last executing test programs: 17.479520608s ago: executing program 2 (id=397): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) r1 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000004e40)={0xfb, 0x11, 0x0, 0x98, "4d512c91002a4950676142687108dcd3f82acf5a895bd90fca2bb40bb4fbf29c"}) syz_usb_disconnect(r0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000001480)={0x44, &(0x7f0000001180)=ANY=[@ANYBLOB="000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r2, &(0x7f0000000280)={0x14, &(0x7f0000000000)={0x40, 0x30, 0xbe, {0xbe, 0x21, "292cf8f0838b52227f78f49858a09b074335e327a9ee1194501b3be9f4af7032acbd5967b64261500cb04f36ff12a528d1f9ceb75c5bfcf7ca87cf8b9a668dbac0cbc8e6e9cd5a468f8597810c23a80a9af011f8efa543fdc28855474122f7583338fb334d148dea51130565040d5f5784b694a58faa3ca43da1d46dd57ba36795abbb91ae6c3032ad08c8a58983d460c1f0f9fc53ab00d164b1631ece8309734ff19d700f66b963a313bba327979c811602bc0cfc963d26dea4dfdf"}}, &(0x7f0000000140)={0x0, 0x3, 0xfb, @string={0xfb, 0x3, "5cca7d5f0ada998c216566bda7ec4a134a092543b4d5a02450d12ffe17324eac6305bf3db5407a754ae846b6b8877dde42de4690aed0c197623ced24ca1c9ec2f2309c599e1e0231f4e0b151faa3cfd8e73c8b8c8ccc9788b07811bcf6e3859f206829dfe3338935e306356c577391f182839fbd082611ff4f440ebcb904d3a4618467d8457589ff76f370d90eaf91e03d50fb5847c0dcfcb462bd0d73ce1e1f09915e677e6a21a7f5115a79cf7761a14413637cbd41f39c61091885bc5198d546ed8bb6c16dc31cf2281e3f345e0cecb5bbf55f4fccf7092ff04f435184d36ea51bce12340d583dab18d5f71ac33bb4c8e71e0151cb06be47"}}}, &(0x7f0000000580)={0x44, &(0x7f00000002c0)={0x20, 0x14, 0x69, "9835feee784bd81b8c4f11f1452713b4ed7bdcfae96dd185641322893178982d932c9e75a6d443106073f9bd944ea5ee84f3fa20ff98a2ed823bf705a9f9413281db91c507a7da91bc7a68201f661812858d5f63952f9578864200fb8cd28771d2fda705221b5bae26"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000440)={0x20, 0x81, 0x2, "fd72"}, &(0x7f0000000480)={0x20, 0x82, 0x2, "9e0b"}, &(0x7f00000004c0)={0x20, 0x83, 0x2, "e193"}, &(0x7f0000000500)={0x20, 0x84, 0x3, "f673b0"}, &(0x7f0000000540)={0x20, 0x85, 0x3, "3b1d19"}}) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000000000407d1e9c3100000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f00000008c0)={0x2c, &(0x7f0000000000)={0x0, 0x1, 0x81, {0x81, 0x23, "fb5a0e5992ed003622212c5103ff495c4ff0ddf14d8054d0d25459ddfe8d40f5d557f80110e2c19ddee51090e4b02caf29b3cb352bf3135fbe02ac532136f193a4ff143b07f9b03e69436e86d3c26564cfc2886e1641135f2d04c562256e3286cdf3b3df5207026f35324a86ed22ccd71307610e2a631617df1e81fc3c147e"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 14.404919582s ago: executing program 2 (id=403): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x62, 0x81, 0xf1, 0x20, 0x2304, 0x248, 0xf2a3, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x1, 0x30, 0x2, "", [{{0x9, 0x4, 0xd1, 0xc9, 0x0, 0xbe, 0x84, 0xaa, 0x6, [@uac_as]}}]}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000600)={0x14, 0x0, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x380a}}}, 0x0) syz_open_dev$evdev(&(0x7f0000000b80), 0xc4, 0x800) syz_usb_control_io$printer(r0, &(0x7f0000000d00)={0x14, 0x0, &(0x7f0000000cc0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1007}}}, 0x0) r1 = syz_usb_connect$uac2(0x3, 0xa8, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x96, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x1d, 0x7}, [@source_unit={0x8, 0x24, 0xa, 0x0, 0x1, 0xff, 0x23}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x1ccc, 0x5}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f0000000700)={0x2c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r1, 0x0, 0x0) syz_usb_control_io$uac2(r1, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r1, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000600)={0x0, 0x1b}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000001440)={0x1c, &(0x7f0000001300)={0x20, 0x13, 0x7, "82fda1181175f3"}, 0x0, 0x0}) syz_usb_disconnect(0xffffffffffffffff) ioctl$EVIOCSREP(0xffffffffffffffff, 0x40084503, 0x0) 13.64370893s ago: executing program 3 (id=404): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d000000000904"], 0x0) (async, rerun: 64) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) (async, rerun: 64) r2 = syz_usb_connect(0x3, 0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="05a1b5c6e420c2a2c9dd61fd3fd354506ee700ac1846ba7368d252ed13a12294f06e8296713dae058ddc09b49399af52502746f8d62f008abc216dfffa9eaeefd463ae0dff7340eec13e926800a86edbd9834cd65f10cc321d1068cb0f5fc87a53a2ef0038ce33c10501111bfc256372531028ae89cf8a20dfb25e8b82d4b4f0dae71150fcee96e650ec028dd9862156529f90309429af7be3e50ee6db63fe4c380bf2eac24766900c55e3ac49607856876a6b111a96b6f979480a5805a7af7f7be5a34b255190737e8b0fde3bb52eb7e4506e0d86c70328226c1a"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$hid(r2, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$printer(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r2, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io(r2, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$uac1(r2, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f0000000a80)={0x1c, &(0x7f0000000440)={0x0, 0xf, 0x1, "ed"}, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000001080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$hid(r3, &(0x7f0000001280)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000006aea220402001b7e34601020301090212"], 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xc38, &(0x7f0000000080)=ANY=[@ANYBLOB="545e9a", @ANYBLOB="4f0cff66dac50e65f4944faabbeb020c8e57572456bec593e0d2ecf32e6dddf38e8aff27f9a893cb516339027ad68134cc76951dd7b7ef951b95e92f41e5a68772e12edfe4c5eeb8cd72677beed3d4ff11"]) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000740)={0x60, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="40070d000000af3a5200c1f10f29a2bd23fbb10ae490f6ff1bea20573f7f246fd9899ba33b8ce2b49f3bae6af31af752a964cede01803648f899f5940b1f757d366a31959f8a75492d5a160c2f44bee61f1f08cddf4a49a4cd146209bcf6472edae3e59279c8d2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 13.527168243s ago: executing program 4 (id=405): syz_usb_connect(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e700008000040905", @ANYBLOB="371fd9"], 0x0) syz_usb_connect$uac1(0x5, 0xa6, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000106b1d01010000000003010902940003010040000904000000010100000a2401000000020102132406000006000000281ab0ab2c90619b34000000000000000000000924030000000000000924050000f8211cfd0924030500000004000724050401", @ANYBLOB="4c171a2c5e"], 0x0) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c3400000000006090224"], 0x0) syz_usb_connect$midi(0x6, 0xf5, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe3, 0x1, 0x1, 0x24, 0x20, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x8, 0x1, 0x3, 0x20, 0x2, [@midi_in_jack={0x6, 0x24, 0x2, 0x1, 0x6, 0xf7}, @midi_out_jack={0xb, 0x24, 0x3, 0x1, 0x8, 0x2, [{0x0, 0x2}, {0x5c, 0xb}], 0x1}, @midi_out_jack={0x11, 0x24, 0x3, 0x2, 0x0, 0x5, [{0x9, 0x2}, {0x57, 0x1}, {0x0, 0x6}, {0x7}, {0xf, 0x4}], 0x8}, @midi_in_jack={0x6, 0x24, 0x2, 0x3, 0xfc}, @midi_in_jack={0x6, 0x24, 0x2, 0x2, 0x2}, @midi_in_jack={0x6, 0x24, 0x2, 0x0, 0xb8, 0x8}], [{{0x9, 0x5, 0xe, 0x1, 0x20, 0x3, 0x8, 0x3, {0x9, 0x25, 0x1, 0x5, "a84b53c752"}}}, {{0x9, 0x5, 0xe, 0x10, 0x3ff, 0x0, 0xc, 0x3, {0x4}}}, {{0x9, 0x5, 0x1, 0x1, 0x400, 0x15, 0x5, 0x5, {0x4}}}, {{0x9, 0x5, 0x6, 0x1, 0x8, 0xc3, 0x4, 0x9, {0xd, 0x25, 0x1, 0x9, "79699a34ce671f3e80"}}}, {{0x9, 0x5, 0x6, 0x0, 0x8, 0x7, 0x37, 0x15, {0xc, 0x25, 0x1, 0x8, "f2690859f4d153a0"}}}, {{0x9, 0x5, 0xa, 0x4, 0x3ff, 0x5, 0x5, 0x0, {0x13, 0x25, 0x1, 0xf, "98d4385c7812f15163ebf1baac3e1d"}}}, {{0x9, 0x5, 0xd, 0x3, 0x3ff, 0xf0, 0x7, 0xff, {0xd, 0x25, 0x1, 0x9, "d8c889e2323cb20018"}}}, {{0x9, 0x5, 0x4, 0x0, 0x40, 0x1, 0xc, 0x6, {0xb, 0x25, 