program: r0 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mtd(0x0, 0x0, 0x8000) sendmsg$sock(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000a00)="54000000100001040000000000000000000000000000000000000000000000000f00030073797a6b616c6c6572300000240012000a00010076786c616e00000014000200080001007b000000080002007f000001", 0x54}], 0x1}, 0x0) r1 = socket$inet(0x2, 0x2, 0x8000000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x4) mount$bind(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f0000000380)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000003c0)='.\x00', &(0x7f0000000400)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f0000000480)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mount$bind(0x0, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000540)='./file0/file0\x00', &(0x7f0000000580)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f00000005c0)='\x00', 0x89901) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000006c0)={0x4, &(0x7f0000000000)=[{0x7, 0x8, 0x5, 0x8}, {0x2, 0x6, 0x5, 0x101}, {0x5b1, 0xf, 0xa, 0x5}, {0x0, 0x6, 0x3, 0x9}]}) move_mount(r3, &(0x7f0000000600)='.\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00', 0x200) mkdir(&(0x7f0000000080)='./sys\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1ff, 0x0) write(r4, &(0x7f00000001c0)='1', 0x1) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000200)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=@bridge_newneigh={0x3c, 0x1c, 0xe37, 0x70bd2c, 0x0, {0x7, 0x0, 0x0, r2, 0x10, 0x2, 0xa}, [@NDA_LLADDR={0xa, 0x2, @random="8daa196a5230"}, @NDA_DST_IPV6={0x14, 0x1, @mcast2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x200008a4}, 0x4000040) [ 102.515279][ T4665] Bluetooth: hci0: command tx timeout [ 102.785391][ T5350] Console: switching to colour dummy device 80x25 [ 102.901731][ T1029] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0 [ 102.901753][ T1029] ata1.00: irq_stat 0x40000000 [ 102.901765][ T1029] ata1.00: failed command: WRITE DMA EXT [ 102.901771][ T1029] ata1.00: cmd 35/00:88:be:11:08/00:09:00:00:00/e0 tag 30 dma 1249280 out [ 102.901771][ T1029] res 41/04:88:be:11:08/00:09:00:00:00/e0 Emask 0x1 (device error) [ 102.901798][ T1029] ata1.00: status: { DRDY ERR } [ 102.901806][ T1029] ata1.00: error: { ABRT } [ 102.902782][ T1029] ata1.00: configured for UDMA/100 [ 102.902851][ T1029] ata1: EH complete [ 103.062183][ T5350] ------------[ cut here ]------------ [ 103.062192][ T5350] Memory manager not clean during takedown. [ 103.062196][ T5350] WARNING: drivers/gpu/drm/drm_mm.c:966 at drm_mm_takedown+0x54/0x70, CPU#0: syz.0.0/5350 [ 103.072228][ T5350] Modules linked in: [ 103.074380][ T5350] CPU: 0 UID: 0 PID: 5350 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.078397][ T5350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.083014][ T5350] RIP: 0010:drm_mm_takedown+0x54/0x70 [ 103.085223][ T5350] Code: 4c 89 f7 e8 ee 6a 97 fc 49 8b 06 4c 39 f0 75 0e e8 b1 c7 1e fc 5b 41 5e e9 d9 8f 5f 06 cc e8 a3 c7 1e fc 48 8d 3d ac 9e 1f 0c <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f [ 103.093473][ T5350] RSP: 0018:ffffc9000f7b76f0 EFLAGS: 00010283 [ 103.096050][ T5350] RAX: ffffffff85aa598d RBX: ffff888036562468 RCX: 0000000000100000 [ 103.099285][ T5350] RDX: ffffc9000ef4a000 RSI: 00000000000143f7 RDI: ffffffff91c9f840 [ 103.102613][ T5350] RBP: ffffffff85a90e00 R08: ffff8880316d2780 R09: ffffffff8ca211c0 [ 103.106088][ T5350] R10: dffffc0000000000 R11: ffffffff85a90e00 R12: ffff8880316d2780 [ 103.109180][ T5350] R13: dffffc0000000000 R14: ffff8880365624a0 R15: dffffc0000000000 [ 103.112668][ T5350] FS: 00007fb39b14e6c0(0000) GS:ffff88808aa01000(0000) knlGS:0000000000000000 [ 103.116154][ T5350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.118829][ T5350] CR2: 00007f3e1d97d2c0 CR3: 0000000040822000 CR4: 0000000000352ef0 [ 103.123636][ T5350] Call Trace: [ 103.125103][ T5350] [ 103.126350][ T5350] drm_managed_release+0x208/0x380 [ 103.128415][ T5350] ? __pfx_virtio_gpu_release+0x10/0x10 [ 103.130601][ T5350] drm_dev_put+0xe0/0x120 [ 103.133587][ T5350] virtio_dev_remove+0x9c/0x1b0 [ 103.135828][ T5350] ? __pfx_virtio_dev_remove+0x10/0x10 [ 103.138158][ T5350] device_release_driver_internal+0x42b/0x7d0 [ 103.140679][ T5350] bus_remove_device+0x444/0x560 [ 103.142873][ T5350] ? __pfx_bus_remove_device+0x10/0x10 [ 103.145209][ T5350] ? kernfs_remove_by_name_ns+0x101/0x140 [ 103.147766][ T5350] device_del+0x524/0x8f0 [ 103.149617][ T5350] ? __pfx_device_del+0x10/0x10 [ 103.152371][ T5350] device_unregister+0x21/0xf0 [ 103.154418][ T5350] unregister_virtio_device+0x37/0x60 [ 103.156680][ T5350] virtio_pci_remove+0x7f/0xf0 [ 103.158694][ T5350] pci_device_remove+0x99/0x1c0 [ 103.160866][ T5350] ? __pfx_pci_device_remove+0x10/0x10 [ 103.163238][ T5350] device_release_driver_internal+0x42b/0x7d0 [ 103.167183][ T5350] pci_stop_bus_device+0xf6/0x120 [ 103.169694][ T5350] pci_stop_and_remove_bus_device_locked+0x77/0xb0 [ 103.172832][ T5350] remove_store+0xe5/0x150 [ 103.174848][ T5350] ? __pfx_remove_store+0x10/0x10 [ 103.177029][ T5350] ? sysfs_file_kobj+0x1e4/0x230 [ 103.179188][ T5350] ? sysfs_kf_write+0x166/0x260 [ 103.181471][ T5350] ? __pfx_sysfs_kf_write+0x10/0x10 [ 103.183648][ T5350] kernfs_fop_write_iter+0x3a4/0x540 [ 103.185715][ T5350] vfs_write+0x612/0xba0 [ 103.187536][ T5350] ? __pfx_vfs_write+0x10/0x10 [ 103.189509][ T5350] ? __fget_files+0x3a2/0x420 [ 103.191513][ T5350] ? __fget_files+0x2a/0x420 [ 103.193341][ T5350] ? fdget+0x1ac/0x250 [ 103.195009][ T5350] ksys_write+0x150/0x270 [ 103.196875][ T5350] ? __pfx_ksys_write+0x10/0x10 [ 103.198935][ T5350] do_syscall_64+0x166/0x520 [ 103.201287][ T5350] ? trace_irq_disable+0x3b/0x140 [ 103.203398][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.206232][ T5350] ? clear_bhb_loop+0x70/0xc0 [ 103.208173][ T5350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.210419][ T5350] RIP: 0033:0x7fb39a19f559 [ 103.213051][ T5350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.221737][ T5350] RSP: 002b:00007fb39b14dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.225708][ T5350] RAX: ffffffffffffffda RBX: 00007fb39a425fa0 RCX: 00007fb39a19f559 [ 103.229488][ T5350] RDX: 0000000000000001 RSI: 00002000000001c0 RDI: 0000000000000005 [ 103.232654][ T5350] RBP: 00007fb39a236b50 R08: 0000000000000000 R09: 0000000000000000 [ 103.239291][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.242704][ T5350] R13: 00007fb39a426038 R14: 00007fb39a425fa0 R15: 00007ffcea87c188 [ 103.246056][ T5350] [ 103.247410][ T5350] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.250633][ T5350] CPU: 0 UID: 0 PID: 5350 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.254893][ T5350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.259668][ T5350] Call Trace: [ 103.261407][ T5350] [ 103.262873][ T5350] vpanic+0x26f/0x710 [ 103.264702][ T5350] panic+0xc5/0xd0 [ 103.266362][ T5350] ? __pfx_panic+0x10/0x10 [ 103.268416][ T5350] __warn+0x315/0x4c0 [ 103.270179][ T5350] ? drm_mm_takedown+0x54/0x70 [ 103.272216][ T5350] ? drm_mm_takedown+0x54/0x70 [ 103.274188][ T5350] __report_bug+0x276/0x570 [ 103.276186][ T5350] ? bus_remove_device+0x444/0x560 [ 103.278325][ T5350] ? device_del+0x524/0x8f0 [ 103.280233][ T5350] ? device_unregister+0x21/0xf0 [ 103.282386][ T5350] ? drm_mm_takedown+0x54/0x70 [ 103.284435][ T5350] ? __pfx___report_bug+0x10/0x10 [ 103.286561][ T5350] report_bug_entry+0x19b/0x290 [ 103.288669][ T5350] ? drm_mm_takedown+0x54/0x70 [ 103.290673][ T5350] ? drm_mm_takedown+0x59/0x70 [ 103.292729][ T5350] handle_bug+0xce/0x200 [ 103.294479][ T5350] exc_invalid_op+0x1a/0x50 [ 103.296423][ T5350] asm_exc_invalid_op+0x1a/0x20 [ 103.298549][ T5350] RIP: 0010:drm_mm_takedown+0x54/0x70 [ 103.301011][ T5350] Code: 4c 89 f7 e8 ee 6a 97 fc 49 8b 06 4c 39 f0 75 0e e8 b1 c7 1e fc 5b 41 5e e9 d9 8f 5f 06 cc e8 a3 c7 1e fc 48 8d 3d ac 9e 1f 0c <67> 48 0f b9 3a 48 89 df 5b 41 5e eb 1f 66 66 66 66 66 66 2e 0f 1f [ 103.309077][ T5350] RSP: 0018:ffffc9000f7b76f0 EFLAGS: 00010283 [ 103.311871][ T5350] RAX: ffffffff85aa598d RBX: ffff888036562468 RCX: 0000000000100000 [ 103.315435][ T5350] RDX: ffffc9000ef4a000 RSI: 00000000000143f7 RDI: ffffffff91c9f840 [ 103.318874][ T5350] RBP: ffffffff85a90e00 R08: ffff8880316d2780 R09: ffffffff8ca211c0 [ 103.322223][ T5350] R10: dffffc0000000000 R11: ffffffff85a90e00 R12: ffff8880316d2780 [ 103.325619][ T5350] R13: dffffc0000000000 R14: ffff8880365624a0 R15: dffffc0000000000 [ 103.329137][ T5350] ? __pfx_drm_gem_init_release+0x10/0x10 [ 103.332486][ T5350] ? __pfx_drm_gem_init_release+0x10/0x10 [ 103.334880][ T5350] ? drm_mm_takedown+0x4d/0x70 [ 103.336836][ T5350] drm_managed_release+0x208/0x380 [ 103.338999][ T5350] ? __pfx_virtio_gpu_release+0x10/0x10 [ 103.341261][ T5350] drm_dev_put+0xe0/0x120 [ 103.343030][ T5350] virtio_dev_remove+0x9c/0x1b0 [ 103.344799][ T5350] ? __pfx_virtio_dev_remove+0x10/0x10 [ 103.346943][ T5350] device_release_driver_internal+0x42b/0x7d0 [ 103.349358][ T5350] bus_remove_device+0x444/0x560 [ 103.351347][ T5350] ? __pfx_bus_remove_device+0x10/0x10 [ 103.353409][ T5350] ? kernfs_remove_by_name_ns+0x101/0x140 [ 103.355893][ T5350] device_del+0x524/0x8f0 [ 103.357722][ T5350] ? __pfx_device_del+0x10/0x10 [ 103.359572][ T5350] device_unregister+0x21/0xf0 [ 103.361511][ T5350] unregister_virtio_device+0x37/0x60 [ 103.363502][ T5350] virtio_pci_remove+0x7f/0xf0 [ 103.365571][ T5350] pci_device_remove+0x99/0x1c0 [ 103.367578][ T5350] ? __pfx_pci_device_remove+0x10/0x10 [ 103.370002][ T5350] device_release_driver_internal+0x42b/0x7d0 [ 103.372673][ T5350] pci_stop_bus_device+0xf6/0x120 [ 103.374844][ T5350] pci_stop_and_remove_bus_device_locked+0x77/0xb0 [ 103.377660][ T5350] remove_store+0xe5/0x150 [ 103.379665][ T5350] ? __pfx_remove_store+0x10/0x10 [ 103.381889][ T5350] ? sysfs_file_kobj+0x1e4/0x230 [ 103.384044][ T5350] ? sysfs_kf_write+0x166/0x260 [ 103.386143][ T5350] ? __pfx_sysfs_kf_write+0x10/0x10 [ 103.388340][ T5350] kernfs_fop_write_iter+0x3a4/0x540 [ 103.390652][ T5350] vfs_write+0x612/0xba0 [ 103.392497][ T5350] ? __pfx_vfs_write+0x10/0x10 [ 103.394464][ T5350] ? __fget_files+0x3a2/0x420 [ 103.396617][ T5350] ? __fget_files+0x2a/0x420 [ 103.398639][ T5350] ? fdget+0x1ac/0x250 [ 103.400417][ T5350] ksys_write+0x150/0x270 [ 103.402319][ T5350] ? __pfx_ksys_write+0x10/0x10 [ 103.404537][ T5350] do_syscall_64+0x166/0x520 [ 103.406583][ T5350] ? trace_irq_disable+0x3b/0x140 [ 103.408779][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.411239][ T5350] ? clear_bhb_loop+0x70/0xc0 [ 103.413026][ T5350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.415459][ T5350] RIP: 0033:0x7fb39a19f559 [ 103.417342][ T5350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.425065][ T5350] RSP: 002b:00007fb39b14dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.428404][ T5350] RAX: ffffffffffffffda RBX: 00007fb39a425fa0 RCX: 00007fb39a19f559 [ 103.431964][ T5350] RDX: 0000000000000001 RSI: 00002000000001c0 RDI: 0000000000000005 [ 103.435505][ T5350] RBP: 00007fb39a236b50 R08: 0000000000000000 R09: 0000000000000000 [ 103.438964][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.442453][ T5350] R13: 00007fb39a426038 R14: 00007fb39a425fa0 R15: 00007ffcea87c188 [ 103.445905][ T5350] [ 103.447782][ T5350] Kernel Offset: disabled [ 103.449750][ T5350] Rebooting in 86400 seconds..