program:
mkdir(&(0x7f0000000000)='./mysys\x00', 0x1ff)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000080)=@FILEID_BTRFS_WITH_PARENT_ROOT={0x28, 0x4e, {0x3, 0x1, 0x4, 0x6, 0x2dba, 0x4}}, 0x48000)
mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xb0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000040)={@host})
ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f00000009c0)={&(0x7f0000000540)={{@local}, {}, 0x400, "d49e0b1f09a3e05cb898141464441748655937bb34d22f02362479246bb6372d891a3b5dafa58a6abc5a678d6874fc8fb5f8a529c6e30103484f2667c174fb6cda19ea0a9301bc3238eb816e9c3882f243bcd4bd7115b26dacf5923f060498d471cb4f789562fcda119739dd1a5b0e4e1a4a64dbd7b398bd4e7a247d81f968f2e945f293fc3860bf11f0424193fce743067d27f0ac187b44b128a4999547f73d8c35d3c2bd8b51bbc9a31123f773be89e109cc71b8ec29a539083c0cba15b0899c7181ba154c28b3c4e2ebe360ac44f942a703b9a3a37fbbefe9ae0de04a32336a6eba07b2fb6ad426d56e17291bb1a9d1fcdaa939378bab6dd2eac37b369ef163c9e0fc8039352c24d8147fcc2e2559b47066abd21a3a5f83f239a2227d17d4ca90ce0ed9acc243ed38818e3883a985106b54dc157b67022525a74e8f9cb99852760359278d5d22294a70433ba4cec5147fbb09b1d0008ba76257f1c5af6b8d6bf3bcfd5a0100566a4e98fe5f264f2663b72cb421c90d8b7883ddfb5749b27a3e146f9d8538706fea61b07c6e064446337439b9d5a5dc82f6c63c57d6ba0e709b7c1b15fa8367f8e6df2cf59b0b30740ef47c5cccffce5911569591ce4ab62275964cd147e87a30cc6e71f7e40e161997cdbadcfbfb6c54e0289ac137508b7b5339414e4ab7afcc420148e37d49b664cc07c8178a3a50f566c5bdd3aa9217ef909805972bd63ee1d729b282cd866c183744b20da3227f9d43843236b571c8d3237408c266e08d0699ebd30e0820362664ab323b15d3ae9896d6120aae6ef9085f53a2b39cc31238b031476c86e6b16d7703fcbacc7269ce8622eab1cfdf82a364209ec4ac912db924bb76bc35ddf8d0e7a3aff0d08a48c07be47303b59653d9409f14dc59ac33cae5e010466f54d86772e43e3680863bb9bf10c971f16a731e601d7fcdbb91d7146e7834d89059ad522d70398c2bacf113ed791e32f933dfa23f5d6d11bfc9d9e0f04a34b0eddd99d16cd9712485e0a5c9aaf1ebf3f14d00005f8960b6145cbb7d4522692ebe1f9491f87a29ed67c5fb60f5e69bde2a758742999fc986a2dbf6199977e9b446691bf9f95d0abd84557c77ea13356c977d0f098ab9fec85acbd6447f2e6893e2fa6a0a7b272dab66e69b7def48f8b3583a53a0941fb3e4367fa8d56e05ee3b265f17ca0439fcdcea276f7f0a9bf4c2a324d7143658007cf4019e8da69ba1b7dff4383714cbcb71dfe6f1b1ac5d5e99394cb2c360ddb1889d92cd36f8fc72ac865f1c6445957b2a57c1af59ef8d2e9fe328ec2bde763d65c4dea965042f540515bf2f879d1b26309ebc1d7f76c569fa88fbe61845e96e93d3b6025b6285777e59495943596c128fdacc545263ce458bf99f57d7e5dc77f65cf650902b5b6d5af9359334759843365bf0dfb244817a40e8cc9030"}, 0x418})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:01.0/driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000340)='0000:00:01.0', 0xc)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./mysys/bus/pci/drivers/xhci_hcd/new_id\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0)
write(r3, &(0x7f0000000140)="30009d", 0x3)
preadv(r3, &(0x7f0000000980)=[{&(0x7f0000000380)=""/242, 0xf2}, {&(0x7f0000000480)=""/190, 0xbe}], 0x2, 0x9, 0xfff)
r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r4, &(0x7f0000000040), 0x6)
ioctl$sock_bt_hci(r4, 0x800448d7, 0x0)
write(r2, &(0x7f0000000840)='1af4 1050', 0x9)
[ 151.415749][ T5327] Console: switching to colour dummy device 80x25
[ 151.543268][ T4642] Bluetooth: hci0: command tx timeout
[ 151.554989][ T5327] =============================================================================
[ 151.555601][ T5327]
[ 151.555615][ T5327] ======================================================
[ 151.555620][ T5327] WARNING: possible circular locking dependency detected
[ 151.555625][ T5327] syzkaller #0 Not tainted
[ 151.555631][ T5327] ------------------------------------------------------
[ 151.555635][ T5327] syz.0.0/5327 is trying to acquire lock:
[ 151.555642][ T5327] ffffffff8ed4c640 (console_owner){....}-{0:0}, at: console_flush_all+0x123/0xb40
[ 151.555729][ T5327]
[ 151.555729][ T5327] but task is already holding lock:
[ 151.555733][ T5327] ffff88801d3b2f18 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x111/0x2a0
[ 151.555761][ T5327]
[ 151.555761][ T5327] which lock already depends on the new lock.
