program:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x5, &(0x7f0000000640)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={0x0, r0}, 0x18)
r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='27', 0x2)
ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000540)={0x7, 0x1, 0x3, 0x9f45, 'syz1\x00'})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='1', 0x1)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000240)='1', 0x1)
lsetxattr$trusted_overlay_origin(&(0x7f0000000280)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', &(0x7f00000002c0), 0x0, 0x0, 0x1)
r4 = socket$packet(0x11, 0x3, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$INCFS_IOC_CREATE_FILE(r3, 0xc058671e, &(0x7f0000000a00)={{}, {0x8}, 0x130, 0x0, 0x0, &(0x7f0000000700)='./sys/bus/pci/rescan\x00', &(0x7f0000000740)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', &(0x7f0000000780)="2bac64042ccd49814ec07b144178be94cb886953dd49d263af4970a55b87c7e45518c212dec924cd74f290345ccc6f90b97813665c85cf5c74e2c9711675a21c2cc83d0e5b46aa2d48cd94af2f0c2c2319f72d9411f8687e", 0x58, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="020000006d010000000000000cd00000004bbcccc31f230271700b667ed4f9e2aa1e99d788d4b45974cb36e745fab0b3ea1d419a462fe8e9701171ce1c72705b33927c266132fab002d1fe39baafec6492faed523e2cdf90ba43056c6a52c321e39c781ce1366944416c7df539de6602472d9e61a8604365c091d94f8474a125b602bde7d51bdba64808da5df8e2cf5c0eff10ec157a3b40528099368f70cf1f39e0b08ce9fd5f29eb826477da363f80469b7a9504ad8edef5d6f6f0e927d8a9c58411b3376eb1e807bdcddc75bac5848e01597c25ad92a77aadb320b1d797f7c190000000ebb5b05ebb4afefd4088b9dc684f990f2342080245240c316c672e1a42222c13923e7eba300a47b23a4c6f5372ef291fa90727d9b1868a7834937edb60226ffc5f2c3fe012ac15dd3a0c34bb60f858c9b469122125db2ee554545d741fcc291dde87fbabd269aace645268d2f64da2cc290104ddc85d8e8539f4a385bcc0ea6b1195f1f3784abc6a53e044d5129642f4328dedab15f56b000000a9241f97241a0013028feb788699b4f18d13e2a09411c9a80f2d30f226dd13466501e5d255a248f2d88706d0f0ec1e607197d0ed3798323953796f0bd40dc6bf841fde0af466e8d37e6513676977b893aab9e1e0ddeeb35107894baa6621999760cd0fdff6d24637a88deb"], 0x1e4})
sendmsg$NFT_BATCH(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x14}]}}}]}]}], {0x14}}, 0xdc}}, 0x0)
syz_emit_ethernet(0x3e, &(0x7f0000000480)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x67, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x61, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x2f, 0x9, @dev={0xac, 0x14, 0x14, 0x10}, @remote}}}}}}, 0x0)
r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x40400)
ioctl$DRM_IOCTL_SYNCOBJ_RESET(r6, 0xc01064c4, &(0x7f0000000180)={&(0x7f0000000140)=[0x0], 0xfffffffffffffd58})
[ 85.517815][ T5300] Bluetooth: hci0: command tx timeout
[ 85.750930][ T5348] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 conventional PCI endpoint
[ 85.779249][ T5348] pci 0000:00:00.0: Adding to iommu group 0
[ 85.818729][ T5347] ------------[ cut here ]------------
[ 85.818743][ T5347] 1
[ 85.818747][ T5347] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5347
[ 85.827299][ T5347] Modules linked in:
[ 85.829083][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.832768][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 85.837203][ T5347] RIP: 0010:___kmalloc_large_node+0x10c/0x170
[ 85.840024][ T5347] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 0c ad 0b 00 c6 05 94 55 51 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89
