program: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_mount_image$hfsplus(&(0x7f0000000600), &(0x7f0000002040)='./file0\x00', 0x800800, &(0x7f0000000040)={[{@creator={'creator', 0x3d, "838818f1"}}, {@nodecompose}]}, 0x1, 0x5d9, &(0x7f0000000640)="$eJzs3U9vHGcdB/DvbmJnHaTUcZM2oEpYPfRARLJrSyTlAoSAIlShShw4W8RJrKzdyt4itwdkEBIVp76EcvAbQByL5APtEU49G/WIxN03o5md9a7txbFr17tuPx9p9nmeeWae+c1v/nhmLcsBvrEePOyWj26/tV6U25vz7e3N+eVePcmVJPWkkaRWzP5bki+SjXSnfLvXMVAe8vknjaefffTph91Wo5rK5WtHrXc8e7FMd2Mty7Mab+7U4/X3cDbJTFXCyO32/Hto9ymvSwBgnNWSS4fn7s1qVO8B3afi7jP2hbYx6gAAAADgHLy0k52s59qo4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICLpPr//7Vqqvfqs6ldrf7//2Q1L1X9QtsadQAAAAAAAAAAcAa+u5OdrOdar71bK3/n/3rZuFF+fivvZS2LWc2drGchnXSymlaS6YGBJtcXOp3V1jHWnBu65tz57C8AAAAAAAAAfE39IY/6v/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBxUEsudYtyutGrT6d+OUkjyWSx3Ebyr179ItsadQAAAABwDl7ayU7Wc63X3q2V7/yvlO/9jbyXlXSylE7aWczj8ruA7lt/fXtzvr29Ob9cTIfH/cl/TxRGOWK63z0M3/KtcompPMlSOedOfpN30s7j1Ms1C7d68QyP6/dFTLUfVQ4H0RgW2eOqLPb8F1U5HqbLjEzsZaRZxVZk4/rRmTjh0Tm4pVbqe9/83Dhdzoe6WpXF/jwc65zPDZx9rxydiWTm13++96y98vzZk7Xb47NLX9LBTMwPZOLVb1QmmmUmbu61H+Xn+VVuZzZvZzVL+W0W0sliZvOwrC1U53PxOX10pn68r/X2iyKZrI5L9y56spheL9e9lqX8Mu/kcXlEm7mXe5nLD/JmmvuO8M0y3okcddXXT3TV90+DiSQ/q8rxUOT1+kBeB++502Xf4Jx+lmbO/t54+TtVpcjXg7G7N14/8FOil4mXj87EX3aLz7X2yvPVZwvvHnN7b1RlkYGfjlUmivNlpjhYZWv/2VH0vTy0r1X23djrK86zrT91R+z23dzre9GVOlk9w/VH6v/EKvpeHdrXXe/WQN+w5y0Axt7V712dnPrP1D+nPp7649SzqbcaD67cv/LaZCb+MfHDy81Lb9Rfq/01H+d3/fd/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgy1t7/4PnC+324qrKCSoTScYgDBWVr6wy6jsT8FW721l+9+7a+x98f2l54eni08WVN5v377darXvNu0+W2ovV56ijBADOUv+h/wULzp5TQAAAAAAAAAAAAAAAwCHn8efEo95HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg6+3R7VzeSi2t5p1m0d7enG8XU6/eX7KRpFZU/p7ki2Qj3SnTA8PV/t92Pv+k8fSzjz79sD9Wo7d87aj1jmdfLPUDMZ12vLlTj9ffw9kkM1UJI/e/AAAA//98Cf/a") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01864c2, &(0x7f00000012c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0xc8d03) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r4, 0xc00864bf, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f0000000180)={&(0x7f0000000080)=[r5, r5], &(0x7f0000000140)=[0x80], 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r4, 0xc03064ca, &(0x7f00000000c0)={&(0x7f0000000040)=[r5], &(0x7f0000000100)=[0xd], 0xfffffffffffeffff, 0x1, 0xb}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r7 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000100)={0x20004, r6}) r9 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r9, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r8}) ioctl$DRM_IOCTL_GEM_FLINK(r9, 0xc00864d2, &(0x7f0000000300)={r10}) r11 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x800) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r11, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r11, 0xc02064cc, &(0x7f00000001c0)={r12, r12, 0x1, 0x5, 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r11, 0xc01864cd, &(0x7f0000000300)={&(0x7f0000000140)=[r12, r12], &(0x7f0000000280)=[0x0, 