program: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x20004, r2, 0x2}) r5 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_GEM_FLINK(r5, 0xc008640a, &(0x7f0000000300)={r6, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000140)={r7}) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000280)={0x3, r9, 0x1, 0xffff, 0xa, 0x1ff, 0x1}) (fail_nth: 15) ioctl$DRM_IOCTL_MODE_CURSOR2(r1, 0xc02464bb, &(0x7f0000000080)={0x2, r9, 0x1fc, 0x0, 0xb, 0x800008, 0x0, 0x4, 0x4000}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x7c}}, 0x4000) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="c60009"], 0x0, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r10 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x80080, 0x0) ioctl$BLKTRACESETUP(r10, 0x80186803, 0x0) getcwd(0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001640)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x0}, 0x0) r11 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x20043, 0x0) ioctl$COMEDI_DEVCONFIG(r11, 0x40946400, &(0x7f0000000380)={'8255\x00', [0x1000, 0x0, 0xa1a, 0x4, 0x6, 0x800afa3, 0x0, 0x2, 0x5855, 0x2, 0x7, 0x9, 0x1, 0x5, 0x6, 0x2, 0x0, 0x4, 0x2, 0xa, 0x8, 0xcaa2, 0x1003, 0x20001e5b, 0x2000003, 0xe69, 0x2, 0x4, 0x4086, 0x0, 0x6f5]}) [ 78.960677][ T4654] Bluetooth: hci0: command tx timeout [ 79.299783][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 79.449693][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 79.455830][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.461995][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 79.466551][ T9] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 79.471041][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.482916][ T9] usb 5-1: config 0 descriptor?? [ 79.506332][ T9] hub 5-1:0.0: USB hub found [ 79.703301][ T5329] FAULT_INJECTION: forcing a failure. [ 79.703301][ T5329] name failslab, interval 1, probability 0, space 0, times 1 [ 79.708796][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 79.708813][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.708820][ T5329] Call Trace: [ 79.708826][ T5329] [ 79.708830][ T5329] dump_stack_lvl+0xe8/0x150 [ 79.708912][ T5329] should_fail_ex+0x40c/0x560 [ 79.708962][ T5329] should_failslab+0xa8/0x100 [ 79.708972][ T5329] __kmalloc_cache_node_noprof+0xaa/0x630 [ 79.708982][ T5329] ? __get_vm_area_node+0x136/0x300 [ 79.708992][ T5329] ? __get_vm_area_node+0x136/0x300 [ 79.709004][ T5329] __get_vm_area_node+0x136/0x300 [ 79.709018][ T5329] __vmalloc_node_range_noprof+0x358/0x1730 [ 79.709030][ T5329] ? system_heap_vmap+0x1b5/0x570 [ 79.709044][ T5329] ? rcu_is_watching+0x15/0xb0 [ 79.709061][ T5329] ? trace_contention_end+0x3d/0x140 [ 79.709083][ T5329] ? system_heap_vmap+0xaa/0x570 [ 79.709095][ T5329] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 79.709112][ T5329] ? system_heap_vmap+0x1b5/0x570 [ 79.709125][ T5329] vmalloc_noprof+0xb2/0xe0 [ 79.709136][ T5329] ? system_heap_vmap+0x1b5/0x570 [ 79.709149][ T5329] system_heap_vmap+0x1b5/0x570 [ 79.709161][ T5329] ? __pfx___mutex_trylock_common+0x10/0x10 [ 79.709173][ T5329] ? __pfx_system_heap_vmap+0x10/0x10 [ 79.709186][ T5329] ? trace_contention_end+0x3d/0x140 [ 79.709201][ T5329] ? __pfx_system_heap_vmap+0x10/0x10 [ 79.709214][ T5329] dma_buf_vmap+0x244/0x3c0 [ 79.709229][ T5329] ? __pfx_dma_buf_vmap+0x10/0x10 [ 79.709236][ T5329] ? drm_gem_vmap+0x4c/0x1d0 [ 79.709250][ T5329] drm_gem_shmem_vmap_locked+0x15c/0x7d0 [ 79.709261][ T5329] ? __pfx_drm_gem_shmem_vmap_locked+0x10/0x10 [ 79.709269][ T5329] ? drm_gem_vmap+0x25/0x1d0 [ 79.709286][ T5329] drm_gem_vmap+0x10a/0x1d0 [ 79.709304][ T5329] drm_gem_fb_vmap+0xa6/0x8e0 [ 79.709318][ T5329] drm_atomic_helper_prepare_planes+0x2de/0xb50 [ 79.709340][ T5329] drm_atomic_helper_commit+0x19d/0xb10 [ 79.709358][ T5329] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 79.709379][ T5329] drm_atomic_commit+0x24e/0x2b0 [ 79.709393][ T5329] ? __pfx_drm_atomic_commit+0x10/0x10 [ 79.709403][ T5329] ? drm_atomic_get_crtc_state+0x36c/0x570 [ 79.709412][ T5329] ? __pfx___drm_printfn_info+0x10/0x10 [ 79.709431][ T5329] ? drm_mode_object_get+0xcf/0x140 [ 79.709445][ T5329] ? drm_atomic_set_fb_for_plane+0x1f7/0x280 [ 79.709461][ T5329] drm_atomic_helper_update_plane+0x248/0x3b0 [ 79.709481][ T5329] drm_mode_cursor_common+0xe1a/0x15e0 [ 79.709506][ T5329] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 79.709513][ T5329] ? kasan_save_free_info+0x40/0x50 [ 79.709536][ T5329] ? __lock_acquire+0x683/0x2cf0 [ 79.709544][ T5329] ? drm_mode_cursor_ioctl+0xbb/0x130 [ 79.709553][ T5329] drm_mode_cursor_ioctl+0xd4/0x130 [ 79.709561][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 79.709570][ T5329] ? do_raw_spin_unlock+0x4d/0x210 [ 79.709579][ T5329] ? _raw_spin_unlock+0x28/0x50 [ 79.709629][ T5329] ? drm_is_current_master+0x19f/0x200 [ 79.709644][ T5329] drm_ioctl_kernel+0x2df/0x3b0 [ 79.709657][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 79.709668][ T5329] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 79.709679][ T5329] drm_ioctl+0x70e/0xba0 [ 79.709689][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 79.709697][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 79.709713][ T5329] ? __fget_files+0x2a/0x420 [ 79.709726][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 79.709737][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 79.709747][ T5329] __se_sys_ioctl+0xfc/0x170 [ 79.709763][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.709775][ T5329] do_syscall_64+0x174/0x580 [ 79.709784][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.709794][ T5329] ? clear_bhb_loop+0x40/0x90 [ 79.709803][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.709810][ T5329] RIP: 0033:0x7ff27eb9de99 [ 79.709819][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.709824][ T5329] RSP: 002b:00007ff27fadffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 79.709833][ T5329] RAX: ffffffffffffffda RBX: 00007ff27ee25fa0 RCX: 00007ff27eb9de99 [ 79.709840][ T5329] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000004 [ 79.709847][ T5329] RBP: 00007ff27fae0050 R08: 0000000000000000 R09: 0000000000000000 [ 79.709852][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 79.709857][ T5329] R13: 00007ff27ee26038 R14: 00007ff27ee25fa0 R15: 00007ffe65095cc8 [ 79.709875][ T5329] [ 79.914148][ T5329] syz.0.0: vmalloc error: size 264, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 79.923297][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 79.923314][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.923321][ T5329] Call Trace: [ 79.923325][ T5329] [ 79.923330][ T5329] dump_stack_lvl+0xe8/0x150 [ 79.923370][ T5329] warn_alloc+0x24c/0x270 [ 79.923397][ T5329] ? __kasan_kmalloc+0x22/0xb0 [ 79.923414][ T5329] ? __pfx_warn_alloc+0x10/0x10 [ 79.923433][ T5329] ? __get_vm_area_node+0x2af/0x300 [ 79.923454][ T5329] __vmalloc_node_range_noprof+0x37d/0x1730 [ 79.923469][ T5329] ? rcu_is_watching+0x15/0xb0 [ 79.923485][ T5329] ? trace_contention_end+0x3d/0x140 [ 79.923506][ T5329] ? system_heap_vmap+0xaa/0x570 [ 79.923521][ T5329] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 79.923538][ T5329] ? system_heap_vmap+0x1b5/0x570 [ 79.923550][ T5329] vmalloc_noprof+0xb2/0xe0 [ 79.923561][ T5329] ? system_heap_vmap+0x1b5/0x570 [ 79.923575][ T5329] system_heap_vmap+0x1b5/0x570 [ 79.923588][ T5329] ? __pfx___mutex_trylock_common+0x10/0x10 [ 79.923603][ T5329] ? __pfx_system_heap_vmap+0x10/0x10 [ 79.923616][ T5329] ? trace_contention_end+0x3d/0x140 [ 79.923633][ T5329] ? __pfx_system_heap_vmap+0x10/0x10 [ 79.923647][ T5329] dma_buf_vmap+0x244/0x3c0 [ 79.923662][ T5329] ? __pfx_dma_buf_vmap+0x10/0x10 [ 79.923673][ T5329] ? drm_gem_vmap+0x4c/0x1d0 [ 79.923697][ T5329] drm_gem_shmem_vmap_locked+0x15c/0x7d0 [ 79.923715][ T5329] ? __pfx_drm_gem_shmem_vmap_locked+0x10/0x10 [ 79.923729][ T5329] ? drm_gem_vmap+0x25/0x1d0 [ 79.923750][ T5329] drm_gem_vmap+0x10a/0x1d0 [ 79.923768][ T5329] drm_gem_fb_vmap+0xa6/0x8e0 [ 79.923784][ T5329] drm_atomic_helper_prepare_planes+0x2de/0xb50 [ 79.923807][ T5329] drm_atomic_helper_commit+0x19d/0xb10 [ 79.923828][ T5329] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 79.923844][ T5329] drm_atomic_commit+0x24e/0x2b0 [ 79.923861][ T5329] ? __pfx_drm_atomic_commit+0x10/0x10 [ 79.923872][ T5329] ? drm_atomic_get_crtc_state+0x36c/0x570 [ 79.923882][ T5329] ? __pfx___drm_printfn_info+0x10/0x10 [ 79.923903][ T5329] ? drm_mode_object_get+0xcf/0x140 [ 79.923918][ T5329] ? drm_atomic_set_fb_for_plane+0x1f7/0x280 [ 79.923934][ T5329] drm_atomic_helper_update_plane+0x248/0x3b0 [ 79.923955][ T5329] drm_mode_cursor_common+0xe1a/0x15e0 [ 79.923987][ T5329] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 79.923998][ T5329] ? kasan_save_free_info+0x40/0x50 [ 79.924038][ T5329] ? __lock_acquire+0x683/0x2cf0 [ 79.924053][ T5329] ? drm_mode_cursor_ioctl+0xbb/0x130 [ 79.924069][ T5329] drm_mode_cursor_ioctl+0xd4/0x130 [ 79.924083][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 79.924099][ T5329] ? do_raw_spin_unlock+0x4d/0x210 [ 79.924113][ T5329] ? _raw_spin_unlock+0x28/0x50 [ 79.924128][ T5329] ? drm_is_current_master+0x19f/0x200 [ 79.924145][ T5329] drm_ioctl_kernel+0x2df/0x3b0 [ 79.924159][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 79.924173][ T5329] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 79.924191][ T5329] drm_ioctl+0x70e/0xba0 [ 79.924209][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 79.924222][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 79.924242][ T5329] ? __fget_files+0x2a/0x420 [ 79.924258][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 79.924272][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 79.924282][ T5329] __se_sys_ioctl+0xfc/0x170 [ 79.924298][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.924311][ T5329] do_syscall_64+0x174/0x580 [ 79.924322][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.924334][ T5329] ? clear_bhb_loop+0x40/0x90 [ 79.924348][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.924359][ T5329] RIP: 0033:0x7ff27eb9de99 [ 79.924371][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.924387][ T5329] RSP: 002b:00007ff27fadffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 79.924400][ T5329] RAX: ffffffffffffffda RBX: 00007ff27ee25fa0 RCX: 00007ff27eb9de99 [ 79.924408][ T5329] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000004 [ 79.924416][ T5329] RBP: 00007ff27fae0050 R08: 0000000000000000 R09: 0000000000000000 [ 79.924422][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 79.924429][ T5329] R13: 00007ff27ee26038 R14: 00007ff27ee25fa0 R15: 00007ffe65095cc8 [ 79.924448][ T5329] [ 79.924547][ T5329] Mem-Info: [ 80.157031][ T9] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 80.161194][ T5329] active_anon:3196 inactive_anon:19 isolated_anon:0 [ 80.161194][ T5329] active_file:5 inactive_file:39575 isolated_file:0 [ 80.161194][ T5329] unevictable:1768 dirty:0 writeback:1143 [ 80.161194][ T5329] slab_reclaimable:7127 slab_unreclaimable:30611 [ 80.161194][ T5329] mapped:10058 shmem:2234 pagetables:713 [ 80.161194][ T5329] sec_pagetables:291 bounce:0 [ 80.161194][ T5329] kernel_misc_reclaimable:0 [ 80.161194][ T5329] free:31578 free_pcp:2423 free_cma:0 [ 80.183900][ T5329] Node 0 active_anon:36kB inactive_anon:16kB active_file:20kB inactive_file:12kB unevictable:1464kB isolated(anon):0kB isolated(file):0kB mapped:24kB dirty:0kB writeback:0kB shmem:1464kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:2592kB pagetables:724kB sec_pagetables:1088kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 80.201647][ T5329] Node 1 active_anon:12748kB inactive_anon:60kB active_file:0kB inactive_file:158288kB unevictable:5608kB isolated(anon):0kB isolated(file):0kB mapped:40208kB dirty:0kB writeback:4572kB shmem:7472kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7296kB pagetables:2128kB sec_pagetables:76kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 80.216320][ T5329] Node 0 DMA free:1340kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:64kB local_pcp:64kB free_cma:0kB [ 80.227826][ T5329] lowmem_reserve[]: 0 109 109 109 109 [ 80.231445][ T5329] Node 0 DMA32 free:4928kB boost:2048kB min:6180kB low:7212kB high:8244kB reserved_highatomic:0KB free_highatomic:0KB active_anon:36kB inactive_anon:16kB active_file:20kB inactive_file:12kB unevictable:1464kB writepending:0kB zspages:0kB present:770052kB managed:111972kB mlocked:0kB bounce:0kB free_pcp:872kB local_pcp:872kB free_cma:0kB [ 80.245293][ T5329] lowmem_reserve[]: 0 0 0 0 0 [ 80.247579][ T5329] Node 1 DMA32 free:119948kB boost:0kB min:34304kB low:42880kB high:51456kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12748kB inactive_anon:60kB active_file:0kB inactive_file:158288kB unevictable:5608kB writepending:4572kB zspages:1224kB present:786288kB managed:690812kB mlocked:0kB bounce:0kB free_pcp:8748kB local_pcp:8748kB free_cma:0kB [ 80.262605][ T5329] lowmem_reserve[]: 0 0 0 0 0 [ 80.264734][ T5329] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (E) 1*32kB (U) 2*64kB (UE) 1*128kB (E) 0*256kB 0*512kB 1*1024kB (E) 0*2048kB 0*4096kB = 1340kB [ 80.271346][ T5329] Node 0 DMA32: 4*4kB (UME) 14*8kB (UME) 14*16kB (ME) 17*32kB (UME) 7*64kB (UME) 6*128kB (UM) 7*256kB (UME) 2*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 4928kB [ 80.278225][ T5329] Node 1 DMA32: 1*4kB (M) 1*8kB (U) 1*16kB (E) 3*32kB (UME) 2*64kB (UM) 3*128kB (UME) 0*256kB 1*512kB (M) 0*1024kB 2*2048kB (UE) 28*4096kB (M) = 119932kB [ 80.285756][ T5329] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 80.290182][ T5329] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 