program:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'sh\x00', 0x1, 0x7, 0x49}, 0x2c)
r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x23)
syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000003c0)=[@textreal={0x8, &(0x7f0000000280)="660f3880ab3aad67f20f1a9d868900000f783d66b9890a00000f322636670f222566b86d0000000f23c00f21f8663503000e000f23f8f326f2660f00090f01c2baf80c66b82fa2f28466efbafc0cb00aee360fae88fc1f", 0x57}], 0x1, 0x13, &(0x7f0000000400)=[@efer={0x2, 0x1100}, @cstype0={0x4, 0x400000001}], 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/task-filter\x00', 0x1, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r4, &(0x7f0000000100)='N', 0x1)
write(r5, &(0x7f0000000100)='100', 0x3)
lsetxattr$trusted_overlay_origin(0x0, &(0x7f00000001c0), &(0x7f0000000340), 0x2, 0x2)
mount$9p_fd(0x0, 0x0, 0x0, 0x1000, 0x0)
setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000440)={{0x84, @loopback, 0x4e21, 0x3, 'sh\x00', 0x71, 0x81, 0x56}, {@dev={0xac, 0x14, 0x14, 0x2a}, 0x4e23, 0x10000, 0xc3, 0x12d5c, 0x12d5c}}, 0x44)
r6 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_vs\x00')
read(r6, &(0x7f0000001b00)=""/194, 0xc2)
r7 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x8, 0x100, 0x3}, &(0x7f00000000c0)=<r8=>0x0, &(0x7f0000000100)=<r9=>0x0, &(0x7f00000004c0)=<r10=>0x0)
r11 = syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@any_dev={0x3, 0x998, 0x0, 0x0, 0x1000, 0x1ad, 0x0, 0x0, 0x104}}}, &(0x7f0000000300))
syz_open_dev$ublk_chdev(&(0x7f0000002000), r11, 0x2)
syz_open_dev$tty20(0xc, 0x4, 0x0)
r12 = socket$netlink(0x10, 0x3, 0x9)
sendmsg$NFT_BATCH(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1400000010cf580e845dd26c361b8d17af04010081bb779ddaf99cb20000010014000000f3030100"], 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x40001)
socket$nl_generic(0x11, 0x3, 0x10)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\v\x00\x00\x00\a\x00\x00'], 0x48)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0100000006000000080000000b00000000000000b9d487ed5b6e5d21d8a9478863f386323404067ccbf030fae958131b8d20267511c96648c20505f91ad3", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10)
r13 = getpid()
syz_pidfd_open(r13, 0x0)

[   95.050909][ T4643] Bluetooth: hci0: command tx timeout
[   95.139050][ T5317] FAULT_INJECTION: forcing a failure.
[   95.139050][ T5317] name failslab, interval 1, probability 100, space 0, times 1
[   95.139075][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   95.139088][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   95.139096][ T5317] Call Trace:
[   95.139113][ T5317]  <TASK>
[   95.139119][ T5317]  dump_stack_lvl+0xe8/0x150
[   95.139183][ T5317]  should_fail_ex+0x410/0x560
[   95.139260][ T5317]  should_failslab+0xa8/0x100
[   95.139275][ T5317]  __kvmalloc_node_noprof+0x176/0x820
[   95.139298][ T5317]  ? vmemdup_user+0x2b/0xd0
[   95.139314][ T5317]  ? vmemdup_user+0x2b/0xd0
[   95.139335][ T5317]  vmemdup_user+0x2b/0xd0
[   95.139351][ T5317]  path_setxattrat+0x2d0/0x450
[   95.139374][ T5317]  ? __pfx_path_setxattrat+0x10/0x10
[   95.139389][ T5317]  ? do_futex+0x3e7/0x4e0
[   95.139419][ T5317]  ? rcu_is_watching+0x16/0xb0
[   95.139436][ T5317]  __x64_sys_lsetxattr+0xbf/0xe0
[   95.139453][ T5317]  do_syscall_64+0x166/0x520
[   95.139500][ T5317]  ? trace_irq_disable+0x3b/0x140
[   95.139512][ T5317]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   95.139524][ T5317]  ? clear_bhb_loop+0x70/0xc0
[   95.139538][ T5317]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   95.139552][ T5317] RIP: 0033:0x7ffbde99e159
[   95.139564][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   95.139574][ T5317] RSP: 002b:00007ffbdf928fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
[   95.139589][ T5317] RAX: ffffffffffffffda RBX: 00007ffbdec25fa0 RCX: 00007ffbde99e159
[   95.139597][ T5317] RDX: 0000200000000340 RSI: 00002000000001c0 RDI: 0000000000000000
[   95.139656][ T5317] RBP: 00007ffbdea3503b R08: 0000000000000002 R09: 0000000000000000
[   95.139679][ T5317] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
[   95.139687][ T5317] R13: 00007ffbdec26038 R14: 00007ffbdec25fa0 R15: 00007ffd2370a528
[   95.139704][ T5317]  </TASK>
[   95.139828][  T806] FAULT_INJECTION: forcing a failure.
