Extracting prog: 11m57.945765951s Minimizing prog: 17m47.727982585s Simplifying prog options: 0s Extracting C: 1m31.8225627s Simplifying C: 9m4.393687306s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ecm-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0) (async) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) (async) syz_usb_control_io$uac1(r1, &(0x7f0000000000)={0x14, &(0x7f0000000280)={0x0, 0x21, 0xcc, {0xcc, 0x31, "4dfeb8c75aa3e9e737a6fada3a84d2c7f0da7ce75dbc766ca49d4487e5be340831a329c41170491220706572488714c1120ea6ae30423ffb6f435f28d8bcfedbe2efcb98c92506ecc925f52b37315532300ef80f95333b3a9b45f32a7b8eb63dc3aebb8b3fa1d9a611bbe131f5175d95e3ee1776c17d6d6fcd3c3bdb7397f29f9312d779f407dab8913bbaec092e6633f651dd408bf5d369650bdc1a856a1720bdbac11b1ee0534791e97bebea1011cdf865d5d64fb66863ad2e9edd55310ae7340767b2c4daaebb9277"}}, &(0x7f0000000080)={0x0, 0x3, 0x48, @string={0x48, 0x3, "21c203ad5664121a731f5602569bdd0e5641c8f1038803e62a9462fb6de8c30f733e950431536f52528f99342bfb9419e9b17944186a6f2e950cbd0050288dfee3bd4b5ae8fe"}}}, &(0x7f0000000540)={0x44, &(0x7f0000000380)={0x40, 0xd, 0xf4, "445361043361d6c5dc416d1a2c270cea8bf1c371b69bb43fc5b16ad5075229633d1b79be888da53688fb0f5085daf59ae90a1ee125b05328b7685d13f86b16760ac83ef8ad8aad68c9a2afbf41ac59e05e41262b75af4e10e28992c0c424054d2c3a92edfd845c92f197e55ef23120a8fecf4b97d55d205e4bd5d88488c1ff76c08b7cb46d4029d2db9dc06e57f455f3d4705589c9ec7ee0d20c057e6191036256855e61642b2052e201e624e6fb64e4a88057cce33ac3a017e206d831b62de5b91fec8e92804f726c0ec0621c30559a7950889cc5dddc2a06d3d641d351ef10ddcb90e18b5fb1a2f74e90c37969467dfec3e1e1"}, &(0x7f0000000100)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000180)={0x0, 0x8, 0x1, 0x40}, &(0x7f00000001c0)={0x20, 0x81, 0x3, "acf492"}, &(0x7f0000000200)={0x20, 0x82, 0x1, "b1"}, &(0x7f0000000480)={0x20, 0x83, 0x1, "e7"}, &(0x7f00000004c0)={0x20, 0x84, 0x3, "f122df"}, &(0x7f0000000500)={0x20, 0x85, 0x3, "707f72"}}) (async) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000140)={0x0, 0x1, 0x4, "6b08f6ef"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000f80)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0x40, 0x13, 0x6, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001740)={0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x40, 0x19, 0x2, "0200"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000012c0)={0x44, &(0x7f0000001040)=ANY=[@ANYBLOB="080001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x3, 0xf5, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c24022d63105d2b2d162a50e629b2bbbfb8ab3ccd7d5eb282b887390ab9c471521fa2"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000800)={{0x12, 0x1, 0x110, 0x15, 0x55, 0x8b, 0x40, 0x3fd, 0xebbe, 0xb643, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x44, 0x0, 0x0, 0x3d, 0xa9, 0x23}}]}}]}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$hid-syz_usb_control_io-syz_open_dev$evdev-ioctl$EVIOCSKEYCODE_V2-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000043242108d81301006230010203010902120001000000000904ee03"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000180), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r2, 0x80104592, &(0x7f0000000200)={0x0, 0x2, 0x0, 0x1000101, "0020946fc67f0000201b14700c1e0ac74f000000001600000000000900"}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000700)={0x40, 0x10, 0x1, '\a'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$hid-syz_usb_connect$cdc_ncm-syz_usb_disconnect-syz_usb_connect$uac1-syz_usb_connect$uac1-syz_usb_connect$cdc_ecm-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x46d, 0xc71e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x20, 0x10, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x3, 0x6, {0x9, 0x21, 0x4, 0xe, 0x1, {0x22, 0xaca}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x73, 0x7, 0x9}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0xf4, 0x3, 0x7f}}]}}}]}}]}}, &(0x7f0000000740)={0xa, &(0x7f0000000400)={0xa, 0x6, 0x310, 0x6, 0x80, 0xb9, 0x10, 0x1}, 0x24, &(0x7f0000000440)={0x5, 0xf, 0x24, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0x3, 0x9, 0x9}, @wireless={0xb, 0x10, 0x1, 0x0, 0xe1, 0x0, 0x2, 0x6, 0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x3, 0x3, 0xb, 0x1}]}, 0x5, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x413}}, {0xd9, &(0x7f00000004c0)=@string={0xd9, 0x3, "c99bd6413f34b9906799eb3d5724d4a5e1465f44dbb458c5d2d1f101f582b3b5fb071f464bee97aebcf525be20b213ce25619c01c3ec4752f5ecb9b9531d190fdb998092d9c4a2d88e206d2ccaefe7cd756d58f328d1c45d93b17d0e2e8c9e3d4ed6384240ea096d4f7ee5160130dded3738a932657ac695e6c8ea5a0e5df889059b46c2b3a1cd1099cad3ded9d9c3c5733dcaa96350c48cbb52e538ba8057c7b7c7afa3c491e5273b365f40ec9a3fe36f7ad1a365ebbb30a21352368d63b6464cf526b3d8c82aed4c066aa51789149f98f33f116a8f02"}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x80c}}, {0x9a, &(0x7f0000000600)=@string={0x9a, 0x3, "ab3592bd68f91b4ea703f325696b51d45bb8c9517eb4ae30c7011cad1948676c8062c7ca95cda657023064f6c939877d14b058ae7dc4a39addae769b73ab0930b33d34fc3f9628960e7a18a6501ed64a770255c4a965e8deea8be1daf715cc39d0f5a60a9e509669ac2cf1165dc9582b5c65bda8a55a6325e10fd7979d00663b4a760cccca6d2bca1c44579fec5e6e357066a7a8d18dac68"}}, {0x68, &(0x7f00000006c0)=@string={0x68, 0x3, "908669c425ea5a5488da67b3fcb534b34cd393e142b1a5965e7dd60ce9ca71b0ef41cbd6c78823671ddb1735d17bcbff674037c523e9c4edc86eb052f208996f370a74812bebdd86a134be08c48adcb9e177eb5408f893ff5bc5124f4ba9ff633cd237e575d3"}}]}) r1 = syz_usb_connect$cdc_ncm(0x4, 0x1c9, &(0x7f00000007c0)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b7, 0x2, 0x1, 0x3, 0x40, 0x3, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "b7f7e08d"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x7, 0x3ff, 0x10}, {0x6, 0x24, 0x1a, 0x8, 0x77}, [@mbim_extended={0x8, 0x24, 0x1c, 0xff, 0x7}, @mbim_extended={0x8, 0x24, 0x1c, 0x7, 0x58, 0x7}, @acm={0x4, 0x24, 0x2, 0x8}, @dmm={0x7, 0x24, 0x14, 0x4, 0x1}, @mdlm_detail={0xb7, 0x24, 0x13, 0x3, "d02c5c9fb66f87d166e36e7bc3437f5a0055642c57f63c9fd70e41431f7b4c38e139aae64f89f98b057e859c5b2c05d8d1dbffd0d81f9aa015f7acb9d41e430168caa5d0aee5eb16da00f1ef4eba47a028d5ab191f87d83dff98aa233f7c6887f010da148be071d8cb8ef1cfaa00711296aceb1340ba4a92a740ec3418f97a40c47ba5d66c18ff8922ba0efb6e8fff097ba544e6f7a42cef7ae7807d0b95fef668d756ac0f0f462580dd1d138761f2178fbf5f"}, @mdlm_detail={0x85, 0x24, 0x13, 0x7, "c6bfb23ee81d5c7f9bb5a5494e2c3ac699d2af24c51237c38354ef33d21fe223c180f9c8793569c0d9c5a15985b6a6fa7ea9b94078b3b4966bf9ea8b6c925456587f4726f43ecc2ad4bfde2483cdcc8a6ed739d88991cccd502a9140d3386be9dabe25377304ee943c051359b750eb46b964ac55ef3def7558fa3beeeb4403fd92"}]}, {{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x7, 0x81, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x7, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x2, 0x5, 0xfe}}}}}}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f00000009c0)={0xa, 0x6, 0x111, 0x8, 0xc, 0x1, 0x20, 0x47}, 0xc, &(0x7f0000000a00)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0xe, 0x7, 0x8000}]}, 0x5, [{0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x816}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x685e}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x802}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0xc0c}}, {0x6f, &(0x7f0000000b40)=@string={0x6f, 0x3, "0fd5196c36e60a2ec6e56e79913e67ea42a465d8ce6648d55a911a639eab4294b499f8e2906ce71884da983f6f4c57737a354948c489e404bf32aa05e34d960373386c69eb624762358912156c64797e98379a66ceee9798a52d0a54759700de82326a7649c5ba7cca8b3498a2"}}]}) syz_usb_disconnect(r1) syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000180)=ANY=[], 0x0) (async) r2 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000180)=ANY=[], 0x0) syz_usb_connect$cdc_ecm(0x2, 0x50, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3e, 0x1, 0x1, 0x2, 0x10, 0x3, [{{0x9, 0x4, 0x0, 0x4, 0x3, 0x2, 0x6, 0x0, 0x76, {{0x8, 0x24, 0x6, 0x0, 0x0, "2fa4d5"}, {0x5, 0x24, 0x0, 0x628b}, {0xd, 0x24, 0xf, 0x1, 0x4e, 0xd, 0x9, 0xca}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x8, 0x3, 0x2, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0xc, 0x6, 0x1}}}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x250, 0x0, 0xff, 0xf, 0x20}, 0x2c, &(0x7f0000000180)={0x5, 0xf, 0x2c, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x12, 0x2, 0x4, 0x8001}, @ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x6, 0xf0f, 0x2, [0xff3f00, 0xffc0ff, 0xff00c0, 0x0, 0x3f00]}]}, 0x4, [{0x55, &(0x7f00000001c0)=@string={0x55, 0x3, "3f384eb5726fb79768dc0f42ace4c230121a499e20e6cf5ef661b502c5c8c6137b557245f64d9f7dfe841616c725224ea57681e0e02c09c46cf36e5159a9722b924aa887a6c2ab976457f24ca2f30b8574cc6f"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x3c01}}, {0x7e, &(0x7f0000000280)=@string={0x7e, 0x3, "6353fe681b1d58f8ebd3564b58144ea4cb22cc33a73288a521ebf2f1a285814bba9e00858cbe8668dbe461cdcd1c0fa41c85ee384596523d42544a9769aaf66157b603f9ea3ed7f42acd439c2a58a7849c31322063fae2d169bee6bdd73b856ee04d46ddb03653e45b0d5ced9dfbba743d48a747b54f295497c1064d"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x827}}]}) syz_usb_control_io(r2, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="dd6e277b7f68937f"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) (async) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x0, 0x0) (async) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$cdc_ecm-syz_usb_control_io-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_connect-syz_open_dev$char_usb-read$char_usb-read$char_usb-syz_usb_control_io-syz_usb_connect-syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$printer-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_connect$hid-syz_usb_disconnect-syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_disconnect-syz_usb_connect-syz_usb_ep_write-syz_usb_connect-syz_usb_connect$hid-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x17, 0xdc, 0xb4, 0x40, 0x41e, 0x4011, 0xaf98, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x82, 0xdd, 0x97}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000001c0)=ANY=[@ANYRESHEX, @ANYRES32=r0, @ANYRES8=0x0, @ANYRES8=r0], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0x62, 0xa1, 0xb, 0x40, 0xc45, 0x1010, 0xe6fc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x32, 0x0, 0x1, 0x97, 0x40, 0xa4, 0x0, [], [{{0x9, 0x5, 0x82, 0x3, 0x3ff, 0x0, 0x7e}}]}}]}}]}}, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0xffffffff) read$char_usb(r2, &(0x7f0000000000)=""/73, 0x49) read$char_usb(r2, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000040)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x2, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_connect(0x0, 0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004635164200a51c0102030109023200020000000202ff00052406000005240000000d240f010000000000000000000904003c791f3d128e6866bd0d11960d77dc1ec8201b69f9a6b2bd39da7b2098d1961322746349d7dc2f12538b99b4098d027b4d3115e6580eb1f8623b8df354eecd94ad53f48a53bd1c14d0d18c6048c5f4ac03fb9e5e075af821822bf31acc481c045f1188b532880d156edf572b7714b1d62e0356a43b420d60f32b5a49718388665ee12e03007cea2e8e973bfb5384573cbcf136f417a2f4e12bf9d56105a74076614df98a0310384ff422771faa31fdbfef5608531564511681"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000200)={0x20, 0xd, 0x5, "3418285eaa"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000bc0)={0x2c, &(0x7f0000000a00)={0x0, 0x15, 0x4, "04269379"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f0000000080)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921"], 0x0) syz_usb_disconnect(r1) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1044, 0x7a4d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x10, 0xfc, 0x43}}}}}]}}]}}, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f0000000940)={0x2c, &(0x7f0000000780)=ANY=[@ANYBLOB="0024750000007511b638b09947b42ccd10b2fde62629b04ad40174d77bdf34675404000000000000002623ab315e5c5e903e518b034c69244cf3c13defec5ab8095c8608adde76fdb77e988040e38a2cc05fe5cf7be3027615cdd8b3c6b9c61dbaab2087c74b994bb97ab78dc1e463b1b2e70346a59fdfc9136659c4311200000000"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_disconnect(r5) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c4b20710200e0101"], 0x0) syz_usb_ep_write(r4, 0x81, 0x0, 0x0) syz_usb_connect(0x4, 0x0, 0x0, 0x0) syz_usb_connect$hid(0x4, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010102000000ffb827ed0140002002030109022d000101aa40800904000e00000000040000030004090502031004ff400200007c00"/63], &(0x7f0000000700)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x310, 0x3, 0xf, 0x1, 0x40, 0x5}, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}, 0x5, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x40c}}, {0x95, &(0x7f0000000480)=@string={0x95, 0x3, "bf5218dafe66f964d885a97d35783c8164cb490aca56517ae0c137c33c092a4772c648f19b77480426ea6d35d06a9cb25d7d88e8ff6773093516c99d79d9da1de8ae4e279327006d3a4e5a246cf174b5cc18fa3c0ed6b32add5697e9bf02b8e2629758bff27deb54dc8fa4810f1b542b4527f8e9155ea29269d932afb4303aaf2e38c3140d0254e61a55b44d505fdf74ea4ee4"}}, {0xa3, &(0x7f0000000640)=ANY=[@ANYBLOB="a30369693d2efa968ffa7cae1c06d4c4780a91aa112b9104442cc59170eaaeb2117d2efc59d625fadf94a60500000056598040405b1a0a31f2b5c438c6e9748432c0b981801efe4d3040469d14b18d859ac7f59c927de232867bafbd3f261629e54a615dd9a568d8be8e1857d41afdc6623e06f552097f620f5c2f142f72817c105e9e2aae591fcd39e1698773ab4f67b29860f777b31d0c9a2268946aff162ae70aaa"]}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x423}}, {0x5e, &(0x7f0000000540)=@string={0x5e, 0x3, "c5d8b4faff5fed4f7ccb4a6fa254a9d35225ddc31088076c973a02c1e990ae3449302eddff1d5baabb04e9772cd7f704f1a25f34ee1909c4be22a9bc910234097f22d67fb131fa4e19add6ec6c67123f34a6d4eaf93ccab90051a60f"}}]}) syz_usb_ep_write(r1, 0x81, 0xac, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2") program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 28, 14, 6, 8, 14, 20, 15, 22, 13, 23, 5, 3, 14, 30, 17, 25, 30, 36, 20, 9, 13, 16, 4, 29, 13, 9, 8, 3, 12] detailed listing: executing program 1: r0 = syz_usb_connect(0x3, 