Extracting prog: 17m41.7985053s
Minimizing prog: 15m16.96683582s
Simplifying prog options: 7m3.297041459s
Extracting C: 1m19.21624835s
Simplifying C: 0s


extracting reproducer from 24 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_usb_control_io-mkdir-mount-openat-write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x4, "01010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='stm32g0-typec 0x35', 0x12)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040450c01600001000000010902200001010080fa0904000002ffffff0007058101fc030107058203400001"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000400)={0x14, &(0x7f0000000100)={0xc1, 0x0, 0x1, "10"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e00)={0x14, &(0x7f0000000f00)={0x41}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x14, &(0x7f0000000200)={0x41, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x14, &(0x7f0000000280)={0xc1, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x14, &(0x7f0000000200)={0x41, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d00)={0x14, &(0x7f0000000280)={0xc1, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-nanosleep-syz_open_dev$evdev
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x0, &(0x7f0000000100)={0xc0, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-openat-write-openat-write-openat$dlm_control-write-socket$inet-connect
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/dlm/cluster\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm/cluster/comms/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/cluster/comms/1/nodeid\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1\x00', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/dlm/cluster/comms/1/local\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='1\x00', 0x2)
r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
write(r2, &(0x7f0000000300)="0600000000000000020000000401000000000000000000006c733100"/152, 0x78)
r3 = socket$inet(0x2, 0x1, 0x6)
connect(r3, &(0x7f0000000400)=@in={0x2, 0x5248, @loopback}, 0x10)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 3, 4, 4, 35, 12, 4, 22, 37, 18, 10, 32, 37, 13, 17, 4, 4, 16, 37, 13, 16, 4, 7, 7]
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='1', 0x1)
close(r0)
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200), 0x200)
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000300)='syz \x00', 0x5)
connect$rxrpc(r0, &(0x7f0000000400)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24)
sendmsg(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000d00)="11223344", 0x4}], 0x1, &(0x7f0000000e00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file8\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000080)='A\x00', 0x2)
lseek(r0, 0xffffe, 0x0)
write(r0, &(0x7f00000000c0)='B\x00', 0x2)
close(r0)
mkdir(&(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000200)='./config/usb_gadget/g9\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g9/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g9/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0x0104\x00', 0x7)
close(r2)
mkdir(&(0x7f0000000340)='./config/usb_gadget/g9/strings/0x409\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g9/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g9/strings/0x409/manufacturer\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='Manufacturer\x00', 0xd)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g9/strings/0x409/product\x00', 0x1, 0x0)
write(r5, &(0x7f00000004c0)='Product\x00', 0x8)
close(r5)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g9/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000540)='./config/usb_gadget/g9/configs/c.1/strings/0x409\x00', 0x1ff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g9/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='Conf 1\x00', 0x7)
close(r6)
mkdir(&(0x7f0000000600)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r7, &(0x7f0000000680)='/proc/self/cwd/file8\x00', 0x14)
close(r7)
symlink(&(0x7f00000006c0)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', &(0x7f0000000700)='./config/usb_gadget/g9/configs/c.1/mass_storage.usb8\x00')
r8 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g9/UDC\x00', 0x1, 0x0)
write(r8, &(0x7f0000000780)='dummy_udc.0', 0xb)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/dlm/cluster\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm/cluster/comms/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/cluster/comms/1/nodeid\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1\x00', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/dlm/cluster/comms/1/local\x00', 0x1, 0x0)
write(r1, &(0x7f0000000240)='1\x00', 0x2)
r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
write(r2, &(0x7f0000000300)="0600000000000000020000000401000000000000000000006c733100"/152, 0x78)
r3 = socket$inet(0x2, 0x1, 0x6)
connect(r3, &(0x7f0000000400)=@in={0x2, 0x5248, @loopback}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x0, 0x0)
read(r0, 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
read(r0, &(0x7f0000000200), 0x200)
executing program 3:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file8\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000080)='A\x00', 0x2)
lseek(r0, 0xffffe, 0x0)
write(r0, 0x0, 0x0)
close(r0)
