program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
syz_usb_connect(0x6, 0x371, 0x0, 0x0)
mkdir(&(0x7f0000000540)='./sys\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0)
ioctl$OCFS2_IOC_GROUP_EXTEND(r0, 0x5220, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c)
listen(r1, 0xfff)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0103000000000000fbff000000000900010073797a300000000040000000030a01020000010000ec08000300737900000000000014000480080600000000000000000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a300000000028000480245701800b000100736f636b65746d0014000280080001400000000208e0014000000017140000001100010000000000000000000000000a"], 0xd8}, 0x1, 0x0, 0x0, 0x50}, 0x4000040)
syz_emit_ethernet(0x4a, &(0x7f0000006340)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd608a35f200140600fe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="153e000090780000"], 0x0)
syz_clone(0x80000, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001280))
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_CAP_X2APIC_API(r4, 0x4068aea3, &(0x7f0000000000)={0x81, 0x0, 0x3})
ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x4000, 0x9, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x2, 0x87, '\x00', 0x8}, {0xf2, 0x8, 0x2, '\x00', 0xa}, {0xfe, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf7, '\x00', 0xf}, {0x9, 0x89, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x1, 0x4, 0x1, '\x00', 0x8}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x18, '\x00', 0xa}, {0xfd, 0x28, 0xf2, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x2}, {0xfe, 0x3, 0x26}, {0xcf, 0xfa, 0xb, '\x00', 0x5}, {0xf, 0x6, 0x5, '\x00', 0x10}, {0x39, 0x2, 0x6, '\x00', 0x8}, {0x9, 0x6, 0xfe, '\x00', 0x8}, {0x4d, 0x7, 0x5, '\x00', 0xc}, {0x7, 0x34, 0x63}, {0x0, 0x80, 0x1, '\x00', 0x81}, {0x75, 0x7f, 0x80, '\x00', 0x7f}, {0x10, 0x23, 0x0, '\x00', 0x1}, {0x1, 0x7, 0xf3, '\x00', 0x4}, {0x7, 0x8, 0x4, '\x00', 0x8}]}})
r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc})
ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r5, 0x3ba0, &(0x7f0000000a40)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1000})
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0)
write(r6, &(0x7f00000000c0)='1', 0x1)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r7, &(0x7f00000001c0)='1', 0x1)
[ 102.194550][ T5288] Bluetooth: hci0: command tx timeout
[ 102.346672][ T5328] netlink: 44 bytes leftover after parsing attributes in process `syz.0.0'.
[ 102.504479][ T5327] Console: switching to colour dummy device 80x25
[ 102.606392][ T5327] =============================================================================
[ 102.606423][ T5327] BUG virtio-gpu-vbufs (Not tainted): Objects remaining on __kmem_cache_shutdown()
[ 102.606434][ T5327] -----------------------------------------------------------------------------
[ 102.606434][ T5327]
[ 102.607098][ T5327] Object 0xffff88801fbb9460 @offset=1120
[ 102.607113][ T5327] Object 0xffff88801fbb9578 @offset=1400
[ 102.607121][ T5327] Object 0xffff88801fbb9690 @offset=1680
[ 102.607128][ T5327] Slab 0xffffea00007eee40 objects=14 used=3 fp=0xffff88801fbb97a8 flags=0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 102.607145][ T5327] Disabling lock debugging due to kernel taint
