program: close(0x3) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f00000000c0)={0x42, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x2, 0x2}, 0x10) close(0x3) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x41555856) r2 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000000000008d804dd0000000000000109022400010000a0e5ee944235513f8601000921fffffd012205000905810308000300fdaefa38ce316c3d2d088b0849d907c540397824ac5c9001f3b7aed96394adca487a476754cec8ee9d844da3033be322d25a267ee9f51b15711f1745d7c9114c15ee1bb1aa4be7b2109bc315dec0dd891c3dfa5aeee845c7669ae5a5357c7edff8fee94e953fd7d32845fc07477e049515"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYRESHEX=r1], 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000180), 0x40000000001, 0x482c03) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f0000000580)={0x0, 0xc, 0x1, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000002c0)={'bond_slave_0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYRES16=r7, @ANYRESDEC, @ANYBLOB="0000000000000000140040000000013fd4f8de52260d0717f3de24ac3979d46610da5672668daf40060671c8ebe94b6d1ce66b81637f260fbba7032ab972aa6e705cbe762dc62554a23929daceedeb17d605072eb45cd4302e2b497791dd83cfad06e0cbbcac3e5986940ac4c42d1f84e656a0235a205d"], 0x40}}, 0x10004815) write$binfmt_misc(r5, &(0x7f0000000000), 0xfffffecc) splice(r4, 0x0, r4, 0x0, 0x4ffe6, 0x0) r8 = userfaultfd(0x801) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) r9 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x40502) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r9, 0xc01864cb, &(0x7f0000000140)={0x0, 0x0, 0xfffffffffffffc86, 0x1}) ioctl$UFFDIO_COPY(r8, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00001b1000/0x4000)=nil, 0x400000, 0x2, 0x2}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) pipe(&(0x7f00000001c0)) socket$inet_udp(0x2, 0x2, 0x0) [ 75.043795][ T5294] Bluetooth: hci0: command tx timeout [ 75.343222][ T1360] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 75.493400][ T1360] usb 5-1: Using ep0 maxpacket: 8 [ 75.498873][ T1360] usb 5-1: config 0 has an invalid descriptor of length 238, skipping remainder of the config [ 75.503468][ T1360] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 75.507438][ T1360] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 75.511453][ T1360] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.527783][ T1360] usb 5-1: config 0 descriptor?? [ 76.499869][ T5318] ------------[ cut here ]------------ [ 76.502378][ T5318] 1 [ 76.502390][ T5318] WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x2d1/0x380, CPU#0: syz.0.0/5318 [ 76.509311][ T5318] Modules linked in: [ 76.511056][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.515340][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.520973][ T5318] RIP: 0010:__alloc_frozen_pages_noprof+0x2d1/0x380 [ 76.523980][ T5318] Code: 74 10 4c 89 e7 89 54 24 0c e8 6b 16 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a8 fe ff ff e9 a9 fe ff ff c6 05 7a 9a d9 0d 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 76.534773][ T5318] RSP: 0018:ffffc9000e39f8a0 EFLAGS: 00010246 [ 76.538526][ T5318] RAX: ffffc9000e39f800 RBX: 0000000000000016 RCX: 0000000000000000 [ 76.542858][ T5318] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000e39f908 [ 76.546521][ T5318] RBP: ffffc9000e39f988 R08: ffffc9000e39f907 R09: 0000000000000000 [ 76.550013][ T5318] R10: ffffc9000e39f8e0 R11: fffff52001c73f21 R12: 0000000000000000 [ 76.553587][ T5318] R13: 