[ 151.555761][ T5327]
[ 151.555766][ T5327]
[ 151.555766][ T5327] the existing dependency chain (in reverse order) is:
[ 151.555770][ T5327]
[ 151.555770][ T5327] -> #4 (&n->list_lock){-.-.}-{3:3}:
[ 151.555785][ T5327] _raw_spin_lock_irqsave+0x40/0x60
[ 151.555829][ T5327] get_from_partial_node+0x54/0x4c0
[ 151.555843][ T5327] ___slab_alloc+0xbe/0x950
[ 151.555856][ T5327] kmem_cache_alloc_noprof+0x137/0x5f0
[ 151.555866][ T5327] fill_pool+0x163/0x600
[ 151.555913][ T5327] debug_object_activate+0x38d/0x420
[ 151.555926][ T5327] insert_work+0x35/0x330
[ 151.555937][ T5327] __queue_work+0xd07/0x10d0
[ 151.555948][ T5327] queue_delayed_work_on+0x11a/0x1e0
[ 151.555958][ T5327] neigh_table_init+0x790/0xb70
[ 151.555969][ T5327] arp_init+0x12/0x50
[ 151.556042][ T5327] inet_init+0x316/0x420
[ 151.556052][ T5327] do_one_initcall+0x250/0x870
[ 151.556066][ T5327] do_initcall_level+0x10a/0x1a0
[ 151.556078][ T5327] do_initcalls+0x59/0xa0
[ 151.556090][ T5327] kernel_init_freeable+0x29d/0x3e0
[ 151.556103][ T5327] kernel_init+0x22/0x1d0
[ 151.556116][ T5327] ret_from_fork+0x514/0xb70
[ 151.556129][ T5327] ret_from_fork_asm+0x1a/0x30
[ 151.556141][ T5327]
[ 151.556141][ T5327] -> #3 (&pool->lock){-.-.}-{2:2}:
[ 151.556151][ T5327] _raw_spin_lock+0x2e/0x40
[ 151.556158][ T5327] __queue_work+0x73d/0x10d0
[ 151.556168][ T5327] queue_work_on+0x106/0x1d0
[ 151.556178][ T5327] rpm_suspend+0xeca/0x17a0
[ 151.556189][ T5327] __pm_runtime_idle+0x12f/0x1a0
[ 151.556200][ T5327] __device_attach+0x355/0x450
[ 151.556214][ T5327] device_initial_probe+0xa1/0xd0
[ 151.556226][ T5327] bus_probe_device+0x12a/0x220
[ 151.556234][ T5327] device_add+0x7d7/0xb80
[ 151.556243][ T5327] serial_base_port_add+0x18f/0x270
[ 151.556256][ T5327] serial_core_register_port+0x37f/0x2840
[ 151.556266][ T5327] serial8250_register_8250_port+0x16b4/0x2090
[ 151.556279][ T5327] serial_pnp_probe+0x56a/0x7f0
[ 151.556288][ T5327] pnp_device_probe+0x30b/0x4c0
[ 151.556305][ T5327] really_probe+0x254/0xae0
[ 151.556319][ T5327] __driver_probe_device+0x1e8/0x360
[ 151.556332][ T5327] driver_probe_device+0x4f/0x240
[ 151.556345][ T5327] __driver_attach+0x339/0x600
[ 151.556356][ T5327] bus_for_each_dev+0x23b/0x2c0
[ 151.556365][ T5327] bus_add_driver+0x345/0x670
[ 151.556373][ T5327] driver_register+0x23a/0x320
[ 151.556386][ T5327] serial8250_init+0x8f/0x160
[ 151.556398][ T5327] do_one_initcall+0x250/0x870
[ 151.556411][ T5327] do_initcall_level+0x10a/0x1a0
[ 151.556423][ T5327] do_initcalls+0x59/0xa0
[ 151.556435][ T5327] kernel_init_freeable+0x29d/0x3e0
[ 151.556446][ T5327] kernel_init+0x22/0x1d0
[ 151.556470][ T5327] ret_from_fork+0x514/0xb70
[ 151.556485][ T5327] ret_from_fork_asm+0x1a/0x30
[ 151.556499][ T5327]
[ 151.556499][ T5327] -> #2 (&dev->power.lock){-.-.}-{3:3}:
[ 151.556514][ T5327] _raw_spin_lock_irqsave+0x40/0x60
[ 151.556523][ T5327] __pm_runtime_resume+0x10f/0x180
[ 151.556533][ T5327] __uart_start+0x171/0x460
[ 151.556541][ T5327] uart_write+0x251/0x9f0
