UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
misc raw-gadget: fail, usb_gadget_register_driver returned -16
netlink: 'syz.2.310': attribute type 3 has an invalid length.
usb 2-1: dvb_usb_v2: could not submit urb no. 0 - get them all back
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000061: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f]
CPU: 0 UID: 0 PID: 6856 Comm: syz.2.310 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:mxl111sf_ep4_streaming_ctrl+0x2c/0x1a0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:399
Code: 1e fa 55 41 57 41 56 53 89 f3 49 89 fe 49 bf 00 00 00 00 00 fc ff df e8 22 a2 93 f9 49 81 c6 08 03 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 25 ab 03 fa 4d 8b 36 49 83 c6 38
RSP: 0018:ffffc9000253fb38 EFLAGS: 00010202
RAX: 0000000000000061 RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc90005d7a000 RSI: 00000000000008b0 RDI: 00000000000008b1
RBP: ffffc9000253fc38 R08: ffffc9000253f647 R09: 1ffff920004a7ec8
R10: dffffc0000000000 R11: ffffffff883439c0 R12: dffffc0000000000
R13: ffff88805a2753b8 R14: 0000000000000308 R15: dffffc0000000000
FS:  00007fd2a76496c0(0000) GS:ffff888124ccb000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bff11b3680 CR3: 000000007f9ac000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 dvb_usb_start_feed+0x57a/0xc70 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:308
 dmx_ts_feed_start_filtering+0x129/0x220 drivers/media/dvb-core/dvb_demux.c:747
 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:658 [inline]
 dvb_dmxdev_filter_start+0x434/0x10d0 drivers/media/dvb-core/dmxdev.c:769
 dvb_demux_do_ioctl+0x48b/0x540 drivers/media/dvb-core/dmxdev.c:1099
 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996
 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd2a679e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd2a7649028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fd2a6a25fa0 RCX: 00007fd2a679e159
RDX: 0000200000000300 RSI: 0000000040146f2c RDI: 0000000000000006
RBP: 00007fd2a683506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd2a6a26038 R14: 00007fd2a6a25fa0 R15: 00007fd2a6b4fa48
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mxl111sf_ep4_streaming_ctrl+0x2c/0x1a0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:399
Code: 1e fa 55 41 57 41 56 53 89 f3 49 89 fe 49 bf 00 00 00 00 00 fc ff df e8 22 a2 93 f9 49 81 c6 08 03 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 25 ab 03 fa 4d 8b 36 49 83 c6 38
RSP: 0018:ffffc9000253fb38 EFLAGS: 00010202
RAX: 0000000000000061 RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc90005d7a000 RSI: 00000000000008b0 RDI: 00000000000008b1
RBP: ffffc9000253fc38 R08: ffffc9000253f647 R09: 1ffff920004a7ec8
R10: dffffc0000000000 R11: ffffffff883439c0 R12: dffffc0000000000
R13: ffff88805a2753b8 R14: 0000000000000308 R15: dffffc0000000000
FS:  00007fd2a76496c0(0000) GS:ffff888124ccb000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd2a67eb840 CR3: 000000007f9ac000 CR4: 00000000003526f0
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	fa                   	cli
   1:	55                   	push   %rbp
   2:	41 57                	push   %r15
   4:	41 56                	push   %r14
   6:	53                   	push   %rbx
   7:	89 f3                	mov    %esi,%ebx
   9:	49 89 fe             	mov    %rdi,%r14
   c:	49 bf 00 00 00 00 00 	movabs $0xdffffc0000000000,%r15
  13:	fc ff df
  16:	e8 22 a2 93 f9       	call   0xf993a23d
  1b:	49 81 c6 08 03 00 00 	add    $0x308,%r14
  22:	4c 89 f0             	mov    %r14,%rax
  25:	48 c1 e8 03          	shr    $0x3,%rax
* 29:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	4c 89 f7             	mov    %r14,%rdi
  33:	e8 25 ab 03 fa       	call   0xfa03ab5d
  38:	4d 8b 36             	mov    (%r14),%r14
  3b:	49 83 c6 38          	add    $0x38,%r14