program:
r0 = syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000c00)={0xe9, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x6, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]})
ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0)
ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0)
ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40084146, &(0x7f0000000040)=0x7)
ioctl$SNDRV_PCM_IOCTL_DRAIN(r0, 0x4144, 0x0)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0xc0000005})
ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0)
syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) (async)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000c00)={0xe9, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x6, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) (async)
ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) (async)
ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) (async)
ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40084146, &(0x7f0000000040)=0x7) (async)
ioctl$SNDRV_PCM_IOCTL_DRAIN(r0, 0x4144, 0x0) (async)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0xc0000005}) (async)
ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) (async)
[ 94.107733][ T45] Bluetooth: hci0: command tx timeout
[ 94.396912][ T5312] ------------[ cut here ]------------
[ 94.400090][ T5312] ODEBUG: free active (active state 0) object: ffff8880122f3320 object type: hrtimer hint: dummy_hrtimer_callback+0x0/0x150
[ 94.405700][ T5312] WARNING: lib/debugobjects.c:632 at debug_print_object+0xec/0x230, CPU#0: syz.0.0/5312
[ 94.409737][ T5312] Modules linked in:
[ 94.411701][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.415502][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.419617][ T5312] RIP: 0010:debug_print_object+0x18a/0x230
[ 94.422137][ T5312] Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 6d 58 52 fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 63 06 93 0b 48 83 c4 10 5b 41 5c
[ 94.430100][ T5312] RSP: 0018:ffffc9000dbe7a10 EFLAGS: 00010246
[ 94.432762][ T5312] RAX: 1ffffffff181f0a0 RBX: dffffc0000000000 RCX: 0000000000000000
[ 94.436064][ T5312] RDX: ffffffff8c6d2140 RSI: ffffffff8c6d1bc0 RDI: ffffffff90840f60
[ 94.439304][ T5312] RBP: ffffffff8c6d2140 R08: ffff8880122f3320 R09: ffffffff8c0f8740
[ 94.442622][ T5312] R10: dffffc0000000000 R11: ffffffff81b3bf00 R12: 0000000000000000
[ 94.445929][ T5312] R13: ffffffff90840f60 R14: ffff8880122f3320 R15: ffffffff8c0f8500
[ 94.449286][ T5312] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000
[ 94.453145][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.455948][ T5312] CR2: 00007f40b29556a0 CR3: 0000000012e06000 CR4: 0000000000352ef0
[ 94.459330][ T5312] Call Trace:
[ 94.460805][ T5312]
[ 94.462160][ T5312] ? __pfx_dummy_hrtimer_callback+0x10/0x10
[ 94.464784][ T5312] ? __pfx_dummy_hrtimer_callback+0x10/0x10
[ 94.467428][ T5312] debug_check_no_obj_freed+0x2e3/0x450
[ 94.469901][ T5312] kfree+0x13e/0x640
[ 94.471968][ T5312] ? _raw_spin_unlock_irq+0x23/0x50
[ 94.474451][ T5312] ? dummy_pcm_close+0x9b/0xb0
[ 94.476330][ T5312] dummy_pcm_close+0x9b/0xb0
[ 94.478190][ T5312] snd_pcm_release_substream+0x313/0x490
[ 94.480352][ T5312] snd_pcm_release+0xb6/0x160
[ 94.482329][ T5312] ? __pfx_snd_pcm_release+0x10/0x10
[ 94.484558][ T5312] __fput+0x418/0xa50
[ 94.486310][ T5312] task_work_run+0x1d9/0x270
[ 94.488403][ T5312] ? __pfx_task_work_run+0x10/0x10
[ 94.490696][ T5312] ? do_raw_spin_unlock+0x4d/0x200
[ 94.493016][ T5312] do_exit+0x73a/0x2360
[ 94.494700][ T5312] ? try_to_wake_up+0x8b6/0x14d0
[ 94.496780][ T5312] ? __pfx_do_exit+0x10/0x10
[ 94.498861][ T5312] ? preempt_schedule_thunk+0x16/0x40
[ 94.501175][ T5312] ? preempt_schedule_thunk+0x16/0x40
[ 94.503759][ T5312] do_group_exit+0x22d/0x2f0
[ 94.505740][ T5312] __x64_sys_exit_group+0x3f/0x40
[ 94.507911][ T5312] x64_sys_call+0x18c6/0x18d0
[ 94.509929][ T5312] do_syscall_64+0x166/0x520
[ 94.512016][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.514743][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 94.516774][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.519331][ T5312] RIP: 0033:0x7f40b1b9e0d9
[ 94.521345][ T5312] Code: Unable to access opcode bytes at 0x7f40b1b9e0af.
