program: prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_dev$dri(&(0x7f0000000940), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000980), 0x40100001, 0x189002) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f00000009c0)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000a00)={&(0x7f0000000a40)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000b40)={&(0x7f0000000bc0)=[r5], 0x1, r3, r4, 0x3, 0x0, 0xffffffff, 0x804, {0xac7c, 0x1, 0x3, 0x67, 0xb4b, 0x1, 0x2, 0x10, 0x12f, 0xe154, 0x1000, 0x0, 0x6, 0xffffffff, "fe1d00003413000000000020b42717e47f00"}}) [ 92.823861][ T4648] Bluetooth: hci0: command tx timeout [ 92.841662][ T1006] cfg80211: failed to load regulatory.db [ 93.019622][ T1006] [drm:virtio_gpu_dequeue_ctrl_func] *ERROR* response 0x1205 (command 0x103) [ 94.108308][ T5316] [drm:virtio_gpu_dequeue_ctrl_func] *ERROR* response 0x1205 (command 0x103) [ 94.897416][ T4648] Bluetooth: hci0: command tx timeout [ 95.135161][ T1006] ------------[ cut here ]------------ [ 95.135181][ T1006] [CRTC:41:crtc-0] vblank wait timed out [ 95.135215][ T1006] WARNING: drivers/gpu/drm/drm_atomic_helper.c:1928 at drm_atomic_helper_wait_for_vblanks+0x763/0x8f0, CPU#0: kworker/0:3/1006 [ 95.146656][ T1006] Modules linked in: [ 95.149272][ T1006] CPU: 0 UID: 0 PID: 1006 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 95.153418][ T1006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.157787][ T1006] Workqueue: events drm_fb_helper_damage_work [ 95.160233][ T1006] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 95.163264][ T1006] Code: 00 4d 8d 6e 20 45 8b 3f 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 0e 48 89 fb 4c 89 ef e8 07 00 99 fc 48 89 df 49 8b 55 00 44 89 fe <67> 48 0f b9 3a 49 bd 00 00 00 00 00 fc ff df 48 8b 5c 24 50 e9 cc [ 95.171862][ T1006] RSP: 0018:ffffc90005247320 EFLAGS: 00010246 [ 95.174475][ T1006] RAX: 1ffff11006c5800c RBX: dffffc0000000000 RCX: ffff888034812580 [ 95.178326][ T1006] RDX: ffff888000d65040 RSI: 0000000000000029 RDI: ffffffff91867c00 [ 95.183096][ T1006] RBP: ffffc90005247460 R08: ffffffff917a977f R09: 1ffffffff22f52ef [ 95.187097][ T1006] R10: dffffc0000000000 R11: fffffbfff22f52f0 R12: ffff888037901008 [ 95.190673][ T1006] R13: ffff8880362c0060 R14: ffff8880362c0040 R15: 0000000000000029 [ 95.193808][ T1006] FS: 0000000000000000(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000 [ 95.197404][ T1006] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.200083][ T1006] CR2: 000055beee881168 CR3: 0000000013ade000 CR4: 0000000000352ef0 [ 95.203364][ T1006] Call Trace: [ 95.205066][ T1006] [ 95.206428][ T1006] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 95.209636][ T1006] ? __pfx_autoremove_wake_function+0x10/0x10 [ 95.212959][ T1006] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.217400][ T1006] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 95.220252][ T1006] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 95.222813][ T1006] commit_tail+0x2b1/0x3c0 [ 95.224772][ T1006] drm_atomic_helper_commit+0xa77/0xb10 [ 95.227126][ T1006] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 95.229633][ T1006] drm_atomic_commit+0x24e/0x2b0 [ 95.231776][ T1006] ? __pfx_drm_atomic_commit+0x10/0x10 [ 95.234077][ T1006] ? __pfx___drm_printfn_info+0x10/0x10 [ 95.236553][ T1006] ? drm_modeset_unlock+0x38/0x100 [ 95.238679][ T1006] drm_atomic_helper_dirtyfb+0xe2f/0xfd0 [ 95.240987][ T1006] ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10 [ 95.243692][ T1006] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.245922][ T1006] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 95.248547][ T1006] drm_fb_helper_damage_work+0x84c/0xf20 [ 95.251082][ T1006] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 95.253725][ T1006] ? lock_acquire+0x115/0x350 [ 95.255874][ T1006] ? rcu_is_watching+0x16/0xb0 [ 95.257821][ T1006] ? process_scheduled_works+0x97a/0x1630 [ 95.262793][ T1006] process_scheduled_works+0xc3d/0x1630 [ 95.265378][ T1006] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.267986][ T1006] ? assign_work+0x3cf/0x5d0 [ 95.270011][ T1006] worker_thread+0xa47/0xfb0 [ 95.271952][ T1006] ? __kthread_parkme+0x71/0x1f0 [ 95.273930][ T1006] kthread+0x38b/0x480 [ 95.275831][ T1006] ? __pfx_worker_thread+0x10/0x10 [ 95.277983][ T1006] ? __pfx_kthread+0x10/0x10 [ 95.280088][ T1006] ret_from_fork+0x514/0xb70 [ 95.282161][ T1006] ? __pfx_ret_from_fork+0x10/0x10 [ 95.286093][ T1006] ? __switch_to+0xc89/0x1420 [ 95.288239][ T1006] ? __pfx_kthread+0x10/0x10 [ 95.290343][ T1006] ret_from_fork_asm+0x1a/0x30 [ 95.292456][ T1006] [ 95.293917][ T1006] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.296867][ T1006] CPU: 0 UID: 0 PID: 1006 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 95.300876][ T1006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.305229][ T1006] Workqueue: events drm_fb_helper_damage_work [ 95.308437][ T1006] Call Trace: [ 95.309909][ T1006] [ 95.311176][ T1006] vpanic+0x56d/0xa60 [ 95.312826][ T1006] ? __pfx__printk+0x10/0x10 [ 95.314844][ T1006] ? __pfx_vpanic+0x10/0x10 [ 95.316809][ T1006] ? is_bpf_text_address+0x292/0x2b0 [ 95.318870][ T1006] ? is_bpf_text_address+0x26/0x2b0 [ 95.321315][ T1006] panic+0xc5/0xd0 [ 95.323025][ T1006] ? __pfx_panic+0x10/0x10 [ 95.325063][ T1006] ? ret_from_fork_asm+0x1a/0x30 [ 95.327216][ T1006] __warn+0x315/0x4c0 [ 95.328966][ T1006] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 95.331752][ T1006] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 95.334536][ T1006] __report_bug+0x276/0x570 [ 95.336943][ T1006] ? drm_atomic_helper_wait_for_vblanks+0x763/0x8f0 [ 95.339865][ T1006] ? __pfx___report_bug+0x10/0x10 [ 95.342021][ T1006] report_bug_entry+0x19b/0x290 [ 95.344082][ T1006] ? drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 95.346869][ T1006] ? drm_atomic_helper_wait_for_vblanks+0x7a8/0x8f0 [ 95.349559][ T1006] handle_bug+0xce/0x200 [ 95.351379][ T1006] exc_invalid_op+0x1a/0x50 [ 95.353370][ T1006] asm_exc_invalid_op+0x1a/0x20 [ 95.355401][ T1006] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x7a3/0x8f0 [ 95.358581][ T1006] Code: 00 4d 8d 6e 20 45 8b 3f 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 0e 48 89 fb 4c 89 ef e8 07 00 99 fc 48 89 df 49 8b 55 00 44 89 fe <67> 48 0f b9 3a 49 bd 00 00 00 00 00 fc ff df 48 8b 5c 24 50 e9 cc [ 95.366884][ T1006] RSP: 0018:ffffc90005247320 EFLAGS: 00010246 [ 95.369457][ T1006] RAX: 1ffff11006c5800c RBX: dffffc0000000000 RCX: ffff888034812580 [ 95.372763][ T1006] RDX: ffff888000d65040 RSI: 0000000000000029 RDI: ffffffff91867c00 [ 95.376291][ T1006] RBP: ffffc90005247460 R08: ffffffff917a977f R09: 1ffffffff22f52ef [ 95.379829][ T1006] R10: dffffc0000000000 R11: fffffbfff22f52f0 R12: ffff888037901008 [ 95.383383][ T1006] R13: ffff8880362c0060 R14: ffff8880362c0040 R15: 0000000000000029 [ 95.386942][ T1006] ? __pfx_drm_atomic_helper_wait_for_vblanks+0x10/0x10 [ 95.390086][ T1006] ? __pfx_autoremove_wake_function+0x10/0x10 [ 95.392857][ T1006] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 95.395490][ T1006] ? drm_atomic_helper_commit_hw_done+0x3da/0x410 [ 95.398376][ T1006] drm_atomic_helper_commit_tail+0x2e9/0x510 [ 95.401037][ T1006] commit_tail+0x2b1/0x3c0 [ 95.403113][ T1006] drm_atomic_helper_commit+0xa77/0xb10 [ 95.405521][ T1006] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 95.408221][ T1006] drm_atomic_commit+0x24e/0x2b0 [ 95.410451][ T1006] ? __pfx_drm_atomic_commit+0x10/0x10 [ 95.412919][ T1006] ? __pfx___drm_printfn_info+0x10/0x10 [ 95.415780][ T1006] ? drm_modeset_unlock+0x38/0x100 [ 95.418230][ T1006] drm_atomic_helper_dirtyfb+0xe2f/0xfd0 [ 95.420712][ T1006] ? __pfx_drm_atomic_helper_dirtyfb+0x10/0x10 [ 95.423483][ T1006] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.425684][ T1006] drm_fbdev_shmem_helper_fb_dirty+0x160/0x310 [ 95.428450][ T1006] drm_fb_helper_damage_work+0x84c/0xf20 [ 95.430963][ T1006] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 95.433690][ T1006] ? lock_acquire+0x115/0x350 [ 95.435770][ T1006] ? rcu_is_watching+0x16/0xb0 [ 95.437799][ T1006] ? process_scheduled_works+0x97a/0x1630 [ 95.440279][ T1006] process_scheduled_works+0xc3d/0x1630 [ 95.442658][ T1006] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.445187][ T1006] ? assign_work+0x3cf/0x5d0 [ 95.447202][ T1006] worker_thread+0xa47/0xfb0 [ 95.449176][ T1006] ? __kthread_parkme+0x71/0x1f0 [ 95.451381][ T1006] kthread+0x38b/0x480 [ 95.453156][ T1006] ? __pfx_worker_thread+0x10/0x10 [ 95.457951][ T1006] ? __pfx_kthread+0x10/0x10 [ 95.460075][ T1006] ret_from_fork+0x514/0xb70 [ 95.462038][ T1006] ? __pfx_ret_from_fork+0x10/0x10 [ 95.464245][ T1006] ? __switch_to+0xc89/0x1420 [ 95.466238][ T1006] ? __pfx_kthread+0x10/0x10 [ 95.468101][ T1006] ret_from_fork_asm+0x1a/0x30 [ 95.470608][ T1006] [ 95.472348][ T1006] Kernel Offset: disabled [ 95.474175][ T1006] Rebooting in 86400 seconds..