last executing test programs: 536.711478ms ago: executing program 3 (id=4): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x28de, 0x1102, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xd0, 0x0, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x1, 0xf9, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x50}}}}}]}}]}}, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x2d, 0x83, 0x57, 0x20, 0xbda, 0x5088, 0xd380, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa, 0x3, 0x40, 0x8, [{{0x9, 0x4, 0xc1, 0x1, 0x0, 0x77, 0x92, 0xe2, 0xc}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000004c0)={0x24, 0x0, &(0x7f0000000400)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x843}}, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r1, &(0x7f0000000800)={0x14, 0x0, &(0x7f0000000780)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000011c0)={0x84, &(0x7f0000000d00)={0xea6ce7d4ea28091, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, &(0x7f00000008c0)={0x44, &(0x7f0000000500)={0x0, 0x14, 0x7, "d7315855b4a151"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$uac1(0x3, 0xa2, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d01014000010203010902900003010380000904000000010100000a24010f00030201020c2402060602040c0032a304090401000001020000090401010101020000072401200404000c2402010201400f0a3b4725090501090000f7090607250183020c00090402000001030000090402010101020000072401"], 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000100)=""/193) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="200b4000000028b1"], 0x0, 0x0, 0x0, 0x0}, 0x0) 189.388649ms ago: executing program 2 (id=3): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000403810c21200000000000109022400010000000009040000010300000009210000000122070009058803"], 0x0) (async) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x6, 0x101003) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000040)={0x1f, 0x6a, &(0x7f00000000c0)="7612ca8447971708b62f3b49e93b5ef96240ca3dd28379322938fc07e3573e095dc5fff9362be472f8dfc97822562b9272f4283bb99b1ade6fd14866d31b38c2d5867bc2c166a44960c02772a4496eaa7bb6048385038cf19a0ef3a76471e03e6328dcebfba6fd128811"}) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f00000002c0)={0x20, 0xc, 0x8, {0x8, 0x0, "b806849a7cd2"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 140.145852ms ago: executing program 4 (id=5): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001140)={{0x12, 0x1, 0x0, 0xc7, 0x72, 0xb6, 0x10, 0x2304, 0x243, 0x23d4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x79, 0x0, 0x0, 0x69, 0x6, 0xa0}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000004c0)={0x2c, &(0x7f0000000580)={0x20, 0x31, 0x5, "c15e9e77d1"}, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$evdev(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000100), 0xffffffffffffffff, 0x200080) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x5b, 0xe, 0x8c, 0x10, 0x17ef, 0x720c, 0x5190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe3, 0x9c, 0xcb}}]}}]}}, &(0x7f0000000500)={0x0, 0x0, 0xf, &(0x7f00000000c0)={0x5, 0xf, 0xf, 0x2, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x0, 0x7, 0xa746}]}, 0x3, [{0xc1, &(0x7f0000000200)=@string={0xc1, 0x3, "3446d7eeaa0b49a5299825047657befadda7ec866a668248637508471c10ca76ed6f1666a1112062d32b612c7ee86f231f3cd4e42210385f0f60eea3e0883152201109b9089c97143403672a30846ab91cefd9685b1794e1b122235b836ce99e5cb3214611ab17fc2c533989e78aa68aa752e59b17d84ce869be44ed60cfcf2f24235c3b63910cf76993d5f6d70187af4d2a78ca2f05e9d070ac325d0b9fce88bbc1eb026b62a7300589fcbde66cf4b57926d582cb80f88c8630f5102752fd"}}, {0x20, &(0x7f0000000400)=@string={0x20, 0x3, "49a1f3e52286fb8a471773ef20a803b16d6cde77df0a2235a7044d77fb7a"}}, {0x4, &(0x7f0000000000)=@lang_id={0x4, 0x3, 0x40f}}]}) syz_open_dev$evdev(0x0, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000300)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1b1c, 0x1b3e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, {0x9}}}]}}]}}, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x862b01) write$char_usb(r1, 0x0, 0x51) r2 = syz_open_dev$evdev(&(0x7f0000000040), 0xfff, 0x0) ioctl$EVIOCGMASK(r2, 0x4020940d, &(0x7f00000003c0)={0x4, 0x0, 0x0}) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x0, 0x0, 0x0) r3 = syz_usb_connect(0x2, 0x36, &(0x7f0000001580)={{0x12, 0x1, 0x0, 0x2, 0x2f, 0xb0, 0x40, 0x4d8, 0xfd08, 0x59b1, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x8, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb1, 0x9, 0x2, 0xa, 0x5f, 0x92, 0x40, [], [{{0x9, 0x5, 0x8, 0xa, 0x3ff, 0xf7, 0x7, 0x9}}, {{0x9, 0x5, 0x30932787f67e0187, 0x2, 0x40, 0x2, 0x5}}]}}]}}]}}, 0x0) syz_usb_disconnect(r3) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 118.960393ms ago: executing program 1 (id=2): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xf8, 0xd9, 0xfa, 0x40, 0x10b8, 0x1faa, 