program:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0)
recvmmsg(r4, &(0x7f0000005000)=[{{0x0, 0x0, &(0x7f0000004ac0)=[{&(0x7f0000000a00)=""/109, 0x6d}, {&(0x7f0000001a80)=""/4111, 0x100f}, {&(0x7f0000000080)=""/172, 0xac}, {&(0x7f0000003900)=""/151, 0x97}, {&(0x7f0000003ac0)=""/4093, 0xffd}], 0x5}, 0x9}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x79}], 0x4, 0x0, 0x0)
r5 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r6, 0xc01864cb, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x75bf8666cdaaf385})
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000540)={0x73622a85, 0x1001, 0x1})
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000500)={0x9c, 0x0, &(0x7f0000000280)=[@request_death={0x400c630e, 0x1}, @enter_looper, @increfs_done={0x40106308, 0x2}, @acquire, @free_buffer={0x40086303, r5}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000180)={@fda={0x66646185, 0x4, 0x1, 0x2e}, @flat=@binder={0x73622a85, 0x101, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/68, 0x44, 0x0, 0x31}}, &(0x7f0000000240)={0x0, 0x20, 0x38}}, 0x400}, @request_death={0x400c630e, 0x1}, @exit_looper], 0x8a, 0x0, &(0x7f0000000440)="9f6ec03034963d22faaa07670ea062901e395253b73efb2f1c751ba5b389421e0a70b29f898a29bc600e8c73813aedcc2caabf07f4e051a0075cce32f3419e0f464a7680459d9814729f9567b95be2ea5f53c4f75e15c6efb1dbc25f61a8158e77960d5978506b4b420171a7c58ec90c07ba140ecc877515f1f9394fe2a42a34f7ed2d1cd04b3244189a"})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
[ 94.514985][ T5284] Bluetooth: hci0: command tx timeout
[ 94.614250][ T5324] ------------[ cut here ]------------
[ 94.614261][ T5324] 1
[ 94.614265][ T5324] WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0, CPU#0: syz.0.0/5324
[ 94.622230][ T5324] Modules linked in:
[ 94.624631][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.628363][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.632821][ T5324] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0
[ 94.635844][ T5324] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 aa 9f 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 2c 11 54 0e 67 48 0f b9 3a e9 68
[ 94.643978][ T5324] RSP: 0018:ffffc9000e277880 EFLAGS: 00010246
[ 94.648034][ T5324] RAX: ffffc9000e277800 RBX: 1ffff92001c4ef14 RCX: 0000000000000000
[ 94.652491][ T5324] RDX: 0000000000000000 RSI: 000000000000000d RDI: ffffc9000e2778e8
[ 94.655849][ T5324] RBP: ffffc9000e277978 R08: ffffc9000e2778e7 R09: 0000000000000000
[ 94.659400][ T5324] R10: ffffc9000e2778c0 R11: fffff52001c4ef1d R12: 0000000000000000
[ 94.662981][ T5324] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000
[ 94.666571][ T5324] FS: 00007f5b1266a6c0(0000) GS:ffff88808c2c3000(0000) knlGS:0000000000000000
[ 94.670515][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.673767][ T5324] CR2: 00007f5b118f1900 CR3: 0000000043997000 CR4: 0000000000352ef0
[ 94.678454][ T5324] Call Trace:
[ 94.681626][ T5324]
[ 94.682986][ T5324] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 94.685864][ T5324] ? __pfx_policy_nodemask+0x10/0x10
[ 94.688152][ T5324] ? kasan_save_track+0x4f/0x80
[ 94.693163][ T5324] ? kasan_save_track+0x3e/0x80
[ 94.695333][ T5324] ? kasan_save_free_info+0x40/0x50
[ 94.697519][ T5324] ? __kasan_slab_free+0x5c/0x80
