last executing test programs: 3.460461298s ago: executing program 0 (id=1): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x5b, &(0x7f0000001140)={{0x12, 0x1, 0x110, 0x48, 0xef, 0x63, 0x8, 0x45e, 0xf8, 0x2293, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x49, 0x1, 0xa2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xf2, 0x4, 0x3, 0xe, 0x1, 0x0, 0x5b, [@uac_control={{0xa, 0x24, 0x1, 0xa, 0x6}, [@input_terminal={0xc, 0x24, 0x2, 0x3, 0x200, 0x5, 0x2, 0xfff7, 0x6, 0x9}]}], [{{0x9, 0x5, 0x86, 0x10, 0x400, 0xf4, 0x8, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7f}]}}, {{0x9, 0x5, 0x0, 0x0, 0x40, 0x85, 0x3, 0xff}}, {{0x9, 0x5, 0x9, 0x1b, 0x8, 0xc, 0x7, 0x80}}]}}]}}]}}, 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xb7, 0x16, 0x61, 0x20, 0x1485, 0x1, 0x3e65, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x7b, 0x0, 0x0, 0x1, 0xbf, 0x72}}]}}]}}, 0x0) syz_usb_control_io(r1, &(0x7f0000000300)={0x2c, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x50, 0x0, 0x0, 0x0, 0x10, 0x46d, 0xc286, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xc0, [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x1, 0x1, 0x1, {0x9, 0x21, 0x8, 0x7, 0x1, {0x22, 0x4ae}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x8, 0x0, 0x20}}}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0x5, 0x0, 0x1, 0xff, 0x5e}, 0xd9, &(0x7f0000000180)={0x5, 0xf, 0xd9, 0x6, [@ptm_cap={0x3}, @generic={0xc1, 0x10, 0x1, "c15ab8c74c86b7b50258e5cf8c8a8f787cdb870073dbab6e669b2ab8446e6db279ded4c4f2fffb512f699901c7364134c83132586b4b1874423192f5f725141c579cd4a93aefa7ff2ed4eb1ee39e941ce2592052e0c44869bf44004c51fac81aa7fbdb3ca0c67f64cd21b2ef10d7eefb9ef1c8c1b3610e6574b992e8ec892cf29af4bbaf72d90a09962691b396ed3442e0a798f8504e5235c9c5499fcef0c203356b96bfcbf8189e18bef452c494ee023fb9cc7261bb57a6a8dcc0690ee0"}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x3, 0x0, 0x6}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x3, [{0x33, &(0x7f0000000280)=@string={0x33, 0x3, "eea9363c077b56011d3d440f48607ce60de45215a26dafd6db3b218f1cddc330beea3ac41f41510c344f89215eb7805edf"}}, {0x3c, &(0x7f00000002c0)=@string={0x3c, 0x3, "3432220d0cff80525b0a8214e42e83a1994ebed809b6f8cd4c373bd85e86cfd187d3ad0ff9e4aeb6763ebbec3834fadd6c2cee77ef694f6dccd2"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0xc1a}}]}) syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00030403c805f820e873a8457e4981e01a52f426d904f6095957104dd67ac67ee5e0"], 0x0, &(0x7f0000000040)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x8, 0x9, 0xc, "8652442a", "0bf81678"}}, 0x0}, 0x0) 3.099172204s ago: executing program 1 (id=2): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)={{0x12, 0x1, 0x0, 0xc4, 0x3b, 0x69, 0x40, 0x424, 0xcf19, 0x927c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x5d, 0x0, 0x0, 0x6e, 0x89, 0x55}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xa1, 0x12, 0x17, 0x10, 0xb95, 0x172a, 0xf7f4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xfb, 0x0, 0x2, 0x6c, 0x5d, 0x65, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x10, 0x0, 0xfa}}, {{0x9, 0x5, 0x82, 0x2, 0x40}}]}}]}}]}}, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) 2.902234796s ago: executing program 3 (id=4): r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000080)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="00000500020017e13f98eac2ce757c9bcb14ac099f13"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000980)=ANY=[]}, 0x0) r1 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_connect(0x3, 0x41, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x92, 0x91, 0x82, 0x40, 0x6f8, 0x300c, 0x3964, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2f, 0x1, 0x0, 0x0, 0x0, 0x3, [{{0x9, 0x4, 0x49, 0x0, 0x0, 0xe, 0x1, 0x0, 0x0, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x1ff, 0x7f, 0xd}, {0x6, 0x24, 0x1a, 0x401, 0x24}}]}}]}}]}}, 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100002439da20cd061201a2d20102030109021b0001000000000904000001717ffe000905a1"], 0x0) syz_usb_connect(0x0, 0xdd, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xc4, 0xb8, 0x68, 0x8, 0x2357, 0x109, 0xbdda, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0xf1, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0xff, 0xff, 0xff}}]}}]}}, 0x0) syz_usb_connect(0x0, 0x6d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003cda2a200a111022"], 0x0) syz_usb_disconnect(r2) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[], 0x0) r3 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000940)=@ready={0x0, 0x0, 0x8, "d1eaf73b", {0x1, 0x2, 0x3ff, 0x7}}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3"], 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002183b9220b1134200"], &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) r4 = syz_usb_connect(0x5, 0x64, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000cb8be7406d04230807000102030109025200010000000009044000000e0100390a240108000b020102082407010500070e11240606060509000600040007000300390c2402050302060254df000a092402050001031f04092403030003", @ANYRES32], 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f00000001c0)={0x20, 0x22, 0x1e, {0x1e, 0xe, "e84dbdab4a7392c45e2c800f01e27775b23f0d7db510a46cb61c056c"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x437}}, &(0x7f0000000280)=ANY=[@ANYRES32=r1], &(0x7f00000002c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xb, 0x3, 0x10, 0x7, "ac7ea42d", "804f4b85"}}, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xe, 0x0, 0x1, 0x40, 0x5, 0x5, 0x3}}}, &(0x7f0000000880)={0x84, &(0x7f0000000480)={0x0, 0x0, 0x40, "ef1c420d546196417fe61362e992dec7fa32f390b7b62178dd0803d035a275b5654d98b5633bc4567118a2fd93607775f223b650e39897f6b56f60d62a0c9a8a"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000000580)={0x20, 0x0, 0x4, {0x2, 0x20}}, &(0x7f00000005c0)={0x40, 0x7, 0x2, 0x101}, &(0x7f0000000600)={0x40, 0x9, 0x1, 0x5}, &(0x7f0000000640)={0x40, 0xb, 0x2, "c286"}, &(0x7f0000000680)={0x40, 