mkdir(&(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000200)='./config/usb_gadget/g9\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g9/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g9/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0x0104\x00', 0x7)
close(r2)
mkdir(&(0x7f0000000340)='./config/usb_gadget/g9/strings/0x409\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g9/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g9/strings/0x409/manufacturer\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='Manufacturer\x00', 0xd)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g9/strings/0x409/product\x00', 0x1, 0x0)
write(r5, &(0x7f00000004c0)='Product\x00', 0x8)
close(r5)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g9/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000540)='./config/usb_gadget/g9/configs/c.1/strings/0x409\x00', 0x1ff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g9/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='Conf 1\x00', 0x7)
close(r6)
mkdir(&(0x7f0000000600)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r7, &(0x7f0000000680)='/proc/self/cwd/file8\x00', 0x14)
close(r7)
symlink(&(0x7f00000006c0)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', &(0x7f0000000700)='./config/usb_gadget/g9/configs/c.1/mass_storage.usb8\x00')
r8 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g9/UDC\x00', 0x1, 0x0)
write(r8, &(0x7f0000000780)='dummy_udc.0', 0xb)
close(r8)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:02.0\x00', 0xd)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='ohci-pci\x00', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ohci-pci/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='0000:00:02.0\x00', 0xd)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='ohci-platform\x00', 0xe)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/ohci-platform/bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='pcspkr\x00', 0x7)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/platform/drivers/ohci-platform/bind\x00', 0x1, 0x0)
write(r5, &(0x7f00000004c0)='serial8250\x00', 0xb)
executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000080)='\x00'/10, 0xa, 0x0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10)
recvfrom(r0, &(0x7f0000000140)=""/10, 0xa, 0x0, 0x0, 0x0)
add_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000200)="0100000002000800ffffff7f0100"/32, 0x20, 0xffffffff)
r2 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_SECURITY_KEY(r2, 0x110, 0x1, &(0x7f0000000300)='syz \x00', 0x5)
sendmsg(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000d00)="11223344", 0x4}], 0x1, &(0x7f0000000e00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
recvfrom$inet(r0, &(0x7f0000000600), 0x3e8, 0x0, &(0x7f0000000700)={0x2, 0x0, @loopback}, 0x10)
executing program 2:
r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(r0, &(0x7f0000000080)='A\x00', 0x2)
lseek(r0, 0xffffe, 0x0)
write(r0, &(0x7f00000000c0)='B\x00', 0x2)
close(r0)
mkdir(&(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000200)='./config/usb_gadget/g9\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g9/idVendor\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g9/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0x0104\x00', 0x7)
close(r1)
mkdir(&(0x7f0000000340)='./config/usb_gadget/g9/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g9/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='1234567890\x00', 0xb)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g9/strings/0x409/manufacturer\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='Manufacturer\x00', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g9/strings/0x409/product\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='Product\x00', 0x8)
close(r4)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g9/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000540)='./config/usb_gadget/g9/configs/c.1/strings/0x409\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g9/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0)
write(r5, &(0x7f00000005c0)='Conf 1\x00', 0x7)
close(r5)
mkdir(&(0x7f0000000600)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', 0x1ff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g9/functions/mass_storage.usb8/lun.0/file\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680), 0x0)
close(r6)
symlink(&(0x7f00000006c0)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', &(0x7f0000000700)='./config/usb_gadget/g9/configs/c.1/mass_storage.usb8\x00')
executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file8\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000080)='A\x00', 0x2)
lseek(r0, 0xffffe, 0x0)
write(r0, 0x0, 0x0)
close(r0)
mkdir(&(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000200)='./config/usb_gadget/g9\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g9/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g9/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0x0104\x00', 0x7)
close(r2)
mkdir(&(0x7f0000000340)='./config/usb_gadget/g9/strings/0x409\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g9/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g9/strings/0x409/manufacturer\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='Manufacturer\x00', 0xd)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g9/strings/0x409/product\x00', 0x1, 0x0)