80.294101][ T5329] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 80.297913][ T5329] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 80.302644][ T5329] 41871 total pagecache pages [ 80.304690][ T5329] 48 pages in swap cache [ 80.306548][ T5329] Free swap = 123868kB [ 80.308503][ T5329] Total swap = 124996kB [ 80.311753][ T5329] 393083 pages RAM [ 80.313549][ T5329] 0 pages HighMem/MovableOnly [ 80.315630][ T5329] 188547 pages reserved [ 80.317401][ T5329] 0 pages cma reserved [ 80.319910][ T5329] ------------[ cut here ]------------ [ 80.322396][ T5329] ret [ 80.322406][ T5329] WARNING: drivers/dma-buf/dma-buf.c:1653 at dma_buf_vmap+0x30f/0x3c0, CPU#0: syz.0.0/5329 [ 80.327810][ T5329] Modules linked in: [ 80.329890][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 80.333601][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.337751][ T5329] RIP: 0010:dma_buf_vmap+0x30f/0x3c0 [ 80.340453][ T5329] Code: 8a 05 cc e8 b3 42 7c fb 90 0f 0b 90 b8 ea ff ff ff eb b4 e8 a3 42 7c fb 90 0f 0b 90 e9 11 fe ff ff e8 95 42 7c fb 44 89 f0 90 <0f> 0b 90 49 bc 00 00 00 00 00 fc ff df eb 8e e8 9d d4 87 05 48 c7 [ 80.348556][ T5329] RSP: 0018:ffffc9000fa473a0 EFLAGS: 00010293 [ 80.351302][ T5329] RAX: 00000000fffffff4 RBX: 1ffff92001f48e78 RCX: ffff888000fd2540 [ 80.354597][ T5329] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 80.357910][ T5329] RBP: ffffc9000fa47450 R08: ffffc9000fa47227 R09: 1ffff92001f48e44 [ 80.361259][ T5329] R10: dffffc0000000000 R11: fffff52001f48e45 R12: 1ffff110081c6c85 [ 80.364607][ T5329] R13: ffffffff864bd580 R14: 00000000fffffff4 R15: ffff888040e36430 [ 80.368000][ T5329] FS: 00007ff27fae06c0(0000) GS:ffff88808c546000(0000) knlGS:0000000000000000 [ 80.371815][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.374599][ T5329] CR2: 00007ff27fa9cfa0 CR3: 0000000040879000 CR4: 0000000000352ef0 [ 80.378327][ T5329] Call Trace: [ 80.379917][ T5329] [ 80.381241][ T5329] ? __pfx_dma_buf_vmap+0x10/0x10 [ 80.383441][ T5329] ? drm_gem_vmap+0x4c/0x1d0 [ 80.385464][ T5329] drm_gem_shmem_vmap_locked+0x15c/0x7d0 [ 80.387894][ T5329] ? __pfx_drm_gem_shmem_vmap_locked+0x10/0x10 [ 80.392144][ T5329] ? drm_gem_vmap+0x25/0x1d0 [ 80.394212][ T5329] drm_gem_vmap+0x10a/0x1d0 [ 80.396171][ T5329] drm_gem_fb_vmap+0xa6/0x8e0 [ 80.398239][ T5329] drm_atomic_helper_prepare_planes+0x2de/0xb50 [ 80.400960][ T5329] drm_atomic_helper_commit+0x19d/0xb10 [ 80.403272][ T5329] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 80.405805][ T5329] drm_atomic_commit+0x24e/0x2b0 [ 80.407882][ T5329] ? __pfx_drm_atomic_commit+0x10/0x10 [ 80.410178][ T5329] ? drm_atomic_get_crtc_state+0x36c/0x570 [ 80.413002][ T5329] ? __pfx___drm_printfn_info+0x10/0x10 [ 80.415851][ T5329] ? drm_mode_object_get+0xcf/0x140 [ 80.418222][ T5329] ? drm_atomic_set_fb_for_plane+0x1f7/0x280 [ 80.420762][ T5329] drm_atomic_helper_update_plane+0x248/0x3b0 [ 80.423281][ T5329] drm_mode_cursor_common+0xe1a/0x15e0 [ 80.425584][ T5329] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 80.428021][ T5329] ? kasan_save_free_info+0x40/0x50 [ 80.430229][ T5329] ? __lock_acquire+0x683/0x2cf0 [ 80.432405][ T5329] ? drm_mode_cursor_ioctl+0xbb/0x130 [ 80.434704][ T5329] drm_mode_cursor_ioctl+0xd4/0x130 [ 80.436950][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 80.439931][ T5329] ? do_raw_spin_unlock+0x4d/0x210 [ 80.442974][ T5329] ? _raw_spin_unlock+0x28/0x50 [ 80.445116][ T5329] ? drm_is_current_master+0x19f/0x200 [ 80.447530][ T5329] drm_ioctl_kernel+0x2df/0x3b0 [ 80.450084][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 80.452876][ T5329] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 80.455531][ T5329] drm_ioctl+0x70e/0xba0 [ 80.457613][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 80.460543][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 80.462930][ T5329] ? __fget_files+0x2a/0x420 [ 80.465224][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 80.467680][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 80.469911][ T5329] __se_sys_ioctl+0xfc/0x170 [ 80.471891][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.474500][ T5329] do_syscall_64+0x174/0x580 [ 80.476634][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.479269][ T5329] ? clear_bhb_loop+0x40/0x90 [ 80.481719][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.484447][ T5329] RIP: 0033:0x7ff27eb9de99 [ 80.486479][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.494729][ T5329] RSP: 002b:00007ff27fadffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 80.498404][ T5329] RAX: ffffffffffffffda RBX: 00007ff27ee25fa0 RCX: 00007ff27eb9de99 [ 80.503548][ T5329] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000004 [ 80.507429][ T5329] RBP: 00007ff27fae0050 R08: 0000000000000000 R09: 0000000000000000 [ 80.510949][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 80.514334][ T5329] R13: 00007ff27ee26038 R14: 00007ff27ee25fa0 R15: 00007ffe65095cc8 [ 80.517884][ T5329] [ 80.519362][ T5329] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 80.522357][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 80.525896][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.529970][ T5329] Call Trace: [ 80.531490][ T5329] [ 80.532823][ T5329] vpanic+0x56c/0xa60 [ 80.534646][ T5329] ? __pfx__printk+0x10/0x10 [ 80.536678][ T5329] ? __pfx_vpanic+0x10/0x10 [ 80.538664][ T5329] ? is_bpf_text_address+0x292/0x2b0 [ 80.541028][ T5329] ? is_bpf_text_address+0x26/0x2b0 [ 80.543281][ T5329] panic+0xc5/0xd0 [ 80.545156][ T5329] ? __pfx_panic+0x10/0x10 [ 80.547138][ T5329] __warn+0x315/0x4c0 [ 80.548871][ T5329] ? dma_buf_vmap+0x30f/0x3c0 [ 80.550972][ T5329] ? dma_buf_vmap+0x30f/0x3c0 [ 80.552970][ T5329] __report_bug+0x276/0x570 [ 80.554968][ T5329] ? dma_buf_vmap+0x30f/0x3c0 [ 80.557003][ T5329] ? __pfx___report_bug+0x10/0x10 [ 80.559114][ T5329] ? __mutex_unlock_slowpath+0x731/0x900 [ 80.561425][ T5329] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 80.563929][ T5329] ? system_heap_vmap+0x1b5/0x570 [ 80.566079][ T5329] ? dma_buf_vmap+0x30f/0x3c0 [ 80.568118][ T5329] report_bug+0x16a/0x220 [ 80.570048][ T5329] ? dma_buf_vmap+0x30f/0x3c0 [ 80.572141][ T5329] ? dma_buf_vmap+0x311/0x3c0 [ 80.574204][ T5329] handle_bug+0x9c/0x200 [ 80.575984][ T5329] exc_invalid_op+0x1a/0x50 [ 80.577965][ T5329] asm_exc_invalid_op+0x1a/0x20 [ 80.580104][ T5329] RIP: 0010:dma_buf_vmap+0x30f/0x3c0 [ 80.582302][ T5329] Code: 8a 05 cc e8 b3 42 7c fb 90 0f 0b 90 b8 ea ff ff ff eb b4 e8 a3 42 7c fb 90 0f 0b 90 e9 11 fe ff ff e8 95 42 7c fb 44 89 f0 90 <0f> 0b 90 49 bc 00 00 00 00 00 fc ff df eb 8e e8 9d d4 87 05 48 c7 [ 80.590273][ T5329] RSP: 0018:ffffc9000fa473a0 EFLAGS: 00010293 [ 80.592914][ T5329] RAX: 00000000fffffff4 RBX: 1ffff92001f48e78 RCX: ffff888000fd2540 [ 80.596159][ T5329] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 80.599443][ T5329] RBP: ffffc9000fa47450 R08: ffffc9000fa47227 R09: 1ffff92001f48e44 [ 80.602956][ T5329] R10: dffffc0000000000 R11: fffff52001f48e45 R12: 1ffff110081c6c85 [ 80.606109][ T5329] R13: ffffffff864bd580 R14: 00000000fffffff4 R15: ffff888040e36430 [ 80.609458][ T5329] ? __pfx_system_heap_vmap+0x10/0x10 [ 80.611803][ T5329] ? __pfx_dma_buf_vmap+0x10/0x10 [ 80.613914][ T5329] ? drm_gem_vmap+0x4c/0x1d0 [ 80.615897][ T5329] drm_gem_shmem_vmap_locked+0x15c/0x7d0 [ 80.618380][ T5329] ? __pfx_drm_gem_shmem_vmap_locked+0x10/0x10 [ 80.620915][ T5329] ? drm_gem_vmap+0x25/0x1d0 [ 80.622926][ T5329] drm_gem_vmap+0x10a/0x1d0 [ 80.624993][ T5329] drm_gem_fb_vmap+0xa6/0x8e0 [ 80.627104][ T5329] drm_atomic_helper_prepare_planes+0x2de/0xb50 [ 80.629694][ T5329] drm_atomic_helper_commit+0x19d/0xb10 [ 80.631905][ T5329] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 80.634440][ T5329] drm_atomic_commit+0x24e/0x2b0 [ 80.636545][ T5329] ? __pfx_drm_atomic_commit+0x10/0x10 [ 80.638913][ T5329] ? drm_atomic_get_crtc_state+0x36c/0x570 [ 80.641451][ T5329] ? __pfx___drm_printfn_info+0x10/0x10 [ 80.643817][ T5329] ? drm_mode_object_get+0xcf/0x140 [ 80.645874][ T5329] ? drm_atomic_set_fb_for_plane+0x1f7/0x280 [ 80.648286][ T5329] drm_atomic_helper_update_plane+0x248/0x3b0 [ 80.650692][ T5329] drm_mode_cursor_common+0xe1a/0x15e0 [ 80.653377][ T5329] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 80.656356][ T5329] ? kasan_save_free_info+0x40/0x50 [ 80.658720][ T5329] ? __lock_acquire+0x683/0x2cf0 [ 80.661187][ T5329] ? drm_mode_cursor_ioctl+0xbb/0x130 [ 80.663536][ T5329] drm_mode_cursor_ioctl+0xd4/0x130 [ 80.665782][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 80.668204][ T5329] ? do_raw_spin_unlock+0x4d/0x210 [ 80.670379][ T5329] ? _raw_spin_unlock+0x28/0x50 [ 80.672423][ T5329] ? drm_is_current_master+0x19f/0x200 [ 80.674511][ T5329] drm_ioctl_kernel+0x2df/0x3b0 [ 80.676464][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 80.678833][ T5329] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 80.681031][ T5329] drm_ioctl+0x70e/0xba0 [ 80.682789][ T5329] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 80.685127][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 80.687130][ T5329] ? __fget_files+0x2a/0x420 [ 80.689044][ T5329] ? bpf_lsm_file_ioctl+0x9/0x20 [ 80.691147][ T5329] ? __pfx_drm_ioctl+0x10/0x10 [ 80.693165][ T5329] __se_sys_ioctl+0xfc/0x170 [ 80.695155][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.697561][ T5329] do_syscall_64+0x174/0x580 [ 80.699430][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.701921][ T5329] ? clear_bhb_loop+0x40/0x90 [ 80.703914][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.706496][ T5329] RIP: 0033:0x7ff27eb9de99 [ 80.708549][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.717069][ T5329] RSP: 002b:00007ff27fadffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 80.720416][ T5329] RAX: ffffffffffffffda RBX: 00007ff27ee25fa0 RCX: 00007ff27eb9de99 [ 80.723798][ T5329] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000004 [ 80.727251][ T5329] RBP: 00007ff27fae0050 R08: 0000000000000000 R09: 0000000000000000 [ 80.730757][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 80.734193][ T5329] R13: 00007ff27ee26038 R14: 00007ff27ee25fa0 R15: 00007ffe65095cc8 [ 80.737542][ T5329] [ 80.739532][ T5329] Kernel Offset: disabled [ 80.741391][ T5329] Rebooting in 86400 seconds..