program: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000100), 0x3) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x4, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[@ANYBLOB="b8000000130000012cbd7400fbdbdf25fc00000000000000000000000009000000000000000020000004000000000a0060803bf300000000000000000000000000139629558de9e98087bc888ea934dffb587d1dd6f782f63c085168208f3a20dd6cdffb56f1a3a92e52b858ca2790c090b82087c07a801cde6e3e57bf4f4cbff4643238cef6f45b257ead7268c0592e73211e35bfa685484e11237e4096b6ff71bfeb5efcd441434998918527803d2ce4130ee8d95a943e766668f7037d4974f1f7e5b008", @ANYRES32=0x0, @ANYRES8=r0, @ANYBLOB="00000000000000000400000000000000000000000000000000000000000002003c00000000000000fdfff7ffffffffff50000000000000000000000000000000050000000000000000000000000000000100000001000000030000000000000006000000000000400001020000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x20004000) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000401c1b021b00000000000109022400010000200609040000020300000009210000000122180009058103ff03000003608b61d47d0731a02f3391efe7be10f12a20cef15ce22560507d6cfb214af5808c1ee53148daa0f7352700b8f8638d4232fc1111f37cb48589a8f426d0b5092904578a4b52675586d1750a6eccb4bce0d522476f848f4f0b25bc411d5259d15e50ff3ad96808759e24b8e40a706edaf13b910fce50ba9aed861c37"], 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.self_freezing\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000280), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r6, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000040000000030a01020000000000000000010000008e8e50a873797a320000000014000480080002400000000008000140000000050900010073797a31000000003c000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000040004800a000700726f757465000000140000001100010000000000000000000000000a"], 0xc4}}, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0xc0189436, &(0x7f0000000140)=0x80004000) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@mpls_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_DST={0x8, 0x1, {0x100}}]}, 0x24}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221800"], 0x0}, 0x0) sendto$inet_nvme_of_msg(r5, &(0x7f00000005c0)={@r2t={{0x9, 0xd, 0x18, 0x3, 0xfffffa25}, 0x0, 0x8, 0x3, 0x5}, @val=&(0x7f0000000480)="5b1f27f78ae8b55fa902bfc50ff6fd97ce16771c86ed8b1c4a82819d09b665a005bb74ba7fbb342561f14b55a6619d5f20039894cea9505f8470a0a01551c8914970af702f2f4781be4014967a787c4baf50f0754996490c20369bb5f356774664c95358beebb19f22ef61b695916e4d98e3d75ed075b7d4ba21101582700ed7a212faba7768b55c0dbf00522366c12f156e20b2ca109607b7392a61ad877eaae6125228a6009b038aa754f6ea3007696024b8a4b38be9b50b19adbfb372348c8ab5142ea28e07f24f6a53bfe66acf9fcadbdcdee289240fedc08274b5084dffb4581ef9daf6af5b8e5f6873d2a21fdffb9e30507219"}, 0x88, 0x0, 0x0, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r9, 0x3ba0, &(0x7f0000000040)={0x48, 0x2, r10, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r9, 0x3ba0, &(0x7f0000000180)={0x48, 0x14, r11}) close(0x3) [ 101.355689][ T5278] Bluetooth: hci0: command tx timeout [ 101.750962][ T807] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 101.902461][ T807] usb 5-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 101.908536][ T807] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.913143][ T807] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 101.918906][ T807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.952008][ T807] usb 