program:
r0 = syz_open_dev$dri(&(0x7f0000000040), 0xcaf9, 0x60000)
ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1})
ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f00000000c0))
ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
socket$packet(0x11, 0x2, 0x300)
r2 = syz_open_dev$video4linux(&(0x7f0000000300), 0xce0, 0x800)
ioctl$VIDIOC_S_EDID(r2, 0xc0285629, &(0x7f0000000340)={0x0, 0x8001, 0xd, '\x00', &(0x7f0000000380)=0x7})
ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f00000002c0)={0x2})
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x1002})
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'batadv0\x00'})
sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newlink={0x20, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20129, 0x1}}, 0x20}, 0x1, 0x0, 0x0, 0x58}, 0x4000010)
write(r1, &(0x7f0000000280)="ffffffffffffc011223344554305000f32ffff90000100112233445500112233445500ff0000", 0xfdef)
mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x1000, 0xfff)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x300c804, &(0x7f0000000500)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x7f1}}]}})
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='mountinfo\x00')
read$FUSE(r6, &(0x7f0000000600)={0x2020}, 0x2020)
socket$inet(0x2, 0x3, 0x8)
syz_emit_ethernet(0x22, &(0x7f00000003c0)=ANY=[@ANYBLOB="080045020014006500000208907c64010100ffffffff"], 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r0, 0xc02864c3, &(0x7f0000000000)={&(0x7f0000000180), 0x400000000000007, 0x3ffffffffffffec7})
[ 103.081176][ T4641] Bluetooth: hci0: command tx timeout
[ 103.254397][ T5329] ------------[ cut here ]------------
[ 103.254410][ T5329] 1
[ 103.254415][ T5329] WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0, CPU#0: syz.0.0/5329
[ 103.264598][ T5329] Modules linked in:
[ 103.266491][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.270984][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.276921][ T5329] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0
[ 103.280815][ T5329] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 08 b4 37 0f 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d bc 27 53 0f 67 48 0f b9 3a e9 68
[ 103.290440][ T5329] RSP: 0018:ffffc9000ea6f8a0 EFLAGS: 00010246
[ 103.293604][ T5329] RAX: ffffc9000ea6f800 RBX: 1ffff92001d4df18 RCX: 0000000000000000
[ 103.297186][ T5329] RDX: 0000000000000000 RSI: 0000000000000016 RDI: ffffc9000ea6f908
[ 103.300998][ T5329] RBP: ffffc9000ea6f998 R08: ffffc9000ea6f907 R09: 0000000000000000
[ 103.304521][ T5329] R10: ffffc9000ea6f8e0 R11: fffff52001d4df21 R12: 0000000000000000
[ 103.308319][ T5329] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000
[ 103.312656][ T5329] FS: 00007f055046f6c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
[ 103.316631][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 103.319548][ T5329] CR2: 00007f055035d9d0 CR3: 000000000095a000 CR4: 0000000000352ef0
[ 103.322995][ T5329] Call Trace:
[ 103.324573][ T5329]
[ 103.325831][ T5329] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 103.328649][ T5329] ? __pfx_policy_nodemask+0x10/0x10
[ 103.331150][ T5329] ? kasan_save_track+0x4f/0x80
[ 103.333417][ T5329] ? kasan_save_track+0x3e/0x80
[ 103.335510][ T5329] ? kasan_save_free_info+0x40/0x50
[ 103.337815][ T5329] ? kfree+0x1c5/0x650
[ 103.339658][ T5329] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 103.342121][ T5329] ? security_file_ioctl+0xc3/0x2a0
[ 103.344299][ T5329] ? __se_sys_ioctl+0x47/0x170
