./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1770593693

<...>
Warning: Permanently added '10.128.1.143' (ED25519) to the list of known hosts.
execve("./syz-executor1770593693", ["./syz-executor1770593693"], 0x7ffdcef976d0 /* 10 vars */) = 0
brk(NULL)                               = 0x555575cfb000
brk(0x555575cfbd00)                     = 0x555575cfbd00
arch_prctl(ARCH_SET_FS, 0x555575cfb380) = 0
set_tid_address(0x555575cfb650)         = 5090
set_robust_list(0x555575cfb660, 24)     = 0
rseq(0x555575cfbca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1770593693", 4096) = 28
getrandom("\xe1\x57\xff\x12\x8b\x28\xa1\x5b", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555575cfbd00
brk(0x555575d1cd00)                     = 0x555575d1cd00
brk(0x555575d1d000)                     = 0x555575d1d000
mprotect(0x7f06b429a000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("/syzcgroup", 0777)               = 0
mkdir("/syzcgroup/unified", 0777)       = 0
mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0
chmod("/syzcgroup/unified", 0777)       = 0
openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3
write(3, "+cpu", 4)                     = 4
write(3, "+io", 3)                      = 3
write(3, "+pids", 5)                    = 5
close(3)                                = 0
mkdir("/syzcgroup/net", 0777)           = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0
umount2("/syzcgroup/net", 0)            = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0
umount2("/syzcgroup/net", 0)            = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0
umount2("/syzcgroup/net", 0)            = 0
mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0
umount2("/syzcgroup/net", 0)            = 0
[   57.001922][ T5090] cgroup: Unknown subsys name 'net'
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0
chmod("/syzcgroup/net", 0777)           = 0
mkdir("/syzcgroup/cpu", 0777)           = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = 0
umount2("/syzcgroup/cpu", 0)            = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0
umount2("/syzcgroup/cpu", 0)            = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0
umount2("/syzcgroup/cpu", 0)            = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument)
mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0
umount2("/syzcgroup/cpu", 0)            = 0
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted)
[   57.133489][ T5090] cgroup: Unknown subsys name 'rlimit'
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted)
mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb,memory") = 0
chmod("/syzcgroup/cpu", 0777)           = 0
openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
mkdir("./syzkaller.L6o80s", 0700)       = 0
chmod("./syzkaller.L6o80s", 0777)       = 0
chdir("./syzkaller.L6o80s")             = 0
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5091 attached
 <unfinished ...>
[pid  5091] set_robust_list(0x555575cfb660, 24 <unfinished ...>
[pid  5090] <... clone resumed>, child_tidptr=0x555575cfb650) = 5091
[pid  5091] <... set_robust_list resumed>) = 0
[pid  5091] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5091] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5091] setsid()                    = 1
[pid  5091] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5091] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5091] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5091] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5091] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5091] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5091] unshare(CLONE_NEWNS)        = 0