0xe906, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x5, [{{0x9, 0x4, 0x58, 0x0, 0x0, 0x56, 0x6c, 0x49}}]}}]}}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0}) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bc9cbf40480b032094710000000109022400010000000009040000224fc25200090503fe"], 0x0) syz_usb_connect(0x2, 0x88d, &(0x7f00000000c0)={{0x12, 0x1, 0x250, 0x89, 0x39, 0x95, 0xff, 0x19d2, 0x1144, 0x25cc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x87b, 0x2, 0x6, 0x81, 0xa0, 0x2, [{{0x9, 0x4, 0x10, 0x5, 0x6, 0xff, 0xff, 0xff, 0x6, [], [{{0x9, 0x5, 0x9, 0x3, 0x20, 0x5, 0x3, 0x1, [@generic={0xf4, 0x22, "728eb05f9b8c5e0d09956b76b5aca8fca47481ba01c311c43d98e5127c5f57f7831a57d493615e22ee21e16a35b718989edad9c1b744540d3c6ffbd6b579f7d53c6cd6a73a2a4e8fcce573583e2786573f24530404ff2e04a28557fbb4257f9b3e3a3faaf269e2bbac1b96476c226e0f073e52178919c2b1711978f8cc911d2b6b109dbc58366b9bde04fde8eb99f23f35fb6beb754d32e5d3ea926ea6028a534f0232a025f41245c901d6122704bdb2f018af3c63fad3d6ca350db709d6221b69de23541ba1fedcc148c98fa6f25d27e6dc7a859b4622ba4b1971f2731f491fe63068f1843cc7bab0812d590dc85cbaf513"}, @generic={0xc4, 0xd, "bf10b61ed0ac04fa941d421266c04feca876fab9a86e9ddaf4a9f2057777105a1e8adf08f07768dee7edeef98d0007d29132bff7deea640d853baca0f157f2068f7ca28b91caecd9ccd9cf93a2c442264888f53b5ef10c88605b88f93847646d7fc5ec2d75d63075d0392f637baa8e78d2913671c48d56b580a88a9d3ea0b9189e1100d2efc45c44285ab960114afc6ec0b063d018cf7fc8ba4028d248b878bd2459c7cca147a9b7a2c0d7b3534678267ea5757258a3a08f080c31bfb9688bd06a30"}]}}, {{0x9, 0x5, 0x1, 0x0, 0x40, 0x96, 0x40, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x447f}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x5}]}}, {{0x9, 0x5, 0x9, 0x3, 0x200, 0x7, 0x2, 0x9}}, {{0x9, 0x5, 0x0, 0xe, 0x20, 0x6, 0x0, 0x7, [@generic={0xe1, 0x21, "e8fce7e60742ddcfe43571942a1a4ab130d2fd4027b943738a4ef18e6948a7ad891409e9bf2dc29a83d3c8186b8d9f3505e09f0e6d4eb9f74476295ba5553c5570f56a7761159eeb1563814d23e16bfdbba7bf05b8f6ccd02132cbf40d96dedf3afb75137a65832118d7526606def631ef253ad839aa2940659c644c348fbe3ce04042500ade77724326c339a0218ac385fe22eebcd1378ceafe85ac3b135a5195613391c313578046ee7b3cd346a1b5528c27c695413fe0a040ca721423b2f82f606cbe97be96b805ef5209d8857f9af54f38949f3509744c7910330619e7"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x92, 0xb000}]}}, {{0x9, 0x5, 0x7, 0x8, 0x8, 0x10, 0x4, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x9, 0x5}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x78, 0x4}]}}, {{0x9, 0x5, 0xe, 0x4, 0x40, 0xfc, 0x2d, 0x2, [@generic={0x102, 0x23, "18a9412b62231f8ca9864c223618eaf0c96c7c1bb458797c08138a09829b9ccb0af264804ad92c835cb1763535f8b5325f70dd4fdca3625dc720ecfa4fe4c2b13ee552f4b31d3dd7681560d75daf0fb2cf49ef1fb3469a0315cf6c310c19d1e24c503e98301f086fb12636e099b061f76e61d48b250e232c6182b3b2a618eec858a524c533e0dacd445ef2d583e65ba6bf2ea588b3a66864168f6a78b8242a485edf68a4b4335f67d8bfeb4e6172a2ec43ab70199084785f335e003066af02db86bd1b6d2e018c3bd09a68353311b31efb582682e790fac7d3ded33713eca911d960d859cd6ec69899dff6e49c9567532396ba106e05860d342b32f4f4b9f8ee"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x2, 0x8}]}}]}}, {{0x9, 0x4, 0x9c, 0x6, 0xf, 0x2d, 0xa2, 0xdb, 0x1, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "192512d2570a"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x7, 0x4, 0x2f}, [@mdlm={0x15}, @acm={0x4, 0x24, 0x2, 0xc}]}, @uac_as={[@format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0xd, 0x4, 0x6, 0x0, "85"}]}], [{{0x9, 0x5, 0xd, 0x0, 0x40, 0x5, 0x9}}, {{0x9, 0x5, 0xf, 0xc, 0x40, 0x9, 0x7, 0x6}}, {{0x9, 0x5, 0xb, 0x3, 0x8, 0xf, 0x0, 0x5, [@generic={0x3c, 0x36, "cf532bb69b4b6559e580e70aaf38f1a680e6cf35fea78219fb9ed8dbdaf49c0442d5a199f83e0f8197ef2b9185a24d09a0a3a5d9be6c6181c95f"}, @generic={0x80, 0x21, "0c288cee0b16c9e5265555136c3536a7fe736e8ba40fdeae9714a272c4b0f3bbc15d893e3a23c51fb390437b6a9c277e80de7e12afdaa268728c8ed6e1c08d43a2f6878fced0a0a3144346d04e540a71b6e95e638523eb8fde19933632d7576c2feed0705ce5454967ea0a053a394f7802b708d61900cd59fad05a6a788b"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x200, 0x1d, 0x6c, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x7, 0x2}]}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x9, 0x5, 0x87, [@generic={0x6, 0x22, "8c4015b0"}]}}, {{0x9, 0x5, 0x7, 0x0, 0x5c, 0x5, 0xf4, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xc7, 0x3800}, @generic={0xcb, 0x21, "f7ecfb3f32778c54a1546edad08b19424a4a53ea6f2335b2ab10730769d390bc589a66fff29600d4504f69069cd1969f4559159be67d0a9d6eddf840b3814da9032b668e3c9fc553af637017cb974596bf004ff182ce22bc642175d91f1ab5574e4dce983468a6a846409f6b05a766dc43afc773109507d2dbcb60e3f0f8d12d7162de2fe737aff5527286aeb19fd8f9fc5a3822deb233517ab9de651e6b184a4819bae84f3baa0bbb44434b275c24c575a439ef08f85f91a47ede8633d250fc71597972986ed8b5d1"}]}}, {{0x9, 0x5, 0xc, 0x3, 0x20, 0x8, 0x7, 0x2}}, {{0x9, 0x5, 0x4, 0x2, 0x0, 0x1, 0xf7}}, {{0x9, 0x5, 0x5, 