program: r0 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000065c0)={0x4c, 0x2, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x4c}}, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8001}, 0x8040) r3 = syz_open_dev$dri(&(0x7f0000000240), 0x2, 0xc8903) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f0000000000)={0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000001c0001f0ffffffffffffff0007000000", @ANYBLOB="ca50c3ae35a6491d3ba1d614a9cd45ee230b6d3e82ce418bc7c369e9ea0153f8f13f3a76d87c072127ac", @ANYBLOB="7fb664af0a000200aaaaaaaaaa0c"], 0x28}, 0x1, 0x0, 0x0, 0x699d6b8bb1bfedb2}, 0x1) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) r9 = fanotify_init(0x8, 0x40000) fanotify_mark(r9, 0x90, 0x8100012, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@delneigh={0x30, 0x1d, 0x2cb9fc920827cc0b, 0x70bd27, 0x25dfdbfe, {0x7, 0x0, 0x0, r10}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, @NDA_VLAN={0x6, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r3, 0xc01864cd, &(0x7f0000000180)={&(0x7f0000000080)=[r4, r4], &(0x7f0000000140)=[0x80], 0x2}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r3, 0xc03064ca, &(0x7f00000000c0)={&(0x7f0000000040)=[r4], &(0x7f0000000100)=[0xd], 0xfffffffffffeffff, 0x1, 0xb}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000000)={&(0x7f00000001c0), 0x0, 0x3ffffe06}) [ 109.478618][ T5290] Bluetooth: hci0: command tx timeout [ 109.586226][ T5330] ------------[ cut here ]------------ [ 109.588716][ T5330] 1 [ 109.588730][ T5330] WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2ce/0x380, CPU#0: syz.0.0/5330 [ 109.594678][ T5330] Modules linked in: [ 109.596298][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 109.599549][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.603828][ T5330] RIP: 0010:__alloc_frozen_pages_noprof+0x2ce/0x380 [ 109.607369][ T5330] Code: 74 10 4c 89 e7 89 54 24 0c e8 4e 2c 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 ab fe ff ff e9 ac fe ff ff c6 05 77 9c 19 0e 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 109.615282][ T5330] RSP: 0018:ffffc9000fbdf920 EFLAGS: 00010246 [ 109.618301][ T5330] RAX: ffffc9000fbdf900 RBX: 0000000000000014 RCX: 0000000000000000 [ 109.621999][ T5330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000fbdf988 [ 109.625792][ T5330] RBP: ffffc9000fbdfa08 R08: ffffc9000fbdf987 R09: 0000000000000000 [ 109.629802][ T5330] R10: ffffc9000fbdf960 R11: fffff52001f7bf31 R12: 0000000000000000 [ 109.633549][ T5330] R13: 1ffff92001f7bf28 R14: 0000000000040cc0 R15: dffffc0000000000 [ 109.637288][ T5330] FS: 00007faf80d846c0(0000) GS:ffff88808c551000(0000) knlGS:0000000000000000 [ 109.641794][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.645215][ T5330] CR2: 00002000000065c0 CR3: 0000000000846000 CR4: 0000000000352ef0 [ 109.648808][ T5330] Call Trace: [ 109.650837][ T5330] [ 109.652851][ T5330] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 109.656029][ T5330] ? __pfx_policy_nodemask+0x10/0x10 [ 109.658355][ T5330] alloc_pages_mpol+0x212/0x380 [ 109.660419][ T5330] ___kmalloc_large_node+0x4c/0x120 [ 109.662802][ T5330] ? drm_syncobj_array_find+0x3a/0x440 [ 109.665658][ T5330] __kmalloc_large_node_noprof+0x18/0x90 [ 109.668745][ T5330] ? drm_syncobj_array_find+0x3a/0x440 [ 109.671696][ T5330] __kmalloc_noprof+0x405/0x720 [ 109.673861][ T5330] ? drm_syncobj_array_find+0x3a/0x440 [ 109.676426][ T5330] drm_syncobj_array_find+0x3a/0x440 [ 109.678701][ T5330] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 109.681377][ T5330] drm_ioctl_kernel+0x2df/0x3b0 [ 109.684045][ T5330] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 109.687705][ T5330] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 109.690079][ T5330] drm_ioctl+0x70e/0xba0 [ 109.691908][ T5330] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 109.694971][ T5330] ? __pfx_drm_ioctl+0x10/0x10 [ 109.697481][ T5330] ? __fget_files+0x2a/0x420 [ 109.699828][ T5330] ? bpf_lsm_file_ioctl+0x9/0x20 [ 109.702180][ T5330] ? __pfx_drm_ioctl+0x10/0x10 [ 109.704595][ T5330] __se_sys_ioctl+0xfc/0x170 [ 109.706691][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.709788][ T5330] do_syscall_64+0x174/0x580 [ 109.711935][ T5330] ? clear_bhb_loop+0x40/0x90 [ 109.714068][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.717385][ T5330] RIP: 0033:0x7faf7ff9de59 [ 109.719466][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.728899][ T5330] RSP: 002b:00007faf80d83fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 109.732448][ T5330] RAX: ffffffffffffffda RBX: 00007faf80225fa0 RCX: 00007faf7ff9de59 [ 109.736281][ T5330] RDX: 0000200000000000 RSI: 00000000c01864cd RDI: 0000000000000003 [ 109.740594][ T5330] RBP: 00007faf80033e6f R08: 0000000000000000 R09: 0000000000000000 [ 109.744498][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.747931][ T5330] R13: 00007faf80226038 R14: 00007faf80225fa0 R15: 00007ffecd8f5368 [ 109.752017][ T5330] [ 109.754386][ T5330] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 109.757735][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 109.761583][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.765955][ T5330] Call Trace: [ 109.767610][ T5330] [ 109.769211][ T5330] vpanic+0x56c/0xa60 [ 109.771361][ T5330] ? __pfx__printk+0x10/0x10 [ 109.773506][ T5330] ? __pfx_vpanic+0x10/0x10 [ 109.775503][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 109.777726][ T5330] ? is_bpf_text_address+0x26/0x2b0 [ 109.779931][ T5330] panic+0xc5/0xd0 [ 109.781740][ T5330] ? __pfx_panic+0x10/0x10 [ 109.784208][ T5330] __warn+0x315/0x4c0 [ 109.786306][ T5330] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 109.788857][ T5330] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 109.791493][ T5330] __report_bug+0x331/0x530 [ 109.793700][ T5330] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 109.796827][ T5330] ? __pfx___report_bug+0x10/0x10 [ 109.798986][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 109.801269][ T5330] ? is_bpf_text_address+0x26/0x2b0 [ 109.803497][ T5330] ? kernel_text_address+0xa5/0xe0 [ 109.806101][ T5330] ? __kernel_text_address+0xd/0x30 [ 109.808824][ T5330] ? unwind_get_return_address+0x4d/0x90 [ 109.811379][ T5330] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 109.814143][ T5330] report_bug+0x16a/0x220 [ 109.816054][ T5330] ? __alloc_frozen_pages_noprof+0x2ce/0x380 [ 109.818722][ T5330] ? __alloc_frozen_pages_noprof+0x2d0/0x380 [ 109.821725][ T5330] handle_bug+0x9c/0x200 [ 109.823830][ T5330] exc_invalid_op+0x1a/0x50 [ 109.825845][ T5330] asm_exc_invalid_op+0x1a/0x20 [ 109.827877][ T5330] RIP: 0010:__alloc_frozen_pages_noprof+0x2ce/0x380 [ 109.830951][ T5330] Code: 74 10 4c 89 e7 89 54 24 0c e8 4e 2c 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 ab fe ff ff e9 ac fe ff ff c6 05 77 9c 19 0e 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 109.839432][ T5330] RSP: 0018:ffffc9000fbdf920 EFLAGS: 00010246 [ 109.841896][ T5330] RAX: ffffc9000fbdf900 RBX: 0000000000000014 RCX: 0000000000000000 [ 109.845614][ T5330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000fbdf988 [ 109.849571][ T5330] RBP: ffffc9000fbdfa08 R08: ffffc9000fbdf987 R09: 0000000000000000 [ 109.852896][ T5330] R10: ffffc9000fbdf960 R11: fffff52001f7bf31 R12: 0000000000000000 [ 109.856383][ T5330] R13: 1ffff92001f7bf28 R14: 0000000000040cc0 R15: dffffc0000000000 [ 109.860447][ T5330] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 109.863581][ T5330] ? __pfx_policy_nodemask+0x10/0x10 [ 109.865997][ T5330] alloc_pages_mpol+0x212/0x380 [ 109.868217][ T5330] ___kmalloc_large_node+0x4c/0x120 [ 109.870680][ T5330] ? drm_syncobj_array_find+0x3a/0x440 [ 109.873437][ T5330] __kmalloc_large_node_noprof+0x18/0x90 [ 109.876033][ T5330] ? drm_syncobj_array_find+0x3a/0x440 [ 109.878378][ T5330] __kmalloc_noprof+0x405/0x720 [ 109.880512][ T5330] ? drm_syncobj_array_find+0x3a/0x440 [ 109.884082][ T5330] drm_syncobj_array_find+0x3a/0x440 [ 109.886732][ T5330] drm_syncobj_timeline_signal_ioctl+0x167/0x8a0 [ 109.889518][ T5330] drm_ioctl_kernel+0x2df/0x3b0 [ 109.891699][ T5330] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 109.895335][ T5330] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 109.897880][ T5330] drm_ioctl+0x70e/0xba0 [ 109.899708][ T5330] ? __pfx_drm_syncobj_timeline_signal_ioctl+0x10/0x10 [ 109.902741][ T5330] ? __pfx_drm_ioctl+0x10/0x10 [ 109.905089][ T5330] ? __fget_files+0x2a/0x420 [ 109.907545][ T5330] ? bpf_lsm_file_ioctl+0x9/0x20 [ 109.910066][ T5330] ? __pfx_drm_ioctl+0x10/0x10 [ 109.912124][ T5330] __se_sys_ioctl+0xfc/0x170 [ 109.914192][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.916971][ T5330] do_syscall_64+0x174/0x580 [ 109.919326][ T5330] ? clear_bhb_loop+0x40/0x90 [ 109.921669][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.924213][ T5330] RIP: 0033:0x7faf7ff9de59 [ 109.926180][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.935301][ T5330] RSP: 002b:00007faf80d83fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 109.938904][ T5330] RAX: ffffffffffffffda RBX: 00007faf80225fa0 RCX: 00007faf7ff9de59 [ 109.942891][ T5330] RDX: 0000200000000000 RSI: 00000000c01864cd RDI: 0000000000000003 [ 109.946541][ T5330] RBP: 00007faf80033e6f R08: 0000000000000000 R09: 0000000000000000 [ 109.950171][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.954098][ T5330] R13: 00007faf80226038 R14: 00007faf80225fa0 R15: 00007ffecd8f5368 [ 109.957736][ T5330] [ 109.959523][ T5330] Kernel Offset: disabled [ 109.961523][ T5330] Rebooting in 86400 seconds..