0x1, 0x7, "8a45857f5e5706"}}}]}}}}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x110, 0x3, 0x2, 0x5, 0xff, 0x4}, 0x5, &(0x7f0000000280)={0x5, 0xf, 0x5}, 0x2, [{0xca, &(0x7f00000002c0)=@string={0xca, 0x3, "84d837f1a6a3c8bb7feb27eff65aad1078b0b827e91d082e3388fcac091a56d4bf9599618f1e110057928d273686c3a97cee1546afc80bd40d9cc71ca2674dd5a4bfc7ee88087ea25ed88378e5f6ff4c476e3c967af23b29ea81439b580f5c1851ad4c631b7b59f0fa266674b7fe2dd931d10af49dbddb50468548237a2fd7e162319a75892b31b1b1e7b477a7da5f020ee72ad29d12f27b1ecd1024df04b6b05528ab918bb9213fb6825a6597db7eba3738a68515d728904fe777f86066169ad66265a97e9b1f18"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x40b}}]}) syz_usb_connect$uac1(0x2, 0x82, &(0x7f0000000700)=ANY=[@ANYBLOB="12015002000000101e0442304000010203010902700004000000010100800a240102000a0002010209040100000102000500040101010102000009240202050001000007240101a50210090501092000ca07780725010c02020009040200000102000009040201010102000009058209080008400907250100070500000000000000"], &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0}) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000400)=ANY=[@ANYRES16=r0, @ANYRES64=r0], 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000040)={0x44, &(0x7f0000000480)=ANY=[@ANYBLOB="401701000000696433bfb40df2761d8b55eb2e53e0de533d87d57ceb028b2b66b174feb696bbd59127f675de9a10a4f5fed02687e58648324bff076f8d5dafab5a7bfa9468fd9e0e98e5f9e8e2c7fc18710b6084c8aad2d1159a2eaf8db3e2427a03594e6e3dfee9248de500000000000039387be09fae28848134f08f498e44f9807bb369f9de805d697dc169f3ca8ab8f1a833"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000440)={0x1c, &(0x7f0000000380)={0x20, 0xe}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000640)={0x1c, &(0x7f0000000580)={0x40, 0x15}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) 13.446672055s ago: executing program 3 (id=406): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x3, 0x9f, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_connect(0x1, 0x0, 0x0, 0x0) syz_usb_connect(0x1, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x5, 0xbf, 0xdd, 0x8, 0xc2e, 0x700, 0xd4f4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x64, 0x6, 0x20, 0xb, "", [{{0x9, 0x4, 0xad, 0x8e, 0x1, 0xdf, 0x30, 0x5, 0x9e, [], [{{0x9, 0x5, 0x83, 0x3, 0x400, 0x4, 0x8d, 0x80}}]}}]}}]}}, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x8a700) ioctl$EVIOCGREP(r1, 0x5450, 0x0) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000180)=""/61) syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a70000000000090507"], 0x0) 12.804061641s ago: executing program 0 (id=408): syz_usb_connect(0x3, 0x24, &(0x7f0000001e80)={{0x12, 0x1, 0x110, 0x11, 0xb5, 0xe0, 0x10, 0xb05, 0x18f1, 0xb138, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x95, 0x10, 0x99, "", [{{0x9, 0x4, 0x94, 0x95, 0x0, 0xff, 0xff, 0xff, 0x45}}]}}]}}, 0x0) r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x56a, 0xd0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x9, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x81, 0x3, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x2, 0xc1, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000180)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="20016f0000006f21c26313852642792c3cbdeace918d0fb74237cc4b44b72fb0688881554400000000000000000023d716146fe6ccba293ea012090b211f6a3f31e2a1f5f23e128e06972d934ecbd755abbb071fb2747d788af010c4ef3c78782c5bf4aab466063ea28eac022f416860669792"], 0x0, 0x0, 0x0, 0x0}, 0x0) 12.190455966s ago: executing program 2 (id=409): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0xa9, 0x79, 0xb5, 0x20, 0xe41, 0x4159, 0xb8da, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xd1, 0x50, 0x60, "", [{{0x9, 0x4, 0x0, 0x1, 0x0, 0x25, 0x1c, 0xde, 0x2}}]}}]}}, 0x0) syz_usb_connect(0x0, 0x47, &(0x7f0000000080)=ANY=[@ANYRES64=r0], 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="e731876f9847bc3ff70a0101dacc0102030000000000000007fc00"], 0x0) syz_usb_disconnect(r0) r2 = syz_usb_connect$uac1(0x0, 0x81, &(0x7f0000000180)=ANY=[@ANYBLOB="12010102000000206307012040000102030109026f00030109403f0904000000010100000a2401d2000a000201020904010000010200000904010101010200000900000920007808ba07250100040300090402000001020000090402050101ff00000724010605021008240201fd0201040905820920"], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0}) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000400)=ANY=[@ANYRES16=r3, @ANYRES64=r3], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000002640)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="200e0200c76386f0fa4e3969ce4b34e5e7723cc98918841a2ebf26d4dd0ce2e8eca1a97e7011a6da8852d3054cd11c77b989490dc6fe0dd6e00d52a9185446ddbed962608aa111ee870a25fcf57e8b1b53d4ed0b0168d92500c8c643369526a671a14d3f3c9e445bdfb99356bdc8bcc46b975226fe165bcbcadbb1fd1e06db4a915cf3f750fb188c78a95c1df6aa97cdc5b4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000580)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f00000000c0)={0x44, &(0x7f0000000300)=ANY=[@ANYBLOB="000e02"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000f80)={0x2c, &(0x7f0000000d80)={0x0, 0x12, 0x5, "713c9009c2"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_disconnect(r2) r4 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xfc5, 0xb080, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0x50, 0x9, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x1, 0x4, {0x9, 0x21, 0x2, 0x77, 0x1, {0x22, 0xeb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x8, 0x64}}}}}]}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r5 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r1], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYRES32=r2, @ANYRES64, @ANYRES16=r0, @ANYRES8=r4, @ANYRES8=r0, @ANYRES32=r0, @ANYRESOCT=r5], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000e40)={0x84, &(0x7f0000000180)=ANY=[@ANYBLOB="001e1400000009"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000c0780a402a1101007f9e0102030109022400010000000009040000020a6bc50009f40522"], 0x0) syz_usb_disconnect(r6) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x18d1, 0x503c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0}}]}}, 0x0) r7 = syz_usb_connect$rtl8150(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_ep_write(r7, 0x83, 0x0, 0x0) syz_usb_disconnect(r7) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000440)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="20014000000020"], 0x0}) syz_usb_control_io(r4, 0x0, 0x0) 11.968036361s ago: executing program 4 (id=410): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d000905", @ANYRES16, @ANYRESHEX], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) ioctl$EVIOCGMASK(r1, 0x541b, 0x0) r2 = syz_usb_connect$uac3(0x3, 0xf6, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x499, 0x7000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe4, 0x3, 0x1, 0x9, 0x20, 0xc, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x1, 0x2e, 0x5000}, [@output_terminal={0x13, 0x24, 0x3, 0x3, 0x0, 0x1, 0x6, 0x0, 0x4, 0x8, 0x4, 0xa}, @extension_unit={0x11, 0x24, 0xa, 0x6, 0x1, [0x0, 0x3, 0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x2b0, 0x9, 0xff, 0xf8, {0xa, 0x25, 0x25, 0x2, 0x7, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x36, 0x4, 0x7f, 0x7}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0x8, 0x3, 0x2}, @as_header={0x17, 0x24, 0x1, 0x2, 0x0, 0x9, 0x2, 0x7, 0x5, 0x400, 0x8}, @format_type_i_descriptor={0x6}, @as_header={0x17, 0x24, 0x1, 0xc7, 0x99, 0x7, 0x3, 0x4, 0xc, 0x3}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x10, 0x3, 0x9, 0x81, 'mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 297.567187][ C0] #1: ffffffff896e2b40 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 [ 297.576819][ C0] #2: ffff888124e2a8b8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 [ 297.582530][ T5232] usb 1-1: USB disconnect, device number 121 [ 297.587607][ C0] #3: ffffffff896e2a80 (rcu_read_lock_sched){....