[ 102.607303][ T5327] ------------[ cut here ]------------
[ 102.607309][ T5327] 1
[ 102.607313][ T5327] WARNING: mm/slub.c:1268 at __slab_err+0x15/0x20, CPU#0: syz.0.0/5327
[ 102.641376][ T5327] Modules linked in:
[ 102.643082][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Tainted: G B syzkaller #0 PREEMPT(full)
[ 102.647612][ T5327] Tainted: [B]=BAD_PAGE
[ 102.649746][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.654976][ T5327] RIP: 0010:__slab_err+0x15/0x20
[ 102.657607][ T5327] Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 2b 00 00 00 bf 05 00 00 00 be 01 00 00 00 e8 4c 0c 5f 00 90 <0f> 0b 90 e9 83 bb c0 0a cc 66 90 90 90 90 90 90 90 90 90 90 90 90
[ 102.665606][ T5327] RSP: 0018:ffffc9000f40f6d8 EFLAGS: 00010087
[ 102.668461][ T5327] RAX: ffffffff818749fa RBX: ffff888034e01140 RCX: 0000000000100000
[ 102.672042][ T5327] RDX: ffffc9000ea92000 RSI: 0000000000011073 RDI: 0000000000011074
[ 102.675730][ T5327] RBP: ffffc9000f40f6f0 R08: ffffffff939980a7 R09: 1ffffffff2733014
[ 102.679381][ T5327] R10: dffffc0000000000 R11: fffffbfff2733015 R12: ffffea000002e950
[ 102.682545][ T5327] R13: ffffea00007eee40 R14: ffffc9000f40f6f0 R15: ffff88801c2b1000
[ 102.685657][ T5327] FS: 00007fd2c0b116c0(0000) GS:ffff88808c2cf000(0000) knlGS:0000000000000000
[ 102.689317][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 102.691967][ T5327] CR2: 00007fba3f7909c0 CR3: 000000001324e000 CR4: 0000000000352ef0
[ 102.695367][ T5327] Call Trace:
[ 102.697040][ T5327]
[ 102.698317][ T5327] __kmem_cache_shutdown+0x1a5/0x2b0
[ 102.700543][ T5327] ? virtio_gpu_free_vbufs+0x40/0x70
[ 102.702722][ T5327] kmem_cache_destroy+0x9d/0x180
[ 102.704778][ T5327] virtio_gpu_free_vbufs+0x40/0x70
[ 102.706854][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 102.709344][ T5327] virtio_gpu_release+0x55/0x140
[ 102.711357][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 102.713635][ T5327] drm_dev_put+0xa9/0x120
[ 102.715428][ T5327] virtio_dev_remove+0x9c/0x1b0
[ 102.717578][ T5327] ? __pfx_virtio_dev_remove+0x10/0x10
[ 102.719805][ T5327] device_release_driver_internal+0x48b/0x880
[ 102.722429][ T5327] bus_remove_device+0x444/0x560
[ 102.724650][ T5327] ? __pfx_bus_remove_device+0x10/0x10
[ 102.726985][ T5327] ? kernfs_remove_by_name_ns+0x101/0x140
[ 102.729396][ T5327] device_del+0x524/0x8f0
[ 102.731316][ T5327] ? __pfx_device_del+0x10/0x10
[ 102.733453][ T5327] device_unregister+0x21/0xf0
[ 102.735514][ T5327] unregister_virtio_device+0x37/0x60
[ 102.737831][ T5327] virtio_pci_remove+0x7f/0xf0
[ 102.739883][ T5327] pci_device_remove+0x99/0x1c0
[ 102.742013][ T5327] ? __pfx_pci_device_remove+0x10/0x10
[ 102.744366][ T5327] device_release_driver_internal+0x48b/0x880
[ 102.746955][ T5327] pci_stop_bus_device+0xf6/0x120
[ 102.749181][ T5327] pci_stop_and_remove_bus_device_locked+0x77/0xb0
[ 102.751935][ T5327] remove_store+0xe5/0x150
[ 102.753866][ T5327] ? __pfx_remove_store+0x10/0x10
[ 102.756106][ T5327] ? sysfs_file_kobj+0x1e4/0x230
[ 102.758224][ T5327] ? sysfs_kf_write+0x166/0x260
[ 102.760310][ T5327] ? __pfx_sysfs_kf_write+0x10/0x10
