program: r0 = openat$panthor(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x20141, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f00000007c0)={0x0}) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r0, 0xc0186445, &(0x7f0000000880)={0x5, 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f00000008c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000900), 0x7fff, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000940)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f0000000980)={&(0x7f00000009c0)=[r6], 0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc03064ca, &(0x7f0000000a40)={&(0x7f0000000280), &(0x7f0000000ac0), 0x2000000056, 0x0, 0x3}) r7 = syz_open_dev$dri(&(0x7f0000000b00), 0x9, 0xc00c1) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r7, 0xc00864bf, &(0x7f0000000b40)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r7, 0xc01864c1, &(0x7f0000000b80)={r8, 0x1, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000bc0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01864c2, &(0x7f0000000c80)={0x0}) r12 = syz_open_dev$dri(&(0x7f0000000cc0), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r12, 0xc03064ca, &(0x7f0000000d40)={&(0x7f0000000d80)=[r2], 0x0, 0x176, 0x3ffffeed, 0x3}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r12, 0xc01064c5, &(0x7f0000000dc0)={&(0x7f0000000e00)=[r13], 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000e40)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01864c2, &(0x7f0000000340)={0x0, 0x1, r9}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000ec0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000f00)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000f40)={0x0}) r19 = syz_open_dev$dri(&(0x7f0000000f80), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r19, 0xc00864bf, &(0x7f0000000fc0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r19, 0xc01864c1, &(0x7f0000001000)={r20}) ioctl$DRM_IOCTL_PANTHOR_VM_BIND(0xffffffffffffffff, 0xc0186443, &(0x7f00000011c0)={0x0, 0x0, {0x30, 0x3, &(0x7f0000001100)=[{0xf0000000, 0x0, 0x80000000, 0x1, 0x1, {0x10, 0x5, &(0x7f0000000800)=[{0x0, 0x0, 0xc1d}, {0x0, 0x0, 0x400}, {0x1, 0x0, 0x1000}, {0x0, 0x0, 0x800}, {0xff, r2, 0x7}]}}, {0x10000000, r3, 0x80000001, 0x100000001, 0x5, {0x10, 0x5, &(0x7f0000000c00)=[{0x0, r4, 0x3}, {0x0, 0x0, 0x9}, {0xff, r8, 0xfccb}, {0x800000ff, 0x0, 0x7}, {0xff, r10}]}}, {0x4, 0x0, 0x4, 0x2, 0x1, {0x10, 0x9, &(0x7f0000001040)=[{0x80000000, r11, 0x3}, {0x1, r13, 0x7}, {0x80000000, r14, 0x6}, {0x80000000, r15, 0xffffffff80000000}, {0x80000000, 0x0, 0x1}, {0x1, r16, 0x7ff}, {0xff, r17, 0x6}, {0x80000000, r18, 0x9}, {0x80000000, r20, 0x3}]}}]}}) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'das16m1\x00', [0x100, 0x80000000, 0x8, 0xd, 0xe, 0x5, 0x7b, 0xffffffff, 0x8000c, 0xfffffffe, 0x2, 0x6, 0xb, 0x1, 0x0, 0x4, 0xfffffffb, 0x1, 0x3, 0x7fffffff, 0x8e, 0x7, 0x7, 0x20001e59, 0x3, 0xf39d, 0x6, 0x40000003, 0xa6b5, 0x2, 0xfffffff8]}) sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="b00000000514080029bd7000fbdbdf25080001000200000008000300040000000800010000000000080003000400000008000100010000000800030001000000080001000000000008000300040000000800010002000000080003000400000008000100020000000800030003000000080001000100000008000300000000008c0001000200000008000300030000000800010001000000080003000300000008000100000000000800030000000000"], 0xb0}, 0x1, 0x0, 0x0, 0x4000}, 0x40880) ioctl$DRM_IOCTL_PANTHOR_VM_GET_STATE(r5, 0xc0086444, &(0x7f0000000300)) [ 94.534554][ T48] Bluetooth: hci0: command tx timeout [ 94.618103][ T5342] ------------[ cut here ]------------ [ 94.618113][ T5342] 1 [ 94.618118][ T5342] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5342 [ 94.626046][ T5342] Modules linked in: [ 94.628125][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.631819][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.636270][ T5342] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 94.638932][ T5342] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 68 5b 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89 [ 94.647810][ T5342] RSP: 0018:ffffc9000e4cfa00 EFLAGS: 00010246 [ 94.650681][ T5342] RAX: 0000000000000000 RBX: 00000000fffffbb4 RCX: 0000000000100000 [ 94.653711][ T5342] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000000fffffbb4 [ 94.657299][ T5342] RBP: 0000000000000cc0 R08: ffffffff85a4fcd9 R09: 0000000000000000 [ 94.660780][ T5342] R10: dffffc0000000000 R11: ffffffff85ae18b0 R12: 1ffff92001c99fb9 [ 94.664284][ T5342] R13: ffffffff85ae149a R14: 00000000fffffbb4 R15: 00000000fffffbb4 [ 94.667709][ T5342] FS: 00007f5cba6dd6c0(0000) GS:ffff88808a9fe000(0000) knlGS:0000000000000000 [ 94.671406][ T5342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.674146][ T5342] CR2: 00007ffff66b2c80 CR3: 000000001f937000 CR4: 0000000000352ef0 [ 94.677621][ T5342] Call Trace: [ 94.678902][ T5342] [ 94.680201][ T5342] __kmalloc_large_node_noprof+0x18/0x90 [ 94.683016][ T5342] __kmalloc_noprof+0x3f6/0x710 [ 94.685222][ T5342] ? drm_syncobj_array_find+0x3a/0x440 [ 94.687666][ T5342] drm_syncobj_array_find+0x3a/0x440 [ 94.690082][ T5342] drm_syncobj_timeline_wait_ioctl+0x18a/0x640 [ 94.692862][ T5342] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 94.695895][ T5342] drm_ioctl_kernel+0x2df/0x3b0 [ 94.698104][ T5342] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 94.701116][ T5342] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 94.703446][ T5342] ? __might_fault+0xaf/0x130 [ 94.705720][ T5342] drm_ioctl+0x70e/0xba0 [ 94.707604][ T5342] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 94.710597][ T5342] ? __pfx_drm_ioctl+0x10/0x10 [ 94.712771][ T5342] ? __fget_files+0x2a/0x420 [ 94.715105][ T5342] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.717387][ T5342] ? __pfx_drm_ioctl+0x10/0x10 [ 94.719898][ T5342] __se_sys_ioctl+0xfc/0x170 [ 94.722323][ T5342] do_syscall_64+0x166/0x520 [ 94.724889][ T5342] ? trace_irq_disable+0x3b/0x140 [ 94.727176][ T5342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.729733][ T5342] ? clear_bhb_loop+0x70/0xc0 [ 94.731555][ T5342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.734096][ T5342] RIP: 0033:0x7f5cb979fb19 [ 94.736209][ T5342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.743844][ T5342] RSP: 002b:00007f5cba6dcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.747562][ T5342] RAX: ffffffffffffffda RBX: 00007f5cb9a25fa0 RCX: 00007f5cb979fb19 [ 94.751108][ T5342] RDX: 0000200000000d40 RSI: 00000000c03064ca RDI: 0000000000000004 [ 94.754429][ T5342] RBP: 00007f5cb9837b70 R08: 0000000000000000 R09: 0000000000000000 [ 94.757796][ T5342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.761057][ T5342] R13: 00007f5cb9a26038 R14: 00007f5cb9a25fa0 R15: 00007fffaf0f4e68 [ 94.764486][ T5342] [ 94.765930][ T5342] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.768855][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.772493][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.776556][ T5342] Call Trace: [ 94.777984][ T5342] [ 94.779308][ T5342] vpanic+0x26f/0x710 [ 94.781196][ T5342] panic+0xc5/0xd0 [ 94.782777][ T5342] ? __pfx_panic+0x10/0x10 [ 94.784596][ T5342] __warn+0x315/0x4c0 [ 94.786316][ T5342] ? ___kmalloc_large_node+0x10c/0x170 [ 94.788486][ T5342] ? ___kmalloc_large_node+0x10c/0x170 [ 94.790724][ T5342] __report_bug+0x276/0x570 [ 94.792459][ T5342] ? kernel_text_address+0xa5/0xe0 [ 94.794371][ T5342] ? ___kmalloc_large_node+0x10c/0x170 [ 94.796419][ T5342] ? __pfx___report_bug+0x10/0x10 [ 94.798443][ T5342] ? stack_trace_save+0xa9/0x100 [ 94.800409][ T5342] ? __pfx_stack_trace_save+0x10/0x10 [ 94.802603][ T5342] ? kasan_save_track+0x4f/0x80 [ 94.804686][ T5342] ? ___kmalloc_large_node+0x10c/0x170 [ 94.807019][ T5342] report_bug+0x16b/0x220 [ 94.808796][ T5342] ? ___kmalloc_large_node+0x10c/0x170 [ 94.811231][ T5342] ? ___kmalloc_large_node+0x10e/0x170 [ 94.813286][ T5342] handle_bug+0x9c/0x200 [ 94.814930][ T5342] exc_invalid_op+0x1a/0x50 [ 94.816980][ T5342] asm_exc_invalid_op+0x1a/0x20 [ 94.819053][ T5342] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 94.821629][ T5342] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 68 5b 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89 [ 94.829981][ T5342] RSP: 0018:ffffc9000e4cfa00 EFLAGS: 00010246 [ 94.832605][ T5342] RAX: 0000000000000000 RBX: 00000000fffffbb4 RCX: 0000000000100000 [ 94.836138][ T5342] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000000fffffbb4 [ 94.839671][ T5342] RBP: 0000000000000cc0 R08: ffffffff85a4fcd9 R09: 0000000000000000 [ 94.843197][ T5342] R10: dffffc0000000000 R11: ffffffff85ae18b0 R12: 1ffff92001c99fb9 [ 94.846713][ T5342] R13: ffffffff85ae149a R14: 00000000fffffbb4 R15: 00000000fffffbb4 [ 94.849988][ T5342] ? drm_syncobj_array_find+0x3a/0x440 [ 94.852465][ T5342] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 94.855398][ T5342] ? drm_dev_enter+0x49/0x150 [ 94.857396][ T5342] __kmalloc_large_node_noprof+0x18/0x90 [ 94.859808][ T5342] __kmalloc_noprof+0x3f6/0x710 [ 94.861948][ T5342] ? drm_syncobj_array_find+0x3a/0x440 [ 94.864340][ T5342] drm_syncobj_array_find+0x3a/0x440 [ 94.866728][ T5342] drm_syncobj_timeline_wait_ioctl+0x18a/0x640 [ 94.869530][ T5342] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 94.872548][ T5342] drm_ioctl_kernel+0x2df/0x3b0 [ 94.874744][ T5342] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 94.877674][ T5342] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 94.880041][ T5342] ? __might_fault+0xaf/0x130 [ 94.882178][ T5342] drm_ioctl+0x70e/0xba0 [ 94.884093][ T5342] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 94.887079][ T5342] ? __pfx_drm_ioctl+0x10/0x10 [ 94.889275][ T5342] ? __fget_files+0x2a/0x420 [ 94.891402][ T5342] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.893592][ T5342] ? __pfx_drm_ioctl+0x10/0x10 [ 94.895730][ T5342] __se_sys_ioctl+0xfc/0x170 [ 94.897778][ T5342] do_syscall_64+0x166/0x520 [ 94.899894][ T5342] ? trace_irq_disable+0x3b/0x140 [ 94.902118][ T5342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.904787][ T5342] ? clear_bhb_loop+0x70/0xc0 [ 94.906881][ T5342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.909588][ T5342] RIP: 0033:0x7f5cb979fb19 [ 94.911576][ T5342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.919817][ T5342] RSP: 002b:00007f5cba6dcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.923522][ T5342] RAX: ffffffffffffffda RBX: 00007f5cb9a25fa0 RCX: 00007f5cb979fb19 [ 94.927034][ T5342] RDX: 0000200000000d40 RSI: 00000000c03064ca RDI: 0000000000000004 [ 94.930512][ T5342] RBP: 00007f5cb9837b70 R08: 0000000000000000 R09: 0000000000000000 [ 94.934026][ T5342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.937467][ T5342] R13: 00007f5cb9a26038 R14: 00007f5cb9a25fa0 R15: 00007fffaf0f4e68 [ 94.941051][ T5342] [ 94.942917][ T5342] Kernel Offset: disabled [ 94.944792][ T5342] Rebooting in 86400 seconds..