last executing test programs: 40m20.059521275s ago: executing program 32 (id=736): read$hidraw(0xffffffffffffffff, &(0x7f00000000c0)=""/186, 0xba) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc70e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xdc, 0x0, 0x37, [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x1, 0x0, 0xa7, {0x9, 0x21, 0xc2b, 0x81, 0x1, {0x22, 0x32d}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x88, 0x8, 0x7}}}}}]}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0xf, &(0x7f0000000080)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0xa, 0x0, 0x81}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000104355220500000000000109022400010000400009040803010300010009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000440)={0x2c, &(0x7f0000000500)=ANY=[@ANYBLOB="401105"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x74, &(0x7f0000000180)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62, 0x2, 0x1, 0x4, 0x0, 0x4, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "4923cdd8d5bf"}, {0x5, 0x24, 0x0, 0xc000}, {0xd, 0x24, 0xf, 0x1, 0x6000000, 0x4e, 0x7f, 0x80}, {0x6, 0x24, 0x1a, 0x6, 0x29}}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0xd, 0x80, 0xff}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x3, 0xb7}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0xfa, 0x6}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x200, 0x0, 0x4, 0x10, 0x40, 0x5}, 0xba, &(0x7f0000000240)={0x5, 0xf, 0xba, 0x3, [@generic={0x8d, 0x10, 0xb, "0f35d0b4c88863ee26e248a59a0739c79415d9b8744f36b2fa9250282651cef2fbd1e509932435a7af95cccd2d742c44edc66e4219f19bd5cf87d634e6761a60fa391d6a83d559e87090b59460191ab6e1fbb1618d02e4c786f973e5c41fe95049ca258981dbc9a7885beaa1d1312897e4de1a964d1ef990e93b75d91ca5683773bfed8995905e3dc1c5"}, @ssp_cap={0x1c, 0x10, 0xa, 0x6, 0x4, 0x6, 0xf880, 0x2de, [0xffc0c0, 0xf, 0xff00d8, 0xff00c0]}, @ssp_cap={0xc, 0x10, 0xa, 0xb, 0x0, 0x1, 0xf, 0x200}]}, 0x8, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x1409}}, {0x76, &(0x7f0000000400)=@string={0x76, 0x3, "8882cab8553d9f77bb421666f27b301ce7dd800a0c1003b6a77d748f7bcdd977d400d4919d4849e18b5a74c76d6b1a6076187689ef822a1a419f5f9b80924dca473f604c929b2300da0c094dafdc7c06702d32dce21274c4eeda37e11ea11f0e74ea988610d6a08d19c8abc36009ead1390bd602"}}, {0x18, &(0x7f0000000380)=@string={0x18, 0x3, "dc3035149646befd3caf77b6f0ee37c04c2bb76e4a33"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x449}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0xf4ff}}, {0x4, &(0x7f0000000540)=@lang_id={0x3e, 0x3, 0x422}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x813}}, {0x21, &(0x7f00000005c0)=@string={0x21, 0x3, "abb03f51b89248936ffe2a98ef230e96b4956e8dadb949e0d4fa4373dc839a"}}]}) 40m19.964001767s ago: executing program 33 (id=735): syz_usb_connect$cdc_ncm(0x6, 0x88, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x76, 0x2, 0x1, 0x4, 0x120, 0x4, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x300, 0x6, 0x6}, {0x6, 0x24, 0x1a, 0xed05, 0xd}, [@obex={0x5}, @mdlm={0x15, 0x24, 0x12, 0x400}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x58, 0x5, 0x7f}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x38, 0x7f, 0x1, 0x17}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0xf, 0x3, 