program: syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040991100b00000000000010902200001010080320904000002000000000705810200020007050202"], 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000440)='debugfs\x00', 0x4004, 0x0) (async) r0 = open(&(0x7f0000000880)='./dev/gnss0\x00', 0x0, 0xfc559a7289ff8d5e) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/gnss0\x00', 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x5, 0x200) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000680)={r3, 0x1ff, 0x0, 0x1, 0x3, [0x0, 0x0, 0x0, 0x0], [0x800020], [0x0, 0x1001000, 0x1], [0x0, 0x0, 0xfffffffffefffffc, 0x9]}) ioctl$DRM_IOCTL_MODE_ADDFB2(0xffffffffffffffff, 0xc06864b8, &(0x7f00000001c0)={0x0, 0x0, 0x3ff, 0x34325241, 0x0, [r4, 0x0, 0x0, r5], [0x2b8], [0x0, 0x0, 0x100], [0x0, 0x0, 0x7]}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000180)={&(0x7f0000000080)=[r7, r7, 0x0, 0x0, 0x0, r7, r7, r7], 0x0, 0x8}) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r6, 0xc01064c5, &(0x7f00000001c0)={&(0x7f00000000c0)=[r7, r7], 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000ac0)={0x0, 0x1}) r9 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r9, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r9, 0xc01864c1, &(0x7f00000009c0)={r10}) (async) r11 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r11, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r11, 0xc03064ca, &(0x7f0000000280)={&(0x7f0000000040)=[r12, r12], &(0x7f0000000200), 0x0, 0x2, 0xd}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01864c2, &(0x7f0000000b00)={0x0, 0x1, r1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000b40)={0x0, 0x1, r0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000b80)={0x0, 0x1}) (async) r16 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r16, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r16, 0xc01864cd, &(0x7f0000000100)={&(0x7f0000000240)=[r13, 0x0, r13, r14, 0x0, 0x0, r17], &(0x7f00000002c0), 0x3ffffffffffffff1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000bc0)) (async) ioctl$DRM_IOCTL_PANTHOR_VM_BIND(r0, 0xc0186443, &(0x7f0000000e80)={0x0, 0x1, {0x30, 0x9, &(0x7f0000000cc0)=[{0xf0000006, 0x0, 0x7, 0xb0, 0xfff, {0x10, 0x4, &(0x7f0000000300)=[{0x80000000, 0x0, 0x93a}, {0x1, 0x0, 0x5}, {0x80000000, 0x0, 0x9}, {0x0, 0x0, 0xffff}]}}, {0x2, 0x0, 0x10001, 0x6, 0x5, {0x10, 0x2, &(0x7f00000003c0)=[{0xff, 0x0, 0x200}, {0x80000000, 0x0, 0x8c6b}]}}, {0x10000000, 0x0, 0x1, 0x8, 0x0, {0x10, 0x1, &(0x7f0000000480)=[{0x1, 0x0, 0x3ca}]}}, {0x20000000, 0x0, 0x7fffffff, 0x0, 0x9, {0x10, 0x8, &(0x7f0000000640)=[{0x1, 0x0, 0x7}, {0xff, 0x0, 0xffffffffffffffff}, {0x80000000, 0x0, 0xc}, {0x0, 0x0, 0x2}, {0xff, 0x0, 0x4}, {0xff, 0x0, 0x100}, {0x80000000, 0x0, 0xff}, {0x1, 0x0, 0x81}]}}, {0x20000000, 0x0, 0x2, 0x8, 0x2, {0x10, 0x2, &(0x7f0000000740)=[{0xff, 0x0, 0x8001}, {0x1}]}}, {0xf0000000, 0x0, 0x1, 0x400, 0x9, {0x10, 0x2, &(0x7f0000000800)=[{0x80000000, r8, 0x2b80}, {0x0, 0x0, 0x9}]}}, {0x2, 0x0, 0x4, 0x400, 0x1, {0x10, 0x3, &(0x7f0000000940)=[{0xff, 0x0, 0xfffffffffffffffc}, {0x0, 0x0, 0x3}, {0xff, 0x0, 0xfffffffffffffffe}]}}, {0xf0000000, 0x0, 0x5198, 0x4a6, 0x6, {0x10, 0x7, &(0x7f0000000a40)=[{0x1}, {0x0, 0x0, 0x200}, {0x1, 0x0, 0x7f}, {0x0, 0x0, 0xa}, {0xff}, {0x0, 0x0, 0x464a7e4b}, {0x80000000, 0x0, 0xf00}]}}, {0x1, r4, 0x1f, 0x5, 0x0, {0x10, 0x9, &(0x7f0000000c00)=[{0xff, r7, 0x81}, {0x9046d25b69e7ec1f, r8, 0x5}, {0x0, r10, 0x1}, {0x80000000, r12, 0x2}, {0x80000000, r13, 0x4000000000003}, {0x80000000, r14, 0xd38e}, {0xff, r15, 0x8}, {0x1, r17}, {0xff, 0x0, 0x61}]}}]}}) [ 94.602140][ T4641] Bluetooth: hci0: command tx timeout [ 94.808897][ T5315] ------------[ cut here ]------------ [ 94.808908][ T5315] 1 [ 94.808912][ T5315] WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0, CPU#0: syz.0.0/5315 [ 94.817156][ T5315] Modules linked in: [ 