0x7fff], 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01864c2, &(0x7f0000001380)={0x0}) r14 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x800) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r14, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r14, 0xc02064cc, &(0x7f00000001c0)={r15, r15, 0x1, 0x5, 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r14, 0xc01864cd, &(0x7f0000000300)={&(0x7f0000000140)=[r15, r15], &(0x7f0000000280)=[0x0, 0x7fff], 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f00000013c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000001400)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01864c2, &(0x7f0000001440)={0x0}) ioctl$DRM_IOCTL_PANTHOR_VM_BIND(0xffffffffffffffff, 0xc0186443, &(0x7f0000001780)={0x0, 0x0, {0x30, 0x8, &(0x7f0000001600)=[{0x10000000, 0x0, 0x1f91600000000000, 0x8000, 0x9, {0x10, 0x8, &(0x7f0000000380)=[{0x1}, {0x80000000, 0x0, 0x4}, {0xff, 0x0, 0x8}, {0x1}, {0x1, 0x0, 0x80000000}, {0x80000000, 0x0, 0x2}, {0xff, 0x0, 0xfffffffffffffffc}, {0x80000000}]}}, {0x1, 0x0, 0x9, 0x2, 0x7, {0x10, 0x5, &(0x7f0000000540)=[{0x0, 0x0, 0x100}, {0x1, 0x0, 0x4}, {0x80000000, 0x0, 0x3}, {0x800000ff, 0x0, 0xffffffffffff44c8}, {0x1, 0x0, 0x2}]}}, {0x20000000, 0x0, 0x100000001, 0xfffffffffffffff7, 0x0, {0x10, 0xa, &(0x7f0000000e40)=[{0x80000000, 0x0, 0x6}, {0x0, 0x0, 0x10000000000fe6f}, {0x80000000, 0x0, 0x200}, {0x80000001, 0x0, 0x9ad}, {0x1, 0x0, 0x6}, {0x80000000, 0x0, 0x82a}, {0xff, 0x0, 0x2f1}, {0x0, 0x0, 0x9}, {0xff, 0x0, 0x8}, {0x1, 0x0, 0x7029}]}}, {0x20000000, 0x0, 0x1ff, 0x2, 0x8, {0x10, 0x2, &(0x7f0000000f80)=[{0x0, 0x0, 0x1}, {0x1, 0x0, 0xd}]}}, {0x20000000, 0x0, 0x3, 0x3, 0x1, {0x10, 0x6, &(0x7f00000010c0)=[{0x80000000}, {0x1, 0x0, 0x100000001}, {0x1}, {0xff, 0x0, 0xa3}, {0x1, 0x0, 0x5}, {0xff, 0x0, 0x8000}]}}, {0x1, 0x0, 0x6, 0x6, 0x8, {0x10, 0x0, &(0x7f0000001140)}}, {0x4, 0x0, 0x9, 0x6, 0x5, {0x10, 0x8, &(0x7f0000001300)=[{0xff, 0x0, 0x4}, {0x80000000, 0x0, 0x8}, {0x80000000, 0x0, 0x6}, {0x1, 0x0, 0x100}, {0x80000000}, {0x80000000, 0x0, 0xfffffffffffffc00}, {0xff, r3, 0x6b2}, {0x80000000, r5, 0x8}]}}, {0x0, r10, 0x51, 0x6, 0x18000000, {0x10, 0x7, &(0x7f0000001480)=[{0x80000000, r12, 0x5}, {0xd648ab1b17f7c1d5, r13, 0x8}, {0x80000000, r15, 0x9}, {0x1, 0x0, 0x8}, {0x80000000, r16, 0x4000000}, {0x1, r17, 0x100000001}, {0x0, r18, 0x4}]}}]}}) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010102}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) [ 102.866963][ T4656] Bluetooth: hci0: command tx timeout [ 103.002008][ T5333] loop0: detected capacity change from 0 to 1024 [ 103.060744][ T5333] hfsplus: unable to find HFS+ superblock [ 103.205799][ T5332] ------------[ cut here ]------------ [ 103.208491][ T5332] !RB_EMPTY_ROOT(&prime_fpriv->dmabufs) [ 103.208501][ T5332] WARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x4b/0x60, CPU#0: syz.0.0/5332 [ 103.216029][ T5332] Modules linked in: [ 103.217778][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.221623][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.226336][ T5332] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 103.229447][ T5332] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 2d c9 c6 fc 48 83 3b 00 75 0c e8 72 fd 59 fc 5b e9 cc e4 41 06 cc e8 66 fd 59 fc 90 <0f> 0b 90 5b e9 bc e4 41 06 cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 103.237748][ T5332] RSP: 0018:ffffc9000f5ffc40 EFLAGS: 00010293 [ 103.241059][ T5332] RAX: ffffffff856bd3da RBX: ffff888012a1e3b0 RCX: ffff88803d978000 [ 103.245357][ T5332] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888012a1e328 [ 103.248923][ T5332] RBP: ffff888012a1e278 R08: ffffc9000f5ffbc7 R09: 1ffff92001ebff78 [ 103.252402][ T5332] R10: dffffc0000000000 R11: fffff52001ebff79 R12: dffffc0000000000 [ 103.255798][ T5332] R13: dead000000000100 R14: 0000000000000000 R15: ffff888012a1e288 [ 103.259234][ T5332] FS: 000055555bda7540(0000) GS:ffff88808c881000(0000) knlGS:0000000000000000 [ 103.263276][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.266384][ T5332] CR2: 00007f6a4cc3fa00 CR3: 0000000041866000 CR4: 0000000000352ef0 [ 103.269884][ T5332] Call Trace: [ 103.271423][ T5332] [ 103.272768][ T5332] drm_file_free+0x7f1/0xa00 [ 103.274848][ T5332] drm_release+0x2de/0x3f0 [ 103.276934][ T5332] ? __pfx_drm_release+0x10/0x10 [ 103.279138][ T5332] __fput+0x44f/0xa60 [ 103.280874][ T5332] task_work_run+0x1d9/0x270 [ 103.282863][ T5332] ? __pfx_task_work_run+0x10/0x10 [ 103.285106][ T5332] exit_to_user_mode_loop+0xf3/0x4d0 [ 103.287490][ T5332] ? rcu_is_watching+0x15/0xb0 [ 103.289467][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.292145][ T5332] do_syscall_64+0x33e/0xf80 [ 103.294151][ T5332] ? clear_bhb_loop+0x40/0x90 [ 103.296604][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.299823][ T5332] RIP: 0033:0x7f23bad9cdd9 [ 103.301809][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.310021][ T5332] RSP: 002b:00007ffe67c0fb48 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.313667][ T5332] RAX: 0000000000000000 RBX: 00007ffe67c0fc30 RCX: 00007f23bad9cdd9 [ 103.317148][ T5332] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.320601][ T5332] RBP: 000000000001917c R08: 0000000000000001 R09: 0000000000000000 [ 103.323946][ T5332] R10: 00007f23babff030 R11: 0000000000000246 R12: 00007ffe67c0fc70 [ 103.327686][ T5332] R13: 00007f23bb015fac R14: 00000000000192b0 R15: 00007f23bb015fa0 [ 103.331823][ T5332] [ 103.333281][ T5332] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.336253][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.339754][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.343632][ T5332] Call Trace: [ 103.345154][ T5332] [ 103.346555][ T5332] vpanic+0x56c/0xa60 [ 103.348159][ T5332] ? __pfx__printk+0x10/0x10 [ 103.350190][ T5332] ? __pfx_vpanic+0x10/0x10 [ 103.352148][ T5332] ? is_bpf_text_address+0x292/0x2b0 [ 103.354654][ T5332] ? is_bpf_text_address+0x26/0x2b0 [ 103.356867][ T5332] panic+0xc5/0xd0 [ 103.358515][ T5332] ? __pfx_panic+0x10/0x10 [ 