Extracting prog: 28m27.892231759s
Minimizing prog: 1h22m12.256061869s
Simplifying prog options: 8m5.003896058s
Extracting C: 3m17.897421215s
Simplifying C: 0s


extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_usb_control_io$cdc_ncm-syz_usb_connect-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x6, 0x36, &(0x7f0000000040)=ANY=[@ANYRES32=0x0], 0x0)
syz_usb_connect(0x2, 0xe7, &(0x7f0000000700)=ANY=[@ANYBLOB="120100037d5da240bb04030ac27b010203010902a60001a01380050904eb080671d1ed0506240600014b05240001000d240f0108faffffffffffffff06241a0100080905011020008103080705f4ba35c2ba09050701ff0306030409050003fe073902c332135de99a7425e65f9ba1ce393ee86e4f09e00bf659bdb094d137e4045e5d46d7e43afdb3d60833961ffcacdaf079f7bf9409050710200006050109050a10ff030504730705e97bdd47ce09050c1e40"], &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="40010400000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_connect(0x5, 0x8b6, &(0x7f0000000e40)={{0x12, 0x1, 0x250, 0x90, 0x2, 0x37, 0xff, 0x421, 0x42d, 0x46cb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8a4, 0x4, 0x0, 0x0, 0x80, 0x4e, "", [{{0x9, 0x4, 0xbf, 0xd7, 0x2, 0x2, 0x2, 0xff, 0x1, [@generic={0x7e, 0xc, "54eb5f4ce2d0173c03aba078ed6c3ad89b4f088f9dddc93504f211e101f76243ecd591a753de728d2276c5073d1770d529b3d610959bb12aea5962a1991343c12eeff6d41011b81f9f4758faa3e3dacb73a3353ecf65e4a41e27645b35e789c41a9e4a434d0d45e72ed2593a816c38174bcd536b40007e7bb0656abe"}], [{{0x9, 0x5, 0x1, 0xc, 0x200, 0x7, 0x4, 0x50}}, {{0x9, 0x5, 0x1, 0xc, 0x40, 0xfe, 0x2, 0x6}}]}}, {{0x9, 0x4, 0xf5, 0x26, 0x6, 0xff, 0x3, 0x79, 0x9, [@cdc_ecm={{0x6, 0x24, 0x6, 0x0, 0x0, ';'}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x200, 0x5, 0x1}, [@acm={0x4, 0x24, 0x2, 0xd}, @obex={0x5, 0x24, 0x15, 0xa}, @mbim_extended={0x8, 0x24, 0x1c, 0x2, 0x5, 0x8000}, @call_mgmt={0x5, 0x24, 0x1, 0x0, 0xe5}]}, @generic={0xa3, 0x23caeeb6f110540b, "69498972b78a546b44bff0683106136180df384ecdf686159e289dd54bff17557b1c79644042e90fe24593b6493428f4a5510cd03ef019d99ede188c69479de237d74ab5a26f7f69e9bf8b9513973dd8c285c9e4d3266a105f03dbdab3c4201fd790f06dd7b18c6b4a3ba5428bfde8736b3eac14713200d1608f8e5e753307b59ff0dec211713d73b1ea3c98ed0704864b9690351e3221c64238e55353860699d8"}], [{{0x9, 0x5, 0x80, 0x10, 0x200, 0x10, 0x4, 0x8e}}, {{0x9, 0x5, 0x6, 0x0, 0x400, 0x7, 0x6, 0x3}}, {{0x9, 0x5, 0xf, 0x1, 0x400, 0x7f, 0x8}}, {{0x9, 0x5, 0x0, 0x4, 0x3ff, 0x3, 0x81, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x8, 0x80, 0x8, [@generic={0x36, 0x24, "eb4666d5021932bbf308fa3d6c1d20c13016a28ab80457b3d8bad32753453f4c489feeb29c77148fa01cae5a5b8b2605dc9e8179"}]}}, {{0x9, 0x5, 0xb, 0x0, 0x200, 0x0, 0x6, 0x70, [@generic={0xe3, 0xb, "1400e0d72118d011a1f323ee8e4b6635da796c4066ae700a3f8ed4f33eb023dcf09828e8f7ba33b828b179a9b8467f165995efc122072b0d921a3ab500d71fff61081ac16921a99a1ac51d73186a95e4c577412cf4381fcd5d463f0f063b39ee678a4836c28ac77241a1f43e7006cb125c82c1f107acb2f7ee28bca3d9c36947b01ad895acfbacfc6b2e8dd2691624f5a9c7f528c40feeaf8d5613a80ef71aff2374d84f3d6ecaf47b1aae608f1b52a9a3dc2b6106a762c34b52c9e0a7cadb3322dde944aa21ff59119d272a1d214446dfdd9aab91088f56e3a28a760f7f55fd27"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x3, 0x800}]}}]}}, {{0x9, 0x4, 0x3f, 0x6, 0x6, 0x77, 0xda, 0x1e, 0xf9, [], [{{0x9, 0x5, 0x3, 0x0, 0x10, 0xb, 0xf, 0x0, [@generic={0x5a, 0x24, "f3cbcea190b4a2259432335f7544269aed15f7f293878b95c122b2958a82c522f055f1b6e110d2458e72535e428721c9a3bfaffbca03f799086f2c1e7320e44cd8e815d865d64e0387b91548bb35b8e001b2d0b3ab36359c"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xd, 0x6}]}}, {{0x9, 0x5, 0x9, 0x8, 0x40, 0xb, 0x55, 0xeb, [@generic={0x89, 0x5, "6c6a72229800562d43c03047ee1425a5600e998b6e38e58dd8898abc064ef294fadd2064035fc4424582f519f319a15f5491db54f183ca5b5ba3fb202ebd41973d66ae6ee7fbad9752c296592a0312f8ff22b0bbad878d5433718522c19197e1cfb621e11e0e75d0c8e9af933fdc39c7d118606e70d52f07c01b21e32b2daedf3fe9cc12680d20"}]}}, {{0x9, 0x5, 0x2, 0x4, 0x20, 0x80, 0x77, 0x80, [@generic={0xe, 0xd, "ef25e4d5436f3700b6e0375d"}]}}, {{0x9, 0x5, 0x6, 0x8, 0x10, 0x8, 0xab, 0x2}}, {{0x9, 0x5, 0x3, 0x0, 0x0, 0x2, 0x9c, 0x3}}, {{0x9, 0x5, 0x2, 0x0, 0x30, 0x0, 0x6, 0x9, [@generic={0xeb, 0x2, "862735dbc4fd1102150dcb54ed075471a5a6492d496d4cacda78665c1999ca6ef09c496ca12759b85711c4260e9efa2559a47dcdf2a0c9fee4dd8b71d1ff5570df335eb8c1fff0fb67c0fba82161d0790576e267b0d7516e5d95c1e76babc45678a8cb26f436ec57329771749d1fe85151a8a46683ee44631a92287e64b2e6baafc9a9db972abe3c32bb4e613b6b4849a88a3867a7c16b0470edd727ecd76a402bf560b0e9a25a2a9ba66a2393692fa2621298079d77903ac46e99d6e819716103c6ee1cee320eff1cc25079e3a98bd37dc73d3c2992be545108e1b7adb3af89ba1153cd908e224019"}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x9, 0xa6}]}}]}}, {{0x9, 0x4, 0x4b, 0x9, 0xf, 0xff, 0xff, 0xff, 0x5, [@cdc_ncm={{0xa, 0x24, 0x6, 0x0, 0x1, "0ddfd5e3ef"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x401, 0x677, 0x8, 0x6}, {0x6, 0x24, 0x1a, 0x81, 0x2}, [@network_terminal={0x7, 0x24, 0xa, 0x10, 0x7, 0x40, 0x2}, @mbim_extended={0x8, 0x24, 0x1c, 0x3, 0x7, 0x2}, @acm={0x4, 0x24, 0x2, 0x3}]}], [{{0x9, 0x5, 0x3, 0x8, 0x8, 0x1, 0x6, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x3, 0x3}, @generic={0xc4, 0x4, "40311e2a251adb8885c4ff39c021d974461cdee707f84d6b58a440efd26f6d93a9c75a86bcd0f809bc7bd0cebf27b6cf417769259a3cfadde761cb205f9c93cafdb3fae089ecf1d3b4724d9419b8a32a957819b76394e6e6bc072a5919991409173a786934361593851ec1c5d079d53421e2ab76530daeb04dea3b528b1fe2bdd770e68fd8481ef156755b3b233d231fc51f69dbf25c1bd42dd5e25bc27848cbf6676106840d97d7660988154b421efb6b19af265b41f7782c4093a251791a90f62e"}]}}, {{0x9, 0x5, 0x2, 0x10, 0x8, 0x4, 0x8, 0x11, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x9, 0xf9b9}]}}, {{0x9, 0x5, 0x7, 0x10, 0x10, 0x8, 0x7, 0x7, [@generic={0x9f, 0xf, "20526bed74d78a2e7e6f352d878aac5e70f6367f9977dc29a104041d64796e0e22a0ae22ffbe13234148f8bfdb1b0c54ebc387c3f9f5df9bce4e185fee6628d2947b0b1c1a0e001d299001bc65f021a4c0dc476cf0cdb44435bb733acee298d799272c8dbb39560b3e43cdf8cac5e7b510749f69d96e608b3ba40d50538f1aacc6e62e939eeefa788e2b017ccc1c8a7b172d27fa66707d0292830d645a"}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x4, 0x3}]}}, {{0x9, 0x5, 0x4, 0x1, 0x60, 0x4, 0x6, 0x80, [@uac_iso={0x7}]}}, {{0x9, 0x5, 0xe, 0x1, 0x40, 0xca, 0x9d, 0xf8, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x10, 0x9}, @generic={0x9b, 0x23, "6aaca9b68a2f8e5fcf5371963192e3a6e099e3f45c3769cf490de4c430b08b775b4b88a65d1334e4687571b15415d12b24136d46407ff60f7f37891481045b1a3f0a55db2fda9170ace0a46ce86f0f1880875cc23c21d7de83cdc18ab391e056a3fc5b7a600cdb7fbb361d6401e293f8d66a8a380af45539570831dc7c0b7f7a597b28b8a69da223a31a3330b17162d33452547f0a920caabe"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x200, 0x0, 0x9, 0xe}}, {{0x9, 0x5, 0x9a, 0x3, 0x400, 0xf4, 0x5, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x657}]}}, {{0x9, 0x5, 0xd, 0x11, 0x400, 0x7, 0x5, 0x3}}, {{0x9, 0x5, 0x4, 0x0, 0x400, 0xd0, 0x6, 0x40, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x3, 0x4}]}}, {{0x9, 0x5, 0xf, 0x10, 0x0, 0x7b, 0x2, 0x73, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x0, 0xec}]}}, {{0x9, 0x5, 0x6, 0xc, 0x3ff, 0x7, 0x68, 0x8b}}, {{0x9, 0x5, 0xb, 0x3, 0x20, 0x5, 0xd, 0xff, [@generic={0x20, 0xd, "32af6e881c743e872181a962b2314ba780139ad25b5c44f9b7f7175a3714"}]}}, {{0x9, 0x5, 0x80, 0x3, 0x3ff, 0x10, 0x1, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x3, 0x100}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x40, 0x8}]}}, {{0x9, 0x5, 0x9, 0x2, 0x400, 0x0, 0x7, 0xc, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0xfff6}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x7, 0x3}]}}, {{0x9, 0x5, 0x8, 0x0, 0x3ff, 0x7f, 0x5, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x5, 0x8000}, @generic={0x6b, 0xe, "e1254d8dda01491982d287bd48b148a73f8b18c92e29159fe8cbe8c2a5225bef5e0a2bc696eb4eb9026740da858475f3c5e48ace309ce75b2a9c1dd14da6171cf747d22d62945993bc4907d7ab5cec23633c5a899bd5e08a08ef0cb36475d5330396d5919084cbb1ac"}]}}]}}]}}]}}, &(0x7f0000001800)={0xa, &(0x7f0000001700)={0xa, 0x6, 0x110, 0x54, 0x1, 0x9, 0xff, 0x2}, 0x45, &(0x7f0000001740)={0x5, 0xf, 0x45, 0x5, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x6, 0x2, 0x3, 0xb}, @ssp_cap={0x1c, 0x10, 0xa, 0x8, 0x4, 0x10000, 0xf0f, 0xd, [0xff3fcf, 0x0, 0x0, 0x0]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0xf6, 0x6, 0xc}, @ssp_cap={0x10, 0x10, 0xa, 0x2, 0x1, 0x8, 0xf78f, 0xfbff, [0xff3fcf]}]}, 0x1, [{0x4, &(0x7f00000017c0)=@lang_id={0x4, 0x3, 0x408}}]})