[ 94.699573][ T5324] ? kfree+0x1c5/0x650
[ 94.701274][ T5324] alloc_pages_mpol+0x21e/0x390
[ 94.703347][ T5324] ? drm_syncobj_array_find+0x3a/0x440
[ 94.705602][ T5324] ___kmalloc_large_node+0x4f/0x120
[ 94.707717][ T5324] __kmalloc_large_node_noprof+0x18/0x90
[ 94.709935][ T5324] __kmalloc_noprof+0x3fb/0x720
[ 94.712004][ T5324] ? drm_syncobj_array_find+0x3a/0x440
[ 94.714184][ T5324] drm_syncobj_array_find+0x3a/0x440
[ 94.716280][ T5324] drm_syncobj_query_ioctl+0x1c3/0xae0
[ 94.718569][ T5324] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 94.720954][ T5324] drm_ioctl_kernel+0x2df/0x3b0
[ 94.723055][ T5324] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 94.725409][ T5324] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 94.727626][ T5324] drm_ioctl+0x70e/0xba0
[ 94.729319][ T5324] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 94.731828][ T5324] ? __pfx_drm_ioctl+0x10/0x10
[ 94.733780][ T5324] ? __fget_files+0x2a/0x420
[ 94.735667][ T5324] ? bpf_lsm_file_ioctl+0x9/0x20
[ 94.737720][ T5324] ? __pfx_drm_ioctl+0x10/0x10
[ 94.739671][ T5324] __se_sys_ioctl+0xfc/0x170
[ 94.741626][ T5324] do_syscall_64+0x166/0x520
[ 94.743558][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.745614][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.748111][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 94.750237][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.752803][ T5324] RIP: 0033:0x7f5b1179e159
[ 94.754764][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.762669][ T5324] RSP: 002b:00007f5b12669fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 94.766052][ T5324] RAX: ffffffffffffffda RBX: 00007f5b11a25fa0 RCX: 00007f5b1179e159
[ 94.769286][ T5324] RDX: 0000200000000a40 RSI: 00000000c01864cb RDI: 0000000000000007
[ 94.772677][ T5324] RBP: 00007f5b1183506b R08: 0000000000000000 R09: 0000000000000000
[ 94.775910][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.779670][ T5324] R13: 00007f5b11a26038 R14: 00007f5b11a25fa0 R15: 00007ffeb00e03f8
[ 94.783575][ T5324]
[ 94.784987][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.788031][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.791981][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.796253][ T5324] Call Trace:
[ 94.797822][ T5324]
[ 94.799203][ T5324] vpanic+0x56d/0xa60
[ 94.801031][ T5324] ? __pfx__printk+0x10/0x10
[ 94.803112][ T5324] ? __pfx_vpanic+0x10/0x10
[ 94.804973][ T5324] ? is_bpf_text_address+0x292/0x2b0
[ 94.807251][ T5324] ? is_bpf_text_address+0x26/0x2b0
[ 94.809268][ T5324] panic+0xc5/0xd0
[ 94.810929][ T5324] ? __pfx_panic+0x10/0x10
[ 94.812750][ T5324] __warn+0x315/0x4c0
[ 94.814381][ T5324] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 94.816904][ T5324] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 94.819440][ T5324] __report_bug+0x276/0x570
[ 94.821414][ T5324] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 94.824075][ T5324] ? __pfx___report_bug+0x10/0x10
[ 94.826388][ T5324] ? lock_acquire+0x115/0x350
[ 94.828502][ T5324] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 94.831193][ T5324] report_bug+0x16b/0x220
[ 94.833110][ T5324] ? __alloc_frozen_pages_noprof+0x425/0x5a0
[ 94.835790][ T5324] ? __alloc_frozen_pages_noprof+0x427/0x5a0
[ 94.838464][ T5324] handle_bug+0x9c/0x200
