program: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000680)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f00000008c0)={0x48, 0x2, r1, 0x0, 0x0}) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000940)={0x48, 0x2, r1}) (async, rerun: 64) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, 0x0) (async, rerun: 64) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, 0x0) (async) ioctl$IOMMU_DESTROY$stdev(r0, 0x3b80, &(0x7f00000009c0)={0x8, r2}) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys\x00', 0x1ff) (async, rerun: 32) mount(0x0, &(0x7f00000004c0)='./sys\x00', &(0x7f00000005c0)='sysfs\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000080)={[{@iocharset={'iocharset', 0x3d, 'maccenteuro'}}, {@shortname_lower}, {@shortname_mixed}, {@numtail}, {@utf8no}, {@shortname_win95}, {@rodir}, {@utf8}, {@utf8}, {@utf8}, {@rodir}, {@shortname_mixed}, {@uni_xlateno}, {@shortname_lower}, {@utf8no}, {@uni_xlateno}]}, 0x1, 0x299, &(0x7f0000000140)="$eJzs3c9qY1UYAPDvJjdNMi6ShSsRvKALV8PUJ2iREcSCoGShLnRwMiBNGGghUBXTrnwCd+58HjfiC/gAiju7EK/c3pt/chNaTZvi/H6be/jO+XK+c3L6Z5OTz14dHz99fvrs4utfotNJonEQB3GZRD8aMXMetX7+rT4OANxzl3kev+eldhk6Wx3RWpOZNm69OADgVnyfls/i7/+uawEA7saHH3383uHR0eMPsqwTMf52MkiifJb9h8/iixjFMB5FL/4s/08ole133j16HGlW6Mcb4+lkUGSOP/2xev3DXyOu8vejF/36/P2stJQ/nQxa8aCa/2AUw/d/iF68XJ//1iK/E1V+DPbizdeX6n8Yvfjp83geo3ha1TbL/2Y/y97Ov/vjq0+KaJGfTCeD9nxcNbrZvdN3BgAAAAAAAAAAAAAAAAAAAACA/7OH2Vx/9f6d2cX/G/o33A80Xbqf51GWZXlSjl/kp/FKGuku1w4AAAAAAAAAAAAAAAAAAAD3xenZl8dPRqPhyVYbs4/113TFX6uRdkRc55XbNV3VLOfXKqysJ5rFsx0xSiJutq5WkRYbsqJT1jNs3nDHuhExGp4kaWzvLUjmke5y12tRzlVEumVjKfKfZ+/EVWN2uo6fJDFsbNznTt0h2UIjrzl+zbVZe/+MdKsV1Azubph976V/VXPeW9OVRERrvpmrY65+yB4sDmRru3t4F799AAAAAAAAAAAAAAAAAACAZYsP/dZ0XuygIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYgcX3/9+gMa2S143Jm0UjjSqy4yUCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwAvg7AAD//1KqU90=") (async) io_setup(0x1, &(0x7f0000000400)=0x0) (async) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='net/ip6_tables_names\x00') pread64(r4, &(0x7f0000000500)=""/82, 0x52, 0xd) (async) r5 = eventfd(0x7c35) io_submit(r3, 0x1, &(0x7f0000000880)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x1, 0x8001, r4, &(0x7f0000000780)="05a785d38ba59a6f01b4ff1488d0b63e1b15e49edc5f39bc727120e7d76c77c58c4454a1f753c653ffef02b541ab733ce42fcc5d011b50b0cb5cc1d7848518ed7dc5fe3c01d9313655caefc8192712c304a600377ead99211dccff76e0d0838f94852860aff98d33946706a20d1d5fbfbd209ee8b44a8ab7484b09196b2347ca30a87ff532c515", 0x87, 0x101, 0x0, 0x0, r5}]) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r6, &(0x7f0000000640)='1', 0x1) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pci/rescan\x00', 0x8001, 0x80) write(r7, &(0x7f0000000740)='1', 0x1) [ 94.568252][ T5305] Bluetooth: hci0: command tx timeout [ 94.679622][ T5351] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.683778][ T5352] iommufd_mock iommufd_mock1: Adding to iommu group 12 [ 94.694563][ T5352] iommufd_mock iommufd_mock1: Adding to iommu group 12 [ 94.829991][ T5352] iommufd_mock iommufd_mock1: Adding to iommu group 11 [ 94.847594][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.854565][ T5351] loop0: detected capacity change from 0 to 256 [ 