Extracting prog: 44m32.637408929s
Minimizing prog: 5m42.569309931s
Simplifying prog options: 0s
Extracting C: 42.806325751s
Simplifying C: 12m17.467685824s


extracting reproducer from 24 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100151f30940cb040001bb000000000109021200090000000009042a00008004", @ANYRES16], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid
detailed listing:
executing program 0:
syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040450c0b76400001020301090224000101063000090400fc010301000009210100fb00225e0809058103"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b808090504105802030d580904"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
detailed listing:
executing program 1:
syz_usb_connect(0x3, 0x48, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007ce7c810d804300a47ce010203010902360001000000000904"], 0x0)
executing program 1:
prctl$PR_CAPBSET_DROP(0x18, 0x29)
executing program 1:
syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009003940422c021664da010203010902120001000000040904"], 0x0)
executing program 1:
syz_usb_connect(0x1, 0x24, &(0x7f0000000240)={{0x12, 0x1, 0x250, 0xa6, 0x66, 0xee, 0x8, 0x19d2, 0x412, 0x6983, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x81, 0x3, 0x20, 0xde, "", [{{0x9, 0x4, 0xb0, 0x9, 0x0, 0xff, 0xff, 0xff, 0x1}}]}}]}}, &(0x7f0000000c80)={0x0, 0x0, 0xf, &(0x7f00000007c0)=ANY=[@ANYBLOB="050f0f00010a1003"], 0x1, [{0x0, 0x0}]})
executing program 3:
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e045f2d20", @ANYRES16], 0x7)
executing program 3:
syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e79"], 0x0)
executing program 2:
pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
executing program 2:
semctl$SETVAL(0x0, 0x1, 0x10, &(0x7f000000f980)=0x800)
executing program 2:
getpriority(0x1, 0xffffffffffffffff)
executing program 2:
fsopen(&(0x7f0000000140)='pipefs\x00', 0x0)
executing program 2:
syz_usb_connect(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000052e8e510b1134200c4dc0102030109021b00010000000009044400012eafb200090581", @ANYBLOB="9423"], 0x0)
executing program 1:
syz_usb_connect(0x3, 0x24, &(0x7f0000001c80)=ANY=[@ANYBLOB="12010000941b6508c410c1ea2f7001020301090212000100000000090401"], 0x0)
executing program 0:
futex_waitv(&(0x7f00000014c0)=[{0x8, 0x0, 0x2}], 0x1, 0x0, 0xffffffffffffffff, 0x0)
executing program 0:
syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c0009050202000202000009058202"], 0x0)
executing program 3:
prctl$PR_SCHED_CORE(0x48, 0x4, 0x0, 0x3, 0x0)
executing program 3:
socket(0x15, 0x3, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)
executing program 2:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
executing program 1:
syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b808090504105802030d580904"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0})
executing program 0:
socket(0x26, 0x80000, 0x7)
executing program 3:
syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040450c0b76400001020301090224000101063000090400fc010301000009210100fb00225e0809058103"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})
executing program 0:
landlock_create_ruleset(&(0x7f0000000180)={0x800, 0x1, 0x0, 0xa060, 0x3, 0x2}, 0x30, 0x3)
executing program 0:
mq_open(&(0x7f0000000000)='}:\x00', 0x2, 0x1, &(0x7f0000000040)={0xfffffffffffffffe, 0x8000000000000001, 0x0, 0x3d52})
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100151f30940cb040001bb000000000109021200090000000009042a00008004", @ANYRES16], 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 4 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100151f30940cb040001bb000000000109021200090000000009042a00008004", @ANYRES16], 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid
detailed listing:
executing program 0:
syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040450c0b76400001020301090224000101063000090400fc010301000009210100fb00225e0809058103"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b808090504105802030d580904"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 1m40s
testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
detailed listing:
executing program 1:
syz_usb_connect(0x3, 0x48, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007ce7c810d804300a47ce010203010902360001000000000904"], 0x0)
executing program 1:
prctl$PR_CAPBSET_DROP(0x18, 0x29)
executing program 1:
syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009003940422c021664da010203010902120001000000040904"], 0x0)
executing program 1:
syz_usb_connect(0x1, 0x24, &(0x7f0000000240)={{0x12, 0x1, 0x250, 0xa6, 0x66, 0xee, 0x8, 0x19d2, 0x412, 0x6983, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x81, 0x3, 0x20, 0xde, "", [{{0x9, 0x4, 0xb0, 0x9, 0x0, 0xff, 0xff, 0xff, 0x1}}]}}]}}, &(0x7f0000000c80)={0x0, 0x0, 0xf, &(0x7f00000007c0)=ANY=[@ANYBLOB="050f0f00010a1003"], 0x1, [{0x0, 0x0}]})
executing program 3:
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e045f2d20", @ANYRES16], 0x7)
executing program 3:
syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e79"], 0x0)