[pid  5091] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5091] unshare(CLONE_NEWIPC)       = 0
[pid  5091] unshare(CLONE_NEWCGROUP)    = 0
[pid  5091] unshare(CLONE_NEWUTS)       = 0
[pid  5091] unshare(CLONE_SYSVSEM)      = 0
[pid  5091] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "16777216", 8)     = 8
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "536870912", 9)    = 9
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "1024", 4)         = 4
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "8192", 4)         = 4
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "1024", 4)         = 4
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "1024", 4)         = 4
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5091] close(3)                    = 0
[pid  5091] getpid()                    = 1
[pid  5091] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5091] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5091] unshare(CLONE_NEWNET)       = 0
[pid  5091] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "0 65535", 7)      = 7
[pid  5091] close(3)                    = 0
[pid  5091] mkdir("/dev/binderfs", 0777) = 0
[pid  5091] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5091] getpid()                    = 1
[pid  5091] mkdir("/syzcgroup/unified/syz0", 0777) = 0
[pid  5091] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "32", 2)           = 2
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "1", 1)            = 1
[pid  5091] close(3)                    = 0
[pid  5091] mkdir("/syzcgroup/cpu/syz0", 0777) = 0
[pid  5091] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "1", 1)            = 1
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "313524224", 9)    = 9
[pid  5091] close(3)                    = 0
[pid  5091] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "314572800", 9)    = 9
[pid  5091] close(3)                    = 0
[pid  5091] mkdir("/syzcgroup/net/syz0", 0777) = 0
[pid  5091] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3
[pid  5091] write(3, "1", 1)            = 1
[pid  5091] close(3)                    = 0
[pid  5091] mkdir("./0", 0777)          = 0
[pid  5091] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5094 attached
, child_tidptr=0x555575cfb650) = 2
[pid  5094] set_robust_list(0x555575cfb660, 24) = 0
[pid  5094] chdir("./0")                = 0
[pid  5094] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5094] setpgid(0, 0)               = 0
[pid  5094] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0
[pid  5094] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0
[pid  5094] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0
[pid  5094] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5094] write(3, "1000", 4)         = 4
[pid  5094] close(3)                    = 0
[pid  5094] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5094] write(1, "executing program\n", 18executing program
) = 18
[pid  5094] openat(AT_FDCWD, "/dev/dri/card1", O_RDONLY) = 3
[pid  5094] ioctl(3, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000040) = 0
[pid  5094] openat(AT_FDCWD, "/dev/dri/card1", O_RDONLY) = 4
[pid  5094] ioctl(4, DRM_IOCTL_MODE_GETRESOURCES, 0x20000140) = 0
[   59.365698][ T5094] ------------[ cut here ]------------
[   59.371348][ T5094] UBSAN: shift-out-of-bounds in mm/vmscan.c:4715:21
[   59.378023][ T5094] shift exponent -1 is negative
[   59.382884][ T5094] CPU: 1 PID: 5094 Comm: syz-executor177 Not tainted 6.10.0-rc1-next-20240528-syzkaller #0
[   59.392847][ T5094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[   59.402899][ T5094] Call Trace:
[   59.406185][ T5094]  <TASK>
[   59.409119][ T5094]  dump_stack_lvl+0x241/0x360
