Extracting prog: 2m55.897656248s
Minimizing prog: 18m41.525163756s
Simplifying prog options: 0s
Extracting C: 1m5.209830348s
Simplifying C: 3m48.541209514s


30 programs, timeouts [30s 1m40s 6m0s]
extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect-syz_usb_connect-syz_open_dev$hidraw-read$hidraw-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r1, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
r2 = syz_open_dev$hidraw(0x0, 0xc, 0x404001)
read$hidraw(r2, 0x0, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r3, &(0x7f0000000200)=""/128, 0x80)
syz_usb_disconnect(r0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 10, 7, 9, 8, 7, 8, 8, 10, 9, 10, 10, 10, 9, 10, 9, 11, 11, 11, 10, 8, 11, 11, 10, 10, 9, 10, 10, 11, 10]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000a00)={0x14, 0x0, 0x0}, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
executing program 2:
syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f8100000000000000000006241a0000000905810300000000000904010000020d00000904010102020d000009058202000000000009050302"], 0x0)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)=ANY=[], 0x0)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_disconnect(r1)
write$char_usb(r2, 0x0, 0x0)
r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d44ebb40ec188832cf690102030109021b00010000000009040000010e01000009058103", @ANYRES8], 0x0)
syz_usb_disconnect(r0)
syz_usb_control_io$cdc_ncm(r3, &(0x7f0000000140)={0x14, &(0x7f0000000040)={0x0, 0x28, 0x9a, {0x9a, 0x2, "a4e382c5be9924617f53aaa620b50758865c15d9dc77739377ffdb6386e67c649da83854b00c5eb813193192354ae8d49f1d6faf8fd26ceec2f4be2c6872fd8171801196eed09ea5c14270a8e090fb53e7accc298c8925caad5ef697c56e901c0b8873922954a3b780f7509838769a40bb61d66b6dffadcd59e059272467bf7906a2d165601f6fd38ddc61c68fa2605c9bff08a8dd83d8f5"}}, &(0x7f00000004c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x20, 0x16, 0xe2, "883069e73e6108216cb85c4288e4785c2111df4c473c73f0777effd6a08b27c8f3ff70da3e0739947ab1fe1bb80768ce12ec7d24862d0a49a040169a195611edacee82cdef20f3707c5801287cb2b65cbc19f41f63ebf8933436f1ce46a3f8433746230fbedb3574288c03f474422449ea1e5083c46ae38ddbf0cdf78eb8968bdf89b40e17bd157e07b16cbe13b4b96833fd82a29dfad68c1b1c8200205bc08226b38e019fb8a4a623cc9cde901fe62f6d5d600da2abb5426760313b609cf8aa3cd3f29be4be0af134f9f542896df21fe8ad3ef0e18da06fe0003092ae5cbd2cb3ed"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x4, 0x0, 0x2, 0x7, 0x9, 0xff7f, 0x5, 0x1, 0x8, 0x319, 0xc1ec, 0x4}}, &(0x7f0000000340)={0x20, 0x85, 0x4, 0x7ff}, &(0x7f0000000380)={0x20, 0x83, 0x2}, &(0x7f00000003c0)={0x20, 0x87, 0x2, 0xc}, &(0x7f0000000400)={0x20, 0x89, 0x2, 0x1}})
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x458, 0x5011, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x394}}}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0)
ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x1, 0x1, "11"}, 0x0})
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000a40)={0x2c, &(0x7f0000000780)={0x8ade946416f95ea5, 0xa}, 0x0, 0x0, 0x0, 0x0})
executing program 1:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0xcc, 0xc7, 0xe1, 0x8, 0x7392, 0xd611, 0xe7bb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x9, 0x12}}]}}]}}]}}, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000280)={0x40, 0x0, 0x1, "ea"}, 0x0, 0x0})
executing program 4:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0)
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
write$char_usb(r2, &(0x7f0000000200)='V', 0x1)
read$char_usb(r1, 0x0, 0x0)
syz_usb_disconnect(r0)
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000002a00)={0x84, 0x0, 0x0, 0x0, &(0x7f0000002700)={0x20, 0x0, 0x4, {0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000c00)={0x2c, &(0x7f0000000a40)={0x40, 0x11, 0x4, "ad4b0a8a"}, 0x0, 0x0, 0x0, 0x0})
executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000e80)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x28de, 0x1102, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xfd}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f00000000c0)={0x20, 0x30, 0x5, {0x5, 0x6, "b105c8"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000600)={0x24, &(0x7f0000000400)={0x40, 0x3c, 0x2, {0x2, 0x21}}, &(0x7f0000000540)={0x0, 0x3, 0x7, @string={0x7, 0x3, "87461ef792"}}, &(0x7f0000000580)={0x0, 0x22, 0x6, {[@global=@item_012={0x0, 0x1, 0x4}, @local=@item_4={0x3, 0x2, 0xa, "6244bf05"}]}}, &(0x7f00000005c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x9, 0x5, 0x1, {0x22, 0xf10}}}}, &(0x7f0000000800)={0x2c, &(0x7f0000000640)={0x20, 0x15, 0x12, "87c68fa32d2eabb9075ade1c0266a84fc18d"}, &(0x7f00000006c0)={0x0, 0xa, 0x1, 0x7}, 0xfffffffffffffffc, 0x0, 0x0})
