Extracting prog: 2m30.878326245s Minimizing prog: 19m13.497751041s Simplifying prog options: 0s Extracting C: 56.4866486s Simplifying C: 25m0.319612297s extracting reproducer from 33 programs testing a last program of every proc single: executing 8 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_NEW_INTERFACE-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_SET_STATION-ioctl$KVM_SET_VCPU_EVENTS-dup-ioctl$KVM_SET_VCPU_EVENTS-ioctl$KVM_RUN detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x3, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000ff000000bfa300000000000007030000f0ffffff720af0fff8ffffff71a4f0ff000000002d040200000000001d400500000000004704000001ed00007b030000000000001d440000000000007a0a00fe00ffffffd703000040000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f320"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ec0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32, @ANYBLOB="0c009900ff071ad9da1000001400040073797a6b616c6c651310852500000000080005"], 0x54}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)={0xa0, r5, 0xa00, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0x6c, 0xbe, "111b3c42c8ac9f682b604e02e0a6b71148bafae01ed1359e366eff4448370ec7afc883f322de756f828922e6deec0944f8e116c0029fde8949176d142dd590c43e9163752c20088faad00f99694c80d69b76a4b3990d5e0c015a47e4e64759c894571de4e40c3c3e"}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x5, 0x13, [{0x6c, 0x1}]}, @NL80211_ATTR_MGMT_SUBTYPE={0x5}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x9}]}, 0xa0}, 0x1, 0x0, 0x0, 0x8010000}, 0x4008040) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000180)=@x86={0x2, 0x9, 0x4, 0x0, 0x9, 0x3, 0x3, 0x9, 0x0, 0x0, 0x0, 0xdb, 0x0, 0x8, 0x5, 0x6, 0x3, 0x7, 0x3, '\x00', 0x7, 0xffff}) r7 = dup(r2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}) ioctl$KVM_RUN(r7, 0xae80, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8=r0]) program crashed: general protection fault in qt2_read_bulk_callback single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8=r0]) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8=r0]) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8=r0]) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8]) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8=r0]) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8=r0]) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8=r0]) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0xc2, 0x0, 0x0, 0x40}}}}}}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB="a200004ef3b125948ef66b0ee0b3d41b1b", @ANYRES8=r0]) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, 0x0) program did not crash testing program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000403f5f201d0650c16fce0102030109021b00010000100509043300011870fd00090582020002"], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x40, {[@mss={0x1e, 0x4, 0xa101}, @mptcp=@mp_join={0x1e, 0x3, 0xe}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES8=r0]) program did not crash extracting C reproducer testing compiled C program (duration=1m20.265960159s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback simplifying C reproducer testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program did not crash testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program did not crash testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback testing compiled C program (duration=1m20.265960159s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_usb_connect-syz_emit_ethernet-syz_usb_control_io$hid-syz_usb_ep_write$ath9k_ep1 program crashed: general protection fault in qt2_read_bulk_callback reproducing took 47m41.182382936s repro crashed as (corrupted=false): Oops: general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc6-syzkaller-00006-g5428dc1906dd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:tty_insert_flip_char include/linux/tty_flip.h:67 [inline] RIP: 0010:qt2_process_read_urb drivers/usb/serial/quatech2.c:538 [inline] RIP: 0010:qt2_read_bulk_callback+0x3b2/0x1160 drivers/usb/serial/quatech2.c:574 Code: 00 00 42 0f b6 04 28 84 c0 0f 85 e0 08 00 00 c6 84 24 d0 00 00 00 00 48 8b 44 24 08 48 8d 98 20 01 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 0f 1b 81 fa 4c 8b 3b 4d 8d 67 08 RSP: 0018:ffffc90000007720 EFLAGS: 00010006 RAX: 0000000000000024 RBX: 0000000000000120 RCX: ffffc90000007700 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 000000000000001b RBP: ffffc90000007870 R08: ffffffff8784cba6 R09: 1ffffffff203303e R10: dffffc0000000000 R11: fffffbfff203303f R12: ffff88802890fc13 R13: dffffc0000000000 R14: 00000000000000a5 R15: ffff88802890c000 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f1fe87fe68 CR3: 000000003359c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __usb_hcd_giveback_urb+0x42c/0x6e0 drivers/usb/core/hcd.c:1650 dummy_timer+0x856/0x4620 drivers/usb/gadget/udc/dummy_hcd.c:1993 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x59b/0xd30 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:92 [inline] RIP: 0010:acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112 Code: 90 90 90 90 90 90 90 90 90 65 48 8b 04 25 00 d6 03 00 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d c5 81 a0 00 f3 0f 1e fa fb f4 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffffff8e607ca8 EFLAGS: 00000246 RAX: ffffffff8e6965c0 RBX: ffff8880206d0864 RCX: 00000000000219a1 RDX: 0000000000000001 RSI: ffff8880206d0800 RDI: ffff8880206d0864 RBP: 000000000003a9f8 R08: ffff8880b8637cdb R09: 1ffff110170c6f9b R10: dffffc0000000000 R11: ffffffff8bc8fcd0 R12: ffff88801fbab800 R13: 0000000000000001 