}-{1:2}, at: page_table_check_clear+0x4b/0x8f0 [ 297.604279][ C0] #4: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 [ 297.610155][ T5236] m920x_read = error: -19 [ 297.616163][ C0] [ 297.616163][ C0] stack backtrace: [ 297.621246][ T5236] dvb-usb: error while querying for an remote control event. [ 297.626459][ C0] CPU: 0 UID: 0 PID: 6838 Comm: syz.1.431 Not tainted syzkaller #0 PREEMPT(lazy) [ 297.626494][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 297.626519][ C0] Call Trace: [ 297.626530][ C0] [ 297.626542][ C0] dump_stack_lvl+0x100/0x190 [ 297.626588][ C0] lockdep_rcu_suspicious.cold+0x4f/0xb1 [ 297.626622][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 297.626661][ C0] __might_resched+0x2e0/0x330 [ 297.626699][ C0] ? __pfx___might_resched+0x10/0x10 [ 297.626735][ C0] ? kfree_const+0x5f/0x70 [ 297.626767][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 297.626804][ C0] cancel_delayed_work_sync+0xb8/0xf0 [ 297.626851][ C0] mmc_free_host+0x19/0x30 [ 297.626886][ C0] vub300_inactivity_timer_expired+0x42f/0x550 [ 297.626924][ C0] call_timer_fn+0x19a/0x610 [ 297.626958][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 297.626998][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 297.627035][ C0] ? mark_held_locks+0x40/0x70 [ 297.627085][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 297.627121][ C0] __run_timers+0x757/0xb00 [ 297.627165][ C0] ? __pfx___run_timers+0x10/0x10 [ 297.627212][ C0] ? ktime_get+0x9f/0x320 [ 297.627245][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 297.627292][ C0] run_timer_base+0x114/0x190 [ 297.627328][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 297.627367][ C0] run_timer_softirq+0x1a/0x50 [ 297.627401][ C0] handle_softirqs+0x1dd/0x990 [ 297.627453][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 297.627499][ C0] ? _raw_spin_unlock+0x28/0x50 [ 297.627537][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 297.627570][ C0] __irq_exit_rcu+0x160/0x210 [ 297.627615][ C0] irq_exit_rcu+0x9/0x30 [ 297.627640][ C0] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 297.627686][ C0] [ 297.627696][ C0] [ 297.627707][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 297.627741][ C0] RIP: 0010:rcu_is_watching+0x5c/0xc0 [ 297.627770][ C0] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5c 48 03 1c ed e0 bb 27 89 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b [ 297.627799][ C0] RSP: 0018:ffffc900151bf428 EFLAGS: 00000a02 [ 297.627822][ C0] RAX: dffffc0000000000 RBX: ffff8881f5633868 RCX: ffffffff82215108 [ 297.627842][ C0] RDX: 1ffff1103eac670d RSI: ffffffff87b15400 RDI: ffffffff8927bbe0 [ 297.627862][ C0] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 297.627880][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 297.627897][ C0] R13: 0000000000000001 R14: ffff88810afca578 R15: 8000000132966007 [ 297.627926][ C0] ? page_table_check_clear+0x78/0x8f0 [ 297.627969][ C0] ? rcu_is_watching+0x12/0xc0 [ 297.627995][ C0] page_table_check_clear+0x523/0x8f0 [ 297.628038][ C0] __page_table_check_pte_clear+0xf1/0x100 [ 297.628081][ C0] ? __pfx___page_table_check_pte_clear+0x10/0x10 [ 297.628120][ C0] ? __tlb_remove_folio_pages_size.isra.0+0x153/0x550 [ 297.628167][ C0] __zap_vma_range+0x23c2/0x3fd0 [ 297.628232][ C0] ? __pfx___zap_vma_range+0x10/0x10 [ 297.628271][ C0] ? find_held_lock+0x2b/0x80 [ 297.628310][ C0] unmap_vmas+0x299/0x5f0 [ 297.628347][ C0] ? __pfx_unmap_vmas+0x10/0x10 [ 297.628381][ C0] ? mas_next_slot+0x10a3/0x1960 [ 297.628439][ C0] exit_mmap+0x1ef/0xa00 [ 297.628476][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 297.628509][ C0] ? rcu_is_watching+0x12/0xc0 [ 297.628542][ C0] ? uprobe_clear_state+0x49/0x260 [ 297.628574][ C0] ? find_held_lock+0x2b/0x80 [ 297.628602][ C0] ? uprobe_clear_state+0x5f/0x260 [ 297.628642][ C0] ? __mutex_unlock_slowpath+0x35d/0x930 [ 297.628704][ C0] ? arch_uprobe_clear_state+0x107/0x150 [ 297.628745][ C0] mmput+0xe0/0x430 [ 297.628789][ C0] do_exit+0x833/0x2a50 [ 297.628828][ C0] ? __pfx_do_exit+0x10/0x10 [ 297.628861][ C0] ? do_raw_spin_lock+0x128/0x260 [ 297.628904][ C0] ? find_held_lock+0x2b/0x80 [ 297.628932][ C0] ? get_signal+0x7e0/0x21e0 [ 297.628980][ C0] do_group_exit+0xd5/0x2a0 [ 297.629017][ C0] get_signal+0x1ec7/0x21e0 [ 297.629080][ C0] ? __pfx_get_signal+0x10/0x10 [ 297.629133][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 297.629171][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 297.629217][ C0] ? do_raw_spin_lock+0x128/0x260 [ 297.629268][ C0] exit_to_user_mode_loop+0xd2/0x530 [ 297.629308][ C0] ? rcu_is_watching+0x12/0xc0 [ 297.629338][ C0] ret_from_fork+0x6cd/0xc80 [ 297.629382][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 297.629426][ C0] ? __switch_to+0x7f6/0x10e0 [ 297.629456][ C0] ? __switch_to_asm+0x39/0x70 [ 297.629488][ C0] ret_from_fork_asm+0x1a/0x30 [ 297.629532][ C0] [ 297.629560][ C0] BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 [ 297.752151][ T5462] m920x_read = error: -19 [ 297.752913][ C0] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6838, name: syz.1.431 [ 297.770229][ T5462] dvb-usb: error while querying for an remote control event. [ 297.772252][ C0] preempt_count: 103, expected: 0 [ 297.772273][ C0] RCU nest depth: 1, expected: 0 [ 297.900150][ T5244] m920x_read = error: -19 [ 297.902070][ C0] 5 locks held by syz.1.431/6838: [ 297.902098][ C0] #0: [ 297.907066][ T5244] dvb-usb: error while querying for an remote control event. [ 297.912576][ C0] ffff88813bf82938 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 298.000199][ T5236] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 298.001816][ C0] #1: ffffffff896e2b40 (rcu_read_lock){....}-{1:3} [ 298.030139][ T5244] m920x_read = error: -19 [ 298.033613][ C0] , at: __pte_offset_map+0x2f/0x300 [ 298.038154][ T5244] dvb-usb: error while querying for an remote control event. [ 298.042961][ C0] #2: ffff888124e2a8b8 (ptlock_ptr(ptdesc)#2 [ 298.130166][ T5462] usb 3-1: new full-speed USB device number 118 using dummy_hcd [ 298.131910][ C0] ){+.+.}-{3:3} [ 298.160138][ T5244] m920x_read = error: -19 [ 298.165362][ C0] , at: pte_offset_map_lock+0x10f/0x320 [ 298.173091][ T5236] usb 4-1: Using ep0 maxpacket: 32 [ 298.179635][ C0] #3: ffffffff896e2a80 (rcu_read_lock_sched){....}-{1:2}, at: page_table_check_clear+0x4b/0x8f0 [ 298.179733][ C0] #4: [ 298.184934][ T5244] dvb-usb: error while querying for an remote control event. [ 298.189296][ C0] ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0} [ 298.198890][ T5236] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 298.202944][ C0] , at: call_timer_fn+0x11f/0x610 [ 298.202987][ C0] Preemption disabled at: [ 298.202995][ C0] [<0000000000000000>] 0x0 [ 298.212188][ T5236] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 298.214323][ C0] CPU: 0 UID: 0 PID: 6838 Comm: syz.1.431 Not tainted syzkaller #0 PREEMPT(lazy) [ 298.214360][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 298.214377][ C0] Call Trace: [ 298.214388][ C0] [ 298.214399][ C0] dump_stack_lvl+0x100/0x190 [ 298.214445][ C0] __might_resched.cold+0x1ec/0x232 [ 298.214490][ C0] ? __pfx___might_resched+0x10/0x10 [ 298.214528][ C0] ? kfree_const+0x5f/0x70 [ 298.214573][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.214611][ C0] cancel_delayed_work_sync+0xb8/0xf0 [ 298.214659][ C0] mmc_free_host+0x19/0x30 [ 298.214694][ C0] vub300_inactivity_timer_expired+0x42f/0x550 [ 298.214731][ C0] call_timer_fn+0x19a/0x610 [ 298.214766][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 