write(r5, &(0x7f00000004c0)='Product\x00', 0x8)
close(r5)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g9/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000540)='./config/usb_gadget/g9/configs/c.1/strings/0x409\x00', 0x1ff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g9/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='Conf 1\x00', 0x7)
close(r6)
mkdir(&(0x7f0000000600)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g9/functions/mass_storage.usb8/lun.0/file\x00', 0x1, 0x0)
write(r7, 0x0, 0x0)
close(r7)
symlink(&(0x7f00000006c0)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', &(0x7f0000000700)='./config/usb_gadget/g9/configs/c.1/mass_storage.usb8\x00')
r8 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g9/UDC\x00', 0x1, 0x0)
write(r8, &(0x7f0000000780)='dummy_udc.0', 0xb)
close(r8)
executing program 2:
mount(&(0x7f0000000100)=@filename='0\x00', &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='0\x00', &(0x7f0000000600)='./sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/dlm/cl1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/dlm/cl1/comms/1/nodeid\x00', 0x1, 0x0)
write(r0, &(0x7f0000000b00)='1\x00', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/dlm/cl1/comms/1/addr\x00', 0x1, 0x0)
write(r1, &(0x7f0000000d00)="0200"/128, 0x80)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/dlm/cl1/spaces/ls1/nodes/1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000004200)='0\x00', 0x2)
close(0xffffffffffffffff)
write(0xffffffffffffffff, &(0x7f0000004700)='1\x00', 0x2)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:02.0\x00', 0xd)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='ohci-pci\x00', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ohci-pci/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='0000:00:02.0\x00', 0xd)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='ohci-platform\x00', 0xe)
close(r3)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/ohci-platform/bind\x00', 0x1, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/platform/drivers/ohci-platform/bind\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='serial8250\x00', 0xb)
executing program 2:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1', 0x1)
executing program 2:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x0, &(0x7f0000000100)={0xc0, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040450c01600001000000010902200001010080fa0904000002ffffff0007058101fc030107058203400001"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000400)={0x14, &(0x7f0000000100)={0xc1, 0x0, 0x1, "10"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e00)={0x14, &(0x7f0000000f00)={0x41}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x14, &(0x7f0000000200)={0x41, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x14, &(0x7f0000000280)={0xc1, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x14, &(0x7f0000000200)={0x41, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d00)={0x14, &(0x7f0000000280)={0xc1, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file8\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000080)='A\x00', 0x2)
lseek(r0, 0xffffe, 0x0)
write(r0, 0x0, 0x0)
close(r0)
mkdir(&(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000200)='./config/usb_gadget/g9\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g9/idVendor\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g9/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='0x0104\x00', 0x7)
close(r2)
mkdir(&(0x7f0000000340)='./config/usb_gadget/g9/strings/0x409\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g9/strings/0x409/serialnumber\x00', 0x1, 0x0)
write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g9/strings/0x409/manufacturer\x00', 0x1, 0x0)
write(r4, &(0x7f0000000440)='Manufacturer\x00', 0xd)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g9/strings/0x409/product\x00', 0x1, 0x0)
write(r5, &(0x7f00000004c0)='Product\x00', 0x8)
close(r5)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g9/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000540)='./config/usb_gadget/g9/configs/c.1/strings/0x409\x00', 0x1ff)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g9/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0)
write(r6, &(0x7f00000005c0)='Conf 1\x00', 0x7)
close(r6)
mkdir(&(0x7f0000000600)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g9/functions/mass_storage.usb8/lun.0/file\x00', 0x1, 0x0)
write(r7, 0x0, 0x0)
close(r7)
symlink(&(0x7f00000006c0)='./config/usb_gadget/g9/functions/mass_storage.usb8\x00', &(0x7f0000000700)='./config/usb_gadget/g9/configs/c.1/mass_storage.usb8\x00')
r8 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g9/UDC\x00', 0x1, 0x0)
write(r8, &(0x7f0000000780)='dummy_udc.0', 0xb)
close(r8)
executing program 1:
mount(&(0x7f0000000100)=@filename='0\x00', &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='0\x00', &(0x7f0000000600)='./sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/dlm/cl1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/dlm/cl1/comms/1/nodeid\x00', 0x1, 0x0)
write(r0, &(0x7f0000000b00)='1\x00', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/dlm/cl1/comms/1/addr\x00', 0x1, 0x0)
write(r1, &(0x7f0000000d00)="0200"/128, 0x80)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/dlm/cl1/spaces/ls1/nodes/1\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000004200)='0\x00', 0x2)
