program: mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys\x00', 0x1ff) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x200000, 0x0, 0x0, 0xffffffff, 0x8003}}}}]}, 0x4c}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'vxcan1\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x7f, 0x69, 0x2, 0x4, 0x2, 0x7}, [@TCA_NETEM_RATE64={0xc, 0x8, 0x7643afc9b5ba62c7}]}}}]}, 0x58}}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) write$binfmt_misc(r4, &(0x7f0000000300), 0xfffffecc) splice(r3, 0x0, r5, 0x0, 0x4ffe6, 0x0) mount(0x0, &(0x7f00000004c0)='./sys\x00', &(0x7f00000005c0)='sysfs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r9, &(0x7f0000000640)='1', 0x1) r10 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pci/rescan\x00', 0x8001, 0x80) write(r10, &(0x7f0000000740)='1', 0x1) [ 93.313110][ T4668] Bluetooth: hci0: command tx timeout [ 93.328685][ T1400] cfg80211: failed to load regulatory.db [ 93.577097][ T5347] Console: switching to colour dummy device 80x25 [ 93.734605][ T5347] ------------[ cut here ]------------ [ 93.734661][ T5347] Memory manager not clean during takedown. [ 93.734669][ T5347] WARNING: drivers/gpu/drm/drm_mm.c:966 at drm_mm_takedown+0x54/0x70, CPU#0: syz.0.0/5347 [ 93.744241][ T5347] Modules linked in: [ 93.746144][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.749721][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.754272][ T5347] RIP: 0010:drm_mm_takedown+0x54/0x70 [ 93.756554][ T5347] Code: 4c 89 f7 e8 5e 63 97 fc 49 8b 06 4c 39 f0 75 0e e8 21 c0 1e fc 5b 41 5e e9 d9 97 5f 06 cc e8 13 c0 1e fc 48 8d 3d ac a2 1f 0c <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f [ 93.766103][ T5347] RSP: 0018:ffffc9000f6976f0 EFLAGS: 00010287 [ 93.769019][ T5347] RAX: ffffffff85aa618d RBX: ffff888036169068 RCX: 0000000000100000 [ 93.772400][ T5347] RDX: ffffc90020001000 RSI: 0000000000014264 RDI: ffffffff91ca0440 [ 93.776101][ T5347] RBP: ffffffff85a91600 R08: ffff8880313be300 R09: ffffffff8ca212c0 [ 93.779371][ T5347] R10: dffffc0000000000 R11: ffffffff85a91600 R12: ffff8880313be300 [ 93.783182][ T5347] R13: dffffc0000000000 R14: ffff8880361690a0 R15: dffffc0000000000 [ 93.786495][ T5347] FS: 00007ff4e18c46c0(0000) GS:ffff88808aa01000(0000) knlGS:0000000000000000 [ 93.790281][ T5347] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.793012][ T5347] CR2: 00007f5b86f909c0 CR3: 000000001df6a000 CR4: 0000000000352ef0 [ 93.796408][ T5347] Call Trace: [ 93.797859][ T5347] [ 93.799047][ T5347] drm_managed_release+0x208/0x380 [ 93.804791][ T5347] ? __pfx_virtio_gpu_release+0x10/0x10 [ 93.807524][ T5347] drm_dev_put+0xe0/0x120 [ 93.809521][ T5347] virtio_dev_remove+0x9c/0x1b0 [ 93.811630][ T5347] ? __pfx_virtio_dev_remove+0x10/0x10 [ 93.813903][ T5347] device_release_driver_internal+0x42b/0x7d0 [ 93.816344][ T5347] bus_remove_device+0x444/0x560 [ 93.818484][ T5347] ? __pfx_bus_remove_device+0x10/0x10 [ 93.821971][ T5347] ? kernfs_remove_by_name_ns+0x101/0x140 [ 93.824384][ T5347] device_del+0x524/0x8f0 [ 93.826137][ T5347] ? __pfx_device_del+0x10/0x10 [ 93.828156][ T5347] device_unregister+0x21/0xf0 [ 93.830043][ T5347] unregister_virtio_device+0x37/0x60 [ 93.833244][ T5347] virtio_pci_remove+0x7f/0xf0 [ 93.835256][ T5347] pci_device_remove+0x99/0x1c0 [ 93.837349][ T5347] ? __pfx_pci_device_remove+0x10/0x10 [ 93.839732][ T5347] device_release_driver_internal+0x42b/0x7d0 [ 93.843883][ T5347] pci_stop_bus_device+0xf6/0x120 [ 93.846173][ T5347] pci_stop_and_remove_bus_device_locked+0x77/0xb0 [ 93.848998][ T5347] remove_store+0xe5/0x150 [ 93.851242][ T5347] ? __pfx_remove_store+0x10/0x10 [ 93.853538][ T5347] ? dev_attr_store+0x33/0x90 [ 93.855623][ T5347] ? __pfx_sysfs_kf_write+0x10/0x10 [ 93.857917][ T5347] kernfs_fop_write_iter+0x3a4/0x540 [ 93.861214][ T5347] vfs_write+0x612/0xba0 [ 93.863195][ T5347] ? __pfx_vfs_write+0x10/0x10 [ 93.865677][ T5347] ? __fget_files+0x3a2/0x420 [ 93.867964][ T5347] ? __fget_files+0x2a/0x420 [ 93.872300][ T5347] ? fdget+0x1ac/0x250 [ 93.874001][ T5347] ksys_write+0x150/0x270 [ 93.875776][ T5347] ? __pfx_ksys_write+0x10/0x10 [ 93.878583][ T5347] do_syscall_64+0x166/0x520 [ 93.882914][ T5347] ? trace_irq_disable+0x3b/0x140 [ 93.884709][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.887340][ T5347] ? clear_bhb_loop+0x70/0xc0 [ 93.889205][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.893314][ T5347] RIP: 0033:0x7ff4e099fb19 [ 93.895146][ T5347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.902911][ T5347] RSP: 002b:00007ff4e18c3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.906329][ T5347] RAX: ffffffffffffffda RBX: 00007ff4e0c26090 RCX: 00007ff4e099fb19 [ 93.909610][ T5347] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 000000000000000a [ 93.913292][ T5347] RBP: 00007ff4e0a37af8 R08: 0000000000000000 R09: 0000000000000000 [ 93.916462][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.919781][ T5347] R13: 00007ff4e0c26128 R14: 00007ff4e0c26090 R15: 00007ffc0559cb28 [ 93.923234][ T5347] [ 93.924579][ T5347] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 93.928288][ T5347] CPU: 0 UID: 0 PID: 5347 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.932191][ T5347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.936209][ T5347] Call Trace: [ 93.937651][ T5347] [ 93.938945][ T5347] vpanic+0x26f/0x710 [ 93.940735][ T5347] panic+0xc5/0xd0 [ 93.942451][ T5347] ? __pfx_panic+0x10/0x10 [ 93.944451][ T5347] __warn+0x315/0x4c0 [ 93.946208][ T5347] ? drm_mm_takedown+0x54/0x70 [ 93.948352][ T5347] ? drm_mm_takedown+0x54/0x70 [ 93.950309][ T5347] __report_bug+0x276/0x570 [ 93.952313][ T5347] ? bus_remove_device+0x444/0x560 [ 93.954547][ T5347] ? device_del+0x524/0x8f0 [ 93.956578][ T5347] ? device_unregister+0x21/0xf0 [ 93.958827][ T5347] ? drm_mm_takedown+0x54/0x70 [ 93.961012][ T5347] ? __pfx___report_bug+0x10/0x10 [ 93.966983][ T5347] report_bug_entry+0x19b/0x290 [ 93.970456][ T5347] ? drm_mm_takedown+0x54/0x70 [ 93.972925][ T5347] ? drm_mm_takedown+0x59/0x70 [ 93.975121][ T5347] handle_bug+0xce/0x200 [ 93.977101][ T5347] exc_invalid_op+0x1a/0x50 [ 93.979191][ T5347] asm_exc_invalid_op+0x1a/0x20 [ 93.981526][ T5347] RIP: 0010:drm_mm_takedown+0x54/0x70 [ 93.984029][ T5347] Code: 4c 89 f7 e8 5e 63 97 fc 49 8b 06 4c 39 f0 75 0e e8 21 c0 1e fc 5b 41 5e e9 d9 97 5f 06 cc e8 13 c0 1e fc 48 8d 3d ac a2 1f 0c <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f [ 93.992414][ T5347] RSP: 0018:ffffc9000f6976f0 EFLAGS: 00010287 [ 