program: r0 = syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000c00)={0xe9, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x1869c, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40084146, &(0x7f0000000040)=0x6) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newtfilter={0x64, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r3, {0xe, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x20, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x5, 0x2, 0x4}, {0x7, 0x0, 0x1}}}]}]}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18d0b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000080)={{0x3c, @remote, 0x4e20, 0x0, 'nq\x00', 0x2, 0x80000001, 0x5c}, {@dev={0xac, 0x14, 0x14, 0x11}, 0x4e23, 0x4, 0x8, 0x10000, 0x1}}, 0x44) pread64(r2, &(0x7f0000000240)=""/131, 0x83, 0x9) ioctl$SNDRV_PCM_IOCTL_DRAIN(r0, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS64(r0, 0x80984120, &(0x7f0000000600)) syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) (async) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000c00)={0xe9, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x1869c, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) (async) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40084146, &(0x7f0000000040)=0x6) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x5, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newtfilter={0x64, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r3, {0xe, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x20, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x5, 0x2, 0x4}, {0x7, 0x0, 0x1}}}]}]}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18d0b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) (async) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000080)={{0x3c, @remote, 0x4e20, 0x0, 'nq\x00', 0x2, 0x80000001, 0x5c}, {@dev={0xac, 0x14, 0x14, 0x11}, 0x4e23, 0x4, 0x8, 0x10000, 0x1}}, 0x44) (async) pread64(r2, &(0x7f0000000240)=""/131, 0x83, 0x9) (async) ioctl$SNDRV_PCM_IOCTL_DRAIN(r0, 0x4144, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_STATUS64(r0, 0x80984120, &(0x7f0000000600)) (async) [ 94.956850][ T5280] Bluetooth: hci0: command tx timeout [ 95.251255][ T5316] ------------[ cut here ]------------ [ 95.251311][ T5316] ODEBUG: free active (active state 0) object: ffff888042786220 object type: hrtimer hint: dummy_hrtimer_callback+0x0/0x150 [ 95.251434][ T5316] WARNING: lib/debugobjects.c:632 at debug_print_object+0xec/0x230, CPU#0: syz.0.0/5316 [ 95.263848][ T5316] Modules linked in: [ 95.265597][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.269397][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.273806][ T5316] RIP: 0010:debug_print_object+0x18a/0x230 [ 95.276290][ T5316] Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 9d de 4d fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 d3 16 8f 0b 48 83 c4 10 5b 41 5c [ 95.284499][ T5316] RSP: 0018:ffffc9000dd9fb70 EFLAGS: 00010246 [ 95.287945][ T5316] RAX: 1ffffffff181f32c RBX: dffffc0000000000 RCX: 0000000000000000 [ 95.291171][ T5316] RDX: ffffffff8c6daf40 RSI: ffffffff8c6da9c0 RDI: ffffffff90855b00 [ 95.294961][ T5316] RBP: ffffffff8c6daf40 R08: ffff888042786220 R09: ffffffff8c0f9ba0 [ 95.298267][ T5316] R10: dffffc0000000000 R11: ffffffff81b44da0 R12: 0000000000000000 [ 95.301920][ T5316] R13: ffffffff90855b00 R14: ffff888042786220 R15: ffffffff8c0f9960 [ 95.305547][ T5316] FS: 0000555577d96540(0000) GS:ffff88808c2cf000(0000) knlGS:0000000000000000 [ 95.310125][ T5316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.313067][ T5316] CR2: 00007fcea0c1b6b0 CR3: 000000003fed7000 CR4: 0000000000352ef0 [ 95.316448][ T5316] Call Trace: [ 95.317891][ T5316] [ 95.319186][ T5316] ? __pfx_dummy_hrtimer_callback+0x10/0x10 [ 95.321674][ T5316] ? __pfx_dummy_hrtimer_callback+0x10/0x10 [ 95.324309][ T5316] debug_check_no_obj_freed+0x2e3/0x450 [ 95.326707][ T5316] kfree+0x13e/0x650 [ 95.328387][ T5316] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.330649][ T5316] ? dummy_pcm_close+0x9b/0xb0 [ 95.332602][ T5316] dummy_pcm_close+0x9b/0xb0 [ 95.334574][ T5316] snd_pcm_release_substream+0x313/0x490 [ 95.336989][ T5316] snd_pcm_release+0xb6/0x160 [ 95.339012][ T5316] ? __pfx_snd_pcm_release+0x10/0x10 [ 95.341327][ T5316] __fput+0x418/0xa50 [ 95.343188][ T5316] task_work_run+0x1d9/0x270 [ 95.345229][ T5316] ? __pfx_task_work_run+0x10/0x10 [ 95.347402][ T5316] exit_to_user_mode_loop+0x204/0x770 [ 95.349854][ T5316] ? rcu_is_watching+0x16/0xb0 [ 95.351916][ T5316] do_syscall_64+0x328/0x520 [ 95.353874][ T5316] ? trace_irq_disable+0x3b/0x140 [ 95.355923][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.358337][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 