298.214806][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.214842][ C0] ? mark_held_locks+0x40/0x70 [ 298.214886][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.214922][ C0] __run_timers+0x757/0xb00 [ 298.214970][ C0] ? __pfx___run_timers+0x10/0x10 [ 298.215017][ C0] ? ktime_get+0x9f/0x320 [ 298.215051][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 298.215097][ C0] run_timer_base+0x114/0x190 [ 298.215132][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 298.215171][ C0] run_timer_softirq+0x1a/0x50 [ 298.215205][ C0] handle_softirqs+0x1dd/0x990 [ 298.215256][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 298.215302][ C0] ? _raw_spin_unlock+0x28/0x50 [ 298.215340][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 298.215373][ C0] __irq_exit_rcu+0x160/0x210 [ 298.215418][ C0] irq_exit_rcu+0x9/0x30 [ 298.215444][ C0] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 298.215491][ C0] [ 298.215500][ C0] [ 298.215512][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 298.215605][ C0] RIP: 0010:rcu_is_watching+0x5c/0xc0 [ 298.215635][ C0] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5c 48 03 1c ed e0 bb 27 89 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b [ 298.215664][ C0] RSP: 0018:ffffc900151bf428 EFLAGS: 00000a02 [ 298.215686][ C0] RAX: dffffc0000000000 RBX: ffff8881f5633868 RCX: ffffffff82215108 [ 298.215707][ C0] RDX: 1ffff1103eac670d RSI: ffffffff87b15400 RDI: ffffffff8927bbe0 [ 298.215728][ C0] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 298.215746][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 298.215763][ C0] R13: 0000000000000001 R14: ffff88810afca578 R15: 8000000132966007 [ 298.215791][ C0] ? page_table_check_clear+0x78/0x8f0 [ 298.215835][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.215863][ C0] page_table_check_clear+0x523/0x8f0 [ 298.215904][ C0] __page_table_check_pte_clear+0xf1/0x100 [ 298.215941][ C0] ? __pfx___page_table_check_pte_clear+0x10/0x10 [ 298.215978][ C0] ? __tlb_remove_folio_pages_size.isra.0+0x153/0x550 [ 298.216025][ C0] __zap_vma_range+0x23c2/0x3fd0 [ 298.216087][ C0] ? __pfx___zap_vma_range+0x10/0x10 [ 298.216126][ C0] ? find_held_lock+0x2b/0x80 [ 298.216165][ C0] unmap_vmas+0x299/0x5f0 [ 298.216202][ C0] ? __pfx_unmap_vmas+0x10/0x10 [ 298.216236][ C0] ? mas_next_slot+0x10a3/0x1960 [ 298.216295][ C0] exit_mmap+0x1ef/0xa00 [ 298.216332][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 298.216364][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.216394][ C0] ? uprobe_clear_state+0x49/0x260 [ 298.216425][ C0] ? find_held_lock+0x2b/0x80 [ 298.216453][ C0] ? uprobe_clear_state+0x5f/0x260 [ 298.216493][ C0] ? __mutex_unlock_slowpath+0x35d/0x930 [ 298.216563][ C0] ? arch_uprobe_clear_state+0x107/0x150 [ 298.216604][ C0] mmput+0xe0/0x430 [ 298.216649][ C0] do_exit+0x833/0x2a50 [ 298.216688][ C0] ? __pfx_do_exit+0x10/0x10 [ 298.216721][ C0] ? do_raw_spin_lock+0x128/0x260 [ 298.216764][ C0] ? find_held_lock+0x2b/0x80 [ 298.216793][ C0] ? get_signal+0x7e0/0x21e0 [ 298.216839][ C0] do_group_exit+0xd5/0x2a0 [ 298.216878][ C0] get_signal+0x1ec7/0x21e0 [ 298.216935][ C0] ? __pfx_get_signal+0x10/0x10 [ 298.216989][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 298.217027][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 298.217073][ C0] ? do_raw_spin_lock+0x128/0x260 [ 298.217124][ C0] exit_to_user_mode_loop+0xd2/0x530 [ 298.217164][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.217195][ C0] ret_from_fork+0x6cd/0xc80 [ 298.217240][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 298.217284][ C0] ? __switch_to+0x7f6/0x10e0 [ 298.217314][ C0] ? __switch_to_asm+0x39/0x70 [ 298.217346][ C0] ret_from_fork_asm+0x1a/0x30 [ 298.217389][ C0] [ 298.217620][ C0] [ 298.218694][ T5236] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 298.224310][ C0] ============================= [ 298.224327][ C0] WARNING: suspicious RCU usage [ 298.224342][ C0] syzkaller #0 Tainted: G W [ 298.224361][ C0] ----------------------------- [ 298.224372][ C0] kernel/rcu/srcutree.c:1483 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! [ 298.241246][ T5236] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 298.243288][ C0] [ 298.243288][ C0] other info that might help us debug this: [ 298.243288][ C0] [ 298.243302][ C0] [ 298.243302][ C0] rcu_scheduler_active = 2, debug_locks = 1 [ 298.243324][ C0] 5 locks held by syz.1.431/6838: [ 298.251826][ T5236] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 298.259485][ C0] #0: ffff88813bf82938 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 298.268537][ T5236] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 298.273099][ C0] #1: ffffffff896e2b40 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 [ 298.278604][ T5236] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 298.282186][ C0] #2: ffff888124e2a8b8 (ptlock_ptr(ptdesc) [ 298.291991][ T5236] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.300100][ C0] #2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 [ 298.300177][ C0] #3: ffffffff896e2a80 [ 298.311141][ T5244] m920x_read = error: -19 [ 298.313772][ C0] (rcu_read_lock_sched){....}-{1:2}, at: page_table_check_clear+0x4b/0x8f0 [ 298.317458][ T5462] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 298.321573][ C0] #4: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 [ 298.327422][ T5244] dvb-usb: error while querying for an remote control event. [ 298.332262][ C0] [ 298.332262][ C0] stack backtrace: [ 298.332284][ C0] CPU: 0 UID: 0 PID: 6838 Comm: syz.1.431 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 298.332324][ C0] Tainted: [W]=WARN [ 298.332334][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 298.332352][ C0] Call Trace: [ 298.332363][ C0] [ 298.332374][ C0] dump_stack_lvl+0x100/0x190 [ 298.332419][ C0] lockdep_rcu_suspicious.cold+0x4f/0xb1 [ 298.332456][ C0] __synchronize_srcu+0x29d/0x300 [ 298.332500][ C0] ? __pfx___synchronize_srcu+0x10/0x10 [ 298.332560][ C0] ? ktime_get_mono_fast_ns+0x1c3/0x3f0 [ 298.332601][ C0] ? synchronize_srcu+0xa8/0x380 [ 298.332645][ C0] wakeup_source_unregister.part.0+0x12c/0x540 [ 298.332685][ C0] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 298.332724][ C0] wakeup_source_unregister+0x1f/0x30 [ 298.332760][ C0] mmc_host_classdev_release+0x42/0x120 [ 298.332797][ C0] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 298.332834][ C0] device_release+0xd2/0x270 [ 298.332880][ C0] kobject_put+0x1f7/0x640 [ 298.332923][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.332961][ C0] put_device+0x1f/0x30 [ 298.333005][ C0] vub300_inactivity_timer_expired+0x42f/0x550 [ 298.333042][ C0] call_timer_fn+0x19a/0x610 [ 298.333077][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 298.333117][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.333154][ C0] ? mark_held_locks+0x40/0x70 [ 298.333197][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.333232][ C0] __run_timers+0x757/0xb00 [ 298.333277][ C0] ? __pfx___run_timers+0x10/0x10 [ 298.333324][ C0] ? ktime_get+0x9f/0x320 [ 298.333358][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 298.333409][ C0] run_timer_base+0x114/0x190 [ 298.333444][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 298.333483][ C0] run_timer_softirq+0x1a/0x50 [ 298.333518][ C0] handle_softirqs+0x1dd/0x990 [ 298.333574][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 298.333621][ C0] ? _raw_spin_unlock+0x28/0x50 [ 298.333663][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 298.333696][ C0] __irq_exit_rcu+0x160/0x210 [ 298.333741][ C0] irq_exit_rcu+0x9/0x30 [ 298.333766][ C0] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 298.333813][ C0] [ 298.333823][ C0] [ 298.333834][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 298.333867][ C0] RIP: 0010:rcu_is_watching+0x5c/0xc0 [ 298.333897][ C0] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5c 48 03 1c ed e0 bb 27 89 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b [ 298.333925][ C0] RSP: 0018:ffffc900151bf428 EFLAGS: 00000a02 [ 298.333948][ C0] RAX: dffffc0000000000 RBX: ffff8881f5633868 RCX: ffffffff82215108 [ 298.333969][ C0] RDX: 1ffff1103eac670d RSI: ffffffff87b15400 RDI: ffffffff8927bbe0 [ 298.333990][ C0] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 298.334007][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 298.334024][ C0] R13: 0000000000000001 R14: ffff88810afca578 R15: 8000000132966007 [ 298.334052][ C0] ? page_table_check_clear+0x78/0x8f0 [ 298.334095][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.334122][ C0] page_table_check_clear+0x523/0x8f0 [ 298.334163][ C0] __page_table_check_pte_clear+0xf1/0x100 [ 298.334201][ C0] ? __pfx___page_table_check_pte_clear+0x10/0x10 [ 298.334239][ C0] ? __tlb_remove_folio_pages_size.isra.0+0x153/0x550 [ 298.334286][ C0] __zap_vma_range+0x23c2/0x3fd0 [ 298.334349][ C0] ? __pfx___zap_vma_range+0x10/0x10 [ 298.334389][ C0] ? find_held_lock+0x2b/0x80 [ 298.334427][ C0] unmap_vmas+0x299/0x5f0 [ 298.334463][ C0] ? __pfx_unmap_vmas+0x10/0x10 [ 298.334498][ C0] ? mas_next_slot+0x10a3/0x1960 [ 298.334561][ C0] exit_mmap+0x1ef/0xa00 [ 298.334599][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 298.334630][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.334664][ C0] ? uprobe_clear_state+0x49/0x260 [ 298.334695][ C0] ? find_held_lock+0x2b/0x80 [ 298.334723][ C0] ? uprobe_clear_state+0x5f/0x260 [ 298.334763][ C0] ? __mutex_unlock_slowpath+0x35d/0x930 [ 298.334826][ C0] ? arch_uprobe_clear_state+0x107/0x150 [ 298.334866][ C0] mmput+0xe0/0x430 [ 298.334911][ C0] do_exit+0x833/0x2a50 [ 298.334949][ C0] ? __pfx_do_exit+0x10/0x10 [ 298.334982][ C0] ? do_raw_spin_lock+0x128/0x260 [ 298.335025][ C0] ? find_held_lock+0x2b/0x80 [ 298.335053][ C0] ? get_signal+0x7e0/0x21e0 [ 298.335100][ C0] do_group_exit+0xd5/0x2a0 [ 298.335138][ C0] get_signal+0x1ec7/0x21e0 [ 298.335196][ C0] ? __pfx_get_signal+0x10/0x10 [ 298.335250][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 298.335288][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 298.335334][ C0] ? do_raw_spin_lock+0x128/0x260 [ 298.335385][ C0] exit_to_user_mode_loop+0xd2/0x530 [ 298.335426][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.335456][ C0] ret_from_fork+0x6cd/0xc80 [ 298.335499][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 298.335550][ C0] ? __switch_to+0x7f6/0x10e0 [ 298.335580][ C0] ? __switch_to_asm+0x39/0x70 [ 298.335612][ C0] ret_from_fork_asm+0x1a/0x30 [ 298.335655][ C0] [ 298.335703][ C0] ODEBUG: object ffffc90000007a70 is NOT on stack ffffc900151b8000, but annotated. [ 298.336695][ C0] [ 298.336703][ C0] ====================================================== [ 298.336713][ C0] WARNING: possible circular locking dependency detected [ 298.336726][ C0] syzkaller #0 Tainted: G W [ 298.336740][ C0] ------------------------------------------------------ [ 298.336748][ C0] syz.1.431/6838 is trying to acquire lock: [ 298.336755][ T5462] usb 3-1: config 0 has no interface number 0 [ 298.336764][ C0] ffffffff895eeac0 (console_owner){-.-.}-{0:0}, at: vprintk_emit+0x4c0/0x6b0 [ 298.336804][ T5462] usb 3-1: config 0 interface 41 has no altsetting 0 [ 298.336827][ C0] [ 298.336827][ C0] but task is already holding lock: [ 298.336835][ C0] ffffffff941bee30 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_object_init+0xec/0x3d0 [ 298.336901][ C0] [ 298.336901][ C0] which lock already depends on the new lock. [ 298.336901][ C0] [ 298.336910][ C0] [ 298.336910][ C0] the existing dependency chain (in reverse order) is: [ 298.336918][ C0] [ 298.336918][ C0] -> #3 (&obj_hash[i].lock){-.-.}-{2:2}: [ 298.336961][ C0] lock_acquire+0x1b9/0x370 [ 298.336992][ C0] _raw_spin_lock_irqsave+0x3a/0x60 [ 298.337027][ C0] debug_object_assert_init+0x142/0x310 [ 298.337063][ C0] hrtimer_start_range_ns+0x4e/0x240 [ 298.337108][ C0] rpm_suspend+0x788/0x11a0 [ 298.337142][ C0] rpm_idle+0x60c/0x790 [ 298.337173][ C0] rpm_resume+0x3b9/0x1320 [ 298.337204][ C0] pm_runtime_work+0x10c/0x150 [ 298.337241][ C0] process_one_work+0xa23/0x1940 [ 298.337277][ C0] worker_thread+0x5ef/0xe50 [ 298.337312][ C0] kthread+0x370/0x450 [ 298.337342][ C0] ret_from_fork+0x69a/0xc80 [ 298.337382][ C0] ret_from_fork_asm+0x1a/0x30 [ 298.337408][ C0] [ 298.337408][ C0] -> #2 (&dev->power.lock){-.-.}-{3:3}: [ 298.337443][ C0] lock_acquire+0x1b9/0x370 [ 298.337478][ C0] _raw_spin_lock_irqsave+0x3a/0x60 [ 298.337517][ C0] __pm_runtime_resume+0xa9/0x170 [ 298.337559][ C0] __uart_start+0x1b0/0x510 [ 298.337591][ C0] uart_write+0x211/0xb20 [ 298.337625][ C0] n_tty_write+0x431/0x1160 [ 298.337665][ C0] file_tty_write.isra.0+0x4d2/0x890 [ 298.337700][ C0] redirected_tty_write+0xd4/0x120 [ 298.337733][ C0] vfs_write+0x6ac/0x1050 [ 298.337772][ C0] ksys_write+0x12a/0x250 [ 298.337810][ C0] do_syscall_64+0x10b/0x7f0 [ 298.337838][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.337863][ C0] [ 298.337863][ C0] -> #1 (&port_lock_key){-.-.}-{3:3}: [ 298.337896][ C0] lock_acquire+0x1b9/0x370 [ 298.337927][ C0] _raw_spin_lock_irqsave+0x3a/0x60 [ 298.337960][ C0] serial8250_console_write+0x177/0x1a50 [ 298.337984][ C0] console_flush_one_record+0x790/0xe50 [ 298.338025][ C0] console_unlock+0x103/0x260 [ 298.338063][ C0] vprintk_emit+0x407/0x6b0 [ 298.338086][ C0] _printk+0xcf/0x110 [ 298.338112][ C0] register_console.cold+0xc0/0x248 [ 298.338141][ C0] univ8250_console_init+0x6f/0x80 [ 298.338171][ C0] console_init+0x3d5/0x5b0 [ 298.338206][ C0] start_kernel+0x30f/0x490 [ 298.338241][ C0] x86_64_start_reservations+0x24/0x30 [ 298.338271][ C0] x86_64_start_kernel+0x12b/0x130 [ 298.338304][ C0] common_startup_64+0x13e/0x158 [ 298.338331][ C0] [ 298.338331][ C0] -> #0 (console_owner){-.-.}-{0:0}: [ 298.338367][ C0] check_prev_add+0xeb/0xe60 [ 298.338397][ C0] __lock_acquire+0x136c/0x1a40 [ 298.338437][ C0] lock_acquire+0x1b9/0x370 [ 298.338471][ C0] vprintk_emit+0x4d1/0x6b0 [ 298.338497][ C0] _printk+0xcf/0x110 [ 298.338533][ C0] lookup_object_or_alloc.part.0.cold+0x18/0x40 [ 298.338576][ C0] __debug_object_init+0x2a9/0x3d0 [ 298.338613][ C0] __synchronize_srcu+0x1c3/0x300 [ 298.338651][ C0] wakeup_source_unregister.part.0+0x12c/0x540 [ 298.338684][ C0] wakeup_source_unregister+0x1f/0x30 [ 298.338716][ C0] mmc_host_classdev_release+0x42/0x120 [ 298.338748][ C0] device_release+0xd2/0x270 [ 298.338788][ C0] kobject_put+0x1f7/0x640 [ 298.338823][ C0] put_device+0x1f/0x30 [ 298.338861][ C0] vub300_inactivity_timer_expired+0x42f/0x550 [ 298.338894][ C0] call_timer_fn+0x19a/0x610 [ 298.338922][ C0] __run_timers+0x757/0xb00 [ 298.338952][ C0] run_timer_base+0x114/0x190 [ 298.338982][ C0] run_timer_softirq+0x1a/0x50 [ 298.339012][ C0] handle_softirqs+0x1dd/0x990 [ 298.339051][ C0] __irq_exit_rcu+0x160/0x210 [ 298.339093][ C0] irq_exit_rcu+0x9/0x30 [ 298.339118][ T5236] usb 4-1: config 0 descriptor?? [ 298.339115][ C0] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 298.339158][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 298.339188][ C0] rcu_is_watching+0x5c/0xc0 [ 298.339213][ C0] page_table_check_clear+0x523/0x8f0 [ 298.339247][ C0] __page_table_check_pte_clear+0xf1/0x100 [ 298.339278][ C0] __zap_vma_range+0x23c2/0x3fd0 [ 298.339304][ C0] unmap_vmas+0x299/0x5f0 [ 298.339326][ C0] exit_mmap+0x1ef/0xa00 [ 298.339355][ C0] mmput+0xe0/0x430 [ 298.339392][ C0] do_exit+0x833/0x2a50 [ 298.339422][ C0] do_group_exit+0xd5/0x2a0 [ 298.339452][ C0] get_signal+0x1ec7/0x21e0 [ 298.339492][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 298.339530][ C0] exit_to_user_mode_loop+0xd2/0x530 [ 298.339567][ C0] ret_from_fork+0x6cd/0xc80 [ 298.339604][ C0] ret_from_fork_asm+0x1a/0x30 [ 298.339629][ C0] [ 298.339629][ C0] other info that might help us debug this: [ 298.339629][ C0] [ 298.339639][ C0] Chain exists of: [ 298.339639][ C0] console_owner --> &dev->power.lock --> &obj_hash[i].lock [ 298.339639][ C0] [ 298.339681][ C0] Possible unsafe locking scenario: [ 298.339681][ C0] [ 298.339689][ C0] CPU0 CPU1 [ 298.339697][ C0] ---- ---- [ 298.339705][ C0] lock(&obj_hash[i].lock); [ 298.339722][ C0] lock(&dev->power.lock); [ 298.339740][ C0] lock(&obj_hash[i].lock); [ 298.339756][ C0] lock(console_owner); [ 298.339773][ C0] [ 298.339773][ C0] *** DEADLOCK *** [ 298.339773][ C0] [ 298.339780][ C0] 6 locks held by syz.1.431/6838: [ 298.339796][ C0] #0: ffff88813bf82938 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 298.339863][ C0] #1: ffffffff896e2b40 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 [ 298.339943][ C0] #2: ffff888124e2a8b8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 [ 298.340028][ C0] #3: ffffffff896e2a80 (rcu_read_lock_sched){....