map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/usb/ch9.h>
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
#define MAX_FDS 30
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static struct usb_device_index* lookup_usb_index(int fd)
{
for (int i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd)
return &usb_devices[i].index;
}
return NULL;
}
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index))
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
struct usb_qualifier_descriptor* qual,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_data = (char*)qual;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
struct vusb_descriptor {
uint8_t req_type;
uint8_t desc_type;
uint32_t len;
char data[0];
} __attribute__((packed));
struct vusb_descriptors {
uint32_t len;
struct vusb_descriptor* generic;
struct vusb_descriptor* descs[0];
} __attribute__((packed));
struct vusb_response {
uint8_t type;
uint8_t req;
uint32_t len;
char data[0];
} __attribute__((packed));
struct vusb_responses {
uint32_t len;
struct vusb_response* generic;
struct vusb_response* resps[0];
} __attribute__((packed));
static bool lookup_control_response(const struct vusb_descriptors* descs, const struct vusb_responses* resps,
struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length)
{
int descs_num = 0;
int resps_num = 0;
if (descs)
descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) / sizeof(descs->descs[0]);
if (resps)
resps_num = (resps->len - offsetof(struct vusb_responses, resps)) / sizeof(resps->resps[0]);
uint8_t req = ctrl->bRequest;
uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK;
uint8_t desc_type = ctrl->wValue >> 8;
if (req == USB_REQ_GET_DESCRIPTOR) {
int i;
for (i = 0; i < descs_num; i++) {
struct vusb_descriptor* desc = descs->descs[i];
if (!desc)
continue;
if (desc->req_type == req_type && desc->desc_type == desc_type) {
*response_length = desc->len;
if (*response_length != 0)
*response_data = &desc->data[0];
else
*response_data = NULL;
return true;
}
}
if (descs && descs->generic) {
*response_data = &descs->generic->data[0];
*response_length = descs->generic->len;
return true;
}
} else {
int i;
for (i = 0; i < resps_num; i++) {
struct vusb_response* resp = resps->resps[i];
if (!resp)
continue;
if (resp->type == req_type && resp->req == req) {
*response_length = resp->len;
if (*response_length != 0)
*response_data = &resp->data[0];
else
*response_data = NULL;
return true;
}
}
if (resps && resps->generic) {
*response_data = &resps->generic->data[0];
*response_length = resps->generic->len;
return true;
}
}
return false;
}
#define UDC_NAME_LENGTH_MAX 128
struct usb_raw_init {
__u8 driver_name[UDC_NAME_LENGTH_MAX];
__u8 device_name[UDC_NAME_LENGTH_MAX];
__u8 speed;
};
enum usb_raw_event_type {
USB_RAW_EVENT_INVALID = 0,
USB_RAW_EVENT_CONNECT = 1,
USB_RAW_EVENT_CONTROL = 2,
};
struct usb_raw_event {
__u32 type;
__u32 length;
__u8 data[0];
};
struct usb_raw_ep_io {
__u16 ep;
__u16 flags;
__u32 length;
__u8 data[0];
};
#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff
struct usb_raw_ep_caps {
__u32 type_control : 1;
__u32 type_iso : 1;
__u32 type_bulk : 1;
__u32 type_int : 1;
__u32 dir_in : 1;
__u32 dir_out : 1;
};
struct usb_raw_ep_limits {
__u16 maxpacket_limit;
__u16 max_streams;
__u32 reserved;
};
struct usb_raw_ep_info {
__u8 name[USB_RAW_EP_NAME_MAX];
__u32 addr;
struct usb_raw_ep_caps caps;
struct usb_raw_ep_limits limits;
};
struct usb_raw_eps_info {
struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};
