program: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01864c2, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000100)={&(0x7f0000000240)=[r1, r2, r1, r2, r1, r1, r1, r2, r2, 0x0, r1, r2], 0x0, 0x3ffffffffffffe04}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000140)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc03064ca, &(0x7f0000000180)={&(0x7f00000001c0)=[r3, r1], &(0x7f0000000200)=[0x1], 0x400, 0x2, 0x4}) open(&(0x7f0000000080)='./bus\x00', 0x143142, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000340)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x24004045) r4 = io_uring_setup(0x1b7f, &(0x7f0000000440)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) r5 = socket$inet(0x2, 0x80001, 0x84) writev(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000600)="1632800e", 0x4}], 0x1) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000640)=@assoc_value, &(0x7f0000000680)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f00000006c0)='.\x00', 0xfffffffb) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) mount(&(0x7f00000004c0)=@sr0, &(0x7f0000000280)='./bus\x00', &(0x7f00000003c0)='9p\x00', 0x2208440, &(0x7f0000000300)='trans=rdma,') [ 102.966852][ T49] Bluetooth: hci0: command tx timeout [ 103.143685][ T5354] ------------[ cut here ]------------ [ 103.143698][ T5354] 1 [ 103.143702][ T5354] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5354 [ 103.151797][ T5354] Modules linked in: [ 103.153537][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.157520][ T5354] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.161862][ T5354] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 103.164629][ T5354] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 ed 40 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 92 88 d2 09 cc 89 ef 89 [ 103.173095][ T5354] RSP: 0018:ffffc9000e70fa78 EFLAGS: 00010246 [ 103.175866][ T5354] RAX: 0000000000000000 RBX: 00000003fffff810 RCX: 0000000000100000 [ 103.179474][ T5354] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000003fffff810 [ 103.183385][ T5354] RBP: 0000000000000cc0 R08: ffffffff85a33b49 R09: 0000000000000000 [ 103.187491][ T5354] R10: dffffc0000000000 R11: ffffffff85ac6de0 R12: ffffffff8cb722e8 [ 103.190959][ T5354] R13: ffffffff85ac530a R14: 00000003fffff810 R15: 00000003fffff810 [ 103.194241][ T5354] FS: 00007efc6127f6c0(0000) GS:ffff88808aa11000(0000) knlGS:0000000000000000 [ 103.198219][ T5354] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.201004][ T5354] CR2: 00007efc60618268 CR3: 0000000045cfd000 CR4: 0000000000352ef0 [ 103.204376][ T5354] Call Trace: [ 103.205974][ T5354] [ 103.207261][ T5354] __kmalloc_large_node_noprof+0x18/0x90 [ 103.209732][ T5354] __kmalloc_noprof+0x3f6/0x710 [ 103.211994][ T5354] ? drm_syncobj_array_find+0x3a/0x440 [ 103.214471][ T5354] ? lock_acquire+0x115/0x350 [ 103.216917][ T5354] drm_syncobj_array_find+0x3a/0x440 [ 103.219401][ T5354] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 103.222046][ T5354] drm_ioctl_kernel+0x2df/0x3b0 [ 103.224084][ T5354] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 103.227000][ T5354] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 103.229228][ T5354] ? __might_fault+0xaf/0x130 [ 103.231195][ T5354] drm_ioctl+0x70e/0xba0 [ 103.233017][ T5354] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 103.236241][ T5354] ? __pfx_drm_ioctl+0x10/0x10 [ 103.238398][ T5354] ? __fget_files+0x2a/0x420 [ 103.240521][ T5354] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.242755][ T5354] ? __pfx_drm_ioctl+0x10/0x10 [ 103.244983][ T5354] __se_sys_ioctl+0xfc/0x170 [ 103.247193][ T5354] do_syscall_64+0x166/0x520 [ 103.249195][ T5354] ? trace_irq_disable+0x3b/0x140 [ 103.251396][ T5354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.254059][ T5354] ? clear_bhb_loop+0x70/0xc0 [ 103.256205][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.258735][ T5354] RIP: 0033:0x7efc6039f559 [ 103.260778][ T5354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.268414][ T5354] RSP: 002b:00007efc6127efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.271692][ T5354] RAX: ffffffffffffffda RBX: 00007efc60625fa0 RCX: 00007efc6039f559 [ 103.274360][ T5354] RDX: 0000200000000100 RSI: 00000000c01864cd RDI: 0000000000000003 [ 103.277953][ T5354] RBP: 00007efc60436b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.281373][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.284925][ T5354] R13: 00007efc60626038 R14: 00007efc60625fa0 R15: 00007ffd9d794888 [ 103.288594][ T5354] [ 103.289943][ T5354] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.293030][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.296968][ T5354] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.301432][ T5354] Call Trace: [ 103.302997][ T5354] [ 103.304176][ T5354] vpanic+0x26f/0x710 [ 103.305827][ T5354] panic+0xc5/0xd0 [ 103.307445][ T5354] ? __pfx_panic+0x10/0x10 [ 103.309381][ T5354] __warn+0x315/0x4c0 [ 103.311112][ T5354] ? ___kmalloc_large_node+0x10c/0x170 [ 103.313345][ T5354] ? ___kmalloc_large_node+0x10c/0x170 [ 103.315554][ T5354] __report_bug+0x276/0x570 [ 103.317408][ T5354] ? ___kmalloc_large_node+0x10c/0x170 [ 103.319767][ T5354] ? __pfx___report_bug+0x10/0x10 [ 103.321949][ T5354] ? stack_trace_save+0xa9/0x100 [ 103.324089][ T5354] ? __pfx_stack_trace_save+0x10/0x10 [ 103.326418][ T5354] ? kasan_save_track+0x4f/0x80 [ 103.328605][ T5354] ? stack_depot_save_flags+0x33/0x810 [ 103.330980][ T5354] ? __lock_acquire+0x747/0x2de0 [ 103.333243][ T5354] ? ___kmalloc_large_node+0x10c/0x170 [ 103.335589][ T5354] report_bug+0x16b/0x220 [ 103.337385][ T5354] ? ___kmalloc_large_node+0x10c/0x170 [ 103.339611][ T5354] ? ___kmalloc_large_node+0x10e/0x170 [ 103.341740][ T5354] handle_bug+0x9c/0x200 [ 103.343313][ T5354] exc_invalid_op+0x1a/0x50 [ 103.345125][ T5354] asm_exc_invalid_op+0x1a/0x20 [ 103.347098][ T5354] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 103.349655][ T5354] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 ed 40 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 92 88 d2 09 cc 89 ef 89 [ 103.357886][ T5354] RSP: 0018:ffffc9000e70fa78 EFLAGS: 00010246 [ 103.360096][ T5354] RAX: 0000000000000000 RBX: 00000003fffff810 RCX: 0000000000100000 [ 103.362627][ T5354] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000003fffff810 [ 103.365119][ T5354] RBP: 0000000000000cc0 R08: ffffffff85a33b49 R09: 0000000000000000 [ 103.367667][ T5354] R10: dffffc0000000000 R11: ffffffff85ac6de0 R12: ffffffff8cb722e8 [ 103.370700][ T5354] R13: ffffffff85ac530a R14: 00000003fffff810 R15: 00000003fffff810 [ 103.374252][ T5354] ? drm_syncobj_array_find+0x3a/0x440 [ 103.376650][ T5354] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 103.379355][ T5354] ? drm_dev_enter+0x49/0x150 [ 103.381415][ T5354] __kmalloc_large_node_noprof+0x18/0x90 [ 103.383783][ T5354] __kmalloc_noprof+0x3f6/0x710 [ 103.385900][ T5354] ? drm_syncobj_array_find+0x3a/0x440 [ 103.388279][ T5354] ? lock_acquire+0x115/0x350 [ 103.390145][ T5354] drm_syncobj_array_find+0x3a/0x440 [ 103.391972][ T5354] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 103.394127][ T5354] drm_ioctl_kernel+0x2df/0x3b0 [ 103.395875][ T5354] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 103.398894][ T5354] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 103.401376][ T5354] ? __might_fault+0xaf/0x130 [ 103.403531][ T5354] drm_ioctl+0x70e/0xba0 [ 103.405694][ T5354] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 103.408918][ T5354] ? __pfx_drm_ioctl+0x10/0x10 [ 103.411084][ T5354] ? __fget_files+0x2a/0x420 [ 103.413227][ T5354] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.415538][ T5354] ? __pfx_drm_ioctl+0x10/0x10 [ 103.417748][ T5354] __se_sys_ioctl+0xfc/0x170 [ 103.419895][ T5354] do_syscall_64+0x166/0x520 [ 103.422082][ T5354] ? trace_irq_disable+0x3b/0x140 [ 103.424068][ T5354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.426556][ T5354] ? clear_bhb_loop+0x70/0xc0 [ 103.429051][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.431746][ T5354] RIP: 0033:0x7efc6039f559 [ 103.433823][ T5354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.442335][ T5354] RSP: 002b:00007efc6127efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.446149][ T5354] RAX: ffffffffffffffda RBX: 00007efc60625fa0 RCX: 00007efc6039f559 [ 103.449568][ T5354] RDX: 0000200000000100 RSI: 00000000c01864cd RDI: 0000000000000003 [ 103.452629][ T5354] RBP: 00007efc60436b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.456085][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.459511][ T5354] R13: 00007efc60626038 R14: 00007efc60625fa0 R15: 00007ffd9d794888 [ 103.462938][ T5354] [ 103.464739][ T5354] Kernel Offset: disabled [ 103.466609][ T5354] Rebooting in 86400 seconds..