program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/task-filter\x00', 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a300000000048000000120a01040000000000000000020000000900010073797a30000000000900020073797a31000000000800034000000008130004800f0001"], 0x90}}, 0x4) r1 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r1, &(0x7f0000000680), 0x40000000000009f, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='N', 0x1) write(r2, &(0x7f0000000100)='100', 0x3) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r0, 0x40786e88, &(0x7f0000000840)={{&(0x7f0000000680)=[{0x1, 0x4, 0xc, {0x4, 0xd}, 0x0, 0x3, 0x401}, {0xffffffff, 0x0, 0x2, {0xd8a4, 0x6}, 0x2, 0x9, 0x8c2}], 0x2, 0x40, 0x6, 0xfffffffffffff801}, {&(0x7f0000000700)=[{0x9, 0x9}, {0x6, 0x3caa}], 0x2, 0x10, 0xff, 0x9}, {&(0x7f0000000740)=[0x40, 0x7, 0x0, 0xc, 0x49, 0x0], 0x6, 0x8, 0xfffb, 0x9}, {&(0x7f0000000780)=[{0x6, 0x7fff, 0x6, 0x5b1, 0x961e}], 0x1, 0x28, 0x4, 0x4}, {&(0x7f00000007c0)=[0x2, 0x6, 0x3, 0x2, 0x5, 0x146, 0x8, 0x7, 0x1000, 0x0], 0xa, 0x8, 0x8, 0x6}}) getpid() r3 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@arena={0x21, 0x0, 0x0, 0x24, 0x20000, r2, 0x80, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x4}, 0x50) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x2) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000500)={0x2, 0x3, 0x0, 0x0, 0x8}, &(0x7f0000000540)=0x18) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f00000003c0)={0x802, 0x0, 0x0, 0x7}, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="200000005200010003000000000000000a0000000c00", @ANYRES32=r5], 0x20}}, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000140)="03000000", 0x4}], 0x2}, 0x0) sendmsg$kcm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="2e00000012008188e6b42aa73772cc9f1b2f8b48430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x90) lsetxattr$trusted_overlay_origin(0x0, &(0x7f00000001c0), &(0x7f0000000340), 0x2, 0x2) openat(r4, &(0x7f00000004c0)='./debug/failslab/task-filter\x00', 0x210080, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x1000, 0x0) [ 134.072472][ T5305] Bluetooth: hci0: command tx timeout [ 134.162649][ T5357] Zero length message leads to an empty skb [ 134.164065][ T5357] FAULT_INJECTION: forcing a failure. [ 134.164065][ T5357] name failslab, interval 1, probability 100, space 0, times 1 [ 134.164089][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 134.164097][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.164102][ T5357] Call Trace: [ 134.164114][ T5357] [ 134.164120][ T5357] dump_stack_lvl+0xe8/0x150 [ 134.164262][ T5357] should_fail_ex+0x3eb/0x540 [ 134.164335][ T5357] should_failslab+0xa8/0x100 [ 134.164347][ T5357] __kmalloc_noprof+0xf9/0x710 [ 134.164356][ T5357] ? rcu_is_watching+0x16/0xb0 [ 134.164388][ T5357] ? tomoyo_realpath_from_path+0xf2/0x640 [ 134.164419][ T5357] ? tomoyo_realpath_from_path+0xf2/0x640 [ 134.164441][ T5357] tomoyo_realpath_from_path+0xf2/0x640 [ 134.164464][ T5357] ? tomoyo_path_number_perm+0x219/0x5f0 [ 134.164474][ T5357] tomoyo_path_number_perm+0x246/0x5f0 [ 134.164486][ T5357] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 134.164495][ T5357] ? __lock_acquire+0x747/0x2de0 [ 134.164512][ T5357] ? __mutex_unlock_slowpath+0x731/0x900 [ 134.164579][ T5357] ? do_futex+0x3e7/0x4e0 [ 134.164597][ T5357] ? __fget_files+0x2a/0x420 [ 134.164621][ T5357] ? __fget_files+0x2a/0x420 [ 134.164631][ T5357] ? __fget_files+0x2a/0x420 [ 134.164645][ T5357] security_file_ioctl+0xc3/0x2a0 [ 134.164661][ T5357] __se_sys_ioctl+0x47/0x170 [ 134.164695][ T5357] do_syscall_64+0x166/0x520 [ 134.164710][ T5357] ? trace_irq_disable+0x3b/0x140 [ 134.164722][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.164730][ T5357] ? clear_bhb_loop+0x70/0xc0 [ 134.164739][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.164746][ T5357] RIP: 0033:0x7f992a59fb19 [ 134.164755][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.164761][ T5357] RSP: 002b:00007f99269f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 134.164774][ T5357] RAX: ffffffffffffffda RBX: 00007f992a825fa0 RCX: 00007f992a59fb19 [ 134.164781][ T5357] RDX: 0000200000000840 RSI: 0000000040786e88 RDI: 0000000000000003 [ 134.164788][ T5357] RBP: 00007f992a637b70 R08: 0000000000000000 R09: 0000000000000000 [ 134.164794][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.164801][ T5357] R13: 00007f992a826038 R14: 00007f992a825fa0 R15: 00007fff369b9148 [ 134.164820][ T5357] [ 134.164937][ T10] FAULT_INJECTION: forcing a failure. [ 134.164937][ T10] name failslab, interval 1, probability 100, space 0, times 1 [ 134.164953][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 134.164965][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.164971][ T10] Workqueue: events drm_fb_helper_damage_work [ 134.164992][ T10] Call Trace: [ 134.164995][ T10] [ 134.164998][ T10] dump_stack_lvl+0xe8/0x150 [ 134.165011][ T10] should_fail_ex+0x3eb/0x540 [ 134.165025][ T10] should_failslab+0xa8/0x100 [ 134.165041][ T10] __kmalloc_cache_noprof+0x9e/0x600 [ 134.165055][ T10] ? drm_atomic_commit_alloc+0xa9/0x100 [ 134.165102][ T10] ? drm_atomic_commit_alloc+0xa9/0x100 [ 134.165118][ T10] drm_atomic_commit_alloc+0xa9/0x100 [ 134.165144][ T10] drm_atomic_helper_dirtyfb+0x129/0xfd0 [ 134.165175][ T10] ? __lock_acquire+0x747/0x2de0 [ 134.165192][ T10] ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10 [ 134.165217][ T10] ? do_raw_spin_lock+0x12b/0x2f0 [ 134.165238][ T10] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 134.165258][ T10] drm_fb_helper_damage_work+0x84c/0xf20 [ 134.165282][ T10] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 134.165303][ T10] ? lock_acquire+0x115/0x350 [ 134.165321][ T10] ? rcu_is_watching+0x16/0xb0 [ 134.165338][ T10] ? process_scheduled_works+0x97a/0x1630 [ 134.165355][ T10] process_scheduled_works+0xc3d/0x1630 [ 134.165383][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 134.165396][ T10] ? assign_work+0x3cf/0x5d0 [ 134.165407][ T10] worker_thread+0xa47/0xfb0 [ 134.165429][ T10] kthread+0x38b/0x480 [ 134.165441][ T10] ? __pfx_worker_thread+0x10/0x10 [ 134.165449][ T10] ? __pfx_kthread+0x10/0x10 [ 134.165463][ T10] ret_from_fork+0x514/0xb70 [ 134.165477][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 134.165490][ T10] ? __switch_to+0xc78/0x1410 [ 134.165503][ T10] ? __pfx_kthread+0x10/0x10 [ 134.165512][ T10] ret_from_fork_asm+0x1a/0x30 [ 134.165531][ T10] [ 134.165642][ T10] ------------[ cut here ]------------ [ 134.165647][ T10] virtio-pci 0000:00:01.0: [drm] Dirty helper failed: ret=-12 [ 134.165670][ T10] WARNING: drivers/gpu/drm/drm_fbdev_shmem.c:118 at drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310, CPU#0: kworker/0:0/10 [ 134.375058][ T10] Modules linked in: [ 134.376830][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 134.380823][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.385145][ T10] Workqueue: events drm_fb_helper_damage_work [ 134.387848][ T10] RIP: 0010:drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 134.390982][ T10] Code: 17 fc 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 9a 5a 90 fc 4d 8b 27 48 89 df 4c 89 f6 4c 89 e2 8b 5c 24 04 89 d9 <67> 48 0f b9 3a 89 d8 e9 f7 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f [ 134.399498][ T10] RSP: 0018:ffffc9000023f898 EFLAGS: 00010246 [ 134.402773][ T10] RAX: 1ffff1100627601a RBX: 00000000fffffff4 RCX: 00000000fffffff4 [ 134.406937][ T10] RDX: ffff888030ad0e80 RSI: ffffffff8c9acf20 RDI: ffffffff91ca2430 [ 134.410768][ T10] RBP: ffff888036204008 R08: 0000000000000dc0 R09: 00000000ffffffff [ 134.415119][ T10] R10: dffffc0000000000 R11: fffffbfff2056d13 R12: ffff888030ad0e80 [ 134.419469][ T10] R13: dffffc0000000000 R14: ffffffff8c9acf20 R15: ffff8880313b00d0 [ 134.422961][ T10] FS: 0000000000000000(0000) GS:ffff88808a9fa000(0000) knlGS:0000000000000000 [ 134.429344][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.432436][ T10] CR2: 00007f992a70f420 CR3: 000000003d228000 CR4: 0000000000352ef0 [ 134.435442][ T10] Call Trace: [ 134.436767][ T10] [ 134.438083][ T10] drm_fb_helper_damage_work+0x84c/0xf20 [ 134.440337][ T10] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 134.442953][ T10] ? lock_acquire+0x115/0x350 [ 134.444689][ T10] ? rcu_is_watching+0x16/0xb0 [ 134.446722][ T10] ? process_scheduled_works+0x97a/0x1630 [ 134.449066][ T10] process_scheduled_works+0xc3d/0x1630 [ 134.451453][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 134.454194][ T10] ? assign_work+0x3cf/0x5d0 [ 134.456276][ T10] worker_thread+0xa47/0xfb0 [ 134.458504][ T10] kthread+0x38b/0x480 [ 134.460351][ T10] ? __pfx_worker_thread+0x10/0x10 [ 134.462634][ T10] ? __pfx_kthread+0x10/0x10 [ 134.464702][ T10] ret_from_fork+0x514/0xb70 [ 134.466781][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 134.468969][ T10] ? __switch_to+0xc78/0x1410 [ 134.470634][ T10] ? __pfx_kthread+0x10/0x10 [ 134.472242][ T10] ret_from_fork_asm+0x1a/0x30 [ 134.473928][ T10] [ 134.475037][ T10] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 134.478251][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) [ 134.482495][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 134.486946][ T10] Workqueue: events drm_fb_helper_damage_work [ 134.489098][ T10] Call Trace: [ 134.490316][ T10] [ 134.491504][ T10] vpanic+0x26f/0x710 [ 134.493119][ T10] panic+0xc5/0xd0 [ 134.494689][ T10] ? __pfx_panic+0x10/0x10 [ 134.496532][ T10] ? ret_from_fork_asm+0x1a/0x30 [ 134.498754][ T10] __warn+0x315/0x4c0 [ 134.500404][ T10] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 134.503028][ T10] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 134.505840][ T10] __report_bug+0x276/0x570 [ 134.507810][ T10] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 134.510436][ T10] ? __pfx___report_bug+0x10/0x10 [ 134.512728][ T10] ? drm_fbdev_shmem_helper_fb_dirty+0x28d/0x310 [ 134.515554][ T10] ? drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 134.518198][ T10] report_bug_entry+0x19b/0x290 [ 134.520188][ T10] ? drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 134.522907][ T10] ? drm_fbdev_shmem_helper_fb_dirty+0x28d/0x310 [ 134.525716][ T10] handle_bug+0xce/0x200 [ 134.527487][ T10] exc_invalid_op+0x1a/0x50 [ 134.529409][ T10] asm_exc_invalid_op+0x1a/0x20 [ 134.531418][ T10] RIP: 0010:drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 134.534267][ T10] Code: 17 fc 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 9a 5a 90 fc 4d 8b 27 48 89 df 4c 89 f6 4c 89 e2 8b 5c 24 04 89 d9 <67> 48 0f b9 3a 89 d8 e9 f7 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f [ 134.542201][ T10] RSP: 0018:ffffc9000023f898 EFLAGS: 00010246 [ 134.544836][ T10] RAX: 1ffff1100627601a RBX: 00000000fffffff4 RCX: 00000000fffffff4 [ 134.548260][ T10] RDX: ffff888030ad0e80 RSI: ffffffff8c9acf20 RDI: ffffffff91ca2430 [ 134.551560][ T10] RBP: ffff888036204008 R08: 0000000000000dc0 R09: 00000000ffffffff [ 134.554709][ T10] R10: dffffc0000000000 R11: fffffbfff2056d13 R12: ffff888030ad0e80 [ 134.558049][ T10] R13: dffffc0000000000 R14: ffffffff8c9acf20 R15: ffff8880313b00d0 [ 134.561304][ T10] ? drm_fbdev_shmem_helper_fb_dirty+0x260/0x310 [ 134.563965][ T10] drm_fb_helper_damage_work+0x84c/0xf20 [ 134.566203][ T10] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 134.568643][ T10] ? lock_acquire+0x115/0x350 [ 134.570651][ T10] ? rcu_is_watching+0x16/0xb0 [ 134.572712][ T10] ? process_scheduled_works+0x97a/0x1630 [ 134.575033][ T10] process_scheduled_works+0xc3d/0x1630 [ 134.577385][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 134.579816][ T10] ? assign_work+0x3cf/0x5d0 [ 134.581878][ T10] worker_thread+0xa47/0xfb0 [ 134.584046][ T10] kthread+0x38b/0x480 [ 134.585838][ T10] ? __pfx_worker_thread+0x10/0x10 [ 134.588132][ T10] ? __pfx_kthread+0x10/0x10 [ 134.590233][ T10] ret_from_fork+0x514/0xb70 [ 134.592273][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 134.594389][ T10] ? __switch_to+0xc78/0x1410 [ 134.596352][ T10] ? __pfx_kthread+0x10/0x10 [ 134.598396][ T10] ret_from_fork_asm+0x1a/0x30 [ 134.600462][ T10] [ 134.608388][ T10] Kernel Offset: disabled [ 134.610331][ T10] Rebooting in 86400 seconds..