0x80}}}}}}}]}}, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x60b, 0x500a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x50, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4f8}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000080)={0x40, 0x11, 0x37, {0x37, 0xc, "6440f7ec3e71acc55d3ec187bb7e30030636c409d0f4549695899f8db9299b906261b26527b4b85525b0df1131b675b1a0efbb63b7"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000001c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000706000000ff030902"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x4d8, 0xf372, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x60, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1000, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0xc, 0x4, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000000)={0x2c, &(0x7f0000000280)={0x20, 0x0, 0xbf, {0xbf, 0x22, "a7ea3163fd3f9718194b120c05cf66f2c5a72e1d3b1e73d54cfc4ad2841ef4f6a3fd7c59ccb785025f2e7b3504bb00000010f3c080bf3385a7015d3a32ed6b5217cdbb6fadb2ea2890cfc29a315cafaaeeeef9bfd0d97a288982d5337c36f5b0ddccbe56ccb4d0ec8b6f6ef8ae907caf75ae5394e13c2e406914d1d37f4afa290a2c95f06c1fdc13f6d675586db1a23acc51e2afb5bcda27893752355be5ba947685b2340fc820eea67350418559f20ce90243afe967a76b2f40a42a8d"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042402024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 40m19.823086949s ago: executing program 34 (id=734): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) r1 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090583"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a500243010203010902120001000000000904"], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000180)={0x40, 0xe, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000740)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00\f\x00\b\x00\x00', @ANYRES64], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f00000003c0)={0x20, 0xe, 0x57, "adfe2db38022ce5f18939ccec0db3de565d34d602f10d9f8748f360560fcdabd71a151e6df699ce57dfb094ed3a2332116a28bab74fca60efa1dd99a490720734a65842b0e0950d64f3e2fa1e2733c0b52991abf7e2635"}, 0x0, 0x0, 0x0, 0x0}) r3 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0xa0, 0x8, [{{0x9, 0x4, 0x0, 0xf9, 0x2, 0x3, 0x1, 0x1, 0x0, {0x9, 0x21, 0x5, 0xff, 0x1, {0x22, 0xdd1}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x4, 0x2, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x1, 0x2, 0x2}}]}}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x0, 0x6, 0x5, 0x9, 0x8, 0x6}, 0x33, &(0x7f00000000c0)={0x5, 0xf, 0x33, 0x2, [@ssp_cap={0x24, 0x10, 0xa, 0xfe, 0x6, 0x0, 0xf, 0x96, [0x3f00, 0xcf, 0x3f0f, 0xc0ff, 0xff00, 0x0]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xf, 0x10, 0x17, 0x2}]}, 0x8, [{0xa1, &(0x7f0000000100)=@string={0xa1, 0x3, "192a552a52c99e5324827b5f7b7ff2bb322cd1df5a5443b90e34dae74941e10df2b69e79477bb9fbd7357f34f2d2bcdc90029b0657731beecbba7aeb0c41f4f479eaef6144cc27686ab88dff0d6b9df80eef8b31645b256e02e527a6db27852d4c361086b9697445ffdcd4acd4c80610f365e4f5f92c250f2af4d0331bfa4d1e86de27176df567d865c74e6f37b1ae7fbf0985c4ac14679e4ee87f5b999f13"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x2c09}}, {0x13, &(0x7f0000000240)=@string={0x13, 