executing program 2:
pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
executing program 2:
semctl$SETVAL(0x0, 0x1, 0x10, &(0x7f000000f980)=0x800)
executing program 2:
getpriority(0x1, 0xffffffffffffffff)
executing program 2:
fsopen(&(0x7f0000000140)='pipefs\x00', 0x0)
executing program 2:
syz_usb_connect(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000052e8e510b1134200c4dc0102030109021b00010000000009044400012eafb200090581", @ANYBLOB="9423"], 0x0)
executing program 1:
syz_usb_connect(0x3, 0x24, &(0x7f0000001c80)=ANY=[@ANYBLOB="12010000941b6508c410c1ea2f7001020301090212000100000000090401"], 0x0)
executing program 0:
futex_waitv(&(0x7f00000014c0)=[{0x8, 0x0, 0x2}], 0x1, 0x0, 0xffffffffffffffff, 0x0)
executing program 0:
syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c0009050202000202000009058202"], 0x0)
executing program 3:
prctl$PR_SCHED_CORE(0x48, 0x4, 0x0, 0x3, 0x0)
executing program 3:
socket(0x15, 0x3, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)
executing program 2:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
executing program 1:
syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b808090504105802030d580904"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0})
executing program 0:
socket(0x26, 0x80000, 0x7)
executing program 3:
syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040450c0b76400001020301090224000101063000090400fc010301000009210100fb00225e0809058103"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})
executing program 0:
landlock_create_ruleset(&(0x7f0000000180)={0x800, 0x1, 0x0, 0xa060, 0x3, 0x2}, 0x30, 0x3)
executing program 0:
mq_open(&(0x7f0000000000)='}:\x00', 0x2, 0x1, &(0x7f0000000040)={0xfffffffffffffffe, 0x8000000000000001, 0x0, 0x3d52})
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100151f30940cb040001bb000000000109021200090000000009042a00008004", @ANYRES16], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <24>
bisect: split chunk #0 of len 24 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
detailed listing:
executing program 2:
getpriority(0x1, 0xffffffffffffffff)
executing program 2:
fsopen(&(0x7f0000000140)='pipefs\x00', 0x0)
executing program 2:
syz_usb_connect(0x3, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000052e8e510b1134200c4dc0102030109021b00010000000009044400012eafb200090581", @ANYBLOB="9423"], 0x0)
executing program 1:
syz_usb_connect(0x3, 0x24, &(0x7f0000001c80)=ANY=[@ANYBLOB="12010000941b6508c410c1ea2f7001020301090212000100000000090401"], 0x0)
executing program 0:
futex_waitv(&(0x7f00000014c0)=[{0x8, 0x0, 0x2}], 0x1, 0x0, 0xffffffffffffffff, 0x0)
executing program 0:
syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c0009050202000202000009058202"], 0x0)
executing program 3:
prctl$PR_SCHED_CORE(0x48, 0x4, 0x0, 0x3, 0x0)
executing program 3:
socket(0x15, 0x3, 0x0)
executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)
executing program 2:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
executing program 1:
syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b808090504105802030d580904"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0})
executing program 0:
socket(0x26, 0x80000, 0x7)
executing program 3:
syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040450c0b76400001020301090224000101063000090400fc010301000009210100fb00225e0809058103"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})
executing program 0:
landlock_create_ruleset(&(0x7f0000000180)={0x800, 0x1, 0x0, 0xa060, 0x3, 0x2}, 0x30, 0x3)
executing program 0:
mq_open(&(0x7f0000000000)='}:\x00', 0x2, 0x1, &(0x7f0000000040)={0xfffffffffffffffe, 0x8000000000000001, 0x0, 0x3d52})
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100151f30940cb040001bb000000000109021200090000000009042a00008004", @ANYRES16], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1, 1, 1, 1, 1, 1, 1]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)
executing program 2:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
executing program 1:
syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b808090504105802030d580904"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0})
executing program 0:
socket(0x26, 0x80000, 0x7)
executing program 3:
syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040450c0b76400001020301090224000101063000090400fc010301000009210100fb00225e0809058103"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})
executing program 0:
landlock_create_ruleset(&(0x7f0000000180)={0x800, 0x1, 0x0, 0xa060, 0x3, 0x2}, 0x30, 0x3)
executing program 0:
mq_open(&(0x7f0000000000)='}:\x00', 0x2, 0x1, &(0x7f0000000040)={0xfffffffffffffffe, 0x8000000000000001, 0x0, 0x3d52})
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100151f30940cb040001bb000000000109021200090000000009042a00008004", @ANYRES16], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1, 1, 1]
detailed listing:
executing program 3:
syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040450c0b76400001020301090224000101063000090400fc010301000009210100fb00225e0809058103"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0})
