program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$phonet(0x23, 0x2, 0x1) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)=ANY=[@ANYBLOB="3401000010000100"/20, @ANYRES32=r1, @ANYBLOB="000000000000000014011a80400002803c000180080021000000000008001800000000000800030000000000080009000000000008000c0000000000080012000000000008001f"], 0x134}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$packet(0x11, 0x3, 0x300) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f000000d000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x67, 0x0, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x485, 0x0, 0x1000020005}]}) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f0000000940)={0x60, 0x124, 0x0, 0x0, 0x0, 0x20, 0xf, 0x0, {0x0, 0x4000000}, {}, {}, {0x7f368e4e}, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffa, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="10031200e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r8}, 0x14) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file1\x00', 0x0, &(0x7f00000000c0), 0xff, 0x756, &(0x7f0000001e40)="$eJzs3c2LW1UbAPDnpvP1tn2dKbiwIjjQhYXSjJ3WUkGkogspVoq6c9GmM+lQJmnKJFM6Q6VWFMGVSHHtx8qd/4Aogu5cCq5dSaFIqRtBiNzMzZg2SScznUyq+f3glnPuvek5z/04OZlzuDeAoTWd/pOL2B8RHycRk9n6JCJGG6mRiJNr+929c20uXZKo19/8PWnsk+aj5TOpPVnmiYj4/oOIQ7n2cqsrq4uFUqm4lOVnauXLM9WV1cMXy4WF4kLx0uzx54/Onph97sTstsX65/uvnz/19Stf3nzvp1/feOfU00mcjL3ZttY4tst0TGfHZDQ9hPd4ebsLG7Bk0BVgS9Jbc9faXR77YzJ2NVIAwH/Z9YioAwBDJvH9DwBDpvl3gObYXj/GwR5lt1+KiImIsZZjsLZlJBuzm2iMg+6+m9wzMpJExNQ2lD8dEVff/vCbdIk+jUMCdPLujYg4NzXd3v4nbXMWNuvZHvaZvi+v/YOd813a/znRqf+XW+//RIf+z3iHe3crNr7/c7e2oZiu0v7fCx37v+uT1qZ2Zbn/N/p8o8mFi6Vi2rY9FhEHY3Q8zR95QBnHPnnxx27bWvt/6ZKW3+wLZvW4NTJ+72fmC7XCw8Tc6vaNiCdHOsWfrJ//pEv/90yPZdR+eOqLbts2jr+/6p9HPNPx/P8zoy1pmZ84Hm3zE2ca18NM86pol/9ocl+38gcdf3r+dz84/qmkdb5mdfNl/PzpX69227bV638seauRHsvWXS3UaktHIsaS19rXt0whbeab+6fxHzzw4Pav0/Wf/iY812P8i599dX7r8fdXGv/8ps7/5hMHfvm2czz1bLbxhuf/WCN1MFvTS/vXawUf5tgBAAAAAAAAAAAAAAAAAAAAAAAAQK9yEbE3klx+PZ3L5fNr7/B+PHbnSpVq7dCFyvKl+Wi8K3sqRnPNJ11OtjwP9Uj2PPxmfva+/NGI2BcRN8f/18jn5yql+UEHDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZPV3e/5/6bXzQtQMA+mbi+qBrAADstIlBVwAA2HG+/wFg+Pj+B4ChctocPwAYTn7/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0GdnTp9Ol/ofd67Npfn5KyvLi5Urh+eL1cV8eXkuP1dZupxfqFQWSsX8XKW80f9XqlQuzx6P5asztWK1NlNdWT1brixfqp29WC4sFM8WR3ckKgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYnOrK6mKhVCouPWKJiax+j0p9JCSGKzHghgkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgX+LvAAAA///A4xmC") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x501042, 0x52) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="30000000200001030000000000000000020000000000000001000000140003006c6f000000000000e0c9437f54a4dd1b"], 0x30}, 0x1, 0x0, 0x0, 0x90}, 0x0) r10 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r10, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0xa00, 0x0, 0x101, 0x100}}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r11, &(0x7f0000000000), 0x560c89bb) ioctl$int_in(r11, 0x5452, &(0x7f0000000340)=0xffffffff) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r12, &(0x7f00000001c0)='1', 0x1) [ 104.012545][ T4648] Bluetooth: hci0: command tx timeout [ 104.162657][ T5327] IPv4: Oversized IP packet from 127.202.26.0 [ 104.227637][ T5327] loop0: detected capacity change from 0 to 2048 [ 104.403084][ T5327] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 104.576828][ T5328] Console: switching to colour dummy device 80x25 [ 104.942985][ T5326] ------------[ cut here ]------------ [ 104.943003][ T5326] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 104.943011][ T5326] WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e2/0x1550, CPU#0: syz.0.0/5326 [ 104.954023][ T5326] Modules linked in: [ 104.955927][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.960278][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.965390][ T5326] RIP: 0010:__mutex_lock+0x12e9/0x1550 [ 104.967852][ T5326] Code: 81 7a 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d ab f0 91 04 00 75 13 48 8d 3d ae ec 94 04 48 c7 c6 c0 11 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f [ 104.976813][ T5326] RSP: 0018:ffffc9000e0cfae0 EFLAGS: 00010246 [ 104.980068][ T5326] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88801f9da580 [ 104.984214][ T5326] RDX: 0000000000000000 RSI: ffffffff8c0d11c0 RDI: ffffffff907d7d90 [ 104.987722][ T5326] RBP: ffffc9000e0cfc80 R08: ffffffff907a8183 R09: 1ffffffff20f5030 [ 104.991474][ T5326] R10: dffffc0000000000 R11: fffffbfff20f5031 R12: ffff888034eb51c0 [ 104.995175][ T5326] R13: 0000000000000000 R14: 1ffff92001c19f70 R15: 0000000000000000 [ 104.998928][ T5326] FS: 0000555565be5540(0000) GS:ffff88808c2c7000(0000) knlGS:0000000000000000 [ 105.003532][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.006689][ T5326] CR2: 00007f2ddb5b39a0 CR3: 0000000012030000 CR4: 0000000000352ef0 [ 105.010236][ T5326] Call Trace: [ 105.012190][ T5326] [ 105.013521][ T5326] ? kfree+0x1c5/0x650 [ 105.015355][ T5326] ? drm_mode_rmfb+0x561/0x7a0 [ 105.018496][ T5326] ? drm_gem_fb_destroy+0x1c9/0x200 [ 105.020885][ T5326] ? virtio_gpu_free_object+0x90/0x1d0 [ 105.023412][ T5326] ? drm_mode_rmfb+0x561/0x7a0 [ 105.025449][ T5326] ? __pfx___mutex_lock+0x10/0x10 [ 105.027721][ T5326] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 105.030796][ T5326] virtio_gpu_free_object+0x90/0x1d0 [ 105.033319][ T5326] drm_client_buffer_delete+0x183/0x2d0 [ 105.035755][ T5326] drm_fbdev_shmem_fb_destroy+0xb5/0xe0 [ 105.038478][ T5326] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10 [ 105.041725][ T5326] fb_release+0x11d/0x140 [ 105.043687][ T5326] ? __pfx_fb_release+0x10/0x10 [ 105.045804][ T5326] __fput+0x418/0xa50 [ 105.047515][ T5326] task_work_run+0x1d9/0x270 [ 105.049484][ T5326] ? __pfx_task_work_run+0x10/0x10 [ 105.051790][ T5326] exit_to_user_mode_loop+0x204/0x770 [ 105.054098][ T5326] ? rcu_is_watching+0x16/0xb0 [ 105.056117][ T5326] do_syscall_64+0x328/0x520 [ 105.058088][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.060833][ T5326] ? clear_bhb_loop+0x70/0xc0 [ 105.062867][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.065411][ T5326] RIP: 0033:0x7f2dda79e159 [ 105.067349][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.075381][ T5326] RSP: 002b:00007ffdeec2db78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 105.078775][ T5326] RAX: 0000000000000000 RBX: 00007f2ddaa27da0 RCX: 00007f2dda79e159 [ 105.082214][ T5326] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 105.085727][ T5326] RBP: 00007f2ddaa27da0 R08: 0000000000000006 R09: 0000000000000000 [ 105.089065][ T5326] R10: 00007f2ddaa27cb0 R11: 0000000000000246 R12: 00000000000198cd [ 105.092685][ T5326] R13: 00007f2ddaa2609c R14: 00000000000197b3 R15: 00007ffdeec2dc80 [ 105.096182][ T5326] [ 105.097479][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 105.100686][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.104562][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.108999][ T5326] Call Trace: [ 105.110403][ T5326] [ 105.111729][ T5326] vpanic+0x56d/0xa60 [ 105.113426][ T5326] ? __pfx__printk+0x10/0x10 [ 105.115210][ T5326] ? __pfx_vpanic+0x10/0x10 [ 105.116995][ T5326] ? is_bpf_text_address+0x292/0x2b0 [ 105.119040][ T5326] ? is_bpf_text_address+0x26/0x2b0 [ 105.121121][ T5326] panic+0xc5/0xd0 [ 105.122952][ T5326] ? __pfx_panic+0x10/0x10 [ 105.125202][ T5326] __warn+0x315/0x4c0 [ 105.127039][ T5326] ? __mutex_lock+0x12e2/0x1550 [ 105.129161][ T5326] ? __mutex_lock+0x12e2/0x1550 [ 105.131297][ T5326] __report_bug+0x276/0x570 [ 105.133128][ T5326] ? __mutex_lock+0x12e2/0x1550 [ 105.135290][ T5326] ? __pfx___report_bug+0x10/0x10 [ 105.137584][ T5326] ? drm_client_buffer_delete+0x113/0x2d0 [ 105.140313][ T5326] report_bug_entry+0x19b/0x290 [ 105.143034][ T5326] ? __mutex_lock+0x12e9/0x1550 [ 105.145740][ T5326] ? __mutex_lock+0x12ee/0x1550 [ 105.147655][ T5326] handle_bug+0xce/0x200 [ 105.149425][ T5326] exc_invalid_op+0x1a/0x50 [ 105.151233][ T5326] asm_exc_invalid_op+0x1a/0x20 [ 105.153168][ T5326] RIP: 0010:__mutex_lock+0x12e9/0x1550 [ 105.155542][ T5326] Code: 81 7a 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d ab f0 91 04 00 75 13 48 8d 3d ae ec 94 04 48 c7 c6 c0 11 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f [ 105.164999][ T5326] RSP: 0018:ffffc9000e0cfae0 EFLAGS: 00010246 [ 105.168471][ T5326] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88801f9da580 [ 105.172170][ T5326] RDX: 0000000000000000 RSI: ffffffff8c0d11c0 RDI: ffffffff907d7d90 [ 105.175697][ T5326] RBP: ffffc9000e0cfc80 R08: ffffffff907a8183 R09: 1ffffffff20f5030 [ 105.179145][ T5326] R10: dffffc0000000000 R11: fffffbfff20f5031 R12: ffff888034eb51c0 [ 105.182831][ T5326] R13: 0000000000000000 R14: 1ffff92001c19f70 R15: 0000000000000000 [ 105.187705][ T5326] ? kfree+0x1c5/0x650 [ 105.190047][ T5326] ? drm_mode_rmfb+0x561/0x7a0 [ 105.192183][ T5326] ? drm_gem_fb_destroy+0x1c9/0x200 [ 105.194374][ T5326] ? virtio_gpu_free_object+0x90/0x1d0 [ 105.196945][ T5326] ? drm_mode_rmfb+0x561/0x7a0 [ 105.199109][ T5326] ? __pfx___mutex_lock+0x10/0x10 [ 105.201398][ T5326] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 105.204070][ T5326] virtio_gpu_free_object+0x90/0x1d0 [ 105.206357][ T5326] drm_client_buffer_delete+0x183/0x2d0 [ 105.209240][ T5326] drm_fbdev_shmem_fb_destroy+0xb5/0xe0 [ 105.213668][ T5326] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10 [ 105.216600][ T5326] fb_release+0x11d/0x140 [ 105.218497][ T5326] ? __pfx_fb_release+0x10/0x10 [ 105.220706][ T5326] __fput+0x418/0xa50 [ 105.222457][ T5326] task_work_run+0x1d9/0x270 [ 105.224442][ T5326] ? __pfx_task_work_run+0x10/0x10 [ 105.226750][ T5326] exit_to_user_mode_loop+0x204/0x770 [ 105.229107][ T5326] ? rcu_is_watching+0x16/0xb0 [ 105.231704][ T5326] do_syscall_64+0x328/0x520 [ 105.234022][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.236972][ T5326] ? clear_bhb_loop+0x70/0xc0 [ 105.238777][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.241719][ T5326] RIP: 0033:0x7f2dda79e159 [ 105.243739][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.252242][ T5326] RSP: 002b:00007ffdeec2db78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 105.255906][ T5326] RAX: 0000000000000000 RBX: 00007f2ddaa27da0 RCX: 00007f2dda79e159 [ 105.259244][ T5326] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 105.262707][ T5326] RBP: 00007f2ddaa27da0 R08: 0000000000000006 R09: 0000000000000000 [ 105.266062][ T5326] R10: 00007f2ddaa27cb0 R11: 0000000000000246 R12: 00000000000198cd [ 105.269352][ T5326] R13: 00007f2ddaa2609c R14: 00000000000197b3 R15: 00007ffdeec2dc80 [ 105.272688][ T5326] [ 105.274490][ T5326] Kernel Offset: disabled [ 105.276433][ T5326] Rebooting in 86400 seconds..