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="00141a00000028e10a4e4f2c801840dbfba10424ebc56a5bd72d1a"], 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io-syz_open_dev$evdev-ioctl$EVIOCGNAME-syz_open_dev$char_usb-ioctl$EVIOCGMASK-syz_usb_connect-syz_usb_control_io-syz_usb_connect$uac1-syz_usb_connect-syz_usb_control_io$hid-syz_usb_connect-syz_usb_disconnect-syz_usb_control_io$printer-syz_open_dev$char_usb-ioctl$EVIOCGMASK-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$rtl8150-syz_usb_control_io$lan78xx-syz_usb_control_io$rtl8150-syz_usb_control_io$uac1-syz_usb_connect$printer-syz_usb_connect-syz_usb_control_io$uac1
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000080), 0x5, 0x1c30c0)
ioctl$EVIOCGNAME(r1, 0x80404506, 0xffffffffffffffff)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b04, 0x0)
r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)={0x0, 0x0, 0x1, '\"'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r4 = syz_usb_connect$uac1(0x2, 0x83, &(0x7f0000001d00)=ANY=[@ANYBLOB="1201110300000020d118052d4000010203010902710003017f80040904000000010100000a240100000a000200020904010000010200005bb1332fc75c8c6200090501092000"], &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0})
r5 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fc"], 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000001c0), 0x0}, 0x0)
r6 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503"], 0x0)
syz_usb_disconnect(r6)
syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000005c0)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYRESOCT=r1, @ANYRES8=r2, @ANYRES64=r3, @ANYRESOCT=r4, @ANYRES16=r6, @ANYRES32=0x0, @ANYRES32=r1, @ANYRES8=r1], 0x0, 0x0, 0x0, 0x0, 0x0})
r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r7, 0x80015b1a, 0x0)
r8 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x6666, 0x8802, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x130, 0xc9, "", [{{0x9, 0x4, 0x0, 0xe, 0x1, 0x3, 0x1, 0x1, 0x0, {0x9, 0x21, 0xa, 0x77, 0x1, {0x22, 0x7e6}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x5, 0x48}}}}}]}}]}}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
syz_usb_control_io(r8, 0x0, 0x0)
syz_usb_control_io$hid(r8, 0x0, 0x0)
syz_usb_control_io(r8, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0022180000000501150091a60906a101200182008c0508951329309102c0"], 0x0}, 0x0)
syz_usb_control_io$rtl8150(r3, &(0x7f0000000200)={0x14, &(0x7f0000000100)={0x20, 0xe, 0xad, {0xad, 0x22, "d603a277ab76fb810921ca5aec7b861f78145ce9f7c4d31f2519b9dc24ff12dbe21e6a45198e67a5b2b9ad134a0c2d3f405ab81f0da1da903105e66a02dc822af42ec7e88dec95f3a34ccd10bfadb734c18bfcdda7970036e5050b35fd3e90a616b6cefa4a22383cf9e6fab0c1fa1aa033f68f1f6203111079ec236c121dbc49096b2d1316af1c444aa7bdfa6b45fcf72e37e9d8421ae41a84b9ed353332fc1aeda4359f6af6d0acef85b4"}}, &(0x7f0000000840)=ANY=[@ANYBLOB="0003099e80bce24266a900000009035f74bb5ddb3264e7ed29b7918eaff429f5e1fa059dc9e97e3e29898b2708d4d68a8e6850723ce1834a67d619342bbe74b11d2dfe0d349ace87f642e9cbcb9ce108119307776eaa555c374e311426ca1c6177af05a38ef617ed6641172d8a009f2cf9d29b25caf285f8e372e7057e6103dffe03ba73a0bbadbc36e373182de1ac5139ce53620682a80202edca0812e84132da0d06ceb40723978e4704304abb63d76c466d"]}, &(0x7f00000003c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="1713120000000d63dd7943977a4b84d8"], &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x19}, &(0x7f0000000340)={0xc0, 0x5, 0x3, "5cb311"}, &(0x7f0000000380)={0x40, 0x5, 0x5, "35c780bad9"}})
syz_usb_control_io$lan78xx(r8, 0x0, 0x0)
syz_usb_control_io$rtl8150(r8, &(0x7f0000000240)={0x14, &(0x7f00000000c0)=ANY=[], 0x0}, 0x0)
syz_usb_control_io$uac1(r3, 0x0, 0x0)
syz_usb_connect$printer(0x1f, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582"], 0x0)
syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110019bde521023398a71"], 0x0)
syz_usb_control_io$uac1(r3, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io$hid-syz_usb_connect-syz_open_dev$evdev-write$char_usb-syz_usb_connect-syz_usb_control_io$hid-syz_usb_connect$hid-syz_open_dev$evdev-syz_usb_ep_write$ath9k_ep1-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_connect-syz_usb_control_io$hid-syz_usb_connect$rtl8150-syz_usb_control_io$rtl8150-syz_usb_control_io$rtl8150-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_write-syz_usb_connect$midi-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-read$char_usb-syz_usb_ep_write$ath9k_ep1-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x46d, 0xc24f, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xbd}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0022180000000501150091a60906a101200182008c0508951329309102c0"], 0x0}, 0x0)
r1 = syz_usb_connect(0x2, 0x36, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_connect(0x5, 0x3d, &(0x7f0000000200)=ANY=[@ANYRES16=r0], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x28, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x423}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1401}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0xf8ff}}, {0x4e, &(0x7f0000000400)=@string={0x4e, 0x3, "179861c7d06878e8492438d057fba756419159a963c0099959888383cace6a9ea3dfa531e885645dbfbe8c85832cae2770556e608849ca25b48fad010f31f1a6f2293181bba4d8bc39f35a4e"}}]})
r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x903d01)
write$char_usb(r2, 0x0, 0xfedd)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109"], 0x0)
syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x80900)
syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xa8, &(0x7f0000000000)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b"])
r4 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c000000000000109"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
syz_usb_connect(0x1, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000048"], 0x0)
syz_usb_control_io$hid(r4, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022440000000600ff0901a10185110902150026ff0075089502810285210903150002000000089501810285910981150026ff00750895219102c0"], 0x0}, 0x0)
r5 = syz_usb_connect$rtl8150(0x1, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0)
syz_usb_control_io$rtl8150(r5, 0x0, 0x0)
syz_usb_control_io$rtl8150(r5, 0x0, &(0x7f0000001680)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="b430fe2a1e6b26c8e2d4b432baf14790c7aba30367694445e4503ad65eb80f74406117037b21a54f47e554e46e00c8a1639a5d60cb0766c3375374ab0000000000000000"]})
syz_usb_control_io(r5, 0x0, 0x0)
syz_usb_control_io(r5, 0x0, 0x0)
syz_usb_ep_write(r5, 0x83, 0x0, 0x0)
syz_usb_connect$midi(0x3, 0x24, &(0x7f0000000c00)=ANY=[@ANYBLOB="1201000200000010e8096200400001020301090212000101008008090400020001020040841f37c228598fc4db1866bc61de9e5d80ac1aab1d17554fdf671c0c6a002c8d95fb5abeadc18f5868af560f80bc45a42860f279c56d1c04c4be1209f287966090a0e18582a53bc0ea26f970fbdc9f30067bbf76a1de9dcfb570d4f62e351a5ba98e34cb27e9fd72e3dc36985070e8b6b59a74ad2e98d19fb4770ea05601ff552f5111815d49461f2a3a698b", @ANYRES32=r1, @ANYRESHEX=r4], 0x0)
r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0)
syz_usb_control_io(r6, 0x0, 0x0)
r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r7, &(0x7f0000000480)=""/74, 0x49)