[   59.413802][ T5094]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.418988][ T5094]  ? __pfx__printk+0x10/0x10
[   59.423580][ T5094]  ? __lock_acquire+0x1346/0x1fd0
[   59.428597][ T5094]  __ubsan_handle_shift_out_of_bounds+0x3c8/0x420
[   59.435037][ T5094]  try_to_shrink_lruvec+0xa99/0xbb0
[   59.440238][ T5094]  ? __pfx_try_to_shrink_lruvec+0x10/0x10
[   59.445965][ T5094]  ? blk_start_plug+0x70/0x1b0
[   59.450731][ T5094]  shrink_lruvec+0x554/0x3070
[   59.455438][ T5094]  ? __lock_acquire+0x1346/0x1fd0
[   59.460498][ T5094]  ? mark_lock+0x9a/0x350
[   59.464829][ T5094]  ? mark_lock+0x9a/0x350
[   59.469164][ T5094]  ? __lock_acquire+0x1346/0x1fd0
[   59.474184][ T5094]  ? __pfx_shrink_lruvec+0x10/0x10
[   59.479334][ T5094]  ? __pfx___might_resched+0x10/0x10
[   59.484613][ T5094]  ? mem_cgroup_iter+0x3a/0x560
[   59.489461][ T5094]  ? mem_cgroup_iter+0x3e9/0x560
[   59.494399][ T5094]  ? mem_cgroup_iter+0x3a/0x560
[   59.499248][ T5094]  shrink_node+0xb17/0x4150
[   59.503784][ T5094]  ? __pfx_shrink_node+0x10/0x10
[   59.508727][ T5094]  ? __pfx_queue_work_on+0x10/0x10
[   59.513848][ T5094]  ? do_raw_spin_unlock+0x13c/0x8b0
[   59.519053][ T5094]  ? _raw_spin_unlock+0x28/0x50
[   59.523909][ T5094]  do_try_to_free_pages+0x789/0x1cb0
[   59.529217][ T5094]  ? __pfx_do_try_to_free_pages+0x10/0x10
[   59.534941][ T5094]  try_to_free_mem_cgroup_pages+0x48f/0xb10
[   59.540831][ T5094]  ? do_raw_spin_unlock+0x13c/0x8b0
[   59.546026][ T5094]  ? __pfx_try_to_free_mem_cgroup_pages+0x10/0x10
[   59.552453][ T5094]  ? cgroup_file_notify+0x111/0x190
[   59.557652][ T5094]  try_charge_memcg+0x704/0x1850
[   59.562604][ T5094]  ? __pfx_try_charge_memcg+0x10/0x10
[   59.567972][ T5094]  ? percpu_ref_tryget+0x14/0x180
[   59.573015][ T5094]  charge_memcg+0xa2/0x160
[   59.577429][ T5094]  __mem_cgroup_charge+0x27/0x80
[   59.582365][ T5094]  shmem_alloc_and_add_folio+0x44b/0xbd0
[   59.588006][ T5094]  ? __pfx_shmem_alloc_and_add_folio+0x10/0x10
[   59.594159][ T5094]  ? __sanitizer_cov_trace_switch+0x83/0x120
[   59.600153][ T5094]  shmem_get_folio_gfp+0x82d/0x1f50
[   59.605374][ T5094]  ? __pfx_shmem_get_folio_gfp+0x10/0x10
[   59.611251][ T5094]  shmem_read_folio_gfp+0xd6/0x170
[   59.616413][ T5094]  ? __pfx_shmem_read_folio_gfp+0x10/0x10
[   59.622158][ T5094]  ? __kmalloc_node_noprof+0x247/0x440
[   59.627624][ T5094]  ? kvmalloc_node_noprof+0x142/0x190
[   59.633008][ T5094]  drm_gem_get_pages+0x21b/0xe50
[   59.637974][ T5094]  ? __pfx_drm_gem_get_pages+0x10/0x10
[   59.643477][ T5094]  drm_gem_shmem_get_pages+0xdd/0x290
[   59.648857][ T5094]  drm_gem_shmem_vmap+0x2ba/0x630
[   59.653887][ T5094]  drm_gem_vmap_unlocked+0x103/0x1d0
[   59.659173][ T5094]  drm_gem_fb_vmap+0xa6/0x810
[   59.663854][ T5094]  drm_atomic_helper_prepare_planes+0x2b2/0xb50
[   59.670101][ T5094]  drm_atomic_helper_commit+0x18b/0x9f0
[   59.675644][ T5094]  ? __pfx_drm_atomic_helper_commit+0x10/0x10
[   59.681707][ T5094]  drm_atomic_commit+0x2ac/0x310
[   59.686643][ T5094]  ? __pfx_drm_atomic_commit+0x10/0x10
[   59.692098][ T5094]  ? __pfx___drm_printfn_info+0x10/0x10
[   59.697642][ T5094]  ? drm_mode_object_get+0xd0/0x150
[   59.702924][ T5094]  ? drm_atomic_set_fb_for_plane+0x222/0x290
[   59.708903][ T5094]  drm_atomic_helper_update_plane+0x238/0x3a0
[   59.714972][ T5094]  drm_mode_cursor_common+0xd68/0x1570
[   59.720441][ T5094]  ? __pfx_validate_chain+0x10/0x10
[   59.725655][ T5094]  ? __pfx_drm_mode_cursor_common+0x10/0x10
[   59.731566][ T5094]  ? drm_mode_cursor_ioctl+0x97/0x160
[   59.736932][ T5094]  drm_mode_cursor_ioctl+0xe1/0x160
[   59.742126][ T5094]  ? __pfx_drm_mode_cursor_ioctl+0x10/0x10
[   59.747933][ T5094]  ? _raw_spin_unlock+0x28/0x50
[   59.752780][ T5094]  drm_ioctl_kernel+0x33a/0x440