94.866346][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.885447][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.942163][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.944581][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.953432][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.972668][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.982618][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.030381][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.032857][ T5356] Console: switching to colour dummy device 80x25 [ 95.035638][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.082086][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.104835][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.140114][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.172079][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.173981][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.178614][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.220813][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.245190][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.247577][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.290923][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.295036][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.305409][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.323465][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.354559][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.356584][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.365650][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.391840][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.412123][ T5352] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 95.447268][ T5356] ------------[ cut here ]------------ [ 95.447281][ T5356] Memory manager not clean during takedown. [ 95.447286][ T5356] WARNING: drivers/gpu/drm/drm_mm.c:966 at drm_mm_takedown+0x54/0x70, CPU#0: syz.0.0/5356 [ 95.457754][ T5356] Modules linked in: [ 95.459751][ T5356] CPU: 0 UID: 0 PID: 5356 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.463806][ T5356] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.468322][ T5356] RIP: 0010:drm_mm_takedown+0x54/0x70 [ 95.470755][ T5356] Code: 4c 89 f7 e8 5e 63 97 fc 49 8b 06 4c 39 f0 75 0e e8 21 c0 1e fc 5b 41 5e e9 d9 97 5f 06 cc e8 13 c0 1e fc 48 8d 3d ac a2 1f 0c <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f [ 95.479129][ T5356] RSP: 0018:ffffc9000e4ff6f0 EFLAGS: 00010293 [ 95.481760][ T5356] RAX: ffffffff85aa618d RBX: ffff8880362c3468 RCX: ffff888037b08000 [ 95.485161][ T5356] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff91ca0440 [ 95.488956][ T5356] RBP: ffffffff85a91600 R08: ffff888031330280 R09: ffffffff8ca212c0 [ 95.492446][ T5356] R10: dffffc0000000000 R11: ffffffff85a91600 R12: ffff888031330280 [ 95.495758][ T5356] R13: dffffc0000000000 R14: ffff8880362c34a0 R15: dffffc0000000000 [ 95.499319][ T5356] FS: 00007f31f3eb56c0(0000) GS:ffff88808aa01000(0000) knlGS:0000000000000000 [ 95.503280][ T5356] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.505992][ T5356] CR2: 00007f31f3f00150 CR3: 00000000456fe000 CR4: 0000000000352ef0 [ 95.509881][ T5356] Call Trace: [ 95.511379][ T5356] [ 95.512697][ T5356] drm_managed_release+0x208/0x380 [ 95.514957][ T5356] ? __pfx_virtio_gpu_release+0x10/0x10 [ 95.517504][ T5356] drm_dev_put+0xe0/0x120 [ 95.519498][ T5356] virtio_dev_remove+0x9c/0x1b0 [ 95.521625][ T5356] ? __pfx_virtio_dev_remove+0x10/0x10 [ 95.524014][ T5356] device_release_driver_internal+0x42b/0x7d0 [ 95.526534][ T5356] bus_remove_device+0x444/0x560 [ 95.528848][ T5356] ? __pfx_bus_remove_device+0x10/0x10 [ 95.531264][ T5356] ? kernfs_remove_by_name_ns+0x101/0x140 [ 95.533532][ T5356] device_del+0x524/0x8f0 [ 95.535395][ T5356] ? __pfx_device_del+0x10/0x10 [ 95.537621][ T5356] device_unregister+0x21/0xf0 [ 95.539708][ T5356] unregister_virtio_device+0x37/0x60 [ 95.542121][ T5356] virtio_pci_remove+0x7f/0xf0 [ 95.544239][ T5356] pci_device_remove+0x99/0x1c0 [ 95.546459][ T5356] ? __pfx_pci_device_remove+0x10/0x10 [ 95.548790][ T5356] device_release_driver_internal+0x42b/0x7d0 [ 95.551446][ T5356] pci_stop_bus_device+0xf6/0x120 [ 95.553242][ T5356] pci_stop_and_remove_bus_device_locked+0x77/0xb0 [ 95.555828][ T5356] remove_store+0xe5/0x150 [ 95.557759][ T5356] ? __pfx_remove_store+0x10/0x10 [ 95.559957][ T5356] ? sysfs_file_kobj+0x1e4/0x230 [ 95.561978][ T5356] ? sysfs_kf_write+0x166/0x260 [ 95.564060][ T5356] ? __pfx_sysfs_kf_write+0x10/0x10 [ 95.566268][ T5356] kernfs_fop_write_iter+0x3a4/0x540 [ 95.568580][ T5356] vfs_write+0x612/0xba0 [ 95.570313][ T5356] ? __pfx_vfs_write+0x10/0x10 [ 95.572351][ T5356] ? __fget_files+0x3a2/0x420 [ 95.574395][ T5356] ? __fget_files+0x2a/0x420 [ 95.576348][ T5356] ? fdget+0x1ac/0x250 [ 95.578306][ T5356] ksys_write+0x150/0x270 [ 95.580254][ T5356] ? __pfx_ksys_write+0x10/0x10 [ 95.582412][ T5356] do_syscall_64+0x166/0x520 [ 95.584449][ T5356] ? trace_irq_disable+0x3b/0x140 [ 95.586604][ T5356] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.589333][ T5356] ? clear_bhb_loop+0x70/0xc0 [ 95.591376][ T5356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.593901][ T5356] RIP: 0033:0x7f31f2f9f559 [ 95.595819][ T5356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.604464][ T5356] RSP: 002b:00007f31f3eb4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.608436][ T5356] RAX: ffffffffffffffda RBX: 00007f31f3226180 RCX: 00007f31f2f9f559 [ 95.611706][ T5356] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 0000000000000008 [ 95.614841][ T5356] RBP: 00007f31f3036b50 R08: 0000000000000000 R09: 0000000000000000 [ 95.618358][ T5356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.621508][ T5356] R13: 00007f31f3226218 R14: 00007f31f3226180 R15: 00007ffcab1e4df8 [ 95.624674][ T5356] [ 95.626042][ T5356] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.629255][ T5356] CPU: 0 UID: 0 PID: 5356 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.633045][ T5356] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.637253][ T5356] Call Trace: [ 95.638747][ T5356] [ 95.640051][ T5356] vpanic+0x26f/0x710 [ 95.641746][ T5356] panic+0xc5/0xd0 [ 95.643404][ T5356] ? __pfx_panic+0x10/0x10 [ 95.645295][ T5356] __warn+0x315/0x4c0 [ 95.647007][ T5356] ? drm_mm_takedown+0x54/0x70 [ 95.648993][ T5356] ? drm_mm_takedown+0x54/0x70 [ 95.650822][ T5356] __report_bug+0x276/0x570 [ 95.652891][ T5356] ? bus_remove_device+0x444/0x560 [ 95.655147][ T5356] ? device_del+0x524/0x8f0 [ 95.657139][ T5356] ? device_unregister+0x21/0xf0 [ 95.659211][ T5356] ? drm_mm_takedown+0x54/0x70 [ 95.661132][ T5356] ? __pfx___report_bug+0x10/0x10 [ 95.662991][ T5356] report_bug_entry+0x19b/0x290 [ 95.665085][ T5356] ? drm_mm_takedown+0x54/0x70 [ 95.667137][ T5356] ? drm_mm_takedown+0x59/0x70 [ 95.669121][ T5356] handle_bug+0xce/0x200 [ 95.670740][ T5356] exc_invalid_op+0x1a/0x50 [ 95.672499][ T5356] asm_exc_invalid_op+0x1a/0x20 [ 95.674542][ T5356] RIP: 0010:drm_mm_takedown+0x54/0x70 [ 95.676829][ T5356] Code: 4c 89 f7 e8 5e 63 97 fc 49 8b 06 4c 39 f0 75 0e e8 21 c0 1e fc 5b 41 5e e9 d9 97 5f 