5-1: config 0 descriptor?? [ 102.225743][ T5316] netlink: 44 bytes leftover after parsing attributes in process `syz.0.0'. [ 102.447187][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.450542][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.459174][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.462678][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.465957][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.470135][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.473513][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.476617][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.479503][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.488311][ T807] corsair 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 102.520028][ T807] corsair 0003:1B1C:1B02.0002: hidraw1: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.0-1/input0 [ 102.654505][ T5316] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 102.705034][ T807] corsair 0003:1B1C:1B02.0002: Failed to get K90 initial state (error -71). [ 102.764320][ T807] usb 5-1: USB disconnect, device number 2 [ 102.798065][ T807] ------------[ cut here ]------------ [ 102.800444][ T807] ODEBUG: free active (active state 0) object: ffff88804faa42c8 object type: work_struct hint: k90_record_led_work+0x0/0x1e0 [ 102.805928][ T807] WARNING: lib/debugobjects.c:632 at debug_print_object+0xec/0x230, CPU#0: kworker/0:2/807 [ 102.810577][ T807] Modules linked in: [ 102.812491][ T807] CPU: 0 UID: 0 PID: 807 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 102.816029][ T807] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.819461][ T807] Workqueue: usb_hub_wq hub_event [ 102.821412][ T807] RIP: 0010:debug_print_object+0x18a/0x230 [ 102.823378][ T807] Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 6d 58 52 fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 63 06 93 0b 48 83 c4 10 5b 41 5c [ 102.830414][ T807] RSP: 0018:ffffc900040fefd0 EFLAGS: 00010246 [ 102.832871][ T807] RAX: 1ffffffff1816d18 RBX: dffffc0000000000 RCX: 0000000000000000 [ 102.836298][ T807] RDX: ffffffff8c6d2140 RSI: ffffffff8c6d1bc0 RDI: ffffffff90840f60 [ 102.839802][ T807] RBP: ffffffff8c6d2140 R08: ffff88804faa42c8 R09: ffffffff8c0b7ae0 [ 102.843427][ T807] R10: dffffc0000000000 R11: ffffffff818ee630 R12: 0000000000000000 [ 102.846861][ T807] R13: ffffffff90840f60 R14: ffff88804faa42c8 R15: ffffffff8c0b68c0 [ 102.850119][ T807] FS: 0000000000000000(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 102.853917][ T807] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.856657][ T807] CR2: 000055f2ca1dd018 CR3: 000000004fa28000 CR4: 0000000000352ef0 [ 102.860103][ T807] Call Trace: [ 102.861630][ T807] [ 102.862918][ T807] ? __pfx_k90_record_led_work+0x10/0x10 [ 102.865352][ T807] ? __pfx_k90_record_led_work+0x10/0x10 [ 102.867844][ T807] debug_check_no_obj_freed+0x2e3/0x450 [ 102.870250][ T807] kfree+0x13e/0x640 [ 102.872061][ T807] ? corsair_remove+0xfd/0x260 [ 102.874191][ T807] corsair_remove+0xfd/0x260 [ 102.876242][ T807] ? __pfx_corsair_remove+0x10/0x10 [ 102.878698][ T807] hid_device_remove+0xc5/0x1c0 [ 102.881401][ T807] ? __pfx_hid_device_remove+0x10/0x10 [ 102.883689][ T807] device_release_driver_internal+0x48b/0x880 [ 102.886370][ T807] bus_remove_device+0x444/0x560 [ 102.888541][ T807] ? __pfx_bus_remove_device+0x10/0x10 [ 102.891135][ T807] ? kernfs_remove_by_name_ns+0x101/0x140 [ 102.893436][ T807] device_del+0x524/0x8f0 [ 102.895338][ T807] ? __pfx_device_del+0x10/0x10 [ 102.897280][ T807] hid_destroy_device+0x6b/0x1b0 [ 102.899295][ T807] usbhid_disconnect+0x9f/0xc0 [ 102.901319][ T807] usb_unbind_interface+0x295/0x9f0 [ 102.903230][ T807] ? kernfs_remove_by_name_ns+0x101/0x140 [ 102.905401][ T807] ? kernfs_remove_by_name_ns+0x101/0x140 [ 102.907658][ T807] ? __pfx_usb_unbind_interface+0x10/0x10 [ 102.910010][ T807] device_release_driver_internal+0x4f5/0x880 [ 102.912741][ T807] bus_remove_device+0x444/0x560 [ 102.914954][ T807] ? __pfx_bus_remove_device+0x10/0x10 [ 102.917356][ T807] ? kernfs_remove_by_name_ns+0x101/0x140 [ 102.919836][ T807] device_del+0x524/0x8f0 [ 102.921841][ T807] ? __pfx_device_del+0x10/0x10 [ 102.924017][ T807] ? kobject_put+0x516/0x550 [ 102.926020][ T807] usb_disable_device+0x3d4/0x8d0 [ 102.928201][ T807] usb_disconnect+0x346/0x9a0 [ 102.930305][ T807] hub_event+0x1bbb/0x4d30 [ 102.932435][ T807] ? do_raw_spin_unlock+0x4d/0x200 [ 102.934724][ T807] ? register_lock_class+0x31/0x2e0 [ 102.937080][ T807] ? __pfx_hub_event+0x10/0x10 [ 102.939151][ T807] ? process_scheduled_works+0x97a/0x1630 [ 102.941711][ T807] ? rcu_is_watching+0x16/0xb0 [ 102.943517][ T807] ? process_scheduled_works+0x97a/0x1630 [ 102.945779][ T807] process_scheduled_works+0xc3d/0x1630 [ 102.947884][ T807] ? __pfx_process_scheduled_works+0x10/0x10 [ 102.949938][ T807] ? assign_work+0x3cf/0x5d0 [ 102.951617][ T807] worker_thread+0xa47/0xfb0 [ 102.953212][ T807] kthread+0x38b/0x480 [ 102.954641][ T807] ? __pfx_worker_thread+0x10/0x10 [ 102.956425][ T807] ? __pfx_kthread+0x10/0x10 [ 102.958208][ T807] ret_from_fork+0x514/0xb70 [ 102.959955][ T807] ? __pfx_ret_from_fork+0x10/0x10 [ 102.961955][ T807] ? __switch_to+0xc89/0x1420 [ 102.963811][ T807] ? __pfx_kthread+0x10/0x10 [ 102.965512][ T807] ret_from_fork_asm+0x1a/0x30 [ 102.967200][ T807] [ 102.968402][ T807] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 102.971131][ T807] CPU: 0 UID: 0 PID: 807 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 102.974393][ T807] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.977999][ T807] Workqueue: usb_hub_wq hub_event [ 102.979821][ T807] Call Trace: [ 102.981090][ T807] [ 102.982179][ T807] vpanic+0x56d/0xa60 [ 102.983639][ T807] ? __pfx__printk+0x10/0x10 [ 102.985285][ T807] ? __pfx_vpanic+0x10/0x10 [ 102.987125][ T807] ? is_bpf_text_address+0x292/0x2b0 [ 102.989357][ T807] ? is_bpf_text_address+0x26/0x2b0 [ 102.991588][ T807] panic+0xc5/0xd0 [ 102.993235][ T807] ? __pfx_panic+0x10/0x10 [ 102.995195][ T807] ? ret_from_fork_asm+0x1a/0x30 [ 102.997341][ T807] __warn+0x315/0x4c0 [ 102.999108][ T807] ? debug_print_object+0xec/0x230 [ 103.001339][ T807] ? debug_print_object+0xec/0x230 [ 103.003310][ T807] __report_bug+0x276/0x570 [ 103.005122][ T807] ? debug_print_object+0xec/0x230 [ 103.007107][ T807] ? __pfx___report_bug+0x10/0x10 [ 103.009107][ T807] ? kasan_save_track+0x4f/0x80 [ 103.011058][ T807] ? kasan_save_free_info+0x40/0x50 [ 103.013119][ T807] ? __kasan_slab_free+0x5c/0x80 [ 103.015025][ T807] ? kfree+0x1c5/0x640 [ 103.016591][ T807] report_bug_entry+0x19b/0x290 [ 103.018379][ T807] ? debug_print_object+0x18a/0x230 [ 103.020312][ T807] ? debug_print_object+0x18f/0x230 [ 103.022185][ T807] handle_bug+0xce/0x200 [ 103.023619][ T807] exc_invalid_op+0x1a/0x50 [ 103.025571][ T807] asm_exc_invalid_op+0x1a/0x20 [ 103.027583][ T807] RIP: 