program: r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @empty}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x4000000, 0x8000, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6]}}, 0x5c) ioctl$DRM_IOCTL_PANTHOR_GROUP_CREATE(0xffffffffffffffff, 0xc0386447, &(0x7f00000000c0)={{0x8, 0x1, &(0x7f0000000080)=[{0xfa, 0x0, 0x5a08}]}, 0x7, 0xff, 0x7, 0x1, 0x0, 0x7, 0x3, 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01864c2, &(0x7f0000000180)) r1 = syz_open_dev$dri(&(0x7f00000001c0), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000200)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r1, 0xc01064c5, &(0x7f0000000240)={&(0x7f0000000280)=[r2, r2, 0x0], 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01864c2, &(0x7f00000002c0)) r3 = syz_open_dev$dri(&(0x7f0000000300), 0x1, 0x0) syz_open_dev$dri(&(0x7f0000000340), 0x1, 0x0) r4 = creat(&(0x7f0000000b40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x17e) io_setup(0x200, &(0x7f0000000c40)=0x0) io_submit(r5, 0x3b, &(0x7f0000000c80)=[&(0x7f0000000cc0)={0x25, 0x0, 0x2, 0x1, 0x0, r4, &(0x7f0000000d00), 0x4000, 0xa1ff}]) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r4, 0xc00864bf, &(0x7f0000000380)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f00000003c0)={0x0}) r8 = socket(0xa, 0x5, 0x0) r9 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f00000006c0)=@filter={'filter\x00', 0xe, 0x4, 0x368, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x298, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x0, 0x4}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) sendto$inet6(r8, &(0x7f0000000ac0)="dc", 0x34000, 0x44004, &(0x7f0000000b00)={0xa, 0x4e24, 0x7, @loopback, 0xc5f}, 0x1c) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r3, 0xc03064ca, &(0x7f0000000140)={&(0x7f0000000440)=[r6], 0x0, 0x100000000000004, 0x40000119, 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000480)={&(0x7f00000004c0)=[r7, r6], 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000d40)='./config\x00', &(0x7f0000000d80)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000dc0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) r10 = openat(0xffffffffffffff9c, &(0x7f0000000e40)='./config/usb_gadget/g1/functions/acm.usb0/console\x00', 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f0000000e80)={0x4e, 0x18, 0xfa00, {0x4, 0x0, 0x106, 0x5}}, 0x20) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000500)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01864c2, &(0x7f0000000540)) [ 102.448648][ T4664] Bluetooth: hci0: command tx timeout [ 102.523456][ T5346] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 102.544629][ T5346] ------------[ cut here ]------------ [ 102.544641][ T5346] 1 [ 102.544644][ T5346] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5346 [ 102.552411][ T5346] Modules linked in: [ 102.554123][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.558147][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.562514][ T5346] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 102.565110][ T5346] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 1c e0 0b 00 c6 05 da 27 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 12 88 d4 09 cc 89 ef 89 [ 102.572814][ T5346] RSP: 0018:ffffc9000f6a7a00 EFLAGS: 00010246 [ 102.575761][ T5346] RAX: 0000000000000000 RBX: 0000000100000464 RCX: 0000000000100000 [ 102.579531][ T5346] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 0000000100000464 [ 102.582816][ T5346] RBP: 0000000000000cc0 R08: ffffffff85a56f99 R09: 0000000000000000 [ 102.586360][ T5346] R10: dffffc0000000000 R11: ffffffff85ae8b70 R12: 1ffff92001ed4fb9 [ 102.589803][ T5346] R13: ffffffff85ae875a R14: 0000000100000464 R15: 0000000100000464 [ 102.593372][ T5346] FS: 00007f276fc0b6c0(0000) GS:ffff88808a9fd000(0000) knlGS:0000000000000000 [ 102.598274][ T5346] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.601220][ T5346] CR2: 0000200000034000 CR3: 0000000013b80000 CR4: 0000000000352ef0 [ 102.604654][ T5346] Call Trace: [ 102.606267][ T5346] [ 102.609689][ T5346] __kmalloc_large_node_noprof+0x18/0x90 [ 102.613224][ T5346] __kmalloc_noprof+0x3f6/0x710 [ 102.615337][ T5346] ? drm_syncobj_array_find+0x3a/0x440 [ 102.617720][ T5346] drm_syncobj_array_find+0x3a/0x440 [ 102.620029][ T5346] drm_syncobj_timeline_wait_ioctl+0x18a/0x640 [ 102.622565][ T5346] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 102.625451][ T5346] drm_ioctl_kernel+0x2df/0x3b0 [ 102.627480][ T5346] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 102.630346][ T5346] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 102.632742][ T5346] ? __might_fault+0xaf/0x130 [ 102.634732][ T5346] drm_ioctl+0x70e/0xba0 [ 102.636657][ T5346] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 102.639456][ T5346] ? __pfx_drm_ioctl+0x10/0x10 [ 102.641504][ T5346] ? __fget_files+0x2a/0x420 [ 102.643356][ T5346] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.645567][ T5346] ? __pfx_drm_ioctl+0x10/0x10 [ 102.647737][ T5346] __se_sys_ioctl+0xfc/0x170 [ 102.649751][ T5346] do_syscall_64+0x166/0x520 [ 102.651974][ T5346] ? trace_irq_disable+0x3b/0x140 [ 102.654131][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.657050][ T5346] ? clear_bhb_loop+0x70/0xc0 [ 102.659042][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.661467][ T5346] RIP: 0033:0x7f276ed9fb19 [ 102.663405][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.671264][ T5346] RSP: 002b:00007f276fc0afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.674719][ T5346] RAX: ffffffffffffffda RBX: 00007f276f025fa0 RCX: 00007f276ed9fb19 [ 102.678312][ T5346] RDX: 0000200000000140 RSI: 00000000c03064ca RDI: 0000000000000005 [ 102.681553][ T5346] RBP: 00007f276ee37b70 R08: 0000000000000000 R09: 0000000000000000 [ 102.684893][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.688455][ T5346] R13: 00007f276f026038 R14: 00007f276f025fa0 R15: 00007ffc590e51f8 [ 102.691752][ T5346] [ 102.693129][ T5346] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 102.696203][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.699855][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.703997][ T5346] Call Trace: [ 102.705384][ T5346] [ 102.706625][ T5346] vpanic+0x26f/0x710 [ 102.708302][ T5346] panic+0xc5/0xd0 [ 102.709864][ T5346] ? __pfx_panic+0x10/0x10 [ 102.711669][ T5346] __warn+0x315/0x4c0 [ 102.713425][ T5346] ? ___kmalloc_large_node+0x10c/0x170 [ 102.715721][ T5346] ? ___kmalloc_large_node+0x10c/0x170 [ 102.717970][ T5346] __report_bug+0x276/0x570 [ 102.719885][ T5346] ? kernel_text_address+0xa5/0xe0 [ 102.722056][ T5346] ? ___kmalloc_large_node+0x10c/0x170 [ 102.724315][ T5346] ? __pfx___report_bug+0x10/0x10 [ 102.726427][ T5346] ? stack_trace_save+0xa9/0x100 [ 102.728520][ T5346] ? __pfx_stack_trace_save+0x10/0x10 [ 102.730829][ T5346] ? kasan_save_track+0x4f/0x80 [ 102.732834][ T5346] ? ___kmalloc_large_node+0x10c/0x170 [ 102.735131][ T5346] report_bug+0x16b/0x220 [ 102.736911][ T5346] ? ___kmalloc_large_node+0x10c/0x170 [ 102.739152][ T5346] ? ___kmalloc_large_node+0x10e/0x170 [ 102.741436][ T5346] handle_bug+0x9c/0x200 [ 102.743196][ T5346] exc_invalid_op+0x1a/0x50 [ 102.745173][ T5346] asm_exc_invalid_op+0x1a/0x20 [ 102.747270][ T5346] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 102.749795][ T5346] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 1c e0 0b 00 c6 05 da 27 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 12 88 d4 09 cc 89 ef 89 [ 102.757748][ T5346] RSP: 0018:ffffc9000f6a7a00 EFLAGS: 00010246 [ 102.760365][ T5346] RAX: 0000000000000000 RBX: 0000000100000464 RCX: 0000000000100000 [ 102.763730][ T5346] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 0000000100000464 [ 102.766983][ T5346] RBP: 0000000000000cc0 R08: ffffffff85a56f99 R09: 0000000000000000 [ 102.770205][ T5346] R10: dffffc0000000000 R11: ffffffff85ae8b70 R12: 1ffff92001ed4fb9 [ 102.773489][ T5346] R13: ffffffff85ae875a R14: 0000000100000464 R15: 0000000100000464 [ 102.776682][ T5346] ? drm_syncobj_array_find+0x3a/0x440 [ 102.779025][ T5346] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 102.781785][ T5346] ? drm_dev_enter+0x49/0x150 [ 102.783819][ T5346] __kmalloc_large_node_noprof+0x18/0x90 [ 102.786135][ T5346] __kmalloc_noprof+0x3f6/0x710 [ 102.788158][ T5346] ? drm_syncobj_array_find+0x3a/0x440 [ 102.790432][ T5346] drm_syncobj_array_find+0x3a/0x440 [ 102.792644][ T5346] drm_syncobj_timeline_wait_ioctl+0x18a/0x640 [ 102.795224][ T5346] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 102.797955][ T5346] drm_ioctl_kernel+0x2df/0x3b0 [ 102.800043][ T5346] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 102.802909][ T5346] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 102.805156][ T5346] ? __might_fault+0xaf/0x130 [ 102.807150][ T5346] drm_ioctl+0x70e/0xba0 [ 102.808930][ T5346] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 102.811726][ T5346] ? __pfx_drm_ioctl+0x10/0x10 [ 102.813829][ T5346] ? __fget_files+0x2a/0x420 [ 102.815796][ T5346] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.817832][ T5346] ? __pfx_drm_ioctl+0x10/0x10 [ 102.819826][ T5346] __se_sys_ioctl+0xfc/0x170 [ 102.821838][ T5346] do_syscall_64+0x166/0x520 [ 102.823989][ T5346] ? trace_irq_disable+0x3b/0x140 [ 102.826157][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.828747][ T5346] ? clear_bhb_loop+0x70/0xc0 [ 102.830717][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.833228][ T5346] RIP: 0033:0x7f276ed9fb19 [ 102.835053][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.843358][ T5346] RSP: 002b:00007f276fc0afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.846881][ T5346] RAX: ffffffffffffffda RBX: 00007f276f025fa0 RCX: 00007f276ed9fb19 [ 102.850249][ T5346] RDX: 0000200000000140 RSI: 00000000c03064ca RDI: 0000000000000005 [ 102.853641][ T5346] RBP: 00007f276ee37b70 R08: 0000000000000000 R09: 0000000000000000 [ 102.857016][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.860356][ T5346] R13: 00007f276f026038 R14: 00007f276f025fa0 R15: 00007ffc590e51f8 [ 102.863651][ T5346] [ 102.865372][ T5346] Kernel Offset: disabled [ 102.867191][ T5346] Rebooting in 86400 seconds..