#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)
static int usb_raw_open()
{
return open("/dev/raw-gadget", O_RDWR);
}
static int usb_raw_init(int fd, uint32_t speed, const char* driver, const char* device)
{
struct usb_raw_init arg;
strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
arg.speed = speed;
return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}
static int usb_raw_run(int fd)
{
return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}
static int usb_raw_ep_write(int fd, struct usb_raw_ep_io* io)
{
return ioctl(fd, USB_RAW_IOCTL_EP_WRITE, io);
}
static int usb_raw_configure(int fd)
{
return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}
static int usb_raw_vbus_draw(int fd, uint32_t power)
{
return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}
static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}
static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}
static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}
static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}
static int usb_raw_ep_disable(int fd, int ep)
{
return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}
static int usb_raw_ep0_stall(int fd)
{
return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}
static int lookup_interface(int fd, uint8_t bInterfaceNumber, uint8_t bAlternateSetting)
{
struct usb_device_index* index = lookup_usb_index(fd);
if (!index)
return -1;
for (int i = 0; i < index->ifaces_num; i++) {
if (index->ifaces[i].bInterfaceNumber == bInterfaceNumber &&
index->ifaces[i].bAlternateSetting == bAlternateSetting)
return i;
}
return -1;
}
static int lookup_endpoint(int fd, uint8_t bEndpointAddress)
{
struct usb_device_index* index = lookup_usb_index(fd);
if (!index)
return -1;
if (index->iface_cur < 0)
return -1;
for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++)
if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress == bEndpointAddress)
return index->ifaces[index->iface_cur].eps[ep].handle;
return -1;
}
#define USB_MAX_PACKET_SIZE 4096
struct usb_raw_control_event {
struct usb_raw_event inner;
struct usb_ctrlrequest ctrl;
char data[USB_MAX_PACKET_SIZE];
};
struct usb_raw_ep_io_data {
struct usb_raw_ep_io inner;
char data[USB_MAX_PACKET_SIZE];
};
static void set_interface(int fd, int n)
{
struct usb_device_index* index = lookup_usb_index(fd);
if (!index)
return;
if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle);
if (rv < 0) {
} else {
}
}
}
if (n >= 0 && n < index->ifaces_num) {
for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) {
int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
if (rv < 0) {
} else {
index->ifaces[n].eps[ep].handle = rv;
}
}
index->iface_cur = n;
}
}
static int configure_device(int fd)
{
struct usb_device_index* index = lookup_usb_index(fd);
if (!index)
return -1;
int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
if (rv < 0) {
return rv;
}
rv = usb_raw_configure(fd);
if (rv < 0) {
return rv;
}
set_interface(fd, 0);
return 0;
}
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
if (!dev) {
return -1;
}
int fd = usb_raw_open();
if (fd < 0) {
return fd;
}
if (fd >= MAX_FDS) {
close(fd);
return -1;
}
struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
if (!index) {
return -1;
}
char device[32];
sprintf(&device[0], "dummy_udc.%llu", procid);
int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
if (rv < 0) {
return rv;
}
rv = usb_raw_run(fd);
if (rv < 0) {
return rv;
}
bool done = false;
while (!done) {
struct usb_raw_control_event event;
event.inner.type = 0;