0x1, 0x200, 0x10, 0x3, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x4, 0xdb25}]}}, {{0x9, 0x5, 0x0, 0x0, 0x200, 0x8, 0x4, 0x9, [@generic={0xad, 0x10, "6123ddee9d94ddeb4ad5da3b6aec18004e013a77d0507b888c42e5242f8e26780a9c30d50e6f0ca9bcaa2214fe1c7e824cf1303f5083cf7fd6eac1a895b58753679ec6c2cf6cf4fb06c3030295717156b4ea5a50d2df327865e8a4b292453024a64f58a9d9ee17fffae85bfdd0c193c893dbe686d0c2ab4a29345cc2508947475a71f1d7b90d672547c8b665593ed1b8d2e81f67b77657446fbc53ac6122c65c00fd46a75ebb8c0d79361d"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0xf, 0x10}]}}, {{0x9, 0x5, 0x0, 0xc, 0x400, 0x9, 0x95, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x4b, 0x4}, @generic={0xe7, 0x2, "cf0959c4b19713c00feb0f4e46b5228e0e4c02774bc86d1ff62e95202e25da0f4db3f912ae7e3a230b44e5dd4b232125264d5aec9adcaa40a348010337afe499881fbacf298004051c28da162736d1554da7160137da9b043992c6c453f3173f9412180ccf29f1f9e8cfb436724bc7add7cdec8ff714df957ddc3e982371e1579b9a6fa7466ac1bb7c779a973af237c0f63dade378856bac401f4423ee8837f004094ca1fecdd6e2708eb7d50d94b15e7068bc4289f38618b1d2efdb562012f5088a6eeed05df61520904f201c3a3b746616b2e59e78b64063bc91b941878e507774d0384f"}]}}, {{0x9, 0x5, 0x7, 0x0, 0x8, 0x6, 0x0, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0xf9, 0xc}]}}, {{0x9, 0x5, 0xb, 0x10, 0x200, 0x3a, 0x7, 0x3}}, {{0x9, 0x5, 0xf, 0x4, 0x10, 0x7, 0xfc, 0xe1, [@uac_iso={0x7, 0x25, 0x1, 0xc0, 0xff, 0x1}]}}, {{0x9, 0x5, 0x8, 0x10, 0x40, 0xd, 0x2f, 0x4, [@generic={0x11, 0x7, "46b960fa8ea4ef649d74ddff4e4758"}, @generic={0x35, 0x22, "c0651b770a8513992eecac17b4da89e370f4bf9309403e55ec1271a58183cfd7088a9facdfdc882c73f6127f5947225f9338f0"}]}}]}}]}}]}}, &(0x7f0000000b80)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x300, 0x0, 0x7, 0x6, 0x8, 0x7}, 0x33, &(0x7f0000000c00)={0x5, 0xf, 0x33, 0x4, [@ssp_cap={0x14, 0x10, 0xa, 0xcf, 0x2, 0x7fffffe, 0xf00, 0x2, [0xff0000, 0x3f00]}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a7f9c74ce6dade2ab83f965e1e25ea0f"}, @ptm_cap={0x3}]}, 0x7, [{0x4, &(0x7f0000000980)=@lang_id={0x4, 0x3, 0x419}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x41e}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x843}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x402}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x440a}}, {0x67, &(0x7f0000000ac0)=@string={0x67, 0x3, "6a0700fc8826988c1260979f48a7c4d1532a36017ad978825e5cf42ffbcf576a6b7d607afe46c6323e963a4a4fe9b2f979c7773ad19f8fa0bdfb33c766d7e71dfb8fa4b52f009ca3f14fb87afb0d88615131515e8d6f5075f88bb75f814e85b7d9ec2704a8"}}, {0x4, &(0x7f0000000b40)=@lang_id={0x4, 0x3, 0x1009}}]}) 0s ago: executing program 0 (id=1): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0xd2, 0x87, 0x49, 0x40, 0x1740, 0x9707, 0x34de, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x25, 0x98}}]}}]}}, &(0x7f0000000500)={0x0, 0x0, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="090f0c002155c1a6a8e0"]}) syz_usb_disconnect(r1) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x56a, 0x30c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x60, 0x10, 0x8, [{{0x9, 0x4, 0x0, 0x98, 0x1, 0x3, 0x1, 0x2, 0xb, {0x9, 0x21, 0x2, 0x9, 0x1, {0x22, 0x34e}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6d, 0x1, 0x7f}}}}}]}}]}}, &(0x7f0000000440)={0x0, 0x0, 0x5, &(0x7f0000000100)={0x5, 0xf, 0x5}}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000a40)={0x2c, &(0x7f0000000780)={0x8ade946416f95ea5, 0xa}, 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.159' (ED25519) to the list of known hosts. [ 38.901920][ T29] audit: type=1400 audit(1740007692.633:80): avc: denied { mounton } for pid=2933 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 38.907302][ T2933] cgroup: Unknown subsys name 'net' [ 38.924752][ T29] audit: type=1400 audit(1740007692.633:81): avc: denied { mount } for pid=2933 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 38.952239][ T29] audit: type=1400 audit(1740007692.673:82): avc: denied { unmount } for pid=2933 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 39.088510][ T2933] cgroup: Unknown subsys name 'cpuset' [ 39.096602][ T2933] cgroup: Unknown subsys name 'rlimit' [ 39.307657][ T29] audit: type=1400 audit(1740007693.043:83): avc: denied { setattr } for pid=2933 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 39.331042][ T29] audit: type=1400 audit(1740007693.043:84): avc: denied { mounton } for pid=2933 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 39.355953][ T29] audit: type=1400 audit(1740007693.043:85): avc: denied { mount } for pid=2933 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 39.402376][ T2936] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 39.412031][ T29] audit: type=1400 audit(1740007693.143:86): avc: denied { relabelto } for pid=2936 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 39.438880][ T29] audit: type=1400 audit(1740007693.143:87): avc: denied { write } for pid=2936 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 39.468199][ T29] audit: type=1400 audit(1740007693.203:88): avc: denied { read } for pid=2933 comm="syz-executor" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 39.471986][ T2933] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 39.493932][ T29] audit: type=1400 audit(1740007693.203:89): avc: denied { open } for pid=2933 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 49.450178][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 49.450201][ T29] audit: type=1400 audit(1740007703.183:96): avc: denied { create } for pid=2943 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 49.518701][ T29] audit: type=1400 audit(1740007703.183:97): avc: denied { write } for pid=2943 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 49.539364][ T29] audit: type=1400 audit(1740007703.233:98): avc: denied { append } for pid=2824 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.561974][ T29] audit: type=1400 audit(1740007703.233:99): avc: denied { open } for pid=2824 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.584863][ T29] audit: type=1400 audit(1740007703.233:100): avc: denied { getattr } for pid=2824 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.717060][ T29] audit: type=1400 audit(1740007703.253:101): avc: denied { read } for pid=2943 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 75.417431][ T29] audit: type=1400 audit(1740007729.153:102): avc: denied { mounton } for pid=2951 comm="syz-executor" path="/root/syzkaller.Vvgzg7/syz-tmp" dev="sda1" ino=1944 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 75.493500][ T29] audit: type=1400 audit(1740007729.183:103): avc: denied { mount } for pid=2951 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 75.516103][ T29] audit: type=1400 audit(1740007729.183:104): avc: denied { mounton } for pid=2951 comm="syz-executor" path="/root/syzkaller.Vvgzg7/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 75.542063][ T29] audit: type=1400 audit(1740007729.183:105): avc: denied { mount } for pid=2951 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 75.564188][ T29] audit: type=1400 audit(1740007729.183:106): avc: denied { mounton } for pid=2951 comm="syz-executor" path="/root/syzkaller.Vvgzg7/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 75.591082][ T29] audit: type=1400 audit(1740007729.183:107): avc: denied { mounton } for pid=2951 comm="syz-executor" path="/root/syzkaller.Vvgzg7/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=2697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 75.618738][ T29] audit: type=1400 audit(1740007729.183:108): avc: denied { unmount } for pid=2951 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 75.638554][ T29] audit: type=1400 audit(1740007729.213:109): avc: denied { mounton } for pid=2951 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=497 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 75.639987][ T5161] modprobe (5161) used greatest stack depth: 22648 bytes left [ 75.774322][ T2951] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 76.228838][ T29] audit: type=1400 audit(1740007729.963:110): avc: denied { read write } for pid=2951 comm="syz-executor" name="loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 76.315892][ T29] audit: type=1400 audit(1740007729.993:111): avc: denied { open } for pid=2951 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 76.727320][ T1120] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 76.888531][ T1120] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 76.899829][ T1120] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 76.909714][ T1120] usb 4-1: config 0 interface 0 has no altsetting 0 [ 76.916408][ T1120] usb 4-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 76.925480][ T1120] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.963537][ T1120] usb 4-1: config 0 descriptor?? [ 76.995915][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 77.003663][ T2803] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 77.011458][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 77.085920][ T36] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 77.165890][ T2803] usb 5-1: Using ep0 maxpacket: 16 [ 77.174253][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 77.182118][ T5203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.185286][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 77.194860][ T5203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.203567][ T9] usb 3-1: New USB device found, idVendor=1038, idProduct=12c2, bcdDevice= 0.00 [ 77.220766][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.229066][ T8] usb 2-1: config 0 has an invalid interface number: 88 but max is 0 [ 77.235939][ T36] usb 1-1: Using ep0 maxpacket: 16 [ 77.237298][ T8] usb 2-1: config 0 has no interface number 0 [ 