syz_usb_connect$cdc_ncm(0x4, 0x0, 0x0, &(0x7f00000003c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x300, 0x46, 0x7f, 0x4, 0x8, 0x4}, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0)
ioctl$HIDIOCSUSAGES(0xffffffffffffffff, 0x501c4814, 0x0)
ioctl$HIDIOCAPPLICATION(0xffffffffffffffff, 0x4802, 0x5)
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)={{0x12, 0x1, 0x0, 0xed, 0x3e, 0xc9, 0x8, 0xccd, 0xb3, 0x2dee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xb0, 0x87, 0x1d}}]}}]}}, 0x0)
ioctl$EVIOCRMFF(r0, 0x550c, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000980)={0x44, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100409dea7840"], 0x0)
syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0)
syz_usb_connect(0x3, 0x36, &(0x7f0000000d80)={{0x12, 0x1, 0x201, 0xa1, 0xc7, 0xa3, 0x8, 0x856, 0xac18, 0x8db5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x6, 0xc, 0x40, 0xc, [{{0x9, 0x4, 0x82, 0x6, 0x2, 0xff, 0xff, 0xff, 0xa5, [], [{{0x9, 0x5, 0x3, 0x10, 0x8, 0x0, 0x3, 0x7}}, {{0x9, 0x5, 0x80, 0x4, 0x8, 0x3, 0xfa, 0xba}}]}}]}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x0, 0x0)
ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0)
r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0)
ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"})
syz_usb_disconnect(r1)
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xdc, 0x3f, 0x6e, 0x40, 0x813, 0x1, 0x3a08, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x9d, 0x26, 0x9b}}]}}]}}, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_disconnect(0xffffffffffffffff)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_disconnect(0xffffffffffffffff)
ioctl$HIDIOCGRDESC(0xffffffffffffffff, 0x40305829, 0x0)
executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1044, 0x7a4d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4}}}}]}}]}}, 0x0)
syz_usb_connect(0x0, 0x36, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x0, 0x0, &(0x7f0000000780)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0xd, 0x25, 0x4, 0x8, 0x75}, 0x5, &(0x7f0000000840)={0x5, 0xf, 0x5}})
syz_usb_connect(0x0, 0x36, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x3d, &(0x7f0000000b80)=ANY=[], 0x0)
syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000005c0)={{0x12, 0x1, 0x69a0e1fba3330989, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x7, 0x10, 0x3, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x7f, 0x5, 0x6}, {0x6, 0x24, 0x1a, 0x5}}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x20, 0xe, 0xba}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x44, 0xa, 0xaa}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x9, 0x2, 0xb0}}}}}}}]}}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x22, 0x5, {[@local=@item_012={0x0, 0x2, 0x9}, @local=@item_012={0x0, 0x2, 0x9}, @local=@item_012={0x2, 0x2, 0x4, '\"E'}]}}, 0x0}, &(0x7f0000000440)={0x2c, &(0x7f00000001c0)={0x20, 0xd}, 0x0, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x5}, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000800)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_connect(0x5, 0x1a2, &(0x7f0000000380)=ANY=[@ANYRESDEC=r0], 0x0)
executing program 4:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000500), 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f00000001c0)={0x0, 0x0, 0x1, "a3"}, 0x0, 0x0})
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000200)={{0x12, 0x1, 0x0, 0x7e, 0x3a, 0xf7, 0x8, 0x7b8, 0xb21d, 0x97ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0xbe, 0xf6, 0x0, 0x37, 0x4f, 0x35, 0x2}}]}}]}}, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1d34, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x20}}}}}]}}]}}, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x12)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_connect$printer(0x0, 0x0, 0x0, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000980)={0x2c, &(0x7f00000007c0)={0x40, 0x30, 0x9f, "44932b2fd80072c498df4f9b6b770bf3d5e8ee849cd6b53544a437be3048ed5b8c2141f80fa53717bd5fce8979331e4a721fdf48cced4f84e8ee3ca2c5eec8f67e1b68a15f6f37203ecaea6078954ceda90a3b5772e8260dd1719bcc0a1f7688dd9eb89eefaf218538444ea41d2dff10c09d68bd8aaa27a7e880334172e2ca8918ed5ef0a0dad153156fd2d6dd9d445473541ad63e763702f7e8171fa32aaf"}, &(0x7f0000000700)={0x0, 0xa, 0x1, 0xf9}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x21}, 0x0, 0x0})