event.inner.length = sizeof(event.ctrl);
rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
if (rv < 0) {
return rv;
}
if (event.inner.type != USB_RAW_EVENT_CONTROL)
continue;
char* response_data = NULL;
uint32_t response_length = 0;
struct usb_qualifier_descriptor qual;
if (event.ctrl.bRequestType & USB_DIR_IN) {
if (!lookup_connect_response_in(fd, descs, &event.ctrl, &qual, &response_data, &response_length)) {
usb_raw_ep0_stall(fd);
continue;
}
} else {
if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
usb_raw_ep0_stall(fd);
continue;
}
response_data = NULL;
response_length = event.ctrl.wLength;
}
if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
rv = configure_device(fd);
if (rv < 0) {
return rv;
}
}
struct usb_raw_ep_io_data response;
response.inner.ep = 0;
response.inner.flags = 0;
if (response_length > sizeof(response.data))
response_length = 0;
if (event.ctrl.wLength < response_length)
response_length = event.ctrl.wLength;
response.inner.length = response_length;
if (response_data)
memcpy(&response.data[0], response_data, response_length);
else
memset(&response.data[0], 0, response_length);
if (event.ctrl.bRequestType & USB_DIR_IN) {
rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
} else {
rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
}
if (rv < 0) {
return rv;
}
}
sleep_ms(200);
return fd;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic);
}
static volatile long syz_usb_control_io(volatile long a0, volatile long a1, volatile long a2)
{
int fd = a0;
const struct vusb_descriptors* descs = (const struct vusb_descriptors*)a1;
const struct vusb_responses* resps = (const struct vusb_responses*)a2;
struct usb_raw_control_event event;
event.inner.type = 0;
event.inner.length = USB_MAX_PACKET_SIZE;
int rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
if (rv < 0) {
return rv;
}
if (event.inner.type != USB_RAW_EVENT_CONTROL) {
return -1;
}
char* response_data = NULL;
uint32_t response_length = 0;
if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) {
if (!lookup_control_response(descs, resps, &event.ctrl, &response_data, &response_length)) {
usb_raw_ep0_stall(fd);
return -1;
}
} else {
if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD ||
event.ctrl.bRequest == USB_REQ_SET_INTERFACE) {
int iface_num = event.ctrl.wIndex;
int alt_set = event.ctrl.wValue;
int iface_index = lookup_interface(fd, iface_num, alt_set);
if (iface_index < 0) {
} else {
set_interface(fd, iface_index);
}
}
response_length = event.ctrl.wLength;
}
struct usb_raw_ep_io_data response;
response.inner.ep = 0;
response.inner.flags = 0;
if (response_length > sizeof(response.data))
response_length = 0;
if (event.ctrl.wLength < response_length)
response_length = event.ctrl.wLength;
if ((event.ctrl.bRequestType & USB_DIR_IN) && !event.ctrl.wLength) {
response_length = USB_MAX_PACKET_SIZE;
}
response.inner.length = response_length;
if (response_data)
memcpy(&response.data[0], response_data, response_length);
else
memset(&response.data[0], 0, response_length);
if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) {
rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
} else {
rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
}
if (rv < 0) {
return rv;
}
sleep_ms(200);
return 0;
}
static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
int fd = a0;
uint8_t ep = a1;
uint32_t len = a2;
char* data = (char*)a3;
int ep_handle = lookup_endpoint(fd, ep);
if (ep_handle < 0) {
return -1;
}
struct usb_raw_ep_io_data io_data;
io_data.inner.ep = ep_handle;
