Extracting prog: 16m25.52883897s Minimizing prog: 19m42.781890273s Simplifying prog options: 0s Extracting C: 53.117580615s Simplifying C: 10m43.418792537s extracting reproducer from 38 programs testing a last program of every proc single: executing 8 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$char_usb-readv detailed listing: executing program 0: r0 = syz_usb_connect(0x2, 0x58, &(0x7f0000000080)=ANY=[@ANYBLOB="120110038e3ac6209406010013780102030109024600020e061003090439d8011adaa8080905081020000709800904e40503b956da020905080000040112fc09050b13200007039a0705d15b"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x14, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB='@\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x44, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) readv(r1, &(0x7f00000004c0)=[{&(0x7f0000000540)=""/117, 0x75}, {0x0}], 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-pipe2$watch_queue-add_key$user-add_key$user-add_key-keyctl$KEYCTL_WATCH_KEY-socket$nl_generic-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-fchdir-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-sendmsg$NL80211_CMD_NEW_INTERFACE-socket$kcm-sendmsg$inet-socket$kcm-ioctl$KVM_SET_XSAVE-madvise-move_pages-syz_usb_connect-sendmsg$kcm-close-ioctl$sock_inet_SIOCDARP-mmap-mlock-socket$pppl2tp-socket$inet6_udp-connect$inet6 detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) pipe2$watch_queue(&(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) add_key$user(&(0x7f0000000100), 0x0, 0x0, 0x0, 0xffffffffffffffff) add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r2 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000005c0)={'syz', 0x1}, &(0x7f0000000f80)='G', 0x1, 0xfffffffffffffffb) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r1, 0x47) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r5) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r8, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="2508007a0000000000030700000008000300", @ANYRES32=r7, @ANYBLOB="1400060064756d6d7930000000000000000000001400040076657468315f746f5f626f01640000000500530001"], 0x54}}, 0x0) r9 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r9, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10, 0x0}, 0x300060c1) r10 = socket$kcm(0x10, 0x2, 0x0) ioctl$KVM_SET_XSAVE(0xffffffffffffffff, 0x5000aea5, &(0x7f00000001c0)={[0x28861e98, 0x7, 0x81, 0x0, 0x7, 0x0, 0x0, 0xbc, 0xa, 0x5, 0x10001, 0xfffff001, 0xd2f, 0x4ff, 0xe, 0x9, 0x4, 0x7, 0x1, 0x4, 0x1000, 0x1, 0x7, 0x0, 0x791e0556, 0x0, 0xffffffff, 0x5, 0x7, 0x3, 0x10, 0xc, 0x9, 0x9, 0x3, 0x667d, 0x81, 0x7fffffff, 0x2, 0x8, 0x0, 0x5, 0x4, 0x6, 0x400, 0xff, 0x8, 0xfffffff8, 0xfffff226, 0xfffffffa, 0x80000000, 0x2, 0x4, 0x2bef0a6, 0x101, 0x4, 0x8, 0x8001, 0x40f5, 0x7, 0xffff, 0xfffffffd, 0x0, 0x10, 0x4, 0xe, 0x2, 0x81, 0x2, 0x8, 0x8, 0x4081, 0x7, 0x60ab, 0x400, 