0010:debug_print_object+0x18a/0x230 [ 103.030105][ T807] Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 6d 58 52 fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 63 06 93 0b 48 83 c4 10 5b 41 5c [ 103.038347][ T807] RSP: 0018:ffffc900040fefd0 EFLAGS: 00010246 [ 103.040777][ T807] RAX: 1ffffffff1816d18 RBX: dffffc0000000000 RCX: 0000000000000000 [ 103.043774][ T807] RDX: ffffffff8c6d2140 RSI: ffffffff8c6d1bc0 RDI: ffffffff90840f60 [ 103.046980][ T807] RBP: ffffffff8c6d2140 R08: ffff88804faa42c8 R09: ffffffff8c0b7ae0 [ 103.050340][ T807] R10: dffffc0000000000 R11: ffffffff818ee630 R12: 0000000000000000 [ 103.053667][ T807] R13: ffffffff90840f60 R14: ffff88804faa42c8 R15: ffffffff8c0b68c0 [ 103.056981][ T807] ? __pfx_work_debug_hint+0x10/0x10 [ 103.059258][ T807] ? __pfx_k90_record_led_work+0x10/0x10 [ 103.061644][ T807] ? __pfx_k90_record_led_work+0x10/0x10 [ 103.063714][ T807] debug_check_no_obj_freed+0x2e3/0x450 [ 103.065688][ T807] kfree+0x13e/0x640 [ 103.067183][ T807] ? corsair_remove+0xfd/0x260 [ 103.068992][ T807] corsair_remove+0xfd/0x260 [ 103.070823][ T807] ? __pfx_corsair_remove+0x10/0x10 [ 103.072964][ T807] hid_device_remove+0xc5/0x1c0 [ 103.075083][ T807] ? __pfx_hid_device_remove+0x10/0x10 [ 103.077411][ T807] device_release_driver_internal+0x48b/0x880 [ 103.079966][ T807] bus_remove_device+0x444/0x560 [ 103.082128][ T807] ? __pfx_bus_remove_device+0x10/0x10 [ 103.084508][ T807] ? kernfs_remove_by_name_ns+0x101/0x140 [ 103.087011][ T807] device_del+0x524/0x8f0 [ 103.088904][ T807] ? __pfx_device_del+0x10/0x10 [ 103.091076][ T807] hid_destroy_device+0x6b/0x1b0 [ 103.093279][ T807] usbhid_disconnect+0x9f/0xc0 [ 103.095366][ T807] usb_unbind_interface+0x295/0x9f0 [ 103.097615][ T807] ? kernfs_remove_by_name_ns+0x101/0x140 [ 103.099904][ T807] ? kernfs_remove_by_name_ns+0x101/0x140 [ 103.102233][ T807] ? __pfx_usb_unbind_interface+0x10/0x10 [ 103.104491][ T807] device_release_driver_internal+0x4f5/0x880 [ 103.106879][ T807] bus_remove_device+0x444/0x560 [ 103.111434][ T807] ? __pfx_bus_remove_device+0x10/0x10 [ 103.113806][ T807] ? kernfs_remove_by_name_ns+0x101/0x140 [ 103.116166][ T807] device_del+0x524/0x8f0 [ 103.118049][ T807] ? __pfx_device_del+0x10/0x10 [ 103.120466][ T807] ? kobject_put+0x516/0x550 [ 103.122895][ T807] usb_disable_device+0x3d4/0x8d0 [ 103.125164][ T807] usb_disconnect+0x346/0x9a0 [ 103.127193][ T807] hub_event+0x1bbb/0x4d30 [ 103.129111][ T807] ? do_raw_spin_unlock+0x4d/0x200 [ 103.131306][ T807] ? register_lock_class+0x31/0x2e0 [ 103.133507][ T807] ? __pfx_hub_event+0x10/0x10 [ 103.135252][ T807] ? process_scheduled_works+0x97a/0x1630 [ 103.137485][ T807] ? rcu_is_watching+0x16/0xb0 [ 103.139469][ T807] ? process_scheduled_works+0x97a/0x1630 [ 103.141974][ T807] process_scheduled_works+0xc3d/0x1630 [ 103.144209][ T807] ? __pfx_process_scheduled_works+0x10/0x10 [ 103.146501][ T807] ? assign_work+0x3cf/0x5d0 [ 103.148630][ T807] worker_thread+0xa47/0xfb0 [ 103.150765][ T807] kthread+0x38b/0x480 [ 103.152507][ T807] ? __pfx_worker_thread+0x10/0x10 [ 103.154661][ T807] ? __pfx_kthread+0x10/0x10 [ 103.156502][ T807] ret_from_fork+0x514/0xb70 [ 103.158325][ T807] ? __pfx_ret_from_fork+0x10/0x10 [ 103.160370][ T807] ? __switch_to+0xc89/0x1420 [ 103.162201][ T807] ? __pfx_kthread+0x10/0x10 [ 103.164091][ T807] ret_from_fork_asm+0x1a/0x30 [ 103.166096][ T807] [ 103.167871][ T807] Kernel Offset: disabled [ 103.169615][ T807] Rebooting in 86400 seconds..