93.995107][ T5347] RAX: ffffffff85aa618d RBX: ffff888036169068 RCX: 0000000000100000 [ 93.998650][ T5347] RDX: ffffc90020001000 RSI: 0000000000014264 RDI: ffffffff91ca0440 [ 94.002206][ T5347] RBP: ffffffff85a91600 R08: ffff8880313be300 R09: ffffffff8ca212c0 [ 94.005602][ T5347] R10: dffffc0000000000 R11: ffffffff85a91600 R12: ffff8880313be300 [ 94.008862][ T5347] R13: dffffc0000000000 R14: ffff8880361690a0 R15: dffffc0000000000 [ 94.012179][ T5347] ? __pfx_drm_gem_init_release+0x10/0x10 [ 94.014679][ T5347] ? __pfx_drm_gem_init_release+0x10/0x10 [ 94.017072][ T5347] ? drm_mm_takedown+0x4d/0x70 [ 94.019124][ T5347] drm_managed_release+0x208/0x380 [ 94.021312][ T5347] ? __pfx_virtio_gpu_release+0x10/0x10 [ 94.023719][ T5347] drm_dev_put+0xe0/0x120 [ 94.025631][ T5347] virtio_dev_remove+0x9c/0x1b0 [ 94.027804][ T5347] ? __pfx_virtio_dev_remove+0x10/0x10 [ 94.030166][ T5347] device_release_driver_internal+0x42b/0x7d0 [ 94.032746][ T5347] bus_remove_device+0x444/0x560 [ 94.034821][ T5347] ? __pfx_bus_remove_device+0x10/0x10 [ 94.037035][ T5347] ? kernfs_remove_by_name_ns+0x101/0x140 [ 94.039401][ T5347] device_del+0x524/0x8f0 [ 94.041222][ T5347] ? __pfx_device_del+0x10/0x10 [ 94.043261][ T5347] device_unregister+0x21/0xf0 [ 94.045314][ T5347] unregister_virtio_device+0x37/0x60 [ 94.047697][ T5347] virtio_pci_remove+0x7f/0xf0 [ 94.049775][ T5347] pci_device_remove+0x99/0x1c0 [ 94.051840][ T5347] ? __pfx_pci_device_remove+0x10/0x10 [ 94.054063][ T5347] device_release_driver_internal+0x42b/0x7d0 [ 94.056061][ T5347] pci_stop_bus_device+0xf6/0x120 [ 94.058122][ T5347] pci_stop_and_remove_bus_device_locked+0x77/0xb0 [ 94.060909][ T5347] remove_store+0xe5/0x150 [ 94.062849][ T5347] ? __pfx_remove_store+0x10/0x10 [ 94.065039][ T5347] ? dev_attr_store+0x33/0x90 [ 94.066629][ T5347] ? __pfx_sysfs_kf_write+0x10/0x10 [ 94.068561][ T5347] kernfs_fop_write_iter+0x3a4/0x540 [ 94.070865][ T5347] vfs_write+0x612/0xba0 [ 94.072727][ T5347] ? __pfx_vfs_write+0x10/0x10 [ 94.074802][ T5347] ? __fget_files+0x3a2/0x420 [ 94.076809][ T5347] ? __fget_files+0x2a/0x420 [ 94.078805][ T5347] ? fdget+0x1ac/0x250 [ 94.080574][ T5347] ksys_write+0x150/0x270 [ 94.082314][ T5347] ? __pfx_ksys_write+0x10/0x10 [ 94.084426][ T5347] do_syscall_64+0x166/0x520 [ 94.086470][ T5347] ? trace_irq_disable+0x3b/0x140 [ 94.088656][ T5347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.091525][ T5347] ? clear_bhb_loop+0x70/0xc0 [ 94.093648][ T5347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.096341][ T5347] RIP: 0033:0x7ff4e099fb19 [ 94.098423][ T5347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.106687][ T5347] RSP: 002b:00007ff4e18c3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.110216][ T5347] RAX: ffffffffffffffda RBX: 00007ff4e0c26090 RCX: 00007ff4e099fb19 [ 94.113646][ T5347] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 000000000000000a [ 94.116926][ T5347] RBP: 00007ff4e0a37af8 R08: 0000000000000000 R09: 0000000000000000 [ 94.133323][ T5347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.136070][ T5347] R13: 00007ff4e0c26128 R14: 00007ff4e0c26090 R15: 00007ffc0559cb28 [ 94.138804][ T5347] [ 94.140482][ T5347] Kernel Offset: disabled [ 94.142363][ T5347] Rebooting in 86400 seconds..