program: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x40100001, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000240)={&(0x7f0000000180)=[r5], 0x1, r3, r4, 0x1, 0x0, 0x2, 0x1, {0xac7c, 0x1, 0x7, 0x69, 0xf4b, 0x3, 0x2, 0x45, 0x412f, 0xe154, 0xfd, 0x7, 0xb2be, 0x3, "fe1d00003413000000000000000caa000000090000000000000004b427180010"}}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01864c2, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01864c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000200)={0x0}) r9 = syz_open_dev$dri(&(0x7f0000000300), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r9, 0xc00864bf, &(0x7f0000000340)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r9, 0xc01864cd, &(0x7f0000000380)={&(0x7f00000003c0)=[r10, r10, r10], &(0x7f0000000400)=[0x800000000006, 0xf], 0x4000000000000285}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01864c2, &(0x7f0000000440)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01864c2, &(0x7f0000000480)={0x0}) r13 = syz_open_dev$dri(&(0x7f00000004c0), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r13, 0xc00864bf, &(0x7f0000000500)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r13, 0xc02064cc, &(0x7f0000000540)={r14, r14, 0xb, 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01864c2, &(0x7f0000000580)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01864c2, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc03064ca, &(0x7f0000000700)={&(0x7f0000000600)=[r6, r7, r8, r10, r11, 0x0, r12, r14, r15, r16], &(0x7f0000000680)=[0x9, 0x98f4, 0x3482], 0x3ff, 0xa, 0x3}) [ 93.478028][ T5279] Bluetooth: hci0: command tx timeout [ 93.503062][ T1376] cfg80211: failed to load regulatory.db [ 93.626436][ T5307] [drm:virtio_gpu_dequeue_ctrl_func] *ERROR* response 0x1205 (command 0x103) [ 94.592464][ T5319] ------------[ cut here ]------------ [ 94.592479][ T5319] [CRTC:40:crtc-0] vblank wait timed out [ 94.592487][ T5319] WARNING: drivers/gpu/drm/drm_atomic_helper.c:1928 at drm_atomic_helper_wait_for_vblanks+0x763/0x8f0, CPU#0: syz.0.0/5319 [ 94.603247][ T5319] Modules linked in: [ 94.605119][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.609163][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.613680][ T5319] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 94.616858][ T5319] Code: 00 4d 8d 6e 20 45 8b 3f 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 0e 48 89 fb 4c 89 ef e8 87 c0 98 fc 48 89 df 49 8b 55 00 44 89 fe <67> 48 0f b9 3a 49 bd 00 00 00 00 00 fc ff df 48 8b 5c 24 50 e9 cc [ 94.624946][ T5319] RSP: 0018:ffffc9000e717540 EFLAGS: 00010246 [ 94.627530][ T5319] RAX: 1ffff11006c1400c RBX: dffffc0000000000 RCX: 0000000000100000 [ 94.630760][ T5319] RDX: ffff888000751700 RSI: 0000000000000028 RDI: ffffffff91868e40 [ 94.634136][ T5319] RBP: ffffc9000e717680 R08: ffffffff917aa87f R09: 1ffffffff22f550f [ 94.637425][ T5319] R10: dffffc0000000000 R11: fffffbfff22f5510 R12: ffff888044c0ac08 [ 94.640843][ T5319] R13: ffff8880360a0060 R14: ffff8880360a0040 R15: 0000000000000028 [ 94.644405][ T5319] FS: 00007f0596de06c0(0000) GS:ffff88808b0b0000(0000) knlGS:0000000000000000 [ 94.648440][ T5319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.651173][ T5319] CR2: 00007fae01608d50 CR3: 00000000457bd000 CR4: 0000000000352ef0 [ 94.654804][ T5319] Call Trace: [ 94.656207][ T5319] [ 94.657566][ T5319] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 94.660545][ T5319] ? __pfx_autoremove_wake_function+0x10/0x10 [ 94.663403][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.666202][ T5319] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 