executing program 0:
landlock_create_ruleset(&(0x7f0000000180)={0x800, 0x1, 0x0, 0xa060, 0x3, 0x2}, 0x30, 0x3)
executing program 0:
mq_open(&(0x7f0000000000)='}:\x00', 0x2, 0x1, &(0x7f0000000040)={0xfffffffffffffffe, 0x8000000000000001, 0x0, 0x3d52})
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201100151f30940cb040001bb000000000109021200090000000009042a00008004", @ANYRES16], 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1, 1, 1]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)
executing program 2:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
executing program 1:
syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b808090504105802030d580904"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0})
executing program 0:
socket(0x26, 0x80000, 0x7)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1]
detailed listing:
executing program 1:
syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f700c873b808090504105802030d580904"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0})
executing program 0:
socket(0x26, 0x80000, 0x7)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)
executing program 2:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 2:
syz_usb_connect(0x3, 0xf4, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003f2fbcc40710402060b11010203010902e20002030a00000904b8060228671626090508100004f0030607250100f809008e0a19b0905e39618a67b86b8ce8ebf8d2e6be04506aadbf4bda58e881389e0c590f25ab989c6a898703293356bf5f58ebf097a647979d12ab9c6f675c46781e205fe48946ab44d5"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 3:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
bisect: concatenation succeeded
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=2m3.738764114s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)

program did not crash
testing program (duration=2m3.738764114s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=2m3.738764114s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
simplifying C reproducer
testing compiled C program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing compiled C program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing compiled C program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing compiled C program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing compiled C program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing compiled C program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing compiled C program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
testing program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
validation run: crashed=true
testing program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
validation run: crashed=true
testing program (duration=2m3.738764114s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b10009058206"], 0x0)

program crashed: INFO: trying to register non-static key in __vb2_queue_cancel
validation run: crashed=true
reproducing took 1h9m14.776437147s
repro crashed as (corrupted=false):
em28xx 1-1:0.132: failed to trigger read from i2c address 0x40 (error=-19)
em28xx 1-1:0.132: Config register raw data: 0xffffffed
em28xx 1-1:0.132: AC97 chip type couldn't be determined
em28xx 1-1:0.132: No AC97 audio processor
usb 1-1: Decoder not found
em28xx 1-1:0.132: failed to create media graph
em28xx 1-1:0.132: V4L2 device video103 deregistered
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 UID: 0 PID: 5930 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: events request_module_async
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:1000
 register_lock_class+0xcc/0x2e0 kernel/locking/lockdep.c:1315
 __lock_acquire+0xaf/0x2e40 kernel/locking/lockdep.c:5128
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906
 rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
 spin_lock include/linux/spinlock_rt.h:45 [inline]
 __wake_up_common_lock+0x2f/0x1f0 kernel/sched/wait.c:124
 __vb2_queue_cancel+0x2de/0xdc0 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x2f/0x150 drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:956 [inline]
 vb2_video_unregister_device+0x15b/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1292
 em28xx_v4l2_init+0x1c60/0x3140 drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
 process_scheduled_works kernel/workqueue.c:3462 [inline]
 worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 5930 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: events request_module_async
RIP: 0010:__wake_up_common kernel/sched/wait.c:104 [inline]
RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 kernel/sched/wait.c:125
Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90004547908 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff888044685b14
R13: ffff888044685c28 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd8c0cfa6b0 CR3: 000000003992c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __vb2_queue_cancel+0x2de/0xdc0 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x2f/0x150 drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:956 [inline]
