program:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x121142)
ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc04464b8, 0x0)
mount(&(0x7f0000000040)=@sg0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='devpts\x00', 0x0, &(0x7f0000000140)='%^\x00')
ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffe89})
[ 102.640811][ T5303] Bluetooth: hci0: command tx timeout
[ 102.752328][ T5357] ------------[ cut here ]------------
[ 102.752340][ T5357] 1
[ 102.752344][ T5357] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5357
[ 102.760058][ T5357] Modules linked in:
[ 102.761952][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.765858][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.770331][ T5357] RIP: 0010:___kmalloc_large_node+0x10c/0x170
[ 102.773292][ T5357] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 0c ad 0b 00 c6 05 52 cf 50 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 12 fc ca 09 cc 89 ef 89
[ 102.781697][ T5357] RSP: 0018:ffffc9000ed7fa78 EFLAGS: 00010246
[ 102.784352][ T5357] RAX: 0000000000000000 RBX: 00000003fffffa24 RCX: 0000000000100000
[ 102.788463][ T5357] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000003fffffa24
[ 102.792970][ T5357] RBP: 0000000000000cc0 R08: ffffffff859dfec9 R09: 0000000000000000
[ 102.796604][ T5357] R10: dffffc0000000000 R11: ffffffff85a71a70 R12: ffffffff8cb6d8a8
[ 102.800217][ T5357] R13: ffffffff85a6ff4a R14: 00000003fffffa24 R15: 00000003fffffa24
[ 102.803595][ T5357] FS: 00007f9bbcac26c0(0000) GS:ffff88808ac41000(0000) knlGS:0000000000000000
[ 102.807555][ T5357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 102.811483][ T5357] CR2: 0000200000001000 CR3: 000000000c0ad000 CR4: 0000000000352ef0
[ 102.815090][ T5357] Call Trace:
[ 102.816615][ T5357]
[ 102.818053][ T5357] __kmalloc_large_node_noprof+0x18/0x90
[ 102.820448][ T5357] __kmalloc_noprof+0x3f6/0x710
[ 102.822479][ T5357] ? drm_syncobj_array_find+0x3a/0x440
[ 102.825002][ T5357] ? lock_acquire+0x115/0x350
[ 102.827164][ T5357] drm_syncobj_array_find+0x3a/0x440
[ 102.829558][ T5357] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0
[ 102.832310][ T5357] drm_ioctl_kernel+0x2df/0x3b0
[ 102.834347][ T5357] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10
[ 102.837402][ T5357] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 102.840034][ T5357] drm_ioctl+0x70e/0xba0
[ 102.842020][ T5357] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10
[ 102.845037][ T5357] ? __pfx_drm_ioctl+0x10/0x10
[ 102.846979][ T5357] ? __fget_files+0x2a/0x420
[ 102.849207][ T5357] ? bpf_lsm_file_ioctl+0x9/0x20
[ 102.851386][ T5357] ? __pfx_drm_ioctl+0x10/0x10
[ 102.853593][ T5357] __se_sys_ioctl+0xfc/0x170
[ 102.855685][ T5357] do_syscall_64+0x166/0x520
[ 102.857749][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.860623][ T5357] ? clear_bhb_loop+0x70/0xc0
[ 102.862697][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.865314][ T5357] RIP: 0033:0x7f9bbbb9f559
[ 102.867296][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.876150][ T5357] RSP: 002b:00007f9bbcac1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 102.880174][ T5357] RAX: ffffffffffffffda RBX: 00007f9bbbe25fa0 RCX: 00007f9bbbb9f559
[ 102.883678][ T5357] RDX: 0000200000000080 RSI: 00000000c01864cd RDI: 0000000000000003
[ 102.886910][ T5357] RBP: 00007f9bbbc36b20 R08: 0000000000000000 R09: 0000000000000000
[ 102.891868][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.895205][ T5357] R13: 00007f9bbbe26038 R14: 00007f9bbbe25fa0 R15: 00007ffdae0c4a28
[ 102.899038][ T5357]
[ 102.900292][ T5357] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 102.902838][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.906385][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.910313][ T5357] Call Trace:
[ 102.911681][ T5357]
[ 102.912892][ T5357] vpanic+0x56d/0xa60
[ 102.914721][ T5357] ? __pfx__printk+0x10/0x10
[ 102.916845][ T5357] ? __pfx_vpanic+0x10/0x10
