Extracting prog: 3m22.025627657s
Minimizing prog: 14m5.114963906s
Simplifying prog options: 5m8.977760685s
Extracting C: 56.596417069s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program crashed: UBSAN: array-index-out-of-bounds in dvb_usb_start_feed
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)

program did not crash
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(0xffffffffffffffff, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program did not crash
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program did not crash
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, 0x0, 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program did not crash
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program did not crash
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(0x0, 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program did not crash
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl
a never seen crash title: general protection fault in mxl111sf_ep6_streaming_ctrl, ignore
simplifying guilty program options
testing program (duration=1m31.974214062s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl
a never seen crash title: general protection fault in mxl111sf_ep6_streaming_ctrl, ignore
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program did not crash
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl
a never seen crash title: general protection fault in mxl111sf_ep6_streaming_ctrl, ignore
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl
validation run: crashed=true
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl
validation run: crashed=true
testing program (duration=1m31.974214062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402001c60100000000010902450001010080fa0904"], 0x0)
r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x1, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000100)={0x1ff, 0x0, 0x3, 0xa, 0x4})

program crashed: general protection fault in mxl111sf_ep6_streaming_ctrl
validation run: crashed=true
reproducing took 28m33.660740726s
repro crashed as (corrupted=false):
usb 4-1: dvb_usb_v2: could not submit urb no. 0 - get them all back
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000061: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f]
CPU: 0 UID: 0 PID: 5926 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:348
Code: 55 41 57 41 56 41 54 53 89 f5 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 30 22 92 f9 49 8d 9e 08 03 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 53 02 03 fa 48 8b 1b 48 83 c3 38
RSP: 0018:ffffc90002eef990 EFLAGS: 00010202
RAX: 0000000000000061 RBX: 0000000000000308 RCX: ffff888033c88000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffc90002eef4a7 R09: 1ffff920005dde94
R10: dffffc0000000000 R11: ffffffff8835ee20 R12: dffffc0000000000
R13: ffff88805c6b53b8 R14: 0000000000000000 R15: ffff88805c6b48d8
FS:  0000000000000000(0000) GS:ffff888123abf000(0063) knlGS:00000000f67feb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f73f6288 CR3: 0000000026ad0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 dvb_usb_start_feed+0x57a/0xc70 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:308
 dmx_ts_feed_start_filtering+0x129/0x220 drivers/media/dvb-core/dvb_demux.c:747
 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:658 [inline]
 dvb_dmxdev_filter_start+0x434/0x10d0 drivers/media/dvb-core/dmxdev.c:769
 dvb_demux_do_ioctl+0x48b/0x540 drivers/media/dvb-core/dmxdev.c:1099
 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996
 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208
 __do_compat_sys_ioctl fs/ioctl.c:695 [inline]
 __se_compat_sys_ioctl fs/ioctl.c:638 [inline]
 __ia32_compat_sys_ioctl+0x5ea/0x950 fs/ioctl.c:638
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x27a/0x6b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f440ec
Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8
RSP: 002b:00000000f67fe50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000040146f2c
RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:348
Code: 55 41 57 41 56 41 54 53 89 f5 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 30 22 92 f9 49 8d 9e 08 03 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 53 02 03 fa 48 8b 1b 48 83 c3 38
RSP: 0018:ffffc90002eef990 EFLAGS: 00010202
RAX: 0000000000000061 RBX: 0000000000000308 RCX: ffff888033c88000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffc90002eef4a7 R09: 1ffff920005dde94
R10: dffffc0000000000 R11: ffffffff8835ee20 R12: dffffc0000000000
R13: ffff88805c6b53b8 R14: 0000000000000000 R15: ffff88805c6b48d8
FS:  0000000000000000(0000) GS:ffff888123abf000(0063) knlGS:00000000f67feb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f73f6288 CR3: 0000000026ad0000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	55                   	push   %rbp
   1:	41 57                	push   %r15
   3:	41 56                	push   %r14
   5:	41 54                	push   %r12
   7:	53                   	push   %rbx
   8:	89 f5                	mov    %esi,%ebp
   a:	49 89 fe             	mov    %rdi,%r14
   d:	49 bc 00 00 00 00 00 	movabs $0xdffffc0000000000,%r12
  14:	fc ff df
  17:	e8 30 22 92 f9       	call   0xf992224c
  1c:	49 8d 9e 08 03 00 00 	lea    0x308(%r14),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 53 02 03 fa       	call   0xfa03028c
  39:	48 8b 1b             	mov    (%rbx),%rbx
  3c:	48 83 c3 38          	add    $0x38,%rbx