[ 85.848489][ T5347] RSP: 0018:ffffc9000e59fa88 EFLAGS: 00010246
[ 85.851104][ T5347] RAX: 0000000000000000 RBX: 00000003fffff560 RCX: 0000000000100000
[ 85.854474][ T5347] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000003fffff560
[ 85.857967][ T5347] RBP: 0000000000000cc0 R08: ffffffff85a15ad9 R09: 0000000000000000
[ 85.861452][ T5347] R10: dffffc0000000000 R11: ffffffff85aa8390 R12: ffffffff8cb70748
[ 85.865151][ T5347] R13: ffffffff85aa729a R14: 00000003fffff560 R15: 00000003fffff560
[ 85.868712][ T5347] FS: 00007f3acef4a6c0(0000) GS:ffff88808ac1d000(0000) knlGS:0000000000000000
[ 85.872538][ T5347] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 85.875333][ T5347] CR2: 00007f3acdf88b80 CR3: 0000000045a0d000 CR4: 0000000000352ef0
[ 85.878712][ T5347] Call Trace:
[ 85.880203][ T5347]
[ 85.881512][ T5347] __kmalloc_large_node_noprof+0x18/0x90
[ 85.883960][ T5347] __kmalloc_noprof+0x3f6/0x710
[ 85.886503][ T5347] ? drm_syncobj_array_find+0x3a/0x440
[ 85.889379][ T5347] drm_syncobj_array_find+0x3a/0x440
[ 85.891651][ T5347] drm_syncobj_reset_ioctl+0x17b/0x450
[ 85.894178][ T5347] drm_ioctl_kernel+0x2df/0x3b0
[ 85.896412][ T5347] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10
[ 85.898954][ T5347] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 85.901369][ T5347] drm_ioctl+0x70e/0xba0
[ 85.903255][ T5347] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10
[ 85.905819][ T5347] ? __pfx_drm_ioctl+0x10/0x10
[ 85.908066][ T5347] ? __fget_files+0x2a/0x420
[ 85.910115][ T5347] ? bpf_lsm_file_ioctl+0x9/0x20
[ 85.912347][ T5347] ? __pfx_drm_ioctl+0x10/0x10
[ 85.914563][ T5347] __se_sys_ioctl+0xfc/0x170
[ 85.916841][ T5347] do_syscall_64+0x166/0x520
[ 85.919047][ T5347] ? trace_irq_disable+0x3b/0x140
[ 85.922246][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.924777][ T5347] ? clear_bhb_loop+0x70/0xc0
[ 85.926966][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.929539][ T5347] RIP: 0033:0x7f3acdf9f559
[ 85.931426][ T5347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 85.939590][ T5347] RSP: 002b:00007f3acef49fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 85.943094][ T5347] RAX: ffffffffffffffda RBX: 00007f3ace225fa0 RCX: 00007f3acdf9f559
[ 85.946599][ T5347] RDX: 0000200000000180 RSI: 00000000c01064c4 RDI: 0000000000000008
[ 85.950028][ T5347] RBP: 00007f3ace036b20 R08: 0000000000000000 R09: 0000000000000000
[ 85.953467][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 85.957137][ T5347] R13: 00007f3ace226038 R14: 00007f3ace225fa0 R15: 00007fff2ffaf7b8
[ 85.960578][ T5347]
[ 85.962008][ T5347] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 85.965662][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.969419][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 85.973495][ T5347] Call Trace:
[ 85.974984][ T5347]
[ 85.976342][ T5347] vpanic+0x56d/0xa60
[ 85.978095][ T5347] ? __pfx__printk+0x10/0x10
[ 85.980100][ T5347] ? __pfx_vpanic+0x10/0x10
[ 85.982099][ T5347] ? is_bpf_text_address+0x292/0x2b0
[ 85.984403][ T5347] ? is_bpf_text_address+0x26/0x2b0
[ 85.986660][ T5347] panic+0xc5/0xd0
[ 85.988309][ T5347] ? __pfx_panic+0x10/0x10
[ 85.990211][ T5347] __warn+0x315/0x4c0
[ 85.991973][ T5347] ? ___kmalloc_large_node+0x10c/0x170
[ 85.994335][ T5347] ? ___kmalloc_large_node+0x10c/0x170
[ 85.996482][ T5347] __report_bug+0x276/0x570
[ 85.998397][ T5347] ? ___kmalloc_large_node+0x10c/0x170
[ 86.000682][ T5347] ? __pfx___report_bug+0x10/0x10
