program: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) io_setup(0xa, &(0x7f0000000080)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/task-filter\x00', 0x1, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/probability\x00', 0x1, 0x50) write(r3, &(0x7f0000000100)='N', 0x1) write(r4, &(0x7f0000000100)='100', 0x3) io_submit(r2, 0x1, &(0x7f0000000280)=[&(0x7f00000000c0)={0x400000, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0}]) mmap$IORING_OFF_SQ_RING(0x0, 0x8001, 0xb, 0x40010, r3, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r5 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) ioctl$HIDIOCSREPORT(r5, 0x81044804, &(0x7f00000002c0)={0x3, 0x1, 0x8}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r6 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7fce1dca24e3ee4c89a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d83104000000fda542e718f94b929ade", 0x55}], 0x1}, 0x20048000) write(r6, &(0x7f0000000040)="2400000021002551241c0165ff00fc020200000003100f000ee1000c08000b0000000000", 0x24) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newtfilter={0x2c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa}, {0x1}, {0x300, 0x1}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x80}}]}, 0x2c}}, 0x0) [ 118.139867][ T5295] Bluetooth: hci0: command tx timeout [ 118.538761][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 118.690558][ T10] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 118.698052][ T10] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 118.705662][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 118.710578][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 118.715428][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 118.726714][ T10] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 118.731333][ T10] usb 5-1: Manufacturer: syz [ 118.743661][ T10] usb 5-1: config 0 descriptor?? [ 118.964460][ T5332] FAULT_INJECTION: forcing a failure. [ 118.964460][ T5332] name failslab, interval 1, probability 100, space 0, times 1 [ 118.971793][ T4979] FAULT_INJECTION: forcing a failure. [ 118.971793][ T4979] name failslab, interval 1, probability 100, space 0, times 1 [ 118.979095][ T4979] CPU: 0 UID: 0 PID: 4979 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 118.979124][ T4979] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.979131][ T4979] Workqueue: events drm_fb_helper_damage_work [ 118.979299][ T4979] Call Trace: [ 118.979309][ T4979] [ 118.979315][ T4979] dump_stack_lvl+0xe8/0x150 [ 118.979361][ T4979] should_fail_ex+0x410/0x560 [ 118.979405][ T4979] should_failslab+0xa8/0x100 [ 118.979436][ T4979] __kmalloc_cache_noprof+0xa3/0x600 [ 118.979455][ T4979] ? drm_atomic_commit_alloc+0xa9/0x100 [ 118.979468][ T4979] ? drm_atomic_commit_alloc+0xa9/0x100 [ 118.979478][ T4979] drm_atomic_commit_alloc+0xa9/0x100 [ 118.979490][ T4979] drm_atomic_helper_dirtyfb+0x129/0xfd0 [ 118.979503][ T4979] ? __lock_acquire+0x6df/0x2e50 [ 118.979527][ T4979] ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10 [ 118.979551][ T4979] ? do_raw_spin_lock+0x12b/0x2f0 [ 118.979575][ T4979] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 118.979594][ T4979] drm_fb_helper_damage_work+0x84c/0xf20 [ 118.979618][ T4979] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 118.979647][ T4979] ? lock_acquire+0x115/0x350 [ 118.979664][ T4979] ? rcu_is_watching+0x16/0xb0 [ 118.979679][ T4979] ? process_scheduled_works+0x97a/0x1630 [ 118.979696][ T4979] process_scheduled_works+0xc3d/0x1630 [ 118.979730][ T4979] ? __pfx_process_scheduled_works+0x10/0x10 [ 118.979750][ T4979] ? assign_work+0x3cf/0x5d0 [ 118.979769][ T4979] worker_thread+0xa47/0xfb0 [ 118.979796][ T4979] kthread+0x38b/0x480 [ 118.979809][ T4979] ? __pfx_worker_thread+0x10/0x10 [ 118.979823][ T4979] ? __pfx_kthread+0x10/0x10 [ 118.979835][ T4979] ret_from_fork+0x514/0xb70 [ 118.979849][ T4979] ? __pfx_ret_from_fork+0x10/0x10 [ 118.979860][ T4979] ? __switch_to+0xc89/0x1420 [ 118.979879][ T4979] ? __pfx_kthread+0x10/0x10 [ 118.979891][ T4979] ret_from_fork_asm+0x1a/0x30 [ 118.979919][ T4979] [ 118.984837][ C0] FAULT_INJECTION: forcing a failure. [ 118.984837][ C0] name failslab, interval 1, probability 100, space 0, times 1 [ 118.984875][ C0] CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) [ 118.984894][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 118.984904][ C0] Call Trace: [ 118.984914][ C0] [ 118.984923][ C0] dump_stack_lvl+0xe8/0x150 [ 118.984963][ C0] should_fail_ex+0x410/0x560 [ 118.985020][ C0] ? __alloc_skb+0x1db/0x7a0 [ 118.985151][ C0] should_failslab+0xa8/0x100 [ 118.985169][ C0] ? __alloc_skb+0x1db/0x7a0 [ 118.985190][ C0] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 118.985210][ C0] ? __alloc_skb+0x18d/0x7a0 [ 118.985232][ C0] ? __alloc_skb+0x1db/0x7a0 [ 118.985257][ C0] __alloc_skb+0x1db/0x7a0 [ 118.985294][ C0] __netdev_alloc_skb+0xc2/0x820 [ 118.985316][ C0] ? __ieee80211_beacon_get+0x36/0x1920 [ 118.985385][ C0] __ieee80211_beacon_get+0xcfd/0x1920 [ 118.985407][ C0] ? __ieee80211_beacon_get+0x36/0x1920 [ 118.985430][ C0] ? __lock_acquire+0x6df/0x2e50 [ 118.985453][ C0] ieee80211_beacon_get_tim+0xbd/0x2c0 [ 118.985478][ C0] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 118.985508][ C0] mac80211_hwsim_beacon_tx+0x378/0x820 [ 118.985563][ C0] __iterate_interfaces+0x2af/0x5a0 [ 118.985588][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 118.985601][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 118.985619][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 118.985635][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 118.985656][ C0] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 118.985681][ C0] mac80211_hwsim_beacon+0xaf/0x240 [ 118.985702][ C0] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 118.985725][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 118.985760][ C0] hrtimer_run_softirq+0x1e3/0x2e0 [ 118.985787][ C0] handle_softirqs+0x226/0x860 [ 118.985810][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 118.985836][ C0] __irq_exit_rcu+0xcb/0x220 [ 118.985855][ C0] irq_exit_rcu+0x9/0x30 [ 118.985872][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 118.985919][ C0] [ 118.985925][ C0] [ 118.985932][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 118.985963][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 118.985978][ C0] Code: f7 e8 5d a5 ba f5 f7 c3 00 02 00 00 74 05 e8 60 f3 e6 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 f4 be ab f5 65 48 8b 05 9c 11 ac 07 48 85 c0 74 18 5b 41 5e c3 [ 118.985986][ C0] RSP: 0018:ffffc9000029fca8 EFLAGS: 00000206 [ 118.985997][ C0] RAX: 0000000000000006 RBX: 0000000000000206 RCX: 8000000000000001 [ 118.986007][ C0] RDX: 0000000000000000 RSI: ffffffff8e477b3f RDI: 0000000000000001 [ 118.986018][ C0] RBP: ffffc9000029fe18 R08: ffffffff907a3c7f R09: 1ffffffff20f478f [ 118.986029][ C0] R10: dffffc0000000000 R11: fffffbfff20f4790 R12: 0000000000000002 [ 118.986038][ C0] R13: ffff88801b768000 R14: ffffffff9ad3e4c0 R15: dffffc0000000000 [ 118.986067][ C0] nbcon_kthread_func+0x6c4/0x880 [ 118.986093][ C0] ? nbcon_kthread_func+0x163/0x880 [ 118.986108][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 118.986121][ C0] ? __kthread_parkme+0x71/0x1f0 [ 118.986135][ C0] ? __kthread_parkme+0x199/0x1f0 [ 118.986150][ C0] kthread+0x38b/0x480 [ 118.986159][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 118.986168][ C0] ? __pfx_kthread+0x10/0x10 [ 118.986177][ C0] ret_from_fork+0x514/0xb70 [ 118.986189][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 118.986198][ C0] ? __switch_to+0xc89/0x1420 [ 118.986213][ C0] ? __pfx_kthread+0x10/0x10 [ 118.986223][ C0] ret_from_fork_asm+0x1a/0x30 [ 118.986245][ C0] [ 119.060450][ T4979] ------------[ cut here ]------------ [ 119.060473][ T4979] virtio-pci 0000:00:01.0: [drm] Dirty helper failed: ret=-12 [ 119.060615][ T4979] WARNING: drivers/gpu/drm/drm_fbdev_shmem.c:118 at drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310, CPU#0: kworker/0:4/4979 [ 119.273953][ T4979] Modules linked in: [ 119.276146][ T4979] CPU: 0 UID: 0 PID: 4979 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 119.280781][ T4979] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.285558][ T4979] Workqueue: events drm_fb_helper_damage_work [ 119.290195][ T4979] RIP: 0010:drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 119.293866][ T4979] Code: 29 fc 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 fa 21 9b fc 4d 8b 27 48 89 df 4c 89 f6 4c 89 e2 8b 5c 24 04 89 d9 <67> 48 0f b9 3a 89 d8 e9 f7 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f [ 119.302130][ T4979] RSP: 0018:ffffc900021bf898 EFLAGS: 00010246 [ 119.304813][ T4979] RAX: 1ffff11003ed541a RBX: 00000000fffffff4 RCX: 00000000fffffff4 [ 119.309560][ T4979] RDX: ffff88801f3f3e60 RSI: ffffffff8c79ae40 RDI: ffffffff90861ab0 [ 119.313303][ T4979] RBP: ffff88801fb0e008 R08: 0000000000000dc0 R09: 00000000ffffffff [ 119.317272][ T4979] R10: dffffc0000000000 R11: fffffbfff1dd6087 R12: ffff88801f3f3e60 [ 119.321965][ T4979] R13: dffffc0000000000 R14: ffffffff8c79ae40 R15: ffff88801f6aa0d0 [ 119.325585][ T4979] FS: 0000000000000000(0000) GS:ffff88808c2cd000(0000) knlGS:0000000000000000 [ 119.330580][ T4979] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 119.333498][ T4979] CR2: 00007f5a690ae0a8 CR3: 000000005067e000 CR4: 0000000000352ef0 [ 119.336480][ T4979] Call Trace: [ 119.337833][ T4979] [ 119.339227][ T4979] drm_fb_helper_damage_work+0x84c/0xf20 [ 119.341875][ T4979] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 119.344800][ T4979] ? lock_acquire+0x115/0x350 [ 119.347266][ T4979] ? rcu_is_watching+0x16/0xb0 [ 119.349556][ T4979] ? process_scheduled_works+0x97a/0x1630 [ 119.352321][ T4979] process_scheduled_works+0xc3d/0x1630 [ 119.354797][ T4979] ? __pfx_process_scheduled_works+0x10/0x10 [ 119.357765][ T4979] ? assign_work+0x3cf/0x5d0 [ 119.360376][ T4979] worker_thread+0xa47/0xfb0 [ 119.362788][ T4979] kthread+0x38b/0x480 [ 119.364978][ T4979] ? __pfx_worker_thread+0x10/0x10 [ 119.367483][ T4979] ? __pfx_kthread+0x10/0x10 [ 119.369965][ T4979] ret_from_fork+0x514/0xb70 [ 119.372281][ T4979] ? __pfx_ret_from_fork+0x10/0x10 [ 119.375424][ T4979] ? __switch_to+0xc89/0x1420 [ 119.377882][ T4979] ? __pfx_kthread+0x10/0x10 [ 119.380127][ T4979] ret_from_fork_asm+0x1a/0x30 [ 119.382396][ T4979] [ 119.383831][ T4979] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 