: disabled
[ 103.173880][ T5351] Rebooting in 86400 seconds..