1ffff92001c73f18 R14: 0000000000040cc0 R15: dffffc0000000000 [ 76.557019][ T5318] FS: 00007fcdbddf36c0(0000) GS:ffff88808cacc000(0000) knlGS:0000000000000000 [ 76.561027][ T5318] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.564060][ T5318] CR2: 00007fcdbddf2ff8 CR3: 000000003d75a000 CR4: 0000000000352ef0 [ 76.567479][ T5318] Call Trace: [ 76.569036][ T5318] [ 76.570339][ T5318] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 76.573473][ T5318] ? __pfx_policy_nodemask+0x10/0x10 [ 76.575907][ T5318] ? kasan_save_track+0x4f/0x80 [ 76.578218][ T5318] ? kasan_save_free_info+0x46/0x50 [ 76.580637][ T5318] ? __kasan_slab_free+0x5c/0x80 [ 76.582935][ T5318] ? kfree+0x1be/0x650 [ 76.584731][ T5318] alloc_pages_mpol+0x232/0x4a0 [ 76.586893][ T5318] ___kmalloc_large_node+0x4e/0x150 [ 76.589172][ T5318] __kmalloc_large_node_noprof+0x18/0x90 [ 76.596382][ T5318] __kmalloc_noprof+0x4b8/0x7e0 [ 76.598684][ T5318] ? drm_syncobj_array_find+0x3a/0x450 [ 76.601081][ T5318] drm_syncobj_array_find+0x3a/0x450 [ 76.603655][ T5318] drm_syncobj_query_ioctl+0x1c3/0xb70 [ 76.605851][ T5318] ? drm_dev_enter+0x49/0x150 [ 76.607865][ T5318] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 76.610441][ T5318] drm_ioctl_kernel+0x2df/0x3b0 [ 76.612421][ T5318] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 76.615271][ T5318] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 76.617774][ T5318] drm_ioctl+0x6ba/0xb80 [ 76.619783][ T5318] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 76.622462][ T5318] ? __pfx_drm_ioctl+0x10/0x10 [ 76.624477][ T5318] ? __fget_files+0x2a/0x420 [ 76.626403][ T5318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 76.628666][ T5318] ? __pfx_drm_ioctl+0x10/0x10 [ 76.630784][ T5318] __se_sys_ioctl+0xfc/0x170 [ 76.632611][ T5318] do_syscall_64+0xe2/0xf80 [ 76.634596][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.637086][ T5318] ? trace_irq_disable+0x37/0x100 [ 76.639056][ T5318] ? clear_bhb_loop+0x60/0xb0 [ 76.640972][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.644307][ T5318] RIP: 0033:0x7fcdc219bf79 [ 76.646373][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.655366][ T5318] RSP: 002b:00007fcdbddf3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.659167][ T5318] RAX: ffffffffffffffda RBX: 00007fcdc2416270 RCX: 00007fcdc219bf79 [ 76.662702][ T5318] RDX: 0000200000000140 RSI: 00000000c01864cb RDI: 000000000000000b [ 76.666361][ T5318] RBP: 00007fcdc22327e0 R08: 0000000000000000 R09: 0000000000000000 [ 76.669860][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.673326][ T5318] R13: 00007fcdc2416308 R14: 00007fcdc2416270 R15: 00007ffd09e07788 [ 76.676730][ T5318] [ 76.678152][ T5318] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 76.681317][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.685159][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.689532][ T5318] Call Trace: [ 76.691139][ T5318] [ 76.692382][ T5318] vpanic+0x1e0/0x670 [ 76.694267][ T5318] panic+0xc5/0xd0 [ 76.696062][ T5318] ? __pfx_panic+0x10/0x10 [ 76.698050][ T5318] __warn+0x315/0x4a0 [ 76.699812][ T5318] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 76.702624][ T5318] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 76.705307][ T5318] __report_bug+0x29a/0x540 [ 76.707457][ T5318] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 76.710179][ T5318] ? __pfx___report_bug+0x10/0x10 [ 76.712356][ T5318] ? is_bpf_text_address+0x26/0x2b0 [ 76.714433][ T5318] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 