[ 151.556549][ T5327] n_tty_write+0xd49/0x11e0
[ 151.556561][ T5327] file_tty_write+0x50d/0x9f0
[ 151.556569][ T5327] vfs_write+0x612/0xba0
[ 151.556584][ T5327] ksys_write+0x150/0x270
[ 151.556591][ T5327] do_syscall_64+0x166/0x520
[ 151.556602][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.556624][ T5327]
[ 151.556624][ T5327] -> #1 (&port_lock_key){-.-.}-{3:3}:
[ 151.556639][ T5327] _raw_spin_lock_irqsave+0x40/0x60
[ 151.556648][ T5327] serial8250_console_write+0x153/0x1ba0
[ 151.556660][ T5327] console_flush_all+0x709/0xb40
[ 151.556671][ T5327] console_unlock+0xd1/0x1c0
[ 151.556680][ T5327] vprintk_emit+0x485/0x560
[ 151.556689][ T5327] _printk+0xdd/0x130
[ 151.556698][ T5327] register_console+0xc1b/0x1040
[ 151.556708][ T5327] univ8250_console_init+0x3a/0x70
[ 151.556719][ T5327] console_init+0x10b/0x4a0
[ 151.556728][ T5327] start_kernel+0x238/0x3e0
[ 151.556740][ T5327] x86_64_start_reservations+0x24/0x30
[ 151.556749][ T5327] x86_64_start_kernel+0x137/0x1b0
[ 151.556757][ T5327] common_startup_64+0x13e/0x157
[ 151.556767][ T5327]
[ 151.556767][ T5327] -> #0 (console_owner){....}-{0:0}:
[ 151.556779][ T5327] __lock_acquire+0x1520/0x2cf0
[ 151.556791][ T5327] lock_acquire+0x106/0x350
[ 151.556803][ T5327] console_flush_all+0x6b2/0xb40
[ 151.556813][ T5327] console_unlock+0xd1/0x1c0
[ 151.556821][ T5327] vprintk_emit+0x485/0x560
[ 151.556829][ T5327] _printk+0xdd/0x130
[ 151.556837][ T5327] __slab_bug+0x6e/0xd0
[ 151.556847][ T5327] slab_bug+0x57/0x80
[ 151.556855][ T5327] list_slab_objects+0x35/0x1a0
[ 151.556865][ T5327] __kmem_cache_shutdown+0x1a5/0x2a0
[ 151.556876][ T5327] kmem_cache_destroy+0x98/0x180
[ 151.556890][ T5327] virtio_gpu_free_vbufs+0x40/0x70
[ 151.556899][ T5327] virtio_gpu_release+0x55/0x140
[ 151.556911][ T5327] drm_dev_put+0xa9/0x120
[ 151.556924][ T5327] virtio_dev_remove+0x9c/0x1b0
[ 151.556941][ T5327] device_release_driver_internal+0x48b/0x880
[ 151.556954][ T5327] bus_remove_device+0x444/0x560
[ 151.556963][ T5327] device_del+0x524/0x8f0
[ 151.556972][ T5327] device_unregister+0x21/0xf0
[ 151.556983][ T5327] unregister_virtio_device+0x37/0x60
[ 151.556996][ T5327] virtio_pci_remove+0x7f/0xf0
[ 151.557005][ T5327] pci_device_remove+0x99/0x1c0
[ 151.557019][ T5327] device_release_driver_internal+0x48b/0x880
[ 151.557031][ T5327] unbind_store+0x1a1/0x1d0
[ 151.557039][ T5327] kernfs_fop_write_iter+0x3a4/0x540
[ 151.557046][ T5327] vfs_write+0x612/0xba0
[ 151.557055][ T5327] ksys_write+0x150/0x270
[ 151.557062][ T5327] do_syscall_64+0x166/0x520
[ 151.557072][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.557080][ T5327]
[ 151.557080][ T5327] other info that might help us debug this:
[ 151.557080][ T5327]
[ 151.557085][ T5327] Chain exists of:
[ 151.557085][ T5327] console_owner --> &pool->lock --> &n->list_lock
[ 151.557085][ T5327]
[ 151.557102][ T5327] Possible unsafe locking scenario:
[ 151.557102][ T5327]
[ 151.557105][ T5327] CPU0 CPU1
[ 151.557109][ T5327] ---- ----
[ 151.557112][ T5327] lock(&n->list_lock);