103.360538][ T5332] __warn+0x315/0x4c0 [ 103.362251][ T5332] ? drm_prime_destroy_file_private+0x4b/0x60 [ 103.364927][ T5332] ? drm_prime_destroy_file_private+0x4b/0x60 [ 103.367508][ T5332] __report_bug+0x29a/0x540 [ 103.369481][ T5332] ? drm_prime_destroy_file_private+0x4b/0x60 [ 103.372030][ T5332] ? __pfx___report_bug+0x10/0x10 [ 103.374193][ T5332] ? drm_file_free+0x78a/0xa00 [ 103.376197][ T5332] ? drm_prime_destroy_file_private+0x4b/0x60 [ 103.378732][ T5332] report_bug+0x16a/0x220 [ 103.380539][ T5332] ? drm_prime_destroy_file_private+0x4b/0x60 [ 103.383115][ T5332] ? drm_prime_destroy_file_private+0x4d/0x60 [ 103.385726][ T5332] handle_bug+0x9c/0x200 [ 103.387521][ T5332] exc_invalid_op+0x1a/0x50 [ 103.389431][ T5332] asm_exc_invalid_op+0x1a/0x20 [ 103.391504][ T5332] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 103.394329][ T5332] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 2d c9 c6 fc 48 83 3b 00 75 0c e8 72 fd 59 fc 5b e9 cc e4 41 06 cc e8 66 fd 59 fc 90 <0f> 0b 90 5b e9 bc e4 41 06 cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 103.402331][ T5332] RSP: 0018:ffffc9000f5ffc40 EFLAGS: 00010293 [ 103.404885][ T5332] RAX: ffffffff856bd3da RBX: ffff888012a1e3b0 RCX: ffff88803d978000 [ 103.408261][ T5332] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888012a1e328 [ 103.411463][ T5332] RBP: ffff888012a1e278 R08: ffffc9000f5ffbc7 R09: 1ffff92001ebff78 [ 103.414729][ T5332] R10: dffffc0000000000 R11: fffff52001ebff79 R12: dffffc0000000000 [ 103.417982][ T5332] R13: dead000000000100 R14: 0000000000000000 R15: ffff888012a1e288 [ 103.421358][ T5332] ? drm_prime_destroy_file_private+0x4a/0x60 [ 103.424039][ T5332] drm_file_free+0x7f1/0xa00 [ 103.426097][ T5332] drm_release+0x2de/0x3f0 [ 103.428165][ T5332] ? __pfx_drm_release+0x10/0x10 [ 103.430332][ T5332] __fput+0x44f/0xa60 [ 103.432117][ T5332] task_work_run+0x1d9/0x270 [ 103.434150][ T5332] ? __pfx_task_work_run+0x10/0x10 [ 103.436293][ T5332] exit_to_user_mode_loop+0xf3/0x4d0 [ 103.438555][ T5332] ? rcu_is_watching+0x15/0xb0 [ 103.440657][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.443261][ T5332] do_syscall_64+0x33e/0xf80 [ 103.445369][ T5332] ? clear_bhb_loop+0x40/0x90 [ 103.447447][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.450073][ T5332] RIP: 0033:0x7f23bad9cdd9 [ 103.451862][ T5332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.459979][ T5332] RSP: 002b:00007ffe67c0fb48 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.463529][ T5332] RAX: 0000000000000000 RBX: 00007ffe67c0fc30 RCX: 00007f23bad9cdd9 [ 103.466854][ T5332] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.470247][ T5332] RBP: 000000000001917c R08: 0000000000000001 R09: 0000000000000000 [ 103.473622][ T5332] R10: 00007f23babff030 R11: 0000000000000246 R12: 00007ffe67c0fc70 [ 103.476990][ T5332] R13: 00007f23bb015fac R14: 00000000000192b0 R15: 00007f23bb015fa0 [ 103.480218][ T5332] [ 103.481868][ T5332] Kernel Offset: disabled [ 103.483652][ T5332] Rebooting in 86400 seconds..