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x1a4, 0x0)
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a0000904000001030101000921000800012203000905", @ANYRES64], 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001300)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB='@0J'], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x0, 0xd2859f99480e5041}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000d80)={0x2c, &(0x7f0000000b80)={0x0, 0x0, 0x4, "30827906"}, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0)
r1 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[], 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x45e, 0xb4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x4, 0x60, 0x7f, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x0, 0xb, {0x9, 0x21, 0xa8f9, 0x5, 0x1, {0x22, 0x806}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x9, 0x7, 0xb8}}}}}]}}]}}, 0x0)
syz_usb_disconnect(r1)
syz_usb_connect$uac1(0x1, 0x0, 0x0, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d44ebb40ec188832cf690102030109021b00010000000009040000010e010000090581"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00222200000096231306e53f070c0000002a9000070d00be0083"], 0x0}, 0x0)
syz_usb_connect(0x0, 0x34, 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000340)={0x40, 0xf, 0x1, 'V'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000001240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000740)={0x34, &(0x7f0000000580)={0x40, 0x0, 0x5, "6305f7ea60"}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x67, 0x5b, 0x8f, 0x40, 0x1039, 0x2121, 0x9eff, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x95, 0x0, 0x4, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xce, 0x25, 0xae, 0x4, [@hid_hid={0x9}]}}]}}]}}, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$uac1(0x0, 0x0, 0x0, 0x0)
ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0xc018480b, 0x0)
ioctl$HIDIOCGUCODE(0xffffffffffffffff, 0xc018480d, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_connect$hid(0x2, 0x36, &(0x7f0000002240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf30, 0x111, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0xf0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x6a0}}, {{{0x9, 0x5, 0x81, 0x3, 0x10}}}}}]}}]}}, 0x0)
ioctl$HIDIOCGNAME(0xffffffffffffffff, 0x80404806, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000401e040128000000000001090224000100000000090300000103000000092100000001220700090581030000000000"], 0x0)
r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
ioctl$EVIOCGMASK(r2, 0x5b01, 0x0)
ioctl$HIDIOCGRDESC(0xffffffffffffffff, 0x90044802, &(0x7f00000015c0)={0x6bd, "8ea1dab7bc406447dd9773f9ce75e4b768028d1f2156f87fb52b5f60498639b370fea9233d563701b26f8c1112e1edd83a8534093101692504195dfd5097c7bf1fc14d9d81c5bbaa873777e3f3ecfde6666d7a8a4c0906508fc26df4587aa327b552b1671ead75645d5735469de750b37b1f612b210bfb25ec3ffa0fbabb1fd7c69d20d35a45bcf15f97c568c43e7c02b54e91e016c6e8be81141b8630a3322e33e81d435db1ee1de61553c23369e41b02c0e6f1a0bf1cdc8d4062f6de12ef96e8f725b994440a9fd0e26867d329e6bff68bcc2ce54eb55dc6d9de694a6d48f9e5204f60bd1ccae13e4898e717f8162797d4aad3a0a34e0c31b6f4cc993c15e499acfcd4f70dd59d8e492fc1550c3f32b0deb3f82d820e2b3c41a6e0b83484e43505be88cee065fae3d47359f39151a738d147a0033f8ac5af4504bbb7a4a45b6741de452d1e111516b94280d54bf9e13e356b8de757c8cc8cbcaafea9f7d18ddb50ed6def98fc25978c87aa9d7cbc407b49672675d4ba0e10df77ab2fb5aeb9ff1146ee01e4235a65758fd916eb012ace9b2f1e4267afcc660079808231f802fc986bc408cd7a885780a923c4928d45db8fa45e3e0c2188c27c1e40a7dada8553efeebe165c5f5135e0dcd84eb9d10f458ef2dcb3091c444021393e0acd2c9dd6be714d076c7c19a71bf335a8b6df685a685a140f17920b5f0f74067b01835f8dcc30310fd6494ab883f231b0f9e9d5d9d700c79d708f27270dba887b5a4089e2b54086904ee908886b2a50d9c4398611a6f2f42adcf01da0f7c99e45e73b33bfb9d0e9fbe27a9a764f213a013