0xf, 0x2, 0x5}, &(0x7f00000006c0)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, &(0x7f0000000700)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000740)={0x40, 0x19, 0x2, '@c'}, &(0x7f0000000780)={0x40, 0x1a, 0x2, 0xcf1}, &(0x7f00000007c0)={0x40, 0x1c, 0x1, 0x6}, &(0x7f0000000800)={0x40, 0x1e, 0x1, 0x2}, &(0x7f0000000840)={0x40, 0x21, 0x1, 0x9}}) syz_usb_connect$uac1(0x2, 0xa6, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x56, 0xc0, 0x2, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x101, 0xbb}, [@feature_unit={0x11, 0x24, 0x6, 0x1, 0x4, 0x5, [0x7, 0xa, 0x8, 0x3, 0x2], 0x5}, @selector_unit={0x5, 0x24, 0x5, 0x6, 0xf}, @feature_unit={0xf, 0x24, 0x6, 0x2, 0x5, 0x4, [0x2, 0x2, 0xa, 0xa], 0x4}, @processing_unit={0x7, 0x24, 0x7, 0x5, 0x4, 0xd7}, @output_terminal={0x9, 0x24, 0x3, 0x1, 0x202, 0x5, 0x5, 0xf5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x93, 0x1, 0x5, {0x7, 0x25, 0x1, 0x0, 0x3, 0xf48}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xd, 0x2, 0x4, {0x7, 0x25, 0x1, 0x91e8570469aa5526, 0x8, 0x3}}}}}}}]}}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) r5 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000440)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="2001404e8c4b94"], 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYRES8=r5, @ANYBLOB="24d483423890bc832b6c027d4672cf16b76f6714c4d928872363ae113e4111797ff0d6cbaac02ba961f333a6f450a83e500908ff3ebf9287ef355eff0e180316ed7ea1be17d1d42a4c2b826394bf20059321ae08b2a423e83c3330d46ff153fe1ac1c901dede1b679ff0be32f9fe9e17f4eef927cb05ed17b2cbfe5c82dd", @ANYRES64=r5, @ANYBLOB="9b5d2ec1146bb2a1ea5403759d924a0607a2069f84f2ef6fc4ea2c0b4db440c6783c12864498f671ac52b2f5c6cc24751c8a6ad5ba3e712eceda62fde5b740855f56bd869eb3009903c7974951c319b51925d51920de532d7a23d260f1d06c778311bbb0efbad7ac98393eb6c51157a5ad18e60c8f22acb24b9faebaa742aa37d028d0d0c12aecd75ca27f96a74f11ca6de6f6d3d7390e2d1a7fa813075cb5f2aeec94121c374c0738bbb117c11b31d1be", @ANYRES16=r5], 0x0) 2.542633312s ago: executing program 4 (id=5): r0 = syz_open_dev$hidraw(&(0x7f0000000440), 0x243c2917, 0x14a042) write$hidraw(r0, &(0x7f0000000040)='F', 0xfffffe41) r1 = syz_open_dev$hidraw(&(0x7f0000002300), 0x243c2917, 0x14a042) write$hidraw(r1, 0x0, 0x0) syz_usb_connect(0x0, 0x10b, &(0x7f0000000080)=ANY=[], 0x0) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r3, 0xc0145b0e, 0x0) syz_open_dev$hidraw(&(0x7f0000000000), 0x5, 0x200) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x9c, 0x32, 0x3f, 0x8, 0x4a5, 0x3003, 0x3ab2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x2, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x28, 0xf0, 0xf6}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000100)={0x24, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b1a0100001000090455070103490200090582030004"], 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0x40, &(0x7f00000003c0)=ANY=[@ANYBLOB="b5e7e19e0ef8349c1c6343c37f53a49d6b46be6d562ee74b4433fd24e681ecfeaa9875f10ffe6e636f4afb353b31393d4c79430aa2f02d490dbfc28258fa508459"]) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0xe0, 0x51, 0x8a, 0x10, 0x846, 0x9030, 0x5442, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0xde, 0x57, 0x4, 0x0, [], [{{0x9, 0x5, 0x2, 0x3}}]}}]}}]}}, 0x0) syz_usb_connect$uac1(0x2, 0xbc, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xaa, 0x3, 0x1, 0x7, 0xb0, 0x5, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0x1}, [@extension_unit={0x8, 0x24, 0x8, 0x4, 0xe, 0x0, 'L'}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x9, 0x0, 0x8, {0x7, 0x25, 0x1, 0x83, 0x8, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x3, 0x4, 0x8, 0x8}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x9, 0x4, 0x9, 0xa, "38effe"}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x80, 0x3, 0x1, 0x5, "2d9d"}, @as_header={0x7, 0x24, 0x1, 0x8, 0x3, 0x4}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x2028, 0x84e, 0x3, "0fc5f2042d"}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0xa, 0x4, 0x0, 0x74, "de5ae2490f7df9896d"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x80, 0xf8, 0x0, {0x7, 0x25, 0x1, 0x2, 0xc1}}}}}}}]}}, &(0x7f0000000480)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x110, 0x66, 0xff, 0x2, 0x20, 0x2}, 0x19, &(0x7f0000000140)=ANY=[@ANYBLOB="05ff00000000007dfa02de750000008d3d5a66f20d74cca7e8"], 0x5, [{0x0, 0x0}, {0x94, &(0x7f0000000200)=@string={0x94, 0x3, "b2fefcb615322f54f36cd4ed8f6455e120f84c2fa4f182e864a82020acbe7e4cb4a5fbb53a239d638f2cd93fb4d2c2665febfd40ff9ee776e24b29fa174b2921927dbe5c6492af66ce9f81d62e0f27b6d87cb9b5378b2748656a9458f91f3add116dcda515445f46d3c6c97a1a268a43b6348e0c1aae4f23ccda2b13c97e730d060a154573f2264f1607b2e988d0b0fc0ab5"}}, {0x7c, &(0x7f00000002c0)=@string={0x7c, 0x3, "a4c1ce5c525d4e037201aedf06dd23ee7e8371524ae04671853e6038015193dfe0f1aa6798eabf909935f0daa3f7803b68e6f44293f339a6ee794a538dcb2afef497e553c9ab8a3b4c12bff181afd22392dc458035d015b8fe5d3496229839717c9e56950a257b128d4537715b6b70fee4e14d13f3f589fccd97"}}, {0x59, &(0x7f0000000340)=@string={0x59, 0x3, "1ca56248233b7fa0e4c447e08a7326908936da86046b10288ac76f18019cb7830e081f06c6dbfcfc9a1b2ccf8d65266795ef5411313ec038fd53cb674c3a189e5a921c5507648740d545f8dff9425777056a7f576a328e"}}, {0x71, &(0x7f0000000400)=@string={0x71, 0x3, "6a5ee4d064b8f815a7c1c909ac0649b8921ae8e9fd69994f10a39a131ea543daa55241326265448bbce6e445ad28c6c2cbc01f6210cf9a437980e7555e8879af30bb4d25d35722e24dd48bb943cac456a88ed9e88df6173928fdf31f44e97505276f7be809da20d6db04004382e81f"}}]}) syz_open_dev$hidraw(&(0x7f0000000500), 0x5b, 0x80200) syz_usb_disconnect(r5) write$hidraw(r1, 0x0, 0x0) r6 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_disconnect(r6) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000840)=ANY=[@ANYRESDEC=0x0, @ANYRESHEX, @ANYRESOCT=r6, @ANYBLOB="205cbd4962a2fbd0cf35bb719778ab76c63ea48800d58d7816d5e02a6737623e9303fc0f8660d8b8b57d859f1b4aa041ffe8e6004e74c722d400b2dcbee4260b7fe6a740f26a3577507c620850f0320461ba66af72e899fb4962a4e95e1e90baac3b8f53bbb02dd17f11c95c73e5dcf7506010901af9193d15e413b93fb80e2b3326f43457f6fc0a3a88d631254410343e2d218d0f"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) 