io_data.inner.flags = 0;
if (len > sizeof(io_data.data))
len = sizeof(io_data.data);
io_data.inner.length = len;
memcpy(&io_data.data[0], data, len);
int rv = usb_raw_ep_write(fd, (struct usb_raw_ep_io*)&io_data);
if (rv < 0) {
return rv;
}
sleep_ms(200);
return 0;
}
uint64_t r[1] = {0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// syz_usb_connect$hid arguments: [
// speed: usb_device_speed = 0x0 (8 bytes)
// dev_len: len = 0x36 (8 bytes)
// dev: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {12 01 00 00 00 00 00 40 26 09 33 33 40 00 00 00 00 01 09 02 24 00 01 00 00 00 00 09 04 00 00 01 03 01 00 00 09 21 00 00 00 01 22 01 00 09 05 81 03 08} (length 0x32)
// }
// }
// }
// conn_descs: nil
// ]
// returns fd_usb_hid
memcpy((void*)0x200000000000, "... [truncated large byte array] ...", 50);
res = -1;
res = syz_usb_connect(/*speed=*/0, /*dev_len=*/0x36, /*dev=*/0x200000000000, /*conn_descs=*/0);
if (res != -1)
r[0] = res;
// syz_usb_control_io$hid arguments: [
// fd: fd_usb_hid (resource)
// descs: nil
// resps: nil
// ]
syz_usb_control_io(/*fd=*/r[0], /*descs=*/0, /*resps=*/0);
// syz_usb_ep_write$ath9k_ep1 arguments: [
// fd: fd_usb_ath9k (resource)
// ep: const = 0x82 (1 bytes)
// len: bytesize = 0x1054 (8 bytes)
// data: ptr[in, ath9k_bulk_frame] {
// ath9k_bulk_frame {
// packets: array[ath9k_bulk_packet] {
// ath9k_bulk_packet {
// pkt_len: len = 0x0 (2 bytes)
// pkt_tag: const = 0x4e00 (2 bytes)
// data: buffer: {} (length 0x0)
// }
// ath9k_bulk_packet {
// pkt_len: len = 0x0 (2 bytes)
// pkt_tag: const = 0x4e00 (2 bytes)
// data: buffer: {} (length 0x0)
// }
// ath9k_bulk_packet {
// pkt_len: len = 0xa1 (2 bytes)
// pkt_tag: const = 0x4e00 (2 bytes)
// data: buffer: {75 fb 4c 30 8d 67 0b fe d5 d2 33 ee d8 d6 e1 b2 2b 9d e2 75 bf 97 e7 45 cb c7 50 d4 42 20 2b 41 38 e8 c1 9e 60 98 ab a4 1a 8e c2 08 71 8e 2d f1 66 76 30 22 fd 4c 49 30 a5 76 00 f9 30 be c7 12 fa ef bb 5a 08 3f f9 2b cf b0 39 c9 c1 64 45 f9 d9 1d 9c 23 ef 84 49 c3 70 1b cc 93 d7 a2 ac 5e 58 c8 36 42 51 ef 80 a1 dc 9c c6 b1 22 88 1c 8e a6 7c 52 a4 4e 4f 68 61 d9 20 f6 f4 a1 66 0d 04 b1 e3 b1 e7 66 83 75 26 02 04 67 ff 3c 53 28 cb e2 7e 9c 25 e7 a5 07 78 e7 fb 9b 27 c9 be 7b d9 1a} (length 0xa1)
// }
// ath9k_bulk_packet {
// pkt_len: len = 0x0 (2 bytes)
// pkt_tag: const = 0x4e00 (2 bytes)
// data: buffer: {} (length 0x0)
// }
// ath9k_bulk_packet {
// pkt_len: len = 0x0 (2 bytes)
// pkt_tag: const = 0x4e00 (2 bytes)
// data: buffer: {} (length 0x0)
// }
// ath9k_bulk_packet {
// pkt_len: len = 0xf5c (2 bytes)
// pkt_tag: const = 0x4e00 (2 bytes)
// data: buffer: {55 d4 5c 41 80 2a d3 0a 9d e5 61 b0 2d bc b4 1e c1 95 c3 4e 66 86 35 c5 05 7d 66 9c df ef c7 73 4c ba 39 28 5d 0e 90 80 9f 58 04 75 8f 00 5a 19 53 d5 79 46 21 d5 19 f4 64 9c 10 ae f7 bf ac 1c c2 dd a2 9b b8 bb db c5 85 d5 6c 77 ab 68 96 f6 44 78 2e 22 97 dc 16 08 48 bb fc e7 cb af c5 cb 7a 35 bf 16 53 12 3d 4f fc 08 dd eb 4c f4 64 ab 17 f1 3b b6 cf 01 b5 84 cb 4a 8f 64 21 99 3d 3d 6d 39 7f 0e 4c c3 e5 a4 98 17 71 54 e2 fa a0 96 fb 80 20 64 ae 9c 05 ec 7b 3a 85 00 84 51 25 14 b4 22 f9 11 cd 1f 96 4f 70 74 99 5a 5d 33 2a f9 e4 fa bd 6e 0b fb 00 26 2b 4c 5d 42 e5 ea a5 c2 d0 a5 bf 35 ba 4c 76 f2 b0 52 a9 ae 27 fb c5 0f 4e ef d2 b8 d9 d7 c8 a3 66 a4 e5 82 4a 38 d2 20 c4 78 ba 77 83 1f 8e d3 35 5c 10 c2 f2 c6 be 00 75 e4 fb f2 25 21 e6 9f 68 82 90 ff 6a 8c 17 19 f1 75 4a 68 76 a2 17 8a 78 cf 8a a9 3a 57 62 a9 ac 07 f7 e4 5d 0f d1 4f 5c 42 33 b1 18 8e 95 d5 14 b6 36 2a 5b 6b 38 18 76 ed e3 ea 12 06 f1 cb da 4c f7 