167b5cf7d46dca42cb5f83d1ed7ed4c52f0878319ec28cd4c9fa563ffb679738daf3990686f0ec4e718b250f7ecd130d7302d3f246da57dacd66d7d9cf1898c1c8ee83f341a77ef6b0a2774c372df70deab20ec1c39b0e4fd123603dde46c6c80175e707723b7ce0f1d094ac475029d67ba42978cf7c20cb3717fdff8c3bb27f88d55a5b51a10ca12814c9130f097946e9197ad66624c2270fb7cdc058afd7c86d0e1ec689e8714f02bfd2dc2a124d8dae4125078abb7c6fd357921b3d2a86f601c861f73bed1f12cb2d78b1b79d043a090d1cdfe91940ca8105f098f748db1611a3615aee126d445acafe266d475be22be1fa76006b010f4be2e6638dee0975c0ed2086a8d718d49eeab506b1cbb7716150162cc513ee979c944416ce02cf98b84a06636121aabdb77dbe70adf6faef871e43f4ef13eee2ae2fb86c350e062827e69fe86c471e4087285b28257a92e3078f52a1d794796018020e0b644472a69bfea5658a92008acc99ef3aedc8d643e0df2af5de41250ca34b595d26e127e59a7358cfeb26c97c6c2825f56a4f371d5b28d66eba31cf5ed6de6c12009078395985f33dc85a4b4d13c617c55860d2e7589cd7a582ca6548e78827ed7e665b7651fbfa2f4d7eac4e785f7f63ff3798249e670760e32d42d507ee8b867f4c88a15afd560bfdb449e28ed508142ce7e5bdefff0f586fce993505e54cad59b7c2c9d8a1987017516c7a3ff1d3ddb3f59e11bbb9b9f389c9d48d794a72f429ccdb460eceed86293eeae78a0f051fcf45b873a146656a7bca26994e40046125bb933e77f838a31431b1bdf4782f24f6295c79db53e22cf70bf535ea2e9d5d4bc59da95e5487270fa1e744bf9be3fb7a4909a1bf142034380776da7522d9da9274f1b13789d5b1f6ba8fa687c84ac82a39feaae87e65af9a42f196d333f1e51df3010ffbef1c181639387ff14e1aa34ff7ae52eb6847c6c8d69a2c607403f60c2f38e46d4f9449d10fbb67298c346f3d983cd71a8b64c99b7e39e356765f0b9fa1b720f9f8b25911efde6ae9d0f18a9ff88371bad5d3cc20cfdb49aa5c9560c404b052cc0eb58940d10d9be4e8c176cfa745710b0db9133b93b13fc1c21d00f83aebafea1da0f5e098dcafaae1fc2a913e06d4432b9ed6af6a097bfd8aa80c589a6bda171291537cd91e81543c6661b8819dbf10626e491e2530fd90daebbd130f9f1d670bea8b041fd09410af354f190346ff0964714c4afe4973d8f3b2a1fe49e1b1ebc5779155d2b52e4833a387c18d5488df7b7ec4c5d5ad2dc640348fd6205216817856d1e6a88388bf3e6c176fa0e6188f5e80f3bc9f9940820f598ee7b2ae4a5180ddd268d95166c64faef1bee26319b38835628b060c6ea272e95b50557dd74a634b5fe054faa60b8c6bb94ac6cf0249c0576c9ad13ea53955e2f22b0821ecf7be039c267c0cef1fb211edd196fc08ef93a43853b629f5241cc63fdd2b1da76d052cf691d7d2399f41260c48905f8a06f17e8423237de48e36687b6719ef61d1a9379c8ae95c9840f59ed4f44e485bc9266b0112061e1476a0e9b0298b4b7660a8e2859a7a9f60ff74b89fa2b1215"})
r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0)
ioctl$EVIOCGLED(r3, 0x5421, &(0x7f0000001c80)=""/93)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000040)={0xfffffffffffffe6d, &(0x7f00000000c0)={0x0, 0x0, 0x8, {0x8, 0x0, "47f886f4d105"}}, 0x0, 0x0, 0x0, 0x0}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x5d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009b6cec20ca08602058c60102030109024b0001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x84, &(0x7f00000001c0)={0x40, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000001e40)={0x44, &(0x7f0000000bc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f0000000100)=ANY=[], 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000001000)={0x1c, &(0x7f0000000040)={0x40, 0x1, 0x1, "b9"}, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000300)={0x0, 0x15, 0x11, "2f06a706baffc52b3a01ef6c30825661a9"}, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000500)={0x40, 0x3}, 0x0, 0x0, 0x0, 0x0})
executing program 1:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x28de, 0x1142, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0)
write$char_usb(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="00000500000007"], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_connect(0x5, 0x34, 0x0, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000200)={0x20, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$HIDIOCGRDESC(0xffffffffffffffff, 0x40305829, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[], 0x0)
executing program 4:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000f80)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0x40, 0x13, 0x6, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x40, 0x19, 0x2, "0200"}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000001480)={0x44, &(0x7f0000001180)={0x0, 0x0, 0x1, '3'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 1:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000f1d566201e043c40d7cc000000010902120001000000000904"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000900)={0x2c, &(0x7f0000000700)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 2:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)={{0x12, 0x1, 0x0, 0xed, 0x3e, 0xc9, 0x8, 0xccd, 0xb3, 0x2dee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xb0, 0x87, 0x1d}}]}}]}}, 0x0)