[   95.139828][  T806] name failslab, interval 1, probability 100, space 0, times 1
[   95.139845][  T806] CPU: 0 UID: 0 PID: 806 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) 
[   95.139857][  T806] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   95.139863][  T806] Workqueue: events drm_fb_helper_damage_work
[   95.139881][  T806] Call Trace:
[   95.139887][  T806]  <TASK>
[   95.139891][  T806]  dump_stack_lvl+0xe8/0x150
[   95.139910][  T806]  should_fail_ex+0x410/0x560
[   95.139931][  T806]  should_failslab+0xa8/0x100
[   95.139944][  T806]  __kmalloc_cache_noprof+0xa3/0x600
[   95.139961][  T806]  ? drm_atomic_commit_alloc+0xa9/0x100
[   95.139973][  T806]  ? drm_atomic_commit_alloc+0xa9/0x100
[   95.139990][  T806]  drm_atomic_commit_alloc+0xa9/0x100
[   95.140002][  T806]  drm_atomic_helper_dirtyfb+0x129/0xfd0
[   95.140022][  T806]  ? __lock_acquire+0x747/0x2de0
[   95.140037][  T806]  ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10
[   95.140064][  T806]  ? do_raw_spin_lock+0x12b/0x2f0
[   95.140086][  T806]  drm_fbdev_shmem_helper_fb_dirty+0x160/0x310
[   95.140105][  T806]  drm_fb_helper_damage_work+0x84c/0xf20
[   95.140124][  T806]  ? __pfx_drm_fb_helper_damage_work+0x10/0x10
[   95.140143][  T806]  ? lock_acquire+0x115/0x350
[   95.140158][  T806]  ? rcu_is_watching+0x16/0xb0
[   95.140170][  T806]  ? process_scheduled_works+0x97a/0x1630
[   95.140185][  T806]  process_scheduled_works+0xc3d/0x1630
[   95.140218][  T806]  ? __pfx_process_scheduled_works+0x10/0x10
[   95.140237][  T806]  ? assign_work+0x3cf/0x5d0
[   95.140253][  T806]  worker_thread+0xa47/0xfb0
[   95.140274][  T806]  ? __kthread_parkme+0x71/0x1f0
[   95.140295][  T806]  kthread+0x38b/0x480
[   95.140307][  T806]  ? __pfx_worker_thread+0x10/0x10
[   95.140319][  T806]  ? __pfx_kthread+0x10/0x10
[   95.140329][  T806]  ret_from_fork+0x514/0xb70
[   95.140342][  T806]  ? __pfx_ret_from_fork+0x10/0x10
[   95.140351][  T806]  ? __switch_to+0xc89/0x1420
[   95.140366][  T806]  ? __pfx_kthread+0x10/0x10
[   95.140376][  T806]  ret_from_fork_asm+0x1a/0x30
[   95.140404][  T806]  </TASK>
[   95.140459][  T806] ------------[ cut here ]------------
[   95.140465][  T806] virtio-pci 0000:00:01.0: [drm] Dirty helper failed: ret=-12
[   95.140473][  T806] WARNING: drivers/gpu/drm/drm_fbdev_shmem.c:118 at drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310, CPU#0: kworker/0:2/806
[   95.402204][  T806] Modules linked in:
[   95.404893][  T806] CPU: 0 UID: 0 PID: 806 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) 
[   95.409251][  T806] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   95.413434][  T806] Workqueue: events drm_fb_helper_damage_work
[   95.415890][  T806] RIP: 0010:drm_fbdev_shmem_helper_fb_dirty+0x288/0x310