final repro crashed as (corrupted=false):
usb 4-1: dvb_usb_v2: could not submit urb no. 0 - get them all back
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000061: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000308-0x000000000000030f]
CPU: 0 UID: 0 PID: 5926 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:348
Code: 55 41 57 41 56 41 54 53 89 f5 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 30 22 92 f9 49 8d 9e 08 03 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 53 02 03 fa 48 8b 1b 48 83 c3 38
RSP: 0018:ffffc90002eef990 EFLAGS: 00010202
RAX: 0000000000000061 RBX: 0000000000000308 RCX: ffff888033c88000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffc90002eef4a7 R09: 1ffff920005dde94
R10: dffffc0000000000 R11: ffffffff8835ee20 R12: dffffc0000000000
R13: ffff88805c6b53b8 R14: 0000000000000000 R15: ffff88805c6b48d8
FS:  0000000000000000(0000) GS:ffff888123abf000(0063) knlGS:00000000f67feb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f73f6288 CR3: 0000000026ad0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 dvb_usb_start_feed+0x57a/0xc70 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:308
 dmx_ts_feed_start_filtering+0x129/0x220 drivers/media/dvb-core/dvb_demux.c:747
 dvb_dmxdev_start_feed drivers/media/dvb-core/dmxdev.c:658 [inline]
 dvb_dmxdev_filter_start+0x434/0x10d0 drivers/media/dvb-core/dmxdev.c:769
 dvb_demux_do_ioctl+0x48b/0x540 drivers/media/dvb-core/dmxdev.c:1099
 dvb_usercopy+0x199/0x2e0 drivers/media/dvb-core/dvbdev.c:996
 dvb_demux_ioctl+0x29/0x40 drivers/media/dvb-core/dmxdev.c:1208
 __do_compat_sys_ioctl fs/ioctl.c:695 [inline]
 __se_compat_sys_ioctl fs/ioctl.c:638 [inline]
 __ia32_compat_sys_ioctl+0x5ea/0x950 fs/ioctl.c:638
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x27a/0x6b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f440ec
Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8
RSP: 002b:00000000f67fe50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000040146f2c
RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mxl111sf_ep6_streaming_ctrl+0x2e/0x2e0 drivers/media/usb/dvb-usb-v2/mxl111sf.c:348
Code: 55 41 57 41 56 41 54 53 89 f5 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 30 22 92 f9 49 8d 9e 08 03 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 53 02 03 fa 48 8b 1b 48 83 c3 38
RSP: 0018:ffffc90002eef990 EFLAGS: 00010202
RAX: 0000000000000061 RBX: 0000000000000308 RCX: ffff888033c88000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffc90002eef4a7 R09: 1ffff920005dde94
R10: dffffc0000000000 R11: ffffffff8835ee20 R12: dffffc0000000000
R13: ffff88805c6b53b8 R14: 0000000000000000 R15: ffff88805c6b48d8
FS:  0000000000000000(0000) GS:ffff888123abf000(0063) knlGS:00000000f67feb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f73f6288 CR3: 0000000026ad0000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	55                   	push   %rbp
   1:	41 57                	push   %r15
   3:	41 56                	push   %r14
   5:	41 54                	push   %r12
   7:	53                   	push   %rbx
   8:	89 f5                	mov    %esi,%ebp
   a:	49 89 fe             	mov    %rdi,%r14
   d:	49 bc 00 00 00 00 00 	movabs $0xdffffc0000000000,%r12
  14:	fc ff df
  17:	e8 30 22 92 f9       	call   0xf992224c
  1c:	49 8d 9e 08 03 00 00 	lea    0x308(%r14),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 53 02 03 fa       	call   0xfa03028c
  39:	48 8b 1b             	mov    (%rbx),%rbx
  3c:	48 83 c3 38          	add    $0x38,%rbx