 vb2_video_unregister_device+0x15b/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1292
 em28xx_v4l2_init+0x1c60/0x3140 drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
 process_scheduled_works kernel/workqueue.c:3462 [inline]
 worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__wake_up_common kernel/sched/wait.c:104 [inline]
RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 kernel/sched/wait.c:125
Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90004547908 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff888044685b14
R13: ffff888044685c28 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd8c0cfa6b0 CR3: 000000003992c000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	0f 84 d4 00 00 00    	je     0xda
   6:	44 8b 7c 24 04       	mov    0x4(%rsp),%r15d
   b:	eb 13                	jmp    0x20
   d:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  14:	fc ff df
  17:	4c 39 ed             	cmp    %r13,%rbp
  1a:	0f 84 ba 00 00 00    	je     0xda
  20:	49 89 ee             	mov    %rbp,%r14
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1) <-- trapping instruction
  2e:	74 12                	je     0x42
  30:	4c 89 f7             	mov    %r14,%rdi
  33:	e8 1c ce 93 00       	call   0x93ce54
  38:	48                   	rex.W
  39:	ba 00 00 00 00       	mov    $0x0,%edx
  3e:	00 fc                	add    %bh,%ah

final repro crashed as (corrupted=false):
em28xx 1-1:0.132: failed to trigger read from i2c address 0x40 (error=-19)
em28xx 1-1:0.132: Config register raw data: 0xffffffed
em28xx 1-1:0.132: AC97 chip type couldn't be determined
em28xx 1-1:0.132: No AC97 audio processor
usb 1-1: Decoder not found
em28xx 1-1:0.132: failed to create media graph
em28xx 1-1:0.132: V4L2 device video103 deregistered
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 UID: 0 PID: 5930 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: events request_module_async
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:1000
 register_lock_class+0xcc/0x2e0 kernel/locking/lockdep.c:1315
 __lock_acquire+0xaf/0x2e40 kernel/locking/lockdep.c:5128
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906
 rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
 spin_lock include/linux/spinlock_rt.h:45 [inline]
 __wake_up_common_lock+0x2f/0x1f0 kernel/sched/wait.c:124
 __vb2_queue_cancel+0x2de/0xdc0 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x2f/0x150 drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:956 [inline]
 vb2_video_unregister_device+0x15b/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1292
 em28xx_v4l2_init+0x1c60/0x3140 drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
 process_scheduled_works kernel/workqueue.c:3462 [inline]
 worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 5930 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: events request_module_async
RIP: 0010:__wake_up_common kernel/sched/wait.c:104 [inline]
RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 kernel/sched/wait.c:125
Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90004547908 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff888044685b14
R13: ffff888044685c28 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd8c0cfa6b0 CR3: 000000003992c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __vb2_queue_cancel+0x2de/0xdc0 drivers/media/common/videobuf2/videobuf2-core.c:2244
 vb2_core_queue_release+0x2f/0x150 drivers/media/common/videobuf2/videobuf2-core.c:2677
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:956 [inline]
 vb2_video_unregister_device+0x15b/0x200 drivers/media/common/videobuf2/videobuf2-v4l2.c:1292
 em28xx_v4l2_init+0x1c60/0x3140 drivers/media/usb/em28xx/em28xx-video.c:3097
 em28xx_init_extension+0x120/0x1d0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
 process_scheduled_works kernel/workqueue.c:3462 [inline]
 worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__wake_up_common kernel/sched/wait.c:104 [inline]
RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 kernel/sched/wait.c:125
Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90004547908 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff888044685b14
R13: ffff888044685c28 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd8c0cfa6b0 CR3: 000000003992c000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	0f 84 d4 00 00 00    	je     0xda
   6:	44 8b 7c 24 04       	mov    0x4(%rsp),%r15d
   b:	eb 13                	jmp    0x20
   d:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  14:	fc ff df
  17:	4c 39 ed             	cmp    %r13,%rbp
  1a:	0f 84 ba 00 00 00    	je     0xda
  20:	49 89 ee             	mov    %rbp,%r14
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1) <-- trapping instruction
  2e:	74 12                	je     0x42
  30:	4c 89 f7             	mov    %r14,%rdi
  33:	e8 1c ce 93 00       	call   0x93ce54
  38:	48                   	rex.W
  39:	ba 00 00 00 00       	mov    $0x0,%edx
  3e:	00 fc                	add    %bh,%ah