0x8000, 0x2, 0xc, 0x9cf, 0x8, 0x972, 0x4, 0x1, 0x5, 0xfb, 0x5, 0x4, 0x40, 0x4, 0x1, 0x7, 0x4, 0x2, 0xc, 0x1, 0x7fffffff, 0x1, 0x5, 0x8, 0x9, 0x7, 0x0, 0xffff7d01, 0x8, 0xe3a, 0xd93, 0x8, 0x7, 0x10000, 0x1, 0x7, 0x4, 0x9, 0x4, 0x2, 0x7, 0x0, 0x4, 0x0, 0xff, 0x3, 0x8, 0xffff1b05, 0xb0, 0x8, 0xff, 0x2f, 0x7, 0x1, 0x7, 0x8, 0x6, 0x9, 0x0, 0x6, 0x9, 0x9, 0xfffffffd, 0x2, 0x40, 0x7, 0x8, 0x781258ac, 0x8, 0x7a8, 0x1, 0xffffffff, 0xabd, 0x9b6c, 0xb6dd, 0x9203, 0xa30, 0x172, 0xf8000002, 0x3ff, 0x3a8, 0x1, 0x2, 0x81, 0x6, 0x50, 0xc75d, 0x5, 0x800000, 0x8, 0x9, 0xa, 0x67a6, 0xfffffffb, 0x5, 0x1, 0xffffffff, 0x1, 0x3, 0x709d, 0xfffffff2, 0x1, 0x1, 0x10001, 0x3, 0x0, 0x2, 0x2, 0x7, 0x0, 0x9, 0x10003, 0x3, 0x2, 0x8, 0xd5, 0x9, 0x7, 0x6, 0x1, 0x3, 0x10000, 0x1, 0x3714fc78, 0x4, 0xbc2, 0x7, 0x5, 0x2, 0x7ff, 0x7a1, 0xab, 0xff, 0x7, 0x0, 0x80000001, 0x3, 0x3, 0x7, 0x0, 0x4, 0xff, 0x4, 0x10000, 0x2, 0x7, 0x1, 0x20, 0x9, 0x8, 0x6, 0x8, 0x80000001, 0x8, 0x2, 0x8, 0x4, 0x9de, 0x6, 0x4, 0x2, 0x10001, 0x2, 0x9, 0x5, 0x3, 0xf, 0xfffff7b0, 0xffff354c, 0x1000, 0xd, 0x1146, 0x0, 0x4, 0x8, 0x10001, 0x5, 0x72a, 0xcb8a, 0x6, 0x5ad, 0x6, 0xe253, 0x6, 0x4, 0x7, 0x9, 0x4, 0x7efb, 0x0, 0xd, 0x401, 0xfffffc00, 0x7fff, 0x80000000, 0x2, 0x3, 0x3, 0x81, 0x6, 0x6, 0x6, 0x4, 0x7ff, 0x2, 0x8, 0x4, 0x6d9, 0x4, 0x8, 0x7, 0x4, 0x6, 0x8, 0x6, 0x1, 0x219c92b0, 0x10000, 0x3ff, 0x6, 0x1ff, 0x7ff, 0x0, 0x2, 0x1, 0x1, 0x8, 0x4, 0xfa33c9e0, 0xfffffffa, 0x8, 0x6, 0x8, 0xa, 0x6, 0x4, 0xfffffffd, 0x3, 0xfffffff9, 0x7fff, 0xd733, 0x59, 0x2, 0x80000000, 0xffff7a56, 0x128, 0x9, 0x3, 0x6, 0x4, 0x20f, 0x1000, 0x8000, 0xffff, 0x9, 0x9, 0x4, 0x0, 0xb8b, 0x1, 0x9, 0x4, 0x5, 0x2, 0xfffffff6, 0x9, 0x1ff, 0x0, 0x2, 0x2, 0x7, 0x2007, 0x5, 0x5, 0xffff1b35, 0xff000000, 0x0, 0x8, 0x3, 0x1, 0x3, 0x7, 0xfffffff9, 0xa, 0x6, 0x6, 0x9, 0x8, 0x1, 0x7, 0x3, 0xcec, 0x4, 0x7e0690a1, 0xfffffffe, 0x7, 0x3, 0x0, 0x0, 0xffff, 0x9, 0xfffffca9, 0x2, 0xbfa9, 0x8, 0x0, 0x2, 0x9, 0x2, 0x2, 0x1, 0x0, 0x7, 0x4, 0xfffffffd, 0x1, 0x510acf21, 0x4, 0x1c, 0x7, 0x2b1d, 0x4, 0x80000001, 0x6, 0x7, 0x1, 0x9, 0x7, 0x30e, 0x1, 0xffffffff, 0x2, 0x6, 0x3, 0x10001, 0xff, 0x7, 0x1, 0x100, 0xea, 0x5be, 0x8, 0xa2, 0x3, 0xc82, 0x40, 0x2, 0x1, 0x401, 0x5, 0x1000, 0x1, 0x3, 0x9, 0x8, 0x0, 0x3, 0x7, 0x7f, 0x4, 0xab5, 0xb34, 0xffff, 0x8, 0x6, 0x4, 0xfffffff7, 0x9, 0x10000, 0xff, 0x6, 0x0, 0x101, 0x7, 0x1000, 0x5, 0x8, 0x3, 0x9, 0xff, 0x1, 0x1002, 0x80000001, 0x0, 0x42, 0x8, 0xfffffff1, 0x1, 0x8, 0x1, 0x8, 0x43c1, 0x3c5, 0xa, 0xffffffff, 0x10001, 0xffff0001, 0xb, 0xf, 0xad4, 0x1, 0x7, 0x0, 0x3ff, 0x9, 0xfffffff9, 0x29b, 0x3, 0xcf2, 0x4, 0xc, 0x401, 0xff, 0x9, 0x80000001, 0xd, 0x31e8, 0x6410, 0xc42d, 0x9ac2, 0x7f, 0xfffffffd, 0x3, 0x9, 0x6, 0x2, 0xc, 0x8, 0x9, 0x2e82a536, 0x999f, 0x77b1000, 0xb, 0x5, 0x81, 0x9, 0x2, 0x1, 0x3, 0x4, 0x6, 0x6, 0x200, 0xcecd, 0x9, 0x7fffffff, 0x8001, 0x7, 0xa, 0xffffffe3, 0x8, 0x1, 0x1, 0x0, 0x8, 0xa, 0x2, 0x58f4, 