2.486545473s ago: executing program 2 (id=3): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)={{0x12, 0x1, 0x0, 0xc4, 0x3b, 0x69, 0x40, 0x424, 0xcf19, 0x927c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x5d, 0x0, 0x0, 0x6e, 0x89, 0x55}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xa1, 0x12, 0x17, 0x10, 0xb95, 0x172a, 0xf7f4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xfb, 0x0, 0x2, 0x6c, 0x5d, 0x65, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x10, 0x0, 0xfa}}, {{0x9, 0x5, 0x82, 0x2, 0x40}}]}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 402.543554ms ago: executing program 0 (id=6): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x10c4, 0xea90, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) r1 = syz_usb_connect(0x0, 0x41, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd2, 0xe7, 0x76, 0x10, 0x110a, 0x1653, 0x5ea7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x43, 0xd3, 0x78}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f0000000040)=ANY=[], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000440)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x1, 0x3, "c282fe"}, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x1, 0xe, "ea6aafaabfc5926708627c6c0963"}, 0x0}) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000240)={0x14, &(0x7f0000000140)={0x20, 0xc, 0x7e, {0x7e, 0x0, "a09c8ef4d1eadd436d4d498c4e5785c63668dbffbe1aaaae25e7d79fbcd10519d48b56aea1382fdeff3da1bf5c2a0a0518072c8aa0d9701a6b8c6f06adea66eebbdb4104cbdadb9137806c0f251d4136c90ee7a87bbedab35260b875e180e4150618ba1085b82697636e9d896e04565deecc323b6525b3a7fca1715f"}}, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000400)={0x1c, &(0x7f0000000280)={0x40, 0x6, 0x89, "df991118d00a61dac3078ef1c6cbeec8d8a594494d30507741a72d5165b9b906b9f0b2f895f8bdb81352f57c74ec3ceb27839fd76bc65bb9aa2b453ffcc0ea0eaaae5a583cf06a624b231952a5141bd7b4c5ed781993d28682ea9a5adb9424dc82016e1f6b4364fbfab80ecef787a31174947b373f813c03c2a7931dcb54bc74f76b5de1be7fbca30c"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x40}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x4a, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) r3 = syz_usb_connect$printer(0x0, 0x36, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc38, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000740)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x1, 0x1a, "2f9aab89b7989528b5fd0f10a091edb408f22bb50195c31f51ae"}, 0x0}) 0s ago: executing program 1 (id=7): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003f050ae20810d001916af0102030109021b0001016700050904"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1e71, 0x2009, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200}}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r1, 0x81, 0x19, &(0x7f0000000480)="61030000000000000039d0a04cd10d388d93b1e5cf8883f873") r3 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000009c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6004, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x30, 0x4, [{{0x9, 0x4, 0x0, 0x6b, 0x1, 0x3, 0x1, 0x1, 0x5, {0x9, 0x21, 0x2, 0x1, 0x1, {0x22, 0x961}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x8, 0x8, 0x81}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x0, 0xef, 0x9}}]}}}]}}]}}, &(0x7f0000000d40)={0xa, &(0x7f0000000a00)={0xa, 0x6, 0x200, 0x1, 0x2, 0xfb, 0x20, 0x27}, 0x10, &(0x7f0000000a40)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x8, 0x86, 0xab, 0x8, 0xe, 0xa}]}, 0x5, [{0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x421}}, {0xfc, &(0x7f0000000ac0)=@string={0xfc, 0x3, "78302463d0015fde6b559745d55214966afdc4159aaf91ac2a281859ff259756bd80f6ee830728592fcf349e21c1a8efe178ab238ad68b04a230bb2d61838f6add20836f4a88d780479abc2007d4634a4b49cc9a8e2f15dd205ac9e914714a47ee6073c9d6cebe9bfd1ccc3b4e1860550b46649e3998be615b8dac2d60ea8ca97aa272751c84cfb8c4fedc49eeb3f0d2328ee2c71242ea72571eec8f61eb1b1b930d5df3999d20f0856a8f1d0938863ddb036c384e0fc3981df5d8f58dff915090db658a8bcb448c44fae97ed4e6856cb23111a94ee21397abe351be204a5e133945c28edcffaa1450d02cdb41f78e4a4027444d1c34b15c3e58"}}, {0xb7, &(0x7f0000000bc0)=@string={0xb7, 0x3, "950b2f8510aa7d66ec7d097af6f9b7386808f42fc5bae511265352bdafe91bfabc153ede08448e056cf86e5c339e2389a9c241cfe3863d74964f915fb4e2b01c3dcacf93ed8e74a431ce678a4810456f32723eb58eb62a8811992baa626e6ce6706feda3106866c28987b89f4d786710f224bdce5473ef78e16b883459a435b827c3a4135d8a05d089b0613cd98fec980ce2b329ba13cc9e0dc8aff1b893a7842706d109c94fdc42ac28c3358ee5f2702e61677056"}}, {0x5f, &(0x7f0000000c80)=@string={0x5f, 0x3, "67727dad0075f22d98849478398365a320ae38052a649867d80b30650371c0115fa7f82f5d49b6959652258500ef55f7f1edbe40c909179da3e199e9d83071dd96b8ac4dc7be068b09425f11abdcc00cff3a0c71501bafe2f77a3d0d9f"}}, {0x4, &(0x7f0000000d00)=@lang_id={0x4, 0x3, 0x408}}]}) syz_usb_control_io$hid(r3, &(0x7f0000000f40)={0x24, &(0x7f0000000dc0)={0x40, 0x22, 0x8c, {0x8c, 0x22, "0964fd07312bb6cb095a38dc3cdf4fe0854edc0644f8030494087103674d5057ca9b1c8b0cfdc6aa092d346b5721a8d27ba0c478aaa263185fb78a667ceec2ef37c1817cdb6cb2b8aa18f86fb4b0d0f94c9dfe67b0a4b3bdd77a18d1113bbcd37a65dda7093b5036e76090d52ce11d693a127c02e9023699059ca31f55636c12bf680bce73509da3587f"}}, &(0x7f0000000e80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40f}}, &(0x7f0000000ec0)={0x0, 0x22, 0x1e, {[@global=@item_012={0x0, 0x1, 0x5}, @local=@item_4={0x3, 0x2, 0x9, "39dee833"}, @global=@item_012={0x2, 0x1, 0xa, "a582"}, @global=@item_4={0x3, 0x1, 0x8, "3989c725"}, @main=@item_012={0x0, 0x0, 0xa}, @global=@item_4={0x3, 0x1, 0x8, "82755161"}, @main=@item_4={0x3, 0x0, 0xa, "0dae985f"}, @local=@item_4={0x3, 0x2, 0x1, "acff72d3"}]}}, &(0x7f0000000f00)={0x0, 0x21, 0x9, {0x9, 0x21, 0xce0, 0x6, 0x1, {0x22, 0x347}}}}, &(0x7f0000001200)={0x2c, &(0x7f0000000f80)={0x20, 