close(0xffffffffffffffff)
write(0xffffffffffffffff, &(0x7f0000004700)='1\x00', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='0000:00:02.0\x00', 0xd)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='ohci-pci\x00', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ohci-pci/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='0000:00:02.0\x00', 0xd)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='ohci-platform\x00', 0xe)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/platform/drivers/ohci-platform/bind\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='serial8250\x00', 0xb)
executing program 1:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='1', 0x1)
executing program 1:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000080)='\x00'/10, 0xa, 0x0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10)
add_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000200)="0100000002000800ffffff7f0100"/32, 0x20, 0xffffffff)
r2 = socket$rxrpc(0x21, 0x2, 0x2)
setsockopt$RXRPC_SECURITY_KEY(r2, 0x110, 0x1, &(0x7f0000000300)='syz \x00', 0x5)
executing program 1:
r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x4, "01010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='stm32g0-typec 0x35', 0x12)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 4 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_usb_control_io-mkdir-mount-openat-write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x40, 0x3, 0x4, "01010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='stm32g0-typec 0x35', 0x12)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040450c01600001000000010902200001010080fa0904000002ffffff0007058101fc030107058203400001"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000400)={0x14, &(0x7f0000000100)={0xc1, 0x0, 0x1, "10"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000e00)={0x14, &(0x7f0000000f00)={0x41}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x14, &(0x7f0000000200)={0x41, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x14, &(0x7f0000000280)={0xc1, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x14, &(0x7f0000000200)={0x41, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d00)={0x14, &(0x7f0000000280)={0xc1, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')
syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000001000)='\x00')

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-nanosleep-syz_open_dev$evdev
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x0, &(0x7f0000000100)={0xc0, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-nanosleep
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x0, &(0x7f0000000100)={0xc0, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x0, &(0x7f0000000100)={0xc0, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, 0x0, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
simplifying guilty program options
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401aeb03e30000010203010902190001010080fa0904000001ff00000007058202000200"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
validation run: crashed=true
reproducing took 47m38.363045837s
repro crashed as (corrupted=false):
em28xx 1-1:1.0: Config register raw data: 0xffffffed
em28xx 1-1:1.0: AC97 chip type couldn't be determined
em28xx 1-1:1.0: No AC97 audio processor
tuner: 1-0061: Tuner has no way to set tv freq
videodev: could not get a free minor
em28xx 1-1:1.0: can't register radio device
em28xx 1-1:1.0: V4L2 device video103 deregistered
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events request_module_async
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:1000
 register_lock_class+0xcc/0x2e0 kernel/locking/lockdep.c:1315
 __lock_acquire+0xaf/0x2e50 kernel/locking/lockdep.c:5128
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:155 [inline]
 _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:181
 __wake_up_common_lock+0x30/0x1f0 kernel/sched/wait.c:124
 __vb2_queue_cancel+0x2de/0xde0 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x2f/0x150 drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:943 [inline]
 vb2_video_unregister_device+0x15b/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1279
 em28xx_v4l2_init+0x1c89/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events request_module_async
RIP: 0010:__wake_up_common kernel/sched/wait.c:104 [inline]
RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 kernel/sched/wait.c:125
Code: 0f 84 d4 00 00 00 44 8b 64 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 fd 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 bc 66 97 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc900000f7880 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8880332d5740 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc900000f77e0
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200001eefc R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880332d57d0
FS:  0000000000000000(0000) GS:ffff88812488f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4c35c14e9c CR3: 000000007de6a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __vb2_queue_cancel+0x2de/0xde0 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x2f/0x150 drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:943 [inline]