77.246068][ T36] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 77.249318][ T2803] usb 5-1: config 7 has an invalid interface number: 121 but max is 0 [ 77.256623][ T36] usb 1-1: config 0 has no interface number 0 [ 77.264785][ T2803] usb 5-1: config 7 has no interface number 0 [ 77.275543][ T36] usb 1-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 77.278742][ T8] usb 2-1: New USB device found, idVendor=10b8, idProduct=1faa, bcdDevice=e9.06 [ 77.286476][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.295178][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.303375][ T36] usb 1-1: Product: syz [ 77.311290][ T8] usb 2-1: Product: syz [ 77.311321][ T8] usb 2-1: Manufacturer: syz [ 77.315506][ T36] usb 1-1: Manufacturer: syz [ 77.319691][ T8] usb 2-1: SerialNumber: syz [ 77.323425][ T9] usb 3-1: config 0 descriptor?? [ 77.324329][ T36] usb 1-1: SerialNumber: syz [ 77.331969][ T2803] usb 5-1: New USB device found, idVendor=2304, idProduct=0243, bcdDevice=23.d4 [ 77.346315][ T36] usb 1-1: config 0 descriptor?? [ 77.352537][ T2803] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.363899][ T36] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 77.365486][ T2803] usb 5-1: Product: syz [ 77.365514][ T2803] usb 5-1: Manufacturer: syz [ 77.381079][ T2803] usb 5-1: SerialNumber: syz [ 77.392682][ T8] usb 2-1: config 0 descriptor?? [ 77.422945][ T5203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.432140][ T5203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.547466][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 77.553736][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 77.572426][ T9] usb 3-1: USB disconnect, device number 2 [ 77.613747][ T1120] hid-steam 0003:28DE:1102.0001: unknown main item tag 0x0 [ 77.621474][ T1120] hid-steam 0003:28DE:1102.0001: unknown main item tag 0x0 [ 77.624318][ T2803] dvb-usb: found a 'Pinnacle PCTV 73A' in warm state. [ 77.635421][ T1120] hid-steam 0003:28DE:1102.0001: : USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.3-1/input0 [ 77.659009][ T8] dvb-usb: found a 'DiBcom STK8096-PVR reference design' in warm state. [ 77.670010][ T2803] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 77.680865][ T8] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 77.691960][ T2803] dvbdev: DVB: registering new adapter (Pinnacle PCTV 73A) [ 77.702324][ T8] dvbdev: DVB: registering new adapter (DiBcom STK8096-PVR reference design) [ 77.706886][ T1120] hid-steam 0003:28DE:1102.0001: Steam Controller 'XXXXXXXXXX' connected [ 77.711220][ T2803] usb 5-1: media controller created [ 77.725209][ T8] usb 2-1: media controller created [ 77.734025][ T1120] input: Steam Controller as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:28DE:1102.0001/input/input5 [ 77.754067][ T8] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 77.774795][ T1120] hid-steam 0003:28DE:1102.0002: unknown main item tag 0x0 [ 77.782353][ T1120] hid-steam 0003:28DE:1102.0002: unknown main item tag 0x0 [ 77.789089][ T2803] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 77.825705][ T5225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.847077][ T5225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.859798][ T5227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.873174][ T5227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.887170][ T8] DVB: Unable to find symbol dib8000_attach() [ 77.888965][ T1120] hid-steam 0003:28DE:1102.0002: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.3-1/input0 [ 77.893367][ T8] dvb-usb: no frontend was attached by 'DiBcom STK8096-PVR reference design' [ 77.913663][ T8] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 77.925071][ T5225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.934982][ T5227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.943709][ T1120] usb 4-1: USB disconnect, device number 2 [ 77.947440][ T5225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.958635][ T5227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.969896][ T2803] DVB: Unable to find symbol dib7000p_attach() [ 77.976670][ T2803] dvb-usb: no frontend was attached by 'Pinnacle PCTV 73A' [ 77.991361][ T5225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.000366][ T5225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.016544][ T8] dvbdev: DVB: registering new adapter (DiBcom STK8096-PVR reference design) [ 78.019999][ T24] input: Steam Controller as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:28DE:1102.0001/input/input7 [ 78.035933][ T8] usb 2-1: media controller created [ 78.053883][ T5231] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.062989][ T5231] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.074881][ T8] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 78.079431][ T1120] hid-steam 0003:28DE:1102.0001: Steam Controller 'XXXXXXXXXX' disconnected [ 78.100016][ T2803] rc_core: IR keymap rc-dib0700-rc5 not found [ 78.106286][ T2803] Registered IR keymap rc-empty [ 78.112730][ T2827] ================================================================== [ 78.120848][ T2827] BUG: KASAN: slab-use-after-free in steam_input_close+0x13b/0x150 [ 78.128921][ T2827] Read of size 8 at addr ffff88811ae0b130 by task acpid/2827 [ 78.136325][ T2827] [ 78.138675][ T2827] CPU: 0 UID: 0 PID: 2827 Comm: acpid Not tainted 6.14.0-rc3-syzkaller-00036-g0a86e49acfbb #0 [ 78.138707][ T2827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 78.138730][ T2827] Call Trace: [ 78.138739][ T2827] [ 78.138752][ T2827] dump_stack_lvl+0x116/0x1f0 [ 78.138798][ T2827] print_report+0xc3/0x620 [ 78.138824][ T2827] ? __virt_addr_valid+0x5e/0x590 [ 78.138849][ T2827] ? __phys_addr+0xc6/0x150 [ 78.138879][ T2827] kasan_report+0xd9/0x110 [ 78.138903][ T2827] ? steam_input_close+0x13b/0x150 [ 78.138936][ T2827] ? steam_input_close+0x13b/0x150 [ 78.138970][ T2827] ? __pfx_steam_input_close+0x10/0x10 [ 78.139008][ T2827] steam_input_close+0x13b/0x150 [ 78.139041][ T2827] ? __pfx_steam_input_close+0x10/0x10 [ 78.139073][ T2827] input_close_device+0x21f/0x290 [ 78.139101][ T2827] evdev_release+0x350/0x400 [ 78.139132][ T2827] ? __pfx_evdev_release+0x10/0x10 [ 78.139167][ T2827] __fput+0x3ff/0xb70 [ 78.139205][ T2827] __fput_sync+0xa1/0xc0 [ 78.139240][ T2827] __x64_sys_close+0x86/0x100 [ 78.139281][ T2827] do_syscall_64+0xcd/0x250 [ 78.139325][ T2827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.139359][ T2827] RIP: 0033:0x7f303cfcd0a8 [ 78.139382][ T2827] Code: 48 8b 05 83 9d 0d 00 64 c7 00 16 00 00 00 83 c8 ff 48 83 c4 20 5b c3 64 8b 04 25 18 00 00 00 85 c0 75 20 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 5b 48 8b 15 51 9d 0d 00 f7 d8 64 89 02 48 83 [ 78.139409][ T2827] RSP: 002b:00007ffcc09e36f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 78.139440][ T2827] RAX: ffffffffffffffda RBX: 00007ffcc09e3968 RCX: 00007f303cfcd0a8 [ 78.139457][ T2827] RDX: 0000000000000000 RSI: 000000000000001e RDI: 000000000000000a [ 78.139472][ T2827] RBP: 000000000000000a R08: 0000000000000008 R09: 00007ffcc09e3868 [ 78.139487][ T2827] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc09e3868 [ 78.139503][ T2827] R13: 0000000000000040 R14: 00007ffcc09e3968 R15: 00007ffcc09e3868 [ 78.139544][ T2827] [ 78.139552][ T2827] [ 78.330821][ T2827] Allocated by task 1120: [ 78.335172][ T2827] kasan_save_stack+0x33/0x60 [ 78.339933][ T2827] kasan_save_track+0x14/0x30 [ 78.344653][ T2827] __kasan_kmalloc+0x8f/0xa0 [ 78.349291][ T2827] __kmalloc_node_track_caller_noprof+0x20b/0x4c0 [ 78.355785][ T2827] devm_kmalloc+0xa5/0x260 [ 78.360253][ T2827] steam_probe+0x132/0x1060 [ 78.364787][ T2827] hid_device_probe+0x349/0x700 [ 78.369669][ T2827] really_probe+0x23e/0xa90 [ 78.374202][ T2827] __driver_probe_device+0x1de/0x440 [ 78.379525][ T2827] driver_probe_device+0x4c/0x1b0 [ 78.384595][ T2827] __device_attach_driver+0x1df/0x310 [ 78.389997][ T2827] bus_for_each_drv+0x157/0x1e0 [ 78.394876][ T2827] __device_attach+0x1e8/0x4b0 [ 78.399672][ T2827] bus_probe_device+0x17f/0x1c0 [ 78.404549][ T2827] device_add+0x114b/0x1a70 [ 78.409077][ T2827] hid_add_device+0x374/0xa60 [ 78.413803][ T2827] usbhid_probe+0xd32/0x1400 [ 78.418424][ T2827] usb_probe_interface+0x300/0x9c0 [ 78.423580][ T2827] really_probe+0x23e/0xa90 [ 78.428115][ T2827] __driver_probe_device+0x1de/0x440 [ 78.433437][ T2827] driver_probe_device+0x4c/0x1b0 [ 78.438506][ T2827] __device_attach_driver+0x1df/0x310 [ 78.443929][ T2827] bus_for_each_drv+0x157/0x1e0 [ 78.448806][ T2827] __device_attach+0x1e8/0x4b0 [ 78.453612][ T2827] bus_probe_device+0x17f/0x1c0 [ 78.458496][ T2827] device_add+0x114b/0x1a70 [ 78.463039][ T2827] usb_set_configuration+0x10cb/0x1c50 [ 78.468542][ T2827] usb_generic_driver_probe+0xb1/0x110 [ 78.474037][ T2827] usb_probe_device+0xec/0x3e0 [ 78.478868][ T2827] really_probe+0x23e/0xa90 [ 78.483410][ T2827] __driver_probe_device+0x1de/0x440 [ 78.488740][ T2827] driver_probe_device+0x4c/0x1b0 [ 78.493810][ T2827] __device_attach_driver+0x1df/0x310 [ 78.499228][ T2827] bus_for_each_drv+0x157/0x1e0 [ 78.504107][ T2827] __device_attach+0x1e8/0x4b0 [ 78.508902][ T2827] bus_probe_device+0x17f/0x1c0 [ 78.513783][ T2827] device_add+0x114b/0x1a70 [ 78.518309][ T2827] usb_new_device+0xd09/0x1a20 [ 78.523094][ T2827] hub_event+0x2e58/0x4f40 [ 78.527618][ T2827] process_one_work+0x9c5/0x1ba0 [ 78.532593][ T2827] worker_thread+0x6c8/0xf00 [ 78.537220][ T2827] kthread+0x3af/0x750 [ 78.541331][ T2827] ret_from_fork+0x45/0x80 [ 78.545791][ T2827] ret_from_fork_asm+0x1a/0x30 [ 78.550580][ T2827] [ 78.552912][ T2827] Freed by task 1120: [ 78.556903][ T2827] kasan_save_stack+0x33/0x60 [ 78.561608][ T2827] kasan_save_track+0x14/0x30 [ 78.566319][ T2827] kasan_save_free_info+0x3b/0x60 [ 78.571369][ T2827] __kasan_slab_free+0x37/0x50 [ 