R14: 0000000000000001 R15: ffffffff8f121820 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:699 cpuidle_enter_state+0x109/0x470 drivers/cpuidle/cpuidle.c:268 cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:389 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:230 [inline] do_idle+0x372/0x5c0 kernel/sched/idle.c:325 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:423 rest_init+0x2dc/0x300 init/main.c:747 start_kernel+0x47f/0x500 init/main.c:1102 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x147 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:tty_insert_flip_char include/linux/tty_flip.h:67 [inline] RIP: 0010:qt2_process_read_urb drivers/usb/serial/quatech2.c:538 [inline] RIP: 0010:qt2_read_bulk_callback+0x3b2/0x1160 drivers/usb/serial/quatech2.c:574 Code: 00 00 42 0f b6 04 28 84 c0 0f 85 e0 08 00 00 c6 84 24 d0 00 00 00 00 48 8b 44 24 08 48 8d 98 20 01 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 0f 1b 81 fa 4c 8b 3b 4d 8d 67 08 RSP: 0018:ffffc90000007720 EFLAGS: 00010006 RAX: 0000000000000024 RBX: 0000000000000120 RCX: ffffc90000007700 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 000000000000001b RBP: ffffc90000007870 R08: ffffffff8784cba6 R09: 1ffffffff203303e R10: dffffc0000000000 R11: fffffbfff203303f R12: ffff88802890fc13 R13: dffffc0000000000 R14: 00000000000000a5 R15: ffff88802890c000 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f1fe87fe68 CR3: 000000003359c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax 7: 84 c0 test %al,%al 9: 0f 85 e0 08 00 00 jne 0x8ef f: c6 84 24 d0 00 00 00 movb $0x0,0xd0(%rsp) 16: 00 17: 48 8b 44 24 08 mov 0x8(%rsp),%rax 1c: 48 8d 98 20 01 00 00 lea 0x120(%rax),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 0f 1b 81 fa call 0xfa811b48 39: 4c 8b 3b mov (%rbx),%r15 3c: 4d 8d 67 08 lea 0x8(%r15),%r12 final repro crashed as (corrupted=false): Oops: general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc6-syzkaller-00006-g5428dc1906dd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:tty_insert_flip_char include/linux/tty_flip.h:67 [inline] RIP: 0010:qt2_process_read_urb drivers/usb/serial/quatech2.c:538 [inline] RIP: 0010:qt2_read_bulk_callback+0x3b2/0x1160 drivers/usb/serial/quatech2.c:574 Code: 00 00 42 0f b6 04 28 84 c0 0f 85 e0 08 00 00 c6 84 24 d0 00 00 00 00 48 8b 44 24 08 48 8d 98 20 01 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 0f 1b 81 fa 4c 8b 3b 4d 8d 67 08 RSP: 0018:ffffc90000007720 EFLAGS: 00010006 RAX: 0000000000000024 RBX: 0000000000000120 RCX: ffffc90000007700 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 000000000000001b RBP: ffffc90000007870 R08: ffffffff8784cba6 R09: 1ffffffff203303e R10: dffffc0000000000 R11: fffffbfff203303f R12: ffff88802890fc13 R13: dffffc0000000000 R14: 00000000000000a5 R15: ffff88802890c000 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f1fe87fe68 CR3: 000000003359c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __usb_hcd_giveback_urb+0x42c/0x6e0 drivers/usb/core/hcd.c:1650 dummy_timer+0x856/0x4620 drivers/usb/gadget/udc/dummy_hcd.c:1993 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x59b/0xd30 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:92 [inline] RIP: 0010:acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112 Code: 90 90 90 90 90 90 90 90 90 65 48 8b 04 25 00 d6 03 00 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d c5 81 a0 00 f3 0f 1e fa fb f4 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffffff8e607ca8 EFLAGS: 00000246 RAX: ffffffff8e6965c0 RBX: ffff8880206d0864 RCX: 00000000000219a1 RDX: 0000000000000001 RSI: ffff8880206d0800 RDI: ffff8880206d0864 RBP: 000000000003a9f8 R08: ffff8880b8637cdb R09: 1ffff110170c6f9b R10: dffffc0000000000 R11: ffffffff8bc8fcd0 R12: ffff88801fbab800 R13: 0000000000000001 R14: 0000000000000001 R15: ffffffff8f121820 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:699 cpuidle_enter_state+0x109/0x470 drivers/cpuidle/cpuidle.c:268 cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:389 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:230 [inline] do_idle+0x372/0x5c0 kernel/sched/idle.c:325 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:423 rest_init+0x2dc/0x300 init/main.c:747 start_kernel+0x47f/0x500 init/main.c:1102 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x147 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:tty_insert_flip_char include/linux/tty_flip.h:67 [inline] RIP: 0010:qt2_process_read_urb drivers/usb/serial/quatech2.c:538 [inline] RIP: 0010:qt2_read_bulk_callback+0x3b2/0x1160 drivers/usb/serial/quatech2.c:574 Code: 00 00 42 0f b6 04 28 84 c0 0f 85 e0 08 00 00 c6 84 24 d0 00 00 00 00 48 8b 44 24 08 48 8d 98 20 01 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 0f 1b 81 fa 4c 8b 3b 4d 8d 67 08 RSP: 0018:ffffc90000007720 EFLAGS: 00010006 RAX: 0000000000000024 RBX: 0000000000000120 RCX: ffffc90000007700 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 000000000000001b RBP: ffffc90000007870 R08: ffffffff8784cba6 R09: 1ffffffff203303e R10: dffffc0000000000 R11: fffffbfff203303f R12: ffff88802890fc13 R13: dffffc0000000000 R14: 00000000000000a5 R15: ffff88802890c000 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f1fe87fe68 CR3: 000000003359c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax 7: 84 c0 test %al,%al 9: 0f 85 e0 08 00 00 jne 0x8ef f: c6 84 24 d0 00 00 00 movb $0x0,0xd0(%rsp) 16: 00 17: 48 8b 44 24 08 mov 0x8(%rsp),%rax 1c: 48 8d 98 20 01 00 00 lea 0x120(%rax),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 0f 1b 81 fa call 0xfa811b48 39: 4c 8b 3b mov (%rbx),%r15 3c: 4d 8d 67 08 lea 0x8(%r15),%r12