8d 50 28 f1 0f 1c c4 3f a9 7c 08 e7 56 b5 7a 9e 37 c2 fa ef 46 cf 2c a6 fd 32 d4 3c 83 c1 9f 6f a8 30 ac eb 0b 02 86 f1 dd ef 59 21 03 4c cb 0b fa 97 48 70 b3 67 74 7d e0 9a 6a 88 80 7d 85 82 2d 70 a1 d2 04 f9 0e 9e 26 fb f3 00 60 42 87 8a 0c 43 66 5e 78 cb b6 77 54 02 b2 8a db 39 75 12 e4 9b b0 9d 80 49 f0 63 4a 2c 1b 59 31 26 6b 0d d6 a9 f6 b8 45 99 48 a5 51 1d 49 c4 d4 29 ae d9 2f 40 16 13 0c c8 5e 1a 4f 95 8f 62 1d e6 78 98 0b ea d0 c5 54 e8 60 24 c8 1a 5e e1 46 ff 9e 3c fc a9 77 ed 26 6c 31 eb 7d 94 81 8a f5 28 dc 47 f4 86 4c b7 d0 ad 69 7b 4f 68 0a d5 fc 63 d3 ac 03 98 d8 43 d3 de 28 af 45 17 19 77 ca e5 0d 0f 45 c7 ad 6a bc 3d 13 80 35 d9 64 0c e7 96 06 04 54 a7 80 90 cb d2 8e 4b e1 53 bc e2 49 0a d6 b2 dd 46 89 46 52 37 92 43 3c dd c2 53 14 5e cc 72 43 be 3f e6 39 20 f9 e6 7e d9 61 41 0d 05 68 2b 1e 9a d3 f5 4f b0 98 e5 08 50 7a 2d c9 c8 7b 44 e2 f5 84 3c 7c 7f 89 e6 5d 84 40 ba 91 58 1e e0 f0 d3 03 b6 88 f0 63 36 1e 99 a4 77 e3 98 0f 19 72 81 cc 0e 75 30 cd 11 5c d0 61 dd d5 3b b7 ad e0 3b 00 21 72 5c fd 83 2d 26 56 0d 53 35 bc ce ab e1 5d 5a c3 14 db 65 6f 13 af ce 4c b8 db 11 ca a0 77 75 22 55 b6 67 0f b3 c2 12 9d a9 54 8e a4 b3 c0 ff 00 01 96 30 71 00 e3 15 3f 09 e8 c5 2c 42 7e 65 10 15 a5 4a 66 44 fa 3b 7a 0e 22 2f 68 0c a0 55 91 9e 78 c4 45 61 57 9b 4f 7f 7e ac 88 bf 8f 1c 86 3d de 86 ce 77 34 17 86 75 48 41 f5 91 8b 38 32 0b 32 6a 00 a1 8d 1e 8a 1e 5c e5 79 23 2f 28 b4 47 78 82 0d 79 42 13 5c c5 a3 7b 1b 40 c7 d3 96 09 9a 55 65 20 7f 26 dc 8c 55 3b bf a1 1d 72 40 1d 7c 3d 73 dc 18 cb 31 39 dd 8e 8b b4 0f 2c ad f7 1c 14 8e 75 b0 e3 18 8c 19 44 f6 63 4d 12 1c 96 30 bb d8 44 97 62 b6 f2 00 5a 50 3f 80 72 5d d2 40 97 4f 94 67 94 1e 3f 12 e4 bb 84 0c 0e b4 4b 09 32 21 b4 e6 e9 66 98 4f 02 3d 00 a4 53 13 ca 24 14 4f ad 2f 79 8c 99 cf 39 75 de b9 e5 84 62 14 b8 23 63 c1 2c b8 21 32 45 fe 09 2d 10 3e 37 9c a7 00 36 0e ac c2 ce d3 f3 90 a6 d1 a3 2a ef bb d9 98 44 4f 33 8f eb 28 83 42 77 8b 82 77 a9 47 93 56 69 d4 c6 5e 69 b5 4f 25 ed 23 73 66 75 7e 76 ca db 89 64 92 c4 8b 16 36 ce 14 83 5e 1f b3 cb 46 5a 44 5a 7e 02 99 2e 73 ce 6b 18 20 47 16 cc c7 f7 ec 33 d5 c5 91 63 48 38 5d 0f 66 76 a1 29 b2 e9 d1 66 3e f1 83 1f ea ec 49 d1 d2 7b b1 84 88 4a 65 61 47 39 f7 8b 25 90 37 3c f0 13 61 c8 18 9c dc 60 fa d4 5e af 65 ec 06 1b bb f6 2d 62 70 c4 02 c5 25 7a c8 52 e5 37 8e 44 df 72 08 f9 d2 f4 67 0e f4 0d 80 d1 15 d8 6b e0 da 17 72 6c 7d 98 4a ac 46 ec 39 1d dd ce a7 20 f1 44 45 76 d3 f2 bb 62 47 c4 01 46 22 fe a9 3d b0 71 52 75 71 b3 a0 4f 2a 25 44 67 8b 3c 14 d7 e1 43 97 ea 86 dd 97 2f f4 3c 4b 2c 49 c7 46 f7 8b a5 0e 60 f2 12 01 43 d7 59 0c 12 f8 b4 c4 f3 06 7d 48 92 91 85 a5 cf 32 20 4d 50 df d2 fe 7c c0 d7 1c a4 f8 7a 64 d7 75 3d 12 b5 e9 14 e2 4e 22 b3 d6 18 5d d8 fe e1 8b ae cc 18 56 46 2e 14 73 db df 66 2c fa e0 b8 5e 6e 83 27 d0 f2 fb 98 a4 34 86 db 46 2c b9 5e 9f 4a 72 6b 52 37 f0 87 df 5c a3 e1 f1 9c 67 98 8f 3a d0 45 0f d0 29 2e 2d fc ac 85 df 76 c6 38 eb b0 d6 5c 03 c0 ae 80 65 1c de b1 dc 75 fb 6f 0f 93 7f 27 d2 ab eb 4a d2 68 ab 23 85 6c 5f a4 6b 30 ff 23 ce a4 f5 48 51 95 5d c8 0c 12 d7 56 6e 1c 03 c7 bb 06 41 97 ba 33 ba 73 c4 c8 60 51 45 a4 27 51 12 74 53 15 82 be f8 d6 71 06 0c ed 84 3c 4f 76 62 a0 11 9e eb 0d 82 72 0d 0b b7 d5 ca a2 d1 b2 40 0c f6 5b 67 69 c7 52 f0 15 06 17 28 eb 3f 1d 87 ea d1 40 46 4a c6 b8 96 f1 da 7d db 80 60 04 09 a9 af 55 f5 5d 80 0a c7 9f a9 c8 69 d1 cb d7 e0 58 f4 f4 ee a7 ba 9c d5 a2 f5 1a d0 f1 9d 02 75 45 c7 e0 89 36 39 21 d6 29 e8 5c c1 33 7b 9e 8f 60 44 5c 4f 00 6f 6b 39 60 0e 83 17 88 21 ce 3a f6 22 97 99 2c