program: r0 = fanotify_init(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000940)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001980)='./dev\x00', &(0x7f00000019c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001a00)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001a40)='./sys\x00', &(0x7f0000001a80)='sysfs\x00', 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000001ac0)='\x00', 0x9902) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xc}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="230000003600000002000000ffff000005"], 0x48) socket$alg(0x26, 0x5, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000840)={{r3}, &(0x7f0000000880), &(0x7f00000008c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000900)={r3, &(0x7f0000000940), &(0x7f0000000980)=""/4096}, 0x20) fanotify_mark(r0, 0x415, 0x48000003, r1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x8000) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f0000000140)={&(0x7f0000000180)=[r6, r6, r6], 0x0, 0x25abd7d07340f8fa}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000580)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc03064ca, &(0x7f00000005c0)={&(0x7f0000000600)=[r7, r6, r7], &(0x7f0000000640)=[0x1, 0x76b], 0xee6, 0x3, 0x4}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000002440)=@filter={'filter\x00', 0xe, 0x4, 0x5a0, 0xffffffff, 0x448, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x508, 0x508, 0x508, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x2f0, 0x318, 0x0, {}, [@common=@inet=@set4={{0x50}, {{0x0, 0x4, 0x5}, {{0xa5}, 0x1}, {{0xcd}, 0xf2}, 0x3}}, @common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1f, 0x0, [{0x0, 0x3, 0x8, 0x5e5}, {0x2, 0x4, 0x54, 0x37}, {0x7, 0x80, 0x81, 0x9}, {0x8, 0x7, 0x7, 0x8}, {0x7, 0x2, 0x3, 0x934}, {0xff, 0xe, 0x85, 0x2}, {0x9, 0x1, 0xfa, 0x4}, {0x1, 0xd, 0xff, 0x8}, {0x6, 0x7f, 0x5, 0x5}, {0x5, 0x5, 0x8, 0x5}, {0x9, 0xb, 0x5, 0x3}, {0x5, 0x3, 0x9, 0x7fff}, {0x1, 0xd5, 0x1, 0x200}, {0x2, 0x6, 0x60, 0x73}, {0x2, 0xe, 0x4, 0x853c}, {0x6, 0x5, 0x3, 0x6}, {0x5, 0xf1, 0x3, 0x1}, {0x1, 0xc2, 0x7, 0xce17}, {0x9, 0x3, 0x7, 0xffffff81}, {0x74, 0x8, 0x2, 0x95b}, {0x3ff, 0xd, 0xd8, 0x49}, {0x8, 0xa, 0x6, 0xffffffff}, {0x8, 0xc, 0x2, 0xfffffff8}, {0xfff9, 0x5, 0xc, 0x8001}, {0x9, 0x0, 0x4}, {0x2, 0xd, 0x9, 0x81}, {0x5, 0x7e, 0xfd, 0x129}, {0x9, 0x7f, 0x1, 0x100}, {0x2, 0x1, 0x2, 0xf8a7}, {0x7, 0x5, 0xaa, 0x8}, {0x3, 0xc, 0x80, 0x80000000}, {0x9, 0x1, 0x73, 0x101}, {0x1, 0x9, 0x4, 0x2}, {0x1, 0x2, 0x3, 0x3}, {0x7, 0x5, 0x7, 0xa54}, {0x0, 0x2, 0x7, 0x4598}, {0x6, 0x1, 0x64, 0x7}, {0x0, 0xb, 0x14, 0x3}, {0x9, 0x7, 0x5, 0x2}, {0x8, 0x7f, 0x55, 0x5}, {0x6, 0xf, 0x9, 0x4}, {0x81, 0x9, 0x4, 0x320d}, {0x8, 0xc, 0x0, 0x1}, {0x10, 0x3, 0x2, 0x3}, {0x7, 0x5, 0x8, 0x3ff}, {0xd, 0x0, 0x62, 0x200}, {0x5, 0x5, 0x2, 0x1}, {0x3, 0x7, 0x9a, 0x200}, {0x3, 0x3, 0x3, 0x1000}, {0x3, 0x4, 0x2, 0x80000000}, {0xd25, 0x1, 0xb6, 0x3}, {0x0, 0xa, 0x0, 0x1}, {0x80, 0x40, 0xa9, 0xf9}, {0x10, 0x3, 0x2, 0x5}, {0x10, 0xe, 0x8, 0x1dd51023}, {0x7af7, 0xf2, 