}-{1:2}, at: page_table_check_clear+0x4b/0x8f0 [ 298.340090][ C0] #4: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 [ 298.340152][ C0] #5: ffffffff941bee30 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_object_init+0xec/0x3d0 [ 298.340217][ C0] [ 298.340217][ C0] stack backtrace: [ 298.340233][ C0] CPU: 0 UID: 0 PID: 6838 Comm: syz.1.431 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 298.340275][ C0] Tainted: [W]=WARN [ 298.340285][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 298.340304][ C0] Call Trace: [ 298.340299][ T5462] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 298.340313][ C0] [ 298.340325][ C0] dump_stack_lvl+0x100/0x190 [ 298.340334][ T5462] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.340362][ T5462] usb 3-1: Product: syz [ 298.340365][ C0] print_circular_bug.cold+0x178/0x1c7 [ 298.340384][ T5462] usb 3-1: Manufacturer: syz [ 298.340406][ T5462] usb 3-1: SerialNumber: syz [ 298.340400][ C0] check_noncircular+0x146/0x160 [ 298.340439][ C0] check_prev_add+0xeb/0xe60 [ 298.340474][ C0] __lock_acquire+0x136c/0x1a40 [ 298.340518][ C0] lock_acquire+0x1b9/0x370 [ 298.340562][ C0] ? vprintk_emit+0x4c0/0x6b0 [ 298.340592][ C0] ? vprintk_emit+0x4ae/0x6b0 [ 298.340622][ C0] vprintk_emit+0x4d1/0x6b0 [ 298.340650][ C0] ? vprintk_emit+0x4c0/0x6b0 [ 298.340678][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 298.340711][ C0] _printk+0xcf/0x110 [ 298.340744][ C0] ? __pfx__printk+0x10/0x10 [ 298.340775][ C0] ? lock_acquire+0x1b9/0x370 [ 298.340814][ C0] ? find_held_lock+0x2b/0x80 [ 298.340843][ C0] ? lookup_object_or_alloc.part.0+0xbd/0x4f0 [ 298.340885][ C0] ? lookup_object_or_alloc.part.0+0xbd/0x4f0 [ 298.340932][ C0] lookup_object_or_alloc.part.0.cold+0x18/0x40 [ 298.340976][ C0] __debug_object_init+0x2a9/0x3d0 [ 298.341016][ C0] ? __pfx___debug_object_init+0x10/0x10 [ 298.341057][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 298.341098][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 298.341137][ C0] ? __init_swait_queue_head+0xca/0x150 [ 298.341168][ C0] __synchronize_srcu+0x1c3/0x300 [ 298.341206][ C0] ? __pfx___synchronize_srcu+0x10/0x10 [ 298.341247][ C0] ? ktime_get_mono_fast_ns+0x1c3/0x3f0 [ 298.341279][ C0] ? synchronize_srcu+0xa8/0x380 [ 298.341317][ C0] wakeup_source_unregister.part.0+0x12c/0x540 [ 298.341354][ C0] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 298.341387][ C0] wakeup_source_unregister+0x1f/0x30 [ 298.341421][ C0] mmc_host_classdev_release+0x42/0x120 [ 298.341458][ C0] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 298.341495][ C0] device_release+0xd2/0x270 [ 298.341546][ C0] kobject_put+0x1f7/0x640 [ 298.341585][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.341621][ C0] put_device+0x1f/0x30 [ 298.341660][ C0] vub300_inactivity_timer_expired+0x42f/0x550 [ 298.341695][ C0] call_timer_fn+0x19a/0x610 [ 298.341726][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 298.341758][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.341793][ C0] ? mark_held_locks+0x40/0x70 [ 298.341828][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.341861][ C0] __run_timers+0x757/0xb00 [ 298.341896][ C0] ? __pfx___run_timers+0x10/0x10 [ 298.341933][ C0] ? ktime_get+0x9f/0x320 [ 298.341965][ T5462] usb 3-1: config 0 descriptor?? [ 298.341965][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 298.342006][ C0] run_timer_base+0x114/0x190 [ 298.342038][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 298.342073][ C0] run_timer_softirq+0x1a/0x50 [ 298.342106][ C0] handle_softirqs+0x1dd/0x990 [ 298.342148][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 298.342187][ C0] ? _raw_spin_unlock+0x28/0x50 [ 298.342223][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 298.342252][ C0] __irq_exit_rcu+0x160/0x210 [ 298.342291][ C0] irq_exit_rcu+0x9/0x30 [ 298.342315][ C0] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 298.342361][ C0] [ 298.342370][ C0] [ 298.342381][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 298.342412][ C0] RIP: 0010:rcu_is_watching+0x5c/0xc0 [ 298.342441][ C0] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5c 48 03 1c ed e0 bb 27 89 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b [ 298.342470][ C0] RSP: 0018:ffffc900151bf428 EFLAGS: 00000a02 [ 298.342493][ C0] RAX: dffffc0000000000 RBX: ffff8881f5633868 RCX: ffffffff82215108 [ 298.342514][ C0] RDX: 1ffff1103eac670d RSI: ffffffff87b15400 RDI: ffffffff8927bbe0 [ 298.342543][ C0] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 298.342562][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 298.342581][ C0] R13: 0000000000000001 R14: ffff88810afca578 R15: 8000000132966007 [ 298.342606][ C0] ? page_table_check_clear+0x78/0x8f0 [ 298.342643][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.342669][ C0] page_table_check_clear+0x523/0x8f0 [ 298.342704][ C0] __page_table_check_pte_clear+0xf1/0x100 [ 298.342738][ C0] ? __pfx___page_table_check_pte_clear+0x10/0x10 [ 298.342773][ C0] ? __tlb_remove_folio_pages_size.isra.0+0x153/0x550 [ 298.342813][ C0] __zap_vma_range+0x23c2/0x3fd0 [ 298.342857][ C0] ? __pfx___zap_vma_range+0x10/0x10 [ 298.342890][ C0] ? find_held_lock+0x2b/0x80 [ 298.342922][ C0] unmap_vmas+0x299/0x5f0 [ 298.342953][ C0] ? __pfx_unmap_vmas+0x10/0x10 [ 298.342985][ C0] ? mas_next_slot+0x10a3/0x1960 [ 298.343030][ C0] exit_mmap+0x1ef/0xa00 [ 298.343064][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 298.343098][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.343127][ C0] ? uprobe_clear_state+0x49/0x260 [ 298.343159][ C0] ? find_held_lock+0x2b/0x80 [ 298.343187][ C0] ? uprobe_clear_state+0x5f/0x260 [ 298.343222][ C0] ? __mutex_unlock_slowpath+0x35d/0x930 [ 298.343276][ C0] ? arch_uprobe_clear_state+0x107/0x150 [ 298.343312][ C0] mmput+0xe0/0x430 [ 298.343354][ C0] do_exit+0x833/0x2a50 [ 298.343395][ C0] ? __pfx_do_exit+0x10/0x10 [ 298.343425][ C0] ? do_raw_spin_lock+0x128/0x260 [ 298.343466][ C0] ? find_held_lock+0x2b/0x80 [ 298.343494][ C0] ? get_signal+0x7e0/0x21e0 [ 298.343546][ C0] do_group_exit+0xd5/0x2a0 [ 298.343581][ C0] get_signal+0x1ec7/0x21e0 [ 298.343630][ C0] ? __pfx_get_signal+0x10/0x10 [ 298.343676][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 298.343719][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 298.343754][ C0] ? do_raw_spin_lock+0x128/0x260 [ 298.343798][ C0] exit_to_user_mode_loop+0xd2/0x530 [ 298.343833][ C0] ? rcu_is_watching+0x12/0xc0 [ 298.343858][ C0] ret_from_fork+0x6cd/0xc80 [ 298.343899][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 298.343939][ C0] ? __switch_to+0x7f6/0x10e0 [ 298.343970][ C0] ? __switch_to_asm+0x39/0x70 [ 298.343998][ C0] ret_from_fork_asm+0x1a/0x30 [ 298.344026][ C0] [ 298.480197][ T5244] m920x_read = error: -19 [ 298.483022][ C0] ------------[ cut here ]------------ [ 298.502764][ T5244] dvb-usb: error while querying for an remote control event. [ 298.508559][ C0] 1 [ 298.508579][ C0] WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc.part.0.cold+0x19/0x40, CPU#0: syz.1.431/6838 [ 298.543438][ T6841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.548589][ C0] Modules linked in: [ 298.548616][ C0] CPU: 0 UID: 0 PID: 6838 Comm: syz.1.431 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 298.548657][ C0] Tainted: [W]=WARN [ 298.548666][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 298.548685][ C0] RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 [ 298.560812][ T6841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 298.564252][ C0] Code: c4 60 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d9 dd 57 06 83 c5 01 89 2d 10 95 ea 12 4c 89 e6 48 c7 c7 c0 5f b1 87 e8 61 c6 fa ff 90 <0f> 0b 90 e9 32 5b b5 01 83 c5 01 89 2d ef 94 ea 12 49 39 c4 73 da [ 298.578269][ T6841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.583482][ C0] RSP: 0018:ffffc90000007900 EFLAGS: 00010086 [ 298.583511][ C0] RAX: 0000000000000050 RBX: ffff888113f5c118 RCX: 0000000000000000 [ 298.583535][ C0] RDX: 0000000000000050 RSI: ffffffff8192e649 RDI: fffff52000000f11 [ 298.583553][ C0] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 298.583570][ C0] R10: 0000000000000104 R11: 205d304320202020 R12: ffffc90000007a70 [ 298.583591][ C0] R13: ffff888114595a00 R14: 0000000000000001 R15: 0000000000000000 [ 298.590715][ T5244] m920x_read = error: -19 [ 298.593837][ C0] FS: 0000000000000000(0000) GS:ffff888268636000(0000) knlGS:0000000000000000 [ 298.593870][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 298.598573][ T5244] dvb-usb: error while querying for an remote control event. [ 298.603198][ C0] CR2: 0000000000000000 CR3: 000000012ccae000 CR4: 00000000003506f0 [ 298.603217][ C0] Call Trace: [ 298.603227][ C0] [ 298.603241][ C0] __debug_object_init+0x2a9/0x3d0 [ 298.603287][ C0] ? __pfx___debug_object_init+0x10/0x10 [ 298.611379][ T6841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 298.613034][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 298.621927][ T6841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.622009][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 298.628832][ T6841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 298.631870][ C0] ? __init_swait_queue_head+0xca/0x150 [ 298.641276][ T6841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.641669][ C0] __synchronize_srcu+0x1c3/0x300 [ 298.649640][ T6841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 298.652934][ C0] ? __pfx___synchronize_srcu+0x10/0x10 [ 298.661957][ T6841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.665450][ C0] ? ktime_get_mono_fast_ns+0x1c3/0x3f0 [ 298.665497][ C0] ? synchronize_srcu+0xa8/0x380 [ 298.672703][ T6841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 298.675175][ C0] wakeup_source_unregister.part.0+0x12c/0x540 [ 298.692923][ T5236] usblp 4-1:0.0: usblp1: USB Bidirectional printer dev 124 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 298.693579][ C0] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 298.715282][ T5236] usb 4-1: USB disconnect, device number 124 [ 298.715772][ C0] wakeup_source_unregister+0x1f/0x30 [ 298.723519][ T5236] usblp1: removed [ 298.725219][ C0] mmc_host_classdev_release+0x42/0x120 [ 298.742121][ T5244] m920x_read = error: -19 [ 298.745108][ C0] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 298.745153][ C0] device_release+0xd2/0x270 [ 298.749208][ T5244] dvb-usb: error while querying for an remote control event. [ 298.750494][ C0] kobject_put+0x1f7/0x640 [ 298.750540][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 298.890333][ T5244] m920x_read = error: -19 [ 298.890575][ C0] put_device+0x1f/0x30 [ 298.897679][ T5244] dvb-usb: error while querying for an remote control event. [ 298.901564][ C0] vub300_inactivity_timer_expired+0x42f/0x550 [ 298.901606][ C0] call_timer_fn+0x19a/0x610 [ 299.040096][ T5236] m920x_read = error: -19 [ 299.044199][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 299.048717][ T5236] dvb-usb: error while querying for an remote control event. [ 299.055304][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 299.055342][ C0] ? mark_held_locks+0x40/0x70 [ 299.055379][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 299.161603][ T5462] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 299.164761][ C0] __run_timers+0x757/0xb00 [ 299.190121][ T5236] m920x_read = error: -19 [ 299.201882][ C0] ? __pfx___run_timers+0x10/0x10 [ 299.201931][ C0] ? ktime_get+0x9f/0x320 [ 299.201969][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 299.208452][ T5236] dvb-usb: error while querying for an remote control event. [ 299.216143][ C0] run_timer_base+0x114/0x190 [ 299.216184][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 299.216221][ C0] run_timer_softirq+0x1a/0x50 [ 301.293266][ C0] handle_softirqs+0x1dd/0x990 [ 301.298165][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 301.303469][ C0] ? _raw_spin_unlock+0x28/0x50 [ 301.308340][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 301.314000][ C0] __irq_exit_rcu+0x160/0x210 [ 301.318721][ C0] irq_exit_rcu+0x9/0x30 [ 301.322983][ C0] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 301.328656][ C0] [ 301.332116][ C0] [ 301.335069][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 301.341090][ C0] RIP: 0010:rcu_is_watching+0x5c/0xc0 [ 301.346492][ C0] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5c 48 03 1c ed e0 bb 27 89 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b [ 301.366209][ C0] RSP: 0018:ffffc900151bf428 EFLAGS: 00000a02 [ 301.372291][ C0] RAX: dffffc0000000000 RBX: ffff8881f5633868 RCX: ffffffff82215108 [ 301.380269][ C0] RDX: 1ffff1103eac670d RSI: ffffffff87b15400 RDI: ffffffff8927bbe0 [ 301.388248][ C0] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 301.396229][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 301.404204][ C0] R13: 0000000000000001 R14: ffff88810afca578 R15: 8000000132966007 [ 301.412217][ C0] ? page_table_check_clear+0x78/0x8f0 [ 301.417726][ C0] ? rcu_is_watching+0x12/0xc0 [ 301.422498][ C0] page_table_check_clear+0x523/0x8f0 [ 301.427888][ C0] __page_table_check_pte_clear+0xf1/0x100 [ 301.433709][ C0] ? __pfx___page_table_check_pte_clear+0x10/0x10 [ 301.440141][ C0] ? __tlb_remove_folio_pages_size.isra.0+0x153/0x550 [ 301.447017][ C0] __zap_vma_range+0x23c2/0x3fd0 [ 301.451988][ C0] ? __pfx___zap_vma_range+0x10/0x10 [ 301.457375][ C0] ? find_held_lock+0x2b/0x80 [ 301.462158][ C0] unmap_vmas+0x299/0x5f0 [ 301.466523][ C0] ? __pfx_unmap_vmas+0x10/0x10 [ 301.471429][ C0] ? mas_next_slot+0x10a3/0x1960 [ 301.476498][ C0] exit_mmap+0x1ef/0xa00 [ 301.480768][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 301.485640][ C0] ? rcu_is_watching+0x12/0xc0 [ 301.490421][ C0] ? uprobe_clear_state+0x49/0x260 [ 301.495550][ C0] ? find_held_lock+0x2b/0x80 [ 301.500233][ C0] ? uprobe_clear_state+0x5f/0x260 [ 301.505362][ C0] ? __mutex_unlock_slowpath+0x35d/0x930 [ 301.511050][ C0] ? arch_uprobe_clear_state+0x107/0x150 [ 301.516791][ C0] mmput+0xe0/0x430 [ 301.520628][ C0] do_exit+0x833/0x2a50 [ 301.524807][ C0] ? __pfx_do_exit+0x10/0x10 [ 301.529407][ C0] ? do_raw_spin_lock+0x128/0x260 [ 301.534458][ C0] ? find_held_lock+0x2b/0x80 [ 301.539144][ C0] ? get_signal+0x7e0/0x21e0 [ 301.543754][ C0] do_group_exit+0xd5/0x2a0 [ 301.548277][ C0] get_signal+0x1ec7/0x21e0 [ 301.552911][ C0] ? __pfx_get_signal+0x10/0x10 [ 301.557798][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 