e6 f8 cd 43 c1 64 7a db b0 0a 18 fb 99 41 df 97 f0 2e 14 5b 74 6d 51 2d a7 f9 05 89 d7 80 fb b9 ec aa 3f 08 59 71 80 d1 8f 71 74 7f 47 2e be 7b 04 a3 17 00 49 29 66 63 2d 60 eb e1 73 54 1e e8 d5 45 c9 2f aa 56 24 13 33 19 d3 8f 43 26 29 ad af 34 1a b1 3b 59 d9 c4 e2 a5 15 f5 1f 51 c0 51 df 76 fe 0e d0 f1 69 f6 47 35 f2 e3 27 54 67 04 61 a4 22 51 6c 55 58 08 4a 77 96 26 1e 62 de d0 ff 81 6b b0 fb 35 16 d6 08 70 8a 70 84 b9 8b 23 e7 ab c0 43 6d 4a de 07 5b 39 63 ac 72 e3 19 9d 91 0a bc 73 6c fe 0e c1 2e f7 42 77 49 e6 6e c9 32 df ef cc 75 00 ec 86 9a a5 09 8d 05 8d 36 74 ad 36 7c 98 b6 00 f7 a4 d3 46 3b 98 ed 8e c8 fe 57 52 fe 2e ad 9d d6 e9 a3 e0 b0 4c 38 ce 0b 61 13 37 34 20 4e 3b 06 09 0e 7b d0 1c 65 b9 25 ce ad 0c 13 92 8b 2f 20 c3 79 9d 9c 39 9e f4 cd a1 76 e0 1f da b0 39 a8 5b f0 ad 0a 4e ce 03 da 31 17 6c d5 65 73 b5 a1 c6 07 f9 d1 5f f3 25 e6 ed f8 e2 41 15 9f 4c c6 5e 40 9f ae ca 7c dd fe 44 4b 7e 30 e4 d7 8b 92 ce 21 6f 43 73 fc 07 06 da 20 fd 1e 7b d7 bf 67 79 19 17 74 ce 2f 96 07 f4 01 33 1d c7 11 35 04 f1 2c 8a 5f 01 a4 b7 01 09 13 dc 2f fb 69 9a c7 5c ec b2 97 10 8e c3 85 47 2d 25 a3 b8 6d 6f 3c dc 62 99 6c e2 6a 07 b1 0b e6 53 40 89 e9 fb 8f 28 4d 5a 47 c0 54 4b 5f 8b 55 df f8 32 e9 e6 e5 ed 32 0b 31 38 f0 e9 d5 69 d5 c3 20 bb b2 7c dd 5e 2f 2e e5 4e f6 45 4c c5 c0 17 76 1b 18 d8 2f 0d e5 fc 9b 38 c0 9a 7c cc 91 3e f1 c7 22 e4 1c f0 4e 56 ab 4b 24 c0 c1 f1 e8 72 fe dc e9 fb a5 1f f5 e5 ba 8f ad 6f 4c c0 d5 c9 59 0a 1b 31 d9 25 60 05 81 c1 ea 24 db 8d d4 21 42 eb f5 18 de d7 bc 4e 87 c7 78 cc 23 ec 21 9e 22 19 a9 b3 1b 5f e0 00 87 6e 7a e4 3f 93 5a 0c d1 fa 57 8c ba 09 5f f9 56 ba a4 c3 61 5a 3b de 0b 7e 2d dc 87 6d 9d e8 52 c5 53 e1 cc a0 8a ce 85 36 2f 6f 3d 63 60 b6 e5 75 aa 06 14 37 65 22 a7 18 40 99 bf 0d 6c b1 d0 88 cf 4b 08 75 46 59 5d 2d fe ef 48 89 48 53 0d 97 65 c9 c2 ee ed ce 77 de 2c 8c 10 b5 fb 45 86 f9 42 83 4f f2 38 28 38 a3 68 bb c8 6f 56 f1 3c 6e 90 8a 7c 72 f1 6c 2e fc 2a ee 41 cb 4e d7 18 b4 11 29 83 b5 af fd 53 8a b3 50 5e bd 89 39 3b bb 14 73 34 35 d0 1f 0f a2 88 0e fa 19 06 06 9b 75 5e 1a 97 85 9e ef 74 5c 14 8b 41 bf 04 44 24 04 a0 b7 97 2b 3c bf 25 47 0d 82 ce 76 42 d7 df c3 8d 27 9f dd 70 b3 8f 5d 1d 7b ed 66 67 e4 7c ca ad 03 91 c1 73 54 23 f9 11 00 d2 ad 90 7f 56 3e 49 38 93 34 6b 95 0c c6 54 fa 39 35 5f c3 b2 f4 a4 04 c1 6d 98 90 94 af ea 03 da 0c ce ff c6 d0 ae e7 96 55 cb 10 6a 98 1a 96 3a b5 04 e9 8d 8d fc b0 59 ed ca d6 a5 88 fb 4f 30 8d 4f 9b 91 43 49 6d c2 b8 ac 3a 0c b9 1b 04 c6 2a 4e 4d 35 8a 93 5f 42 e0 d8 bf ef d3 72 35 79 4b de 31 d2 4a 2f d0 d4 c2 43 79 b4 32 48 60 5c 38 ab 09 eb 6e 7d 9c ed 7e 56 66 33 0d 67 a7 4b 38 36 53 a2 db 9b 3f fa d9 5a c2 33 eb 94 ce 52 18 ae cc a4 79 1e 29 71 47 d4 79 3d d7 ef 2e 19 08 0f 04 bc b9 4c 8e ce c8 f0 22 50 05 88 bc bc 62 3b 92 4a 14 bb 17 03 a3 b2 cd 79 2b 49 1a ca 78 d4 fe 07 6a 51 1c 68 35 68 ee e6 21 d8 8d ff 27 a4 66 07 3f 2c 60 23 ab 61 ce eb de f6 dc e8 2d 72 9b 54 b3 c8 26 fe c4 50 df 77 93 b7 4a 5f 31 0f af ba 49 cb 3e 32 85 30 b1 3c 79 59 ad a3 3a c1 ae a5 d1 15 0d 8f e6 a0 6c 86 0c e0 f7 ed 05 b9 c2 b8 46 28 1f a2 68 f7 8c 50 be 42 32 58 68 64 44 12 a9 39 f0 ca 81 84 0f ac ad 87 1a 11 c0 08 69 37 86 6b 2b b3 27 93 bc d7 8d 7d 36 86 88 0b b0 35 b2 4e bd a2 41 5f c9 b2 8f 84 a0 6e 26 73 09 2b 3e b3 96 2d 97 82 05 45 28 eb f5 2a 26 30 d0 0f 1f af 6f ed 16 01 1b ab e5 ec 50 0c 36 9a 66 f9 4b 17 52 bc f6 60 65 93 5d e6 63 bf 3d 39 33 77 65 52 bd 30 47 8b 27 60 8b 9a 21 b0 ab 31 8c 0d 47 9f fc 99 36 b8 66 41 61 c7 1b 3b ef 01 01 92 f8 5b eb ca fc 16 5a af 6d 47 2d 