[   95.418713][  T806] Code: 29 fc 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 da a0 9a fc 4d 8b 27 48 89 df 4c 89 f6 4c 89 e2 8b 5c 24 04 89 d9 <67> 48 0f b9 3a 89 d8 e9 f7 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f
[   95.429181][  T806] RSP: 0018:ffffc90003fff898 EFLAGS: 00010246
[   95.432503][  T806] RAX: 1ffff11003f5481a RBX: 00000000fffffff4 RCX: 00000000fffffff4
[   95.437145][  T806] RDX: ffff88801f7a2ee0 RSI: ffffffff8c79ca40 RDI: ffffffff90864130
[   95.441546][  T806] RBP: ffff888000a24008 R08: 0000000000000dc0 R09: 00000000ffffffff
[   95.446038][  T806] R10: dffffc0000000000 R11: fffffbfff1dd616f R12: ffff88801f7a2ee0
[   95.450651][  T806] R13: dffffc0000000000 R14: ffffffff8c79ca40 R15: ffff88801faa40d0
[   95.455462][  T806] FS:  0000000000000000(0000) GS:ffff88808c2c6000(0000) knlGS:0000000000000000
[   95.460779][  T806] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   95.464730][  T806] CR2: 00007ffbdf927518 CR3: 0000000043309000 CR4: 0000000000352ef0
[   95.469514][  T806] Call Trace:
[   95.473875][  T806]  <TASK>
[   95.475653][  T806]  drm_fb_helper_damage_work+0x84c/0xf20
[   95.479072][  T806]  ? __pfx_drm_fb_helper_damage_work+0x10/0x10
[   95.482720][  T806]  ? lock_acquire+0x115/0x350
[   95.485333][  T806]  ? rcu_is_watching+0x16/0xb0
[   95.488071][  T806]  ? process_scheduled_works+0x97a/0x1630
[   95.491314][  T806]  process_scheduled_works+0xc3d/0x1630
[   95.494558][  T806]  ? __pfx_process_scheduled_works+0x10/0x10
[   95.498529][  T806]  ? assign_work+0x3cf/0x5d0
[   95.501293][  T806]  worker_thread+0xa47/0xfb0
[   95.506363][  T806]  ? __kthread_parkme+0x71/0x1f0
[   95.508453][  T806]  kthread+0x38b/0x480
[   95.510322][  T806]  ? __pfx_worker_thread+0x10/0x10
[   95.512542][  T806]  ? __pfx_kthread+0x10/0x10
[   95.515031][  T806]  ret_from_fork+0x514/0xb70
[   95.517738][  T806]  ? __pfx_ret_from_fork+0x10/0x10
[   95.520643][  T806]  ? __switch_to+0xc89/0x1420
[   95.523499][  T806]  ? __pfx_kthread+0x10/0x10
[   95.526207][  T806]  ret_from_fork_asm+0x1a/0x30
[   95.528922][  T806]  </TASK>
[   95.530716][  T806] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   95.535126][  T806] CPU: 0 UID: 0 PID: 806 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) 
[   95.540255][  T806] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   95.545625][  T806] Workqueue: events drm_fb_helper_damage_work
[   95.548119][  T806] Call Trace:
[   95.549585][  T806]  <TASK>
[   95.550857][  T806]  vpanic+0x56d/0xa60
[   95.552569][  T806]  ? __pfx__printk+0x10/0x10
[   95.554517][  T806]  ? __pfx_vpanic+0x10/0x10
[   95.556441][  T806]  ? is_bpf_text_address+0x292/0x2b0
[   95.558613][  T806]  ? is_bpf_text_address+0x26/0x2b0
[   95.561355][  T806]  panic+0xc5/0xd0
[   95.563552][  T806]  ? __pfx_panic+0x10/0x10
[   95.566209][  T806]  ? ret_from_fork_asm+0x1a/0x30
[   95.569173][  T806]  __warn+0x315/0x4c0