94.818795][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.822609][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.827030][ T5315] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 [ 94.829983][ T5315] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 6c a0 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 7c 12 54 0e 67 48 0f b9 3a e9 68 [ 94.838381][ T5315] RSP: 0018:ffffc9000f337920 EFLAGS: 00010246 [ 94.841087][ T5315] RAX: ffffc9000f337900 RBX: 1ffff92001e66f28 RCX: 0000000000000000 [ 94.844510][ T5315] RDX: 0000000000000000 RSI: 0000000000000016 RDI: ffffc9000f337988 [ 94.847967][ T5315] RBP: ffffc9000f337a10 R08: ffffc9000f337987 R09: 0000000000000000 [ 94.851082][ T5315] R10: ffffc9000f337960 R11: fffff52001e66f31 R12: 0000000000000000 [ 94.854674][ T5315] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000 [ 94.858107][ T5315] FS: 00007ff0444c06c0(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000 [ 94.862903][ T5315] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.865626][ T5315] CR2: 00007ff04445cfe8 CR3: 0000000043b61000 CR4: 0000000000352ef0 [ 94.868652][ T5315] Call Trace: [ 94.870042][ T5315] [ 94.871547][ T5315] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 94.874114][ T5315] ? __pfx_policy_nodemask+0x10/0x10 [ 94.876414][ T5315] alloc_pages_mpol+0x21e/0x390 [ 94.878605][ T5315] ? drm_syncobj_array_find+0x3a/0x440 [ 94.880890][ T5315] ___kmalloc_large_node+0x4f/0x120 [ 94.883130][ T5315] __kmalloc_large_node_noprof+0x18/0x90 [ 94.885334][ T5315] __kmalloc_noprof+0x3fb/0x720 [ 94.887384][ T5315] ? drm_syncobj_array_find+0x3a/0x440 [ 94.889656][ T5315] ? lock_acquire+0x115/0x350 [ 94.891973][ T5315] drm_syncobj_array_find+0x3a/0x440 [ 94.894200][ T5315] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 94.897021][ T5315] drm_ioctl_kernel+0x2df/0x3b0 [ 94.899094][ T5315] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 94.901952][ T5315] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 94.904176][ T5315] drm_ioctl+0x70e/0xba0 [ 94.905900][ T5315] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 94.908619][ T5315] ? __pfx_drm_ioctl+0x10/0x10 [ 94.910535][ T5315] ? __fget_files+0x2a/0x420 [ 94.912430][ T5315] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.914396][ T5315] ? __pfx_drm_ioctl+0x10/0x10 [ 94.916279][ T5315] __se_sys_ioctl+0xfc/0x170 [ 94.918084][ T5315] do_syscall_64+0x166/0x520 [ 94.919946][ T5315] ? trace_irq_disable+0x3b/0x140 [ 94.922164][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.924583][ T5315] ? clear_bhb_loop+0x70/0xc0 [ 94.926453][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.928845][ T5315] RIP: 0033:0x7ff04359e159 [ 94.930755][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.939757][ T5315] RSP: 002b:00007ff0444bffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.943263][ T5315] RAX: ffffffffffffffda RBX: 00007ff043826090 RCX: 00007ff04359e159 [ 94.946542][ T5315] RDX: 0000200000000100 RSI: 00000000c01864cd RDI: 0000000000000004 [ 94.950024][ T5315] RBP: 00007ff04363506b R08: 0000000000000000 R09: 0000000000000000 [ 94.953488][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.956769][ T5315] R13: 00007ff043826128 R14: 00007ff043826090 R15: 00007ffed5dad5b8 [ 94.959975][ T5315] [ 94.961343][ T5315] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.964299][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.967891][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.971957][ T5315] Call Trace: [ 94.973352][ T5315] [ 94.974629][ T5315] vpanic+0x56d/0xa60 [ 94.976281][ T5315] ? __pfx__printk+0x10/0x10 [ 94.978249][ T5315] ? __pfx_vpanic+0x10/0x10 [ 94.980191][ T5315] ? is_bpf_text_address+0x292/0x2b0 [ 94.982460][ T5315] ? is_bpf_text_address+0x26/0x2b0 [ 94.984635][ T5315] panic+0xc5/0xd0 [ 94.986247][ T5315] ? __pfx_panic+0x10/0x10 [ 94.988244][ T5315] __warn+0x315/0x4c0 [ 94.990012][ T5315] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 94.994220][ T5315] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 94.996835][ T5315] __report_bug+0x276/0x570 [ 94.998865][ T5315] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.001365][ T5315] ? __pfx___report_bug+0x10/0x10 [ 95.003487][ T5315] ? is_bpf_text_address+0x292/0x2b0 [ 95.005615][ T5315] ? is_bpf_text_address+0x26/0x2b0 [ 95.007713][ T5315] ? kernel_text_address+0xa5/0xe0 [ 95.009743][ T5315] ? __kernel_text_address+0xd/0x30 [ 95.011852][ T5315] ? unwind_get_return_address+0x4d/0x90 [ 95.014112][ T5315] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.016565][ T5315] report_bug+0x16b/0x220 [ 95.018496][ T5315] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.021185][ T5315] ? __alloc_frozen_pages_noprof+0x427/0x5a0 [ 95.023792][ T5315] handle_bug+0x9c/0x200 [ 95.025632][ T5315] exc_invalid_op+0x1a/0x50 [ 95.027634][ T5315] asm_exc_invalid_op+0x1a/0x20 [ 95.029834][ T5315] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 [ 95.032741][ T5315] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 6c a0 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 7c 12 54 0e 67 48 0f b9 3a e9 68 [ 95.041024][ T5315] RSP: 0018:ffffc9000f337920 EFLAGS: 00010246 [ 95.043618][ T5315] RAX: ffffc9000f337900 RBX: 1ffff92001e66f28 RCX: 0000000000000000 [ 95.047037][ T5315] RDX: 0000000000000000 RSI: 0000000000000016 RDI: ffffc9000f337988 [ 95.050500][ T5315] RBP: ffffc9000f337a10 R08: ffffc9000f337987 R09: 0000000000000000 [ 95.053877][ T5315] R10: ffffc9000f337960 R11: fffff52001e66f31 R12: 0000000000000000 [ 95.057230][ T5315] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000 [ 95.060518][ T5315] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 95.063299][ T5315] ? __pfx_policy_nodemask+0x10/0x10 [ 95.065574][ T5315] alloc_pages_mpol+0x21e/0x390 [ 95.067721][ T5315] ? drm_syncobj_array_find+0x3a/0x440 [ 95.070120][ T5315] ___kmalloc_large_node+0x4f/0x120 [ 95.072464][ T5315] __kmalloc_large_node_noprof+0x18/0x90 [ 95.074920][ T5315] __kmalloc_noprof+0x3fb/0x720 [ 95.077085][ T5315] ? drm_syncobj_array_find+0x3a/0x440 [ 95.079715][ T5315] ? lock_acquire+0x115/0x350 [ 95.082271][ T5315] drm_syncobj_array_find+0x3a/0x440 [ 95.085068][ T5315] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 95.088253][ T5315] drm_ioctl_kernel+0x2df/0x3b0 [ 95.090685][ T5315] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 95.094099][ T5315] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 95.096452][ T5315] drm_ioctl+0x70e/0xba0 [ 95.098364][ T5315] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 95.101233][ T5315] ? __pfx_drm_ioctl+0x10/0x10 [ 95.103509][ T5315] ? __fget_files+0x2a/0x420 [ 95.106014][ T5315] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.108501][ T5315] ? __pfx_drm_ioctl+0x10/0x10 [ 95.110730][ T5315] __se_sys_ioctl+0xfc/0x170 [ 95.112685][ T5315] do_syscall_64+0x166/0x520 [ 95.114489][ T5315] ? trace_irq_disable+0x3b/0x140 [ 95.116509][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.119091][ T5315] ? clear_bhb_loop+0x70/0xc0 [ 95.121116][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.123487][ T5315] RIP: 0033:0x7ff04359e159 [ 95.125997][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.133687][ T5315] RSP: 002b:00007ff0444bffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.137218][ T5315] RAX: ffffffffffffffda RBX: 00007ff043826090 RCX: 00007ff04359e159 [ 95.140539][ T5315] RDX: 0000200000000100 RSI: 00000000c01864cd RDI: 0000000000000004 [ 95.143897][ T5315] RBP: 00007ff04363506b R08: 0000000000000000 R09: 0000000000000000 [ 95.146954][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.149862][ T5315] R13: 00007ff043826128 R14: 00007ff043826090 R15: 00007ffed5dad5b8 [ 95.153029][ T5315] [ 95.154755][ T5315] Kernel Offset: disabled [ 95.156479][ T5315] Rebooting in 86400 seconds..