program: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000003c0)={&(0x7f0000000200)=[r6], 0x1, r3, r4, 0x3, 0x0, 0xffffffff, 0x804, {0xac7c, 0x1, 0x3, 0x67, 0xb4b, 0xffff, 0x2, 0x10, 0x12f, 0xe154, 0x1000, 0x0, 0x6, 0xffffffff, "fe1d00003413000000000020b4271822c93f0000000000000200"}}) [ 94.603813][ T5283] Bluetooth: hci0: command tx timeout [ 94.842789][ T1129] [drm:virtio_gpu_dequeue_ctrl_func] *ERROR* response 0x1205 (command 0x103) [ 95.891261][ T5324] ------------[ cut here ]------------ [ 95.891279][ T5324] [CRTC:40:crtc-0] vblank wait timed out [ 95.891296][ T5324] WARNING: drivers/gpu/drm/drm_atomic_helper.c:1928 at drm_atomic_helper_wait_for_vblanks+0x763/0x8f0, CPU#0: syz.0.0/5324 [ 95.903555][ T5324] Modules linked in: [ 95.906143][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.912674][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.917119][ T5324] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 95.920408][ T5324] Code: 00 4d 8d 6e 20 45 8b 3f 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 0e 48 89 fb 4c 89 ef e8 c7 84 99 fc 48 89 df 49 8b 55 00 44 89 fe <67> 48 0f b9 3a 49 bd 00 00 00 00 00 fc ff df 48 8b 5c 24 50 e9 cc [ 95.929145][ T5324] RSP: 0018:ffffc9000fd97540 EFLAGS: 00010246 [ 95.932194][ T5324] RAX: 1ffff110069cc00c RBX: dffffc0000000000 RCX: 0000000000100000 [ 95.936374][ T5324] RDX: ffff88801f7d0680 RSI: 0000000000000028 RDI: ffffffff90865440 [ 95.939885][ T5324] RBP: ffffc9000fd97680 R08: ffffffff907a727f R09: 1ffffffff20f4e4f [ 95.943441][ T5324] R10: dffffc0000000000 R11: fffffbfff20f4e50 R12: ffff88803707bb08 [ 95.946743][ T5324] R13: ffff888034e60060 R14: ffff888034e60040 R15: 0000000000000028 [ 95.950161][ T5324] FS: 00007effcedc36c0(0000) GS:ffff88808c2c3000(0000) knlGS:0000000000000000 [ 95.954222][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.957086][ T5324] CR2: 00007effceda29a0 CR3: 0000000012c96000 CR4: 0000000000352ef0 [ 95.960794][ T5324] Call Trace: [ 95.962492][ T5324] [ 95.963871][ T5324] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 95.966837][ T5324] ? __pfx_autoremove_wake_function+0x10/0x10 [ 95.969415][ T5324] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.972253][ T5324] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 95.975308][ T5324] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 95.978130][ T5324] commit_tail+0x2b1/0x3c0 [ 95.980102][ T5324] drm_atomic_helper_commit+0xa77/0xb10 [ 95.982640][ T5324] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 95.985299][ T5324] drm_atomic_commit+0x24e/0x2b0 [ 95.987512][ T5324] ? __pfx_drm_atomic_commit+0x10/0x10 [ 95.989792][ T5324] ? __pfx___drm_printfn_info+0x10/0x10 [ 95.992595][ T5324] ? drm_atomic_commit_init+0x2ca/0x370 [ 95.995165][ T5324] drm_atomic_helper_set_config+0xe2/0x160 [ 95.997802][ T5324] drm_mode_setcrtc+0xa70/0x1d20 [ 95.999919][ T5324] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 96.002378][ T5324] ? __lock_acquire+0x747/0x2de0 [ 96.004676][ T5324] ? do_raw_spin_unlock+0x4d/0x200 [ 96.006986][ T5324] ? _raw_spin_unlock+0x28/0x50 [ 96.009571][ T5324] ? drm_is_current_master+0x19f/0x200 [ 96.012500][ T5324] drm_ioctl_kernel+0x2df/0x3b0 [ 96.014725][ T5324] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 96.017240][ T5324] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 96.019542][ T5324] drm_ioctl+0x70e/0xba0 [ 96.021573][ T5324] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 96.023951][ T5324] ? __pfx_drm_ioctl+0x10/0x10 [ 96.025959][ T5324] ? __fget_files+0x2a/0x420 [ 96.028001][ T5324] ? bpf_lsm_file_ioctl+0x9/0x20 [ 96.030228][ T5324] ? __pfx_drm_ioctl+0x10/0x10 [ 96.032589][ T5324] __se_sys_ioctl+0xfc/0x170 [ 96.034916][ T5324] do_syscall_64+0x166/0x520 [ 96.037128][ T5324] ? trace_irq_disable+0x3b/0x140 [ 96.039411][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.042140][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 96.044100][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.046602][ T5324] RIP: 0033:0x7effcdf9e159 [ 96.048586][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.057983][ T5324] RSP: 002b:00007effcedc2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.061777][ T5324] RAX: ffffffffffffffda RBX: 00007effce225fa0 RCX: 00007effcdf9e159 [ 96.065275][ T5324] RDX: 00002000000003c0 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 96.068626][ T5324] RBP: 00007effce03506b R08: 0000000000000000 R09: 0000000000000000 [ 96.072461][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.076002][ T5324] R13: 00007effce226038 R14: 00007effce225fa0 R15: 00007fff19280808 [ 96.079426][ T5324] [ 96.080800][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 