program: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r3, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r4, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000280)={r3, 0x0, 0x0, 0x0, 0x0, [0x0], [], [0x0, 0x0, 0x8, 0x8000], [0x0, 0x3, 0x400000006]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000100)={r6}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000340)={r3, 0x0, 0x0, 0x0, 0x0, [0x0], [0xffffffff], [], [0xfffffffffffffffc]}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c64d2, &(0x7f0000000040)={r7}) [ 84.765258][ T5307] Bluetooth: hci0: command tx timeout [ 84.843837][ T5327] ------------[ cut here ]------------ [ 84.846225][ T5327] WARNING: CPU: 0 PID: 5327 at drivers/gpu/drm/drm_prime.c:223 drm_prime_destroy_file_private+0x4b/0x60 [ 84.850946][ T5327] Modules linked in: [ 84.852246][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 84.855617][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 84.859988][ T5327] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 84.862690][ T5327] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 bd 57 f2 fc 48 83 3b 00 75 0c e8 52 0b 8b fc 5b e9 3c 4c 16 06 cc e8 46 0b 8b fc 90 <0f> 0b 90 5b c3 cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 84.870689][ T5327] RSP: 0018:ffffc9000ec5fc60 EFLAGS: 00010293 [ 84.873192][ T5327] RAX: ffffffff8535086a RBX: ffff88803d3c9410 RCX: ffff888000712480 [ 84.876432][ T5327] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88803d3c9380 [ 84.879880][ T5327] RBP: ffff88803d3c92c8 R08: ffffc9000ec5fbe7 R09: 1ffff92001d8bf7c [ 84.883089][ T5327] R10: dffffc0000000000 R11: fffff52001d8bf7d R12: dffffc0000000000 [ 84.886345][ T5327] R13: dead000000000100 R14: 0000000000000000 R15: ffff88803d3c92d8 [ 84.889664][ T5327] FS: 0000555586e4c500(0000) GS:ffff88808d730000(0000) knlGS:0000000000000000 [ 84.893408][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 84.896224][ T5327] CR2: 00007f4491fd4318 CR3: 0000000041cae000 CR4: 0000000000352ef0 [ 84.899551][ T5327] Call Trace: [ 84.901111][ T5327] [ 84.902433][ T5327] drm_file_free+0x7f2/0xa00 [ 84.904489][ T5327] drm_release+0x2de/0x3f0 [ 84.906514][ T5327] ? __pfx_drm_release+0x10/0x10 [ 84.908726][ T5327] __fput+0x44c/0xa70 [ 84.910640][ T5327] task_work_run+0x1d4/0x260 [ 84.912783][ T5327] ? __pfx_task_work_run+0x10/0x10 [ 84.915081][ T5327] ? exit_to_user_mode_loop+0x40/0x130 [ 84.917516][ T5327] exit_to_user_mode_loop+0xe9/0x130 [ 84.920251][ T5327] do_syscall_64+0x2bd/0xfa0 [ 84.922360][ T5327] ? lockdep_hardirqs_on+0x9c/0x150 [ 84.924708][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.927328][ T5327] ? clear_bhb_loop+0x60/0xb0 [ 84.929307][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.932242][ T5327] RIP: 0033:0x7f4491d8f6c9 [ 84.934182][ T5327] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 84.942277][ T5327] RSP: 002b:00007ffd4b1fcea8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 84.945497][ T5327] RAX: 0000000000000000 RBX: 0000000000014aba RCX: 00007f4491d8f6c9 [ 84.948825][ T5327] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 84.952459][ T5327] RBP: 00007f4491fe7da0 R08: 0000000000000001 R09: 0000000c4b1fd19f [ 84.955601][ T5327] R10: 00007f4491bff02c R11: 0000000000000246 R12: 00007f4491fe5fac [ 84.958714][ T5327] R13: 00007f4491fe5fa0 R14: ffffffffffffffff R15: 00007ffd4b1fcfc0 [ 84.962143][ T5327] [ 84.963340][ T5327] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 84.965855][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 84.969442][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 84.973874][ T5327] Call Trace: [ 84.975272][ T5327] [ 84.976437][ T5327] dump_stack_lvl+0x99/0x250 [ 84.978371][ T5327] ? __asan_memcpy+0x40/0x70 [ 84.980302][ T5327] ? __pfx_dump_stack_lvl+0x10/0x10 [ 84.982562][ T5327] ? __pfx__printk+0x10/0x10 [ 84.984596][ T5327] vpanic+0x237/0x6d0 [ 84.986263][ T5327] ? __pfx_vpanic+0x10/0x10 [ 84.988152][ T5327] panic+0xb9/0xc0 [ 84.989720][ T5327] ? __pfx_panic+0x10/0x10 [ 84.991561][ T5327] __warn+0x31b/0x4b0 [ 84.993204][ T5327] ? drm_prime_destroy_file_private+0x4b/0x60 [ 84.995576][ T5327] ? drm_prime_destroy_file_private+0x4b/0x60 [ 84.998172][ T5327] report_bug+0x2be/0x4f0 [ 85.000017][ T5327] ? drm_prime_destroy_file_private+0x4b/0x60 [ 85.002515][ T5327] ? drm_prime_destroy_file_private+0x4b/0x60 [ 85.005099][ T5327] ? drm_prime_destroy_file_private+0x4d/0x60 [ 85.007631][ T5327] handle_bug+0x84/0x160 [ 85.009359][ T5327] exc_invalid_op+0x1a/0x50 [ 85.011285][ T5327] asm_exc_invalid_op+0x1a/0x20 [ 85.013368][ T5327] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 85.016151][ T5327] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 bd 57 f2 fc 48 83 3b 00 75 0c e8 52 0b 8b fc 5b e9 3c 4c 16 06 cc e8 46 0b 8b fc 90 <0f> 0b 90 5b c3 cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 85.023816][ T5327] RSP: 0018:ffffc9000ec5fc60 EFLAGS: 00010293 [ 85.026409][ T5327] RAX: ffffffff8535086a RBX: ffff88803d3c9410 RCX: ffff888000712480 [ 85.029761][ T5327] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88803d3c9380 [ 85.033196][ T5327] RBP: ffff88803d3c92c8 R08: ffffc9000ec5fbe7 R09: 1ffff92001d8bf7c [ 85.036733][ T5327] R10: dffffc0000000000 R11: fffff52001d8bf7d R12: dffffc0000000000 [ 85.040111][ T5327] R13: dead000000000100 R14: 0000000000000000 R15: ffff88803d3c92d8 [ 85.043500][ T5327] ? drm_prime_destroy_file_private+0x4a/0x60 [ 85.046204][ T5327] drm_file_free+0x7f2/0xa00 [ 85.048349][ T5327] drm_release+0x2de/0x3f0 [ 85.050440][ T5327] ? __pfx_drm_release+0x10/0x10 [ 85.052384][ T5327] __fput+0x44c/0xa70 [ 85.054167][ T5327] task_work_run+0x1d4/0x260 [ 85.056254][ T5327] ? __pfx_task_work_run+0x10/0x10 [ 85.058499][ T5327] ? exit_to_user_mode_loop+0x40/0x130 [ 85.060783][ T5327] exit_to_user_mode_loop+0xe9/0x130 [ 85.062920][ T5327] do_syscall_64+0x2bd/0xfa0 [ 85.064944][ T5327] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.067367][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.070097][ T5327] ? clear_bhb_loop+0x60/0xb0 [ 85.072196][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.074659][ T5327] RIP: 0033:0x7f4491d8f6c9 [ 85.076418][ T5327] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.084317][ T5327] RSP: 002b:00007ffd4b1fcea8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 85.087468][ T5327] RAX: 0000000000000000 RBX: 0000000000014aba RCX: 00007f4491d8f6c9 [ 85.090617][ T5327] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 85.093632][ T5327] RBP: 00007f4491fe7da0 R08: 0000000000000001 R09: 0000000c4b1fd19f [ 85.097047][ T5327] R10: 00007f4491bff02c R11: 0000000000000246 R12: 00007f4491fe5fac [ 85.100225][ T5327] R13: 00007f4491fe5fa0 R14: ffffffffffffffff R15: 00007ffd4b1fcfc0 [ 85.103617][ T5327] [ 85.105168][ T5327] Kernel Offset: disabled [ 85.107007][ T5327] Rebooting in 86400 seconds..