[ 102.918825][ T5357] ? is_bpf_text_address+0x292/0x2b0
[ 102.921074][ T5357] ? is_bpf_text_address+0x26/0x2b0
[ 102.923431][ T5357] panic+0xc5/0xd0
[ 102.925072][ T5357] ? __pfx_panic+0x10/0x10
[ 102.926988][ T5357] __warn+0x315/0x4c0
[ 102.928729][ T5357] ? ___kmalloc_large_node+0x10c/0x170
[ 102.931089][ T5357] ? ___kmalloc_large_node+0x10c/0x170
[ 102.933406][ T5357] __report_bug+0x276/0x570
[ 102.935369][ T5357] ? ___kmalloc_large_node+0x10c/0x170
[ 102.937771][ T5357] ? __pfx___report_bug+0x10/0x10
[ 102.940003][ T5357] ? stack_trace_save+0xa9/0x100
[ 102.942140][ T5357] ? __pfx_stack_trace_save+0x10/0x10
[ 102.944504][ T5357] ? kasan_save_track+0x4f/0x80
[ 102.946616][ T5357] ? stack_depot_save_flags+0x33/0x7f0
[ 102.948885][ T5357] ? __lock_acquire+0x747/0x2de0
[ 102.951124][ T5357] ? ___kmalloc_large_node+0x10c/0x170
[ 102.953539][ T5357] report_bug+0x16b/0x220
[ 102.955428][ T5357] ? ___kmalloc_large_node+0x10c/0x170
[ 102.957859][ T5357] ? ___kmalloc_large_node+0x10e/0x170
[ 102.960246][ T5357] handle_bug+0x9c/0x200
[ 102.962071][ T5357] exc_invalid_op+0x1a/0x50
[ 102.964071][ T5357] asm_exc_invalid_op+0x1a/0x20
[ 102.966197][ T5357] RIP: 0010:___kmalloc_large_node+0x10c/0x170
[ 102.968888][ T5357] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 0c ad 0b 00 c6 05 52 cf 50 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d e9 12 fc ca 09 cc 89 ef 89
[ 102.977220][ T5357] RSP: 0018:ffffc9000ed7fa78 EFLAGS: 00010246
[ 102.980012][ T5357] RAX: 0000000000000000 RBX: 00000003fffffa24 RCX: 0000000000100000
[ 102.983497][ T5357] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000003fffffa24
[ 102.986869][ T5357] RBP: 0000000000000cc0 R08: ffffffff859dfec9 R09: 0000000000000000
[ 102.990186][ T5357] R10: dffffc0000000000 R11: ffffffff85a71a70 R12: ffffffff8cb6d8a8
[ 102.993461][ T5357] R13: ffffffff85a6ff4a R14: 00000003fffffa24 R15: 00000003fffffa24
[ 102.996882][ T5357] ? drm_syncobj_array_find+0x3a/0x440
[ 102.999216][ T5357] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10
[ 103.002167][ T5357] ? drm_dev_enter+0x49/0x150
[ 103.004280][ T5357] __kmalloc_large_node_noprof+0x18/0x90
[ 103.006678][ T5357] __kmalloc_noprof+0x3f6/0x710
[ 103.008793][ T5357] ? drm_syncobj_array_find+0x3a/0x440
[ 103.011054][ T5357] ? lock_acquire+0x115/0x350
[ 103.013080][ T5357] drm_syncobj_array_find+0x3a/0x440
[ 103.015338][ T5357] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0
[ 103.018091][ T5357] drm_ioctl_kernel+0x2df/0x3b0
[ 103.020313][ T5357] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10
[ 103.023275][ T5357] ? __pfx_drm_ioctl_kernel+0x10/0x10
[ 103.025631][ T5357] drm_ioctl+0x70e/0xba0
[ 103.027493][ T5357] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10
[ 103.030471][ T5357] ? __pfx_drm_ioctl+0x10/0x10
[ 103.032609][ T5357] ? __fget_files+0x2a/0x420
[ 103.034639][ T5357] ? bpf_lsm_file_ioctl+0x9/0x20
[ 103.036802][ T5357] ? __pfx_drm_ioctl+0x10/0x10
[ 103.038879][ T5357] __se_sys_ioctl+0xfc/0x170
[ 103.040859][ T5357] do_syscall_64+0x166/0x520
[ 103.042818][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.045413][ T5357] ? clear_bhb_loop+0x70/0xc0
[ 103.047478][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.050019][ T5357] RIP: 0033:0x7f9bbbb9f559
[ 103.052054][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.060364][ T5357] RSP: 002b:00007f9bbcac1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 103.063827][ T5357] RAX: ffffffffffffffda RBX: 00007f9bbbe25fa0 RCX: 00007f9bbbb9f559
[ 103.067205][ T5357] RDX: 0000200000000080 RSI: 00000000c01864cd RDI: 0000000000000003
[ 103.070683][ T5357] RBP: 00007f9bbbc36b20 R08: 0000000000000000 R09: 0000000000000000
[ 103.074167][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.077661][ T5357] R13: 00007f9bbbe26038 R14: 00007f9bbbe25fa0 R15: 00007ffdae0c4a28
[ 103.081041][ T5357]
[ 103.082845][ T5357] Kernel Offset: disabled
[ 103.084713][ T5357] Rebooting in 86400 seconds..