[ 103.346025][ T5329] ? do_syscall_64+0x166/0x520
[ 103.348053][ T5329] alloc_pages_mpol+0x21e/0x390
[ 103.350171][ T5329] ? drm_syncobj_array_find+0x3a/0x440
[ 103.352587][ T5329] ___kmalloc_large_node+0x4f/0x120
[ 103.354816][ T5329] __kmalloc_large_node_noprof+0x18/0x90
[ 103.357321][ T5329] __kmalloc_noprof+0x3fb/0x720
[ 103.359672][ T5329] ? drm_syncobj_array_find+0x3a/0x440
[ 103.362057][ T5329] drm_syncobj_array_find+0x3a/0x440
[ 103.364373][ T5329] drm_syncobj_wait_ioctl+0x1fa/0x690
[ 103.366737][ T5329] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10
[ 103.369446][ T5329] drm_ioctl_kernel+0x2df/0x3b0
[ 103.371276][ T5329] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10
[ 103.373459][ T5329] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 103.375364][ T5329] drm_ioctl+0x70e/0xba0
[ 103.377067][ T5329] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10
[ 103.380037][ T5329] ? __pfx_drm_ioctl+0x10/0x10
[ 103.382258][ T5329] ? __fget_files+0x2a/0x420
[ 103.384388][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20
[ 103.389556][ T5329] ? __pfx_drm_ioctl+0x10/0x10
[ 103.391758][ T5329] __se_sys_ioctl+0xfc/0x170
[ 103.393989][ T5329] do_syscall_64+0x166/0x520
[ 103.396022][ T5329] ? trace_irq_disable+0x3b/0x140
[ 103.398588][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.401532][ T5329] ? clear_bhb_loop+0x70/0xc0
[ 103.403586][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.406114][ T5329] RIP: 0033:0x7f054f59e559
[ 103.408079][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.416146][ T5329] RSP: 002b:00007f055046efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 103.419844][ T5329] RAX: ffffffffffffffda RBX: 00007f054f825fa0 RCX: 00007f054f59e559
[ 103.423088][ T5329] RDX: 0000200000000000 RSI: 00000000c02864c3 RDI: 0000000000000003
[ 103.426618][ T5329] RBP: 00007f054f635b20 R08: 0000000000000000 R09: 0000000000000000
[ 103.431368][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.434963][ T5329] R13: 00007f054f826038 R14: 00007f054f825fa0 R15: 00007fff7192a218
[ 103.438509][ T5329]
[ 103.440100][ T5329] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 103.443347][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.447236][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.451424][ T5329] Call Trace:
[ 103.452774][ T5329]
[ 103.454019][ T5329] vpanic+0x56d/0xa60
[ 103.455711][ T5329] ? __pfx__printk+0x10/0x10
[ 103.457572][ T5329] ? __pfx_vpanic+0x10/0x10
[ 103.459448][ T5329] ? is_bpf_text_address+0x292/0x2b0
[ 103.461682][ T5329] ? is_bpf_text_address+0x26/0x2b0
[ 103.463943][ T5329] panic+0xc5/0xd0
[ 103.465689][ T5329] ? __pfx_panic+0x10/0x10
[ 103.467706][ T5329] __warn+0x315/0x4c0
[ 103.469338][ T5329] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 103.471808][ T5329] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 103.474167][ T5329] __report_bug+0x276/0x570
[ 103.476117][ T5329] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 103.478729][ T5329] ? __pfx___report_bug+0x10/0x10
[ 103.480972][ T5329] ? is_bpf_text_address+0x26/0x2b0
[ 103.483283][ T5329] ? is_bpf_text_address+0x292/0x2b0
[ 103.485590][ T5329] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 103.488136][ T5329] report_bug+0x16b/0x220
[ 103.489966][ T5329] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 103.492487][ T5329] ? __alloc_frozen_pages_noprof+0x427/0x5a0
[ 103.495049][ T5329] handle_bug+0x9c/0x200
[ 103.496800][ T5329] exc_invalid_op+0x1a/0x50
