program: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) (async) mkdir(&(0x7f0000000080)='./sys\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) r2 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) close(r2) (async, rerun: 64) r3 = syz_open_dev$dri(&(0x7f00000001c0), 0x1ff, 0x0) (rerun: 64) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async, rerun: 32) r5 = syz_open_dev$dri(&(0x7f00000005c0), 0x1, 0x8000) (rerun: 32) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000600)={0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r5, 0xc06864a1, &(0x7f0000000680)={0x0, 0x0, r6, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB(r5, 0xc01c64ad, &(0x7f0000000700)={r7}) (async) ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f0000000280)={0x0, 0x0, r4, r7, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x3, 0x80, 0x0, 0x0, 0x6, 0x0, 0x6, 0x0, 0xfffffffe, 0x0, 0xfffffffe, "65366a50432b7ee2c7feddd91df868e7cfc6fa7272f3bf0a71b5d0c19323a260"}}) write(r1, &(0x7f0000000340)='1', 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x13, r0, 0x0) (async) r8 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r8, 0x65, 0x7, &(0x7f0000000040)=0x44, 0x4) r9 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r9, &(0x7f0000000300)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000026c0)='./debug\x00', 0x1ff) (async, rerun: 32) mount(0x0, &(0x7f0000002700)='./debug\x00', &(0x7f0000002780)='debugfs\x00', 0x0, 0x0) (rerun: 32) openat(0xffffffffffffff9c, &(0x7f00000027c0)='./debug/netdevsim/netdevsim0/health/break_health\x00', 0x1, 0x0) (async) write(r8, &(0x7f0000002800)='br', 0xfffffffffffffdfc) (async, rerun: 32) r10 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r10) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_INTERFACE(r10, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x1c, r11, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r13}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4840}, 0x24008814) (async) sendmsg$NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, r11, 0x10, 0x70bd27, 0x25dfdbfe, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044850}, 0x20040894) [ 94.676536][ T4642] Bluetooth: hci0: command tx timeout [ 94.883678][ T5318] Console: switching to colour dummy device 80x25 [ 95.153673][ T5316] ------------[ cut here ]------------ [ 95.153685][ T5316] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 95.153691][ T5316] WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e2/0x1550, CPU#0: syz.0.0/5316 [ 95.162719][ T5316] Modules linked in: [ 95.164712][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.168667][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.173544][ T5316] RIP: 0010:__mutex_lock+0x12e9/0x1550 [ 95.176184][ T5316] Code: c8 7a 91 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d ab 86 8e 05 00 75 13 48 8d 3d 9e 83 91 05 48 c7 c6 a0 12 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f [ 95.185036][ T5316] RSP: 0018:ffffc9000ee2f7e0 EFLAGS: 00010246 [ 95.187948][ T5316] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888000242580 [ 95.191138][ T5316] RDX: 0000000000000000 RSI: ffffffff8c0d12a0 RDI: ffffffff917dc580 [ 95.194935][ T5316] RBP: ffffc9000ee2f980 R08: ffffffff917ac883 R09: 1ffffffff22f5910 [ 95.198391][ T5316] R10: dffffc0000000000 R11: fffffbfff22f5911 R12: ffff8880362551c0 [ 95.202369][ T5316] R13: 0000000000000000 R14: 1ffff92001dc5f10 R15: 0000000000000000 [ 95.205864][ T5316] FS: 