------------[ cut here ]------------ WARNING: CPU: 1 PID: 16337 at drivers/gpu/drm/vkms/vkms_crtc.c:97 vkms_get_vblank_timestamp+0x167/0x1b0 drivers/gpu/drm/vkms/vkms_crtc.c:97 Modules linked in: CPU: 1 UID: 0 PID: 16337 Comm: syz.0.7875 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:vkms_get_vblank_timestamp+0x167/0x1b0 drivers/gpu/drm/vkms/vkms_crtc.c:97 Code: ae fb e8 4c 5a 9c fb 4c 89 e1 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c 11 00 75 43 49 89 04 24 eb c0 e8 6a e1 ae fb 90 <0f> 0b 90 eb b5 e8 7f 43 14 fc e9 dc fe ff ff e8 05 44 14 fc e9 14 RSP: 0018:ffffc900079bf068 EFLAGS: 00010287 RAX: 000000000000121d RBX: ffff888025058028 RCX: ffffc90035e09000 RDX: 0000000000080000 RSI: ffffffff860c2966 RDI: 0000000000000006 RBP: 0000011827c6bc13 R08: 0000000000000006 R09: 0000011827c6bc13 R10: 0000011827c6bc13 R11: 0000000000000000 R12: ffffc900079bf1d0 R13: 0000011827c6bc13 R14: 0000000000004e20 R15: ffffffff860c2800 FS: 0000000000000000(0000) GS:ffff8880975c0000(0063) knlGS:00000000f4fd1b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000031df9ffc CR3: 000000006f2e8000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: drm_crtc_get_last_vbltimestamp+0x102/0x1b0 drivers/gpu/drm/drm_vblank.c:879 drm_crtc_next_vblank_start+0x182/0x300 drivers/gpu/drm/drm_vblank.c:1013 set_fence_deadline drivers/gpu/drm/drm_atomic_helper.c:1711 [inline] drm_atomic_helper_wait_for_fences+0x203/0x830 drivers/gpu/drm/drm_atomic_helper.c:1758 drm_atomic_helper_commit+0x1cf/0x380 drivers/gpu/drm/drm_atomic_helper.c:2187 drm_atomic_commit+0x231/0x300 drivers/gpu/drm/drm_atomic.c:1577 drm_client_modeset_commit_atomic+0x69d/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1103 drm_client_modeset_commit_locked+0x14d/0x580 drivers/gpu/drm/drm_client_modeset.c:1206 drm_client_modeset_commit+0x4f/0x80 drivers/gpu/drm/drm_client_modeset.c:1232 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:238 [inline] __drm_fb_helper_restore_fbdev_mode_unlocked+0x19f/0x200 drivers/gpu/drm/drm_fb_helper.c:217 drm_fb_helper_set_par+0xd8/0x120 drivers/gpu/drm/drm_fb_helper.c:1360 fb_set_var+0x822/0x1280 drivers/video/fbdev/core/fbmem.c:319 fbcon_resize+0x684/0x910 drivers/video/fbdev/core/fbcon.c:2089 resize_screen drivers/tty/vt/vt.c:1120 [inline] vc_do_resize+0xcc8/0x10e0 drivers/tty/vt/vt.c:1177 vt_resizex drivers/tty/vt/vt_ioctl.c:717 [inline] vt_ioctl+0x2ca4/0x30a0 drivers/tty/vt/vt_ioctl.c:937 vt_compat_ioctl+0x1c2/0x4e0 drivers/tty/vt/vt_ioctl.c:1129 tty_compat_ioctl+0x2f1/0x4d0 drivers/tty/tty_io.c:2971 __do_compat_sys_ioctl fs/ioctl.c:696 [inline] __se_compat_sys_ioctl fs/ioctl.c:639 [inline] __ia32_compat_sys_ioctl+0x23f/0x370 fs/ioctl.c:639 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7f24579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f4fd155c EFLAGS: 00000296 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000000560a RDX: 00000000800006c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 10 06 adc %al,(%rsi) 2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 6: 10 07 adc %al,(%rdi) 8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi c: 10 08 adc %cl,(%rax) e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 1e: 00 51 52 add %dl,0x52(%rcx) 21: 55 push %rbp 22: 89 e5 mov %esp,%ebp 24: 0f 34 sysenter 26: cd 80 int $0x80 * 28: 5d pop %rbp <-- trapping instruction 29: 5a pop %rdx 2a: 59 pop %rcx 2b: c3 ret 2c: 90 nop 2d: 90 nop 2e: 90 nop 2f: 90 nop 30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi 37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi