Extracting prog: 3m49.103192118s Minimizing prog: 7m41.681341481s Simplifying prog options: 0s Extracting C: 44.962170162s Simplifying C: 6m14.72083928s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_sctp-socket$inet6_sctp-socket$packet-socket-sendmsg$SMC_PNETID_GET-getsockname$packet-sendmsg$nl_route-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x801, 0x84) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x437, 0x3, 0x3, {0x0, 0x0, 0x0, 0x0, 0x59f7b}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0x91e1e}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_LINK={0x8}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="6c0000001000370403000000ffffffff00000000", @ANYRES32=r2, @ANYBLOB="0b1b0500000000004c0012800b000100697036677265"], 0x6c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) sendto$packet(r0, &(0x7f0000000240)="060000000000000500000000000000cd86dd", 0x12, 0x40015, &(0x7f0000000200)={0x11, 0x8100, r2, 0x1, 0x5, 0x6, @remote}, 0x14) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x4, 0x8, 0x400}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000380), 0xa283, r0}, 0x38) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$xdp-socket$tipc-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH detailed listing: executing program 0: socket$xdp(0x2c, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0b00000008000000070000000300000001"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r0}, 0x38) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000000000020a020874200000000000109022d000100007b2c09040004020308000009218b00090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program crashed: BUG: unable to handle kernel paging request in u2fzero_rng_read validation run: crashed=true reproducing took 21m25.409009289s repro crashed as (corrupted=false): usb 1-1: config 0 descriptor?? hid-u2fzero 0003:20A0:4287.0001: hidraw0: USB HID v0.8b Joystick [HID 20a0:4287] on usb-dummy_hcd.0-1/input0 hid-u2fzero 0003:20A0:4287.0001: NitroKey U2F LED initialised Unable to handle kernel paging request at virtual address dfff800000000015 KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000015] address between user and kernel address ranges Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 4459 Comm: kworker/1:13 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: usb_hub_wq hub_event pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : u2fzero_recv drivers/hid/hid-u2fzero.c:137 [inline] pc : u2fzero_rng_read+0x210/0x614 drivers/hid/hid-u2fzero.c:223 lr : u2fzero_recv drivers/hid/hid-u2fzero.c:135 [inline] lr : u2fzero_rng_read+0x1ec/0x614 drivers/hid/hid-u2fzero.c:223 sp : ffff800021686700 x29: ffff800021686870 x28: 1fffe0001aa3f610 x27: dfff800000000000 x26: ffff7000042d0ce8 x25: 00000000000000a8 x24: ffff800021686760 x23: ffff0000d51fb080 x22: ffff0000d51fb088 x21: 1fffe0001aa3f687 x20: ffff0000d51fb320 x19: 1fffe0001aa3f611 x18: 1fffe00033e7217e x17: 313030302e373832 x16: ffff800011ba0e90 x15: 000000000004ffff x14: ffff60001abfc098 x13: 1fffe0001abfc090 x12: 0000000000000001 x11: ffffffffffffffff x10: dfff800000000000 x9 : 0000000000000001 x8 : 0000000000000015 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff8000186b52c8 x4 : 000000000000000a x3 : 0000000000000030 x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff0000d5fe0486 Call trace: u2fzero_recv drivers/hid/hid-u2fzero.c:137 [inline] u2fzero_rng_read+0x210/0x614 drivers/hid/hid-u2fzero.c:223 rng_get_data drivers/char/hw_random/core.c:201 [inline] add_early_randomness+0x88/0x170 drivers/char/hw_random/core.c:73 hwrng_register+0x37c/0x430 drivers/char/hw_random/core.c:593 devm_hwrng_register+0x50/0xcc drivers/char/hw_random/core.c:665 u2fzero_init_hwrng+0x10c/0x14c drivers/hid/hid-u2fzero.c:266 u2fzero_probe+0x300/0x3f0 drivers/hid/hid-u2fzero.c:359 hid_device_probe+0x230/0x320 drivers/hid/hid-core.c:2678 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x3a0/0xac4 drivers/base/dd.c:638 __driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804 driver_probe_device+0x78/0x324 drivers/base/dd.c:834 __device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962 bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429 __device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034 device_initial_probe+0x24/0x34 drivers/base/dd.c:1083 bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489 device_add+0x93c/0xe4c drivers/base/core.c:3712 hid_add_device+0x310/0x4d0 drivers/hid/hid-core.c:2830 usbhid_probe+0x8e0/0xc78 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x50c/0x988 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x3a0/0xac4 drivers/base/dd.c:638 __driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804 driver_probe_device+0x78/0x324 drivers/base/dd.c:834 __device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962 bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429 __device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034 device_initial_probe+0x24/0x34 drivers/base/dd.c:1083 bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489 device_add+0x93c/0xe4c drivers/base/core.c:3712 usb_set_configuration+0x15ec/0x1b88 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x258 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x3a0/0xac4 drivers/base/dd.c:638 __driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804 driver_probe_device+0x78/0x324 drivers/base/dd.c:834 __device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962 bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429 __device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034 device_initial_probe+0x24/0x34 drivers/base/dd.c:1083 bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489 device_add+0x93c/0xe4c drivers/base/core.c:3712 usb_new_device+0x7e4/0x11d0 drivers/usb/core/hub.c:2664 hub_port_connect drivers/usb/core/hub.c:5522 [inline] hub_port_connect_change drivers/usb/core/hub.c:5662 [inline] port_event drivers/usb/core/hub.c:5822 [inline] hub_event+0x2254/0x3e74 drivers/usb/core/hub.c:5904 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 Code: 9650352d f94002c8 9102a119 d343ff28 (387b6908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 9650352d bl 0xfffffffff940d4b4 4: f94002c8 ldr x8, [x22] 8: 9102a119 add x25, x8, #0xa8 c: d343ff28 lsr x8, x25, #3 * 10: 387b6908 ldrb w8, [x8, x27] <-- trapping instruction final repro crashed as (corrupted=false): usb 1-1: config 0 descriptor?? hid-u2fzero 0003:20A0:4287.0001: hidraw0: USB HID v0.8b Joystick [HID 20a0:4287] on usb-dummy_hcd.0-1/input0 hid-u2fzero 0003:20A0:4287.0001: NitroKey U2F LED initialised Unable to handle kernel paging request at virtual address dfff800000000015 KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000015] address between user and kernel address ranges Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 4459 Comm: kworker/1:13 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: usb_hub_wq hub_event pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : u2fzero_recv drivers/hid/hid-u2fzero.c:137 [inline] pc : u2fzero_rng_read+0x210/0x614 drivers/hid/hid-u2fzero.c:223 lr : u2fzero_recv drivers/hid/hid-u2fzero.c:135 [inline] lr : u2fzero_rng_read+0x1ec/0x614 drivers/hid/hid-u2fzero.c:223 sp : ffff800021686700 x29: ffff800021686870 x28: 1fffe0001aa3f610 x27: dfff800000000000 x26: ffff7000042d0ce8 x25: 00000000000000a8 x24: ffff800021686760 x23: ffff0000d51fb080 x22: ffff0000d51fb088 x21: 1fffe0001aa3f687 x20: ffff0000d51fb320 x19: 1fffe0001aa3f611 x18: 1fffe00033e7217e x17: 313030302e373832 x16: ffff800011ba0e90 x15: 000000000004ffff x14: ffff60001abfc098 x13: 1fffe0001abfc090 x12: 0000000000000001 x11: ffffffffffffffff x10: dfff800000000000 x9 : 0000000000000001 x8 : 0000000000000015 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff8000186b52c8 x4 : 000000000000000a x3 : 0000000000000030 x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff0000d5fe0486 Call trace: u2fzero_recv drivers/hid/hid-u2fzero.c:137 [inline] u2fzero_rng_read+0x210/0x614 drivers/hid/hid-u2fzero.c:223 rng_get_data drivers/char/hw_random/core.c:201 [inline] add_early_randomness+0x88/0x170 drivers/char/hw_random/core.c:73 hwrng_register+0x37c/0x430 drivers/char/hw_random/core.c:593 devm_hwrng_register+0x50/0xcc drivers/char/hw_random/core.c:665 u2fzero_init_hwrng+0x10c/0x14c drivers/hid/hid-u2fzero.c:266 u2fzero_probe+0x300/0x3f0 drivers/hid/hid-u2fzero.c:359 hid_device_probe+0x230/0x320 drivers/hid/hid-core.c:2678 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x3a0/0xac4 drivers/base/dd.c:638 __driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804 driver_probe_device+0x78/0x324 drivers/base/dd.c:834 __device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962 bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429 __device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034 device_initial_probe+0x24/0x34 drivers/base/dd.c:1083 bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489 device_add+0x93c/0xe4c drivers/base/core.c:3712 hid_add_device+0x310/0x4d0 drivers/hid/hid-core.c:2830 usbhid_probe+0x8e0/0xc78 drivers/hid/usbhid/hid-core.c:1442 usb_probe_interface+0x50c/0x988 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x3a0/0xac4 drivers/base/dd.c:638 __driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804 driver_probe_device+0x78/0x324 drivers/base/dd.c:834 __device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962 bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429 __device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034 device_initial_probe+0x24/0x34 drivers/base/dd.c:1083 bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489 device_add+0x93c/0xe4c drivers/base/core.c:3712 usb_set_configuration+0x15ec/0x1b88 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x8c/0x148 drivers/usb/core/generic.c:238 usb_probe_device+0x120/0x258 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x3a0/0xac4 drivers/base/dd.c:638 __driver_probe_device+0x1c8/0x368 drivers/base/dd.c:804 driver_probe_device+0x78/0x324 drivers/base/dd.c:834 __device_attach_driver+0x28c/0x4c0 drivers/base/dd.c:962 bus_for_each_drv+0x154/0x1e4 drivers/base/bus.c:429 __device_attach+0x2a4/0x3d8 drivers/base/dd.c:1034 device_initial_probe+0x24/0x34 drivers/base/dd.c:1083 bus_probe_device+0xbc/0x1c4 drivers/base/bus.c:489 device_add+0x93c/0xe4c drivers/base/core.c:3712 usb_new_device+0x7e4/0x11d0 drivers/usb/core/hub.c:2664 hub_port_connect drivers/usb/core/hub.c:5522 [inline] hub_port_connect_change drivers/usb/core/hub.c:5662 [inline] port_event drivers/usb/core/hub.c:5822 [inline] hub_event+0x2254/0x3e74 drivers/usb/core/hub.c:5904 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 Code: 9650352d f94002c8 9102a119 d343ff28 (387b6908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 9650352d bl 0xfffffffff940d4b4 4: f94002c8 ldr x8, [x22] 8: 9102a119 add x25, x8, #0xa8 c: d343ff28 lsr x8, x25, #3 * 10: 387b6908 ldrb w8, [x8, x27] <-- trapping instruction