95.360337][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.362873][ T5316] RIP: 0033:0x7f6fa4f9e159 [ 95.364732][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.372897][ T5316] RSP: 002b:00007ffd11ddaae8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 95.376271][ T5316] RAX: 0000000000000000 RBX: 00007f6fa5227da0 RCX: 00007f6fa4f9e159 [ 95.379542][ T5316] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 95.382737][ T5316] RBP: 00007f6fa5227da0 R08: 0000000000000006 R09: 0000000000000000 [ 95.385889][ T5316] R10: 0000000000dffccc R11: 0000000000000246 R12: 00000000000175fe [ 95.389367][ T5316] R13: 00007f6fa522627c R14: 00007f6fa5226278 R15: 00007f6fa5226270 [ 95.392657][ T5316] [ 95.394029][ T5316] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.397162][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.400485][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.403943][ T5316] Call Trace: [ 95.405231][ T5316] [ 95.406439][ T5316] vpanic+0x56d/0xa60 [ 95.408166][ T5316] ? __pfx__printk+0x10/0x10 [ 95.410077][ T5316] ? __pfx_vpanic+0x10/0x10 [ 95.412042][ T5316] ? is_bpf_text_address+0x292/0x2b0 [ 95.414261][ T5316] ? is_bpf_text_address+0x26/0x2b0 [ 95.416462][ T5316] panic+0xc5/0xd0 [ 95.417963][ T5316] ? __pfx_panic+0x10/0x10 [ 95.420133][ T5316] __warn+0x315/0x4c0 [ 95.422115][ T5316] ? debug_print_object+0xec/0x230 [ 95.424590][ T5316] ? debug_print_object+0xec/0x230 [ 95.427048][ T5316] __report_bug+0x276/0x570 [ 95.429127][ T5316] ? __kernel_text_address+0xd/0x30 [ 95.431424][ T5316] ? debug_print_object+0xec/0x230 [ 95.433607][ T5316] ? __pfx___report_bug+0x10/0x10 [ 95.435860][ T5316] ? lockdep_unlock+0x5c/0xd0 [ 95.437935][ T5316] ? __lock_acquire+0x14b9/0x2e50 [ 95.440082][ T5316] report_bug_entry+0x19b/0x290 [ 95.442305][ T5316] ? debug_print_object+0x18a/0x230 [ 95.444659][ T5316] ? debug_print_object+0x18f/0x230 [ 95.446973][ T5316] handle_bug+0xce/0x200 [ 95.448876][ T5316] exc_invalid_op+0x1a/0x50 [ 95.451019][ T5316] asm_exc_invalid_op+0x1a/0x20 [ 95.453484][ T5316] RIP: 0010:debug_print_object+0x18a/0x230 [ 95.456085][ T5316] Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 9d de 4d fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 d3 16 8f 0b 48 83 c4 10 5b 41 5c [ 95.464164][ T5316] RSP: 0018:ffffc9000dd9fb70 EFLAGS: 00010246 [ 95.466800][ T5316] RAX: 1ffffffff181f32c RBX: dffffc0000000000 RCX: 0000000000000000 [ 95.470067][ T5316] RDX: ffffffff8c6daf40 RSI: ffffffff8c6da9c0 RDI: ffffffff90855b00 [ 95.473560][ T5316] RBP: ffffffff8c6daf40 R08: ffff888042786220 R09: ffffffff8c0f9ba0 [ 95.476892][ T5316] R10: dffffc0000000000 R11: ffffffff81b44da0 R12: 0000000000000000 [ 95.480069][ T5316] R13: ffffffff90855b00 R14: ffff888042786220 R15: ffffffff8c0f9960 [ 95.483365][ T5316] ? __pfx_hrtimer_debug_hint+0x10/0x10 [ 95.485614][ T5316] ? __pfx_dummy_hrtimer_callback+0x10/0x10 [ 95.488123][ T5316] ? __pfx_dummy_hrtimer_callback+0x10/0x10 [ 95.490693][ T5316] debug_check_no_obj_freed+0x2e3/0x450 [ 95.493140][ T5316] kfree+0x13e/0x650 [ 95.494824][ T5316] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.496991][ T5316] ? dummy_pcm_close+0x9b/0xb0 [ 95.498997][ T5316] dummy_pcm_close+0x9b/0xb0 [ 95.500982][ T5316] snd_pcm_release_substream+0x313/0x490 [ 95.503486][ T5316] snd_pcm_release+0xb6/0x160 [ 95.506033][ T5316] ? __pfx_snd_pcm_release+0x10/0x10 [ 95.508574][ T5316] __fput+0x418/0xa50 [ 95.510402][ T5316] task_work_run+0x1d9/0x270 [ 95.512643][ T5316] ? __pfx_task_work_run+0x10/0x10 [ 95.515105][ T5316] exit_to_user_mode_loop+0x204/0x770 [ 95.517456][ T5316] ? rcu_is_watching+0x16/0xb0 [ 95.519825][ T5316] do_syscall_64+0x328/0x520 [ 95.522326][ T5316] ? trace_irq_disable+0x3b/0x140 [ 95.524739][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.527430][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 95.529546][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.532152][ T5316] RIP: 0033:0x7f6fa4f9e159 [ 95.534071][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.542314][ T5316] RSP: 002b:00007ffd11ddaae8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 95.545822][ T5316] RAX: 0000000000000000 RBX: 00007f6fa5227da0 RCX: 00007f6fa4f9e159 [ 95.549029][ T5316] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 95.552544][ T5316] RBP: 00007f6fa5227da0 R08: 0000000000000006 R09: 0000000000000000 [ 95.555887][ T5316] R10: 0000000000dffccc R11: 0000000000000246 R12: 00000000000175fe [ 95.559272][ T5316] R13: 00007f6fa522627c R14: 00007f6fa5226278 R15: 00007f6fa5226270 [ 95.562955][ T5316] [ 95.564613][ T5316] Kernel Offset: disabled [ 95.566540][ T5316] Rebooting in 86400 seconds..