 vb2_video_unregister_device+0x15b/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1279
 em28xx_v4l2_init+0x1c89/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__wake_up_common kernel/sched/wait.c:104 [inline]
RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 kernel/sched/wait.c:125
Code: 0f 84 d4 00 00 00 44 8b 64 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 fd 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 bc 66 97 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc900000f7880 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8880332d5740 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc900000f77e0
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200001eefc R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880332d57d0
FS:  0000000000000000(0000) GS:ffff88812488f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4c35c14e9c CR3: 000000007de6a000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	0f 84 d4 00 00 00    	je     0xda
   6:	44 8b 64 24 04       	mov    0x4(%rsp),%r12d
   b:	eb 13                	jmp    0x20
   d:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  14:	fc ff df
  17:	4c 39 fd             	cmp    %r15,%rbp
  1a:	0f 84 ba 00 00 00    	je     0xda
  20:	49 89 ee             	mov    %rbp,%r14
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1) <-- trapping instruction
  2e:	74 12                	je     0x42
  30:	4c 89 f7             	mov    %r14,%rdi
  33:	e8 bc 66 97 00       	call   0x9766f4
  38:	48                   	rex.W
  39:	ba 00 00 00 00       	mov    $0x0,%edx
  3e:	00 fc                	add    %bh,%ah

final repro crashed as (corrupted=false):
em28xx 1-1:1.0: Config register raw data: 0xffffffed
em28xx 1-1:1.0: AC97 chip type couldn't be determined
em28xx 1-1:1.0: No AC97 audio processor
tuner: 1-0061: Tuner has no way to set tv freq
videodev: could not get a free minor
em28xx 1-1:1.0: can't register radio device
em28xx 1-1:1.0: V4L2 device video103 deregistered
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events request_module_async
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:1000
 register_lock_class+0xcc/0x2e0 kernel/locking/lockdep.c:1315
 __lock_acquire+0xaf/0x2e50 kernel/locking/lockdep.c:5128
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:155 [inline]
 _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:181
 __wake_up_common_lock+0x30/0x1f0 kernel/sched/wait.c:124
 __vb2_queue_cancel+0x2de/0xde0 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x2f/0x150 drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:943 [inline]
 vb2_video_unregister_device+0x15b/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1279
 em28xx_v4l2_init+0x1c89/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events request_module_async
RIP: 0010:__wake_up_common kernel/sched/wait.c:104 [inline]
RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 kernel/sched/wait.c:125
Code: 0f 84 d4 00 00 00 44 8b 64 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 fd 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 bc 66 97 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc900000f7880 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8880332d5740 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc900000f77e0
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200001eefc R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880332d57d0
FS:  0000000000000000(0000) GS:ffff88812488f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4c35c14e9c CR3: 000000007de6a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __vb2_queue_cancel+0x2de/0xde0 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x2f/0x150 drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:943 [inline]
 vb2_video_unregister_device+0x15b/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1279
 em28xx_v4l2_init+0x1c89/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__wake_up_common kernel/sched/wait.c:104 [inline]
RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 kernel/sched/wait.c:125
Code: 0f 84 d4 00 00 00 44 8b 64 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 fd 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 bc 66 97 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc900000f7880 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8880332d5740 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc900000f77e0
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200001eefc R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880332d57d0
FS:  0000000000000000(0000) GS:ffff88812488f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4c35c14e9c CR3: 000000007de6a000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	0f 84 d4 00 00 00    	je     0xda
   6:	44 8b 64 24 04       	mov    0x4(%rsp),%r12d
   b:	eb 13                	jmp    0x20
   d:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  14:	fc ff df
  17:	4c 39 fd             	cmp    %r15,%rbp
  1a:	0f 84 ba 00 00 00    	je     0xda
  20:	49 89 ee             	mov    %rbp,%r14
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1) <-- trapping instruction
  2e:	74 12                	je     0x42
  30:	4c 89 f7             	mov    %r14,%rdi
  33:	e8 bc 66 97 00       	call   0x9766f4
  38:	48                   	rex.W
  39:	ba 00 00 00 00       	mov    $0x0,%edx
  3e:	00 fc                	add    %bh,%ah