92 79 be f4 7a 67 bf 60 c6 33 ea 98 3a 90 9f 47 ca 28 14 0b 1b 19 5f c3 8c 4a fd 10 fb 78 1a 91 a4 12 cb e1 95 6c 34 14 0a 55 04 df cc 13 ad e9 42 fa 6c 2a 60 4a c3 7c 52 5b d3 99 71 53 99 be 4b 3e 1f af 0a e5 3d 45 98 f0 30 7e db a1 82 f8 16 ad 08 28 63 cb 72 4e f4 e2 83 83 3b f0 ca b8 6a 2d 74 fc 69 b9 44 4a 42 60 06 b0 0e 0e 1b db 10 f4 0b 54 37 17 61 c0 a4 41 58 6c e8 65 4a 83 f1 5d ad 88 49 b2 60 d1 1b 06 40 aa 57 ba 2f 56 91 53 97 e8 2d c5 ae 0a 08 24 da 23 1a f5 08 6a 9d ed 6d 88 7a e2 b6 df 7e 16 95 82 c2 c4 8f 57 4d ff a6 c9 48 74 77 46 ca 99 2c 8e cb 99 22 24 2b 89 ea e2 c4 b4 24 70 dd 86 a7 96 ca 95 e9 c7 5c db 35 60 37 a7 32 ad a8 87 07 ca fe ad f4 20 19 c4 27 c7 c0 73 16 ac aa fa 1e 30 b0 5c da ca af 00 46 c3 d0 56 b4 61 b5 46 70 c4 20 5d 65 8e 46 8a 3d 36 8b 26 57 9e cc a2 bb 06 2e 21 a3 c1 78 71 ab 91 3e a9 37 94 22 09 ad 9e cb 83 f0 fc 80 76 32 ff 79 99 b5 4d 42 e2 b1 31 1e 63 20 65 ca da 66 6d bd 31 ab 2e ed 65 17 37 ca 61 e1 ff 02 f1 c7 10 a4 7e 74 35 c3 27 d4 11 71 61 82 b2 c7 5a 42 db 69 56 74 0b 0d 89 12 81 84 64 5e 3e 5b 51 40 52 3c 1f e3 76 f2 a6 af fd ae 85 0a 94 30 3f 2b 7b 67 bb d5 ac 80 aa 4e ec d1 e6 9c 1a 02 b4 5a 13 94 64 77 84 6b 05 0f 43 4b df 41 32 b0 64 f8 01 3b 11 d9 5e 95 6c e5 b8 3e 0e 04 8e 87 a1 02 52 32 f8 03 e1 8f 39 d5 17 9d 73 a2 ab a5 5e 9c 12 5a 90 ef 46 c6 1f 82 1c 8f a3 bb 7d 5c 06 c1 5e 10 71 93 1a af c2 26 7d 4d 0e cb 7b 8d 8f ce fd 8b fe a4 ee f2 61 95 54 43 52 b0 fa 87 65 45 6d e7 a2 d2 e6 d4 3b 44 de 57 7b e3 7a a9 25 75 5c 79 0e 31 b8 ee 0a c3 d1 c0 34 fc 49 f1 23 09 72 01 83 ed e2 f8 37 4c b5 ec 0b 52 90 b5 76 5a 4d 56 3b 95 45 b4 ce bd 66 eb 1a 71 b0 f7 12 d7 a4 dc 56 fc f3 8b 82 6f 40 fc b1 e6 b0 39 b9 a9 a9 64 cc 57 e6 94 ce 0a 12 bc b8 84 d0 10 fc 67 73 b4 5c 2d 45 64 a5 cb 59 98 92 7d 1d ef 03 f2 59 09 ff 6a 3e 31 da 81 84 7e b8 8e 14 2c 85 4f bc 42 29 b6 3a 3f f8 22 4d 12 23 ac 29 67 6f 5c 5b 6b 9c e2 70 c1 f0 b7 ab 75 c9 17 ae a7 fb 21 c1 e7 9c cf e0 02 84 8a 1b 00 7e d0 de 15 6e df ba 5e 58 e0 c9 e0 3f 9f 81 97 e4 9e 8d 70 d0 14 02 e7 78 57 72 4e c6 eb c1 5a c0 06 1a 3b 8f c9 66 1e a5 47 f7 c3 12 bd 11 08 67 2b 0d d9 19 5b 06 cc 9f da 32 a6 cc cf 90 2b aa 7f cc 72 68 5a f8 76 71 31 37 5b 08 2f 0f e3 97 92 bd d8 3a 17 17 af eb cf c0 f4 33 0b ed 0f 72 a9 41 4e 1f 4d 72 32 96 ac db 0a af 5f 5e d4 5f e5 81 68 17 ae ef 3f 30 ee af ce 84 8c 86 95 50 8b 49 48 97 ed 52 e6 79 ca b7 7b 25 c6 18 4f 0f 30 7e 19 a0 58 1e 01 7a ab 72 cb 5c 64 88 fc d4 e2 ce 8b 2c 73 0e 4c 0e 03 a4 7b 92 4d 6d ed f0 d1 00 75 60 80 6a 1d 7b 78 01 e0 b2 ff bb 6e 96 83 34 d0 57 bf 38 ca 68 bd e3 8c d5 6a eb b6 fe 21 c3 a7 2d 3a 7e 80 61 9d 36 e1 ec e0 af a6 22 7a 07 85 d8 17 8e 66 79 be d9 44 ec 97 ed d0 02 20 2d 9f 99 6f d6 f5 21 ea 25 52 72 21 d6 0e 96 2e e1 89 0d 69 de f2 93 ca bc 45 19 bb 54 7d e2 7d d2 cf dd 7f 83 39 d2 8d a4 f1 b5 50 10 e2 1a 97 65 e7 b2 ab 7d 59 5b 84 64 fb 61 48 70 26 b8 fe 61 6c 7c e2 06 85 01 1c 39 9e 73 0f 6c 97 12 fc 5b 4c 04 94 c3 c1 a2 4b 5a dc f5 b9 a1 77 c7 c5 81 80 cc 7c ef 5c ed f6 9c 3d 6a 4c 7a ee 24 c9 43 22 d0 3c 53 29 89 4a 65 2d da eb 49 fb 13 01 31 e3 50 71 7f 6a 35 77 3c 14 e0 c7 fc d1 76 0b 8a e0 04 2a 08 7f 2f 76 b4 cf 50 a0 1b 2a 51 ce e8 4f 09 f6 fd c3 7a 93 7a 79 a2 a2 14 26 1b 8a be 0d e8 9d e4 1d a6 69 9d d4 61 b1 a8 db ac cf 6a 33 d0 99 5b b1 1e f5 d8 e0 c0 71 a4 e8 d1 6b 7b 26 ea bc fa 79 4e 33 66 0b a4 83 bf f0 6a e0 74 57 da c9 c1 bb b7 4a b5 1a d8 8a 57 f7 08 8e d6 39 02 7a 90 b9 16 a6 52 04 9f 52 cb ca 17 d2 71 1a 5d 7c f3 e4 62 6d 49 5c b3 2c 93 9e b7 b3 59 e7 48 43 d4 a2 4c 07 7e f3 5d 85 de 8e 93 67 3f de f1 80 1d 3b 1f d9 2f 62 11 72 54 e7 fa 00 6c d5 c2 37 88 82 a3 10 be 7e 72 39 cf c9 71 2f c4 eb 37 6f ed a6 10 96 c4 5d 1e ae 5a 94 d2 e1 66 d1 c9 d7 4d a3 68 71 dd 29 55 1f 85 35 ae c1 a3 57 6e c5 7c 5f 90 83 4e df 66 11 b9 1f 47 a5 db f0 60 87 da 47 3d b7 d7 dc dc eb e4 5f} (length 0xf5c)