ioctl$EVIOCRMFF(r0, 0x550c, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000d00)={0x44, &(0x7f0000000bc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r1, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
executing program 0:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x3e, 0x0)
r1 = syz_usb_connect$cdc_ecm(0x0, 0x5e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001020000402505a1a440000102030d0902"], 0x0)
syz_usb_disconnect(r1)
syz_usb_disconnect(r0)
r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32=<r3=>0xffffffffffffffff], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
write$char_usb(r4, &(0x7f0000000100)="ccb38d8bdce616f97682de0f58bba49f27363f6fac9217dac5da5a8222ea9ac8dc5c03ea00ea3bdf105685631439a1311b9885ddbd8b29e361b927fdc6ac140f140b8795f1d68dde25136a03f539", 0x4e)
syz_usb_disconnect(r2)
syz_usb_disconnect(r1)
syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYRESHEX=r3], 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000e3ddef20501da1604fa1010203010902120001000000000904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000140), 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f00000005c0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000940)={0x44, &(0x7f0000000680), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000840)={0x44, &(0x7f0000000580), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0xfffffffffffffddf, 0x0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)={{0x12, 0x1, 0x0, 0xed, 0x3e, 0xc9, 0x8, 0xccd, 0xb3, 0x2dee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xb0, 0x87, 0x1d}}]}}]}}, 0x0)
ioctl$EVIOCRMFF(r0, 0x550c, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000180)={0x20, 0x11, 0x2, ',d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x17ef, 0x6047, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc}}}}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f0000001bc0)={0x20, 0x23, 0x5d, {0x5d, 0xc, "0d3b20fc6fce750bb2631d1632758db91f50fec00966971b5a774d60d2fc22cc19dd23eb5aec5e6f11113bb19b1a0b74a84fa9b863d2629669825caf73b75f95088d209bea56803b442f058c52d18361bf07838bcd124e0e98f2f9"}}, &(0x7f0000000400)={0x0, 0x3, 0x7c, @string={0x7c, 0x3, "f4f92af5281c63dd7f2edc419f588a21cc3ba93bfdd0508b5fd4cae5e779e05ccc60341a78137ed4ddcaccd8ed8f22fd0375d59e17bb2f4195347e9a3ebff8ea5faffb04f72a7eee78e1671752b854dd732206c255e08472bc46436de6ac849500f04f4cd94d5ada7f8c60e9c78cf70954f06c3d6f34b946f7be"}}, &(0x7f0000000000)={0x0, 0xf, 0x19, {0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "67dac0a0097faf6a82948e4d71c18991"}]}}, 0x0, &(0x7f00000000c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x2, 0xff, 0x3, 0x95, 0x9b2a, 0xa}}}, &(0x7f00000018c0)={0x84, &(0x7f0000000180)={0x40, 0xe, 0x6f, "e66a1b5286549f4f2fdf163145abd93ceac6859d45b6da5ae531963c08a5d6c4662bbc5cfe1a8c752935ae26e341132b862ea1b26ce1794eb5363e3eaa0fea3fd620074fedf7c493042c5c8861354b1f857523d98f7147e446bde33095f6e7ee0f8f42b684150a0935c3bace6d62c5"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x4e}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000001580)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f00000015c0)={0x20, 0x0, 0x4, {0xe0, 0x8}}, &(0x7f0000001600)={0x40, 0x7, 0x2, 0x1}, &(0x7f0000001640)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000001680)={0x40, 0xb, 0x2, "8084"}, &(0x7f00000016c0)={0x40, 0xf, 0x2, 0x2}, &(0x7f0000001700)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f0000001740)={0x40, 0x17, 0x6, @multicast}, 0x0, &(0x7f00000017c0)={0x40, 0x1a, 0x2, 0x2ae2}, &(0x7f0000001800)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000001840)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000001880)={0x40, 0x21, 0x1, 0x4}})