[ 151.557119][ T5327] lock(&pool->lock);
[ 151.557125][ T5327] lock(&n->list_lock);
[ 151.557139][ T5327] lock(console_owner);
[ 151.557145][ T5327]
[ 151.557145][ T5327] *** DEADLOCK ***
[ 151.557145][ T5327]
[ 151.557148][ T5327] locks held by syz.0.0/5327: 10, last CPU#0:
[ 151.557156][ T5327] #0: ffff88803f195470 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320
[ 151.557188][ T5327] #1: ffff888012fe2460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
[ 151.557216][ T5327] #2: ffff88801258a480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
[ 151.557232][ T5327] #3: ffff88801d29c1f8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 151.557254][ T5327] #4: ffff88803352e1b0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
[ 151.557278][ T5327] #5: ffffffff8ebe76b0 (cpu_hotplug_lock){++++}-{0:0}, at: kmem_cache_destroy+0x60/0x180
[ 151.557306][ T5327] #6: ffffffff8ee71f58 (slab_mutex){+.+.}-{4:4}, at: kmem_cache_destroy+0x6e/0x180
[ 151.557330][ T5327] #7: ffff88801d3b2f18 (&n->list_lock){-.-.}-{3:3}, at: __kmem_cache_shutdown+0x111/0x2a0
[ 151.557392][ T5327] #8: ffffffff8ed4c6a0 (console_lock){+.+.}-{0:0}, at: _printk+0xdd/0x130
[ 151.557418][ T5327] #9: ffffffff8ec33f38 (console_srcu){....}-{0:0}, at: console_flush_all+0x123/0xb40
[ 151.557448][ T5327]
[ 151.557448][ T5327] stack backtrace:
[ 151.557454][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 151.557467][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 151.557474][ T5327] Call Trace:
[ 151.557479][ T5327]
[ 151.557484][ T5327] dump_stack_lvl+0xe8/0x150
[ 151.557500][ T5327] print_circular_bug+0x2e1/0x300
[ 151.557512][ T5327] check_noncircular+0x12e/0x150
[ 151.557521][ T5327] __lock_acquire+0x1520/0x2cf0
[ 151.557538][ T5327] ? console_flush_all+0x123/0xb40
[ 151.557551][ T5327] lock_acquire+0x106/0x350
[ 151.557564][ T5327] ? console_flush_all+0x123/0xb40
[ 151.557578][ T5327] ? do_raw_spin_unlock+0x4d/0x200
[ 151.557589][ T5327] ? console_flush_all+0x123/0xb40
[ 151.557599][ T5327] console_flush_all+0x6b2/0xb40
[ 151.557617][ T5327] ? console_flush_all+0x123/0xb40
[ 151.557629][ T5327] ? console_flush_all+0x123/0xb40
[ 151.557641][ T5327] ? __pfx_console_flush_all+0x10/0x10
[ 151.557654][ T5327] ? is_printk_cpu_sync_owner+0x32/0x40
[ 151.557667][ T5327] console_unlock+0xd1/0x1c0
[ 151.557678][ T5327] ? __pfx_console_unlock+0x10/0x10
[ 151.557686][ T5327] ? _raw_spin_lock_bh+0x30/0x50
[ 151.557695][ T5327] ? _printk+0xdd/0x130
[ 151.557707][ T5327] vprintk_emit+0x485/0x560
[ 151.557719][ T5327] ? __pfx_vprintk_emit+0x10/0x10
[ 151.557731][ T5327] _printk+0xdd/0x130
[ 151.557739][ T5327] ? __lock_acquire+0x683/0x2cf0
[ 151.557753][ T5327] ? __pfx__printk+0x10/0x10
[ 151.557763][ T5327] ? do_raw_spin_lock+0x12b/0x2f0
[ 151.557776][ T5327] __slab_bug+0x6e/0xd0
[ 151.557787][ T5327] slab_bug+0x57/0x80
[ 151.557800][ T5327] list_slab_objects+0x35/0x1a0
[ 151.557813][ T5327] __kmem_cache_shutdown+0x1a5/0x2a0
[ 151.557827][ T5327] ? virtio_gpu_free_vbufs+0x40/0x70