syz_usb_ep_write$ath9k_ep1(r6, 0x82, 0x494, &(0x7f0000000d00)=ANY=[@ANYRESDEC=r6, @ANYRES8, @ANYBLOB="2751076a8b829ac4a1a9aec0ab8b9081abb1d62becfaad87ab2073e8af8965853391ade34c6016569e7c972d0747e109ead98e69fc7d265eea7c001d65fa6c2e5ed2c19b66a438eae507d71e4797d78abdf618eb1d08fe195d86dc13c648bfdbb9f974d7c0fea613f2fe001d0d84955bc33b7784cf4d974b6ec94b9899c5fb0148462b5bf11f00ac5532de292514e683556272765de02e08f1db0943cdaf838ef040d1edb731d4c4885afc0a5e4ad4f38bfec668612e0c3d49131705969aeb40d9bbc0a0d6279d9790d87488e3c5b42d3e3e5360eab12ec0786bc3e8c7aafe1eca0c199d", @ANYRES64=r7, @ANYRESOCT, @ANYRES16=r6, @ANYRES64=r4, @ANYBLOB="a93d5a0ba718f57231e11dc57c5e1d5b3ce586d5f1086ef81da6038279bddc7ed76fbbde9dd67aafb1516f91d35ecc0bffa421ea075528f25ebde6c73a9e441cc32d308ea696f2ab693e6de5bdb65d3410b5e65907934fe52f5de755e74e1712bb30a2d69b071f3b561e22e39fab8de8ff8270f88ccc74097a3d59190660362566220f1b7a78f8b3a2c28ef3b7f12d4e080a2faad82b232f2255736697ed3fb41c567ef83afb126c207d0892d9d9b641acef91301ce13c8b8341ef5d35e34f993ca7988ee866f3135bc22c6677af1f4ad2f568a03a7c355d2227fda61cc4a21e5e5f017c51fb784179f5154c158e048e2f633465f5d36fe01db6429971f1f084181e8e4a6beeea11ac7f9cd2d35caf1312c09f8ebfed5c935c61ed9e25ec9e4171ea2dad928f05c07db96da1a6abb7fd633d1fcd730250910e4e09f071029fc4384bd01f6e5224dfc08e7168d70e2580004ade2f52339b61ee471209e2c4d11be3cfaeb6f72fbe15842f0259f215a3626532f973787b57bd7dce780778a90c0ff45cbf4a9604c419f854926e5434f4f9c6af75cdaeaa1c5e4be2056f1d143190fde8c1d135ff6586ee0ce5764f566048c41c3fe457db114347b226c1b311903cfeaa5b010c52755e7293b78107f3bb498970eb05eb53e1d715207986699b25036506c93c4d8a56646a424e13f796bc137f409ef0f5b1732484bfad4436d93d01d4d865ef8c8ff6cc127d98ccae198090e198fa8f25021516c8053600f8deab5f3bbcd6b350e2072e58b3bf81c6817d9013f633d4085cd43d9edfa5d03002c94bcc748ade3a12efcf46ce660391495b2a8b1f0aaa0c82275a62a61c94ade689cebd5b55864848a6cc430c0c8e67001f0d006aa5a0be6628dcbb88b17b16cf947ad22011974af22a090eec5f4b6544b50bb31547c6a0bff723d6de1bcc0d9851b726f73e1c64a055859cb9c7c3267b484246e442c96484e595e3d562ccc567681c7866f3daec761768616a95c56d40f98fbf6ea3e8cd815bef9bcbacbde13e18226c998c667ee307839aa313317896e92e0e95b0a16771b978b9dda9e501374bd86afe39d9eb081e93a18d51861eed1be9f0660882d0"])
syz_usb_connect(0x0, 0x24, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io$cdc_ecm-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ncm-syz_usb_control_io$printer-syz_usb_control_io$hid-syz_open_dev$evdev-ioctl$EVIOCSFF-syz_open_dev$evdev-ioctl$EVIOCGSND-ioctl$EVIOCGRAB-syz_usb_control_io$rtl8150-syz_usb_connect$cdc_ecm-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ecm-syz_usb_control_io$uac1-ioctl$EVIOCRMFF-syz_usb_control_io$uac2-syz_open_dev$evdev-ioctl$EVIOCSCLOCKID-syz_usb_connect$rtl8150-syz_usb_connect$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-ioctl$EVIOCGLED-syz_usb_control_io$uac2-ioctl$EVIOCSMASK
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x35a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xdb, 0x70, 0x5a, 0x20, 0xbaf, 0x121, 0xa3c3, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x348, 0x1, 0x5, 0x1, 0x20, 0xc0, "", [{{0x9, 0x4, 0x97, 0x7, 0x1, 0x28, 0x88, 0x69, 0x7, [@cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "973f07d3"}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0xfffffff8, 0x9, 0xa, 0x8}, [@mdlm_detail={0xe9, 0x24, 0x13, 0x2, "327a5df08a6a82f8347901cfdd83e56bb68bfa055968df82aa84fb4207fe883b7cd3b704e1e1a9d1d9ac80e957bae5243db135c6812454fd221f680d7873749e6d351dcff8a57b147ea368dd753674b062d63410a9536cc2437458dbd137aab1b061b9b08c4b1bb932f6cd4c3749a132d84dec312ad7201084ad768930fe2d3d95bafff8ea7a2d23d91571886436b568f9d29214ce7dd29085d67dbb079463ea21022bdce04c469c18ddd1e93a0b2dc7e4e2e49a4e32edd835c26a32fabd515c9b6c48dcb317778faff57ca11b267ad2efc5a5a24258dc3095a0028fea7ed16312665aa152"}, @network_terminal={0x7, 0x24, 0xa, 0xa0, 0x2, 0x5, 0xe}]}, @uac_as={[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x100, 0x2, 0x4, "abda2abf3871"}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x9c, 0x1, 0x3, 0xc9, "4806de", '\"'}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x7, 0x5, 0x6, "fbc5"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0xe7b, 0x8, 0x80, "2f6112f7efb90235ca"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x5, 0x3c3, 0x84, 0x7}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x5, 0x1, 0x77, "80aff2a61eab"}]}], [{{0x9, 0x5, 0xc, 0x10, 0x40, 0x3, 0xc, 0x3, [@generic={0x100, 0x4, "1339b5759a4e67e674475e1a2e74648da73f58ba53fb0c5b9d06f0b9b79779d9b88ea0f63bd436e55ac64ab4eec00aff38f5648444c4dff172d1b6f9159719dd2324c33054fd9f2d1af9d5c278cbab0b3e670ce0c6d218ce838073fa1f8985c84bd0e10e259c1c1da331a19f3cfe321d9acf5db0c9a924c75500eb56b36f52010d55648d824a33ba4ba6e6df7582f77119f62659d868c95c1313674f559d866229e55077935042cfa992ed21a8d0555888caf27a993efe77d2a75d471c7cfbe031353f8af5b8da13b961e1624426d9031ad73eed0ce94af596a1624abc28bc4ef403850cb32417d01b5520813657a6c76039d817db30302d31383824f862"}, @generic={0xd1, 0x30, "2f33e202c07646ac0f1229eb59c5fa47c5f11772749bb0e9745d77226c7c93686d94bfd4bb59b38a2a8ea83661307c1252f2ecef2a35d6f1ece6e0843c019d2195c82b7efe7ddef87cb42c56129c651768d227d84a315de51388be55df9c8fbc4fbae9aafb45e9e42e270aa4ac12a3c59fab08220205b2a359d370bb06b1d496aa31d838a03ec5dd0e44fd27ab4537d55aee1f4418f4452c02d89ff97acd1f5207e48a909ce9154a49608de81ec2be85b5af68bcb912cc6fb7c5cb5fce850e53fcbe5b5406a74f895ce22937145093"}]}}]}}]}}]}}, &(0x7f0000000840)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x310, 0x88, 0xc, 0xb, 0x10, 0x2}, 0xf, &(0x7f00000003c0)={0x5, 0xf, 0xf, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x12, 0x5, 0xa, 0x7738}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000400)=@string={0xca, 0x3, "65f2dfc4c2673a2fe5d1676f57ed2b860e8c4090a83ccb694110fafcce1c09cf7253815f372b921f8595192e869f6384cc4ee86feb5da1bef690ede1cbacebccfedc1985f279a5c272bbc7171032989b17edc0da63b3dd63bee7b6aa9be8e6daaaf97253d6f1c6bca291c8d5404a75b3871d028f31b6d5dfbb3169c0570043d70274e7f40690bff037403facd940a038208a65fd8abc739b1295316ef7435fdaa259e0095cf510fe8c51942910982f321b52be46abb916a18b69388dc4969ac6c526174108feeb8e"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x340a}}, {0x7, &(0x7f0000000540)=@string={0x7, 0x3, "655822d519"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x3009}}, {0xe5, &(0x7f00000005c0)=@string={0xe5, 0x3, "90829ab8c5f2ee3731e30fd2cbd1c2d01887cd816085f55e63b5e39fce6305133d72753810824d5bf4865f993a05e10cf0d7fb93410e7f90f67ddad4ed7c0a1242562ae16111df937130a149d314aa4d39fda38cba842f8ea918a5896836bbf993b7af50a8e53209b0d0207b47a6c6f4b0bd164f8d21a263191feadd3493a49b0530d6c17b34163d08f1661d18db17fb39cd97e89c88ade3b2a3821505d6de6c0b7cb29b000d10ae5293e7877b5dbc17aba92a4c32266376d379f6961f4869fcf0f20a34604373a1a2c31d39de819b08fe86ab7be30f0e986ad2fd0d9adae52eda64f4"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x41d}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x80c}}, {0xaf, &(0x7f0000000740)=@string={0xaf, 0x3, "b4e46b2f354d2aee66d3f95560b0b1ca15faf5f50ceb636c5a1ed93b2fa97a623fea5772d8be5eeef6ae6fa151e016cdd6e2218707d47fba46de1ab31ff610eeadcd9dc1791a1042d9f3961f946df45f36928058c682ae572d994d3649cabe02682ffb28c7ed691a7909f971652ebb481300e1649ced034013a77f99c3981ab46ae7d059dd00b54e72cc38506a4da859a39dda11f55bd248eb875a3521be2aaa9170666ab8ff7f7f18eb63ec35"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x425}}]})
syz_usb_control_io$rtl8150(r0, &(0x7f00000009c0)={0x14, &(0x7f0000000900)={0x40, 0x24, 0x5a, {0x5a, 0x6, "49881688c2af3faccb25e88e400da651e10513ddb2e4971421d660897ac7d5c76876b3f7f8fe52d4d5cb3bfb9bd24ee55098b5f76783bc155a5052564f49e8e317d36f6a9cd971c0f53e622ea67fd29601e8d1557af77fb2"}}, &(0x7f0000000980)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x43e}}}, &(0x7f0000000bc0)={0x2c, &(0x7f0000000a00)={0x20, 0x7, 0x97, "408bd77f398012311f9429cd411e760a247e6cdf4ababcd515c50ea6c065a94442b585287f589e64c48fb45671e97c3f474a06372cf55a409d20f4ee17fe1f4c2a4bd5cb34364642159460665afa50b823b275e29fd7d58c29a3f752a739f43cae0c063e31773e7f5537dfe89086514f23bf74d640340081d473d1784a4c70b02061be7797821ee41218097b4f57c4e50ed125e7589dcd"}, &(0x7f0000000ac0)={0x0, 0xa, 0x1, 0x81}, &(0x7f0000000b00)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000b40)={0xc0, 0x5, 0x5, "462cd850d1"}, &(0x7f0000000b80)={0x40, 0x5, 0x3, "d26c74"}})
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000c40)={0x14, &(0x7f0000000c00)={0x40, 0x31, 0x27, {0x27, 0x24, "e09487ffb7886ebd11a0a92c515b1568936890ccc4ace33addcaa7a4fbc27d99b7cfffd536"}}, 0xfffffffffffffffc}, &(0x7f0000000d80)={0x1c, &(0x7f0000000c80)={0x0, 0xc, 0x4a, "542249933b6a0f6b878d0ac9370303c100538fe74d26b264675a7725a9f4ad3ed8425c93b56140dbb6af71ba80f443f3eb530f183b0be6d83022b35eba85c141d456d75e208636e0a757"}, &(0x7f0000000d00)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000d40)={0x0, 0x8, 0x1, 0x9}})