[   59.757627][ T5094]  ? __pfx_drm_mode_cursor_ioctl+0x10/0x10
[   59.763427][ T5094]  ? __pfx_drm_ioctl_kernel+0x10/0x10
[   59.768792][ T5094]  ? __might_fault+0xc6/0x120
[   59.773467][ T5094]  drm_ioctl+0x611/0xad0
[   59.777703][ T5094]  ? __pfx_drm_mode_cursor_ioctl+0x10/0x10
[   59.783516][ T5094]  ? __pfx_drm_ioctl+0x10/0x10
[   59.788291][ T5094]  ? bpf_lsm_file_ioctl+0x9/0x10
[   59.793227][ T5094]  ? security_file_ioctl+0x87/0xb0
[   59.798333][ T5094]  ? __pfx_drm_ioctl+0x10/0x10
[   59.803091][ T5094]  __se_sys_ioctl+0xfc/0x170
[   59.807678][ T5094]  do_syscall_64+0xf3/0x230
[   59.812175][ T5094]  ? clear_bhb_loop+0x35/0x90
[   59.816847][ T5094]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.822742][ T5094] RIP: 0033:0x7f06b4225999
[   59.827156][ T5094] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   59.846751][ T5094] RSP: 002b:00007fff29e89738 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   59.855171][ T5094] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f06b4225999
[   59.863137][ T5094] RDX: 0000000020000340 RSI: 00000000c01c64a3 RDI: 0000000000000003
[   59.871098][ T5094] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[   59.879058][ T5094] R10: 0023647261632f69 R11: 0000000000000246 R12: 00007f06b426f036
[   59.887018][ T5094] R13: 00007fff29e89770 R14: 00007fff29e897b0 R15: 0000000000000000
[   59.894998][ T5094]  </TASK>
[   59.899098][ T5094] ---[ end trace ]---
[   59.903179][ T5094] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[   59.910377][ T5094] CPU: 1 PID: 5094 Comm: syz-executor177 Not tainted 6.10.0-rc1-next-20240528-syzkaller #0
[   59.920347][ T5094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[   59.930394][ T5094] Call Trace:
[   59.933665][ T5094]  <TASK>
[   59.936587][ T5094]  dump_stack_lvl+0x241/0x360
[   59.941265][ T5094]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.946455][ T5094]  ? __pfx__printk+0x10/0x10
[   59.951040][ T5094]  ? vprintk_emit+0x631/0x770
[   59.955721][ T5094]  ? vscnprintf+0x5d/0x90
[   59.960046][ T5094]  panic+0x349/0x860
[   59.963939][ T5094]  ? check_panic_on_warn+0x21/0xb0
[   59.969045][ T5094]  ? __pfx_panic+0x10/0x10
[   59.973456][ T5094]  ? _printk+0xd5/0x120
[   59.977614][ T5094]  ? __pfx__printk+0x10/0x10
[   59.982205][ T5094]  check_panic_on_warn+0x86/0xb0
[   59.987139][ T5094]  __ubsan_handle_shift_out_of_bounds+0x3e7/0x420
[   59.993565][ T5094]  try_to_shrink_lruvec+0xa99/0xbb0
[   59.998770][ T5094]  ? __pfx_try_to_shrink_lruvec+0x10/0x10
[   60.004482][ T5094]  ? blk_start_plug+0x70/0x1b0
[   60.009248][ T5094]  shrink_lruvec+0x554/0x3070
[   60.013920][ T5094]  ? __lock_acquire+0x1346/0x1fd0
[   60.018948][ T5094]  ? mark_lock+0x9a/0x350
[   60.023275][ T5094]  ? mark_lock+0x9a/0x350
[   60.027600][ T5094]  ? __lock_acquire+0x1346/0x1fd0
[   60.032620][ T5094]  ? __pfx_shrink_lruvec+0x10/0x10
[   60.037759][ T5094]  ? __pfx___might_resched+0x10/0x10
[   60.043042][ T5094]  ? mem_cgroup_iter+0x3a/0x560
[   60.047883][ T5094]  ? mem_cgroup_iter+0x3e9/0x560
[   60.052811][ T5094]  ? mem_cgroup_iter+0x3a/0x560
[   60.057655][ T5094]  shrink_node+0xb17/0x4150
[   60.062182][ T5094]  ? __pfx_shrink_node+0x10/0x10
[   60.067111][ T5094]  ? __pfx_queue_work_on+0x10/0x10
[   60.072215][ T5094]  ? do_raw_spin_unlock+0x13c/0x8b0
[   60.077407][ T5094]  ? _raw_spin_unlock+0x28/0x50
[   60.082252][ T5094]  do_try_to_free_pages+0x789/0x1cb0
[   60.087552][ T5094]  ? __pfx_do_try_to_free_pages+0x10/0x10
[   60.093272][ T5094]  try_to_free_mem_cgroup_pages+0x48f/0xb10
[   60.099160][ T5094]  ? do_raw_spin_unlock+0x13c/0x8b0
[   60.104350][ T5094]  ? __pfx_try_to_free_mem_cgroup_pages+0x10/0x10
