program:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2)
ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f00000000c0)=0x3)
r3 = syz_open_dev$video(&(0x7f0000000100), 0x7fff, 0x0)
ioctl$VIDIOC_G_SELECTION(r3, 0xc040565e, &(0x7f0000000040)={0x1, 0x101, 0x1, {0x6, 0xc, 0x770d0368, 0xb9c5a9dd}})
ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000940)={0x60, 0x360, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7})
r4 = userfaultfd(0x1)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79})
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$NILFS_IOCTL_GET_SUINFO(r4, 0x80186e84, &(0x7f0000000140)={&(0x7f00000000c0)=[{0x1, 0x6, 0x1}], 0x1, 0x10, 0x5, 0x7})
ioctl$UFFDIO_MOVE(r4, 0xc028aa05, &(0x7f0000000340)={&(0x7f0000a0c000/0x2000)=nil, &(0x7f00007a9000/0x4000)=nil, 0x2000, 0x1})
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300))
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000200)=""/148, &(0x7f00000002c0)=""/8})
r6 = dup(r5)
ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f00000001c0)={0x0, r6})
r7 = socket$inet6_sctp(0xa, 0x1, 0x84)
mkdir(&(0x7f0000000540)='./sys\x00', 0x0)
r8 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCL_BLANKSCREEN(r8, 0x541c, &(0x7f0000000000))
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0)
write(r9, &(0x7f00000000c0)='1', 0x1)
sendto$inet6(r7, &(0x7f0000000500)="a4", 0x1a000, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
[ 96.310443][ T5285] Bluetooth: hci0: command tx timeout
[ 96.448304][ T5326] Console: switching to colour dummy device 80x25
[ 96.686587][ T5325] ------------[ cut here ]------------
[ 96.686650][ T5325] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
[ 96.686680][ T5325] WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e2/0x1550, CPU#0: syz.0.0/5325
[ 96.694989][ T5325] Modules linked in:
[ 96.696509][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.699688][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.703697][ T5325] RIP: 0010:__mutex_lock+0x12e9/0x1550
[ 96.705969][ T5325] Code: 73 7a 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d ab 32 92 04 00 75 13 48 8d 3d ae 2e 95 04 48 c7 c6 60 10 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f
[ 96.715516][ T5325] RSP: 0018:ffffc9000de07ae0 EFLAGS: 00010246
[ 96.718587][ T5325] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88803c8dcb00
[ 96.721920][ T5325] RDX: 0000000000000000 RSI: ffffffff8c0d1060 RDI: ffffffff907d6f90
[ 96.725008][ T5325] RBP: ffffc9000de07c80 R08: ffffffff907a7383 R09: 1ffffffff20f4e70
[ 96.728278][ T5325] R10: dffffc0000000000 R11: fffffbfff20f4e71 R12: ffff888034cb51c0
[ 96.731454][ T5325] R13: 0000000000000000 R14: 1ffff92001bc0f70 R15: 0000000000000000
[ 96.735076][ T5325] FS: 00005555806b7540(0000) GS:ffff88808c2ca000(0000) knlGS:0000000000000000
[ 96.740289][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 96.743024][ T5325] CR2: 00005572ae4ed280 CR3: 000000000e96a000 CR4: 0000000000352ef0
[ 96.746376][ T5325] Call Trace:
[ 96.747852][ T5325]
[ 96.749366][ T5325] ? kfree+0x1c5/0x650
[ 96.751249][ T5325] ? drm_mode_rmfb+0x561/0x7a0
[ 96.753351][ T5325] ? drm_gem_fb_destroy+0x1c9/0x200
[ 96.755747][ T5325] ? virtio_gpu_free_object+0x90/0x1d0
[ 96.758221][ T5325] ? drm_mode_rmfb+0x561/0x7a0
[ 96.760332][ T5325] ? __pfx___mutex_lock+0x10/0x10
[ 96.762402][ T5325] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 96.764960][ T5325] virtio_gpu_free_object+0x90/0x1d0
[ 96.767055][ T5325] drm_client_buffer_delete+0x183/0x2d0
[ 96.769423][ T5325] drm_fbdev_shmem_fb_destroy+0xb5/0xe0
[ 96.771909][ T5325] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10
[ 96.774394][ T5325] fb_release+0x11d/0x140
[ 96.776240][ T5325] ? __pfx_fb_release+0x10/0x10
[ 96.778329][ T5325] __fput+0x418/0xa50
[ 96.780101][ T5325] task_work_run+0x1d9/0x270
[ 96.782030][ T5325] ? __pfx_task_work_run+0x10/0x10
[ 96.784057][ T5325] exit_to_user_mode_loop+0x204/0x770
[ 96.786241][ T5325] ? rcu_is_watching+0x16/0xb0
[ 96.788199][ T5325] do_syscall_64+0x328/0x520
[ 96.790274][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.792809][ T5325] ? clear_bhb_loop+0x70/0xc0
[ 96.794832][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.797322][ T5325] RIP: 0033:0x7f058f99e159
[ 96.799173][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.807694][ T5325] RSP: 002b:00007ffe5b6bd368 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 96.811388][ T5325] RAX: 0000000000000000 RBX: 00007f058fc27da0 RCX: 00007f058f99e159
[ 96.814847][ T5325] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 96.818170][ T5325] RBP: 00007f058fc27da0 R08: 00007f058fc26038 R09: 0000000000000000
[ 96.821607][ T5325] R10: 0000000000dde168 R11: 0000000000000246 R12: 0000000000017ac8
[ 96.824848][ T5325] R13: 00007f058fc2609c R14: 000000000001785a R15: 00007ffe5b6bd470
[ 96.828415][ T5325]
[ 96.830114][ T5325] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 96.833139][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.836790][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.841145][ T5325] Call Trace:
[ 96.842499][ T5325]
[ 96.843734][ T5325] vpanic+0x56d/0xa60
[ 96.845536][ T5325] ? __pfx__printk+0x10/0x10
[ 96.847474][ T5325] ? __pfx_vpanic+0x10/0x10
[ 96.849417][ T5325] ? is_bpf_text_address+0x292/0x2b0
[ 96.851669][ T5325] ? is_bpf_text_address+0x26/0x2b0
[ 96.853849][ T5325] panic+0xc5/0xd0
[ 96.855457][ T5325] ? __pfx_panic+0x10/0x10
[ 96.857330][ T5325] __warn+0x315/0x4c0
[ 96.859138][ T5325] ? __mutex_lock+0x12e2/0x1550
[ 96.861237][ T5325] ? __mutex_lock+0x12e2/0x1550
[ 96.863295][ T5325] __report_bug+0x276/0x570
[ 96.865279][ T5325] ? __mutex_lock+0x12e2/0x1550
[ 96.867273][ T5325] ? __pfx___report_bug+0x10/0x10
[ 96.869383][ T5325] ? drm_client_buffer_delete+0x113/0x2d0
[ 96.871818][ T5325] report_bug_entry+0x19b/0x290
[ 96.873889][ T5325] ? __mutex_lock+0x12e9/0x1550
[ 96.875884][ T5325] ? __mutex_lock+0x12ee/0x1550
[ 96.877960][ T5325] handle_bug+0xce/0x200
[ 96.879826][ T5325] exc_invalid_op+0x1a/0x50
[ 96.881709][ T5325] asm_exc_invalid_op+0x1a/0x20
[ 96.883741][ T5325] RIP: 0010:__mutex_lock+0x12e9/0x1550
[ 96.886045][ T5325] Code: 73 7a 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d ab 32 92 04 00 75 13 48 8d 3d ae 2e 95 04 48 c7 c6 60 10 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f
[ 96.893888][ T5325] RSP: 0018:ffffc9000de07ae0 EFLAGS: 00010246
[ 96.896602][ T5325] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88803c8dcb00
[ 96.899932][ T5325] RDX: 0000000000000000 RSI: ffffffff8c0d1060 RDI: ffffffff907d6f90
[ 96.903356][ T5325] RBP: ffffc9000de07c80 R08: ffffffff907a7383 R09: 1ffffffff20f4e70
[ 96.906789][ T5325] R10: dffffc0000000000 R11: fffffbfff20f4e71 R12: ffff888034cb51c0
[ 96.910063][ T5325] R13: 0000000000000000 R14: 1ffff92001bc0f70 R15: 0000000000000000
[ 96.913398][ T5325] ? kfree+0x1c5/0x650
[ 96.915113][ T5325] ? drm_mode_rmfb+0x561/0x7a0
[ 96.917210][ T5325] ? drm_gem_fb_destroy+0x1c9/0x200
[ 96.919487][ T5325] ? virtio_gpu_free_object+0x90/0x1d0
[ 96.921801][ T5325] ? drm_mode_rmfb+0x561/0x7a0
[ 96.923834][ T5325] ? __pfx___mutex_lock+0x10/0x10
[ 96.925951][ T5325] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 96.928590][ T5325] virtio_gpu_free_object+0x90/0x1d0
[ 96.930865][ T5325] drm_client_buffer_delete+0x183/0x2d0
[ 96.933233][ T5325] drm_fbdev_shmem_fb_destroy+0xb5/0xe0
[ 96.935619][ T5325] ? __pfx_drm_fbdev_shmem_fb_release+0x10/0x10
[ 96.938126][ T5325] fb_release+0x11d/0x140
[ 96.939991][ T5325] ? __pfx_fb_release+0x10/0x10
[ 96.942021][ T5325] __fput+0x418/0xa50
[ 96.943693][ T5325] task_work_run+0x1d9/0x270
[ 96.945654][ T5325] ? __pfx_task_work_run+0x10/0x10
[ 96.947864][ T5325] exit_to_user_mode_loop+0x204/0x770
[ 96.950052][ T5325] ? rcu_is_watching+0x16/0xb0
[ 96.952108][ T5325] do_syscall_64+0x328/0x520
[ 96.954133][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.956741][ T5325] ? clear_bhb_loop+0x70/0xc0
[ 96.958784][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.961302][ T5325] RIP: 0033:0x7f058f99e159
[ 96.963274][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.971385][ T5325] RSP: 002b:00007ffe5b6bd368 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 96.974960][ T5325] RAX: 0000000000000000 RBX: 00007f058fc27da0 RCX: 00007f058f99e159
[ 96.978328][ T5325] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 96.981847][ T5325] RBP: 00007f058fc27da0 R08: 00007f058fc26038 R09: 0000000000000000
[ 96.985286][ T5325] R10: 0000000000dde168 R11: 0000000000000246 R12: 0000000000017ac8
[ 96.988733][ T5325] R13: 00007f058fc2609c R14: 000000000001785a R15: 00007ffe5b6bd470
[ 96.992281][ T5325]
[ 96.994146][ T5325] Kernel Offset: disabled
[ 96.996116][ T5325] Rebooting in 86400 seconds..