syz_usb_control_io(r0, &(0x7f0000000f80)={0x2c, &(0x7f0000000dc0)={0x0, 0x22, 0x4b, {0x4b, 0x23, "c765716cb77bcd2f442c9bab26d77412d58fa66b3edd7ee970f6bea0fe3768b0d09b9965b466e9ba19d323a552ca31e4f37da5695397d78c8d6be88072523801b904eb0870b7d16cfe"}}, &(0x7f0000000e40)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}, &(0x7f0000000e80)={0x0, 0xf, 0x52, {0x5, 0xf, 0x52, 0x2, [@generic={0x43, 0x10, 0x1, "759778a6510ae6182ed141b32a94c888d3312d9341005da2cc20d02b6ead44e38e8ab57a8a1bc63e9b6a8f640331f2f02d114b3f48f77bcbfa1f57f8676c17a9"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0xb, 0x4, 0x9}]}}, &(0x7f0000000f00)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x1, 0x1, 0x34, "af251a0e", "38314e82"}}, &(0x7f0000000f40)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x18, 0x6f, 0x1, 0x30, 0x5, 0x9}}}, &(0x7f0000001440)={0x84, &(0x7f0000000fc0)={0x0, 0x14, 0xad, "c72c008fe77e25c9efa722b3fb3ed489a5beb397840190358fe4075aec95dfc6455ad79fba0bbb8a02700ac056fe7cdbf90bab24fcac65de733ce0aafb41cbd4c2ef7acb7d037b904103e2cb60f66cec77c9553289def1a371a12b4ba6b744469cbd50b466b12ea2515605e2b1a8735f8892d52e9d3b30ed2c734b0fea733d239019d98bb140f1c36d08b7049076906fbbd9cf4186917b5256fefdf418258566974f898f60fbf960ca63c75d5e"}, &(0x7f0000001080)={0x0, 0xa, 0x1, 0xaa}, &(0x7f00000010c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000001100)={0x20, 0x0, 0x4, {0x0, 0x1}}, &(0x7f0000001140)={0x20, 0x0, 0x8, {0x1, 0x5, [0xf000]}}, &(0x7f0000001180)={0x40, 0x7, 0x2, 0x1000}, &(0x7f00000011c0)={0x40, 0x9, 0x1, 0x5}, &(0x7f0000001200)={0x40, 0xb, 0x2, "fc42"}, &(0x7f0000001240)={0x40, 0xf, 0x2, 0xd100}, &(0x7f0000001280)={0x40, 0x13, 0x6, @random="ab60112b2515"}, &(0x7f00000012c0)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, &(0x7f0000001300)={0x40, 0x19, 0x2, "886d"}, &(0x7f0000001340)={0x40, 0x1a, 0x2, 0x8}, &(0x7f0000001380)={0x40, 0x1c, 0x1, 0x40}, &(0x7f00000013c0)={0x40, 0x1e, 0x1, 0x7}, &(0x7f0000001400)={0x40, 0x21, 0x1, 0x8}})
syz_usb_control_io$uac1(r0, &(0x7f0000001600)={0x14, &(0x7f0000001500)={0x40, 0x4, 0xa1, {0xa1, 0x6, "43406b7862a0cadcaa0a0fe707817054a163685ab9a9fcedec86ffa3e002c8a63c88102e099972980b7795477e15d89c38c34226a34c3e3ebc0d3ad67834e9a92c63739a45e56fa72e9c5f300c858757440dd6468ee4820d1e6503672c9c081ce17aa2f1fd12c844a5e71e86d12646b8c767f4f156af3127680e0f4656e7148e10000d78ce3944d769a868757051656c07c95960c10a58e10eb4930a8adaa9"}}, &(0x7f00000015c0)={0x0, 0x3, 0x17, @string={0x17, 0x3, "f8400ed538a4ff733ec6d87156d497faf637582502"}}}, &(0x7f00000018c0)={0x44, &(0x7f0000001640)={0x40, 0xc, 0x84, "35203d21c93754ebed8e1f5088701728d688b13cd044465e4dcd80ba091b403445942e66a717a1e6df3f6122c0b166428e5f5d4d9117b60331921d731bcd64f84237cec6dc93a8b39f1fd6524bfa3ba8b30a2aa828f07eef3313f59ee1929be2e0af07c8402c17fa2c77b0c4a3380e9796f24b4d1b6a7c0a2c4e505b193388a1c4926012"}, &(0x7f0000001700)={0x0, 0xa, 0x1, 0xf}, &(0x7f0000001740)={0x0, 0x8, 0x1, 0x80}, &(0x7f0000001780)={0x20, 0x81, 0x3, "6a8d55"}, &(0x7f00000017c0)={0x20, 0x82, 0x3, "07ded3"}, &(0x7f0000001800)={0x20, 0x83, 0x1, "f7"}, &(0x7f0000001840)={0x20, 0x84, 0x3, "a3d63c"}, &(0x7f0000001880)={0x20, 0x85, 0x3, "03ddf3"}})
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000001a40)={0x14, &(0x7f0000001940)={0x0, 0x31, 0x7b, {0x7b, 0x4, "76f23a7589bb612b37a1f38c644b3e09a55e265af130b8f065de30e890303a5a83657eba44c7da2dda70fcb5d54bebf36915dee67c07f5580e51645da4ba8e35d3bf4c2d46fed0efc594e03e5c1c6a0fa9d91232d0d02c0456c2d460836e4c60065d76fe520cbedceb1008e5e67fbd5f6c12776db47457db2d"}}, &(0x7f0000001a00)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001c80)={0x44, &(0x7f0000001a80)={0x40, 0xe, 0xd, "72bf34889f6ebe66632d4e0754"}, &(0x7f0000001ac0)={0x0, 0xa, 0x1, 0xc}, &(0x7f0000001b00)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000001b40)={0x20, 0x80, 0x1c, {0x6, 0x3, 0x5, 0xe28f, 0xdaa, 0x7, 0x7, 0x800, 0x0, 0x1ff, 0x8, 0x9}}, &(0x7f0000001b80)={0x20, 0x85, 0x4, 0xd}, &(0x7f0000001bc0)={0x20, 0x83, 0x2}, &(0x7f0000001c00)={0x20, 0x87, 0x2, 0x1}, &(0x7f0000001c40)={0x20, 0x89, 0x2}})
syz_usb_control_io$printer(r0, &(0x7f0000001e00)={0x14, &(0x7f0000001d00)={0x0, 0x9, 0xb8, {0xb8, 0x21, "721ad21c12a6fe97b4d68c1899c6ffac3418fc1e413b68fc33b7ff1b31829550e04e1b4153b44cc9d7e93e5e15a9eb19dc3e06ce57b12ec2b78c3c1b3775ee39d3a717ce723ea6a4cf498af6d243d7df3e7eb597b87f0f0c2fd7620a62ec9887b995fefc540c5250a4d71b90225e0bb0656fa75bbe05bd6d705a1b22df4c6bef0900de85101085e73cecde8ad798103dce9dcef6d827c0c46de06597fa175bbe5410e22990a56c503fd096ae600c0e2d8316aa10bdbf"}}, &(0x7f0000001dc0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x80c}}}, &(0x7f0000002040)={0x34, &(0x7f0000001e40)={0x40, 0x5, 0x7, "e398959d00613c"}, &(0x7f0000001e80)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000001ec0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000001f00)={0x20, 0x0, 0x86, {0x84, "f8aec103d7a54bbfe521d40f6dd2cb024b6e3a4f4d4154071f742cc329a55e3ecb2146bb3c98b1f8625ce2cc50a985a75cb4ebfc845f72975da7efbcb5609258daf1a433736f34e412a4123c21311f0e760cafc4dda53e755732dad9e65bac2d1583b4ddaa20b4cea3683741489d476f16e2c537f256d7189dcdfec17a43e6382108c7ce"}}, &(0x7f0000001fc0)={0x20, 0x1, 0x1, 0xfa}, &(0x7f0000002000)={0x20, 0x0, 0x1, 0xc}})
syz_usb_control_io$hid(r0, &(0x7f0000002200)={0x24, &(0x7f0000002080)={0x0, 0x22, 0xb, {0xb, 0x4, "e14b2d661d4895baea"}}, &(0x7f00000020c0)={0x0, 0x3, 0x7b, @string={0x7b, 0x3, "8f2e5be49d510c1a56df8537c2c0ec2374e52864a43b909f88fcb7e4bef344ed898d6a9f47b2941e0d61fa5c58d18e2f9d5ffcb4c19ad14751d4a51c7adbeaed5f7b813189fd738124955c37b1be5dfe195d3dca2ec8d3ccab5970565935de622af654cffad7f13f00d69660c0ed42753eae04f4f2d7848015"}}, &(0x7f0000002180)={0x0, 0x22, 0x15, {[@local=@item_4={0x3, 0x2, 0x9, "34f12127"}, @main=@item_012={0x0, 0x0, 0xb}, @global=@item_4={0x3, 0x1, 0x0, "46be222e"}, @global=@item_4={0x3, 0x1, 0x6, "96ffb13c"}, @local=@item_4={0x3, 0x2, 0x0, "abacb758"}]}}, &(0x7f00000021c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x3, 0x5, 0x1, {0x22, 0x532}}}}, &(0x7f0000002400)={0x2c, &(0x7f0000002240)={0x20, 0xb, 0x60, "e55620c3edf12b5a381745c58ed0bfcd8c3de258d0359e3d86f81a757ff4bbd44a8bae15d981e8bf547b96d6d29061ffddb4f245348f873c5ebae1a303904e660d9a6353e9c59a66ebb40f24cb4f100c6de2faa237e4abdb4c5cbbda83674b95"}, &(0x7f00000022c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000002300)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000002340)={0x20, 0x1, 0x41, "b4a020e157d6bbe2085966c28670b94fcf57f34ba8e559ca1816555715741c92db10f1637217aaaf26efe33e6e3823d8e5a4e8afff235167dada749e5680b06a3c"}, &(0x7f00000023c0)={0x20, 0x3, 0x1, 0x1}})
r1 = syz_open_dev$evdev(&(0x7f0000002440), 0x1, 0x40180)
ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000002480)={0x52, 0xa, 0x677, {0xc, 0x100}, {0x9, 0x8}, @rumble={0xdd2, 0x100}})
r2 = syz_open_dev$evdev(&(0x7f00000024c0), 0x681b9337, 0x4001)
ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f0000002500)=""/111)
ioctl$EVIOCGRAB(r2, 0x40044590, 0xfffffffffffffffc)
syz_usb_control_io$rtl8150(r0, &(0x7f0000002680)={0x14, &(0x7f0000002580)={0x0, 0x4, 0x89, {0x89, 0x6, "0a5d7b5be6e9c8706ed5691343db017ef4b128ae61038b6da1aa71dc8d27a2cd0c837e9aec6c97fb044cd938259ee5e8d46921106004125d557c6dd1e8b69c426ed4efc565f5f0e25457a1db724a2a2e1c1c8a053aca3d3ed8c0cd6cb07a6029fc69a36bdc6dccd8d86a8a7ac3f611fa80aa38690a12fe533472040de10b6f65ea1e3b0951c65a"}}, &(0x7f0000002640)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x820}}}, &(0x7f0000002880)={0x2c, &(0x7f00000026c0)={0x0, 0x13, 0xa4, "783ebcd7822b81392c1b9693ae1019eb2fb796d82a50bc46f78d9b52f5449d14c9ec730703c25063e9a266ac6684307b0aa7a8a8d1e0121a260fa92db2594cf00f668e79e0f76cc6e24020f630fcace3d201723b20887d6acfba02af2bcd7d0e576350e8c98520de02cc875bab2d01de3a40eb97e25876aee9566ff0cfaec68f9956046f363a963a77b77f20d118aa840341112b6428c526f8fd8fa840e286b362b3b90d"}, &(0x7f0000002780)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000027c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000002800)={0xc0, 0x5, 0x1, 'a'}, &(0x7f0000002840)})