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000740)={0x84, &(0x7f0000000300)={0x20, 0x0, 0x3, "8ffc79"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x236, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0x40, 0x78, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x3, 0x1, 0x2, 0xef, {0x9, 0x21, 0xf, 0x3, 0x1, {0x22, 0xb83}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x6, 0x5}}}}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x200, 0x5, 0x73, 0x2, 0xff, 0x4}, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x0, 0x0}]})
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000d40)={0x24, &(0x7f0000000b80)={0x40, 0x0, 0xcd, {0xcd, 0xb, "deedfacab946071870cf76592f7fac5c61aa1df0477ccf0e6b6fb09e17156e089e22d4a295d9638e88ce4caee36ccdbf3721e5cbe619136cecf427b0eba9e90fb41d1866d2f10279fed8a9c051773b1393ea36b29c85f35284841d1c9a31eba6c2532c1a658b51076d6781b30cc4f992bc74850de5cdc7ef81be8ff195023d727a6b164e6545a842476fae046abd4f20f360baf1b3c4804ce0712c60ac853578884dff6fd321c429f08337d7ace0d0719a4647ebcf89827e5a25a53ac6c20c83570cfb19c81aeaf70d5e94"}}, 0x0, &(0x7f0000000cc0)={0x0, 0x22, 0xc, {[@main=@item_012={0x0, 0x0, 0xe}, @global=@item_4={0x3, 0x1, 0x9, "48906641"}, @global=@item_4={0x3, 0x1, 0x7, "15ad0884"}, @global=@item_012={0x0, 0x1, 0xa}]}}, &(0x7f0000000d00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x5, 0xce, 0x1, {0x22, 0x8a8}}}}, &(0x7f0000001000)={0x2c, &(0x7f0000000d80)={0x40, 0x17, 0xb4, "c6cdb35cdb071119943c6222d783e2c8fe7e4806b0b5200b69241da38dfb833e9ffc00e647a1388aef11b5137d4b0f76caf2fe1223c25e37531ed61583f413f16cb3adffd43471de91edbb619d3718bf10f1f1846276eb27b68102a7b83d859dddc20c9eec64bac365161b673fe34e809a66cc80cb6ef87081e3b1a9b899ae0f3ed5b587385dfab8c1083fe85de85051a037bfd02355f74a6532363b76e283df37523eb66ff84f57b8bdc78d8c46a7c7f100e138"}, &(0x7f0000000e40)={0x0, 0xa, 0x1, 0x4}, 0x0, &(0x7f0000000ec0)={0x20, 0x1, 0xb7, "c6fc0cf990a46b2ccd98387770ade0a2d132e1afa490e8e9d62704a66ccd00538129f02376769d61cf475536106c1a96108cd613172fdb81f6a89ca867cd1b7ae22a0f5ba717ea64d55dc878a82fe20ea4c893e5975c729daa48bb54ce06b341199ca571ee025f4579e24a4188f027113646286677f165a7467c53ee4fc1bb4648400bd23ffe06419bf3919eb1b5f45aab9dcdf5bfb973e4357b184b83401933a89ceb4308b4e033d468c7cfd46b88334308724e2b4ccd"}, &(0x7f0000000fc0)={0x20, 0x3, 0x1, 0x9}})
r2 = syz_usb_connect(0x3, 0x13b, &(0x7f00000010c0)={{0x12, 0x1, 0x200, 0x7b, 0x64, 0x5d, 0x8, 0x16c0, 0x9b0, 0xd985, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x129, 0x1, 0x28, 0x0, 0x80, 0x8, [{{0x9, 0x4, 0x26, 0x0, 0x9, 0x24, 0x82, 0x45, 0x8, [], [{{0x9, 0x5, 0xc, 0xc, 0x20, 0xba, 0x0, 0x7}}, {{0x9, 0x5, 0x0, 0x4, 0x20, 0x6, 0x6, 0x2}}, {{0x9, 0x5, 0x719da58c5009e660, 0x4, 0x20, 0x3, 0x4, 0xb}}, {{0x9, 0x5, 0x9, 0x10, 0x40, 0x8f, 0x5, 0x7f, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x1, 0x7}]}}, {{0x9, 0x5, 0x8, 0x10, 0x7bf, 0x1, 0xc, 0xe}}, {{0x9, 0x5, 0xb, 0xc, 0x400, 0x1, 0x8, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x7, 0xfff8}, @generic={0xb8, 0x23, "7547cbe08286206889ca9fcd26b5e7d9fa45ab40ffd59a75dc1f097320e5a78840474abfc470cbccb25bd84f0cc5a2fb7919115378b0090b62ef465be16758d48e9509d6a34c9570fb69fa84968ded8c35ededfda43fb3c3a652aea24f0f658b259cb06cc994a6f0cc3840484e381cc51ddffa74fe2fe7bcf3d1a34288bd0cedc1fc4279dbd6d3174b15d43771de4885e757b66f163127ab754653f3eb69d84235f1564e256bac655720658c40b48f435f1a2f639c2a"}]}}, {{0x9, 0x5, 0xa, 0x1, 0x3ff, 0x4, 0x81, 0x4d}}, {{0x9, 0x5, 0xb, 0x8, 0x200, 0x9, 0x9, 0x2}}, {{0x9, 0x5, 0x80, 0x10, 0x3ff, 0x81, 0x1}}]}}]}}]}}, 0x0)
syz_usb_control_io$uac1(r2, 0x0, 0x0)
syz_open_dev$evdev(0x0, 0x1ff, 0x440000)
syz_usb_control_io(0xffffffffffffffff, &(0x7f0000003d40)={0x2c, &(0x7f0000003b80)={0x0, 0xd, 0x2, {0x2, 0x30}}, 0x0, 0x0, &(0x7f0000003cc0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xc5, 0x0, 0x7, 0x3, "8d2205ad", "646edb11"}}, 0x0}, 0x0)
executing program 3:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r1, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
r2 = syz_open_dev$hidraw(0x0, 0xc, 0x404001)
read$hidraw(r2, 0x0, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r3, &(0x7f0000000200)=""/128, 0x80)
syz_usb_disconnect(r0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect-syz_usb_connect-syz_open_dev$hidraw-read$hidraw-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r1, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
r2 = syz_open_dev$hidraw(0x0, 0xc, 0x404001)
read$hidraw(r2, 0x0, 0x0)
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r3, &(0x7f0000000200)=""/128, 0x80)
syz_usb_disconnect(r0)