119.387735][ T4979] CPU: 0 UID: 0 PID: 4979 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 119.392412][ T4979] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.396109][ T4979] Workqueue: events drm_fb_helper_damage_work [ 119.398670][ T4979] Call Trace: [ 119.400417][ T4979] [ 119.402438][ T4979] vpanic+0x56d/0xa60 [ 119.405071][ T4979] ? __pfx__printk+0x10/0x10 [ 119.407381][ T4979] ? __pfx_vpanic+0x10/0x10 [ 119.410143][ T4979] ? is_bpf_text_address+0x292/0x2b0 [ 119.412851][ T4979] ? is_bpf_text_address+0x26/0x2b0 [ 119.415353][ T4979] panic+0xc5/0xd0 [ 119.416862][ T4979] ? __pfx_panic+0x10/0x10 [ 119.419068][ T4979] ? ret_from_fork_asm+0x1a/0x30 [ 119.421375][ T4979] __warn+0x315/0x4c0 [ 119.423324][ T4979] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 119.426733][ T4979] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 119.430077][ T4979] __report_bug+0x276/0x570 [ 119.432248][ T4979] ? drm_modeset_acquire_fini+0x27/0x180 [ 119.434482][ T4979] ? drm_fbdev_shmem_helper_fb_dirty+0x1e1/0x310 [ 119.437169][ T4979] ? __pfx___report_bug+0x10/0x10 [ 119.439735][ T4979] ? drm_atomic_helper_dirtyfb+0xf27/0xfd0 [ 119.442505][ T4979] ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10 [ 119.445730][ T4979] report_bug_entry+0x19b/0x290 [ 119.447980][ T4979] ? drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 119.450988][ T4979] ? drm_fbdev_shmem_helper_fb_dirty+0x28d/0x310 [ 119.453534][ T4979] handle_bug+0xce/0x200 [ 119.455864][ T4979] exc_invalid_op+0x1a/0x50 [ 119.458842][ T4979] asm_exc_invalid_op+0x1a/0x20 [ 119.461432][ T4979] RIP: 0010:drm_fbdev_shmem_helper_fb_dirty+0x288/0x310 [ 119.464207][ T4979] Code: 29 fc 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 fa 21 9b fc 4d 8b 27 48 89 df 4c 89 f6 4c 89 e2 8b 5c 24 04 89 d9 <67> 48 0f b9 3a 89 d8 e9 f7 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f [ 119.472566][ T4979] RSP: 0018:ffffc900021bf898 EFLAGS: 00010246 [ 119.475235][ T4979] RAX: 1ffff11003ed541a RBX: 00000000fffffff4 RCX: 00000000fffffff4 [ 119.479779][ T4979] RDX: ffff88801f3f3e60 RSI: ffffffff8c79ae40 RDI: ffffffff90861ab0 [ 119.484101][ T4979] RBP: ffff88801fb0e008 R08: 0000000000000dc0 R09: 00000000ffffffff [ 119.487662][ T4979] R10: dffffc0000000000 R11: fffffbfff1dd6087 R12: ffff88801f3f3e60 [ 119.491517][ T4979] R13: dffffc0000000000 R14: ffffffff8c79ae40 R15: ffff88801f6aa0d0 [ 119.495901][ T4979] ? drm_fbdev_shmem_helper_fb_dirty+0x260/0x310 [ 119.499179][ T4979] drm_fb_helper_damage_work+0x84c/0xf20 [ 119.501617][ T4979] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 119.504233][ T4979] ? lock_acquire+0x115/0x350 [ 119.506488][ T4979] ? rcu_is_watching+0x16/0xb0 [ 119.509091][ T4979] ? process_scheduled_works+0x97a/0x1630 [ 119.511998][ T4979] process_scheduled_works+0xc3d/0x1630 [ 119.514593][ T4979] ? __pfx_process_scheduled_works+0x10/0x10 [ 119.517136][ T4979] ? assign_work+0x3cf/0x5d0 [ 119.519358][ T4979] worker_thread+0xa47/0xfb0 [ 119.521476][ T4979] kthread+0x38b/0x480 [ 119.523225][ T4979] ? __pfx_worker_thread+0x10/0x10 [ 119.525772][ T4979] ? __pfx_kthread+0x10/0x10 [ 119.528021][ T4979] ret_from_fork+0x514/0xb70 [ 119.530562][ T4979] ? __pfx_ret_from_fork+0x10/0x10 [ 119.532960][ T4979] ? __switch_to+0xc89/0x1420 [ 119.534892][ T4979] ? __pfx_kthread+0x10/0x10 [ 119.536571][ T4979] ret_from_fork_asm+0x1a/0x30 [ 119.538509][ T4979] [ 119.540137][ T4979] Kernel Offset: disabled [ 119.542040][ T4979] Rebooting in 86400 seconds..