program:
r0 = openat$fb1(0xffffff9c, &(0x7f0000000000), 0x100, 0x0)
ioctl$FBIOBLANK(r0, 0x4611, 0x0) (async, rerun: 64)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (rerun: 64)
mount(0x0, &(0x7f0000000240)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x4, 0x0) (async, rerun: 64)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) (rerun: 64)
write(r1, &(0x7f00000000c0)='1', 0x1) (async)
r2 = io_uring_setup(0x1864, &(0x7f0000000000)={0x0, 0x9bdd, 0x40, 0x1, 0x165})
syz_ublk_setup_io_uring(0x5564, &(0x7f00000000c0)={0x0, 0x96d1, 0x22, 0x3, 0x33c, 0x0, r2}, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) (async, rerun: 64)
fspick(r1, &(0x7f0000000040)='./sys\x00', 0x1) (rerun: 64)
[ 93.318592][ T5291] Bluetooth: hci0: command tx timeout
[ 93.380374][ T9] cfg80211: failed to load regulatory.db
[ 93.774509][ T5331] ------------[ cut here ]------------
[ 93.776849][ T5331] Memory manager not clean during takedown.
[ 93.779379][ T5331] WARNING: drivers/gpu/drm/drm_mm.c:966 at drm_mm_takedown+0x54/0x70, CPU#0: syz.0.0/5331
[ 93.783940][ T5331] Modules linked in:
[ 93.785840][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.789451][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.793672][ T5331] RIP: 0010:drm_mm_takedown+0x54/0x70
[ 93.795577][ T5331] Code: 4c 89 f7 e8 2e 8e aa fc 49 8b 06 4c 39 f0 75 0e e8 31 5c 3b fc 5b 41 5e c3 cc cc cc cc cc e8 23 5c 3b fc 48 8d 3d 2c 01 d8 0a <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f
[ 93.802976][ T5331] RSP: 0018:ffffc9000e2ef8e0 EFLAGS: 00010293
[ 93.805842][ T5331] RAX: ffffffff858bc8fd RBX: ffff888034a29c68 RCX: ffff8880397c4a80
[ 93.809210][ T5331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9063ca30
[ 93.812829][ T5331] RBP: ffffffff858a7750 R08: ffff88801ae12580 R09: ffffffff8c5f1c60
[ 93.816078][ T5331] R10: dffffc0000000000 R11: ffffffff858a7750 R12: ffff88801ae12580
[ 93.818867][ T5331] R13: dffffc0000000000 R14: ffff888034a29ca0 R15: dffffc0000000000
[ 93.821771][ T5331] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000
[ 93.825392][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 93.828080][ T5331] CR2: 00007fa8d1f6b230 CR3: 000000004fefc000 CR4: 0000000000352ef0
[ 93.831528][ T5331] Call Trace:
[ 93.833092][ T5331]
[ 93.834338][ T5331] drm_managed_release+0x208/0x380
[ 93.836517][ T5331] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10
[ 93.839106][ T5331] ? __pfx_virtio_gpu_release+0x10/0x10
[ 93.841345][ T5331] drm_dev_put+0xe0/0x120
[ 93.843213][ T5331] fb_release+0x11d/0x140
[ 93.845050][ T5331] ? __pfx_fb_release+0x10/0x10
[ 93.847074][ T5331] __fput+0x418/0xa50
[ 93.848732][ T5331] task_work_run+0x1d9/0x270
[ 93.850725][ T5331] ? __pfx_task_work_run+0x10/0x10
[ 93.854140][ T5331] ? do_raw_spin_unlock+0x4d/0x210
[ 93.856390][ T5331] do_exit+0x73a/0x2360
[ 93.858467][ T5331] ? __pfx_do_exit+0x10/0x10
[ 93.860401][ T5331] ? do_raw_spin_lock+0x12b/0x2f0
[ 93.862853][ T5331] do_group_exit+0x22d/0x2f0
[ 93.864749][ T5331] ? _raw_spin_unlock_irq+0x23/0x50
[ 93.866882][ T5331] get_signal+0x121b/0x12c0
[ 93.868761][ T5331] arch_do_signal_or_restart+0xbb/0x860
[ 93.870926][ T5331] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 93.873398][ T5331] ? ksys_write+0x242/0x270
[ 93.875287][ T5331] exit_to_user_mode_loop+0x104/0x730
[ 93.877452][ T5331] ? rcu_is_watching+0x15/0xb0
[ 93.879519][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.881923][ T5331] do_syscall_64+0x353/0x580
[ 93.883884][ T5331] ? clear_bhb_loop+0x40/0x90
[ 93.885779][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.888161][ T5331] RIP: 0033:0x7fa8d119e019
[ 93.889897][ T5331] Code: Unable to access opcode bytes at 0x7fa8d119dfef.