[ 151.557838][ T5327] kmem_cache_destroy+0x98/0x180
[ 151.557852][ T5327] virtio_gpu_free_vbufs+0x40/0x70
[ 151.557859][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 151.557869][ T5327] virtio_gpu_release+0x55/0x140
[ 151.557878][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 151.557887][ T5327] drm_dev_put+0xa9/0x120
[ 151.557898][ T5327] virtio_dev_remove+0x9c/0x1b0
[ 151.557907][ T5327] ? __pfx_virtio_dev_remove+0x10/0x10
[ 151.557916][ T5327] device_release_driver_internal+0x48b/0x880
[ 151.557927][ T5327] bus_remove_device+0x444/0x560
[ 151.557935][ T5327] ? __pfx_bus_remove_device+0x10/0x10
[ 151.557942][ T5327] ? kernfs_remove_by_name_ns+0x101/0x140
[ 151.557950][ T5327] device_del+0x524/0x8f0
[ 151.557958][ T5327] ? __pfx_device_del+0x10/0x10
[ 151.557968][ T5327] device_unregister+0x21/0xf0
[ 151.557980][ T5327] unregister_virtio_device+0x37/0x60
[ 151.557992][ T5327] virtio_pci_remove+0x7f/0xf0
[ 151.558002][ T5327] pci_device_remove+0x99/0x1c0
[ 151.558018][ T5327] ? __pfx_pci_device_remove+0x10/0x10
[ 151.558031][ T5327] device_release_driver_internal+0x48b/0x880
[ 151.558047][ T5327] unbind_store+0x1a1/0x1d0
[ 151.558058][ T5327] ? __pfx_sysfs_kf_write+0x10/0x10
[ 151.558072][ T5327] kernfs_fop_write_iter+0x3a4/0x540
[ 151.558085][ T5327] vfs_write+0x612/0xba0
[ 151.558103][ T5327] ? __pfx_vfs_write+0x10/0x10
[ 151.558119][ T5327] ? __fget_files+0x2a/0x420
[ 151.558135][ T5327] ksys_write+0x150/0x270
[ 151.558144][ T5327] ? __pfx_ksys_write+0x10/0x10
[ 151.558160][ T5327] do_syscall_64+0x166/0x520
[ 151.558170][ T5327] ? trace_irq_disable+0x3b/0x140
[ 151.558182][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.558192][ T5327] ? clear_bhb_loop+0x70/0xc0
[ 151.558201][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.558211][ T5327] RIP: 0033:0x7fcfa2b9e0d9
[ 151.558221][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 151.558230][ T5327] RSP: 002b:00007fcfa39e0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 151.558241][ T5327] RAX: ffffffffffffffda RBX: 00007fcfa2e25fa0 RCX: 00007fcfa2b9e0d9
[ 151.558249][ T5327] RDX: 000000000000000c RSI: 0000200000000340 RDI: 0000000000000004
[ 151.558255][ T5327] RBP: 00007fcfa2c35024 R08: 0000000000000000 R09: 0000000000000000
[ 151.558262][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 151.558268][ T5327] R13: 00007fcfa2e26038 R14: 00007fcfa2e25fa0 R15: 00007ffdc6b4a808
[ 151.558278][ T5327]
[ 152.085053][ T5327] BUG virtio-gpu-vbufs (Not tainted): Objects remaining on __kmem_cache_shutdown()
[ 152.088953][ T5327] -----------------------------------------------------------------------------
[ 152.088953][ T5327]
[ 152.093588][ T5327] Object 0xffff88801fa58230 @offset=560
[ 152.095950][ T5327] Object 0xffff88801fa58348 @offset=840
[ 152.098303][ T5327] Slab 0xffffea00007e9600 objects=14 used=2 fp=0xffff88801fa58460 flags=0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 152.104383][ T5327] ------------[ cut here ]------------
[ 152.106805][ T5327] 1
