program: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x40100001, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000240)={&(0x7f0000000180)=[r5], 0x1, r3, r4, 0x1, 0x0, 0x2, 0x1, {0xd49, 0x1, 0x7, 0x69, 0xf4b, 0x2, 0x2, 0x45, 0x412f, 0xe154, 0x20, 0x7, 0xb2bf, 0x3, "fe1d00003413000000000000000caa000000090000000000000004b427180010"}}) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) (async) syz_open_dev$dri(&(0x7f0000000080), 0x40100001, 0x0) (async) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) (async) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000240)={&(0x7f0000000180)=[r5], 0x1, r3, r4, 0x1, 0x0, 0x2, 0x1, {0xd49, 0x1, 0x7, 0x69, 0xf4b, 0x2, 0x2, 0x45, 0x412f, 0xe154, 0x20, 0x7, 0xb2bf, 0x3, "fe1d00003413000000000000000caa000000090000000000000004b427180010"}}) (async) [ 94.067404][ T4638] Bluetooth: hci0: command tx timeout [ 94.167138][ T5296] [drm:virtio_gpu_dequeue_ctrl_func] *ERROR* response 0x1205 (command 0x103) [ 95.212960][ T5312] ------------[ cut here ]------------ [ 95.216383][ T5312] [CRTC:39:crtc-0] vblank wait timed out [ 95.219009][ T5312] WARNING: drivers/gpu/drm/drm_atomic_helper.c:1922 at drm_atomic_helper_wait_for_vblanks+0x763/0x8f0, CPU#0: syz.0.0/5312 [ 95.224666][ T5312] Modules linked in: [ 95.227241][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.231206][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.235596][ T5312] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 95.238771][ T5312] Code: 00 4d 8d 6e 20 45 8b 3f 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 0e 48 89 fb 4c 89 ef e8 47 66 a3 fc 48 89 df 49 8b 55 00 44 89 fe <67> 48 0f b9 3a 49 bd 00 00 00 00 00 fc ff df 48 8b 5c 24 50 e9 cc [ 95.246937][ T5312] RSP: 0018:ffffc9000dbff540 EFLAGS: 00010246 [ 95.249664][ T5312] RAX: 1ffff11003ed000c RBX: dffffc0000000000 RCX: ffff88803fa38000 [ 95.253267][ T5312] RDX: ffff88801f189a60 RSI: 0000000000000027 RDI: ffffffff9063d750 [ 95.256722][ T5312] RBP: ffffc9000dbff680 R08: ffffffff9057b437 R09: 1ffffffff20af686 [ 95.260207][ T5312] R10: dffffc0000000000 R11: fffffbfff20af687 R12: ffff8880336cf708 [ 95.263673][ T5312] R13: ffff88801f680060 R14: ffff88801f680040 R15: 0000000000000027 [ 95.267074][ T5312] FS: 00007fb96fddd6c0(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000 [ 95.270983][ T5312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.274046][ T5312] CR2: 00007f8c30515380 CR3: 0000000012998000 CR4: 0000000000352ef0 [ 95.277380][ T5312] Call Trace: [ 95.278900][ T5312] [ 95.280244][ T5312] ? irqentry_exit+0x218/0x8f0 [ 95.282595][ T5312] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 95.285593][ T5312] ? __pfx_autoremove_wake_function+0x10/0x10 [ 95.288239][ T5312] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 95.291410][ T5312] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 95.294481][ T5312] commit_tail+0x2b1/0x3c0 [ 95.296509][ T5312] drm_atomic_helper_commit+0xa77/0xb10 [ 95.298925][ T5312] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 95.301761][ T5312] drm_atomic_commit+0x24e/0x2b0 [ 95.303955][ T5312] ? __pfx_drm_atomic_commit+0x10/0x10 [ 95.306285][ T5312] ? __pfx___drm_printfn_info+0x10/0x10 [ 95.308749][ T5312] ? drm_atomic_commit_init+0x2ca/0x370 [ 95.311323][ T5312] drm_atomic_helper_set_config+0xe2/0x160 [ 95.313931][ T5312] drm_mode_setcrtc+0xa70/0x1d20 [ 95.316154][ T5312] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 95.318509][ T5312] ? __lock_acquire+0x683/0x2cf0 [ 95.320733][ T5312] ? do_raw_spin_unlock+0x4d/0x210 [ 95.323090][ T5312] ? _raw_spin_unlock+0x28/0x50 [ 95.325213][ T5312] ? drm_is_current_master+0x19f/0x200 [ 95.327446][ T5312] drm_ioctl_kernel+0x2df/0x3b0 [ 95.329603][ T5312] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 95.331964][ T5312] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 95.334269][ T5312] drm_ioctl+0x70e/0xba0 [ 95.336028][ T5312] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 95.338321][ T5312] ? __pfx_drm_ioctl+0x10/0x10 [ 95.340330][ T5312] ? __fget_files+0x2a/0x420 [ 95.342393][ T5312] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.344483][ T5312] ? __pfx_drm_ioctl+0x10/0x10 [ 95.346495][ T5312] __se_sys_ioctl+0xfc/0x170 [ 95.348401][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.350827][ T5312] do_syscall_64+0x174/0x580 [ 95.352941][ T5312] ? trace_irq_disable+0x3b/0x140 [ 95.355025][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 95.357017][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.359540][ T5312] RIP: 0033:0x7fb96ef9e0d9 [ 95.361583][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.369488][ T5312] RSP: 002b:00007fb96fddcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.373697][ T5312] RAX: ffffffffffffffda RBX: 00007fb96f225fa0 RCX: 00007fb96ef9e0d9 [ 95.377314][ T5312] RDX: 0000200000000240 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 95.380624][ T5312] RBP: 00007fb96f035024 R08: 0000000000000000 R09: 0000000000000000 [ 95.384123][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.387434][ T5312] R13: 00007fb96f226038 R14: 00007fb96f225fa0 R15: 00007ffc3769e308 [ 95.390612][ T5312] [ 95.392138][ T5312] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.395343][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.399267][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.403421][ T5312] Call Trace: [ 95.404864][ T5312] [ 95.406087][ T5312] vpanic+0x56c/0xa60 [ 95.407772][ T5312] ? __pfx__printk+0x10/0x10 [ 95.409553][ T5312] ? __pfx_vpanic+0x10/0x10 [ 95.411344][ T5312] ? is_bpf_text_address+0x292/0x2b0 [ 95.413357][ T5312] ? is_bpf_text_address+0x26/0x2b0 [ 95.415421][ T5312] panic+0xc5/0xd0 [ 95.416944][ T5312] ? __pfx_panic+0x10/0x10 [ 95.418912][ T5312] __warn+0x315/0x4c0 [ 95.420673][ T5312] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 95.423402][ T5312] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 95.426094][ T5312] __report_bug+0x276/0x570 [ 95.427935][ T5312] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 95.430657][ T5312] ? __pfx___report_bug+0x10/0x10 [ 95.432742][ T5312] report_bug_entry+0x19a/0x290 [ 95.434686][ T5312] ? drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 95.437372][ T5312] ? drm_atomic_helper_wait_for_vblanks+0x7a8/0x8f0 [ 95.440078][ T5312] handle_bug+0xce/0x200 [ 95.441906][ T5312] exc_invalid_op+0x1a/0x50 [ 95.443764][ T5312] asm_exc_invalid_op+0x1a/0x20 [ 95.445812][ T5312] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 95.448833][ T5312] Code: 00 4d 8d 6e 20 45 8b 3f 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 0e 48 89 fb 4c 89 