program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000bc0)={&(0x7f0000000680), 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x30, 0x0, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {}, {0x14, 0x17, {0x12, 0x1, @l2={'ib', 0x3a, 'hsr0\x00'}}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x40004) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4cf400003c7b9e7f81e3afb5c14aa1126991e4ce9a6236326251643d09676a5bfe9c0990c11da7db190f62448dafaa6b9e4a5caae4eec04e2da6ebc5", @ANYRES16=r1, @ANYBLOB="010000000000000000001200000008000300", @ANYRES32=r2, @ANYBLOB="05001900020000000a0006000802110000000000"], 0x30}}, 0x0) r3 = timerfd_create(0x0, 0x0) timerfd_settime(r3, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0xf6d, 0x0, 0xd, 0x7fffffff, 0x0, 0x4, 0x200000000000000, 0x0, 0x100, 0x0, 0x702b, 0x6, 0x3, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x1000, 0x2000000000008, 0x9, 0x3, 0x8000000000005a, 0x3}) ioctl$TFD_IOC_SET_TICKS(r3, 0x40085400, &(0x7f0000000100)=0x6) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r5 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r5) write$char_usb(r6, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) r8 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) r10 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r10, 0x0, 0x0, 0x0, &(0x7f0000000c00)={0x11, 0x8847, r9, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) r11 = syz_ublk_setup_io_uring(0x1612, &(0x7f0000000300)={0x0, 0xfd8a, 0x80, 0x3, 0x218}, &(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)) open_by_handle_at(r11, &(0x7f0000000500)=ANY=[@ANYBLOB="3c000000fb00000000fb3c0302c18bde707a3bd2741f94533d0b9e74259be18c35ffb04f8742ed8d8556685ac86890fa9beb586d17b8dda840c4b1e7b1b171536301b43780a71f87"], 0x1416a0) ioctl$DRM_IOCTL_MODE_GETPLANE(r4, 0xc02064b6, &(0x7f00000001c0)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x408e, &(0x7f0000000240)={[{@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x2e}}, {@nombcache}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2}}, {@stripe={'stripe', 0x3d, 0x2004000}}, {@max_batch_time={'max_batch_time', 0x3d, 0x2}}, {@max_batch_time={'max_batch_time', 0x3d, 0x4}}]}, 0x3, 0x43a, &(0x7f0000000780)="$eJzs28tvG0UYAPBv13FKXySU8ugDCBRExCNp0gI9cAGBxAEkJDiUY0jSqtRtUBMkWlUQECpHVIk74ojEX8AJLgg4IXGFO6pUoVxaOBmtvZs4jp0mwY5L/ftJm8zsjjPzeXbs2Z1sAH1rJPuRROyJiN8jYqieXV1gpP7r5tLl6b+XLk8nUa2+9VdSK3dj6fJ0UbR43e48M5pGpJ8lcahFvfMXL52dqlRmL+T58YVz74/PX7z07JlzU6dnT8+enzxx4vixiReen3yuI3Fmbbpx8KO5wwdee+fqG9Mnr77787dJEX9THB0yst7BJ6rVDlfXW3sb0slADxvCppQiIuuucm38D0UpVjpvKF79tKeNA7qqWq1Wd7c/vFgF7mBJbLTk2fzzArgzFF/02fVvsW3T1OO2cP2l+gVQFvfNfKsfGYg0L1Nuur7tpJGIOLn4z1fZFt25DwEAsMr32fznmVbzvzTubyh3d742NBwR90TEvoi4NyL2R8R9EbWyD0TEg5usv3mRZO38J722pcA2KJv/vZivba2e/xWzvxgu5bm9tfjLyakzldmj+XsyGuUdWX5inTp+eOW3L9oda5z/ZVtWfzEXzNtxbWDH6tfMTC1M/ZeYG13/JOLgQKv4k+WVgCQiDkTEwS3Wceapbw63O9Yu/vJG/nAH1pmqX0c8We//xWiKv5Csvz45fldUZo+OF2fFWr/8euXNdvXfuv+7K+v/XS3P/+X4h5PG9dr5zddx5Y/P217TbPX8H0zerqUH830fTi0sXJiIGExerze6cf/kymuLfFE+i3/0SOvxvy9W3olDEZGdxA9FxMMR8Uje9kcj4rGIOLJO/D+9/Ph7W4+/u7L4ZzbV/yuJwWje0zpROvvjd6sqHd5M/Fn/H6+lRvM9G/n820i7tnY2AwAAwP9PGhF7IknHltNpOjZW/3/5/bErrczNLzx9au6D8zP1ZwSGo5wWd7qGGu6HTuSX9UV+sil/LL9v/GVpZy0/Nj1Xmel18NDndrcZ/5k/S71uHdB1nteC/mX8Q/8y/qF/Gf/Qv1qM/529aAew/Vp9/3/cg3YA269p/Fv2gz7i+h/6l/EP/cv4h740vzNu/ZC8hMSaRKS3RTMkupTo9ScTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZ/wbAAD//9E940M=") r13 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r13, 0x40286608, &(0x7f0000000080)={@desc={0x1, 0x0, @auto="1738e34e556bc5df"}}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000300), 0x3, r12}) ioctl$DRM_IOCTL_MODE_ATOMIC(r4, 0xc03864bc, &(0x7f0000000580)={0x600, 0x1, &(0x7f0000000180)=[r12], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r15, r14, r15], &(0x7f00000003c0), 0x0, 0x2}) [ 93.654168][ T46] Bluetooth: hci0: command tx