program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0/driver\x00', 0x0, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x9f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) ioctl$sock_SIOCBRDELBR(r2, 0x89a2, &(0x7f0000000000)='bridge0\x00') r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r5, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e000300000003"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) syz_emit_ethernet(0x26, &(0x7f0000000200)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @random="6a2ddcf6177a", @val={@void, {0x806, 0x1, 0x1, 0x1}}, {@ipv4={0x8864, @generic={{0x5, 0x4, 0x1, 0x2, 0x14, 0x67, 0x0, 0x8, 0x4, 0x0, @private=0xa010101, @remote}}}}}, 0x0) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="02c82010000c000100050108"], 0x15) r6 = openat(r0, &(0x7f0000000140)='unbind\x00', 0x1, 0x0) write(r6, &(0x7f0000000180)='0000:00:01.0\x00', 0xd) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0) r8 = openat(r7, &(0x7f0000000240)='driver_override\x00', 0x1, 0x0) write(r8, &(0x7f0000000280)='intel_ish_ipc\x00', 0xe) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[], 0xb8}}, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000006c0)={'syztnl0\x00', &(0x7f0000000400)={'syztnl2\x00', 0x0, 0x1, 0x1, 0xc390, 0x8, {{0xc, 0x4, 0x0, 0x20, 0x30, 0x64, 0x0, 0x1, 0x4, 0x0, @local, @private=0xa010102, {[@end, @timestamp_prespec={0x44, 0xc, 0x35, 0x3, 0xa, [{@empty, 0xc}]}, @cipso={0x86, 0x6, 0x2}, @noop, @timestamp={0x44, 0x8, 0x69, 0x0, 0x6, [0x2]}]}}}}}) sendmsg$nl_xfrm(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b8000000190001000000000010000000000000000000000000000000000000007f00000100000000000000000000000000000008000000000a000000"], 0xb8}, 0x1, 0x0, 0x0, 0x2000c884}, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="a0000000210001000400000000000000ac1414aa000000000000000000000000ff02000000000000000000000000000100000003000000000a0000002e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000015358dd500d3781f00e00000020000000000000000000000007f00000100000000000000000000000000000000000000000000000000000001ffffffff0000000000000000000000003c040000020000000a000a00"], 0xa0}, 0x1, 0x0, 0x0, 0x40005}, 0x0) r12 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/intel_ish_ipc\x00', 0x0, 0x0) r13 = openat(r12, &(0x7f0000000340)='bind\x00', 0x1, 0x0) write(r13, &(0x7f0000000380)='0000:00:01.0\x00', 0xd) [ 104.835090][ T5288] Bluetooth: hci0: command tx timeout [ 105.151885][ T5325] bridge0: port 3(syz_tun) entered blocking state [ 105.152042][ T5325] bridge0: port 3(syz_tun) entered disabled state [ 105.175740][ T5325] syz_tun: entered allmulticast mode [ 105.178045][ T5325] syz_tun: entered promiscuous mode [ 105.180885][ T5325] bridge0: port 3(syz_tun) entered blocking state [ 105.181018][ T5325] bridge0: port 3(syz_tun) entered forwarding state [ 105.198417][ T5325] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 105.256730][ T5325] Console: switching to colour dummy device 80x25 [ 105.310176][ T5326] netlink: 80 bytes leftover after parsing attributes in process `syz.0.0'. [ 105.458688][ T5325] ------------[ cut here ]------------ [ 105.458731][ T5325] Memory manager not clean during takedown. [ 105.458749][ T5325] WARNING: drivers/gpu/drm/drm_mm.c:966 at drm_mm_takedown+0x54/0x70, CPU#0: syz.0.0/5325 [ 105.479161][ T5325] Modules linked in: [ 105.481999][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.486818][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.493113][ T5325] RIP: 0010:drm_mm_takedown+0x54/0x70 [ 105.496344][ T5325] Code: 4c 89 f7 e8 fe 11 a1 fc 49 8b 06 4c 39 f0 75 0e e8 31 6f 2f fc 5b 41 5e c3 cc cc cc cc cc e8 23 6f 2f fc 48 8d 3d 7c d7 ed 0a <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f [ 105.509665][ T5325] RSP: 0018:ffffc9000f55f800 