0x3, "f8880bf3f878ba3888558379d4fd13543d"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x3409}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x224}}, {0x2d, &(0x7f0000000480)=@string={0x2d, 0x3, "f767ad107a27b56af8fc9682ecdfb437266bda90eb7aeb2091d442012f590efc68c99b9d0655466b437e75"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0xc1a}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x441}}]}) syz_usb_control_io$hid(r3, &(0x7f0000000840)={0x24, &(0x7f0000000600)={0x40, 0xf, 0x8f, {0x8f, 0xb, "b5d613202b5e2f0b8b7e69ff756e3abe3e185273f9049c9bec38468e0a480e86651ea1278b605300ee802f12b2bdeab281a16f8328eafb1ff173f294d5eaf78131b578b5453bc02ad9cd78e7513e2ea9ca52c711a3bc1ab83a344eebfbbc874a91d70cc70681476ed7f10a30ede0b1deb0a8e1a703f73854a301419390a8f91bfe53bdef118dc59e3983604178"}}, &(0x7f0000000780)={0x0, 0x3, 0xb1, @string={0xb1, 0x3, "f59d7ae7b64a7419b48d7adb0245ba0c6f041f5319ffd7cf02de95145e528ba312c30e1b5a720b4b36a29bdc9745f9896b89a980b8a92ef9cf36f1d41a6d19014c29d27a705aa42fedcac09696e36df5f039e42a741780810694dc7c35e50c819893aa72262d0b8581eaf3d87ab3c8c48ab2f672efc7b571dfef3b448a20533c23a7b9d2a89ef5d75a86c60880149fa3cd7230e738936dceb47f4b5306599554b17656c8820375e19a74fe1c1620f7"}}, &(0x7f00000006c0)={0x0, 0x22, 0xd, {[@main=@item_012={0x1, 0x0, 0xb, ']'}, @main=@item_012={0x0, 0x0, 0xc}, @local=@item_4={0x3, 0x2, 0x1, "3ddda43a"}, @main=@item_4={0x3, 0x0, 0x9, "67b5b85e"}]}}, &(0x7f0000000700)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7fff, 0x80, 0x1, {0x22, 0xea9}}}}, &(0x7f0000000a80)={0x2c, &(0x7f0000000880)={0x20, 0xd, 0xb4, "53ca5baf85d48ec4b5c49d9e62b4981387d1c40014038084a06ef7ee2001218fb944cc26630d64bbc5fc0bba2389475cd72dbe5c3ae1513262a39803b5fd0d48f8a23a57ff78b3b3be7b4a59726856995de6c8e6d65a8c0b5a8936389c8e6c79e8e8b29e62fc6d03fbda91efd172dd9cf5bd3967b53f5030984490b66c4990772fa3e6eed99dd82f999459344021a33f1bd7dedf3e822ee05245a657ddc216cefddb6f98b0d4307424faea8ed17bc45b3a1a324d"}, &(0x7f0000000940)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000980)={0x0, 0x8, 0x1, 0x7}, &(0x7f00000009c0)={0x20, 0x1, 0x64, "b71f54ae388c9c76f22c2bf3f217cd3f5263438271bfaa23427653375530173315ef20b646b567b9de753b1d7c2238975fedc34c58a085aa1f8fbb511e08adbcd8e418dc253127396f573941194d4198061cd95ea207ac0603cb482d065f252a8ddfb84e"}, &(0x7f0000000a40)={0x20, 0x3, 0x1, 0x3}}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000001580)={0x2c, &(0x7f00000013c0)=ANY=[@ANYBLOB='@\":'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffff75, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2ea95f65bba452eae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c90679b4dd859ddc9e4800448aab0000000000000d75f34bb50d8d7084") 40m19.669406472s ago: executing program 35 (id=737): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x3, 0x24, &(0x7f0000000200)={{0x12, 0x1, 0x0, 0x22, 0x17, 0x4a, 0x20, 0x4b4, 0x861f, 0xf9d6, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x73, 0xa7, 0x7a}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100007882b740422c0917b7ca010203010902120001000000000904000000bf60e700ba5a92c8f1417ee798e056a85ba2f13e9b7a4ea724bdece4d9915a79d30f9719d02204354208d790b275e119cafda49bd3f6e3cf3296563b476524205d8813dee6cd7f7f7e4eebf7348669b3561c665c5c7659c0e93ef700000000"], 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000600)={0x44, &(0x7f00000000c0)={0x0, 0x0, 