[ 94.524243][ T5312] RSP: 002b:00007fff04809d38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 94.527733][ T5312] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f40b1b9e0d9
[ 94.530977][ T5312] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000b
[ 94.534706][ T5312] RBP: 00000000000009e8 R08: 00007fff0480a8f7 R09: 000000000000000b
[ 94.538290][ T5312] R10: 00007f40b1e25fa0 R11: 0000000000000246 R12: 0000000000000003
[ 94.541836][ T5312] R13: 00007f40b1e2627c R14: 00007f40b1e26278 R15: 00007f40b1e26270
[ 94.545317][ T5312]
[ 94.546709][ T5312] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.549744][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.553334][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.557605][ T5312] Call Trace:
[ 94.559147][ T5312]
[ 94.560474][ T5312] vpanic+0x56d/0xa60
[ 94.562201][ T5312] ? __pfx__printk+0x10/0x10
[ 94.564180][ T5312] ? __pfx_vpanic+0x10/0x10
[ 94.566224][ T5312] ? is_bpf_text_address+0x292/0x2b0
[ 94.568497][ T5312] ? is_bpf_text_address+0x26/0x2b0
[ 94.570724][ T5312] panic+0xc5/0xd0
[ 94.572291][ T5312] ? __pfx_panic+0x10/0x10
[ 94.574212][ T5312] __warn+0x315/0x4c0
[ 94.575843][ T5312] ? debug_print_object+0xec/0x230
[ 94.578035][ T5312] ? debug_print_object+0xec/0x230
[ 94.580221][ T5312] __report_bug+0x276/0x570
[ 94.582276][ T5312] ? check_noncircular+0xda/0x150
[ 94.584379][ T5312] ? debug_print_object+0xec/0x230
[ 94.586438][ T5312] ? __pfx___report_bug+0x10/0x10
[ 94.588595][ T5312] ? lockdep_unlock+0x5c/0xd0
[ 94.590653][ T5312] ? __lock_acquire+0x13e8/0x2cf0
[ 94.592865][ T5312] report_bug_entry+0x19b/0x290
[ 94.595119][ T5312] ? debug_print_object+0x18a/0x230
[ 94.597280][ T5312] ? debug_print_object+0x18f/0x230
[ 94.599375][ T5312] handle_bug+0xce/0x200
[ 94.601115][ T5312] exc_invalid_op+0x1a/0x50
[ 94.603160][ T5312] asm_exc_invalid_op+0x1a/0x20
[ 94.605196][ T5312] RIP: 0010:debug_print_object+0x18a/0x230
[ 94.607645][ T5312] Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 6d 58 52 fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 63 06 93 0b 48 83 c4 10 5b 41 5c
[ 94.615498][ T5312] RSP: 0018:ffffc9000dbe7a10 EFLAGS: 00010246
[ 94.618009][ T5312] RAX: 1ffffffff181f0a0 RBX: dffffc0000000000 RCX: 0000000000000000
[ 94.621277][ T5312] RDX: ffffffff8c6d2140 RSI: ffffffff8c6d1bc0 RDI: ffffffff90840f60
[ 94.624545][ T5312] RBP: ffffffff8c6d2140 R08: ffff8880122f3320 R09: ffffffff8c0f8740
[ 94.627704][ T5312] R10: dffffc0000000000 R11: ffffffff81b3bf00 R12: 0000000000000000
[ 94.630930][ T5312] R13: ffffffff90840f60 R14: ffff8880122f3320 R15: ffffffff8c0f8500
[ 94.634252][ T5312] ? __pfx_hrtimer_debug_hint+0x10/0x10
[ 94.636629][ T5312] ? __pfx_dummy_hrtimer_callback+0x10/0x10
[ 94.639160][ T5312] ? __pfx_dummy_hrtimer_callback+0x10/0x10
[ 94.641695][ T5312] debug_check_no_obj_freed+0x2e3/0x450
[ 94.643998][ T5312] kfree+0x13e/0x640
[ 94.645692][ T5312] ? _raw_spin_unlock_irq+0x23/0x50
[ 94.647740][ T5312] ? dummy_pcm_close+0x9b/0xb0
[ 94.649703][ T5312] dummy_pcm_close+0x9b/0xb0
[ 94.651572][ T5312] snd_pcm_release_substream+0x313/0x490
[ 94.653861][ T5312] snd_pcm_release+0xb6/0x160
[ 94.655785][ T5312] ? __pfx_snd_pcm_release+0x10/0x10
[ 94.658053][ T5312] __fput+0x418/0xa50
[ 94.659764][ T5312] task_work_run+0x1d9/0x270
[ 94.661784][ T5312] ? __pfx_task_work_run+0x10/0x10
[ 94.663884][ T5312] ? do_raw_spin_unlock+0x4d/0x200
[ 94.665907][ T5312] do_exit+0x73a/0x2360
[ 94.667570][ T5312] ? try_to_wake_up+0x8b6/0x14d0
[ 94.669559][ T5312] ? __pfx_do_exit+0x10/0x10
[ 94.671611][ T5312] ? preempt_schedule_thunk+0x16/0x40
[ 94.673985][ T5312] ? preempt_schedule_thunk+0x16/0x40
[ 94.676335][ T5312] do_group_exit+0x22d/0x2f0
[ 94.678444][ T5312] __x64_sys_exit_group+0x3f/0x40
[ 94.680663][ T5312] x64_sys_call+0x18c6/0x18d0
[ 94.682771][ T5312] do_syscall_64+0x166/0x520
[ 94.684770][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.687387][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 94.689615][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.692245][ T5312] RIP: 0033:0x7f40b1b9e0d9
[ 94.694243][ T5312] Code: Unable to access opcode bytes at 0x7f40b1b9e0af.
[ 94.697300][ T5312] RSP: 002b:00007fff04809d38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 94.700845][ T5312] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f40b1b9e0d9
[ 94.704173][ T5312] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000b
[ 94.707381][ T5312] RBP: 00000000000009e8 R08: 00007fff0480a8f7 R09: 000000000000000b
[ 94.710791][ T5312] R10: 00007f40b1e25fa0 R11: 0000000000000246 R12: 0000000000000003
[ 94.714692][ T5312] R13: 00007f40b1e2627c R14: 00007f40b1e26278 R15: 00007f40b1e26270
[ 94.717939][ T5312]
[ 94.719631][ T5312] Kernel Offset: disabled
[ 94.721441][ T5312] Rebooting in 86400 seconds..