0x12, 0xc3, "77ee45a709044d2d0c0c2b217ddd26476c3c5021c8bace42c0531641c63027ba920e7027701ab174d117a18ab408cc6dda681efe70ddddb93a9eac0a317d96bbba74f646b085f0dd10e36e1cd646c1a87f883afa4b11676271ef9e8397a2a8769d29deab8c925f3cb7292dafaa45ee419e90edc48ead3d4bffc5db7ea6d97abb1660060a1b0979d86cd00586b3496175eb164e29a59944db3cdde3edb44099ed4c3b7239825bf1283b87ea52fd20d4f40a35917221940929c71618e9a1383f5bd1ef84"}, &(0x7f0000001080)={0x0, 0xa, 0x1, 0xfd}, &(0x7f00000010c0)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000001100)={0x20, 0x1, 0x94, "28a73a7fb8d3dfaf4740492dddc8fc85e71bc55ebf0762fa3d6697b6850ba238e339597c6c35e4aa7e45cd3ea8fe3968300e0d205716b01782adeaf166f2da60c67618e69b06da5ad3e92708e668a77de82ce1d5ba084e31a331f0a828a2f79fad3928179be8f212da2dca16baeae343ae718fb6d1459deca8110739afc272857e507f8dc1cf2df168bdf8dc8bbaac831d436c4f"}, &(0x7f00000011c0)={0x20, 0x3, 0x1, 0x81}}) r4 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b1c, 0x1c09, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x60, 0x0, [{{0x9, 0x4, 0x0, 0x80, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x408, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x9, 0x8, 0x7}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x6, 0x9, 0x9}}]}}}]}}]}}, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r4, 0x81, 0x1, &(0x7f0000000080)='\x00') syz_usb_disconnect(r0) syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000000)=ANY=[@ANYBLOB="12015001000000106b1d01014000010a030109029a0003010000000904000000010100000a24010000000201020c240200617274c5302aad86af0d8c3dc105f4d63a2d00000524050000082407060000009e0c240701000000c80975f9070d2407014b000005cf1f000005092403000000000100"], 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "0100"}, @global=@item_012={0x2, 0x1, 0x0, "0100"}, @main=@item_4, @local=@item_012={0x2, 0x2, 0x2, "90a0"}, @global=@item_4={0x3, 0x1, 0x2}, @main=@item_4={0x3, 0x0, 0xb, "813e2503"}, @local=@item_4={0x3, 0x2, 0x1, "dde84050"}, @local=@item_4={0x3, 0x2, 0x3, "5d8c3dda"}]}}, 0x0}, 0x0) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1044, 0x7a4d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x10, 0xfc, 0x43}}}}}]}}]}}, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000400)="b9") syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0xc7, 0x46d, 0xc219, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x6e, 0x40, 0x0, [{{0x9, 0x4, 0x0, 0x45, 0x2, 0x3, 0x1, 0x3, 0xc, {0x9, 0x21, 0x2, 0xbd, 0x1, {0x22, 0x55f}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x8, 0x1, 0x7f}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0x9, 0x3, 0xa, 0x20, 0x9}, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="059c81fb9229e409780d9b"], 0x9, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x406}}, {0x69, &(0x7f0000001240)=ANY=[@ANYBLOB="69031a53b6b09beb93fe0639d069a995a7bb331651d24a3138c316d142dedfd2de3a75d369e0d7f2f3e000740af9434d8fe2a53cb8b305b26fa3ae8448363a0722f1e92842a19b04b93dae6fbe14aa954152413ee6b46f2550eb343d4044bb9838451011b7f0a44ef4292b0eeefd9c0022b4e76ecf0b1f028abe2aa8651da3841a"]}, {0x1f, &(0x7f00000002c0)=@string={0x1f, 0x3, "44d9b42fc7a34c0dd8c07d5bf8286bbc782a91a9a49c8cbf0632fb5325"}}, {0x4f, &(0x7f0000000300)=@string={0x4f, 0x3, "74fffe0f1c90514477283bd7a343bf6e964f403c9e83926f7614002fdca300500c470553ac0c22f44521720ebdc55075da734297db08743fe642d6075e5088df823f7e5374eeaee4ebfc641bef"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x444}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x412}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x3001}}, {0xb0, &(0x7f0000000500)=@string={0xb0, 0x3, "c825b1de0f46b96f5aed0fbe064e3139f287440ae370efb8aaf2252e338cbbeb0c2031d899f21acc67796f8f907479c3826d1b0e8af2ba2743c596457706fc390ceec3d9695fb5a2d17403b5c5373e4110462e812bb4d1454d61cd9d02a2904d958894da10e99e22eeed4545f6dd574ed370c665f316c837f1a5185cbb98a9a048605348ee7e0d1092d5bd0f406188248114c266ab1791735adf5e8634a5a81ef436d998cbf70f10a21ca3b9fa0b"}}, {0x4c, &(0x7f00000005c0)=@string={0x4c, 0x3, "ec59917e06ee7f93ce09e098712dc9d635725708f23c34dad73a14cf156fa6668eb65d675ae3f1e20780d1257eb5191a4cabe889376b9dbde881efa21073afd6f5c9dc33f00d54bd71bf"}}]}) syz_usb_connect$printer(0x6, 0x2d, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x5, 0xc0, 0x1, [{{0x9, 0x4, 0x0, 0x45, 0x1, 0x7, 0x1, 0x3, 0x41, "", {{{0x9, 0x5, 0x1, 0x2, 0x8, 0x80, 0x80, 0x1}}}}}]}}]}}, &(0x7f0000000980)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x200, 0x10, 0x92, 0x2, 0x8, 0x5}, 0x2d, &(0x7f0000000780)={0x5, 0xf, 0x2d, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "de5f1b3a67fcc94e508b62cda4a0e293"}, @ss_container_id={0x14, 0x10, 0x4, 0xf, "d313c578d0b63dda0b761a593ca6800e"}]}, 0x3, [{0x58, &(0x7f00000007c0)=@string={0x58, 0x3, "4766e4e9ae85d2165c1c73b1246db13ebc4c15a0d132bbca79c032e780febea0c5f34d1d04b4d733cdc253c100adb51c780ba578e739ac1927ec8d43987c90d549430ba7086b16341ee6c5cb734ac73096134f981d9e"}}, {0xdb, &(0x7f0000000840)=@string={0xdb, 0x3, "e6e8837ee3c195b94025f0837dfc55be53a46a4240967c0472d02440c78f94f5887d5ba87debc18b9ca2784889741964a734f446a6fa2874b43c8baa79f57c043c260803662f0a0d1af3e48ae9fc2713617bec77153c2c2cf1e3322cd0ac15effd936a780044f9bca6de91c48b0e8be8832f27af870607f2e6db9fc0b6deb3664a4dbc4254a4b87005d989eab69496824025f374525a52d6246900a8740a7f796bbc66c1310a86c98a832aeb1163904ef08f263830e4ae12fb7b22e0b274e250195a4362e81754170dafe2d4d76e33bb3d88c1aa62c8b14cdf"}}, {0x10, &(0x7f0000000940)=@string={0x10, 0x3, "9ccc345a71da7ff3ae7dfc80da75"}}]}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.156' (ED25519) to the list of known hosts. [ 34.008558][ T29] audit: type=1400 audit(1751543900.490:61): avc: denied { mounton } for pid=2945 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 34.012974][ T2945] cgroup: Unknown subsys name 'net' [ 34.031354][ T29] audit: type=1400 audit(1751543900.490:62): avc: denied { mount } for pid=2945 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.061292][ T29] audit: type=1400 