// }
// ath9k_bulk_packet {
// pkt_len: len = 0x36 (2 bytes)
// pkt_tag: const = 0x4e00 (2 bytes)
// data: buffer: {60 4f 1b 4d e8 31 f2 18 f3 74 12 c8 38 97 9d 29 4b 86 f8 03 65 04 cd fd 29 52 08 be a7 9a 10 40 b7 e9 1f da f2 ab 5f 21 df f1 43 79 b4 9c 02 c5 d5 67 64 e9 da b0} (length 0x36)
// }
// }
// }
// }
// ]
*(uint16_t*)0x200000000880 = 0;
*(uint16_t*)0x200000000882 = 0x4e00;
*(uint16_t*)0x200000000884 = 0;
*(uint16_t*)0x200000000886 = 0x4e00;
*(uint16_t*)0x200000000888 = 0xa1;
*(uint16_t*)0x20000000088a = 0x4e00;
memcpy((void*)0x20000000088c, "... [truncated large byte array] ...", 161);
*(uint16_t*)0x200000000930 = 0;
*(uint16_t*)0x200000000932 = 0x4e00;
*(uint16_t*)0x200000000934 = 0;
*(uint16_t*)0x200000000936 = 0x4e00;
*(uint16_t*)0x200000000938 = 0xf5c;
*(uint16_t*)0x20000000093a = 0x4e00;
memcpy((void*)0x20000000093c, "... [truncated large byte array] ...", 3932);
*(uint16_t*)0x200000001898 = 0x36;
*(uint16_t*)0x20000000189a = 0x4e00;
memcpy((void*)0x20000000189c, "... [truncated large byte array] ...", 54);
syz_usb_ep_write(/*fd=*/-1, /*ep=*/0x82, /*len=*/0x1054, /*data=*/0x200000000880);
// syz_usb_control_io arguments: [
// fd: fd_usb (resource)
// descs: nil
// resps: nil
// ]
syz_usb_control_io(/*fd=*/-1, /*descs=*/0, /*resps=*/0);
// syz_usb_control_io arguments: [
// fd: fd_usb (resource)
// descs: nil
// resps: nil
// ]
syz_usb_control_io(/*fd=*/-1, /*descs=*/0, /*resps=*/0);
// syz_usb_control_io arguments: [
// fd: fd_usb (resource)
// descs: ptr[in, vusb_descriptors] {
// vusb_descriptors {
// len: len = 0x2c (4 bytes)
// generic: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {00 00 02} (length 0x3)
// }
// }
// }
// string: nil
// bos: nil
// hub_hs: nil
// hub_ss: nil
// }
// }
// resps: nil
// ]
*(uint32_t*)0x200000000080 = 0x2c;
*(uint64_t*)0x200000000084 = 0x200000000100;
memcpy((void*)0x200000000100, "\x00\x00\x02", 3);
*(uint64_t*)0x20000000008c = 0;
*(uint64_t*)0x200000000094 = 0;
*(uint64_t*)0x20000000009c = 0;
*(uint64_t*)0x2000000000a4 = 0;
syz_usb_control_io(/*fd=*/r[0], /*descs=*/0x200000000080, /*resps=*/0);
// syz_usb_ep_write arguments: [
// fd: fd_usb (resource)
// ep: int8 = 0x81 (1 bytes)
// len: len = 0xffffff75 (8 bytes)
// data: ptr[in, buffer] {
// buffer: {b9 42 5b 44 65 1d d2 32 41 96 35 99 00 00 00 11 00 00 00 4a 16 94 1f f5 f4 b4 f1 f0 ad d7 fc f2 b8 77 fc ea ff ff ff ff ff f1 ff df 4c d9 f5 d3 96 98 90 52 2c 77 15 7d 88 01 00 00 00 3a 5b d5 53 1d 45 9d ff ff 03 00 00 00 00 00 91 ff 00 00 00 e8 f5 b3 37 1d a3 63 5b 8b 4f a6 37 13 58 00 00 1f 65 e4 b4 36 aa 9e 50 bc 0f 19 b7 d3 37 2f f9 eb ce de 1f b5 e9 42 8f 54 d5 d1 f0 cc 75 2c f2 46 a5 d2 da 34 a5 aa 97 dc 14 a4 69 c3 dd 3e 26 b4 1c 35 64 84 e4 6f d6 6e 3f 2c 78 07 e8 77 3e ed 7b 94 fa 09 9a b8 4f ea de c2 ea 95 f6 5b ba 45 2e ae 5b 09 00 f9 8a 97 9a 88 c5 17 a2 dc 36 0a 00 23 77 23 e2 f4 67 af 70 6e a1 72 26 29 6b 3a 10 a3 51 cb 47 ab a2 c6 b8 36 c9 06 79 b4 dd 85 9d dc 9e 48 00 44 8a ab 00 00 00 00 00 00 0d 75 f3 4b b5 0d 8d 70 84} (length 0xf9)
// }
// ]
memcpy((void*)0x2000000002c0, "... [truncated large byte array] ...", 249);
syz_usb_ep_write(/*fd=*/r[0], /*ep=*/0x81, /*len=*/0xffffff75, /*data=*/0x2000000002c0);
return 0;
}
]