[ 152.106815][ T5327] WARNING: mm/slub.c:1245 at __slab_err+0x15/0x20, CPU#0: syz.0.0/5327
[ 152.111427][ T5327] Modules linked in:
[ 152.113183][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Tainted: G B syzkaller #0 PREEMPT(full)
[ 152.117633][ T5327] Tainted: [B]=BAD_PAGE
[ 152.119202][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 152.123122][ T5327] RIP: 0010:__slab_err+0x15/0x20
[ 152.125137][ T5327] Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 2b 00 00 00 bf 05 00 00 00 be 01 00 00 00 e8 4c a0 5e 00 90 <0f> 0b 90 c3 cc cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90
[ 152.133793][ T5327] RSP: 0018:ffffc9000eb177b8 EFLAGS: 00010083
[ 152.136327][ T5327] RAX: ffffffff8186d99a RBX: ffff888034f54dc0 RCX: 0000000000100000
[ 152.139779][ T5327] RDX: ffffc9000f2c1000 RSI: 000000000006520c RDI: 000000000006520d
[ 152.143301][ T5327] RBP: ffffea0000498e50 R08: ffffffff9395c0c7 R09: 1ffffffff272b818
[ 152.146776][ T5327] R10: dffffc0000000000 R11: fffffbfff272b819 R12: ffff88801d3b2f48
[ 152.150147][ T5327] R13: ffffea00007e9600 R14: ffffc9000eb177d0 R15: ffff88801d3b2f00
[ 152.153430][ T5327] FS: 00007fcfa39e16c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000
[ 152.156948][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 152.159747][ T5327] CR2: 0000000000000000 CR3: 0000000033605000 CR4: 0000000000352ef0
[ 152.162812][ T5327] Call Trace:
[ 152.164157][ T5327]
[ 152.165301][ T5327] __kmem_cache_shutdown+0x1a5/0x2a0
[ 152.167447][ T5327] ? virtio_gpu_free_vbufs+0x40/0x70
[ 152.169593][ T5327] kmem_cache_destroy+0x98/0x180
[ 152.171618][ T5327] virtio_gpu_free_vbufs+0x40/0x70
[ 152.173739][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 152.176067][ T5327] virtio_gpu_release+0x55/0x140
[ 152.177935][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 152.180222][ T5327] drm_dev_put+0xa9/0x120
[ 152.182194][ T5327] virtio_dev_remove+0x9c/0x1b0
[ 152.184306][ T5327] ? __pfx_virtio_dev_remove+0x10/0x10
[ 152.186872][ T5327] device_release_driver_internal+0x48b/0x880
[ 152.189547][ T5327] bus_remove_device+0x444/0x560
[ 152.191622][ T5327] ? __pfx_bus_remove_device+0x10/0x10
[ 152.193993][ T5327] ? kernfs_remove_by_name_ns+0x101/0x140
[ 152.196396][ T5327] device_del+0x524/0x8f0
[ 152.198236][ T5327] ? __pfx_device_del+0x10/0x10
[ 152.200366][ T5327] device_unregister+0x21/0xf0
[ 152.202593][ T5327] unregister_virtio_device+0x37/0x60
[ 152.204944][ T5327] virtio_pci_remove+0x7f/0xf0
[ 152.207054][ T5327] pci_device_remove+0x99/0x1c0
[ 152.209227][ T5327] ? __pfx_pci_device_remove+0x10/0x10
[ 152.211980][ T5327] device_release_driver_internal+0x48b/0x880
[ 152.215153][ T5327] unbind_store+0x1a1/0x1d0
[ 152.217161][ T5327] ? __pfx_sysfs_kf_write+0x10/0x10
[ 152.219393][ T5327] kernfs_fop_write_iter+0x3a4/0x540
[ 152.221754][ T5327] vfs_write+0x612/0xba0
[ 152.223622][ T5327] ? __pfx_vfs_write+0x10/0x10
[ 152.225710][ T5327] ? __fget_files+0x2a/0x420
[ 152.227674][ T5327] ksys_write+0x150/0x270