[ 93.892811][ T5331] RSP: 002b:00007fa8cd5d3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 93.896169][ T5331] RAX: 0000000000000001 RBX: 00007fa8d1426090 RCX: 00007fa8d119e019
[ 93.899342][ T5331] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000004
[ 93.902626][ T5331] RBP: 00007fa8d123500c R08: 0000000000000000 R09: 0000000000000000
[ 93.905666][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.908797][ T5331] R13: 00007fa8d1426128 R14: 00007fa8d1426090 R15: 00007fff687e8278
[ 93.911903][ T5331]
[ 93.913274][ T5331] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 93.916123][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.919813][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.923890][ T5331] Call Trace:
[ 93.925352][ T5331]
[ 93.926604][ T5331] vpanic+0x56c/0xa60
[ 93.928303][ T5331] ? __pfx__printk+0x10/0x10
[ 93.930273][ T5331] ? __pfx_vpanic+0x10/0x10
[ 93.932256][ T5331] ? is_bpf_text_address+0x292/0x2b0
[ 93.934660][ T5331] ? is_bpf_text_address+0x26/0x2b0
[ 93.936948][ T5331] panic+0xc5/0xd0
[ 93.938553][ T5331] ? __pfx_panic+0x10/0x10
[ 93.940402][ T5331] __warn+0x315/0x4c0
[ 93.942116][ T5331] ? drm_mm_takedown+0x54/0x70
[ 93.944200][ T5331] ? drm_mm_takedown+0x54/0x70
[ 93.946227][ T5331] __report_bug+0x276/0x570
[ 93.948197][ T5331] ? fb_release+0x11d/0x140
[ 93.950143][ T5331] ? __fput+0x418/0xa50
[ 93.951998][ T5331] ? task_work_run+0x1d9/0x270
[ 93.954063][ T5331] ? drm_mm_takedown+0x54/0x70
[ 93.956167][ T5331] ? __pfx___report_bug+0x10/0x10
[ 93.958280][ T5331] report_bug_entry+0x19a/0x290
[ 93.960351][ T5331] ? drm_mm_takedown+0x54/0x70
[ 93.962387][ T5331] ? drm_mm_takedown+0x59/0x70
[ 93.964460][ T5331] handle_bug+0xce/0x200
[ 93.966284][ T5331] exc_invalid_op+0x1a/0x50
[ 93.968251][ T5331] asm_exc_invalid_op+0x1a/0x20
[ 93.970354][ T5331] RIP: 0010:drm_mm_takedown+0x54/0x70
[ 93.972697][ T5331] Code: 4c 89 f7 e8 2e 8e aa fc 49 8b 06 4c 39 f0 75 0e e8 31 5c 3b fc 5b 41 5e c3 cc cc cc cc cc e8 23 5c 3b fc 48 8d 3d 2c 01 d8 0a <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f
[ 93.980856][ T5331] RSP: 0018:ffffc9000e2ef8e0 EFLAGS: 00010293
[ 93.983336][ T5331] RAX: ffffffff858bc8fd RBX: ffff888034a29c68 RCX: ffff8880397c4a80
[ 93.986690][ T5331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9063ca30
[ 93.990080][ T5331] RBP: ffffffff858a7750 R08: ffff88801ae12580 R09: ffffffff8c5f1c60
[ 93.993452][ T5331] R10: dffffc0000000000 R11: ffffffff858a7750 R12: ffff88801ae12580
[ 93.996864][ T5331] R13: dffffc0000000000 R14: ffff888034a29ca0 R15: dffffc0000000000
[ 94.000164][ T5331] ? __pfx_drm_gem_init_release+0x10/0x10
[ 94.002508][ T5331] ? __pfx_drm_gem_init_release+0x10/0x10
[ 94.004847][ T5331] ? drm_mm_takedown+0x4d/0x70
[ 94.006923][ T5331] drm_managed_release+0x208/0x380
[ 94.009087][ T5331] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10
[ 94.011730][ T5331] ? __pfx_virtio_gpu_release+0x10/0x10
[ 94.014030][ T5331] drm_dev_put+0xe0/0x120
[ 94.015838][ T5331] fb_release+0x11d/0x140
[ 94.017583][ T5331] ? __pfx_fb_release+0x10/0x10
[ 94.019638][ T5331] __fput+0x418/0xa50
[ 94.021435][ T5331] task_work_run+0x1d9/0x270
[ 94.023406][ T5331] ? __pfx_task_work_run+0x10/0x10
[ 94.025599][ T5331] ? do_raw_spin_unlock+0x4d/0x210
[ 94.027717][ T5331] do_exit+0x73a/0x2360
[ 94.029450][ T5331] ? __pfx_do_exit+0x10/0x10
[ 94.031400][ T5331] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.033487][ T5331] do_group_exit+0x22d/0x2f0
[ 94.035430][ T5331] ? _raw_spin_unlock_irq+0x23/0x50
[ 94.037632][ T5331] get_signal+0x121b/0x12c0
[ 94.039594][ T5331] arch_do_signal_or_restart+0xbb/0x860
[ 94.041925][ T5331] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 94.044469][ T5331] ? ksys_write+0x242/0x270
[ 94.046420][ T5331] exit_to_user_mode_loop+0x104/0x730
[ 94.048724][ T5331] ? rcu_is_watching+0x15/0xb0
[ 94.050807][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.053410][ T5331] do_syscall_64+0x353/0x580
[ 94.055233][ T5331] ? clear_bhb_loop+0x40/0x90
[ 94.057120][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.059431][ T5331] RIP: 0033:0x7fa8d119e019
[ 94.061330][ T5331] Code: Unable to access opcode bytes at 0x7fa8d119dfef.
[ 94.064115][ T5331] RSP: 002b:00007fa8cd5d3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.067314][ T5331] RAX: 0000000000000001 RBX: 00007fa8d1426090 RCX: 00007fa8d119e019
[ 94.070171][ T5331] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000004
[ 94.073139][ T5331] RBP: 00007fa8d123500c R08: 0000000000000000 R09: 0000000000000000
[ 94.076038][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.079000][ T5331] R13: 00007fa8d1426128 R14: 00007fa8d1426090 R15: 00007fff687e8278
[ 94.082110][ T5331]
[ 94.083744][ T5331] Kernel Offset: disabled
[ 94.085467][ T5331] Rebooting in 86400 seconds..