06 cc e8 13 c0 1e fc 48 8d 3d ac a2 1f 0c <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f [ 95.684764][ T5356] RSP: 0018:ffffc9000e4ff6f0 EFLAGS: 00010293 [ 95.687333][ T5356] RAX: ffffffff85aa618d RBX: ffff8880362c3468 RCX: ffff888037b08000 [ 95.690507][ T5356] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff91ca0440 [ 95.693616][ T5356] RBP: ffffffff85a91600 R08: ffff888031330280 R09: ffffffff8ca212c0 [ 95.696975][ T5356] R10: dffffc0000000000 R11: ffffffff85a91600 R12: ffff888031330280 [ 95.700233][ T5356] R13: dffffc0000000000 R14: ffff8880362c34a0 R15: dffffc0000000000 [ 95.703604][ T5356] ? __pfx_drm_gem_init_release+0x10/0x10 [ 95.706070][ T5356] ? __pfx_drm_gem_init_release+0x10/0x10 [ 95.708398][ T5356] ? drm_mm_takedown+0x4d/0x70 [ 95.710372][ T5356] drm_managed_release+0x208/0x380 [ 95.712444][ T5356] ? __pfx_virtio_gpu_release+0x10/0x10 [ 95.714782][ T5356] drm_dev_put+0xe0/0x120 [ 95.716658][ T5356] virtio_dev_remove+0x9c/0x1b0 [ 95.718639][ T5356] ? __pfx_virtio_dev_remove+0x10/0x10 [ 95.720824][ T5356] device_release_driver_internal+0x42b/0x7d0 [ 95.723248][ T5356] bus_remove_device+0x444/0x560 [ 95.725286][ T5356] ? __pfx_bus_remove_device+0x10/0x10 [ 95.727719][ T5356] ? kernfs_remove_by_name_ns+0x101/0x140 [ 95.730043][ T5356] device_del+0x524/0x8f0 [ 95.731860][ T5356] ? __pfx_device_del+0x10/0x10 [ 95.733845][ T5356] device_unregister+0x21/0xf0 [ 95.735832][ T5356] unregister_virtio_device+0x37/0x60 [ 95.738350][ T5356] virtio_pci_remove+0x7f/0xf0 [ 95.740402][ T5356] pci_device_remove+0x99/0x1c0 [ 95.742452][ T5356] ? __pfx_pci_device_remove+0x10/0x10 [ 95.744793][ T5356] device_release_driver_internal+0x42b/0x7d0 [ 95.747289][ T5356] pci_stop_bus_device+0xf6/0x120 [ 95.749361][ T5356] pci_stop_and_remove_bus_device_locked+0x77/0xb0 [ 95.752022][ T5356] remove_store+0xe5/0x150 [ 95.753779][ T5356] ? __pfx_remove_store+0x10/0x10 [ 95.755903][ T5356] ? sysfs_file_kobj+0x1e4/0x230 [ 95.758076][ T5356] ? sysfs_kf_write+0x166/0x260 [ 95.760246][ T5356] ? __pfx_sysfs_kf_write+0x10/0x10 [ 95.762508][ T5356] kernfs_fop_write_iter+0x3a4/0x540 [ 95.764847][ T5356] vfs_write+0x612/0xba0 [ 95.766665][ T5356] ? __pfx_vfs_write+0x10/0x10 [ 95.768658][ T5356] ? __fget_files+0x3a2/0x420 [ 95.770701][ T5356] ? __fget_files+0x2a/0x420 [ 95.772671][ T5356] ? fdget+0x1ac/0x250 [ 95.774543][ T5356] ksys_write+0x150/0x270 [ 95.776418][ T5356] ? __pfx_ksys_write+0x10/0x10 [ 95.779003][ T5356] do_syscall_64+0x166/0x520 [ 95.781111][ T5356] ? trace_irq_disable+0x3b/0x140 [ 95.783308][ T5356] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.785785][ T5356] ? clear_bhb_loop+0x70/0xc0 [ 95.787537][ T5356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.789919][ T5356] RIP: 0033:0x7f31f2f9f559 [ 95.791831][ T5356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.799596][ T5356] RSP: 002b:00007f31f3eb4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.803152][ T5356] RAX: ffffffffffffffda RBX: 00007f31f3226180 RCX: 00007f31f2f9f559 [ 95.806493][ T5356] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 0000000000000008 [ 95.809917][ T5356] RBP: 00007f31f3036b50 R08: 0000000000000000 R09: 0000000000000000 [ 95.813340][ T5356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.816694][ T5356] R13: 00007f31f3226218 R14: 00007f31f3226180 R15: 00007ffcab1e4df8 [ 95.820385][ T5356] [ 95.822280][ T5356] Kernel Offset: disabled [ 95.824257][ T5356] Rebooting in 86400 seconds..