syz_usb_connect$cdc_ecm(0x3, 0x80, &(0x7f00000028c0)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x1, 0x1, 0x10, 0x0, 0xd0, "", [{{0x9, 0x4, 0x0, 0x1, 0x3, 0x2, 0x6, 0x0, 0x7, {{0x5}, {0x5, 0x24, 0x0, 0xffff}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x7f, 0xc09, 0x4}, [@mdlm={0x15, 0x24, 0x12, 0x101}, @mbim={0xc, 0x24, 0x1b, 0x79a8, 0x5, 0xe, 0x2, 0x8, 0xb}, @country_functional={0x12, 0x24, 0x7, 0x0, 0x2, [0xf46a, 0x8, 0x1, 0x7664, 0x2, 0x4]}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x5, 0x81, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x1, 0xb, 0x6}}}}}]}}]}}, &(0x7f0000002f00)={0xa, &(0x7f0000002940)={0xa, 0x6, 0x250, 0xff, 0x3, 0x2, 0x58, 0x6}, 0xf, &(0x7f0000002980)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x18, 0x5, 0x0, 0x80}]}, 0x8, [{0x8f, &(0x7f00000029c0)=@string={0x8f, 0x3, "7b50fe37b8dd97bcbb8b6ad4cb61307b01bc340df287adb5ed4cc2b44ce4e40258eb967f14067e26dea33d7379530e78907c26f0002b7f2a440719b2e7908ef699c0c65d781916dba9ba0b6dc850598cbc1a8b3df64d0b7c176cc981f59d11107526fa1ac591dfa7ed5a0d832ad183807c54ed89562a35f886f76189d2765013044ec588234acec85bd06e502e"}}, {0xdf, &(0x7f0000002a80)=@string={0xdf, 0x3, "7a1f94b1017435219947b5b14658d119fc682ac264965b028f28aeb73c71449e3e59522979557ef6a738535c7f0a8eb964c9edd010b8ce3cc4ce3e19f491630cab42ce1b4fabcce95a6c3ccf5c9cdd21df3ec25ac32af963fd58d3c01c921bef892902e1d8d44daabbba35da8b95ed32ff8a7aea4135dbf6b98b691c6cce8878a077290e91f4bb3743145f6b6ee191e4e8766346d285600d1f26ba9d413aafdfa3daa6e72e8131878a960b473acf59f6b4441cd7b19b779ef12cd7d6ca7021e1b33eff44f24ceedca9fa541924f9a43f08d8206efc7f7efe4dfdeb97cc"}}, {0x4c, &(0x7f0000002b80)=@string={0x4c, 0x3, "2b2097aa7ad65a9d9b916780fc33eb0ef6821c089e34d10f0d5aaa25ba26bd8dd8a412683dd69393f0fd0b212e19d92f2c2b72691b3fd97a8244fbea19c0c3f7b3239fa5b8af75cad303"}}, {0x4, &(0x7f0000002c00)=@lang_id={0x4, 0x3, 0x1809}}, {0x19, &(0x7f0000002c40)=@string={0x19, 0x3, "3edca981649e7d6c2d3a48eb4fa7b0ab14c3240145a2e5"}}, {0x4, &(0x7f0000002c80)=@lang_id={0x4, 0x3, 0x1c01}}, {0x102, &(0x7f0000002cc0)=@string={0x102, 0x3, "7d39b4a909d2630b81ac27b91ad64e10425a247c3c66a587b0f32b92516c2e9ac75176e3241bb453483f878b7b1c6ff5e6e8182701cbe1f04cd6042db5c08f1d0e02c50ef98658efc319bc268afeb59fce16e7906a9cdfe3f50a3a5252898909aa1542f90964a37cfdc34dc2960c4066ac28b36346c120186c1c9701add859b0755b859526b5d84dfa5fce24e9cb41b39ae2cf9a25ecd3d0e329a947764eb749d4f1aa0af8fd2324eb3975ac6010b8e7b9a09c5143e5818335a7ef7fbc2349445be3498ac83cba56cf7d37a889d6e4c1ce189455701113db898892cb8c00c5339f9b578460280560bcf9714df1ca03c8ae1fd177a2cc32b55e93b91803801965"}}, {0xf5, &(0x7f0000002e00)=@string={0xf5, 0x3, "e96a7b256419052d47ec4cef2f7f0d7b23cecb364311bd151d6577befa9796c0dba4fed9da6d8110481467ed24d18072de807d4019504059b7e03e3300dca98a0d7724be6826b0fa9f1afb5ade5f62ec1b6597b21ddde61fedfb0e738f3279ac5a2609e5d7e30ea0fc45433f84a1d7e73b632df6e704839d8dc5cbcfc99481ebbe6297417bae8cbce51b6e0fe0ca66260a9e4fb040315484f7eb676d37230949048fae76cb582a78fdd84d551b2b7963eeb26840c3eb1024ff01e4bf906a0d722599c08379993c6e98cd43987507422e084492773e79b7278824e2ac66e49592c1e03706a9203d45625a63cf3002d781941313"}}]})
syz_usb_control_io$uac1(r0, &(0x7f00000030c0)={0x14, &(0x7f0000002f80)={0x40, 0x11, 0xe3, {0xe3, 0x10, "55ef37fe4b25c29aa751d783216c2066ce332a6a273be6c57f59e3b776c5922f4ac2de6bae9742733a2f4540244f24bde852c24eec9f19c9688fc000eb6e7a053f78a3c29ae69e2b3c4f5f4b03ffd998350f8769344f27e644d9d7f7bc6efd3e68980b6fdf51e1d7fc116a357bce960c95b568c6f39b8eac6d7d72809f0c82acb3e8f0954dcdaeae6d46a8644c4b032a71d5efc4ec7ffa61686c67bb523a97ba7e55c88ea629e785b8b11eaab402078363971534dd066aaf2c8d85811c6465ad0c73f3b1ce923e05dc1b7a4614c749429f1e0a2ef807553ef245626282683bbec4"}}, &(0x7f0000003080)={0x0, 0x3, 0x1e, @string={0x1e, 0x3, "92c460aff1968bfcac2f54793afbd4a4b8ff4ccbec7589a40e55b472"}}}, &(0x7f0000003340)={0x44, &(0x7f0000003100)={0x20, 0xf, 0x4d, "6f909f79003a057b9217dff96159052eef7f63899b7b3a176f4e12256fb73bf831cba2463e93b3f8ff6cab7c370b2817d3ddbac9651a1e55775d22a7c48005d36c311c95afab0562c39056558d"}, &(0x7f0000003180)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000031c0)={0x0, 0x8, 0x1, 0x19}, &(0x7f0000003200)={0x20, 0x81, 0x1, "e5"}, &(0x7f0000003240)={0x20, 0x82, 0x3, "cc4b84"}, &(0x7f0000003280)={0x20, 0x83, 0x2, "937a"}, &(0x7f00000032c0)={0x20, 0x84, 0x1, '1'}, &(0x7f0000003300)={0x20, 0x85, 0x3, "7418cf"}})
syz_usb_control_io$cdc_ecm(r0, &(0x7f0000003480)={0x14, &(0x7f00000033c0)={0x0, 0x24, 0x54, {0x54, 0x4, "67475d08d037dbe05216ac7f455386a94e480a49b1ce74e8cd32cd5d9bbfbea7f9464608046ffc70413361973110220ee1303576a0f4de6f302a80808ba7372c2f365822698430389656057f2399e75a6dd0"}}, &(0x7f0000003440)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000003600)={0x1c, &(0x7f00000034c0)={0x0, 0x1, 0xa1, "644a014a80f29de9860df8c337db10748b88cee51f7fcc337673d038ffbaf0fa12e2b7e498e2a8097e98f2d0909620e97ee7da5663f81b5c5c711d196e506ad2129ec762ce79c7d3a7c64e3e8125685ea73beddca6b1fc2da4dee37a0344fd9e94b2295c681ae0d46d9f091467d976fab2571bfcf21f443e73c79bb70d0d0db2a652307e166bdc648df78beaf7aab7caa24d1ed6f3b52279bd3e815e87bea93ab2"}, &(0x7f0000003580)={0x0, 0xa, 0x1, 0x8d}, &(0x7f00000035c0)={0x0, 0x8, 0x1}})
syz_usb_control_io$uac1(r0, &(0x7f0000003740)={0x14, &(0x7f0000003640)={0x40, 0x24, 0xab, {0xab, 0x23, "c6caa52edfc7d13b8d3e06dbfb70ca6397ffeea0df0ab1af2f908de41d673642ab1edf98c629eff3822f5aa72e122e71af33f8bf72e6dfec21f1274efebe762c73f596cdbaae648e6c9be8ad995fb4d0a35436398649b9f874d9389541d9d04e5f717c50ebb246ceb8435481d6eec6dbb05ebd8a3832f31988253cac56576d7982ef20d2cd0a05db677e41f3419cc94e6c8ba6121a2af6ae0d6dfdf06036b48fb07a624461fc65899c"}}, &(0x7f0000003700)={0x0, 0x3, 0xe, @string={0xe, 0x3, "6955e650ffb7e90ec8337c28"}}}, &(0x7f0000003a00)={0x44, &(0x7f0000003780)={0x0, 0x30, 0x8b, "c549aad81dd2c455ff8f5c8c6436672fb5dfe1762ad9a058d041ce359ba3064b3faf0e1fb6a6c3fffd32c3048084130371eaefa6c7318a93c66e476563b11e435132da62c5b2d1226c331685569872424ecbc2c23742314a6fd8afceb45e9dd6e93079463a74b0e2d8089d8cf62bbdccf35aca8d637865ed0ec3c6e07705c66d883a6afb71ffcc325ef9a6"}, &(0x7f0000003840)={0x0, 0xa, 0x1, 0xd}, &(0x7f0000003880)={0x0, 0x8, 0x1}, &(0x7f00000038c0)={0x20, 0x81, 0x2, "b5cd"}, &(0x7f0000003900)={0x20, 0x82, 0x3, "d9a50e"}, &(0x7f0000003940)={0x20, 0x83, 0x3, "3f7f89"}, &(0x7f0000003980)={0x20, 0x84, 0x3, "ea73fe"}, &(0x7f00000039c0)={0x20, 0x85, 0x3, "5a1fff"}})
ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f0000003a80)=0x420e)
syz_usb_control_io$uac2(r0, &(0x7f0000003b40)={0x14, &(0x7f0000003ac0)={0x0, 0x21, 0xc, {0xc, 0x5, "39963be30fe002e80624"}}, &(0x7f0000003b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1009}}}, &(0x7f0000003d80)={0x44, &(0x7f0000003b80)={0x40, 0x13, 0x13, "28a656abcae55ccf8d5d1bcf52d18b9c86741f"}, &(0x7f0000003bc0)={0x0, 0xa, 0x1, 0x81}, &(0x7f0000003c00)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000003c40)={0x20, 0x81, 0x1, "cd"}, &(0x7f0000003c80)={0x20, 0x82, 0x2, "fd24"}, &(0x7f0000003cc0)={0x20, 0x83, 0x3, "50ced1"}, &(0x7f0000003d00)={0x20, 0x84, 0x1, 'q'}, &(0x7f0000003d40)={0x20, 0x85, 0x3, "840be0"}})
r3 = syz_open_dev$evdev(&(0x7f0000003e00), 0x7000000, 0x109000)
ioctl$EVIOCSCLOCKID(r3, 0x400445a0, &(0x7f0000003e40)=0x5ef0d33d)
syz_usb_connect$rtl8150(0xd50bde49af2c09a4, 0x3f, &(0x7f0000003e80)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0)