[ 152.229479][ T5327] ? __pfx_ksys_write+0x10/0x10
[ 152.231486][ T5327] do_syscall_64+0x166/0x520
[ 152.233455][ T5327] ? trace_irq_disable+0x3b/0x140
[ 152.235477][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.238030][ T5327] ? clear_bhb_loop+0x70/0xc0
[ 152.239982][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.242526][ T5327] RIP: 0033:0x7fcfa2b9e0d9
[ 152.244475][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 152.252650][ T5327] RSP: 002b:00007fcfa39e0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 152.256317][ T5327] RAX: ffffffffffffffda RBX: 00007fcfa2e25fa0 RCX: 00007fcfa2b9e0d9
[ 152.260179][ T5327] RDX: 000000000000000c RSI: 0000200000000340 RDI: 0000000000000004
[ 152.263538][ T5327] RBP: 00007fcfa2c35024 R08: 0000000000000000 R09: 0000000000000000
[ 152.266789][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 152.270335][ T5327] R13: 00007fcfa2e26038 R14: 00007fcfa2e25fa0 R15: 00007ffdc6b4a808
[ 152.273918][ T5327]
[ 152.275228][ T5327] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 152.278099][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Tainted: G B syzkaller #0 PREEMPT(full)
[ 152.282269][ T5327] Tainted: [B]=BAD_PAGE
[ 152.283954][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 152.288182][ T5327] Call Trace:
[ 152.289699][ T5327]
[ 152.291029][ T5327] vpanic+0x56d/0xa60
[ 152.292719][ T5327] ? __pfx__printk+0x10/0x10
[ 152.294592][ T5327] ? __pfx_vpanic+0x10/0x10
[ 152.296411][ T5327] ? is_bpf_text_address+0x292/0x2b0
[ 152.298288][ T5327] ? is_bpf_text_address+0x26/0x2b0
[ 152.300319][ T5327] panic+0xc5/0xd0
[ 152.301888][ T5327] ? __pfx_panic+0x10/0x10
[ 152.303747][ T5327] __warn+0x315/0x4c0
[ 152.305462][ T5327] ? __slab_err+0x15/0x20
[ 152.307292][ T5327] ? __slab_err+0x15/0x20
[ 152.309048][ T5327] __report_bug+0x276/0x570
[ 152.311004][ T5327] ? do_raw_spin_unlock+0x4d/0x200
[ 152.313097][ T5327] ? __slab_err+0x15/0x20
[ 152.314914][ T5327] ? __pfx___report_bug+0x10/0x10
[ 152.317015][ T5327] ? __wake_up_klogd+0xf0/0x130
[ 152.319088][ T5327] ? vprintk_emit+0x4ee/0x560
[ 152.321018][ T5327] ? __pfx_vprintk_emit+0x10/0x10
[ 152.323229][ T5327] ? _printk+0xdd/0x130
[ 152.324919][ T5327] ? __slab_err+0x15/0x20
[ 152.326647][ T5327] report_bug+0x16b/0x220
[ 152.328468][ T5327] ? __slab_err+0x15/0x20
[ 152.330264][ T5327] ? __slab_err+0x17/0x20
[ 152.332140][ T5327] handle_bug+0x9c/0x200
[ 152.333933][ T5327] exc_invalid_op+0x1a/0x50
[ 152.335812][ T5327] asm_exc_invalid_op+0x1a/0x20
[ 152.337921][ T5327] RIP: 0010:__slab_err+0x15/0x20
[ 152.340101][ T5327] Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 2b 00 00 00 bf 05 00 00 00 be 01 00 00 00 e8 4c a0 5e 00 90 <0f> 0b 90 c3 cc cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90
[ 152.348914][ T5327] RSP: 0018:ffffc9000eb177b8 EFLAGS: 00010083
[ 152.351575][ T5327] RAX: ffffffff8186d99a RBX: ffff888034f54dc0 RCX: 0000000000100000
[ 152.354916][ T5327] RDX: ffffc9000f2c1000 RSI: 000000000006520c RDI: 000000000006520d