0x1, 0x1000}, {0xfff, 0x37, 0x1, 0x101}, {0x7ff, 0x4, 0xdb, 0x341}, {0x2, 0x52, 0x7, 0xfffffff8}, {0x9, 0xf, 0x8}, {0x3, 0x10, 0x2, 0x2}, {0x200, 0xd7, 0xd7, 0x7}, {0x4, 0xc, 0x9, 0x3d8}, {0x3, 0x6, 0x45, 0x800}], {0xffffffffffffffff}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@inet=@iprange={{0x68}, {@ipv4=@local, @ipv4=@loopback, @ipv6=@loopback, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x20}}, @common=@inet=@ipcomp={{0x30}, {[0x4d2, 0x4d6], 0x1}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@inet=@tcpmss={{0x28}, {0x18, 0x100}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x18, 0x9, 0x4000}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x600) sendto$inet(r4, &(0x7f0000000500)="0002", 0x2, 0x4, &(0x7f0000000540)={0x2, 0x4e24, @empty}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r8 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r8, 0x6, 0x21, 0x0, &(0x7f0000001b00)) r9 = openat(0xffffffffffffff9c, &(0x7f0000000680)='file1\x00', 0x42, 0x1b6) write$binfmt_misc(r9, &(0x7f00000006c0)="f6", 0x1) ioctl$F2FS_IOC_SET_PIN_FILE(r2, 0x4004f50d, &(0x7f0000000200)=0x9) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000003100090025bd7000fddbdf250600000008000a00010000004cb616c9e8d170cd027f2f5dc6d655847f53a032b0d75606d4b40181158efcdd4c5cd895f2e58542aa86bd4bc1d54d0b3389b14da6344e6f00e07e58506beed7a4bb140bbd0a5db98cd96c6d95e0bf21638623303ad239a4422c8ec423e2504204f002d94d13694c6f4511c8f66153ff9a6228ef5a7cfc1dafc5d77e58afcfbe084c828c2ffe68aa1d79d317ee8ebec982ee1e361bc301d247ae0581524803628e7fcd770215fd7ecbbcdbb30729faf1d7"], 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x2000c080) [ 94.254185][ T4668] Bluetooth: hci0: command tx timeout [ 94.353121][ T5344] ------------[ cut here ]------------ [ 94.353132][ T5344] 1 [ 94.353146][ T5344] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5344 [ 94.360501][ T5344] Modules linked in: [ 94.362413][ T5344] CPU: 0 UID: 0 PID: 5344 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.366373][ T5344] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.371060][ T5344] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 94.374297][ T5344] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 68 5b 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89 [ 94.382795][ T5344] RSP: 0018:ffffc9000e4dfa78 EFLAGS: 00010246 [ 94.385466][ T5344] RAX: 0000000000000000 RBX: 00000001cd03e3e8 RCX: 0000000000100000 [ 94.388921][ T5344] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000001cd03e3e8 [ 94.392566][ T5344] RBP: 0000000000000cc0 R08: ffffffff85a4fcd9 R09: 0000000000000000 [ 94.396308][ T5344] R10: dffffc0000000000 R11: ffffffff85ae2f70 R12: ffffffff8cb73be8 [ 94.400015][ T5344] R13: ffffffff85ae149a R14: 00000001cd03e3e8 R15: 00000001cd03e3e8 [ 94.403934][ T5344] FS: 00007f43441446c0(0000) GS:ffff88808a9fe000(0000) knlGS:0000000000000000 [ 94.407965][ T5344] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.410732][ T5344] CR2: 00007f4343189140 CR3: 000000003364b000 CR4: 0000000000352ef0 [ 94.414187][ T5344] Call Trace: [ 94.415699][ T5344] [ 94.416981][ T5344] __kmalloc_large_node_noprof+0x18/0x90 [ 94.419207][ T5344] __kmalloc_noprof+0x3f6/0x710 [ 94.421246][ T5344] ? drm_syncobj_array_find+0x3a/0x440 [ 94.423502][ T5344] ? lock_acquire+0x115/0x350 [ 94.425398][ T5344] drm_syncobj_array_find+0x3a/0x440 [ 94.427395][ T5344] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 94.429749][ T5344] drm_ioctl_kernel+0x2df/0x3b0 [ 94.431729][ T5344] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 94.434384][ T5344] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 94.436635][ T5344] ? __might_fault+0xaf/0x130 [ 94.438702][ T5344] drm_ioctl+0x70e/0xba0 [ 94.440630][ T5344] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 94.443715][ T5344] ? __pfx_drm_ioctl+0x10/0x10 [ 94.446039][ T5344] ? __fget_files+0x2a/0x420 [ 94.448350][ T5344] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.450793][ T5344] ? __pfx_drm_ioctl+0x10/0x10 [ 94.452974][ T5344] __se_sys_ioctl+0xfc/0x170 [ 94.455005][ T5344] do_syscall_64+0x166/0x520 [ 94.457209][ T5344] ? trace_irq_disable+0x3b/0x140 [ 94.459394][ T5344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.462220][ T5344] ? clear_bhb_loop+0x70/0xc0 [ 94.464320][ T5344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.466946][ T5344] RIP: 0033:0x7f434319fb19 [ 94.468952][ T5344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.477953][ T5344] RSP: 002b:00007f4344143fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.481938][ T5344] RAX: ffffffffffffffda RBX: 00007f4343425fa0 RCX: 00007f434319fb19 [ 94.485443][ T5344] RDX: 0000200000000140 RSI: 00000000c01864cd RDI: 000000000000000a [ 94.489033][ T5344] RBP: 00007f4343237b70 R08: 0000000000000000 R09: 0000000000000000 [ 94.492647][ T5344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.496126][ T5344] R13: 00007f4343426038 R14: 00007f4343425fa0 R15: 00007ffccb5ea608 [ 94.499578][ T5344] [ 94.501068][ T5344] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.504287][ T5344] CPU: 0 UID: 0 PID: 5344 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.508710][ T5344] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.513505][ T5344] Call Trace: [ 94.515080][ T5344] [ 94.516471][ T5344] vpanic+0x26f/0x710 [ 94.518306][ T5344] panic+0xc5/0xd0 [ 94.520125][ T5344] ? __pfx_panic+0x10/0x10 [ 94.522448][ T5344] __warn+0x315/0x4c0 [ 94.524386][ T5344] ? ___kmalloc_large_node+0x10c/0x170 [ 94.526765][ T5344] ? ___kmalloc_large_node+0x10c/0x170 [ 94.529254][ T5344] __report_bug+0x276/0x570 [ 94.531331][ T5344] ? ___kmalloc_large_node+0x10c/0x170 [ 94.533737][ T5344] ? __pfx___report_bug+0x10/0x10 [ 94.536058][ T5344] ? irqentry_exit+0x2a0/0x9b0 [ 94.538176][ T5344] ? trace_irq_disable+0x3b/0x140 [ 94.540436][ T5344] ? ___kmalloc_large_node+0x10e/0x170 [ 94.542888][ T5344] ? ___kmalloc_large_node+0x10c/0x170 [ 94.545303][ T5344] ? ___kmalloc_large_node+0x10c/0x170 [ 94.547405][ T5344] report_bug+0x16b/0x220 [ 94.548996][ T5344] ? ___kmalloc_large_node+0x10c/0x170 [ 94.550878][ T5344] ? ___kmalloc_large_node+0x10e/0x170 [ 94.552938][ T5344] handle_bug+0x9c/0x200 [ 94.554894][ T5344] exc_invalid_op+0x1a/0x50 [ 94.556810][ T5344] asm_exc_invalid_op+0x1a/0x20 [ 94.558810][ T5344] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 94.561476][ T5344] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 68 5b 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89 [ 94.569917][ T5344] RSP: 0018:ffffc9000e4dfa78 EFLAGS: 00010246 [ 94.572634][ T5344] RAX: 0000000000000000 RBX: 00000001cd03e3e8 RCX: 0000000000100000 [ 94.576131][ T5344] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000001cd03e3e8 [ 94.579561][ T5344] RBP: 0000000000000cc0 R08: ffffffff85a4fcd9 R09: 0000000000000000 [ 94.582796][ T5344] R10: dffffc0000000000 R11: ffffffff85ae2f70 R12: ffffffff8cb73be8 [ 94.585861][ T5344] R13: ffffffff85ae149a R14: 00000001cd03e3e8 R15: 00000001cd03e3e8 [ 94.589116][ T5344] ? drm_syncobj_array_find+0x3a/0x440 [ 94.591354][ T5344] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 94.594171][ T5344] ? drm_dev_enter+0x49/0x150 [ 94.596325][ T5344] __kmalloc_large_node_noprof+0x18/0x90 [ 94.598816][ T5344] __kmalloc_noprof+0x3f6/0x710 [ 94.601146][ T5344] ? drm_syncobj_array_find+0x3a/0x440 [ 94.603578][ T5344] ? lock_acquire+0x115/0x350 [ 94.605693][ T5344] drm_syncobj_array_find+0x3a/0x440 [ 94.608315][ T5344] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 94.611132][ T5344] drm_ioctl_kernel+0x2df/0x3b0 [ 94.613268][ T5344] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 94.616274][ T5344] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 94.618565][ T5344] ? __might_fault+0xaf/0x130 [ 94.620722][ T5344] drm_ioctl+0x70e/0xba0 [ 94.622607][ T5344] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 94.625529][ T5344] ? __pfx_drm_ioctl+0x10/0x10 [ 94.627661][ T5344] ? __fget_files+0x2a/0x420 [ 94.629739][ T5344] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.631934][ T5344] ? __pfx_drm_ioctl+0x10/0x10 [ 94.634015][ T5344] __se_sys_ioctl+0xfc/0x170 [ 94.636039][ T5344] do_syscall_64+0x166/0x520 [ 94.638086][ T5344] ? trace_irq_disable+0x3b/0x140 [ 94.640284][ T5344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.642878][ T5344] ? clear_bhb_loop+0x70/0xc0 [ 94.644907][ T5344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.647423][ T5344] RIP: 0033:0x7f434319fb19 [ 94.649320][ T5344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.657438][ T5344] RSP: 002b:00007f4344143fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.661093][ T5344] RAX: ffffffffffffffda RBX: 00007f4343425fa0 RCX: 00007f434319fb19 [ 94.664421][ T5344] RDX: 0000200000000140 RSI: 00000000c01864cd RDI: 000000000000000a [ 94.667837][ T5344] RBP: 00007f4343237b70 R08: 0000000000000000 R09: 0000000000000000 [ 94.671275][ T5344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.674674][ T5344] R13: 00007f4343426038 R14: 00007f4343425fa0 R15: 00007ffccb5ea608 [ 94.677997][ T5344] [ 94.679878][ T5344] Kernel Offset: disabled [ 94.681811][ T5344] Rebooting in 86400 seconds..