r4 = syz_usb_connect$cdc_ncm(0x4, 0x83, &(0x7f0000003ec0)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x71, 0x2, 0x1, 0x9, 0x80, 0xc0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0xfff7}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x7f, 0x539, 0x8}, {0x6, 0x24, 0x1a, 0x6, 0x1}, [@mdlm={0x15, 0x24, 0x12, 0x5}]}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x2, 0x5, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x78, 0x8, 0xf}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0xd8, 0x8}}}}}}}]}}, &(0x7f0000004240)={0xa, &(0x7f0000003f80)={0xa, 0x6, 0x300, 0x3f, 0x9, 0xf, 0x28, 0x3a}, 0x19, &(0x7f0000003fc0)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "707da35e7821788486793f607b60d385"}]}, 0x7, [{0x4, &(0x7f0000004000)=@lang_id={0x4, 0x3, 0x41f}}, {0x4, &(0x7f0000004040)=@lang_id={0x4, 0x3, 0x40b}}, {0xe, &(0x7f0000004080)=@string={0xe, 0x3, "15fd8980bc0cc5d10facec44"}}, {0x94, &(0x7f00000040c0)=@string={0x94, 0x3, "33ad0576159fa1fdddfa458101ea554d76f2c0e1372fbb0e307728909513e1cb9d9017faa53a20a799236802bb3514ce2bcbfcbf9417181122474d15b6bcd81ca11ecbc754532261b4741fadeb4b7f51c837fee8934067eba6f5a3f93636cdb64e1b892010a520a435f1237bbcd1c850e97c231a5f4fa64fe712676f7138b6b3bb2f474573363e1a0f8b6d20714b71a92f98"}}, {0x4, &(0x7f0000004180)=@lang_id={0x4, 0x3, 0x300a}}, {0x4, &(0x7f00000041c0)=@lang_id={0x4, 0x3, 0x40c}}, {0x2c, &(0x7f0000004200)=@string={0x2c, 0x3, "365563426a28bf52ffcb30e23e9a19d08f403e5c5d130c8e29315bc3948f507435a60b5524bdb91346d5"}}]})
syz_usb_control_io$cdc_ncm(r4, &(0x7f0000004340)={0x14, &(0x7f00000042c0)={0xa0, 0x23, 0x5, {0x5, 0xf, "726aec"}}, &(0x7f0000004300)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000004600)={0x44, &(0x7f0000004380)={0x20, 0xf, 0xac, "f0c962701a5ad421eff37abea02c18142cc4bb3e5f7acd34c2582f62913b7e29afc001903e8db77aaf0e74f346c1c1d8e7c8141c91a090d7cf09e1c4464e24f47a8e8f3a72152e52b038e8ba232edd8039cd2dd87e0c0c04a51d4fa5a140290bf00572c4d662fc0ef1440d56c8ceb77211ae3e06959c21832741205d5842bf689177ebf16d7a234369b7a9df8db79eb4fbfa3eedc7a3e681bf35193d08fd1f69942634fecd7c12e33d0dcf0d"}, &(0x7f0000004440)={0x0, 0xa, 0x1, 0x9d}, &(0x7f0000004480)={0x0, 0x8, 0x1, 0x9}, &(0x7f00000044c0)={0x20, 0x80, 0x1c, {0x0, 0x5, 0x2, 0x2, 0xc9, 0xff7f, 0xb62d, 0x4, 0x8, 0xffff, 0x0, 0x9}}, &(0x7f0000004500)={0x20, 0x85, 0x4}, &(0x7f0000004540)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000004580)={0x20, 0x87, 0x2, 0x2}, &(0x7f00000045c0)={0x20, 0x89, 0x2, 0x1}})
r5 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000004680)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r5, 0x83, 0x10, &(0x7f0000004700)=@ready={0x0, 0x0, 0x8, "4f9048d0", {0x1, 0x7ae, 0x4, 0x8, 0xd}})
ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000004740)=""/104)
syz_usb_control_io$uac2(r0, &(0x7f0000004900)={0x14, &(0x7f00000047c0)={0x0, 0x31, 0x23, {0x23, 0x24, "8bd9c500a72a5340e488827133e0da0069701aebd813223749f73302d149650b0f"}}, &(0x7f0000004800)={0x0, 0x3, 0xf6, @string={0xf6, 0x3, "4ac9315997ef1ddf511fb8ff1d6aaddac253c49c7e844e5c1c88aef6aa339a48c7b110769985f73df04afcce0781935684c28956b83df837c4810558106e72e9d63fc3b5768158bd284ff0115197df1ae99263d2007384bc6abe5048f7ceefe35eddc09ccefd6eb49af09fb47dcdac498f5c688de87ec93593242f2a14baaf1cb556cc78a177b7292537c0008eedb73352c01db1ca300b794ab97d6640dd9cde5fdaac2dd60cfb1ff803bf6696962eb287b9f8ff1dde8be7d7fca01872722aa89c23b3aafa6f6c5bfaabf83df86c901164f3d71f75a2c9bedbd6272051a9e052a280fa90b7852e1664d55f1a133816d67c0379cd"}}}, &(0x7f0000004c00)={0x44, &(0x7f0000004940)={0x0, 0x10, 0xdb, "c855999cd543fa545611824e9f9032123b0e3eb060bed55262cdf606b306cf5dea94e5fad6c70dc5ae0099e718aebd8b3168ba55263d96f2eb453bbbcf247ad744f7a394c03b17a059a73a57deea84cc144c93c2b0b2d3403749e0015a91e2f50aedcdc10deabd844e02147107dfed39a52e0120d5ae9ea2dd89ffd788e0c4a44eb097660184c88d1b38b29296551ca8156a0c6635e0b51a6a5875a00ebd7907e38234d7738e3b9f615687c195eb0569549c5477cdedd778d777505e9a133b5cdd304870fb3a24ab23b22ae4b8f01ec62e56897cbb78c853a8e132"}, &(0x7f0000004a40)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000004a80)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000004ac0)={0x20, 0x81, 0x2, "e977"}, &(0x7f0000004b00)={0x20, 0x82, 0x1, "f2"}, &(0x7f0000004b40)={0x20, 0x83, 0x3, "68fbdb"}, &(0x7f0000004b80)={0x20, 0x84, 0x4, "db0161b7"}, &(0x7f0000004bc0)={0x20, 0x85, 0x3, "edbe47"}})
ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000005c80)={0x4, 0x1000, &(0x7f0000004c80)="a989d5fbbebc6a46ac63ae345e97e436c87db8bf0cdcd2c5ec4622de5087c59a8f4201fe70b9eb2c890718965b5c5f2794e247b1203b2ba66509a022b0e371688ce3344dfe6de483e09003f2f837674baf355435baa66b520f6a06463245ac480b4fa69e4a1bc88718129ee99fab91816bde65872da468d55e39494a9374492004802c5b6ccae08ebff309050b7ca90c8028a60b6bb582a75c30f9faefa94d56b1794ae32af16b51e58288c7178cf41d0ae4a397c46a19c73a30cd48da4ec7e494d4a67593a6f70034e49e0013a86f1f361c7840ba157faaa81fc5d2cc8ae85b815b4851fcbd2499ee57d145cbce92711ca32799d4017e95b8f9416c8dd7b95370cb9d7df33d5ca135d5a0eb2acfb6ab17baeec8d2de320c0f6b3f845c7ee88d171b1f38b99d9358f303aaf73e6a9bfeb065bf05773efb92cc9a682c65f2a6f71f7afa0f07b9d800e9605ef633333211f9bff66f5b3d1d4441b5e265c0ee3d1a527e923eca9fa142191d2fb546cc2cc4f6c9dbd7070470eec5ae058a2eda6661a5e5b5a97ed139281075d9a2f2cdcc280b894d40a8ff8c91409333404feb7e039d621eb0f9397690911ab448fc041b54359eb2ef112b1140008424655117637dfecf88f1485cd01b4c03bde9818de05d3ab17dbbdf9f0d2de1e9ff095889497eddaf235cc2eeedf338e4bf2728544c7d4786c49dee5134f187c6d0a9bc1c2d2d8557ff04ca1d7279d0dda4641fb7bc72448f92ccd47cb9171afe2848cc5c4e9fd19657527e4c7bd88728ba632bda6365778f6baf86468fcc31341012f319588c9d9041c1662e6a0dfc3c8726734639caf979ba8d713a8351a62992efb573b9db9acebab42cc583caa8f0ea40fda42506980a3e9f1a9d648e883bfc7f3c0c66bc07f8c74b90f230f9f5dd4560e78e01fb43ed97d6e5a9789e32b1988a856336590b3fd74bae8d826c2143862b77b6362d38f298d857658b86fa9860e78da94c26a4db3cfc0ad9b32a539e6dc410e398cf5c6356b696b0312f54954d505dcaade5de660dea85c02dcc21ebef0a850195c9a684bb8e114496492332deafd175aafef69169ef8e59a21a740f8ee835b139371128efc36ee3e4aca99e257fb3e69b5047ea042572cc7deefcb9fe3cf13c7b84bb4ad61167fef623f84cfa86ee1335e4c0bfe0686daadf7e240279dce1858b752fc42916c2e5c423063da915fd2d9aa99697f6adcacddbb9264714bcbe6b1ed09688978c925ed29335e77447bfe5323d22b843f83caef5579133333aead80a1621c6fd3e898c84fd945d09ab538d8620753efd9e90beaa61ff90a7ccbdb8742f1801af3289ccd1c42204a9461ab5d188abcb306278f8a7a5a42a4da7b3ba6d43f07fb343017bc878d958299c9e77443eb4110dd488cfd942a52e383f1e2af2b86f2ca7b5ea12516d5f542b3ef60305332cc435b4c888d42863d87adbb3eccadf9ca9817b1aa099a29e9974e0ff992e38079a1a37203fff31af6787a60c9344d601c5a5e4c47ff95fd8fbc256c53aba5934dfa6990054f12f07b77322db3b917c6a855dcfb9a29c6645f4ab36f80eb211cc2fc8f433355f9400aba2c9ccb9a0df382863cb2a84e5f6b84f90e1180d0bf066eddb15d90e3759bbef4ba021224aaacc8d68c93ecc7a268ca24527544264a7a66387646df49981391c847df28c577f9a2fcc6ed81410518a91805c3f77930ffed2b6dcf80c967ab40d44a6eb40bb6992e96b4b00dc8630e1a0aa8ab31976753cb7ca44363275be551fb9102a9f72882b4ce8f37e006e0bf33db8bea35583fef8467856426d7e73b1e580a3f42c303d25c49d8c19530fcfc0c4bf088400136ebbd9a58b55cecaed410b5d85c397688b9b5d51b1e7516e53c6fdb8e571ba79233d0eaf2ba4f14c1b4ac70547585a0361ddef6db8de969e1462e66745988639880ed474eb295cbc1076d3dce1e73246c43abcf337d818e20932262a55af680ae7c93d4dd597a772e1afb78b811d9492c63b3dff4213d0312fa6b6763ab456060b6aadf6d5741e4b9f29067e27ace0b7946cd07a4a493118a0bee33182aa8c36ed1690dd973bb4cd36989e4d3fc85e472998955f493bca9fcc612954048c1e7ddd21d6e1a7faf534186314da9462be2f983b3af654d1bb2f0a1c5eca0c9db0c0e7c728eb79b129626d9c9a0a767618859b00a87901221431a1775a2c9a58c6b5dc0956271585c1f9b3f90e6c72c2f24403ed6e1da7071d46a4456aa7fbfc07d51d9da932da80c1931382ff3dd70f6473e84fe4c49a3df65fab6f7605fb4b5d8e302612a43541b2be02ecdcc11a316365d6318f508f8cc3ff5aaaebb4db7a166a4d5f54f31377d7499270bacd37e8f43e0cad6f21125591074adc720e50bbd8edc6a5e1d6ff97040038e71ad9527546d37190c77caf7711859093d53c77365ff184c335c4ae80a8c5194b60acfe3c4a6c6f15795c071c20ab86862880664cd44fae1773ab385772245bbbacca7627d7c8496b899f2074741cc0bba93c2ed7c766d5fbc39e64496a3c6926a0dbbc99f4305a179396c48dc17aecff1df74aed0928836eb684710eb88ee6afbc0117da142f48c574a128f10cf1da53a3991f8c386880bbb8b354d97cdc9cc3fe7ad29b6f8f0169859db1daefcd86513abde12c93636c2fc83b0707bc691091f019fa287c9bb3f5c39ebe8950827fc7ace5461b44d221b0d71ba55d56b0406507707773e2a106abb105db64e62b108f289f3ef262177b1b5c9bc603a1ac5211e1b966abbf3acab61399b4963619621e4e5f71d8afcee14605b3a60c3322fb6470b624a97d242c41b66d9cc662b2f83f76b55c67463235ac634ff3af8f025b3d11a99efbde9a8aec17b6be0988a2cb1132e77ecc2ee232f7615f143ebf1445c639d0e80f8f5bd2a6750ee895620bfa4c58238649d0e246ebf42bd2795bf8128b4c5cc0a83533c018cdffbf3cae85f01004c08e3558f1511ea71c9b1d262554ef2e38fbdebcd1a3bbb20d840f0886f8fb8