0x35, &(0x7f0000000300)=ANY=[@ANYBLOB="120100004aaf36207205a2580a27010203010902230001000000000904010901a37d7e03090500004000020401080b01fe"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x75, 0x1c, 0x1, 0x10, 0xfe6, 0x9800, 0xd19a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x29, 0x2, 0x0, 0xb4, 0x8c, 0xbb}}]}}]}}, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000240)={0x14, &(0x7f0000000140)={0x20, 0x11, 0x4b, {0x4b, 0xc, "93f8b66870ff454f4a77538cb8fd9233c920b59e991da7d9b3da585b8ea090d74fe920995040269c67e5b86b537cbf515ca163b216cc6d8a2a1542abdc95e47ae7e2bcba7a2e845d7e"}}, &(0x7f00000001c0)={0x0, 0x3, 0x4e, @string={0x4e, 0x3, "4f4a6497ba600ed0f826ae45a3b082cf231c69a5d0924ffd7ea03b651e68db668a8e926bb221cb0643cfa178b3770de909923c4b26021f76c401bf925f352bb27199e81a6e83fd094fb65b5b"}}}, &(0x7f0000000980)={0x2c, &(0x7f0000000580)={0x0, 0x3, 0x78, "38af60e31e53b9807d97d808722019dc33cd5db59e1500dfba10e33b5b00b3473c0f2fb22679e15d6d64e157a962d1198278d756457cab80f1ce1965dacf62dbb771bf6ffa3ad19f7ba5c04f0be8d87038507f060019e7ede1ba00d185fcb663e23b918f92122745148caaad6554590d470419c2333a2040"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0xe5}, &(0x7f0000000900)={0xc0, 0x5, 0x6, "65828180970a"}, &(0x7f0000000940)={0x40, 0x5, 0x3, "ae5032"}}) syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0xed) read$char_usb(r2, &(0x7f0000000500)=""/67, 0x43) syz_usb_connect(0x0, 0x56, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000084a48e08d112f74247aa000000010902440001000000000904000003ff0169000524060010"], 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_connect(0x2, 0x51, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x90, 0x67, 0xfa, 0x20, 0xbda, 0xc82b, 0x2b28, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3f, 0x1, 0x0, 0xfd, 0x10, 0x0, [{{0x9, 0x4, 0x64, 0x7a, 0x5, 0xff, 0xff, 0xff, 0x9, [], [{{0x9, 0x5, 0x8, 0xa, 0x20, 0x2, 0xff, 0x81}}, {{0x9, 0x5, 0x2, 0x2, 0x400, 0x6, 0xa, 0xb}}, {{0x9, 0x5, 0xe, 0x2, 0x20, 0x1, 0x5, 0xc9}}, {{0x9, 0x5, 0x6, 0x2, 0x200, 0xb6, 0x5, 0x64}}, {{0x9, 0x5, 0x1, 0x2, 0x40, 0x6, 0x6, 0x9}}]}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001040)={0x2c, &(0x7f0000000dc0)={0x0, 0x14, 0x5, "9bfbbdaf94"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$hid(0x6, 0x36, &(0x7f00000002c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc283, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x90, 0x7, [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x1, 0x2, 0xf, {0x9, 0x21, 0x0, 0x51, 0x1, {0x22, 0x3f8}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x9, 0x4}}}}}]}}]}}, &(0x7f0000000e00)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x310, 0x0, 0xba, 0x7, 0xdf, 0x4}, 0x2d, &(0x7f0000000c80)={0x5, 0xf, 0x2d, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "5968580b0f7bd0259a4bbd573379ddbb"}, @ss_container_id={0x14, 0x10, 0x4, 0x5, "805b1524b7459af248cce5abab66cab0"}]}, 0x4, [{0x4, &(0x7f0000000cc0)=@lang_id={0x4, 0x3, 0xf0ff}}, {0x4, &(0x7f0000000d00)=@lang_id={0x4, 0x3, 0x100c}}, {0x4, &(0x7f0000000d40)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x4, &(0x7f0000000d80)=@lang_id={0x4, 0x3, 0x180a}}]}) r3 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000086a042700000000000001091e24000100000000090400000103000000092100000001224500090581030000000000"], 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000480)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x46, 0xd0, 0x2, 0x40, 0x1498, 0xa090, 0x77b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x40, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb4, 0x0, 