0x3, 0x7, 0x2, 0xea, 0x3, 0x20008000, 0xc42c, 0x800, 0x0, 0x3, 0x50, 0x4, 0x3, 0x4, 0xffc, 0x3, 0x1, 0x7, 0x3, 0x3, 0x8, 0x3, 0x90, 0x3, 0x9, 0x98a, 0x8, 0x5, 0x400, 0xe, 0x2, 0x1, 0xff, 0x2, 0x7, 0x293, 0xe, 0x10000, 0x7, 0x84a4e3c, 0x6, 0x81, 0x8, 0x1000, 0x4, 0xffff, 0x401, 0x81, 0x9, 0x6, 0x3, 0x7ff, 0x2, 0x3, 0xb, 0xaa, 0x74, 0x0, 0x6, 0x5, 0x5, 0x1, 0x100, 0x3, 0x1ff, 0x41c2, 0x1, 0xb, 0x3f58, 0x0, 0xff, 0x9, 0x1abadea7, 0x6, 0x7, 0x9, 0x40, 0x0, 0xff, 0x7f, 0x7, 0xc, 0x80000000, 0xfffffe01, 0x5, 0x4, 0xd, 0xae41, 0x4d, 0x5, 0x8, 0x0, 0x7f, 0xad, 0x40, 0x6, 0xfffeffff, 0x1, 0x6, 0xf, 0x3, 0x4, 0x4fa, 0x2, 0xb7, 0x100, 0x7ff, 0x7fff, 0x7ff, 0x9, 0x100000e, 0xd82, 0x3, 0x0, 0x3, 0x3ff, 0x401, 0x7, 0x2, 0xab1, 0x9, 0xfffffffe, 0xa49, 0xc, 0x8, 0x81, 0xc6, 0x0, 0x7, 0x3, 0x2, 0x1, 0x3, 0x23a1, 0xa, 0x3, 0x9, 0x3d, 0x2, 0xa, 0x82, 0x2, 0x8, 0x5, 0xe, 0xb, 0x9, 0xed, 0x0, 0xa, 0x9, 0xf, 0x9, 0x1, 0xffffff13, 0x1, 0x8, 0x81, 0x200, 0x4, 0x5, 0x6, 0x8, 0x4, 0x9, 0x6, 0x9, 0x9, 0x5, 0xc3, 0x2b6ff772, 0x4, 0x7, 0x0, 0x2, 0x400, 0xe, 0x8, 0x1000, 0x1, 0x5, 0x6, 0x9, 0x5, 0x401, 0x6, 0x9, 0x9, 0x279, 0x2, 0x7f, 0x9, 0x80000000, 0x2, 0x0, 0xc, 0xfffffff7, 0x3, 0x397, 0x1, 0x6, 0x0, 0x80000001, 0x4edc, 0xa6c, 0x0, 0xf7f6, 0x10, 0x8, 0xd33, 0x3ff, 0x81, 0x1, 0x240000, 0x5, 0x9, 0x9, 0x3, 0x49fc, 0x6, 0xc89, 0x8, 0x8, 0xf, 0x2, 0x3, 0x1, 0xaab, 0x6, 0x401, 0x5, 0xfff, 0x4, 0x9, 0x2, 0x0, 0x8000, 0x1ff, 0x8000, 0x80, 0xe2d3, 0x0, 0x2, 0x1, 0x7, 0xa, 0x8, 0x200, 0x7, 0x7, 0x8455, 0x5, 0x9, 0x1, 0x2abf, 0xffff, 0x7, 0x2000020, 0x7, 0x2, 0x6, 0x8, 0x0, 0xb8f, 0x8, 0xa, 0x2, 0xffffffff, 0x8, 0xc, 0x1, 0x3, 0x2, 0x0, 0x2, 0x1, 0x7, 0x7, 0x200, 0x4, 0x2, 0xf7a6, 0x1, 0x2000009, 0x3, 0x40, 0x3, 0x1, 0xf, 0x800, 0xb231, 0x7de, 0x40, 0x3, 0x0, 0x6, 0x7f, 0x7ff, 0x5, 0x2, 0x1, 0xa73, 0x9, 0xc321, 0x1, 0x48, 0x10001, 0x5, 0x8, 0x2, 0x7ac0, 0xfff, 0x3, 0x2, 0x2, 0x901, 0x6, 0xfffffffb, 0x3ff, 0x0, 0x5, 0x5, 0x3, 0xff, 0x6, 0xa, 0x2, 0x80000000, 0x9, 0xf, 0x1, 0x100, 0x80000001, 0xfffffffa, 0x8, 0x71, 0x1, 0x7, 0x7, 0x1163, 0x2, 0x9, 0x1, 0x65e7, 0x400, 0x2, 0xe384, 0x200, 0x0, 0xffffffff, 0xe, 0x894, 0x5, 0x8, 0xffffffff, 0x80, 0x77a2d67e, 0x1, 0x80000000, 0x1, 0x8c, 0x3, 0x7, 0x8, 0xfffffffc, 0x5, 0x9, 0x2, 0x3fbd40, 0x1, 0x10001, 0x1, 0x7f, 0xe, 0x6, 0x3, 0x5, 0x406, 0xff, 0x7, 0x101, 0x6, 0xf, 0x8, 0x7, 0x9, 0x8000, 0x8000, 0x3, 0x1, 0x8, 0x9, 0x2, 0x400, 0x2, 0x3, 0xffffffff, 0xa1dc, 0x2, 0x6, 0xb25, 0x2, 0x6, 0x4, 0x6, 0x5, 0x3d91, 0xffffffff, 0x2dd, 0x7, 0x4, 0x0, 0x3ff, 0x1, 0x80, 0xff, 0x6, 0x3, 0x8000, 0x71, 0x6, 0x8, 0x5, 0x0, 0xa01250fd, 0x101, 0x3, 0x0, 0x8b16, 0x9, 0x543, 0x8, 0x2, 0x7, 0x2, 0x8, 0x1000, 0xfffffffc, 0x8, 0x40, 0x4, 0x5, 0xb93, 0x7, 0xb5e7, 0x0, 0xf547, 0xf, 0x2, 0xffffffc0, 0xab8, 0x2, 0x6, 0x6, 0x101, 0x49, 0x3, 0x7, 0xfb65, 0x9, 0x2, 0xfff, 0x1, 0x6, 0x3, 0xfffffff7, 0xf, 0x1, 0xffffff7c, 0x9, 0x7f, 0xe, 0x858, 0x7ff, 