76.717076][ T5318] report_bug+0x16a/0x220 [ 76.719201][ T5318] ? __alloc_frozen_pages_noprof+0x2d1/0x380 [ 76.722015][ T5318] ? __alloc_frozen_pages_noprof+0x2d3/0x380 [ 76.724591][ T5318] handle_bug+0x98/0x200 [ 76.726386][ T5318] exc_invalid_op+0x1a/0x50 [ 76.728363][ T5318] asm_exc_invalid_op+0x1a/0x20 [ 76.730392][ T5318] RIP: 0010:__alloc_frozen_pages_noprof+0x2d1/0x380 [ 76.733298][ T5318] Code: 74 10 4c 89 e7 89 54 24 0c e8 6b 16 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a8 fe ff ff e9 a9 fe ff ff c6 05 7a 9a d9 0d 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 76.741710][ T5318] RSP: 0018:ffffc9000e39f8a0 EFLAGS: 00010246 [ 76.744434][ T5318] RAX: ffffc9000e39f800 RBX: 0000000000000016 RCX: 0000000000000000 [ 76.748117][ T5318] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000e39f908 [ 76.751731][ T5318] RBP: ffffc9000e39f988 R08: ffffc9000e39f907 R09: 0000000000000000 [ 76.755382][ T5318] R10: ffffc9000e39f8e0 R11: fffff52001c73f21 R12: 0000000000000000 [ 76.758966][ T5318] R13: 1ffff92001c73f18 R14: 0000000000040cc0 R15: dffffc0000000000 [ 76.762337][ T5318] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 76.764661][ T5318] ? __pfx_policy_nodemask+0x10/0x10 [ 76.766449][ T5318] ? kasan_save_track+0x4f/0x80 [ 76.768396][ T5318] ? kasan_save_free_info+0x46/0x50 [ 76.770589][ T5318] ? __kasan_slab_free+0x5c/0x80 [ 76.772656][ T5318] ? kfree+0x1be/0x650 [ 76.774439][ T5318] alloc_pages_mpol+0x232/0x4a0 [ 76.776673][ T5318] ___kmalloc_large_node+0x4e/0x150 [ 76.779078][ T5318] __kmalloc_large_node_noprof+0x18/0x90 [ 76.781659][ T5318] __kmalloc_noprof+0x4b8/0x7e0 [ 76.783892][ T5318] ? drm_syncobj_array_find+0x3a/0x450 [ 76.786399][ T5318] drm_syncobj_array_find+0x3a/0x450 [ 76.788754][ T5318] drm_syncobj_query_ioctl+0x1c3/0xb70 [ 76.791304][ T5318] ? drm_dev_enter+0x49/0x150 [ 76.793338][ T5318] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 76.795739][ T5318] drm_ioctl_kernel+0x2df/0x3b0 [ 76.797732][ T5318] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 76.800718][ T5318] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 76.803185][ T5318] drm_ioctl+0x6ba/0xb80 [ 76.805053][ T5318] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 76.807778][ T5318] ? __pfx_drm_ioctl+0x10/0x10 [ 76.809983][ T5318] ? __fget_files+0x2a/0x420 [ 76.812093][ T5318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 76.814395][ T5318] ? __pfx_drm_ioctl+0x10/0x10 [ 76.816673][ T5318] __se_sys_ioctl+0xfc/0x170 [ 76.818804][ T5318] do_syscall_64+0xe2/0xf80 [ 76.820734][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.823649][ T5318] ? trace_irq_disable+0x37/0x100 [ 76.826571][ T5318] ? clear_bhb_loop+0x60/0xb0 [ 76.829149][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.831807][ T5318] RIP: 0033:0x7fcdc219bf79 [ 76.833828][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.842239][ T5318] RSP: 002b:00007fcdbddf3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.845639][ T5318] RAX: ffffffffffffffda RBX: 00007fcdc2416270 RCX: 00007fcdc219bf79 [ 76.848855][ T5318] RDX: 0000200000000140 RSI: 00000000c01864cb RDI: 000000000000000b [ 76.851993][ T5318] RBP: 00007fcdc22327e0 R08: 0000000000000000 R09: 0000000000000000 [ 76.855151][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.858342][ T5318] R13: 00007fcdc2416308 R14: 00007fcdc2416270 R15: 00007ffd09e07788 [ 76.861636][ T5318] [ 76.863503][ T5318] Kernel Offset: disabled [ 76.865482][ T5318] Rebooting in 86400 seconds..