301.563368][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 301.569538][ C0] ? do_raw_spin_lock+0x128/0x260 [ 301.574588][ C0] exit_to_user_mode_loop+0xd2/0x530 [ 301.579889][ C0] ? rcu_is_watching+0x12/0xc0 [ 301.584655][ C0] ret_from_fork+0x6cd/0xc80 [ 301.589261][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 301.594435][ C0] ? __switch_to+0x7f6/0x10e0 [ 301.599142][ C0] ? __switch_to_asm+0x39/0x70 [ 301.603910][ C0] ret_from_fork_asm+0x1a/0x30 [ 301.608683][ C0] [ 301.611705][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 301.619076][ C0] CPU: 0 UID: 0 PID: 6838 Comm: syz.1.431 Tainted: G W syzkaller #0 PREEMPT(lazy) [ 301.629859][ C0] Tainted: [W]=WARN [ 301.633666][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 301.644178][ C0] Call Trace: [ 301.647549][ C0] [ 301.650392][ C0] dump_stack_lvl+0x100/0x190 [ 301.655084][ C0] vpanic+0x552/0x970 [ 301.659070][ C0] ? __pfx_vpanic+0x10/0x10 [ 301.663590][ C0] ? lock_release+0x24d/0x310 [ 301.668310][ C0] panic+0xd1/0xe0 [ 301.672060][ C0] ? __pfx_panic+0x10/0x10 [ 301.676590][ C0] ? check_panic_on_warn+0x1f/0x90 [ 301.681724][ C0] check_panic_on_warn.cold+0x19/0x34 [ 301.687138][ C0] ? lookup_object_or_alloc.part.0.cold+0x19/0x40 [ 301.693601][ C0] __warn.cold+0x191/0x318 [ 301.698045][ C0] __report_bug+0x30f/0x440 [ 301.702574][ C0] ? lookup_object_or_alloc.part.0.cold+0x19/0x40 [ 301.709020][ C0] ? __pfx___report_bug+0x10/0x10 [ 301.714237][ C0] ? irq_work_queue+0xce/0x100 [ 301.719389][ C0] ? __wake_up_klogd+0xe2/0x140 [ 301.724372][ C0] ? vprintk_emit+0x1c9/0x6b0 [ 301.729076][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 301.734489][ C0] ? lookup_object_or_alloc.part.0.cold+0x19/0x40 [ 301.741031][ C0] report_bug+0xb2/0x220 [ 301.745290][ C0] ? lookup_object_or_alloc.part.0.cold+0x19/0x40 [ 301.751729][ C0] handle_bug+0x16a/0x2a0 [ 301.756079][ C0] exc_invalid_op+0x17/0x50 [ 301.760593][ C0] asm_exc_invalid_op+0x1a/0x20 [ 301.765448][ C0] RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 [ 301.772664][ C0] Code: c4 60 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d9 dd 57 06 83 c5 01 89 2d 10 95 ea 12 4c 89 e6 48 c7 c7 c0 5f b1 87 e8 61 c6 fa ff 90 <0f> 0b 90 e9 32 5b b5 01 83 c5 01 89 2d ef 94 ea 12 49 39 c4 73 da [ 301.792484][ C0] RSP: 0018:ffffc90000007900 EFLAGS: 00010086 [ 301.798582][ C0] RAX: 0000000000000050 RBX: ffff888113f5c118 RCX: 0000000000000000 [ 301.806745][ C0] RDX: 0000000000000050 RSI: ffffffff8192e649 RDI: fffff52000000f11 [ 301.814731][ C0] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 301.822719][ C0] R10: 0000000000000104 R11: 205d304320202020 R12: ffffc90000007a70 [ 301.830882][ C0] R13: ffff888114595a00 R14: 0000000000000001 R15: 0000000000000000 [ 301.838953][ C0] ? vprintk_emit+0x1c9/0x6b0 [ 301.843652][ C0] __debug_object_init+0x2a9/0x3d0 [ 301.848798][ C0] ? __pfx___debug_object_init+0x10/0x10 [ 301.855236][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 301.860651][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 301.866131][ C0] ? __init_swait_queue_head+0xca/0x150 [ 301.871691][ C0] __synchronize_srcu+0x1c3/0x300 [ 301.876822][ C0] ? __pfx___synchronize_srcu+0x10/0x10 [ 301.882395][ C0] ? ktime_get_mono_fast_ns+0x1c3/0x3f0 [ 301.887956][ C0] ? synchronize_srcu+0xa8/0x380 [ 301.892918][ C0] wakeup_source_unregister.part.0+0x12c/0x540 [ 301.899089][ C0] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 301.905265][ C0] wakeup_source_unregister+0x1f/0x30 [ 301.910828][ C0] mmc_host_classdev_release+0x42/0x120 [ 301.916474][ C0] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 301.922833][ C0] device_release+0xd2/0x270 [ 301.927463][ C0] kobject_put+0x1f7/0x640 [ 301.931904][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 301.938613][ C0] put_device+0x1f/0x30 [ 301.942805][ C0] vub300_inactivity_timer_expired+0x42f/0x550 [ 301.948995][ C0] call_timer_fn+0x19a/0x610 [ 301.953618][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 301.958759][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 301.965471][ C0] ? mark_held_locks+0x40/0x70 [ 301.970259][ C0] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 301.976953][ C0] __run_timers+0x757/0xb00 [ 301.981512][ C0] ? __pfx___run_timers+0x10/0x10 [ 301.986659][ C0] ? ktime_get+0x9f/0x320 [ 301.991050][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 301.996216][ C0] run_timer_base+0x114/0x190 [ 302.000925][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 302.006147][ C0] run_timer_softirq+0x1a/0x50 [ 302.010924][ C0] handle_softirqs+0x1dd/0x990 [ 302.015805][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 302.021124][ C0] ? _raw_spin_unlock+0x28/0x50 [ 302.026014][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 302.031679][ C0] __irq_exit_rcu+0x160/0x210 [ 302.036478][ C0] irq_exit_rcu+0x9/0x30 [ 302.040722][ C0] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 302.046388][ C0] [ 302.049320][ C0] [ 302.052248][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 302.058422][ C0] RIP: 0010:rcu_is_watching+0x5c/0xc0 [ 302.063801][ C0] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5c 48 03 1c ed e0 bb 27 89 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b [ 302.083419][ C0] RSP: 0018:ffffc900151bf428 EFLAGS: 00000a02 [ 302.089500][ C0] RAX: dffffc0000000000 RBX: ffff8881f5633868 RCX: ffffffff82215108 [ 302.097566][ C0] RDX: 1ffff1103eac670d RSI: ffffffff87b15400 RDI: ffffffff8927bbe0 [ 302.105543][ C0] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 302.113519][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 302.121578][ C0] R13: 0000000000000001 R14: ffff88810afca578 R15: 8000000132966007 [ 302.129564][ C0] ? page_table_check_clear+0x78/0x8f0 [ 302.135236][ C0] ? rcu_is_watching+0x12/0xc0 [ 302.140043][ C0] page_table_check_clear+0x523/0x8f0 [ 302.145663][ C0] __page_table_check_pte_clear+0xf1/0x100 [ 302.151496][ C0] ? __pfx___page_table_check_pte_clear+0x10/0x10 [ 302.157933][ C0] ? __tlb_remove_folio_pages_size.isra.0+0x153/0x550 [ 302.164727][ C0] __zap_vma_range+0x23c2/0x3fd0 [ 302.169712][ C0] ? __pfx___zap_vma_range+0x10/0x10 [ 302.175051][ C0] ? find_held_lock+0x2b/0x80 [ 302.179831][ C0] unmap_vmas+0x299/0x5f0 [ 302.184174][ C0] ? __pfx_unmap_vmas+0x10/0x10 [ 302.189121][ C0] ? mas_next_slot+0x10a3/0x1960 [ 302.194084][ C0] exit_mmap+0x1ef/0xa00 [ 302.198356][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 302.203139][ C0] ? rcu_is_watching+0x12/0xc0 [ 302.207964][ C0] ? uprobe_clear_state+0x49/0x260 [ 302.213538][ C0] ? find_held_lock+0x2b/0x80 [ 302.218245][ C0] ? uprobe_clear_state+0x5f/0x260 [ 302.223553][ C0] ? __mutex_unlock_slowpath+0x35d/0x930 [ 302.229237][ C0] ? arch_uprobe_clear_state+0x107/0x150 [ 302.234903][ C0] mmput+0xe0/0x430 [ 302.238746][ C0] do_exit+0x833/0x2a50 [ 302.243006][ C0] ? __pfx_do_exit+0x10/0x10 [ 302.248054][ C0] ? do_raw_spin_lock+0x128/0x260 [ 302.253135][ C0] ? find_held_lock+0x2b/0x80 [ 302.257999][ C0] ? get_signal+0x7e0/0x21e0 [ 302.262614][ C0] do_group_exit+0xd5/0x2a0 [ 302.267135][ C0] get_signal+0x1ec7/0x21e0 [ 302.271667][ C0] ? __pfx_get_signal+0x10/0x10 [ 302.276553][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 302.282122][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 302.288293][ C0] ? do_raw_spin_lock+0x128/0x260 [ 302.293341][ C0] exit_to_user_mode_loop+0xd2/0x530 [ 302.298648][ C0] ? rcu_is_watching+0x12/0xc0 [ 302.303419][ C0] ret_from_fork+0x6cd/0xc80 [ 302.308032][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 302.313165][ C0] ? __switch_to+0x7f6/0x10e0 [ 302.317939][ C0] ? __switch_to_asm+0x39/0x70 [ 302.322715][ C0] ret_from_fork_asm+0x1a/0x30 [ 302.327500][ C0] [ 302.330775][ C0] Kernel Offset: disabled [ 302.335101][ C0] Rebooting in 86400 seconds..