d0b18835c56572955fe4fda3d5d69215cb133f9b12e6314a8c95d1c395de16bbd8b72c0dd58a4091dd9247f82047c8e331fa7395f48c090cd7e22c3a4faf5ab0d036d7f49ff3fb0dd8b869cf8f9ad0fccffafa3654b6760e0f6d8bc624d1bc817dc05c339ef61dc5b49da675439063fe06991d53d86007096943f690b8dcce7184c303a14ca848034c9e47410f422b20dae9e51a653dfa5ce75a484b7dadecd4b616577e8a4406bc3164dc309c189e6ea845dc5a09f73f97411d626c44fa71a03b1074800141e086a248e915b7b575bf9575fd1b53ff8c047fc48f324e17f3b0bb3a894f7e34b33c30656316109409dda7ae765fda25ddabec790103ae6e0fe2b5d0fc24492cc67591657ef4c71ad98d649a50db3b76deac0198c1154295c8719a69f3d21349d1a9819d716ab200d9d6dd56686ef261e19ab45cb31715d581f2753abe0a1e004784321589f9f40bef426e09fdc0f4b69c44d8e66766a7f4be8cdad2c4206d17a2f9be7fe952573df0ce21105815fede4247b19d32bead400b2242784d6a75f36d78b3cf196194cf3d3578fc012dc1a753586102eca9f21834b514ca00069216e3c409479463009ecbf87b20d24b1b35b540577ac84dd6bdfd8455c5c0c9381e678ac1a1e0a48c0b318d0275b846d2c55d57507eaf04353bbcd1056bea603ebec5b0f3aacd7f5801f90e5a9ae862f81d062e9820fdfd42c1a7384594716483099bf39d3064f2480ad1acf146c9e1d1738427542acb9fa47be06bb5d9375effaa262169292e70a67b5a9e3da4ed471e14d6a195756859b9b30115efb0bbe784045c5354763f156c64c8657223167b1459cb786c7316125973b4b003e63fb336674bec39c68a3d3d4a0a79901a7dd7169e522f9f90337f207de9c9754d1e3d903f701fea099562f666233d2cc60e41e67ef0456aeff96900ff801d6c50f09121bcb53c00dad26c44c30504b01ef064cd0824f331951dc944cd1039c8c7546131290b69ee0df01bde3aac041d7329a9393f17d0deb83299814a7cc6401626f4ff1ad8a9e5a7bfbe56505c87caea764f9e390bad1b4bf63b1d44d6af24a21962b70ed9379374618a05e1305f7e11ee7b5bc290dd110f9ca9fcc9ab1cbd65c6db23c1fa26603d3073551a2b85d1b2e48b5e7bbea5f5e86b7c989a2c15c8b6e46b8bc1511717089b78fdc390b8b46610860d51b048dc6589dd836c477e467e575f97eacf5cddeb67ed3d3301295a64c17b2a15134d750aebdcd305bba4e383fc8120e847e3cd010af57ffa44c72fddac009f81da247c9d10ab388858a867dac02c523e03226af4d9fd64f041ee175a21e547be018e2278317a61034fdfe7743f5d7c6001e3631ae774f7358b314a10ed433f8370ccf720bc9d6bd96cfe7c6add9f9ca6b7db9ff819d768ce8ff5c24143f8ac527349acd241b1c69b157141caf1086681fd14f4afbef6d9d93d41cff6ed24a87c5f20b26bc23848036596253eeb2689c34d628ef1b418a53e46bd9265aca9a071195aa51f4175bf11fb30e1cc13233a143ca250b367c37e819876b0a129ec8881fff9381505ee4aa4fbe65d25ca939fa9555d793157c1d8650938b5005038d31c121387a98b1c591d9ec70291b3b12550367c76a38b82483d93e949d0cb0aa60799ed59256ab4b871103477dbb52014fbd53e9aaba27d1ff0fddadb7e45d4761da67fa58107337129a055d4571d584c93aa4b54aca57eb47b7ceffa555b45fbde9f9183a68a17e2e10ef07e585e7d82bfa35ac69c83b3039f1689b48abcc41e8cec22bb99512ad6e8dbfc46b2e265b5518e84248f4e9684dbafc580422fbe109b753eba0268f3c3ea03061924681e5da3d63d2ea2879072e40783094ee82455a1942c2ab19b356311f486d3c96aabc4892b0ef264dd97d60b99b61b681bb16c45c147fe46fe75084530cd18ca13e0eb51b9837da99f0bcf7af47a084b9126562086666d15eb549b8371c6ae8beb83fadd427250c81cd02684936079f71d123cd3f62c64e210141c64435ca03e3c56dc071ea0e5f4ae58884939c49a8861c281c534b194247935e9577f344922ddedcf457a845b1d6e346682530aba95d2476d5fe12f463079887460106063e6e68c3e33b26ca28eabfa1227a82ede2a68edff6cd41ff7e737cc3b6c377e6474b70ef221bf47179586c61b18d6f35668983a23c6efa0fc65f9af99d4bb8749cf9fac2e228ee849a17760294f2b5d26f677a7a1de70dd5deb4fe379efd283fdd6ee74cb1d7d24143498f403e317b6d817b206fe37c2c7d144169432eb8ceb711c707233696ab5e7ad4dc85e459700b3f5febc6d4a826bef3fd1d71f250119b8f3622ae9a3930558113e9082d241142c5b358c051427e791a23dcbf221b5853c9d2a5736698656efdca59ea5b4eb03fdda1ac4d8dbf046b5fbd2e90d842f86fa652bf17bd722bdf2fbe6519af2902444a96bb0f9d168f22dd639c751f549559c7e56f797a3dc67c2c1b2c1b618596a313ee19c83c8111b921d43547b226c2ffa935a8de9d49b7ebbaa6457cd393702fcba593d2c989164d81ec8f7efcb6ebb5a63c0d4cdde02345da1d4be1b16b4a5ec95159b8acdb4029ec3b95a51384fa9b575740a5745393779e1ae43728079971eaaaafd01a73038bd656f6fecdfef5e69ba8d77687ccbf7471fda9b6fd2b11d2da0da811db89824c850a101b2614bb0252c144c603377b11e76d044cb26b80a689117c7cc8dcfbdc6e35691b2776924dd96f6fa05201"})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$char_usb-syz_usb_ep_write-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect$uac2-syz_usb_connect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffa) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000101904010000000000000109022400010000f80b0904000902030000000921fd7f000122e301090581038936050a7059d14f8ef43d3e22dd8f6dccb5ad4434133b35644a605b828952da8236506e707e2b"], 0x0) (rerun: 32)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_connect$uac2(0x0, 0xa3, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010102000000f0400e4942400001020301090291000301090008080b00020100207f090400000cc56c000101200009240100080731000611240804050100010002000300020000000b2406020406000600f2000c240306000408050233ea02090401000001022000090401010101021000090501092000050500082501010007b8bd09040200000102200009040201010102200009058209200035d7070825010203000000"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200029010203010902120001000000000904"], 0x0)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
single: successfully extracted reproducer
found reproducer with 21 syscalls
minimizing guilty program
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$char_usb-syz_usb_ep_write-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_connect$uac2
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffa) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000101904010000000000000109022400010000f80b0904000902030000000921fd7f000122e301090581038936050a7059d14f8ef43d3e22dd8f6dccb5ad4434133b35644a605b828952da8236506e707e2b"], 0x0) (rerun: 32)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
syz_usb_connect$uac2(0x0, 0xa3, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010102000000f0400e4942400001020301090291000301090008080b00020100207f090400000cc56c000101200009240100080731000611240804050100010002000300020000000b2406020406000600f2000c240306000408050233ea02090401000001022000090401010101021000090501092000050500082501010007b8bd09040200000102200009040201010102200009058209200035d7070825010203000000"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$char_usb-syz_usb_ep_write-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffa) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000101904010000000000000109022400010000f80b0904000902030000000921fd7f000122e301090581038936050a7059d14f8ef43d3e22dd8f6dccb5ad4434133b35644a605b828952da8236506e707e2b"], 0x0) (rerun: 32)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$char_usb-syz_usb_ep_write-syz_usb_connect$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffa) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000101904010000000000000109022400010000f80b0904000902030000000921fd7f000122e301090581038936050a7059d14f8ef43d3e22dd8f6dccb5ad4434133b35644a605b828952da8236506e707e2b"], 0x0) (rerun: 32)
syz_usb_control_io$hid(r1, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$char_usb-syz_usb_ep_write-syz_usb_connect$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffa) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000101904010000000000000109022400010000f80b0904000902030000000921fd7f000122e301090581038936050a7059d14f8ef43d3e22dd8f6dccb5ad4434133b35644a605b828952da8236506e707e2b"], 0x0) (rerun: 32)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$char_usb-syz_usb_ep_write
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffa) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_open_dev$char_usb
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffa) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="3d00004ec4eaf25b88ffacbf6f56fc6a2876659c363fad62f284759a082f2f09b64147f31c772e2635a3c595eeeb8450000000004d899c1b59aff4f90021000000000000"]) (async, rerun: 32)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(0xffffffffffffffff, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
program did not crash
simplifying guilty program options
testing program (duration=3m7.551611782s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
extracting C reproducer
testing compiled C program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
program did not crash