[ 102.762537][ T5327] kernfs_fop_write_iter+0x3a4/0x540
[ 102.764903][ T5327] vfs_write+0x612/0xba0
[ 102.766750][ T5327] ? __pfx_vfs_write+0x10/0x10
[ 102.768812][ T5327] ? __fget_files+0x2a/0x420
[ 102.770779][ T5327] ksys_write+0x150/0x270
[ 102.772627][ T5327] ? __pfx_ksys_write+0x10/0x10
[ 102.774737][ T5327] do_syscall_64+0x166/0x520
[ 102.776774][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.779403][ T5327] ? clear_bhb_loop+0x70/0xc0
[ 102.781423][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.783919][ T5327] RIP: 0033:0x7fd2bfb9e159
[ 102.785951][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.794136][ T5327] RSP: 002b:00007fd2c0b10fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.797742][ T5327] RAX: ffffffffffffffda RBX: 00007fd2bfe25fa0 RCX: 00007fd2bfb9e159
[ 102.801255][ T5327] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000a
[ 102.804628][ T5327] RBP: 00007fd2bfc35024 R08: 0000000000000000 R09: 0000000000000000
[ 102.808003][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.811332][ T5327] R13: 00007fd2bfe26038 R14: 00007fd2bfe25fa0 R15: 00007fffc8b1b948
[ 102.814838][ T5327]
[ 102.816246][ T5327] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 102.819332][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Tainted: G B syzkaller #0 PREEMPT(full)
[ 102.823805][ T5327] Tainted: [B]=BAD_PAGE
[ 102.825665][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.829908][ T5327] Call Trace:
[ 102.831324][ T5327]
[ 102.832631][ T5327] vpanic+0x56d/0xa60
[ 102.834469][ T5327] ? __pfx__printk+0x10/0x10
[ 102.836504][ T5327] ? __pfx_vpanic+0x10/0x10
[ 102.838419][ T5327] ? is_bpf_text_address+0x292/0x2b0
[ 102.840708][ T5327] ? is_bpf_text_address+0x26/0x2b0
[ 102.842868][ T5327] panic+0xc5/0xd0
[ 102.844435][ T5327] ? __pfx_panic+0x10/0x10
[ 102.846297][ T5327] __warn+0x315/0x4c0
[ 102.847954][ T5327] ? __slab_err+0x15/0x20
[ 102.849763][ T5327] ? __slab_err+0x15/0x20
[ 102.851505][ T5327] __report_bug+0x276/0x570
[ 102.853375][ T5327] ? rcu_is_watching+0x16/0xb0
[ 102.855446][ T5327] ? __slab_err+0x15/0x20
[ 102.857313][ T5327] ? __pfx___report_bug+0x10/0x10
[ 102.859477][ T5327] ? __wake_up_klogd+0xf0/0x130
[ 102.861684][ T5327] ? vprintk_emit+0x4ee/0x560
[ 102.863830][ T5327] ? __wake_up_klogd+0xf0/0x130
[ 102.866006][ T5327] ? __pfx_vprintk_emit+0x10/0x10
[ 102.868257][ T5327] ? __pfx_vprintk_emit+0x10/0x10
[ 102.870497][ T5327] ? __slab_err+0x15/0x20
[ 102.872451][ T5327] report_bug+0x16b/0x220
[ 102.874419][ T5327] ? __slab_err+0x15/0x20
[ 102.876395][ T5327] ? __slab_err+0x17/0x20
[ 102.878323][ T5327] handle_bug+0x9c/0x200
[ 102.880166][ T5327] exc_invalid_op+0x1a/0x50
[ 102.882083][ T5327] asm_exc_invalid_op+0x1a/0x20
[ 102.884199][ T5327] RIP: 0010:__slab_err+0x15/0x20
[ 102.886295][ T5327] Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 2b 00 00 00 bf 05 00 00 00 be 01 00 00 00 e8 4c 0c 5f 00 90 <0f> 0b 90 e9 83 bb c0 0a cc 66 90 90 90 90 90 90 90 90 90 90 90 90
[ 102.894632][ T5327] RSP: 0018:ffffc9000f40f6d8 EFLAGS: 00010087
[ 102.897277][ T5327] RAX: ffffffff818749fa RBX: ffff888034e01140 RCX: 0000000000100000
[ 102.900686][ T5327] RDX: ffffc9000ea92000 RSI: 0000000000011073 RDI: 0000000000011074