timeout [ 93.989765][ T1369] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.139571][ T1369] usb 5-1: Using ep0 maxpacket: 8 [ 94.141383][ T1369] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 94.143231][ T1369] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 94.143255][ T1369] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 94.143276][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 94.143291][ T1369] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 94.143304][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 94.143322][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 94.143336][ T1369] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 94.143351][ T1369] usb 5-1: config 168 interface 0 has no altsetting 0 [ 94.144366][ T1369] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 94.144387][ T1369] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 94.144408][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 94.144422][ T1369] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 94.144441][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 94.144454][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 94.144467][ T1369] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 94.144478][ T1369] usb 5-1: config 168 interface 0 has no altsetting 0 [ 94.145435][ T1369] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 94.145454][ T1369] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 94.145475][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 94.145488][ T1369] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 94.145499][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 94.145513][ T1369] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 94.145527][ T1369] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 94.145540][ T1369] usb 5-1: config 168 interface 0 has no altsetting 0 [ 94.148783][ T1369] usb 5-1: string descriptor 0 read error: -22 [ 94.151035][ T1369] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.340688][ T1369] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 94.520587][ T1369] usb 5-1: USB disconnect, device number 2 [ 94.745948][ T5321] adutux: No device or device unplugged -19 [ 94.794030][ T5321] loop0: detected capacity change from 0 to 512 [ 94.814940][ T5321] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 94.814956][ T5321] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 94.882203][ T5321] EXT4-fs (loop0): 1 truncate cleaned up [ 94.900571][ T5321] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.906675][ T5321] EXT4-fs (loop0): Online resizing not supported with sparse_super2 [ 94.948944][ T13] ================================================================== [ 94.948958][ T13] BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 94.949048][ T13] Read of size 1 at addr ffff8880138c8009 by task kworker/u4:1/13 [ 94.949058][ T13] [ 94.949066][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 94.949078][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.949086][ T13] Workqueue: events_unbound commit_work [ 94.949101][ T13] Call Trace: [ 94.949118][ T13] [ 94.949123][ T13] dump_stack_lvl+0xe8/0x150 [ 94.949152][ T13] print_address_description+0x55/0x1e0 [ 94.949168][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 94.949180][ T13] print_report+0x58/0x70 [ 94.949193][ T13] kasan_report+0x117/0x150 [ 94.949216][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 94.949231][ T13] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 94.949243][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 94.949266][ T13] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 94.949279][ T13] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 94.949341][ T13] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 94.949356][ T13] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 94.949369][ T13] commit_tail+0x2b1/0x3c0 [ 94.949382][ T13] ? process_scheduled_works+0x97a/0x1630 [ 94.949409][ T13] process_scheduled_works+0xc3d/0x1630 [ 94.949429][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.949466][ T13] ? assign_work+0x3cf/0x5d0 [ 94.949480][ T13] worker_thread+0xa47/0xfb0 [ 94.949500][ T13] kthread+0x38b/0x480 [ 94.949511][ T13] ? __pfx_worker_thread+0x10/0x10 [ 94.949525][ T13] ? __pfx_kthread+0x10/0x10 [ 94.949535][ T13] ret_from_fork+0x514/0xb70 [ 94.949557][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 94.949567][ T13] ? __switch_to+0xc89/0x1420 [ 94.949583][ T13] ? __pfx_kthread+0x10/0x10 [ 94.949593][ T13] ret_from_fork_asm+0x1a/0x30 [ 94.949614][ T13] [ 94.949619][ T13] [ 94.949622][ T13] Allocated by task 5321: [ 94.949638][ T13] kasan_save_track+0x3e/0x80 [ 94.949654][ T13] __kasan_kmalloc+0x93/0xb0 [ 94.949664][ T13] __kmalloc_cache_noprof+0x321/0x600 [ 94.949688][ T13] drm_atomic_helper_crtc_duplicate_state+0x72/0xb0 [ 94.949702][ T13] drm_atomic_get_crtc_state+0x1b3/0x570 [ 94.949715][ T13] drm_atomic_set_property+0x17b/0x4040 [ 94.949729][ T13] drm_mode_atomic_ioctl+0x817/0x2550 [ 94.949742][ T13] drm_ioctl_kernel+0x2df/0x3b0 [ 94.949754][ T13] drm_ioctl+0x70e/0xba0 [ 94.949764][ T13] __se_sys_ioctl+0xfc/0x170 [ 94.949787][ T13] do_syscall_64+0x166/0x520 [ 94.949798][ T13] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.949809][ T13] [ 94.949811][ T13] Freed by task 1369: [ 94.949817][ T13] kasan_save_track+0x3e/0x80 [ 94.949831][ T13] kasan_save_free_info+0x40/0x50 [ 94.949849][ T13] __kasan_slab_free+0x5c/0x80 [ 94.949858][ T13] kfree+0x1c5/0x650 [ 94.949871][ T13] drm_atomic_commit_default_clear+0x47f/0xf00 [ 94.949883][ T13] __drm_atomic_commit_free+0xb4/0x230 [ 94.949894][ T13] drm_atomic_helper_dirtyfb+0xee3/0xfd0 [ 94.949910][ T13] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 94.949925][ T13] drm_fb_helper_damage_work+0x84c/0xf20 [ 94.949936][ T13] process_scheduled_works+0xc3d/0x1630 [ 94.949949][ T13] worker_thread+0xa47/0xfb0 [ 94.949961][ T13] kthread+0x38b/0x480 [ 94.949970][ T13] ret_from_fork+0x514/0xb70 [ 94.949979][ T13] ret_from_fork_asm+0x1a/0x30 [ 94.949993][ T13] [ 94.949995][ T13] The buggy address belongs to the object at ffff8880138c8000 [ 94.949995][ T13] which belongs to the cache kmalloc-512 of size 512 [ 94.950005][ T13] The buggy address is located 9 bytes inside of [ 94.950005][ T13] freed 512-byte region [ffff8880138c8000, ffff8880138c8200) [ 94.950016][ T13] [ 94.950019][ T13] The buggy address belongs to the physical page: [ 94.950026][ T13] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x138c8 [ 94.950036][ T13] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 94.950045][ T13] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 94.950057][ T13] page_type: f5(slab) [ 94.950067][ T13] raw: 00fff00000000040 ffff88801b041c80 dead000000000122 0000000000000000 [ 94.950076][ T13] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 94.950085][ T13] head: 00fff00000000040 ffff88801b041c80 dead000000000122 0000000000000000 [ 94.950125][ T13] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 94.950135][ T13] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 94.950143][ T13] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 94.950148][ T13] page dumped because: kasan: bad access detected [ 94.950154][ T13] page_owner tracks the page as allocated [ 94.950158][ T13] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1053, tgid 1053 (kworker/u4:7), ts 94755121345 [ 94.950175][ T13] post_alloc_hook+0x1f9/0x250 [ 94.950189][ T13] get_page_from_freelist+0x2209/0x2280 [ 94.950203][ T13] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 94.950219][ T13] allocate_slab+0x7d/0x620 [ 94.950229][ T13] refill_objects+0x2d5/0x350 [ 94.950240][ T13] __pcs_replace_empty_main+0x2c8/0x6c0 [ 94.950250][ T13] __kmalloc_cache_noprof+0x39b/0x600 [ 94.950264][ T13] batadv_forw_packet_alloc+0x178/0x370 [ 94.950286][ T13] batadv_iv_ogm_queue_add+0x8b8/0xd90 [ 94.950302][ T13] batadv_iv_ogm_schedule+0xafb/0xfc0 [ 94.950317][ T13] batadv_iv_send_outstanding_bat_ogm_packet+0x622/0x740 [ 94.950333][ T13] process_scheduled_works+0xc3d/0x1630 [ 94.950344][ T13] worker_thread+0xa47/0xfb0 [ 94.950357][ T13] kthread+0x38b/0x480 [ 94.950366][ T13] ret_from_fork+0x514/0xb70 [ 94.950374][ T13] ret_from_fork_asm+0x1a/0x30 [ 94.950388][ T13] page last free pid 70 tgid 70 ts 94582403537 stack trace: [ 94.950395][ T13] free_unref_folios+0xdc2/0x14e0 [ 94.950408][ T13] shrink_folio_list+0x2be2/0x5250 [ 94.950430][ T13] evict_folios+0x3055/0x3fb0 [ 94.950445][ T13] try_to_shrink_lruvec+0xe3b/0x1340 [ 94.950458][ T13] shrink_one+0x233/0x730 [ 94.950471][ T13] shrink_node+0x35d0/0x3e30 [ 94.950484][ T13] kswapd+0x185e/0x32c0 [ 94.950494][ T13] kthread+0x38b/0x480 [ 94.950503][ T13] ret_from_fork+0x514/0xb70 [ 94.950511][ T13] ret_from_fork_asm+0x1a/0x30 [ 94.950526][ T13] [ 94.950529][ T13] Memory state around the buggy address: [ 94.950535][ T13] ffff8880138c7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 94.950542][ T13] ffff8880138c7f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 94.950548][ T13] >ffff8880138c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.950554][ T13] ^ [ 94.950559][ T13] ffff8880138c8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.950566][ T13] ffff8880138c8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.950571][ T13] ================================================================== [ 95.234114][ T13] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.277005][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full) [ 95.281073][ T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.285405][ T13] Workqueue: events_unbound commit_work [ 95.287866][ T13] Call Trace: [ 95.289351][ T13] [ 95.290541][ T13] vpanic+0x56d/0xa60 [ 95.292339][ T13] ? __pfx_vpanic+0x10/0x10 [ 95.294458][ T13] panic+0xc5/0xd0 [ 95.296145][ T13] ? __pfx_panic+0x10/0x10 [ 95.298113][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 95.300482][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.303433][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 95.305810][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.308744][ T13] check_panic_on_warn+0x89/0xb0 [ 95.310997][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.313888][ T13] end_report+0x73/0x170 [ 95.315744][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.318336][ T13] kasan_report+0x128/0x150 [ 95.320226][ T13] ? drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.322894][ T13] drm_atomic_helper_wait_for_vblanks+0x317/0x8f0 [ 95.325680][ T13] ? preempt_schedule_thunk+0x16/0x40 [ 95.327963][ T13] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 95.330999][ T13] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 95.333359][ T13] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 95.335883][ T13] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 95.338294][ T13] commit_tail+0x2b1/0x3c0 [ 95.340237][ T13] ? process_scheduled_works+0x97a/0x1630 [ 95.342691][ T13] process_scheduled_works+0xc3d/0x1630 [ 95.345074][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.347611][ T13] ? assign_work+0x3cf/0x5d0 [ 95.349647][ T13] worker_thread+0xa47/0xfb0 [ 95.351388][ T13] kthread+0x38b/0x480 [ 95.353170][ T13] ? __pfx_worker_thread+0x10/0x10 [ 95.355478][ T13] ? __pfx_kthread+0x10/0x10 [ 95.357565][ T13] ret_from_fork+0x514/0xb70 [ 95.359749][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 95.361944][ T13] ? __switch_to+0xc89/0x1420 [ 95.364106][ T13] ? __pfx_kthread+0x10/0x10 [ 95.366250][ T13] ret_from_fork_asm+0x1a/0x30 [ 95.368411][ T13] [ 95.370341][ T13] Kernel Offset: disabled [ 95.372312][ T13] Rebooting in 86400 seconds..