program: socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file1\x00', 0x0, &(0x7f00000000c0), 0xff, 0x756, &(0x7f0000001e40)="$eJzs3c2LW1UbAPDnpvP1tn2dKbiwIjjQhYXSjJ3WUkGkogspVoq6c9GmM+lQJmnKJFM6Q6VWFMGVSHHtx8qd/4Aogu5cCq5dSaFIqRtBiNzMzZg2SScznUyq+f3glnPuvek5z/04OZlzuDeAoTWd/pOL2B8RHycRk9n6JCJGG6mRiJNr+929c20uXZKo19/8PWnsk+aj5TOpPVnmiYj4/oOIQ7n2cqsrq4uFUqm4lOVnauXLM9WV1cMXy4WF4kLx0uzx54/Onph97sTstsX65/uvnz/19Stf3nzvp1/feOfU00mcjL3ZttY4tst0TGfHZDQ9hPd4ebsLG7Bk0BVgS9Jbc9faXR77YzJ2NVIAwH/Z9YioAwBDJvH9DwBDpvl3gObYXj/GwR5lt1+KiImIsZZjsLZlJBuzm2iMg+6+m9wzMpJExNQ2lD8dEVff/vCbdIk+jUMCdPLujYg4NzXd3v4nbXMWNuvZHvaZvi+v/YOd813a/znRqf+XW+//RIf+z3iHe3crNr7/c7e2oZiu0v7fCx37v+uT1qZ2Zbn/N/p8o8mFi6Vi2rY9FhEHY3Q8zR95QBnHPnnxx27bWvt/6ZKW3+wLZvW4NTJ+72fmC7XCw8Tc6vaNiCdHOsWfrJ//pEv/90yPZdR+eOqLbts2jr+/6p9HPNPx/P8zoy1pmZ84Hm3zE2ca18NM86pol/9ocl+38gcdf3r+dz84/qmkdb5mdfNl/PzpX69227bV638seauRHsvWXS3UaktHIsaS19rXt0whbeab+6fxHzzw4Pav0/Wf/iY812P8i599dX7r8fdXGv/8ps7/5hMHfvm2czz1bLbxhuf/WCN1MFvTS/vXawUf5tgBAAAAAAAAAAAAAAAAAAAAAAAAQK9yEbE3klx+PZ3L5fNr7/B+PHbnSpVq7dCFyvKl+Wi8K3sqRnPNJ11OtjwP9Uj2PPxmfva+/NGI2BcRN8f/18jn5yql+UEHDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZPV3e/5/6bXzQtQMA+mbi+qBrAADstIlBVwAA2HG+/wFg+Pj+B4ChctocPwAYTn7/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0GdnTp9Ol/ofd67Npfn5KyvLi5Urh+eL1cV8eXkuP1dZupxfqFQWSsX8XKW80f9XqlQuzx6P5asztWK1NlNdWT1brixfqp29WC4sFM8WR3ckKgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYnOrK6mKhVCouPWKJiax+j0p9JCSGKzHghgkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgX+LvAAAA///A4xmC") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x501042, 0x52) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="30000000200001030000000000000000020000000000000001000000140003006c6f000000000000e0c9437f54a4dd1b"], 0x30}, 0x1, 0x0, 0x0, 0x90}, 0x0) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x182000, 0x0) ioctl$FBIOPUT_VSCREENINFO(r2, 0x4601, &(0x7f0000000040)={0x80, 0xa0, 0x30, 0x0, 0x6, 0x0, 0x0, 0x0, {0x10, 0x8}, {0x8, 0x9}, {0x0, 0x8}, {0xffff, 0xb, 0xfffffffd}, 0x0, 0x80, 0x100, 0x0, 0x0, 0x0, 0x9, 0x0, 0xfffffffc, 0x400009, 0x6, 0xfffffffc, 0x17, 0x200, 0x1, 0x8}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0xa00, 0x0, 0x101, 0x100}}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000000), 0x560c89bb) ioctl$int_in(r4, 0x5452, &(0x7f0000000340)=0xffffffff) r5 = socket$inet6(0xa, 0x3, 0x8000000003c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="7800000018002507b9409b14ffff00000202be04020506050e130204", 0x1c, 0xc084, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x4ea4, 0x20000, @local, 0x9}, 0x1c) sendmsg(r5, &(0x7f00000000c0)={0x0, 0x9521, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r6, &(0x7f00000001c0)='1', 0x1) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) pwrite64(r7, &(0x7f0000000140)='2', 0xfdef, 0xe7c) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYRES64=r6, @ANYRES32=0x0, @ANYBLOB="08df1b2bbad8a150e84263effc82340398572fcd1738d07a0b8cf860b40c17c4194f517f4d394471d54391efcb690577af56facfc01b75f52e71f771b8287433ee41c8d6ce59530cd7"], 0x30}, 0x1, 0x0, 0x0, 0x840}, 0x8841) r8 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000140)={'team_slave_0\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x1, 0x1}}) [ 102.314717][ T5287] Bluetooth: hci0: command tx timeout [ 102.398625][ T5329] loop0: detected capacity change from 0 to 2048 [ 102.494212][ T5329] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.602407][ T5330] Console: switching to colour dummy device 80x25 [ 103.161217][ T5328] ------------[ cut here ]------------ [ 