78.576148][ T2827] kfree+0x294/0x480 [ 78.580063][ T2827] release_nodes+0x11e/0x240 [ 78.584666][ T2827] devres_release_group+0x1be/0x2a0 [ 78.589891][ T2827] hid_device_remove+0x107/0x260 [ 78.594865][ T2827] device_remove+0xc8/0x170 [ 78.599402][ T2827] device_release_driver_internal+0x44a/0x610 [ 78.605484][ T2827] bus_remove_device+0x22f/0x420 [ 78.610453][ T2827] device_del+0x396/0x9f0 [ 78.614837][ T2827] hid_destroy_device+0x19c/0x240 [ 78.619897][ T2827] usbhid_disconnect+0xa0/0xe0 [ 78.624685][ T2827] usb_unbind_interface+0x1e2/0x960 [ 78.629914][ T2827] device_remove+0x122/0x170 [ 78.634543][ T2827] device_release_driver_internal+0x44a/0x610 [ 78.640636][ T2827] bus_remove_device+0x22f/0x420 [ 78.645605][ T2827] device_del+0x396/0x9f0 [ 78.649972][ T2827] usb_disable_device+0x36c/0x7f0 [ 78.655018][ T2827] usb_disconnect+0x2e1/0x920 [ 78.659715][ T2827] hub_event+0x1bed/0x4f40 [ 78.664153][ T2827] process_one_work+0x9c5/0x1ba0 [ 78.669125][ T2827] worker_thread+0x6c8/0xf00 [ 78.673749][ T2827] kthread+0x3af/0x750 [ 78.677847][ T2827] ret_from_fork+0x45/0x80 [ 78.682300][ T2827] ret_from_fork_asm+0x1a/0x30 [ 78.687088][ T2827] [ 78.689432][ T2827] Last potentially related work creation: [ 78.695152][ T2827] kasan_save_stack+0x33/0x60 [ 78.699868][ T2827] kasan_record_aux_stack+0x9b/0xb0 [ 78.705105][ T2827] insert_work+0x36/0x230 [ 78.709466][ T2827] __queue_work+0x97e/0x1080 [ 78.714074][ T2827] queue_work_on+0x11a/0x140 [ 78.718680][ T2827] hid_hw_close+0xaf/0xe0 [ 78.723069][ T2827] drop_ref+0x2c8/0x390 [ 78.727254][ T2827] hidraw_disconnect+0x4b/0x60 [ 78.732050][ T2827] hid_disconnect+0x13e/0x1b0 [ 78.736769][ T2827] hid_hw_stop+0x16/0x80 [ 78.741047][ T2827] steam_remove+0x1af/0x220 [ 78.745577][ T2827] hid_device_remove+0xce/0x260 [ 78.750468][ T2827] device_remove+0xc8/0x170 [ 78.755004][ T2827] device_release_driver_internal+0x44a/0x610 [ 78.761119][ T2827] bus_remove_device+0x22f/0x420 [ 78.766094][ T2827] device_del+0x396/0x9f0 [ 78.770461][ T2827] hid_destroy_device+0x19c/0x240 [ 78.775517][ T2827] steam_remove+0xf0/0x220 [ 78.779963][ T2827] hid_device_remove+0xce/0x260 [ 78.784851][ T2827] device_remove+0xc8/0x170 [ 78.789404][ T2827] device_release_driver_internal+0x44a/0x610 [ 78.795488][ T2827] bus_remove_device+0x22f/0x420 [ 78.800468][ T2827] device_del+0x396/0x9f0 [ 78.804834][ T2827] hid_destroy_device+0x19c/0x240 [ 78.809896][ T2827] usbhid_disconnect+0xa0/0xe0 [ 78.814683][ T2827] usb_unbind_interface+0x1e2/0x960 [ 78.819909][ T2827] device_remove+0x122/0x170 [ 78.824544][ T2827] device_release_driver_internal+0x44a/0x610 [ 78.830632][ T2827] bus_remove_device+0x22f/0x420 [ 78.835610][ T2827] device_del+0x396/0x9f0 [ 78.839977][ T2827] usb_disable_device+0x36c/0x7f0 [ 78.845028][ T2827] usb_disconnect+0x2e1/0x920 [ 78.849723][ T2827] hub_event+0x1bed/0x4f40 [ 78.854167][ T2827] process_one_work+0x9c5/0x1ba0 [ 78.859138][ T2827] worker_thread+0x6c8/0xf00 [ 78.863765][ T2827] kthread+0x3af/0x750 [ 78.867948][ T2827] ret_from_fork+0x45/0x80 [ 78.872402][ T2827] ret_from_fork_asm+0x1a/0x30 [ 78.877196][ T2827] [ 78.879526][ T2827] Second to last potentially related work creation: [ 78.886119][ T2827] kasan_save_stack+0x33/0x60 [ 78.890828][ T2827] kasan_record_aux_stack+0x9b/0xb0 [ 78.896061][ T2827] insert_work+0x36/0x230 [ 78.900419][ T2827] __queue_work+0x97e/0x1080 [ 78.905021][ T2827] queue_work_on+0x11a/0x140 [ 78.909627][ T2827] steam_client_ll_open+0xab/0xf0 [ 78.914682][ T2827] hid_hw_open+0xe2/0x170 [ 78.919042][ T2827] hidraw_open+0x274/0x7e0 [ 78.923503][ T2827] chrdev_open+0x237/0x6a0 [ 78.927950][ T2827] do_dentry_open+0x6cb/0x1390 [ 78.932747][ T2827] vfs_open+0x82/0x3f0 [ 78.936844][ T2827] path_openat+0x1e88/0x2d80 [ 78.941454][ T2827] do_filp_open+0x20c/0x470 [ 78.945977][ T2827] do_sys_openat2+0x17a/0x1e0 [ 78.950686][ T2827] __x64_sys_openat+0x175/0x210 [ 78.955577][ T2827] do_syscall_64+0xcd/0x250 [ 78.960132][ T2827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.966049][ T2827] [ 78.968377][ T2827] The buggy address belongs to the object at ffff88811ae0b000 [ 78.968377][ T2827] which belongs to the cache kmalloc-1k of size 1024 [ 78.982443][ T2827] The buggy address is located 304 bytes inside of [ 78.982443][ T2827] freed 1024-byte region [ffff88811ae0b000, ffff88811ae0b400) [ 78.996340][ T2827] [ 78.998686][ T2827] The buggy address belongs to the physical page: [ 79.005133][ T2827] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ae08 [ 79.014004][ T2827] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 79.022517][ T2827] flags: 0x200000000000040(head|node=0|zone=2) [ 79.028691][ T2827] page_type: f5(slab) [ 79.032693][ T2827] raw: 0200000000000040 ffff888100041dc0 ffffea000474a400 dead000000000002 [ 79.041296][ T2827] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 79.049922][ T2827] head: 0200000000000040 ffff888100041dc0 