[   95.571578][  T806]  ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310
[   95.575412][  T806]  ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310
[   95.579248][  T806]  __report_bug+0x276/0x570
[   95.581923][  T806]  ? drm_modeset_acquire_fini+0x27/0x180
[   95.585228][  T806]  ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310
[   95.588696][  T806]  ? __pfx___report_bug+0x10/0x10
[   95.591725][  T806]  ? drm_atomic_helper_dirtyfb+0xf27/0xfd0
[   95.595145][  T806]  ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10
[   95.598636][  T806]  report_bug_entry+0x19b/0x290
[   95.601375][  T806]  ? drm_fbdev_shmem_helper_fb_dirty+0x288/0x310
[   95.604514][  T806]  ? drm_fbdev_shmem_helper_fb_dirty+0x28d/0x310
[   95.608306][  T806]  handle_bug+0xce/0x200
[   95.610785][  T806]  exc_invalid_op+0x1a/0x50
[   95.612951][  T806]  asm_exc_invalid_op+0x1a/0x20
[   95.615344][  T806] RIP: 0010:drm_fbdev_shmem_helper_fb_dirty+0x288/0x310
[   95.618506][  T806] Code: 29 fc 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 da a0 9a fc 4d 8b 27 48 89 df 4c 89 f6 4c 89 e2 8b 5c 24 04 89 d9 <67> 48 0f b9 3a 89 d8 e9 f7 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f
[   95.632286][  T806] RSP: 0018:ffffc90003fff898 EFLAGS: 00010246
[   95.636588][  T806] RAX: 1ffff11003f5481a RBX: 00000000fffffff4 RCX: 00000000fffffff4
[   95.641471][  T806] RDX: ffff88801f7a2ee0 RSI: ffffffff8c79ca40 RDI: ffffffff90864130
[   95.645799][  T806] RBP: ffff888000a24008 R08: 0000000000000dc0 R09: 00000000ffffffff
[   95.649413][  T806] R10: dffffc0000000000 R11: fffffbfff1dd616f R12: ffff88801f7a2ee0
[   95.653150][  T806] R13: dffffc0000000000 R14: ffffffff8c79ca40 R15: ffff88801faa40d0
[   95.656812][  T806]  ? drm_fbdev_shmem_helper_fb_dirty+0x260/0x310
[   95.660024][  T806]  drm_fb_helper_damage_work+0x84c/0xf20
[   95.662521][  T806]  ? __pfx_drm_fb_helper_damage_work+0x10/0x10
[   95.665298][  T806]  ? lock_acquire+0x115/0x350
[   95.667709][  T806]  ? rcu_is_watching+0x16/0xb0
[   95.669908][  T806]  ? process_scheduled_works+0x97a/0x1630
[   95.672390][  T806]  process_scheduled_works+0xc3d/0x1630
[   95.675184][  T806]  ? __pfx_process_scheduled_works+0x10/0x10
[   95.678010][  T806]  ? assign_work+0x3cf/0x5d0
[   95.680578][  T806]  worker_thread+0xa47/0xfb0
[   95.683581][  T806]  ? __kthread_parkme+0x71/0x1f0
[   95.686692][  T806]  kthread+0x38b/0x480
[   95.689117][  T806]  ? __pfx_worker_thread+0x10/0x10
[   95.691384][  T806]  ? __pfx_kthread+0x10/0x10
[   95.693309][  T806]  ret_from_fork+0x514/0xb70
[   95.695462][  T806]  ? __pfx_ret_from_fork+0x10/0x10
[   95.698223][  T806]  ? __switch_to+0xc89/0x1420
[   95.700728][  T806]  ? __pfx_kthread+0x10/0x10
[   95.703410][  T806]  ret_from_fork_asm+0x1a/0x30
[   95.706215][  T806]  </TASK>
[   95.708266][  T806] Kernel Offset: disabled
[   95.710587][  T806] Rebooting in 86400 seconds..