0x1, "ac"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000740)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00\f\x00\b\x00\x00', @ANYRES64], 0x0, 0x0, 0x0, 0x0}) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100001964d408861a92e03f530102030109022400010200100309041f0202e917f300090502020002020000090582020002"], 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r4) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000b10b5103a092226"], 0x0) syz_usb_disconnect(r5) r6 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_ep_write(r4, 0x81, 0x2, &(0x7f0000000240)="1000") syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) 40m19.499615694s ago: executing program 36 (id=738): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xc70, 0xf001, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x10}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000000000)={0x40, 0x11, 0x3b, {0x3b, 0x11, "ecb0e7a7dd8867a234280f510817e700879c7f46203877869571067c21df7a364338eb9e26e166882ed9d48c83292a3eb928f892bd4e8949d4"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1001}}, &(0x7f00000000c0)={0x0, 0x22, 0x10, {[@local=@item_012={0x2, 0x2, 0x0, ' [ 2869.507669][ C0] dump_stack_lvl+0x116/0x1f0 [ 2869.507748][ C0] print_report+0xcd/0x680 [ 2869.507796][ C0] ? __virt_addr_valid+0x81/0x610 [ 2869.507850][ C0] ? __phys_addr+0xe8/0x180 [ 2869.507906][ C0] ? mcp2221_raw_event+0xf94/0x1030 [ 2869.507959][ C0] kasan_report+0xe0/0x110 [ 2869.508009][ C0] ? mcp2221_raw_event+0xf94/0x1030 [ 2869.508069][ C0] mcp2221_raw_event+0xf94/0x1030 [ 2869.508122][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 2869.508176][ C0] __hid_input_report.constprop.0+0x311/0x450 [ 2869.508248][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 2869.508306][ C0] hid_irq_in+0x35e/0x870 [ 2869.508363][ C0] __usb_hcd_giveback_urb+0x38d/0x6e0 [ 2869.508418][ C0] usb_hcd_giveback_urb+0x39b/0x450 [ 2869.508473][ C0] dummy_timer+0x180e/0x3a20 [ 2869.508584][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2869.508643][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2869.508700][ C0] ? mark_held_locks+0x49/0x80 [ 2869.508741][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 2869.508797][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2869.508854][ C0] __hrtimer_run_queues+0x202/0xad0 [ 2869.508911][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 2869.508964][ C0] ? read_tsc+0x9/0x20 [ 2869.509025][ C0] hrtimer_run_softirq+0x17d/0x350 [ 2869.509077][ C0] handle_softirqs+0x205/0x8d0 [ 2869.509142][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 2869.509209][ C0] __irq_exit_rcu+0xfa/0x160 [ 2869.509267][ C0] irq_exit_rcu+0x9/0x30 [ 2869.509326][ C0] sysvec_apic_timer_interrupt+0x90/0xb0 [ 2869.509386][ C0] [ 2869.509400][ C0] [ 2869.509416][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2869.509464][ C0] RIP: 0010:console_flush_all+0x9a2/0xc60 [ 2869.509525][ C0] Code: 00 e8 b2 42 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 40 79 20 00 48 85 db 0f 85 55 01 00 00 e8 c2 7d 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 97 7b 7d [ 2869.509577][ C0] RSP: 0018:ffffc9000519f868 EFLAGS: 00000293 [ 2869.509612][ C0] RAX: ffffffff895d4678 RBX: 0000000000000000 RCX: ffffffff815d4eb0 [ 2869.509642][ C0] RDX: ffff88813454d700 RSI: ffffffff815d4ebe RDI: 0000000000000007 [ 2869.509671][ C0] RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 [ 2869.509699][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff895d4678 [ 2869.509728][ C0] R13: ffffffff895d4620 R14: ffffc9000519f8f8 R15: dffffc0000000000 [ 2869.509765][ C0] ? console_flush_all+0x990/0xc60 [ 2869.509817][ C0] ? console_flush_all+0x99e/0xc60 [ 2869.509875][ C0] ? console_flush_all+0x99e/0xc60 [ 2869.509937][ C0] ? __pfx_console_flush_all+0x10/0x10 [ 2869.509994][ C0] ? __lock_acquire+0x622/0x1c90 [ 2869.510039][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 2869.510106][ C0] console_unlock+0xd8/0x210 [ 2869.510158][ C0] ? __pfx_console_unlock+0x10/0x10 [ 2869.510215][ C0] ? vprintk_emit+0x67c/0x6d0 [ 2869.510277][ C0] vprintk_emit+0x418/0x6d0 [ 2869.510338][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 2869.510399][ C0] ? kasan_quarantine_put+0x10a/0x240 [ 2869.510445][ C0] _printk+0xc7/0x100 [ 2869.510486][ C0] ? __pfx__printk+0x10/0x10 [ 2869.510534][ C0] ? legacy_dvb_usb_read_remote_control+0x3ff/0x4f0 [ 2869.510591][ C0] ? legacy_dvb_usb_read_remote_control+0x118/0x4f0 [ 2869.510642][ C0] legacy_dvb_usb_read_remote_control+0x40b/0x4f0 [ 2869.510694][ C0] ? __pfx_legacy_dvb_usb_read_remote_control+0x10/0x10 [ 2869.510748][ C0] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 2869.510798][ C0] process_one_work+0x9cc/0x1b70 [ 2869.510857][ C0] ? __pfx_process_one_work+0x10/0x10 [ 2869.510917][ C0] ? assign_work+0x1a0/0x250 [ 2869.510964][ C0] worker_thread+0x6c8/0xf10 [ 2869.511023][ C0] ? __kthread_parkme+0x19e/0x250 [ 2869.511087][ C0] ? __pfx_worker_thread+0x10/0x10 [ 2869.511138][ C0] kthread+0x3c5/0x780 [ 2869.511183][ C0] ? __pfx_kthread+0x10/0x10 [ 2869.511230][ C0] ? rcu_is_watching+0x12/0xc0 [ 2869.511287][ C0] ? __pfx_kthread+0x10/0x10 [ 2869.511332][ C0] ret_from_fork+0x5b3/0x6c0 [ 2869.511397][ C0] ? __pfx_kthread+0x10/0x10 [ 2869.511442][ C0] ret_from_fork_asm+0x1a/0x30 [ 2869.511508][ C0] [ 2869.511523][ C0] [ 2869.511904][ T7035] dvb-usb: error while querying for an remote control event. [ 2869.519830][ C0] Allocated by task 4139: [ 2869.533414][ T5244] m920x_read = error: -19 [ 2869.535107][ C0] kasan_save_stack+0x33/0x60 [ 2869.543064][ T5244] dvb-usb: error while querying for an remote control event. [ 2869.547259][ C0] kasan_save_track+0x14/0x30 [ 2869.547299][ C0] __kasan_slab_alloc+0x6e/0x70 [ 2869.547336][ C0] kmem_cache_alloc_node_noprof+0x14d/0x3a0 [ 2869.547388][ C0] copy_process+0x4b6/0x7580 [ 2869.547438][ C0] kernel_clone+0xfc/0x960 [ 2869.581733][T24956] m920x_read = error: -19 [ 2869.582511][ C0] __do_sys_clone3+0x212/0x290 [ 2869.585436][T24956] dvb-usb: error while querying for an remote control event. [ 2869.590065][ C0] do_syscall_64+0xcd/0x4b0 [ 2869.597582][T16881] m920x_read = error: -19 [ 2869.599527][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2869.604167][T16881] dvb-usb: error while querying for an remote control event. [ 2869.609265][ C0] [ 2869.609276][ C0] Freed by task 5335: [ 2869.609293][ C0] kasan_save_stack+0x33/0x60 [ 2869.614104][ T7035] m920x_read = error: -19 [ 2869.618938][ C0] kasan_save_track+0x14/0x30 [ 2869.618987][ C0] kasan_save_free_info+0x3b/0x60 [ 2869.624223][ T7035] dvb-usb: error while querying for an remote control event. [ 2869.629847][ C0] __kasan_slab_free+0x37/0x50 [ 2869.636387][ T5244] m920x_read = error: -19 [ 2869.641383][ C0] kmem_cache_free+0x2a0/0x470 [ 2869.641440][ C0] delayed_put_task_struct+0x115/0x2e0 [ 2869.645797][ T5244] dvb-usb: error while querying for an remote control event. [ 2869.651160][ C0] rcu_core+0x799/0x14e0 [ 2869.651218][ C0] handle_softirqs+0x205/0x8d0 [ 2869.651281][ C0] __irq_exit_rcu+0xfa/0x160 [ 2869.656698][ T3935] m920x_read = error: -19 [ 2869.661119][ C0] irq_exit_rcu+0x9/0x30 [ 2869.661179][ C0] sysvec_apic_timer_interrupt+0x90/0xb0 [ 2869.666168][ T3935] dvb-usb: error while querying for an remote control event. [ 2869.671051][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2869.671097][ C0] [ 2869.671106][ C0] Last potentially related work creation: [ 2869.671125][ C0] kasan_save_stack+0x33/0x60 [ 2869.680622][ T4400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2869.681704][ C0] kasan_record_aux_stack+0x8c/0xa0 [ 2869.681764][ C0] __call_rcu_common.constprop.0+0x9a/0x9f0 [ 2870.209706][ C0] put_task_struct_rcu_user+0x75/0xc0 [ 2870.215219][ C0] __schedule+0x1332/0x3b10 [ 2870.219776][ C0] schedule+0xe7/0x3a0 [ 2870.223912][ C0] schedule_timeout+0x257/0x290 [ 2870.228835][ C0] ___down_common+0x2d8/0x460 [ 2870.233595][ C0] __down_interruptible+0x21/0x40 [ 2870.238693][ C0] down_interruptible+0x7f/0xa0 [ 2870.243601][ C0] raw_ioctl+0x1287/0x2c30 [ 2870.248080][ C0] __x64_sys_ioctl+0x18e/0x210 [ 2870.252887][ C0] do_syscall_64+0xcd/0x4b0 [ 2870.257620][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2870.263558][ C0] [ 2870.265918][ C0] The buggy address belongs to the object at ffff88812f12d700 [ 2870.265918][ C0] which belongs to the cache task_struct of size 7168 [ 2870.280203][ C0] The buggy address is located 3327 bytes to the right of [ 2870.280203][ C0] allocated 7168-byte region [ffff88812f12d700, ffff88812f12f300) [ 2870.295106][ C0] [ 2870.297463][ C0] The buggy address belongs to the physical page: [ 2870.303912][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f128 [ 2870.312807][ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2870.321451][ C0] memcg:ffff888143899781 [ 2870.325724][ C0] flags: 0x200000000000040(head|node=0|zone=2) [ 2870.331952][ C0] page_type: f5(slab) [ 2870.335995][ C0] raw: 0200000000000040 ffff888100ae3500 dead000000000122 0000000000000000 [ 2870.344617][ C0] raw: 0000000000000000 0000000000040004 00000000f5000000 ffff888143899781 [ 2870.353241][ C0] head: 0200000000000040 ffff888100ae3500 dead000000000122 0000000000000000 [ 2870.361949][ C0] head: 0000000000000000 0000000000040004 00000000f5000000 ffff888143899781 [ 2870.370684][ C0] head: 0200000000000003 ffffea0004bc4a01 00000000ffffffff 00000000ffffffff [ 2870.379408][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 2870.388115][ C0] page dumped because: kasan: bad access detected [ 2870.394677][ C0] page_owner tracks the page as allocated [ 2870.400427][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4131, tgid 4131 (syz.6.4929), ts 2815365190099, free_ts 2815224491523 [ 2870.422035][ C0] post_alloc_hook+0x1c0/0x230 [ 2870.426850][ C0] get_page_from_freelist+0xf98/0x2ce0 [ 2870.432353][ C0] __alloc_frozen_pages_noprof+0x259/0x21e0 [ 2870.438294][ C0] alloc_pages_mpol+0xe4/0x410 [ 2870.443101][ C0] new_slab+0x23b/0x330 [ 2870.447297][ C0] ___slab_alloc+0xda5/0x1940 [ 2870.452015][ C0] __slab_alloc.constprop.0+0x56/0xb0 [ 2870.457431][ C0] kmem_cache_alloc_node_noprof+0x1f6/0x3a0 [ 2870.463380][ C0] copy_process+0x4b6/0x7580 [ 2870.468025][ C0] kernel_clone+0xfc/0x960 [ 2870.472492][ C0] __do_sys_clone3+0x212/0x290 [ 2870.477468][ C0] do_syscall_64+0xcd/0x4b0 [ 2870.482032][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2870.488140][ C0] page last free pid 12028 tgid 12028 stack trace: [ 2870.494665][ C0] __free_frozen_pages+0x78a/0x1040 [ 2870.499910][ C0] __put_partials+0x16d/0x1c0 [ 2870.504634][ C0] qlist_free_all+0x4d/0x120 [ 2870.509260][ C0] kasan_quarantine_reduce+0x195/0x1e0 [ 2870.514761][ C0] __kasan_slab_alloc+0x4e/0x70 [ 2870.520089][ C0] kmem_cache_alloc_noprof+0x14f/0x3b0 [ 2870.525601][ C0] getname_flags.part.0+0x4c/0x550 [ 2870.530755][ C0] getname_flags+0x93/0xf0 [ 2870.535219][ C0] do_sys_openat2+0xb8/0x1d0 [ 2870.539845][ C0] __x64_sys_openat+0x174/0x210 [ 2870.544738][ C0] do_syscall_64+0xcd/0x4b0 [ 2870.549296][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2870.555235][ C0] [ 2870.557584][ C0] Memory state around the buggy address: [ 2870.563239][ C0] ffff88812f12fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2870.571335][ C0] ffff88812f12ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2870.579443][ C0] >ffff88812f12ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2870.587550][ C0] ^ [ 2870.595558][ C0] ffff88812f130000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2870.603662][ C0] ffff88812f130080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2870.611756][ C0] ================================================================== [ 2870.619861][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 2870.627103][ C0] CPU: 0 UID: 0 PID: 602 Comm: kworker/0:2 Not tainted 6.16.0-rc2-syzkaller-00050-ge35a5d814525 #0 PREEMPT(voluntary) [ 2870.639568][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2870.649667][ C0] Workqueue: events legacy_dvb_usb_read_remote_control [ 2870.656580][ C0] Call Trace: [ 2870.659897][ C0] [ 2870.662777][ C0] dump_stack_lvl+0x3d/0x1f0 [ 2870.667437][ C0] panic+0x71c/0x800 [ 2870.671389][ C0] ? __pfx_panic+0x10/0x10 [ 2870.675861][ C0] ? __pfx__printk+0x10/0x10 [ 2870.680502][ C0] ? end_report+0x4c/0x170 [ 2870.685001][ C0] ? mcp2221_raw_event+0xf94/0x1030 [ 2870.690275][ C0] check_panic_on_warn+0xab/0xb0 [ 2870.695281][ C0] end_report+0x107/0x170 [ 2870.699667][ C0] kasan_report+0xee/0x110 [ 2870.704129][ C0] ? mcp2221_raw_event+0xf94/0x1030 [ 2870.709412][ C0] mcp2221_raw_event+0xf94/0x1030 [ 2870.714511][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 2870.720393][ C0] __hid_input_report.constprop.0+0x311/0x450 [ 2870.726538][ C0] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 2870.732052][ C0] hid_irq_in+0x35e/0x870 [ 2870.736435][ C0] __usb_hcd_giveback_urb+0x38d/0x6e0 [ 2870.741861][ C0] usb_hcd_giveback_urb+0x39b/0x450 [ 2870.747110][ C0] dummy_timer+0x180e/0x3a20 [ 2870.751779][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2870.756798][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2870.761818][ C0] ? mark_held_locks+0x49/0x80 [ 2870.766632][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 2870.772500][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2870.777491][ C0] __hrtimer_run_queues+0x202/0xad0 [ 2870.782769][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 2870.788544][ C0] ? read_tsc+0x9/0x20 [ 2870.792685][ C0] hrtimer_run_softirq+0x17d/0x350 [ 2870.797865][ C0] handle_softirqs+0x205/0x8d0 [ 2870.802697][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 2870.808042][ C0] __irq_exit_rcu+0xfa/0x160 [ 2870.812694][ C0] irq_exit_rcu+0x9/0x30 [ 2870.817081][ C0] sysvec_apic_timer_interrupt+0x90/0xb0 [ 2870.822787][ C0] [ 2870.825764][ C0] [ 2870.828731][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2870.834759][ C0] RIP: 0010:console_flush_all+0x9a2/0xc60 [ 2870.840529][ C0] Code: 00 e8 b2 42 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 40 79 20 00 48 85 db 0f 85 55 01 00 00 e8 c2 7d 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 97 7b 7d [ 2870.860187][ C0] RSP: 0018:ffffc9000519f868 EFLAGS: 00000293 [ 2870.866305][ C0] RAX: ffffffff895d4678 RBX: 0000000000000000 RCX: ffffffff815d4eb0 [ 2870.874316][ C0] RDX: ffff88813454d700 RSI: ffffffff815d4ebe RDI: 0000000000000007 [ 2870.882322][ C0] RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 [ 2870.890333][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff895d4678 [ 2870.898343][ C0] R13: ffffffff895d4620 R14: ffffc9000519f8f8 R15: dffffc0000000000 [ 2870.906362][ C0] ? console_flush_all+0x990/0xc60 [ 2870.911553][ C0] ? console_flush_all+0x99e/0xc60 [ 2870.916733][ C0] ? console_flush_all+0x99e/0xc60 [ 2870.921993][ C0] ? __pfx_console_flush_all+0x10/0x10 [ 2870.927508][ C0] ? __lock_acquire+0x622/0x1c90 [ 2870.932486][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 2870.938177][ C0] console_unlock+0xd8/0x210 [ 2870.942822][ C0] ? __pfx_console_unlock+0x10/0x10 [ 2870.948074][ C0] ? vprintk_emit+0x67c/0x6d0 [ 2870.952808][ C0] vprintk_emit+0x418/0x6d0 [ 2870.957390][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 2870.962505][ C0] ? kasan_quarantine_put+0x10a/0x240 [ 2870.967962][ C0] _printk+0xc7/0x100 [ 2870.972008][ C0] ? __pfx__printk+0x10/0x10 [ 2870.976650][ C0] ? legacy_dvb_usb_read_remote_control+0x3ff/0x4f0 [ 2870.983440][ C0] ? legacy_dvb_usb_read_remote_control+0x118/0x4f0 [ 2870.990124][ C0] legacy_dvb_usb_read_remote_control+0x40b/0x4f0 [ 2870.996601][ C0] ? __pfx_legacy_dvb_usb_read_remote_control+0x10/0x10 [ 2871.003617][ C0] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 2871.009661][ C0] process_one_work+0x9cc/0x1b70 [ 2871.014660][ C0] ? __pfx_process_one_work+0x10/0x10 [ 2871.020086][ C0] ? assign_work+0x1a0/0x250 [ 2871.024723][ C0] worker_thread+0x6c8/0xf10 [ 2871.029370][ C0] ? __kthread_parkme+0x19e/0x250 [ 2871.034463][ C0] ? __pfx_worker_thread+0x10/0x10 [ 2871.039650][ C0] kthread+0x3c5/0x780 [ 2871.043787][ C0] ? __pfx_kthread+0x10/0x10 [ 2871.048436][ C0] ? rcu_is_watching+0x12/0xc0 [ 2871.053251][ C0] ? __pfx_kthread+0x10/0x10 [ 2871.057889][ C0] ret_from_fork+0x5b3/0x6c0 [ 2871.062537][ C0] ? __pfx_kthread+0x10/0x10 [ 2871.067173][ C0] ret_from_fork_asm+0x1a/0x30 [ 2871.071999][ C0] [ 2871.075367][ C0] Kernel Offset: disabled [ 2871.079736][ C0] Rebooting in 86400 seconds..