0x1, 0x6, 0x800000, 0x21f2, 0x4, 0x2, 0xb, 0x7, 0x6, 0xa, 0x10000, 0x8e, 0xcd, 0x85, 0x6, 0x5732, 0x93e]}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99", @ANYRES32], 0x0) sendmsg$kcm(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)="d80000001000810468f70082db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006000d00036010fab94dcf5c0461c1d67f6f94000534cf6ee08000a0e408e8dd095618e1f4dff3a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x20000004) close(0x3) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000300)={{0x2, 0x2000, @broadcast}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x31857717b80f31eb}}, 0x4c, {0x2, 0x4e22, @empty}, 'syz_tun\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000120000/0xd000)=nil, 0xd000) socket$pppl2tp(0x18, 0x1, 0x1) r11 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x4e20, 0xfffffffc, @mcast2, 0x3}, 0x1c) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) (fail_nth: 1) program crashed: WARNING in as102_dvb_dmx_start_feed single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) program did not crash testing program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(0xffffffffffffffff, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) (fail_nth: 1) program did not crash testing program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) (fail_nth: 1) program did not crash testing program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) program crashed: WARNING in as102_dvb_dmx_start_feed testing program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, 0x0, 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) program did not crash testing program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(0x0, 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) program did not crash testing program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m34.083351206s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: WARNING in as102_dvb_dmx_start_feed simplifying C reproducer testing compiled C program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: WARNING in as102_dvb_dmx_start_feed testing compiled C program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program did not crash testing compiled C program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: WARNING in as102_dvb_dmx_start_feed testing compiled C program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: WARNING in as102_dvb_dmx_start_feed testing compiled C program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: WARNING in as102_dvb_dmx_start_feed testing compiled C program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: WARNING in as102_dvb_dmx_start_feed testing compiled C program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: WARNING in as102_dvb_dmx_start_feed testing compiled C program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER program crashed: WARNING in as102_dvb_dmx_start_feed testing program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) program crashed: WARNING in as102_dvb_dmx_start_feed validation run: crashed=true testing program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) program crashed: WARNING in as102_dvb_dmx_start_feed validation run: crashed=true testing program (duration=1m34.083351206s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0x2, 0x0, 0x1, 0x7, 0x4}) program crashed: WARNING in as102_dvb_dmx_start_feed validation run: crashed=true reproducing took 53m17.930152882s repro crashed as (corrupted=false): ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: kernel/locking/mutex.c:625 at __mutex_lock_common kernel/locking/mutex.c:625 [inline], CPU#1: syz.4.28/6011 WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e2/0x1550 kernel/locking/mutex.c:821, CPU#1: syz.4.28/6011 Modules linked in: CPU: 1 UID: 0 PID: 6011 Comm: syz.4.28 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:625 [inline] RIP: 0010:__mutex_lock+0x12e9/0x1550 kernel/locking/mutex.c:821 Code: 5c 7a 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d ab db 93 04 00 75 13 48 8d 3d ae d7 96 04 48 c7 c6 c0 11 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f RSP: 0018:ffffc9000352f8c0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888027591f40 RDX: 0000000000000000 RSI: ffffffff8c0d11c0 RDI: ffffffff907d5890 RBP: ffffc9000352fa60 R08: ffffffff907a5c83 R09: 1ffffffff20f4b90 R10: dffffc0000000000 R11: fffffbfff20f4b91 R12: ffff8880787dab30 R13: 0000000000000000 R14: 1ffff920006a5f2c R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124dd2000(0063) knlGS:0000000056f84480 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002d063fff CR3: 0000000028fc4000 CR4: 00000000003526f0 Call Trace: as102_dvb_dmx_start_feed+0x70/0x290 drivers/media/usb/as102/as102_drv.c:139 dmx_ts_feed_start_filtering+0x129/0x220 drivers/media/dvb-core/dvb_demux.c:747 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:658 [inline] dvb_dmxdev_filter_start+0x434/0x10d0 drivers/media/dvb-core/dmxdev.c:769 dvb_demux_do_ioctl+0x48b/0x540 drivers/media/dvb-core/dmxdev.c:1099 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x5ea/0x950 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x27a/0x6a0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf707f0ec Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 RSP: 002b:00000000ff81d3cc EFLAGS: 00000206 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000040146f2c RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: 5c pop %rsp 1: 7a 90 jp 0xffffff93 3: 48 c1 e8 03 shr $0x3,%rax 7: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax b: 84 c0 test %al,%al d: 0f 85 47 02 00 00 jne 0x25a 13: 83 3d ab db 93 04 00 cmpl $0x0,0x493dbab(%rip) # 0x493dbc5 1a: 75 13 jne 0x2f 1c: 48 8d 3d ae d7 