EFLAGS: 00010287 [ 105.513994][ T5325] RAX: ffffffff85987ded RBX: ffff888034dfa068 RCX: 0000000000100000 [ 105.517969][ T5325] RDX: ffffc9000f601000 RSI: 00000000000139e0 RDI: ffffffff90865570 [ 105.522202][ T5325] RBP: ffffffff85972d00 R08: ffff88801f758180 R09: ffffffff8c8115c0 [ 105.527414][ T5325] R10: dffffc0000000000 R11: ffffffff85972d00 R12: ffff88801f758180 [ 105.531751][ T5325] R13: dffffc0000000000 R14: ffff888034dfa0a0 R15: dffffc0000000000 [ 105.536373][ T5325] FS: 00007f6bd18646c0(0000) GS:ffff88808c2bf000(0000) knlGS:0000000000000000 [ 105.541292][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.545388][ T5325] CR2: 00007fe449f909c0 CR3: 0000000042d61000 CR4: 0000000000352ef0 [ 105.549967][ T5325] Call Trace: [ 105.551825][ T5325] [ 105.553855][ T5325] drm_managed_release+0x208/0x380 [ 105.556761][ T5325] ? __pfx_virtio_gpu_release+0x10/0x10 [ 105.559793][ T5325] drm_dev_put+0xe0/0x120 [ 105.562195][ T5325] virtio_dev_remove+0x9c/0x1b0 [ 105.565036][ T5325] ? __pfx_virtio_dev_remove+0x10/0x10 [ 105.567973][ T5325] device_release_driver_internal+0x48b/0x880 [ 105.571319][ T5325] bus_remove_device+0x444/0x560 [ 105.574451][ T5325] ? __pfx_bus_remove_device+0x10/0x10 [ 105.580854][ T5325] ? kernfs_remove_by_name_ns+0x101/0x140 [ 105.583643][ T5325] device_del+0x524/0x8f0 [ 105.585748][ T5325] ? __pfx_device_del+0x10/0x10 [ 105.587690][ T5325] device_unregister+0x21/0xf0 [ 105.589639][ T5325] unregister_virtio_device+0x37/0x60 [ 105.594001][ T5325] virtio_pci_remove+0x7f/0xf0 [ 105.596924][ T5325] pci_device_remove+0x99/0x1c0 [ 105.599724][ T5325] ? __pfx_pci_device_remove+0x10/0x10 [ 105.603106][ T5325] device_release_driver_internal+0x48b/0x880 [ 105.606898][ T5325] unbind_store+0x1a1/0x1d0 [ 105.610019][ T5325] ? __pfx_sysfs_kf_write+0x10/0x10 [ 105.613958][ T5325] kernfs_fop_write_iter+0x3a4/0x540 [ 105.617630][ T5325] vfs_write+0x612/0xba0 [ 105.620871][ T5325] ? __pfx_vfs_write+0x10/0x10 [ 105.624335][ T5325] ? __fget_files+0x2a/0x420 [ 105.627516][ T5325] ksys_write+0x150/0x270 [ 105.630741][ T5325] ? __pfx_ksys_write+0x10/0x10 [ 105.634626][ T5325] do_syscall_64+0x166/0x520 [ 105.638219][ T5325] ? trace_irq_disable+0x3b/0x140 [ 105.642372][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.647589][ T5325] ? clear_bhb_loop+0x70/0xc0 [ 105.651378][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.655762][ T5325] RIP: 0033:0x7f6bd099e159 [ 105.658901][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.669196][ T5325] RSP: 002b:00007f6bd1863fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.672722][ T5325] RAX: ffffffffffffffda RBX: 00007f6bd0c26090 RCX: 00007f6bd099e159 [ 105.676521][ T5325] RDX: 000000000000000d RSI: 0000200000000180 RDI: 0000000000000008 [ 105.681878][ T5325] RBP: 00007f6bd0a3506b R08: 0000000000000000 R09: 0000000000000000 [ 105.687549][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.692590][ T5325] R13: 00007f6bd0c26128 R14: 00007f6bd0c26090 R15: 00007ffd8e7c3758 [ 105.697866][ T5325] [ 105.700190][ T5325] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 105.705559][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.710746][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.715435][ T5325] Call Trace: [ 105.717010][ T5325] [ 105.718565][ T5325] vpanic+0x56d/0xa60 [ 105.720890][ T5325] ? __pfx__printk+0x10/0x10 [ 105.723604][ T5325] ? __pfx_vpanic+0x10/0x10 [ 105.726296][ T5325] ? is_bpf_text_address+0x292/0x2b0 [ 105.729401][ T5325] ? is_bpf_text_address+0x26/0x2b0 [ 105.732239][ T5325] panic+0xc5/0xd0 [ 105.734489][ T5325] ? __pfx_panic+0x10/0x10 [ 105.737349][ T5325] __warn+0x315/0x4c0 [ 105.739697][ T5325] ? drm_mm_takedown+0x54/0x70 [ 105.742559][ T5325] ? drm_mm_takedown+0x54/0x70 [ 105.745285][ T5325] __report_bug+0x276/0x570 [ 105.747880][ T5325] ? virtio_dev_remove+0x9c/0x1b0 [ 105.750997][ T5325] ? device_release_driver_internal+0x48b/0x880 [ 105.755370][ T5325] ? bus_remove_device+0x444/0x560 [ 105.759323][ T5325] ? drm_mm_takedown+0x54/0x70 [ 105.762191][ T5325] ? __pfx___report_bug+0x10/0x10 [ 105.765374][ T5325] report_bug_entry+0x19b/0x290 [ 105.767819][ T5325] ? drm_mm_takedown+0x54/0x70 [ 105.770339][ T5325] ? drm_mm_takedown+0x59/0x70 [ 105.772909][ T5325] handle_bug+0xce/0x200 [ 105.775994][ T5325] exc_invalid_op+0x1a/0x50 [ 105.778519][ T5325] asm_exc_invalid_op+0x1a/0x20 [ 105.780663][ T5325] RIP: 0010:drm_mm_takedown+0x54/0x70 [ 105.783157][ T5325] Code: 4c 89 f7 e8 fe 11 a1 fc 49 8b 06 4c 39 f0 75 0e e8 31 6f 2f fc 5b 41 5e c3 cc cc cc cc cc e8 23 6f 2f fc 48 8d 3d 7c d7 ed 0a <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f [ 105.792021][ T5325] RSP: 0018:ffffc9000f55f800 EFLAGS: 00010287 [ 105.795281][ T5325] RAX: ffffffff85987ded RBX: ffff888034dfa068 RCX: 0000000000100000 [ 105.799116][ T5325] RDX: ffffc9000f601000 RSI: 00000000000139e0 RDI: ffffffff90865570 [ 105.803218][ T5325] RBP: ffffffff85972d00 R08: ffff88801f758180 R09: ffffffff8c8115c0 [ 105.806928][ T5325] R10: dffffc0000000000 R11: ffffffff85972d00 R12: ffff88801f758180 [ 105.810643][ T5325] R13: dffffc0000000000 R14: ffff888034dfa0a0 R15: dffffc0000000000 [ 105.814414][ T5325] ? __pfx_drm_gem_init_release+0x10/0x10 [ 105.816752][ T5325] ? __pfx_drm_gem_init_release+0x10/0x10 [ 105.819392][ T5325] ? drm_mm_takedown+0x4d/0x70 [ 105.821392][ T5325] drm_managed_release+0x208/0x380 [ 105.823530][ T5325] ? __pfx_virtio_gpu_release+0x10/0x10 [ 105.825783][ T5325] drm_dev_put+0xe0/0x120 [ 105.828148][ T5325] virtio_dev_remove+0x9c/0x1b0 [ 105.830598][ T5325] ? __pfx_virtio_dev_remove+0x10/0x10 [ 105.833422][ T5325] device_release_driver_internal+0x48b/0x880 [ 105.836553][ T5325] bus_remove_device+0x444/0x560 [ 105.838656][ T5325] ? __pfx_bus_remove_device+0x10/0x10 [ 105.841349][ T5325] ? kernfs_remove_by_name_ns+0x101/0x140 [ 105.844081][ T5325] device_del+0x524/0x8f0 [ 105.846122][ T5325] ? __pfx_device_del+0x10/0x10 [ 105.848304][ T5325] device_unregister+0x21/0xf0 [ 105.850254][ T5325] unregister_virtio_device+0x37/0x60 [ 105.852912][ T5325] virtio_pci_remove+0x7f/0xf0 [ 105.855090][ T5325] pci_device_remove+0x99/0x1c0 [ 105.857505][ T5325] ? __pfx_pci_device_remove+0x10/0x10 [ 105.860443][ T5325] device_release_driver_internal+0x48b/0x880 [ 105.865039][ T5325] unbind_store+0x1a1/0x1d0 [ 105.867534][ T5325] ? __pfx_sysfs_kf_write+0x10/0x10 [ 105.870379][ T5325] kernfs_fop_write_iter+0x3a4/0x540 [ 105.872941][ T5325] vfs_write+0x612/0xba0 [ 105.874932][ T5325] ? __pfx_vfs_write+0x10/0x10 [ 105.877304][ T5325] ? __fget_files+0x2a/0x420 [ 105.879903][ T5325] ksys_write+0x150/0x270 [ 105.884314][ T5325] ? __pfx_ksys_write+0x10/0x10 [ 105.888901][ T5325] do_syscall_64+0x166/0x520 [ 105.893167][ T5325] ? trace_irq_disable+0x3b/0x140 [ 105.896785][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.900033][ T5325] ? clear_bhb_loop+0x70/0xc0 [ 105.902252][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.906576][ T5325] RIP: 0033:0x7f6bd099e159 [ 105.909141][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.920651][ T5325] RSP: 002b:00007f6bd1863fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.926140][ T5325] RAX: ffffffffffffffda RBX: 00007f6bd0c26090 RCX: 00007f6bd099e159 [ 105.930738][ T5325] RDX: 000000000000000d RSI: 0000200000000180 RDI: 0000000000000008 [ 105.935626][ T5325] RBP: 00007f6bd0a3506b R08: 0000000000000000 R09: 0000000000000000 [ 105.940876][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.946029][ T5325] R13: 00007f6bd0c26128 R14: 00007f6bd0c26090 R15: 00007ffd8e7c3758 [ 105.953170][ T5325] [ 105.955111][ T5325] Kernel Offset: disabled [ 105.957085][ T5325] Rebooting in 86400 seconds..