103.161259][ T5328] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 103.161291][ T5328] WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e2/0x1550, CPU#0: syz.0.0/5328 [ 103.169794][ T5328] Modules linked in: [ 103.171624][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.175339][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.179420][ T5328] RIP: 0010:__mutex_lock+0x12e9/0x1550 [ 103.181992][ T5328] Code: 6b 7a 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d 2b 8b 92 04 00 75 13 48 8d 3d ee 86 95 04 48 c7 c6 80 0f 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f [ 103.190059][ T5328] RSP: 0018:ffffc9000dadfae0 EFLAGS: 00010246 [ 103.192936][ T5328] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88803c5aa580 [ 103.196285][ T5328] RDX: 0000000000000000 RSI: ffffffff8c0d0f80 RDI: ffffffff907d6750 [ 103.199420][ T5328] RBP: ffffc9000dadfc80 R08: ffffffff907a6b83 R09: 1ffffffff20f4d70 [ 103.202812][ T5328] R10: dffffc0000000000 R11: fffffbfff20f4d71 R12: ffff888034ef51c0 [ 103.206185][ T5328] R13: 0000000000000000 R14: 1ffff92001b5bf70 R15: 0000000000000000 [ 103.209386][ T5328] FS: 000055557d010540(0000) GS:ffff88808c2cd000(0000) knlGS:0000000000000000 [ 103.213291][ T5328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.216052][ T5328] CR2: 000055e50f6c0cf0 CR3: 00000000437f1000 CR4: 0000000000352ef0 [ 103.219408][ T5328] Call Trace: [ 103.220975][ T5328] [ 103.222288][ T5328] ? kfree+0x1c5/0x650 [ 103.224141][ T5328] ? drm_mode_rmfb+0x561/0x7a0 [ 103.226306][ T5328] ? drm_gem_fb_destroy+0x1c9/0x200 [ 103.228630][ T5328] ? virtio_gpu_free_object+0x90/0x1d0 [ 103.231465][ T5328] ? drm_mode_rmfb+0x561/0x7a0 [ 103.233489][ T5328] ? __pfx___mutex_lock+0x10/0x10 [ 103.235448][ T5328] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 103.237951][ T5328] virtio_gpu_free_object+0x90/0x1d0 [ 103.240295][ T5328] drm_client_buffer_delete+0x183/0x2d0 [ 103.242627][ T5328] drm_fbdev_shmem_fb_destroy+0xb5/0xe0 [ 103.244883][ T5328] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10 [ 103.247324][ T5328] fb_release+0x11d/0x140 [ 103.249072][ T5328] ? __pfx_fb_release+0x10/0x10 [ 103.251146][ T5328] __fput+0x418/0xa50 [ 103.252808][ T5328] task_work_run+0x1d9/0x270 [ 103.254653][ T5328] ? __pfx_task_work_run+0x10/0x10 [ 103.256715][ T5328] exit_to_user_mode_loop+0x204/0x770 [ 103.258808][ T5328] ? rcu_is_watching+0x16/0xb0 [ 103.260798][ T5328] do_syscall_64+0x328/0x520 [ 103.262729][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.265212][ T5328] ? clear_bhb_loop+0x70/0xc0 [ 103.267160][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.269658][ T5328] RIP: 0033:0x7f6b0e19e159 [ 103.271643][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.279765][ T5328] RSP: 002b:00007ffea2e83568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.283737][ T5328] RAX: 0000000000000000 RBX: 00007f6b0e427da0 RCX: 00007f6b0e19e159 [ 103.287146][ T5328] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.290609][ T5328] RBP: 00007f6b0e427da0 R08: 0000000000000006 R09: 0000000000000000 [ 103.293857][ T5328] R10: 00007f6b0e427cb0 R11: 0000000000000246 R12: 0000000000019248 [ 103.297816][ T5328] R13: 00007f6b0e42618c R14: 00000000000190a6 R15: 00007f6b0e426180 [ 103.301296][ T5328] [ 103.302610][ T5328] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.305644][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.309476][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.314162][ T5328] Call Trace: [ 103.315548][ T5328] [ 103.316844][ T5328] vpanic+0x56d/0xa60 [ 103.318534][ T5328] ? __pfx__printk+0x10/0x10 [ 103.320517][ T5328] ? __pfx_vpanic+0x10/0x10 [ 103.322571][ T5328] ? is_bpf_text_address+0x292/0x2b0 [ 103.324709][ T5328] ? is_bpf_text_address+0x26/0x2b0 [ 103.326838][ T5328] panic+0xc5/0xd0 [ 103.328380][ T5328] ? __pfx_panic+0x10/0x10 [ 103.330253][ T5328] __warn+0x315/0x4c0 [ 103.331945][ T5328] ? __mutex_lock+0x12e2/0x1550 [ 103.334013][ T5328] ? __mutex_lock+0x12e2/0x1550 [ 103.336114][ T5328] __report_bug+0x276/0x570 [ 103.338049][ T5328] ? __mutex_lock+0x12e2/0x1550 [ 103.340097][ T5328] ? __pfx___report_bug+0x10/0x10 [ 103.342348][ T5328] ? drm_client_buffer_delete+0x113/0x2d0 [ 103.344861][ T5328] report_bug_entry+0x19b/0x290 [ 103.346972][ T5328] ? __mutex_lock+0x12e9/0x1550 [ 103.349114][ T5328] ? __mutex_lock+0x12ee/0x1550 [ 103.351281][ T5328] handle_bug+0xce/0x200 [ 103.353141][ T5328] exc_invalid_op+0x1a/0x50 [ 103.355100][ T5328] asm_exc_invalid_op+0x1a/0x20 [ 103.357210][ T5328] RIP: 0010:__mutex_lock+0x12e9/0x1550 [ 103.359512][ T5328] Code: 6b 7a 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d 2b 8b 92 04 00 75 13 48 8d 3d ee 86 95 04 48 c7 c6 80 0f 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f [ 103.367511][ T5328] RSP: 0018:ffffc9000dadfae0 EFLAGS: 00010246 [ 103.370147][ T5328] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88803c5aa580 [ 103.373530][ T5328] RDX: 0000000000000000 RSI: ffffffff8c0d0f80 RDI: ffffffff907d6750 [ 103.376845][ T5328] RBP: ffffc9000dadfc80 R08: ffffffff907a6b83 R09: 1ffffffff20f4d70 [ 103.380172][ T5328] R10: dffffc0000000000 R11: fffffbfff20f4d71 R12: ffff888034ef51c0 [ 103.383590][ T5328] R13: 0000000000000000 R14: 1ffff92001b5bf70 R15: 0000000000000000 [ 103.386999][ T5328] ? kfree+0x1c5/0x650 [ 103.388782][ T5328] ? drm_mode_rmfb+0x561/0x7a0 [ 103.390821][ T5328] ? drm_gem_fb_destroy+0x1c9/0x200 [ 103.393160][ T5328] ? virtio_gpu_free_object+0x90/0x1d0 [ 103.395506][ T5328] ? drm_mode_rmfb+0x561/0x7a0 [ 103.397639][ T5328] ? __pfx___mutex_lock+0x10/0x10 [ 103.399871][ T5328] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 103.402482][ T5328] virtio_gpu_free_object+0x90/0x1d0 [ 103.404755][ T5328] drm_client_buffer_delete+0x183/0x2d0 [ 103.407071][ T5328] drm_fbdev_shmem_fb_destroy+0xb5/0xe0 [ 103.409530][ T5328] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10 [ 103.412266][ T5328] fb_release+0x11d/0x140 [ 103.414156][ T5328] ? __pfx_fb_release+0x10/0x10 [ 103.416339][ T5328] __fput+0x418/0xa50 [ 103.418109][ T5328] task_work_run+0x1d9/0x270 [ 103.420110][ T5328] ? __pfx_task_work_run+0x10/0x10 [ 103.422379][ T5328] exit_to_user_mode_loop+0x204/0x770 [ 103.424684][ T5328] ? rcu_is_watching+0x16/0xb0 [ 103.426696][ T5328] do_syscall_64+0x328/0x520 [ 103.428754][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.431294][ T5328] ? clear_bhb_loop+0x70/0xc0 [ 103.433488][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.435996][ T5328] RIP: 0033:0x7f6b0e19e159 [ 103.437883][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.445998][ T5328] RSP: 002b:00007ffea2e83568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.449572][ T5328] RAX: 0000000000000000 RBX: 00007f6b0e427da0 RCX: 00007f6b0e19e159 [ 103.452966][ T5328] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.456398][ T5328] RBP: 00007f6b0e427da0 R08: 0000000000000006 R09: 0000000000000000 [ 103.459806][ T5328] R10: 00007f6b0e427cb0 R11: 0000000000000246 R12: 0000000000019248 [ 103.463129][ T5328] R13: 00007f6b0e42618c R14: 00000000000190a6 R15: 00007f6b0e426180 [ 103.466563][ T5328] [ 103.468345][ T5328] Kernel Offset: disabled [ 103.470236][ T5328] Rebooting in 86400 seconds..