[   60.110771][ T5094]  ? cgroup_file_notify+0x111/0x190
[   60.115966][ T5094]  try_charge_memcg+0x704/0x1850
[   60.120920][ T5094]  ? __pfx_try_charge_memcg+0x10/0x10
[   60.126283][ T5094]  ? percpu_ref_tryget+0x14/0x180
[   60.131315][ T5094]  charge_memcg+0xa2/0x160
[   60.135732][ T5094]  __mem_cgroup_charge+0x27/0x80
[   60.140664][ T5094]  shmem_alloc_and_add_folio+0x44b/0xbd0
[   60.146297][ T5094]  ? __pfx_shmem_alloc_and_add_folio+0x10/0x10
[   60.152447][ T5094]  ? __sanitizer_cov_trace_switch+0x83/0x120
[   60.158423][ T5094]  shmem_get_folio_gfp+0x82d/0x1f50
[   60.163627][ T5094]  ? __pfx_shmem_get_folio_gfp+0x10/0x10
[   60.169260][ T5094]  shmem_read_folio_gfp+0xd6/0x170
[   60.174363][ T5094]  ? __pfx_shmem_read_folio_gfp+0x10/0x10
[   60.180074][ T5094]  ? __kmalloc_node_noprof+0x247/0x440
[   60.185526][ T5094]  ? kvmalloc_node_noprof+0x142/0x190
[   60.190890][ T5094]  drm_gem_get_pages+0x21b/0xe50
[   60.195834][ T5094]  ? __pfx_drm_gem_get_pages+0x10/0x10
[   60.201314][ T5094]  drm_gem_shmem_get_pages+0xdd/0x290
[   60.206686][ T5094]  drm_gem_shmem_vmap+0x2ba/0x630
[   60.211713][ T5094]  drm_gem_vmap_unlocked+0x103/0x1d0
[   60.216991][ T5094]  drm_gem_fb_vmap+0xa6/0x810
[   60.221669][ T5094]  drm_atomic_helper_prepare_planes+0x2b2/0xb50
[   60.227910][ T5094]  drm_atomic_helper_commit+0x18b/0x9f0
[   60.233449][ T5094]  ? __pfx_drm_atomic_helper_commit+0x10/0x10
[   60.239509][ T5094]  drm_atomic_commit+0x2ac/0x310
[   60.244442][ T5094]  ? __pfx_drm_atomic_commit+0x10/0x10
[   60.249891][ T5094]  ? __pfx___drm_printfn_info+0x10/0x10
[   60.255437][ T5094]  ? drm_mode_object_get+0xd0/0x150
[   60.260628][ T5094]  ? drm_atomic_set_fb_for_plane+0x222/0x290
[   60.266605][ T5094]  drm_atomic_helper_update_plane+0x238/0x3a0
[   60.272671][ T5094]  drm_mode_cursor_common+0xd68/0x1570
[   60.278126][ T5094]  ? __pfx_validate_chain+0x10/0x10
[   60.283334][ T5094]  ? __pfx_drm_mode_cursor_common+0x10/0x10
[   60.289244][ T5094]  ? drm_mode_cursor_ioctl+0x97/0x160
[   60.294609][ T5094]  drm_mode_cursor_ioctl+0xe1/0x160
[   60.299799][ T5094]  ? __pfx_drm_mode_cursor_ioctl+0x10/0x10
[   60.305601][ T5094]  ? _raw_spin_unlock+0x28/0x50
[   60.310444][ T5094]  drm_ioctl_kernel+0x33a/0x440
[   60.315288][ T5094]  ? __pfx_drm_mode_cursor_ioctl+0x10/0x10
[   60.321088][ T5094]  ? __pfx_drm_ioctl_kernel+0x10/0x10
[   60.326453][ T5094]  ? __might_fault+0xc6/0x120
[   60.331125][ T5094]  drm_ioctl+0x611/0xad0
[   60.335358][ T5094]  ? __pfx_drm_mode_cursor_ioctl+0x10/0x10
[   60.341165][ T5094]  ? __pfx_drm_ioctl+0x10/0x10
[   60.345932][ T5094]  ? bpf_lsm_file_ioctl+0x9/0x10
[   60.350862][ T5094]  ? security_file_ioctl+0x87/0xb0
[   60.355968][ T5094]  ? __pfx_drm_ioctl+0x10/0x10
[   60.360725][ T5094]  __se_sys_ioctl+0xfc/0x170
[   60.365313][ T5094]  do_syscall_64+0xf3/0x230
[   60.369811][ T5094]  ? clear_bhb_loop+0x35/0x90
[   60.374481][ T5094]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.380365][ T5094] RIP: 0033:0x7f06b4225999
[   60.384771][ T5094] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   60.404368][ T5094] RSP: 002b:00007fff29e89738 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   60.412775][ T5094] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f06b4225999
[   60.420736][ T5094] RDX: 0000000020000340 RSI: 00000000c01c64a3 RDI: 0000000000000003
[   60.428709][ T5094] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[   60.436672][ T5094] R10: 0023647261632f69 R11: 0000000000000246 R12: 00007f06b426f036
[   60.444633][ T5094] R13: 00007fff29e89770 R14: 00007fff29e897b0 R15: 0000000000000000
[   60.452606][ T5094]  </TASK>
[   60.455841][ T5094] Kernel Offset: disabled
[   60.460211][ T5094] Rebooting in 86400 seconds..