ef e8 47 66 a3 fc 48 89 df 49 8b 55 00 44 89 fe <67> 48 0f b9 3a 49 bd 00 00 00 00 00 fc ff df 48 8b 5c 24 50 e9 cc [ 95.456501][ T5312] RSP: 0018:ffffc9000dbff540 EFLAGS: 00010246 [ 95.459001][ T5312] RAX: 1ffff11003ed000c RBX: dffffc0000000000 RCX: ffff88803fa38000 [ 95.462292][ T5312] RDX: ffff88801f189a60 RSI: 0000000000000027 RDI: ffffffff9063d750 [ 95.465566][ T5312] RBP: ffffc9000dbff680 R08: ffffffff9057b437 R09: 1ffffffff20af686 [ 95.468793][ T5312] R10: dffffc0000000000 R11: fffffbfff20af687 R12: ffff8880336cf708 [ 95.472023][ T5312] R13: ffff88801f680060 R14: ffff88801f680040 R15: 0000000000000027 [ 95.475299][ T5312] ? irqentry_exit+0x218/0x8f0 [ 95.477318][ T5312] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 95.480352][ T5312] ? __pfx_autoremove_wake_function+0x10/0x10 [ 95.483047][ T5312] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 95.485822][ T5312] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 95.488419][ T5312] commit_tail+0x2b1/0x3c0 [ 95.490310][ T5312] drm_atomic_helper_commit+0xa77/0xb10 [ 95.492678][ T5312] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 95.495242][ T5312] drm_atomic_commit+0x24e/0x2b0 [ 95.497447][ T5312] ? __pfx_drm_atomic_commit+0x10/0x10 [ 95.499587][ T5312] ? __pfx___drm_printfn_info+0x10/0x10 [ 95.501959][ T5312] ? drm_atomic_commit_init+0x2ca/0x370 [ 95.504305][ T5312] drm_atomic_helper_set_config+0xe2/0x160 [ 95.506852][ T5312] drm_mode_setcrtc+0xa70/0x1d20 [ 95.509051][ T5312] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 95.511371][ T5312] ? __lock_acquire+0x683/0x2cf0 [ 95.513528][ T5312] ? do_raw_spin_unlock+0x4d/0x210 [ 95.515719][ T5312] ? _raw_spin_unlock+0x28/0x50 [ 95.517856][ T5312] ? drm_is_current_master+0x19f/0x200 [ 95.520219][ T5312] drm_ioctl_kernel+0x2df/0x3b0 [ 95.522316][ T5312] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 95.524620][ T5312] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 95.526926][ T5312] drm_ioctl+0x70e/0xba0 [ 95.528738][ T5312] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 95.531015][ T5312] ? __pfx_drm_ioctl+0x10/0x10 [ 95.533116][ T5312] ? __fget_files+0x2a/0x420 [ 95.535177][ T5312] ? bpf_lsm_file_ioctl+0x9/0x20 [ 95.537292][ T5312] ? __pfx_drm_ioctl+0x10/0x10 [ 95.539438][ T5312] __se_sys_ioctl+0xfc/0x170 [ 95.541481][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.544088][ T5312] do_syscall_64+0x174/0x580 [ 95.546126][ T5312] ? trace_irq_disable+0x3b/0x140 [ 95.548381][ T5312] ? clear_bhb_loop+0x70/0xc0 [ 95.550437][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.553037][ T5312] RIP: 0033:0x7fb96ef9e0d9 [ 95.555009][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.563526][ T5312] RSP: 002b:00007fb96fddcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.567096][ T5312] RAX: ffffffffffffffda RBX: 00007fb96f225fa0 RCX: 00007fb96ef9e0d9 [ 95.570445][ T5312] RDX: 0000200000000240 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 95.573859][ T5312] RBP: 00007fb96f035024 R08: 0000000000000000 R09: 0000000000000000 [ 95.577312][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.580807][ T5312] R13: 00007fb96f226038 R14: 00007fb96f225fa0 R15: 00007ffc3769e308 [ 95.584333][ T5312] [ 95.585995][ T5312] Kernel Offset: disabled [ 95.587902][ T5312] Rebooting in 86400 seconds..