ffffea000474a400 dead000000000002 [ 79.058610][ T2827] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 79.067302][ T2827] head: 0200000000000003 ffffea00046b8201 ffffffffffffffff 0000000000000000 [ 79.075998][ T2827] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 79.084673][ T2827] page dumped because: kasan: bad access detected [ 79.091100][ T2827] page_owner tracks the page as allocated [ 79.096819][ T2827] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3049, tgid 3049 (kworker/u8:3), ts 42474342799, free_ts 42434535518 [ 79.118203][ T2827] post_alloc_hook+0x181/0x1b0 [ 79.122995][ T2827] get_page_from_freelist+0xe76/0x2b90 [ 79.128495][ T2827] __alloc_frozen_pages_noprof+0x21c/0x2290 [ 79.134431][ T2827] alloc_pages_mpol+0xe7/0x410 [ 79.139242][ T2827] new_slab+0x23d/0x330 [ 79.143422][ T2827] ___slab_alloc+0xc41/0x1670 [ 79.148118][ T2827] __slab_alloc.constprop.0+0x56/0xb0 [ 79.153612][ T2827] __kmalloc_noprof+0x154/0x4d0 [ 79.158509][ T2827] load_elf_phdrs+0x103/0x210 [ 79.163235][ T2827] load_elf_binary+0x1f8/0x4f00 [ 79.168128][ T2827] bprm_execve+0x8dd/0x1680 [ 79.172658][ T2827] kernel_execve+0x2ef/0x3b0 [ 79.177291][ T2827] call_usermodehelper_exec_async+0x255/0x4c0 [ 79.183469][ T2827] ret_from_fork+0x45/0x80 [ 79.187950][ T2827] ret_from_fork_asm+0x1a/0x30 [ 79.192746][ T2827] page last free pid 2945 tgid 2945 stack trace: [ 79.199079][ T2827] free_frozen_pages+0x653/0xde0 [ 79.204042][ T2827] __put_partials+0x14c/0x170 [ 79.208744][ T2827] qlist_free_all+0x4e/0x120 [ 79.213374][ T2827] kasan_quarantine_reduce+0x195/0x1e0 [ 79.218863][ T2827] __kasan_slab_alloc+0x4e/0x70 [ 79.223729][ T2827] kmem_cache_alloc_node_noprof+0x150/0x3b0 [ 79.229670][ T2827] __alloc_skb+0x2b1/0x380 [ 79.234116][ T2827] netlink_alloc_large_skb+0x69/0x130 [ 79.239605][ T2827] netlink_sendmsg+0x689/0xd70 [ 79.244399][ T2827] __sys_sendto+0x488/0x4f0 [ 79.248931][ T2827] __x64_sys_sendto+0xe0/0x1c0 [ 79.253721][ T2827] do_syscall_64+0xcd/0x250 [ 79.258270][ T2827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.264189][ T2827] [ 79.266526][ T2827] Memory state around the buggy address: [ 79.272163][ T2827] ffff88811ae0b000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.280242][ T2827] ffff88811ae0b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.288322][ T2827] >ffff88811ae0b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.296392][ T2827] ^ [ 79.302040][ T2827] ffff88811ae0b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.310121][ T2827] ffff88811ae0b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.318215][ T2827] ================================================================== [ 79.326999][ T36] gspca_spca1528: reg_w err -110 [ 79.327111][ T2827] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 79.327132][ T2827] CPU: 0 UID: 0 PID: 2827 Comm: acpid Not tainted 6.14.0-rc3-syzkaller-00036-g0a86e49acfbb #0 [ 79.327171][ T2827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 79.327190][ T2827] Call Trace: [ 79.327200][ T2827] [ 79.327213][ T2827] dump_stack_lvl+0x3d/0x1f0 [ 79.327270][ T2827] panic+0x71d/0x800 [ 79.327319][ T2827] ? __pfx_panic+0x10/0x10 [ 79.327372][ T2827] ? check_panic_on_warn+0x1f/0xb0 [ 79.327423][ T2827] check_panic_on_warn+0xab/0xb0 [ 79.327484][ T2827] end_report+0x117/0x180 [ 79.327518][ T2827] kasan_report+0xe9/0x110 [ 79.327550][ T2827] ? steam_input_close+0x13b/0x150 [ 79.327595][ T2827] ? steam_input_close+0x13b/0x150 [ 79.327639][ T2827] ? __pfx_steam_input_close+0x10/0x10 [ 79.327683][ T2827] steam_input_close+0x13b/0x150 [ 79.327727][ T2827] ? __pfx_steam_input_close+0x10/0x10 [ 79.327770][ T2827] input_close_device+0x21f/0x290 [ 79.327805][ T2827] evdev_release+0x350/0x400 [ 79.327846][ T2827] ? __pfx_evdev_release+0x10/0x10 [ 79.327885][ T2827] __fput+0x3ff/0xb70 [ 79.327935][ T2827] __fput_sync+0xa1/0xc0 [ 79.327981][ T2827] __x64_sys_close+0x86/0x100 [ 79.328033][ T2827] do_syscall_64+0xcd/0x250 [ 79.328085][ T2827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.328127][ T2827] RIP: 0033:0x7f303cfcd0a8 [ 79.328152][ T2827] Code: 48 8b 05 83 9d 0d 00 64 c7 00 16 00 00 00 83 c8 ff 48 83 c4 20 5b c3 64 8b 04 25 18 00 00 00 85 c0 75 20 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 5b 48 8b 15 51 9d 0d 00 f7 d8 64 89 02 48 83 [ 79.328183][ T2827] RSP: 002b:00007ffcc09e36f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 79.328215][ T2827] RAX: ffffffffffffffda RBX: 00007ffcc09e3968 RCX: 00007f303cfcd0a8 [ 79.328237][ T2827] RDX: 0000000000000000 RSI: 000000000000001e RDI: 000000000000000a [ 79.328257][ T2827] RBP: 000000000000000a R08: 0000000000000008 R09: 00007ffcc09e3868 [ 79.328278][ T2827] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc09e3868 [ 79.328300][ T2827] R13: 0000000000000040 R14: 00007ffcc09e3968 R15: 00007ffcc09e3868 [ 79.328330][ T2827] [ 79.332292][ T2827] Kernel Offset: disabled