[ 86.002740][ T5347] ? stack_trace_save+0xa9/0x100
[ 86.004808][ T5347] ? __pfx_stack_trace_save+0x10/0x10
[ 86.007004][ T5347] ? kasan_save_track+0x4f/0x80
[ 86.009037][ T5347] ? stack_depot_save_flags+0x33/0x7f0
[ 86.011272][ T5347] ? __lock_acquire+0x747/0x2de0
[ 86.013264][ T5347] ? kasan_save_track+0x4f/0x80
[ 86.015232][ T5347] ? ___kmalloc_large_node+0x10c/0x170
[ 86.017424][ T5347] report_bug+0x16b/0x220
[ 86.019226][ T5347] ? ___kmalloc_large_node+0x10c/0x170
[ 86.021394][ T5347] ? ___kmalloc_large_node+0x10e/0x170
[ 86.023743][ T5347] handle_bug+0x9c/0x200
[ 86.025559][ T5347] exc_invalid_op+0x1a/0x50
[ 86.027429][ T5347] asm_exc_invalid_op+0x1a/0x20
[ 86.029439][ T5347] RIP: 0010:___kmalloc_large_node+0x10c/0x170
[ 86.031996][ T5347] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 0c ad 0b 00 c6 05 94 55 51 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89
[ 86.039551][ T5347] RSP: 0018:ffffc9000e59fa88 EFLAGS: 00010246
[ 86.041935][ T5347] RAX: 0000000000000000 RBX: 00000003fffff560 RCX: 0000000000100000
[ 86.045068][ T5347] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000003fffff560
[ 86.048371][ T5347] RBP: 0000000000000cc0 R08: ffffffff85a15ad9 R09: 0000000000000000
[ 86.051727][ T5347] R10: dffffc0000000000 R11: ffffffff85aa8390 R12: ffffffff8cb70748
[ 86.055095][ T5347] R13: ffffffff85aa729a R14: 00000003fffff560 R15: 00000003fffff560
[ 86.058371][ T5347] ? drm_syncobj_array_find+0x3a/0x440
[ 86.060706][ T5347] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10
[ 86.063131][ T5347] ? drm_dev_enter+0x49/0x150
[ 86.065234][ T5347] __kmalloc_large_node_noprof+0x18/0x90
[ 86.067865][ T5347] __kmalloc_noprof+0x3f6/0x710
[ 86.069946][ T5347] ? drm_syncobj_array_find+0x3a/0x440
[ 86.072443][ T5347] drm_syncobj_array_find+0x3a/0x440
[ 86.074855][ T5347] drm_syncobj_reset_ioctl+0x17b/0x450
[ 86.077304][ T5347] drm_ioctl_kernel+0x2df/0x3b0
[ 86.079458][ T5347] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10
[ 86.082388][ T5347] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 86.085038][ T5347] drm_ioctl+0x70e/0xba0
[ 86.087130][ T5347] ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10
[ 86.090209][ T5347] ? __pfx_drm_ioctl+0x10/0x10
[ 86.092526][ T5347] ? __fget_files+0x2a/0x420
[ 86.094844][ T5347] ? bpf_lsm_file_ioctl+0x9/0x20
[ 86.096995][ T5347] ? __pfx_drm_ioctl+0x10/0x10
[ 86.098985][ T5347] __se_sys_ioctl+0xfc/0x170
[ 86.100940][ T5347] do_syscall_64+0x166/0x520
[ 86.102797][ T5347] ? trace_irq_disable+0x3b/0x140
[ 86.104988][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.107629][ T5347] ? clear_bhb_loop+0x70/0xc0
[ 86.109794][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.112288][ T5347] RIP: 0033:0x7f3acdf9f559
[ 86.114232][ T5347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.122418][ T5347] RSP: 002b:00007f3acef49fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 86.126036][ T5347] RAX: ffffffffffffffda RBX: 00007f3ace225fa0 RCX: 00007f3acdf9f559
[ 86.129459][ T5347] RDX: 0000200000000180 RSI: 00000000c01064c4 RDI: 0000000000000008
[ 86.132969][ T5347] RBP: 00007f3ace036b20 R08: 0000000000000000 R09: 0000000000000000
[ 86.136478][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.139857][ T5347] R13: 00007f3ace226038 R14: 00007f3ace225fa0 R15: 00007fff2ffaf7b8
[ 86.143152][ T5347]
[ 86.144869][ T5347] Kernel Offset: disabled
[ 86.146649][ T5347] Rebooting in 86400 seconds..