0000000000000000(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 95.209572][ T5316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.213042][ T5316] CR2: 000055771ee8b8d8 CR3: 000000004da20000 CR4: 0000000000352ef0 [ 95.216712][ T5316] Call Trace: [ 95.218138][ T5316] [ 95.219479][ T5316] ? drm_gem_object_handle_put_unlocked+0x1b0/0x410 [ 95.223269][ T5316] ? virtio_gpu_free_object+0x90/0x1d0 [ 95.225764][ T5316] ? __mutex_unlock_slowpath+0x731/0x900 [ 95.228305][ T5316] ? __pfx___mutex_lock+0x10/0x10 [ 95.230691][ T5316] ? preempt_schedule_thunk+0x16/0x40 [ 95.233290][ T5316] ? preempt_schedule_common+0x7f/0xd0 [ 95.235571][ T5316] virtio_gpu_free_object+0x90/0x1d0 [ 95.237850][ T5316] drm_gem_object_release_handle+0xc2/0x220 [ 95.240373][ T5316] idr_for_each+0x1c6/0x2a0 [ 95.242581][ T5316] ? __pfx_drm_gem_object_release_handle+0x10/0x10 [ 95.245263][ T5316] ? __pfx_idr_for_each+0x10/0x10 [ 95.247415][ T5316] drm_gem_release+0x28/0x40 [ 95.249392][ T5316] drm_file_free+0x780/0xa90 [ 95.251594][ T5316] drm_release+0x2f0/0x400 [ 95.253424][ T5316] ? __pfx_drm_release+0x10/0x10 [ 95.255618][ T5316] __fput+0x40d/0xa50 [ 95.257451][ T5316] task_work_run+0x1d9/0x270 [ 95.259546][ T5316] ? __pfx_task_work_run+0x10/0x10 [ 95.262670][ T5316] ? do_raw_spin_unlock+0x4d/0x200 [ 95.264957][ T5316] do_exit+0x73a/0x2360 [ 95.266848][ T5316] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.269158][ T5316] ? __pfx_do_exit+0x10/0x10 [ 95.271731][ T5316] ? preempt_schedule_thunk+0x16/0x40 [ 95.274134][ T5316] ? preempt_schedule_thunk+0x16/0x40 [ 95.276439][ T5316] do_group_exit+0x22d/0x2f0 [ 95.278564][ T5316] __x64_sys_exit_group+0x3f/0x40 [ 95.280798][ T5316] x64_sys_call+0x18c6/0x18d0 [ 95.283165][ T5316] do_syscall_64+0x166/0x520 [ 95.285212][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.287906][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 95.290074][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.292863][ T5316] RIP: 0033:0x7f9f5a59e559 [ 95.294771][ T5316] Code: Unable to access opcode bytes at 0x7f9f5a59e52f. [ 95.297725][ T5316] RSP: 002b:00007ffc74d06868 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 95.301758][ T5316] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9f5a59e559 [ 95.305050][ T5316] RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 [ 95.308418][ T5316] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f9f5a7ef3e0 [ 95.312144][ T5316] R10: 00007f9f5a826128 R11: 0000000000000246 R12: 0000000000000000 [ 95.315394][ T5316] R13: 00007f9f5a7ef3e0 R14: 0000000000000003 R15: 00007ffc74d06920 [ 95.318810][ T5316] [ 95.320196][ T5316] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.323275][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.327100][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.331458][ T5316] Call Trace: [ 95.332930][ T5316] [ 95.334189][ T5316] vpanic+0x56d/0xa60 [ 95.335959][ T5316] ? __pfx__printk+0x10/0x10 [ 95.338035][ T5316] ? __pfx_vpanic+0x10/0x10 [ 95.340065][ T5316] ? is_bpf_text_address+0x292/0x2b0 [ 95.342399][ T5316] ? is_bpf_text_address+0x26/0x2b0 [ 95.344689][ T5316] panic+0xc5/0xd0 [ 95.346338][ T5316] ? __pfx_panic+0x10/0x10 [ 95.348309][ T5316] __warn+0x315/0x4c0 [ 95.350085][ T5316] ? __mutex_lock+0x12e2/0x1550 [ 95.352267][ T5316] ? __mutex_lock+0x12e2/0x1550 [ 95.354052][ T5316] __report_bug+0x276/0x570 [ 95.355763][ T5316] ? __mutex_lock+0x12e2/0x1550 [ 95.357794][ T5316] ? __pfx___report_bug+0x10/0x10 [ 