[ 102.904244][ T5327] RBP: ffffc9000f40f6f0 R08: ffffffff939980a7 R09: 1ffffffff2733014
[ 102.907692][ T5327] R10: dffffc0000000000 R11: fffffbfff2733015 R12: ffffea000002e950
[ 102.911209][ T5327] R13: ffffea00007eee40 R14: ffffc9000f40f6f0 R15: ffff88801c2b1000
[ 102.914699][ T5327] ? add_taint+0x9a/0xe0
[ 102.916644][ T5327] ? __slab_err+0x14/0x20
[ 102.918730][ T5327] __kmem_cache_shutdown+0x1a5/0x2b0
[ 102.921010][ T5327] ? virtio_gpu_free_vbufs+0x40/0x70
[ 102.923325][ T5327] kmem_cache_destroy+0x9d/0x180
[ 102.925688][ T5327] virtio_gpu_free_vbufs+0x40/0x70
[ 102.927887][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 102.930295][ T5327] virtio_gpu_release+0x55/0x140
[ 102.932340][ T5327] ? __pfx_virtio_gpu_release+0x10/0x10
[ 102.935126][ T5327] drm_dev_put+0xa9/0x120
[ 102.936918][ T5327] virtio_dev_remove+0x9c/0x1b0
[ 102.938983][ T5327] ? __pfx_virtio_dev_remove+0x10/0x10
[ 102.941187][ T5327] device_release_driver_internal+0x48b/0x880
[ 102.943589][ T5327] bus_remove_device+0x444/0x560
[ 102.945879][ T5327] ? __pfx_bus_remove_device+0x10/0x10
[ 102.948229][ T5327] ? kernfs_remove_by_name_ns+0x101/0x140
[ 102.950728][ T5327] device_del+0x524/0x8f0
[ 102.952666][ T5327] ? __pfx_device_del+0x10/0x10
[ 102.954897][ T5327] device_unregister+0x21/0xf0
[ 102.956969][ T5327] unregister_virtio_device+0x37/0x60
[ 102.959230][ T5327] virtio_pci_remove+0x7f/0xf0
[ 102.961268][ T5327] pci_device_remove+0x99/0x1c0
[ 102.963320][ T5327] ? __pfx_pci_device_remove+0x10/0x10
[ 102.965640][ T5327] device_release_driver_internal+0x48b/0x880
[ 102.968254][ T5327] pci_stop_bus_device+0xf6/0x120
[ 102.970444][ T5327] pci_stop_and_remove_bus_device_locked+0x77/0xb0
[ 102.973213][ T5327] remove_store+0xe5/0x150
[ 102.975179][ T5327] ? __pfx_remove_store+0x10/0x10
[ 102.977352][ T5327] ? sysfs_file_kobj+0x1e4/0x230
[ 102.979552][ T5327] ? sysfs_kf_write+0x166/0x260
[ 102.985276][ T5327] ? __pfx_sysfs_kf_write+0x10/0x10
[ 102.987623][ T5327] kernfs_fop_write_iter+0x3a4/0x540
[ 102.990070][ T5327] vfs_write+0x612/0xba0
[ 102.992015][ T5327] ? __pfx_vfs_write+0x10/0x10
[ 102.994304][ T5327] ? __fget_files+0x2a/0x420
[ 102.996439][ T5327] ksys_write+0x150/0x270
[ 102.998265][ T5327] ? __pfx_ksys_write+0x10/0x10
[ 103.000427][ T5327] do_syscall_64+0x166/0x520
[ 103.002480][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.005300][ T5327] ? clear_bhb_loop+0x70/0xc0
[ 103.007293][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.009892][ T5327] RIP: 0033:0x7fd2bfb9e159
[ 103.013301][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.022135][ T5327] RSP: 002b:00007fd2c0b10fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 103.025926][ T5327] RAX: ffffffffffffffda RBX: 00007fd2bfe25fa0 RCX: 00007fd2bfb9e159
[ 103.029324][ T5327] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000a
[ 103.032740][ T5327] RBP: 00007fd2bfc35024 R08: 0000000000000000 R09: 0000000000000000
[ 103.036282][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.039681][ T5327] R13: 00007fd2bfe26038 R14: 00007fd2bfe25fa0 R15: 00007fffc8b1b948
[ 103.043127][ T5327]
[ 103.044966][ T5327] Kernel Offset: disabled
[ 103.046890][ T5327] Rebooting in 86400 seconds..