audit(1751543900.540:63): avc: denied { unmount } for pid=2945 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.226192][ T2945] cgroup: Unknown subsys name 'cpuset' [ 34.234491][ T2945] cgroup: Unknown subsys name 'rlimit' [ 34.409454][ T29] audit: type=1400 audit(1751543900.890:64): avc: denied { setattr } for pid=2945 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.434584][ T29] audit: type=1400 audit(1751543900.890:65): avc: denied { mounton } for pid=2945 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.459867][ T29] audit: type=1400 audit(1751543900.890:66): avc: denied { mount } for pid=2945 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 34.476470][ T2947] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 34.494531][ T29] audit: type=1400 audit(1751543900.980:67): avc: denied { relabelto } for pid=2947 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.520162][ T29] audit: type=1400 audit(1751543900.980:68): avc: denied { write } for pid=2947 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.544872][ T2945] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 34.546209][ T29] audit: type=1400 audit(1751543901.020:69): avc: denied { read } for pid=2945 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 34.580740][ T29] audit: type=1400 audit(1751543901.020:70): avc: denied { open } for pid=2945 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 47.506218][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 47.506239][ T29] audit: type=1400 audit(1751543913.990:77): avc: denied { create } for pid=2955 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 47.597013][ T29] audit: type=1400 audit(1751543913.990:78): avc: denied { write } for pid=2957 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 47.674990][ T29] audit: type=1400 audit(1751543914.100:79): avc: denied { read } for pid=2957 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 81.969400][ T29] audit: type=1400 audit(1751543948.450:80): avc: denied { mounton } for pid=2957 comm="syz-executor" path="/root/syzkaller.96DoCz/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 82.078089][ T29] audit: type=1400 audit(1751543948.480:81): avc: denied { mount } for pid=2957 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 82.100241][ T29] audit: type=1400 audit(1751543948.480:82): avc: denied { mounton } for pid=2957 comm="syz-executor" path="/root/syzkaller.96DoCz/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 82.126711][ T29] audit: type=1400 audit(1751543948.480:83): avc: denied { mount } for pid=2957 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 82.148630][ T29] audit: type=1400 audit(1751543948.480:84): avc: denied { mounton } for pid=2957 comm="syz-executor" path="/root/syzkaller.96DoCz/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 82.176553][ T29] audit: type=1400 audit(1751543948.480:85): avc: denied { mounton } for pid=2957 comm="syz-executor" path="/root/syzkaller.96DoCz/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3395 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 82.205158][ T29] audit: type=1400 audit(1751543948.480:86): avc: denied { unmount } for pid=2957 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 82.225147][ T29] audit: type=1400 audit(1751543948.520:87): avc: denied { mounton } for pid=2957 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=531 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 82.352861][ T2957] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 82.909959][ T29] audit: type=1400 audit(1751543949.390:88): avc: denied { read write } for pid=2957 comm="syz-executor" name="loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 82.937267][ T29] audit: type=1400 audit(1751543949.390:89): avc: denied { open } for pid=2957 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 83.435856][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 83.603987][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 83.623651][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 83.639598][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 83.652139][ T10] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 83.664253][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 83.677104][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 83.691966][ T1118] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 83.702095][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 83.712086][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 83.723608][ T10] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 83.735492][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 83.746716][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 83.760119][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 83.774406][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 83.785749][ T10] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 83.798054][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 83.809624][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 83.814055][ T37] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 83.856299][ T1118] usb 2-1: config 8 has an invalid interface number: 93 but max is 0 [ 83.864712][ T1118] usb 2-1: config 8 has no interface number 0 [ 83.873432][ T1118] usb 2-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=92.7c [ 83.882938][ T1118] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.891195][ T1118] usb 2-1: Product: syz [ 83.896498][ T1118] usb 2-1: Manufacturer: syz [ 83.901602][ T1118] usb 2-1: SerialNumber: syz [ 83.935395][ T10] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 83.945542][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.953705][ T10] usb 1-1: Product: syz [ 83.958175][ T10] usb 1-1: Manufacturer: syz [ 83.962807][ T10] usb 1-1: SerialNumber: syz [ 84.014001][ T37] usb 4-1: Using ep0 maxpacket: 16 [ 84.023577][ T37] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.036245][ T37] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 84.050610][ T37] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 84.063014][ T37] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 84.073190][ T37] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 84.105795][ T37] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 84.116066][ T37] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 84.124667][ T37] usb 4-1: Manufacturer: syz [ 84.133608][ T37] usb 4-1: config 0 descriptor?? [ 84.164031][ T2794] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 84.215251][ T10] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 84.236556][ T10] usb 1-1: USB disconnect, device number 2 [ 84.335705][ T2794] usb 3-1: config 8 has an invalid interface number: 93 but max is 0 [ 84.344568][ T2794] usb 3-1: config 8 has no interface number 0 [ 84.362522][ T2794] usb 3-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=92.7c [ 84.366939][ T5226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.372337][ T2794] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.384117][ T1118] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 84.390867][ T2794] usb 3-1: Product: syz [ 84.403958][ T2794] usb 3-1: Manufacturer: syz [ 84.409437][ T2794] usb 3-1: SerialNumber: syz [ 84.417573][ T5226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.439975][ T5226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.451389][ T5226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.544069][ T1118] usb 5-1: device descriptor read/64, error -71 [ 84.560789][ T5244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.572586][ T5244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.583292][ T5244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.593638][ T5244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.666877][ T5226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.677901][ T5226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.692388][ T5226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.702099][ T5226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.716254][ T5226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.726572][ T5226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.735930][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 84.784048][ T1118] usb 5-1: device descriptor read/64, error -71 [ 84.893994][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 84.903268][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 84.912022][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 84.926020][ T10] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 84.938676][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 84.952205][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 84.966760][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 84.975844][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 84.987659][ T10] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 85.001528][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 85.014306][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 85.017523][ T5245] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.027068][ T1118] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 85.032057][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 85.041081][ T5245] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 85.048026][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 85.077359][ T10] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 85.089361][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 85.100573][ T10] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 85.115188][ T10] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 85.125542][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.134065][ T10] usb 1-1: Product: syz [ 85.138352][ T10] usb 1-1: Manufacturer: syz [ 85.142960][ T10] usb 1-1: SerialNumber: syz [ 85.174033][ T1118] usb 5-1: device descriptor read/64, error -71 [ 85.353720][ T5203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.363764][ T5203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 85.383261][ T10] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 85.406920][ T10] usb 1-1: USB disconnect, device number 3 [ 85.414385][ T1118] usb 5-1: device descriptor read/64, error -71 [ 85.534742][ T1118] usb usb5-port1: attempt power cycle [ 85.544033][ T37] rc_core: IR keymap rc-hauppauge not found [ 85.550364][ T37] Registered IR keymap rc-empty [ 85.555624][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.574114][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.595539][ T37] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 85.609142][ T37] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input5 [ 85.625656][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.644080][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.664145][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.684040][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.704065][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.724021][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.744042][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.764014][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.784013][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.804006][ T37] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 85.826420][ T37] mceusb 4-1:0.0: Registered ะท with mce emulator interface version 1 [ 85.834843][ T37] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 85.892056][ T1118] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 85.927581][ T1118] usb 5-1: device descriptor read/8, error -71 [ 86.007120][ T5219] usb 4-1: USB disconnect, device number 2 [ 86.065773][ T1118] usb 5-1: device descriptor read/8, error -71 [ 86.204033][ T10] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 86.304069][ T1118] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 