[ 103.498649][ T5329] asm_exc_invalid_op+0x1a/0x20
[ 103.500709][ T5329] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0
[ 103.503472][ T5329] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 08 b4 37 0f 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d bc 27 53 0f 67 48 0f b9 3a e9 68
[ 103.511551][ T5329] RSP: 0018:ffffc9000ea6f8a0 EFLAGS: 00010246
[ 103.514174][ T5329] RAX: ffffc9000ea6f800 RBX: 1ffff92001d4df18 RCX: 0000000000000000
[ 103.517721][ T5329] RDX: 0000000000000000 RSI: 0000000000000016 RDI: ffffc9000ea6f908
[ 103.521049][ T5329] RBP: ffffc9000ea6f998 R08: ffffc9000ea6f907 R09: 0000000000000000
[ 103.524207][ T5329] R10: ffffc9000ea6f8e0 R11: fffff52001d4df21 R12: 0000000000000000
[ 103.527349][ T5329] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000
[ 103.530527][ T5329] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 103.532856][ T5329] ? __pfx_policy_nodemask+0x10/0x10
[ 103.534969][ T5329] ? kasan_save_track+0x4f/0x80
[ 103.537080][ T5329] ? kasan_save_track+0x3e/0x80
[ 103.539160][ T5329] ? kasan_save_free_info+0x40/0x50
[ 103.541415][ T5329] ? kfree+0x1c5/0x650
[ 103.543039][ T5329] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 103.545231][ T5329] ? security_file_ioctl+0xc3/0x2a0
[ 103.547306][ T5329] ? __se_sys_ioctl+0x47/0x170
[ 103.549427][ T5329] ? do_syscall_64+0x166/0x520
[ 103.551693][ T5329] alloc_pages_mpol+0x21e/0x390
[ 103.553817][ T5329] ? drm_syncobj_array_find+0x3a/0x440
[ 103.556187][ T5329] ___kmalloc_large_node+0x4f/0x120
[ 103.558315][ T5329] __kmalloc_large_node_noprof+0x18/0x90
[ 103.560783][ T5329] __kmalloc_noprof+0x3fb/0x720
[ 103.562897][ T5329] ? drm_syncobj_array_find+0x3a/0x440
[ 103.565259][ T5329] drm_syncobj_array_find+0x3a/0x440
[ 103.567600][ T5329] drm_syncobj_wait_ioctl+0x1fa/0x690
[ 103.569978][ T5329] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10
[ 103.572517][ T5329] drm_ioctl_kernel+0x2df/0x3b0
[ 103.574575][ T5329] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10
[ 103.577133][ T5329] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 103.579496][ T5329] drm_ioctl+0x70e/0xba0
[ 103.581272][ T5329] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10
[ 103.583819][ T5329] ? __pfx_drm_ioctl+0x10/0x10
[ 103.585882][ T5329] ? __fget_files+0x2a/0x420
[ 103.587911][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20
[ 103.590151][ T5329] ? __pfx_drm_ioctl+0x10/0x10
[ 103.592262][ T5329] __se_sys_ioctl+0xfc/0x170
[ 103.594289][ T5329] do_syscall_64+0x166/0x520
[ 103.596425][ T5329] ? trace_irq_disable+0x3b/0x140
[ 103.598705][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.601481][ T5329] ? clear_bhb_loop+0x70/0xc0
[ 103.603653][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.606171][ T5329] RIP: 0033:0x7f054f59e559
[ 103.608116][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.616110][ T5329] RSP: 002b:00007f055046efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 103.619557][ T5329] RAX: ffffffffffffffda RBX: 00007f054f825fa0 RCX: 00007f054f59e559
[ 103.622690][ T5329] RDX: 0000200000000000 RSI: 00000000c02864c3 RDI: 0000000000000003
[ 103.625891][ T5329] RBP: 00007f054f635b20 R08: 0000000000000000 R09: 0000000000000000
[ 103.629151][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.632557][ T5329] R13: 00007f054f826038 R14: 00007f054f825fa0 R15: 00007fff7192a218
[ 103.636046][ T5329]
[ 103.637931][ T5329] Kernel Offset: disabled
[ 103.639881][ T5329] Rebooting in 86400 seconds..