96 04 lea 0x496d7ae(%rip),%rdi # 0x496d7d1 23: 48 c7 c6 c0 11 0d 8c mov $0xffffffff8c0d11c0,%rsi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 90 nop 30: e9 6b ee ff ff jmp 0xffffeea0 35: 90 nop 36: 0f 0b ud2 38: 90 nop 39: e9 3e f2 ff ff jmp 0xfffff27c 3e: 90 nop 3f: 0f .byte 0xf final repro crashed as (corrupted=false): ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: kernel/locking/mutex.c:625 at __mutex_lock_common kernel/locking/mutex.c:625 [inline], CPU#1: syz.4.28/6011 WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e2/0x1550 kernel/locking/mutex.c:821, CPU#1: syz.4.28/6011 Modules linked in: CPU: 1 UID: 0 PID: 6011 Comm: syz.4.28 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:625 [inline] RIP: 0010:__mutex_lock+0x12e9/0x1550 kernel/locking/mutex.c:821 Code: 5c 7a 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d ab db 93 04 00 75 13 48 8d 3d ae d7 96 04 48 c7 c6 c0 11 0d 8c <67> 48 0f b9 3a 90 e9 6b ee ff ff 90 0f 0b 90 e9 3e f2 ff ff 90 0f RSP: 0018:ffffc9000352f8c0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff888027591f40 RDX: 0000000000000000 RSI: ffffffff8c0d11c0 RDI: ffffffff907d5890 RBP: ffffc9000352fa60 R08: ffffffff907a5c83 R09: 1ffffffff20f4b90 R10: dffffc0000000000 R11: fffffbfff20f4b91 R12: ffff8880787dab30 R13: 0000000000000000 R14: 1ffff920006a5f2c R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124dd2000(0063) knlGS:0000000056f84480 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002d063fff CR3: 0000000028fc4000 CR4: 00000000003526f0 Call Trace: as102_dvb_dmx_start_feed+0x70/0x290 drivers/media/usb/as102/as102_drv.c:139 dmx_ts_feed_start_filtering+0x129/0x220 drivers/media/dvb-core/dvb_demux.c:747 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:658 [inline] dvb_dmxdev_filter_start+0x434/0x10d0 drivers/media/dvb-core/dmxdev.c:769 dvb_demux_do_ioctl+0x48b/0x540 drivers/media/dvb-core/dmxdev.c:1099 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x5ea/0x950 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x27a/0x6a0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf707f0ec Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 RSP: 002b:00000000ff81d3cc EFLAGS: 00000206 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000040146f2c RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: 5c pop %rsp 1: 7a 90 jp 0xffffff93 3: 48 c1 e8 03 shr $0x3,%rax 7: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax b: 84 c0 test %al,%al d: 0f 85 47 02 00 00 jne 0x25a 13: 83 3d ab db 93 04 00 cmpl $0x0,0x493dbab(%rip) # 0x493dbc5 1a: 75 13 jne 0x2f 1c: 48 8d 3d ae d7 96 04 lea 0x496d7ae(%rip),%rdi # 0x496d7d1 23: 48 c7 c6 c0 11 0d 8c mov $0xffffffff8c0d11c0,%rsi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 90 nop 30: e9 6b ee ff ff jmp 0xffffeea0 35: 90 nop 36: 0f 0b ud2 38: 90 nop 39: e9 3e f2 ff ff jmp 0xfffff27c 3e: 90 nop 3f: 0f .byte 0xf