program crashed: possible deadlock in usb_deregister_dev
single: successfully extracted reproducer
found reproducer with 10 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect-syz_usb_connect-syz_open_dev$hidraw-read$hidraw-syz_open_dev$char_usb-read$char_usb
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r0, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
r1 = syz_open_dev$hidraw(0x0, 0xc, 0x404001)
read$hidraw(r1, 0x0, 0x0)
r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r2, &(0x7f0000000200)=""/128, 0x80)

program crashed: possible deadlock in chaoskey_release
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect-syz_usb_connect-syz_open_dev$hidraw-read$hidraw-syz_open_dev$char_usb
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r0, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
r1 = syz_open_dev$hidraw(0x0, 0xc, 0x404001)
read$hidraw(r1, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: possible deadlock in chaoskey_release
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect-syz_usb_connect-syz_open_dev$hidraw-read$hidraw
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r0, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
r1 = syz_open_dev$hidraw(0x0, 0xc, 0x404001)
read$hidraw(r1, 0x0, 0x0)

program crashed: possible deadlock in chaoskey_release
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect-syz_usb_connect-syz_open_dev$hidraw
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r0, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
syz_open_dev$hidraw(0x0, 0xc, 0x404001)

program crashed: possible deadlock in chaoskey_release
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect-syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r0, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)