96.084110][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.087976][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.092667][ T5324] Call Trace: [ 96.094198][ T5324] [ 96.095702][ T5324] vpanic+0x56d/0xa60 [ 96.097548][ T5324] ? __pfx__printk+0x10/0x10 [ 96.099633][ T5324] ? __pfx_vpanic+0x10/0x10 [ 96.101892][ T5324] ? is_bpf_text_address+0x292/0x2b0 [ 96.105037][ T5324] ? is_bpf_text_address+0x26/0x2b0 [ 96.107752][ T5324] panic+0xc5/0xd0 [ 96.109502][ T5324] ? __pfx_panic+0x10/0x10 [ 96.111690][ T5324] __warn+0x315/0x4c0 [ 96.113438][ T5324] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 96.116380][ T5324] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 96.119466][ T5324] __report_bug+0x276/0x570 [ 96.121540][ T5324] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 96.124593][ T5324] ? __pfx___report_bug+0x10/0x10 [ 96.126884][ T5324] report_bug_entry+0x19b/0x290 [ 96.129350][ T5324] ? drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 96.131992][ T5324] ? drm_atomic_helper_wait_for_vblanks+0x7a8/0x8f0 [ 96.134494][ T5324] handle_bug+0xce/0x200 [ 96.136206][ T5324] exc_invalid_op+0x1a/0x50 [ 96.138232][ T5324] asm_exc_invalid_op+0x1a/0x20 [ 96.140489][ T5324] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 96.143724][ T5324] Code: 00 4d 8d 6e 20 45 8b 3f 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 0e 48 89 fb 4c 89 ef e8 c7 84 99 fc 48 89 df 49 8b 55 00 44 89 fe <67> 48 0f b9 3a 49 bd 00 00 00 00 00 fc ff df 48 8b 5c 24 50 e9 cc [ 96.152299][ T5324] RSP: 0018:ffffc9000fd97540 EFLAGS: 00010246 [ 96.155296][ T5324] RAX: 1ffff110069cc00c RBX: dffffc0000000000 RCX: 0000000000100000 [ 96.158548][ T5324] RDX: ffff88801f7d0680 RSI: 0000000000000028 RDI: ffffffff90865440 [ 96.162003][ T5324] RBP: ffffc9000fd97680 R08: ffffffff907a727f R09: 1ffffffff20f4e4f [ 96.165505][ T5324] R10: dffffc0000000000 R11: fffffbfff20f4e50 R12: ffff88803707bb08 [ 96.169072][ T5324] R13: ffff888034e60060 R14: ffff888034e60040 R15: 0000000000000028 [ 96.172658][ T5324] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 96.176006][ T5324] ? __pfx_autoremove_wake_function+0x10/0x10 [ 96.178941][ T5324] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.181612][ T5324] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 96.184451][ T5324] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 96.187180][ T5324] commit_tail+0x2b1/0x3c0 [ 96.189209][ T5324] drm_atomic_helper_commit+0xa77/0xb10 [ 96.191846][ T5324] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 96.194524][ T5324] drm_atomic_commit+0x24e/0x2b0 [ 96.196877][ T5324] ? __pfx_drm_atomic_commit+0x10/0x10 [ 96.199448][ T5324] ? __pfx___drm_printfn_info+0x10/0x10 [ 96.202024][ T5324] ? drm_atomic_commit_init+0x2ca/0x370 [ 96.204590][ T5324] drm_atomic_helper_set_config+0xe2/0x160 [ 96.207199][ T5324] drm_mode_setcrtc+0xa70/0x1d20 [ 96.209469][ T5324] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 96.211793][ T5324] ? __lock_acquire+0x747/0x2de0 [ 96.214211][ T5324] ? do_raw_spin_unlock+0x4d/0x200 [ 96.216693][ T5324] ? _raw_spin_unlock+0x28/0x50 [ 96.219040][ T5324] ? drm_is_current_master+0x19f/0x200 [ 96.221442][ T5324] drm_ioctl_kernel+0x2df/0x3b0 [ 96.223719][ T5324] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 96.226063][ T5324] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 96.228439][ T5324] drm_ioctl+0x70e/0xba0 [ 96.230367][ T5324] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 96.233140][ T5324] ? __pfx_drm_ioctl+0x10/0x10 [ 96.235205][ T5324] ? __fget_files+0x2a/0x420 [ 96.237194][ T5324] ? bpf_lsm_file_ioctl+0x9/0x20 [ 96.239534][ T5324] ? __pfx_drm_ioctl+0x10/0x10 [ 96.241863][ T5324] __se_sys_ioctl+0xfc/0x170 [ 96.244027][ T5324] do_syscall_64+0x166/0x520 [ 96.246124][ T5324] ? trace_irq_disable+0x3b/0x140 [ 96.248388][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.250782][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 96.252872][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.255388][ T5324] RIP: 0033:0x7effcdf9e159 [ 96.257469][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.266311][ T5324] RSP: 002b:00007effcedc2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.269905][ T5324] RAX: ffffffffffffffda RBX: 00007effce225fa0 RCX: 00007effcdf9e159 [ 96.273436][ T5324] RDX: 00002000000003c0 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 96.276841][ T5324] RBP: 00007effce03506b R08: 0000000000000000 R09: 0000000000000000 [ 96.280289][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.283885][ T5324] R13: 00007effce226038 R14: 00007effce225fa0 R15: 00007fff19280808 [ 96.287785][ T5324] [ 96.289572][ T5324] Kernel Offset: disabled [ 96.291475][ T5324] Rebooting in 86400 seconds..