[ 94.840385][ T5324] exc_invalid_op+0x1a/0x50
[ 94.842313][ T5324] asm_exc_invalid_op+0x1a/0x20
[ 94.844381][ T5324] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0
[ 94.847087][ T5324] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 aa 9f 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 2c 11 54 0e 67 48 0f b9 3a e9 68
[ 94.855186][ T5324] RSP: 0018:ffffc9000e277880 EFLAGS: 00010246
[ 94.857904][ T5324] RAX: ffffc9000e277800 RBX: 1ffff92001c4ef14 RCX: 0000000000000000
[ 94.861329][ T5324] RDX: 0000000000000000 RSI: 000000000000000d RDI: ffffc9000e2778e8
[ 94.865118][ T5324] RBP: ffffc9000e277978 R08: ffffc9000e2778e7 R09: 0000000000000000
[ 94.868917][ T5324] R10: ffffc9000e2778c0 R11: fffff52001c4ef1d R12: 0000000000000000
[ 94.872342][ T5324] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000
[ 94.875199][ T5324] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 94.877801][ T5324] ? __pfx_policy_nodemask+0x10/0x10
[ 94.879925][ T5324] ? kasan_save_track+0x4f/0x80
[ 94.881898][ T5324] ? kasan_save_track+0x3e/0x80
[ 94.883789][ T5324] ? kasan_save_free_info+0x40/0x50
[ 94.885898][ T5324] ? __kasan_slab_free+0x5c/0x80
[ 94.887972][ T5324] ? kfree+0x1c5/0x650
[ 94.889736][ T5324] alloc_pages_mpol+0x21e/0x390
[ 94.891880][ T5324] ? drm_syncobj_array_find+0x3a/0x440
[ 94.894228][ T5324] ___kmalloc_large_node+0x4f/0x120
[ 94.896352][ T5324] __kmalloc_large_node_noprof+0x18/0x90
[ 94.898667][ T5324] __kmalloc_noprof+0x3fb/0x720
[ 94.900702][ T5324] ? drm_syncobj_array_find+0x3a/0x440
[ 94.903115][ T5324] drm_syncobj_array_find+0x3a/0x440
[ 94.905390][ T5324] drm_syncobj_query_ioctl+0x1c3/0xae0
[ 94.907917][ T5324] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 94.910594][ T5324] drm_ioctl_kernel+0x2df/0x3b0
[ 94.912603][ T5324] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 94.915199][ T5324] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 94.917589][ T5324] drm_ioctl+0x70e/0xba0
[ 94.919500][ T5324] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10
[ 94.922035][ T5324] ? __pfx_drm_ioctl+0x10/0x10
[ 94.924106][ T5324] ? __fget_files+0x2a/0x420
[ 94.926106][ T5324] ? bpf_lsm_file_ioctl+0x9/0x20
[ 94.928227][ T5324] ? __pfx_drm_ioctl+0x10/0x10
[ 94.930301][ T5324] __se_sys_ioctl+0xfc/0x170
[ 94.932429][ T5324] do_syscall_64+0x166/0x520
[ 94.934426][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.936696][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.939435][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 94.941532][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.944170][ T5324] RIP: 0033:0x7f5b1179e159
[ 94.946360][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.954644][ T5324] RSP: 002b:00007f5b12669fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 94.958332][ T5324] RAX: ffffffffffffffda RBX: 00007f5b11a25fa0 RCX: 00007f5b1179e159
[ 94.961825][ T5324] RDX: 0000200000000a40 RSI: 00000000c01864cb RDI: 0000000000000007
[ 94.965183][ T5324] RBP: 00007f5b1183506b R08: 0000000000000000 R09: 0000000000000000
[ 94.968627][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.972044][ T5324] R13: 00007f5b11a26038 R14: 00007f5b11a25fa0 R15: 00007ffeb00e03f8
[ 94.975484][ T5324]
[ 94.977262][ T5324] Kernel Offset: disabled
[ 94.979219][ T5324] Rebooting in 86400 seconds..