94.669010][ T5319] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 94.671673][ T5319] commit_tail+0x2b1/0x3c0 [ 94.673879][ T5319] drm_atomic_helper_commit+0xa77/0xb10 [ 94.676355][ T5319] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 94.678746][ T5319] drm_atomic_commit+0x24e/0x2b0 [ 94.680945][ T5319] ? __pfx_drm_atomic_commit+0x10/0x10 [ 94.683360][ T5319] ? __pfx___drm_printfn_info+0x10/0x10 [ 94.685631][ T5319] ? drm_atomic_commit_init+0x2ca/0x370 [ 94.688514][ T5319] drm_atomic_helper_set_config+0xe2/0x160 [ 94.691453][ T5319] drm_mode_setcrtc+0xa70/0x1d20 [ 94.693746][ T5319] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 94.696097][ T5319] ? __lock_acquire+0x747/0x2de0 [ 94.698150][ T5319] ? do_raw_spin_unlock+0x4d/0x200 [ 94.700297][ T5319] ? _raw_spin_unlock+0x28/0x50 [ 94.702488][ T5319] ? drm_is_current_master+0x19f/0x200 [ 94.704976][ T5319] drm_ioctl_kernel+0x2df/0x3b0 [ 94.707281][ T5319] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 94.709528][ T5319] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 94.711929][ T5319] drm_ioctl+0x70e/0xba0 [ 94.713700][ T5319] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 94.715920][ T5319] ? __pfx_drm_ioctl+0x10/0x10 [ 94.717955][ T5319] ? __fget_files+0x2a/0x420 [ 94.720001][ T5319] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.722263][ T5319] ? __pfx_drm_ioctl+0x10/0x10 [ 94.724339][ T5319] __se_sys_ioctl+0xfc/0x170 [ 94.726402][ T5319] do_syscall_64+0x166/0x520 [ 94.728457][ T5319] ? trace_irq_disable+0x3b/0x140 [ 94.730602][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.733335][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 94.735342][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.738257][ T5319] RIP: 0033:0x7f0595f9f559 [ 94.740655][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.748900][ T5319] RSP: 002b:00007f0596ddffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.753100][ T5319] RAX: ffffffffffffffda RBX: 00007f0596225fa0 RCX: 00007f0595f9f559 [ 94.756724][ T5319] RDX: 0000200000000240 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 94.760100][ T5319] RBP: 00007f0596036b20 R08: 0000000000000000 R09: 0000000000000000 [ 94.763396][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.766805][ T5319] R13: 00007f0596226038 R14: 00007f0596225fa0 R15: 00007ffc4d3ff4b8 [ 94.770055][ T5319] [ 94.771414][ T5319] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.774754][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.778945][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.783507][ T5319] Call Trace: [ 94.784938][ T5319] [ 94.786244][ T5319] vpanic+0x56d/0xa60 [ 94.788071][ T5319] ? __pfx__printk+0x10/0x10 [ 94.790139][ T5319] ? __pfx_vpanic+0x10/0x10 [ 94.792190][ T5319] ? is_bpf_text_address+0x292/0x2b0 [ 94.794472][ T5319] ? is_bpf_text_address+0x26/0x2b0 [ 94.796779][ T5319] panic+0xc5/0xd0 [ 94.798363][ T5319] ? __pfx_panic+0x10/0x10 [ 94.800283][ T5319] __warn+0x315/0x4c0 [ 94.802123][ T5319] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 94.805016][ T5319] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 94.807903][ T5319] __report_bug+0x276/0x570 [ 94.809841][ T5319] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 94.812727][ T5319] ? __pfx___report_bug+0x10/0x10 [ 94.815046][ T5319] report_bug_entry+0x19b/0x290 [ 94.817150][ T5319] ? drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 94.820003][ T5319] ? drm_atomic_helper_wait_for_vblanks+0x7a8/0x8f0 [ 94.822786][ T5319] handle_bug+0xce/0x200 [ 94.824625][ T5319] exc_invalid_op+0x1a/0x50 [ 94.826594][ T5319] asm_exc_invalid_op+0x1a/0x20 [ 94.828739][ T5319] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 94.831946][ T5319] Code: 00 4d 8d 6e 20 45 8b 3f 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 0e 48 89 fb 4c 89 ef e8 87 c0 98 fc 48 89 df 49 8b 55 00 44 89 fe <67> 48 0f b9 3a 49 bd 00 00 00 00 00 fc ff df 48 8b 5c 24 50 e9 cc [ 94.840173][ T5319] RSP: 0018:ffffc9000e717540 EFLAGS: 00010246 [ 94.842774][ T5319] RAX: 1ffff11006c1400c RBX: dffffc0000000000 RCX: 0000000000100000 [ 94.846239][ T5319] RDX: ffff888000751700 RSI: 0000000000000028 RDI: ffffffff91868e40 [ 94.849814][ T5319] RBP: ffffc9000e717680 R08: ffffffff917aa87f R09: 1ffffffff22f550f [ 94.853369][ T5319] R10: dffffc0000000000 R11: fffffbfff22f5510 R12: ffff888044c0ac08 [ 94.856865][ T5319] R13: ffff8880360a0060 R14: ffff8880360a0040 R15: 0000000000000028 [ 94.860396][ T5319] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 94.863442][ T5319] ? __pfx_autoremove_wake_function+0x10/0x10 [ 94.866016][ T5319] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 94.868390][ T5319] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 94.871153][ T5319] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 94.873720][ T5319] commit_tail+0x2b1/0x3c0 [ 94.875793][ T5319] drm_atomic_helper_commit+0xa77/0xb10 [ 94.878189][ T5319] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 94.880804][ T5319] drm_atomic_commit+0x24e/0x2b0 [ 94.882858][ T5319] ? __pfx_drm_atomic_commit+0x10/0x10 [ 94.885186][ T5319] ? __pfx___drm_printfn_info+0x10/0x10 [ 94.887572][ T5319] ? drm_atomic_commit_init+0x2ca/0x370 [ 94.889894][ T5319] drm_atomic_helper_set_config+0xe2/0x160 [ 94.892432][ T5319] drm_mode_setcrtc+0xa70/0x1d20 [ 94.894708][ T5319] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 94.897032][ T5319] ? __lock_acquire+0x747/0x2de0 [ 94.899227][ T5319] ? do_raw_spin_unlock+0x4d/0x200 [ 94.901446][ T5319] ? _raw_spin_unlock+0x28/0x50 [ 94.903658][ T5319] ? drm_is_current_master+0x19f/0x200 [ 94.906149][ T5319] drm_ioctl_kernel+0x2df/0x3b0 [ 94.908391][ T5319] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 94.910689][ T5319] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 94.913062][ T5319] drm_ioctl+0x70e/0xba0 [ 94.914977][ T5319] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 94.917447][ T5319] ? __pfx_drm_ioctl+0x10/0x10 [ 94.919648][ T5319] ? __fget_files+0x2a/0x420 [ 94.921704][ T5319] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.923900][ T5319] ? __pfx_drm_ioctl+0x10/0x10 [ 94.925999][ T5319] __se_sys_ioctl+0xfc/0x170 [ 94.928093][ T5319] do_syscall_64+0x166/0x520 [ 94.930132][ T5319] ? trace_irq_disable+0x3b/0x140 [ 94.932424][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.935194][ T5319] ? clear_bhb_loop+0x70/0xc0 [ 94.937361][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.940033][ T5319] RIP: 0033:0x7f0595f9f559 [ 94.942064][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.950526][ T5319] RSP: 002b:00007f0596ddffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.954202][ T5319] RAX: ffffffffffffffda RBX: 00007f0596225fa0 RCX: 00007f0595f9f559 [ 94.957654][ T5319] RDX: 0000200000000240 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 94.961100][ T5319] RBP: 00007f0596036b20 R08: 0000000000000000 R09: 0000000000000000 [ 94.964638][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.968024][ T5319] R13: 00007f0596226038 R14: 00007f0596225fa0 R15: 00007ffc4d3ff4b8 [ 94.971493][ T5319] [ 94.973256][ T5319] Kernel Offset: disabled [ 94.975142][ T5319] Rebooting in 86400 seconds..