86.325464][ T1118] usb 5-1: device descriptor read/8, error -71 [ 86.360535][ T5219] usb 2-1: USB disconnect, device number 2 [ 86.375764][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 86.387606][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 86.397808][ T10] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 86.412506][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.426513][ T5219] ================================================================== [ 86.435147][ T5219] BUG: KASAN: slab-use-after-free in hdm_disconnect+0x227/0x250 [ 86.443185][ T5219] Read of size 8 at addr ffff888119d31890 by task kworker/0:3/5219 [ 86.452324][ T5219] [ 86.455213][ T5219] CPU: 0 UID: 0 PID: 5219 Comm: kworker/0:3 Not tainted 6.16.0-rc2-syzkaller-00053-gcf16f408364e #0 PREEMPT(voluntary) [ 86.455246][ T5219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 86.455263][ T5219] Workqueue: usb_hub_wq hub_event [ 86.455294][ T5219] Call Trace: [ 86.455303][ T5219] [ 86.455309][ T5219] dump_stack_lvl+0x116/0x1f0 [ 86.455336][ T5219] print_report+0xcd/0x680 [ 86.455354][ T5219] ? __virt_addr_valid+0x81/0x610 [ 86.455372][ T5219] ? __phys_addr+0xe8/0x180 [ 86.455391][ T5219] ? hdm_disconnect+0x227/0x250 [ 86.455405][ T5219] kasan_report+0xe0/0x110 [ 86.455420][ T5219] ? hdm_disconnect+0x227/0x250 [ 86.455440][ T5219] hdm_disconnect+0x227/0x250 [ 86.455460][ T5219] usb_unbind_interface+0x1da/0x9a0 [ 86.455479][ T5219] ? kernfs_remove_by_name_ns+0xbe/0x110 [ 86.455498][ T5219] ? __pfx_usb_unbind_interface+0x10/0x10 [ 86.455514][ T5219] device_remove+0x122/0x170 [ 86.455530][ T5219] device_release_driver_internal+0x44b/0x620 [ 86.455549][ T5219] bus_remove_device+0x22f/0x420 [ 86.455564][ T5219] device_del+0x396/0x9f0 [ 86.455579][ T5219] ? __pfx_device_del+0x10/0x10 [ 86.455594][ T5219] ? __pfx___mutex_lock+0x10/0x10 [ 86.455614][ T5219] ? __pfx___pm_runtime_barrier+0x10/0x10 [ 86.455632][ T5219] ? do_raw_spin_lock+0x12c/0x2b0 [ 86.455658][ T5219] usb_disable_device+0x355/0x7d0 [ 86.455713][ T5219] usb_disconnect+0x2e1/0x920 [ 86.455747][ T5219] hub_event+0x1aa0/0x5030 [ 86.455765][ T5219] ? __lock_acquire+0xb8a/0x1c90 [ 86.455779][ T5219] ? __pfx_hub_event+0x10/0x10 [ 86.455791][ T5219] ? assoc_array_gc+0xe00/0x15b0 [ 86.455807][ T5219] ? rcu_is_watching+0x12/0xc0 [ 86.455827][ T5219] process_one_work+0x9cc/0x1b70 [ 86.455847][ T5219] ? __pfx_process_one_work+0x10/0x10 [ 86.455865][ T5219] ? assign_work+0x1a0/0x250 [ 86.455880][ T5219] worker_thread+0x6c8/0xf10 [ 86.455898][ T5219] ? __kthread_parkme+0x19e/0x250 [ 86.455919][ T5219] ? __pfx_worker_thread+0x10/0x10 [ 86.455935][ T5219] kthread+0x3c5/0x780 [ 86.455949][ T5219] ? __pfx_kthread+0x10/0x10 [ 86.455964][ T5219] ? rcu_is_watching+0x12/0xc0 [ 86.455981][ T5219] ? __pfx_kthread+0x10/0x10 [ 86.455996][ T5219] ret_from_fork+0x5b3/0x6c0 [ 86.456016][ T5219] ? __pfx_kthread+0x10/0x10 [ 86.456031][ T5219] ret_from_fork_asm+0x1a/0x30 [ 86.456052][ T5219] [ 86.456057][ T5219] [ 86.692036][ T5219] Allocated by task 1118: [ 86.696380][ T5219] kasan_save_stack+0x33/0x60 [ 86.701163][ T5219] kasan_save_track+0x14/0x30 [ 86.705868][ T5219] __kasan_kmalloc+0x8f/0xa0 [ 86.710478][ T5219] hdm_probe+0xb3/0x19a0 [ 86.714836][ T5219] usb_probe_interface+0x300/0x9c0 [ 86.720044][ T5219] really_probe+0x241/0xa90 [ 86.724903][ T5219] __driver_probe_device+0x1de/0x440 [ 86.730645][ T5219] driver_probe_device+0x4c/0x1b0 [ 86.735791][ T5219] __device_attach_driver+0x1df/0x310 [ 86.742050][ T5219] bus_for_each_drv+0x159/0x1e0 [ 86.747724][ T5219] __device_attach+0x1e4/0x4b0 [ 86.752605][ T5219] bus_probe_device+0x17f/0x1c0 [ 86.758815][ T5219] device_add+0x1148/0x1a70 [ 86.764424][ T5219] usb_set_configuration+0x1187/0x1e20 [ 86.770220][ T5219] usb_generic_driver_probe+0xb1/0x110 [ 86.777576][ T5219] usb_probe_device+0xec/0x3e0 [ 86.782911][ T5219] really_probe+0x241/0xa90 [ 86.787470][ T5219] __driver_probe_device+0x1de/0x440 [ 86.794439][ T5219] driver_probe_device+0x4c/0x1b0 [ 86.800272][ T5219] __device_attach_driver+0x1df/0x310 [ 86.805870][ T5219] bus_for_each_drv+0x159/0x1e0 [ 86.810957][ T5219] __device_attach+0x1e4/0x4b0 [ 86.815932][ T5219] bus_probe_device+0x17f/0x1c0 [ 86.820979][ T5219] device_add+0x1148/0x1a70 [ 86.826183][ T5219] usb_new_device+0xd07/0x1a20 [ 86.831479][ T5219] hub_event+0x2f85/0x5030 [ 86.835964][ T5219] process_one_work+0x9cc/0x1b70 [ 86.841269][ T5219] worker_thread+0x6c8/0xf10 [ 86.845971][ T5219] kthread+0x3c5/0x780 [ 86.850067][ T5219] ret_from_fork+0x5b3/0x6c0 [ 86.854780][ T5219] ret_from_fork_asm+0x1a/0x30 [ 86.859954][ T5219] [ 86.862555][ T5219] Freed by task 5219: [ 86.866658][ T5219] kasan_save_stack+0x33/0x60 [ 86.871385][ T5219] kasan_save_track+0x14/0x30 [ 86.876089][ T5219] kasan_save_free_info+0x3b/0x60 [ 86.881924][ T5219] __kasan_slab_free+0x37/0x50 [ 86.887126][ T5219] kfree+0x283/0x470 [ 86.891342][ T5219] device_release+0xa1/0x240 [ 86.896252][ T5219] kobject_put+0x1e7/0x5a0 [ 86.901225][ T5219] device_unregister+0x2f/0xc0 [ 86.906194][ T5219] hdm_disconnect+0x10b/0x250 [ 86.911704][ T5219] usb_unbind_interface+0x1da/0x9a0 [ 86.918441][ T5219] device_remove+0x122/0x170 [ 86.924032][ T5219] device_release_driver_internal+0x44b/0x620 [ 86.931256][ T5219] bus_remove_device+0x22f/0x420 [ 86.937550][ T5219] device_del+0x396/0x9f0 [ 86.941896][ T5219] usb_disable_device+0x355/0x7d0 [ 86.947308][ T5219] usb_disconnect+0x2e1/0x920 [ 86.952651][ T5219] hub_event+0x1aa0/0x5030 [ 86.957754][ T5219] process_one_work+0x9cc/0x1b70 [ 86.963507][ T5219] worker_thread+0x6c8/0xf10 [ 86.968378][ T5219] kthread+0x3c5/0x780 [ 86.972650][ T5219] ret_from_fork+0x5b3/0x6c0 [ 86.977364][ T5219] ret_from_fork_asm+0x1a/0x30 [ 86.982405][ T5219] [ 86.984734][ T5219] The buggy address belongs to the object at ffff888119d30000 [ 86.984734][ T5219] which belongs to the cache kmalloc-8k of size 8192 [ 86.999421][ T5219] The buggy address is located 6288 bytes inside of [ 86.999421][ T5219] freed 8192-byte region [ffff888119d30000, ffff888119d32000) [ 87.015409][ T5219] [ 87.017842][ T5219] The buggy address belongs to the physical page: [ 87.025244][ T5219] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119d30 [ 87.034380][ T5219] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 87.043517][ T5219] anon flags: 0x200000000000040(head|node=0|zone=2) [ 87.050836][ T5219] page_type: f5(slab) [ 87.055109][ T5219] raw: 0200000000000040 ffff888100042280 0000000000000000 0000000000000001 [ 87.064121][ T5219] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 87.073666][ T5219] head: 0200000000000040 ffff888100042280 0000000000000000 0000000000000001 [ 87.082976][ T5219] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 87.092371][ T5219] head: 0200000000000003 ffffea0004674c01 00000000ffffffff 00000000ffffffff [ 87.101681][ T5219] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 87.111726][ T5219] page dumped because: kasan: bad access detected [ 87.119112][ T5219] page_owner tracks the page as allocated [ 87.125977][ T5219] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2935, tgid 2935 (sshd-session), ts 24478664680, free_ts 24468198817 [ 87.148861][ T5219] post_alloc_hook+0x1c0/0x230 [ 87.154791][ T5219] get_page_from_freelist+0xf98/0x2ce0 [ 87.160579][ T5219] __alloc_frozen_pages_noprof+0x259/0x21e0 [ 87.167173][ T5219] alloc_pages_mpol+0xe4/0x410 [ 87.173105][ T5219] new_slab+0x23b/0x330 [ 87.177462][ T5219] ___slab_alloc+0xda5/0x1940 [ 87.183121][ T5219] __slab_alloc.constprop.0+0x56/0xb0 [ 87.188617][ T5219] __kmalloc_node_track_caller_noprof+0x15e/0x4c0 [ 87.195852][ T5219] kmalloc_reserve+0xef/0x2c0 [ 87.200987][ T5219] __alloc_skb+0x166/0x380 [ 87.206382][ T5219] netlink_dump+0x292/0x11c0 [ 87.211948][ T5219] netlink_recvmsg+0x7f9/0x9c0 [ 87.217021][ T5219] sock_recvmsg+0x1f9/0x250 [ 87.221873][ T5219] ____sys_recvmsg+0x218/0x6b0 [ 87.227569][ T5219] ___sys_recvmsg+0x114/0x1a0 [ 87.232585][ T5219] __sys_recvmsg+0x16a/0x220 [ 87.237336][ T5219] page last free pid 2935 tgid 2935 stack trace: [ 87.243980][ T5219] __free_frozen_pages+0x78a/0x1040 [ 87.249657][ T5219] __put_partials+0x16d/0x1c0 [ 87.254933][ T5219] qlist_free_all+0x4d/0x120 [ 87.259732][ T5219] kasan_quarantine_reduce+0x195/0x1e0 [ 87.265391][ T5219] __kasan_slab_alloc+0x4e/0x70 [ 87.270754][ T5219] kmem_cache_alloc_noprof+0x14f/0x3b0 [ 87.276962][ T5219] __anon_vma_prepare+0xae/0x5e0 [ 87.282089][ T5219] __vmf_anon_prepare+0x11c/0x240 [ 87.287422][ T5219] __handle_mm_fault+0x181b/0x3200 [ 87.293261][ T5219] handle_mm_fault+0x589/0xd10 [ 87.298078][ T5219] do_user_addr_fault+0x613/0x1240 [ 87.303390][ T5219] exc_page_fault+0x5c/0xb0 [ 87.309230][ T5219] asm_exc_page_fault+0x26/0x30 [ 87.314922][ T5219] [ 87.317364][ T5219] Memory state around the buggy address: [ 87.323830][ T5219] ffff888119d31780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.332100][ T5219] ffff888119d31800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.341101][ T5219] >ffff888119d31880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.349989][ T5219] ^ [ 87.355308][ T5219] ffff888119d31900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.363712][ T5219] ffff888119d31980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.374193][ T5219] ================================================================== [ 87.384299][ T5219] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.393479][ T5219] CPU: 0 UID: 0 PID: 5219 Comm: kworker/0:3 Not tainted 6.16.0-rc2-syzkaller-00053-gcf16f408364e #0 PREEMPT(voluntary) [ 87.408447][ T5219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 87.419485][ T5219] Workqueue: usb_hub_wq hub_event [ 87.425642][ T5219] Call Trace: [ 87.428947][ T5219] [ 87.431882][ T5219] dump_stack_lvl+0x3d/0x1f0 [ 87.436514][ T5219] panic+0x71c/0x800 [ 87.440745][ T5219] ? __pfx_panic+0x10/0x10 [ 87.445443][ T5219] ? mark_held_locks+0x49/0x80 [ 87.450413][ T5219] ? hdm_disconnect+0x227/0x250 [ 87.455408][ T5219] ? hdm_disconnect+0x227/0x250 [ 87.460891][ T5219] check_panic_on_warn+0xab/0xb0 [ 87.466297][ T5219] end_report+0x107/0x170 [ 87.471511][ T5219] kasan_report+0xee/0x110 [ 87.476084][ T5219] ? hdm_disconnect+0x227/0x250 [ 87.481116][ T5219] hdm_disconnect+0x227/0x250 [ 87.486434][ T5219] usb_unbind_interface+0x1da/0x9a0 [ 87.491730][ T5219] ? kernfs_remove_by_name_ns+0xbe/0x110 [ 87.497486][ T5219] ? __pfx_usb_unbind_interface+0x10/0x10 [ 87.503424][ T5219] device_remove+0x122/0x170 [ 87.508227][ T5219] device_release_driver_internal+0x44b/0x620 [ 87.515405][ T5219] bus_remove_device+0x22f/0x420 [ 87.521396][ T5219] device_del+0x396/0x9f0 [ 87.525858][ T5219] ? __pfx_device_del+0x10/0x10 [ 87.531353][ T5219] ? __pfx___mutex_lock+0x10/0x10 [ 87.536600][ T5219] ? __pfx___pm_runtime_barrier+0x10/0x10 [ 87.542364][ T5219] ? do_raw_spin_lock+0x12c/0x2b0 [ 87.547871][ T5219] usb_disable_device+0x355/0x7d0 [ 87.553207][ T5219] usb_disconnect+0x2e1/0x920 [ 87.558109][ T5219] hub_event+0x1aa0/0x5030 [ 87.562833][ T5219] ? __lock_acquire+0xb8a/0x1c90 [ 87.568434][ T5219] ? __pfx_hub_event+0x10/0x10 [ 87.573223][ T5219] ? assoc_array_gc+0xe00/0x15b0 [ 87.579021][ T5219] ? rcu_is_watching+0x12/0xc0 [ 87.585216][ T5219] process_one_work+0x9cc/0x1b70 [ 87.590715][ T5219] ? __pfx_process_one_work+0x10/0x10 [ 87.596293][ T5219] ? assign_work+0x1a0/0x250 [ 87.601259][ T5219] worker_thread+0x6c8/0xf10 [ 87.606495][ T5219] ? __kthread_parkme+0x19e/0x250 [ 87.611998][ T5219] ? __pfx_worker_thread+0x10/0x10 [ 87.617669][ T5219] kthread+0x3c5/0x780 [ 87.621883][ T5219] ? __pfx_kthread+0x10/0x10 [ 87.626606][ T5219] ? rcu_is_watching+0x12/0xc0 [ 87.631460][ T5219] ? __pfx_kthread+0x10/0x10 [ 87.636363][ T5219] ret_from_fork+0x5b3/0x6c0 [ 87.641178][ T5219] ? __pfx_kthread+0x10/0x10 [ 87.645804][ T5219] ret_from_fork_asm+0x1a/0x30 [ 87.651740][ T5219] [ 87.656554][ T5219] Kernel Offset: disabled [ 87.661406][ T5219] Rebooting in 86400 seconds..