[ 152.358297][ T5327] RBP: ffffea0000498e50 R08: ffffffff9395c0c7 R09: 1ffffffff272b818
[ 152.361671][ T5327] R10: dffffc0000000000 R11: fffffbfff272b819 R12: ffff88801d3b2f48
[ 152.364963][ T5327] R13: ffffea00007e9600 R14: ffffc9000eb177d0 R15: ffff88801d3b2f00
[ 152.368167][ T5327] ? add_taint+0x9a/0xe0
[ 152.369897][ T5327] ? __slab_err+0x14/0x20
[ 152.371787][ T5327] __kmem_cache_shutdown+0x1a5/0x2a0
[ 152.374016][ T5327] ? virtio_gpu_free_vbufs+0x40/0x70
[ 152.376111][ T5327] kmem_cache_destroy+0x98/0x180
[ 152.378517][ T5327] virtio_gpu_free_vbufs+0x40/0x70
[ 152.381211][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 152.383605][ T5327] virtio_gpu_release+0x55/0x140
[ 152.385718][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 152.388036][ T5327] drm_dev_put+0xa9/0x120
[ 152.389935][ T5327] virtio_dev_remove+0x9c/0x1b0
[ 152.392042][ T5327] ? __pfx_virtio_dev_remove+0x10/0x10
[ 152.394441][ T5327] device_release_driver_internal+0x48b/0x880
[ 152.397020][ T5327] bus_remove_device+0x444/0x560
[ 152.399085][ T5327] ? __pfx_bus_remove_device+0x10/0x10
[ 152.401516][ T5327] ? kernfs_remove_by_name_ns+0x101/0x140
[ 152.404034][ T5327] device_del+0x524/0x8f0
[ 152.405956][ T5327] ? __pfx_device_del+0x10/0x10
[ 152.408029][ T5327] device_unregister+0x21/0xf0
[ 152.409986][ T5327] unregister_virtio_device+0x37/0x60
[ 152.412287][ T5327] virtio_pci_remove+0x7f/0xf0
[ 152.414392][ T5327] pci_device_remove+0x99/0x1c0
[ 152.416496][ T5327] ? __pfx_pci_device_remove+0x10/0x10
[ 152.418782][ T5327] device_release_driver_internal+0x48b/0x880
[ 152.421330][ T5327] unbind_store+0x1a1/0x1d0
[ 152.423310][ T5327] ? __pfx_sysfs_kf_write+0x10/0x10
[ 152.425624][ T5327] kernfs_fop_write_iter+0x3a4/0x540
[ 152.427842][ T5327] vfs_write+0x612/0xba0
[ 152.429589][ T5327] ? __pfx_vfs_write+0x10/0x10
[ 152.431516][ T5327] ? __fget_files+0x2a/0x420
[ 152.433479][ T5327] ksys_write+0x150/0x270
[ 152.435261][ T5327] ? __pfx_ksys_write+0x10/0x10
[ 152.437290][ T5327] do_syscall_64+0x166/0x520
[ 152.439180][ T5327] ? trace_irq_disable+0x3b/0x140
[ 152.441199][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.443766][ T5327] ? clear_bhb_loop+0x70/0xc0
[ 152.445808][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.448296][ T5327] RIP: 0033:0x7fcfa2b9e0d9
[ 152.450295][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 152.458237][ T5327] RSP: 002b:00007fcfa39e0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 152.461572][ T5327] RAX: ffffffffffffffda RBX: 00007fcfa2e25fa0 RCX: 00007fcfa2b9e0d9
[ 152.464777][ T5327] RDX: 000000000000000c RSI: 0000200000000340 RDI: 0000000000000004
[ 152.468115][ T5327] RBP: 00007fcfa2c35024 R08: 0000000000000000 R09: 0000000000000000
[ 152.471621][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 152.475200][ T5327] R13: 00007fcfa2e26038 R14: 00007fcfa2e25fa0 R15: 00007ffdc6b4a808
[ 152.478754][ T5327]
[ 152.480504][ T5327] Kernel Offset: disabled
[ 152.482455][ T5327] Rebooting in 86400 seconds..