95.360073][ T5316] report_bug_entry+0x19b/0x290 [ 95.362264][ T5316] ? __mutex_lock+0x12e9/0x1550 [ 95.364496][ T5316] ? __mutex_lock+0x12ee/0x1550 [ 95.366694][ T5316] handle_bug+0xce/0x200 [ 95.368547][ T5316] exc_invalid_op+0x1a/0x50 [ 95.370587][ T5316] asm_exc_invalid_op+0x1a/0x20 [ 95.372713][ T5316] RIP: 0010:__mutex_lock+0x12e9/0x1550 [ 95.375199][ T5316] Code: c8 7a 91 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d ab 86 8e 05 00 75 13 48 8d 3d 9e 83 91 05 48 c7 c6 a0 12 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f [ 95.383704][ T5316] RSP: 0018:ffffc9000ee2f7e0 EFLAGS: 00010246 [ 95.386478][ T5316] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888000242580 [ 95.389910][ T5316] RDX: 0000000000000000 RSI: ffffffff8c0d12a0 RDI: ffffffff917dc580 [ 95.393393][ T5316] RBP: ffffc9000ee2f980 R08: ffffffff917ac883 R09: 1ffffffff22f5910 [ 95.396747][ T5316] R10: dffffc0000000000 R11: fffffbfff22f5911 R12: ffff8880362551c0 [ 95.400142][ T5316] R13: 0000000000000000 R14: 1ffff92001dc5f10 R15: 0000000000000000 [ 95.403569][ T5316] ? drm_gem_object_handle_put_unlocked+0x1b0/0x410 [ 95.406438][ T5316] ? virtio_gpu_free_object+0x90/0x1d0 [ 95.408833][ T5316] ? __mutex_unlock_slowpath+0x731/0x900 [ 95.411320][ T5316] ? __pfx___mutex_lock+0x10/0x10 [ 95.413530][ T5316] ? preempt_schedule_thunk+0x16/0x40 [ 95.415895][ T5316] ? preempt_schedule_common+0x7f/0xd0 [ 95.418215][ T5316] virtio_gpu_free_object+0x90/0x1d0 [ 95.420538][ T5316] drm_gem_object_release_handle+0xc2/0x220 [ 95.423167][ T5316] idr_for_each+0x1c6/0x2a0 [ 95.425162][ T5316] ? __pfx_drm_gem_object_release_handle+0x10/0x10 [ 95.428092][ T5316] ? __pfx_idr_for_each+0x10/0x10 [ 95.430406][ T5316] drm_gem_release+0x28/0x40 [ 95.432530][ T5316] drm_file_free+0x780/0xa90 [ 95.434605][ T5316] drm_release+0x2f0/0x400 [ 95.436579][ T5316] ? __pfx_drm_release+0x10/0x10 [ 95.438811][ T5316] __fput+0x40d/0xa50 [ 95.440670][ T5316] task_work_run+0x1d9/0x270 [ 95.442717][ T5316] ? __pfx_task_work_run+0x10/0x10 [ 95.444827][ T5316] ? do_raw_spin_unlock+0x4d/0x200 [ 95.446856][ T5316] do_exit+0x73a/0x2360 [ 95.448643][ T5316] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.450766][ T5316] ? __pfx_do_exit+0x10/0x10 [ 95.452622][ T5316] ? preempt_schedule_thunk+0x16/0x40 [ 95.454678][ T5316] ? preempt_schedule_thunk+0x16/0x40 [ 95.456820][ T5316] do_group_exit+0x22d/0x2f0 [ 95.458620][ T5316] __x64_sys_exit_group+0x3f/0x40 [ 95.460578][ T5316] x64_sys_call+0x18c6/0x18d0 [ 95.462519][ T5316] do_syscall_64+0x166/0x520 [ 95.464575][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.467326][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 95.469408][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.472022][ T5316] RIP: 0033:0x7f9f5a59e559 [ 95.474018][ T5316] Code: Unable to access opcode bytes at 0x7f9f5a59e52f. [ 95.476903][ T5316] RSP: 002b:00007ffc74d06868 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 95.480408][ T5316] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9f5a59e559 [ 95.483773][ T5316] RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 [ 95.487209][ T5316] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f9f5a7ef3e0 [ 95.490706][ T5316] R10: 00007f9f5a826128 R11: 0000000000000246 R12: 0000000000000000 [ 95.494026][ T5316] R13: 00007f9f5a7ef3e0 R14: 0000000000000003 R15: 00007ffc74d06920 [ 95.497187][ T5316] [ 95.499043][ T5316] Kernel Offset: disabled [ 95.501012][ T5316] Rebooting in 86400 seconds..