program crashed: possible deadlock in chaoskey_release
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb-syz_usb_disconnect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r0, &(0x7f0000000000)=""/123, 0x7b)
syz_usb_disconnect(0xffffffffffffffff)

program crashed: possible deadlock in chaoskey_release
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-read$char_usb
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r0, &(0x7f0000000000)=""/123, 0x7b)

program crashed: possible deadlock in chaoskey_release
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: possible deadlock in chaoskey_release
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$char_usb
detailed listing:
executing program 0:
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
program crashed: possible deadlock in usb_deregister_dev
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
program crashed: possible deadlock in chaoskey_release
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
program crashed: possible deadlock in chaoskey_release
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
program crashed: possible deadlock in chaoskey_release
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
program crashed: possible deadlock in chaoskey_release
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
program crashed: possible deadlock in chaoskey_release
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb
program crashed: possible deadlock in chaoskey_release
reproducing took 26m31.173876996s
repro crashed as (corrupted=false):
raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
============================================
WARNING: possible recursive locking detected
6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted
--------------------------------------------
syz-executor320/2646 is trying to acquire lock:
ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322

but task is already holding lock:
ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(chaoskey_list_lock);
  lock(chaoskey_list_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

1 lock held by syz-executor320/2646:
 #0: ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299

stack backtrace:
CPU: 0 UID: 0 PID: 2646 Comm: syz-executor320 Not tainted 6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_deadlock_bug+0x2e3/0x410 kernel/locking/lockdep.c:3037
 check_deadlock kernel/locking/lockdep.c:3089 [inline]
 validate_chain kernel/locking/lockdep.c:3891 [inline]
 __lock_acquire+0x2185/0x3ce0 kernel/locking/lockdep.c:5202
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
 chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322
 __fput+0x3f6/0xb60 fs/file_table.c:431
 task_work_run+0x14e/0x250 kernel/task_work.c:228
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xadd/0x2ce0 kernel/exit.c:939
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1088
 __do_sys_exit_group kernel/exit.c:1099 [inline]
 __se_sys_exit_group kernel/exit.c:1097 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1097
 x64_sys_call+0x14a9/0x16a0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdecf39d409
Code: Unable to access opcode bytes at 0x7fdecf39d3df.
RSP: 002b:00007ffd352f76b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fdecf39d409
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007fdecf418370 R08: ffffffffffffffb8 R09: 00007ffd352f7427
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdecf418370
R13: 0000000000000000 R14: 00007fdecf41c080 R15: 00007fdecf36b670
 </TASK>

final repro crashed as (corrupted=false):
raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
============================================
WARNING: possible recursive locking detected
6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted
--------------------------------------------
syz-executor320/2646 is trying to acquire lock:
ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322

but task is already holding lock:
ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(chaoskey_list_lock);
  lock(chaoskey_list_lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

1 lock held by syz-executor320/2646:
 #0: ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299

stack backtrace:
CPU: 0 UID: 0 PID: 2646 Comm: syz-executor320 Not tainted 6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_deadlock_bug+0x2e3/0x410 kernel/locking/lockdep.c:3037
 check_deadlock kernel/locking/lockdep.c:3089 [inline]
 validate_chain kernel/locking/lockdep.c:3891 [inline]
 __lock_acquire+0x2185/0x3ce0 kernel/locking/lockdep.c:5202
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
 chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322
 __fput+0x3f6/0xb60 fs/file_table.c:431
 task_work_run+0x14e/0x250 kernel/task_work.c:228
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xadd/0x2ce0 kernel/exit.c:939
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1088
 __do_sys_exit_group kernel/exit.c:1099 [inline]
 __se_sys_exit_group kernel/exit.c:1097 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1097
 x64_sys_call+0x14a9/0x16a0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdecf39d409
Code: Unable to access opcode bytes at 0x7fdecf39d3df.
RSP: 002b:00007ffd352f76b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fdecf39d409
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007fdecf418370 R08: ffffffffffffffb8 R09: 00007ffd352f7427
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdecf418370
R13: 0000000000000000 R14: 00007fdecf41c080 R15: 00007fdecf36b670
 </TASK>