program: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r3, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r4, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000280)={r3, 0x0, 0x0, 0x0, 0x0, [0x0], [], [0x0, 0x0, 0x8, 0x8000], [0x0, 0x3, 0x400000006]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000100)={r6}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000340)={r3, 0x0, 0x0, 0x0, 0x0, [0x0], [0xffffffff], [], [0xfffffffffffffffc]}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c64d2, &(0x7f0000000040)={r7}) [ 85.352226][ T5304] Bluetooth: hci0: command tx timeout [ 85.438219][ T5328] ------------[ cut here ]------------ [ 85.440921][ T5328] WARNING: CPU: 0 PID: 5328 at drivers/gpu/drm/drm_prime.c:223 drm_prime_destroy_file_private+0x4b/0x60 [ 85.445901][ T5328] Modules linked in: [ 85.447789][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.451961][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.456806][ T5328] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 85.459718][ T5328] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 4d 63 f2 fc 48 83 3b 00 75 0c e8 b2 23 8b fc 5b c3 cc cc cc cc cc e8 a6 23 8b fc 90 <0f> 0b 90 5b e9 0c 42 16 06 cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 85.467965][ T5328] RSP: 0018:ffffc9000f3d7c60 EFLAGS: 00010293 [ 85.470792][ T5328] RAX: ffffffff8534f28a RBX: ffff888042bc2410 RCX: ffff888000f44900 [ 85.474193][ T5328] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888042bc2380 [ 85.477560][ T5328] RBP: ffff888042bc22c8 R08: ffffc9000f3d7be7 R09: 1ffff92001e7af7c [ 85.480769][ T5328] R10: dffffc0000000000 R11: fffff52001e7af7d R12: dffffc0000000000 [ 85.484052][ T5328] R13: dead000000000100 R14: 0000000000000000 R15: ffff888042bc22d8 [ 85.487478][ T5328] FS: 00005555747df500(0000) GS:ffff88808d730000(0000) knlGS:0000000000000000 [ 85.491497][ T5328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.494283][ T5328] CR2: 00007f1503fd39e8 CR3: 00000000423f8000 CR4: 0000000000352ef0 [ 85.497653][ T5328] Call Trace: [ 85.499149][ T5328] [ 85.500609][ T5328] drm_file_free+0x7f2/0xa00 [ 85.502673][ T5328] drm_release+0x2de/0x3f0 [ 85.504550][ T5328] ? __pfx_drm_release+0x10/0x10 [ 85.506689][ T5328] __fput+0x44c/0xa70 [ 85.508472][ T5328] task_work_run+0x1d4/0x260 [ 85.510623][ T5328] ? __pfx_task_work_run+0x10/0x10 [ 85.512824][ T5328] ? exit_to_user_mode_loop+0x40/0x130 [ 85.515223][ T5328] exit_to_user_mode_loop+0xe9/0x130 [ 85.518096][ T5328] do_syscall_64+0x2bd/0xfa0 [ 85.520738][ T5328] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.523009][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.525673][ T5328] ? clear_bhb_loop+0x60/0xb0 [ 85.527710][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.530594][ T5328] RIP: 0033:0x7f1503d8f6c9 [ 85.532543][ T5328] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.540902][ T5328] RSP: 002b:00007ffdf282e628 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 85.544437][ T5328] RAX: 0000000000000000 RBX: 0000000000014cef RCX: 00007f1503d8f6c9 [ 85.547860][ T5328] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 85.552249][ T5328] RBP: 00007f1503fe7da0 R08: 0000000000000001 R09: 0000000cf282e91f [ 85.555844][ T5328] R10: 00007f1503bff02c R11: 0000000000000246 R12: 00007f1503fe5fac [ 85.559442][ T5328] R13: 00007f1503fe5fa0 R14: ffffffffffffffff R15: 00007ffdf282e740 [ 85.562742][ T5328] [ 85.564135][ T5328] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 85.567314][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.571253][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.575835][ T5328] Call Trace: [ 85.577262][ T5328] [ 85.578408][ T5328] dump_stack_lvl+0x99/0x250 [ 85.580384][ T5328] ? __asan_memcpy+0x40/0x70 [ 85.582412][ T5328] ? __pfx_dump_stack_lvl+0x10/0x10 [ 85.584601][ T5328] ? __pfx__printk+0x10/0x10 [ 85.586734][ T5328] vpanic+0x237/0x6d0 [ 85.588492][ T5328] ? __pfx_vpanic+0x10/0x10 [ 85.590497][ T5328] panic+0xb9/0xc0 [ 85.592139][ T5328] ? __pfx_panic+0x10/0x10 [ 85.594146][ T5328] __warn+0x31b/0x4b0 [ 85.595972][ T5328] ? drm_prime_destroy_file_private+0x4b/0x60 [ 85.598708][ T5328] ? drm_prime_destroy_file_private+0x4b/0x60 [ 85.601422][ T5328] report_bug+0x2be/0x4f0 [ 85.603350][ T5328] ? drm_prime_destroy_file_private+0x4b/0x60 [ 85.606050][ T5328] ? drm_prime_destroy_file_private+0x4b/0x60 [ 85.608715][ T5328] ? drm_prime_destroy_file_private+0x4d/0x60 [ 85.611409][ T5328] handle_bug+0x84/0x160 [ 85.613408][ T5328] exc_invalid_op+0x1a/0x50 [ 85.615473][ T5328] asm_exc_invalid_op+0x1a/0x20 [ 85.617773][ T5328] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 85.621352][ T5328] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 4d 63 f2 fc 48 83 3b 00 75 0c e8 b2 23 8b fc 5b c3 cc cc cc cc cc e8 a6 23 8b fc 90 <0f> 0b 90 5b e9 0c 42 16 06 cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 85.630618][ T5328] RSP: 0018:ffffc9000f3d7c60 EFLAGS: 00010293 [ 85.633380][ T5328] RAX: ffffffff8534f28a RBX: ffff888042bc2410 RCX: ffff888000f44900 [ 85.636863][ T5328] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888042bc2380 [ 85.640338][ T5328] RBP: ffff888042bc22c8 R08: ffffc9000f3d7be7 R09: 1ffff92001e7af7c [ 85.643730][ T5328] R10: dffffc0000000000 R11: fffff52001e7af7d R12: dffffc0000000000 [ 85.647189][ T5328] R13: dead000000000100 R14: 0000000000000000 R15: ffff888042bc22d8 [ 85.650586][ T5328] ? drm_prime_destroy_file_private+0x4a/0x60 [ 85.653201][ T5328] drm_file_free+0x7f2/0xa00 [ 85.655249][ T5328] drm_release+0x2de/0x3f0 [ 85.657226][ T5328] ? __pfx_drm_release+0x10/0x10 [ 85.659405][ T5328] __fput+0x44c/0xa70 [ 85.661224][ T5328] task_work_run+0x1d4/0x260 [ 85.663220][ T5328] ? __pfx_task_work_run+0x10/0x10 [ 85.665561][ T5328] ? exit_to_user_mode_loop+0x40/0x130 [ 85.667849][ T5328] exit_to_user_mode_loop+0xe9/0x130 [ 85.670241][ T5328] do_syscall_64+0x2bd/0xfa0 [ 85.672347][ T5328] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.674713][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.677471][ T5328] ? clear_bhb_loop+0x60/0xb0 [ 85.679547][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.682200][ T5328] RIP: 0033:0x7f1503d8f6c9 [ 85.684239][ T5328] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.692613][ T5328] RSP: 002b:00007ffdf282e628 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 85.696154][ T5328] RAX: 0000000000000000 RBX: 0000000000014cef RCX: 00007f1503d8f6c9 [ 85.699391][ T5328] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 85.702624][ T5328] RBP: 00007f1503fe7da0 R08: 0000000000000001 R09: 0000000cf282e91f [ 85.705971][ T5328] R10: 00007f1503bff02c R11: 0000000000000246 R12: 00007f1503fe5fac [ 85.709247][ T5328] R13: 00007f1503fe5fa0 R14: ffffffffffffffff R15: 00007ffdf282e740 [ 85.712764][ T5328] [ 85.714504][ T5328] Kernel Offset: disabled [ 85.716507][ T5328] Rebooting in 86400 seconds..