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
validation run: crashed=true
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program did not crash
validation run: crashed=false
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Read in rtsx_usb_ms_handle_req
validation run: crashed=true
testing program (duration=3m7.551611782s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)
syz_usb_ep_write(r0, 0x82, 0x0, 0x0) (async, rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (rerun: 32)
syz_usb_ep_read(r0, 0x1, 0x0, 0x0) (async)

program crashed: KASAN: slab-use-after-free Write in rtsx_usb_ms_handle_req
validation run: crashed=true
reproducing took 2h17m34.904188273s
repro crashed as (corrupted=false):
usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
==================================================================
BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x173b/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:528
Write of size 4 at addr ffff888122fbb074 by task kworker/1:1/39

CPU: 1 UID: 0 PID: 39 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: events rtsx_usb_ms_handle_req
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 rtsx_usb_ms_handle_req+0x173b/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:528
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 44:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2d8/0x680 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 memstick_alloc_card drivers/memstick/core/memstick.c:383 [inline]
 memstick_check+0x2c1/0x10d0 drivers/memstick/core/memstick.c:452
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 44:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kfree+0x20c/0x650 mm/slub.c:6792
 memstick_alloc_card drivers/memstick/core/memstick.c:420 [inline]
 memstick_check+0x72b/0x10d0 drivers/memstick/core/memstick.c:452
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888122fbb000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 116 bytes inside of
 freed 2048-byte region [ffff888122fbb000, ffff888122fbb800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888122fbf000 pfn:0x122fb8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000240(workingset|head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000240 ffff888100042000 ffffea000413ac10 ffff888100040948
raw: ffff888122fbf000 0000000000080007 00000000f5000000 0000000000000000
head: 0200000000000240 ffff888100042000 ffffea000413ac10 ffff888100040948
head: ffff888122fbf000 0000000000080007 00000000f5000000 0000000000000000
head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 44, tgid 44 (kworker/u8:3), ts 108906902817
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0xf4b/0x3440 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2d7/0x2f70 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x4a1/0x680 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 device_create_groups_vargs+0x8a/0x270 drivers/base/core.c:4440
 device_create_with_groups+0xf4/0x130 drivers/base/core.c:4538
 led_classdev_register_ext+0x4d2/0x990 drivers/leds/led-class.c:555
 led_classdev_register include/linux/leds.h:274 [inline]
 rtsx_usb_sdmmc_drv_probe+0x622/0x9a0 drivers/mmc/host/rtsx_usb_sdmmc.c:1413
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1507
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
page last free pid 3982 tgid 3982 ts 107449464156 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x714/0xfc0 mm/page_alloc.c:2962
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_lru_noprof+0x260/0x650 mm/slub.c:5029
 shmem_alloc_inode+0x25/0x50 mm/shmem.c:5115
 alloc_inode+0x68/0x250 fs/inode.c:338
 new_inode+0x22/0x1c0 fs/inode.c:1171
 __shmem_get_inode+0x1df/0xec0 mm/shmem.c:3040
 shmem_get_inode mm/shmem.c:3137 [inline]
 shmem_mknod+0xcb/0x2e0 mm/shmem.c:3830
 lookup_open+0x1255/0x1990 fs/namei.c:4567
 open_last_lookups fs/namei.c:4767 [inline]
 path_openat+0xa2c/0x2440 fs/namei.c:4997
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84

Memory state around the buggy address:
 ffff888122fbaf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888122fbaf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888122fbb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff888122fbb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888122fbb100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
==================================================================
BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x173b/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:528
Write of size 4 at addr ffff888122fbb074 by task kworker/1:1/39

CPU: 1 UID: 0 PID: 39 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: events rtsx_usb_ms_handle_req
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 rtsx_usb_ms_handle_req+0x173b/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:528
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 44:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2d8/0x680 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 memstick_alloc_card drivers/memstick/core/memstick.c:383 [inline]
 memstick_check+0x2c1/0x10d0 drivers/memstick/core/memstick.c:452
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 44:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x43/0x70 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kfree+0x20c/0x650 mm/slub.c:6792
 memstick_alloc_card drivers/memstick/core/memstick.c:420 [inline]
 memstick_check+0x72b/0x10d0 drivers/memstick/core/memstick.c:452
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888122fbb000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 116 bytes inside of
 freed 2048-byte region [ffff888122fbb000, ffff888122fbb800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888122fbf000 pfn:0x122fb8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000000240(workingset|head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000240 ffff888100042000 ffffea000413ac10 ffff888100040948
raw: ffff888122fbf000 0000000000080007 00000000f5000000 0000000000000000
head: 0200000000000240 ffff888100042000 ffffea000413ac10 ffff888100040948
head: ffff888122fbf000 0000000000080007 00000000f5000000 0000000000000000
head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 44, tgid 44 (kworker/u8:3), ts 108906902817
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0xf4b/0x3440 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2d7/0x2f70 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x4a1/0x680 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 device_create_groups_vargs+0x8a/0x270 drivers/base/core.c:4440
 device_create_with_groups+0xf4/0x130 drivers/base/core.c:4538
 led_classdev_register_ext+0x4d2/0x990 drivers/leds/led-class.c:555
 led_classdev_register include/linux/leds.h:274 [inline]
 rtsx_usb_sdmmc_drv_probe+0x622/0x9a0 drivers/mmc/host/rtsx_usb_sdmmc.c:1413
 platform_probe+0x106/0x1d0 drivers/base/platform.c:1507
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
page last free pid 3982 tgid 3982 ts 107449464156 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x714/0xfc0 mm/page_alloc.c:2962
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_lru_noprof+0x260/0x650 mm/slub.c:5029
 shmem_alloc_inode+0x25/0x50 mm/shmem.c:5115
 alloc_inode+0x68/0x250 fs/inode.c:338
 new_inode+0x22/0x1c0 fs/inode.c:1171
 __shmem_get_inode+0x1df/0xec0 mm/shmem.c:3040
 shmem_get_inode mm/shmem.c:3137 [inline]
 shmem_mknod+0xcb/0x2e0 mm/shmem.c:3830
 lookup_open+0x1255/0x1990 fs/namei.c:4567
 open_last_lookups fs/namei.c:4767 [inline]
 path_openat+0xa2c/0x2440 fs/namei.c:4997
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x119/0x710 arch/x86/entry/syscall_64.c:84

Memory state around the buggy address:
 ffff888122fbaf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888122fbaf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888122fbb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff888122fbb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888122fbb100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================