0x0, 0x18, 0x33, 0x37}}]}}]}}, 0x0) r4 = syz_usb_connect(0x0, 0xdd, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xc4, 0xb8, 0x68, 0x8, 0x2357, 0x109, 0xbdda, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0xf1, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0xff, 0xff, 0xff}}]}}]}}, 0x0) syz_usb_disconnect(r3) syz_usb_ep_write$ath9k_ep1(r4, 0x82, 0x130, &(0x7f0000000680)={[{0xa3, 0x4e00, "b8a53d866408fad12fa15c0755de738e51e30dde7ad033d5bc238d0573909f8dd6d992878182545c9d16aa02e2061c126945badb8d78e3cf4adfad6743f9ca32dc5e92d046cf0bb48bdfb99e4ed5aa32977671aa7b98ac466a794bdfece9f5dbc527cb399e8ce1c8e56b3c0cf525e7fdaf632b0ff37bab8a031babf2bf57e59dae0efe13be0569c66d494cdc26eecc62f052b0491b641835d0c2a27ae26bc7edb458e1"}, {0x83, 0x4e00, "2873e875784f36abb2621289d90616b527138e91e4372746c0b6f0247cf78fc11cd3233a4a8c2659fae9d9155b32cc1e618f8b07d62a00007ceeb333107fda7e36b0eead3b968d00000000000000007ba733adc657544a3562a4af134262736f5aff2f3df1517fe4afb6f7846553d7d6e947fdafe1e6c95e516768c05d01120e2cdcca"}]}) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000b80)=""/231) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x49, 0x93, 0x4d, 0x8, 0x5ac, 0xed81, 0xe7fb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xfe, 0x0, 0x0, [{{0x9, 0x4, 0x70, 0x0, 0x0, 0xff, 0x1, 0x1, 0xa}}]}}]}}, 0x0) r5 = syz_usb_connect(0x2, 0xaa7, &(0x7f0000001080)={{0x12, 0x1, 0x111, 0xd1, 0x52, 0xd1, 0x40, 0xabcd, 0xcdee, 0x5724, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa95, 0x3, 0x3, 0x8a, 0x80, 0x33, [{{0x9, 0x4, 0x5d, 0x6, 0xd, 0xf9, 0xbc, 0xd6, 0xb, [@generic={0x29, 0xb, "f054ccc0d530536ef5da915bedd513ae2958a28afa26ba14ef477fd587dc1760c269db2f6cb780"}], [{{0x9, 0x5, 0x2, 0x7b3a237f1cd3f8d2, 0x10, 0x2, 0x1, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x4, 0x505}]}}, {{0x9, 0x5, 0x9, 0x4, 0x200, 0x6, 0xf8, 0x6, [@generic={0xd2, 0x9, "dff081ce904aa9776366e2eac44609eb3f67e6cb02d260f75c20b723f140120f5e7230a6c45cbe7043d9738c1c893f9eddd65619fbd4987ff99c2b5da9226f1d02184d021f2bd86c775c96f3ea0dc2f3c8e5a1dfe606fb42d8e9d0428e8b4958310965e663693580c871db885dcba8a698ba3236d770ff10779df03568f49af2d095326c261c720bb1c694fc49c9578524ac707ba5ba1702126485b222911144372b8025102cc99407a96302209f7ed9ea87a9a71ea4920b53e2e4c46ae10169ab00e79e17d058aef459e203af3605b7"}]}}, {{0x9, 0x5, 0xf, 0x2, 0x10, 0x8, 0x24, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x2, 0x6}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x0, 0xac34}]}}, {{0x9, 0x5, 0x3, 0x0, 0x400, 0x6, 0x8, 0xa2, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x4, 0xc}]}}, {{0x9, 0x5, 0x4, 0x3, 0x10, 0x6, 0x7f, 0xd5, [@generic={0xb1, 0x17, "62b518f5481c7a14ecb30f8c737087886975cf9e34b7a777c55180242cd9fa0fcd4ec4be290f82043d896f596996d5590a92ad1c0307ec4fadb5f4e475cedae19df880b3a34a4d7354385b10d1c3f8c7858cea989b26ac9de85dc94f8cea213e6dcc1a59c95bd38838fbdd6d8d85ec910c9ad8367075847339f06f75e276542ab63bc7022fac53dd686f6b6850bc341a6d74a3180c077c8172f2277718ff122f7972a3c60c8fe77ce057a08c65e736"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x1ff, 0xfa, 0x10, 0x4, [@generic={0xfa, 0x10, "40d80061621324818d4f3d095965cb9f8e7058a1a4c11bfb6552c5351840851ec164072ecff5f98e0f01132565d443cdb494d7abe09d1d4f66396d29485bd59a7690904707e00c6e850a0474b4b12df3a9d7f4e0c6e73b010f2e8f8b406a1d1c137e893fe21de97e689e7014091f9d25affc13075182256756e7a5380131a4b09e3810239b805b61d0214cbe93dd47235e637cec3a1b7deb676f743bb3b97dc87bc96757fe5a50764c2154115552985adda0acc06c1ea16e07d4ec4314bcfd05d4c086ddcda4803d6897cb9ba9e35c0f9aa128455e9ea6a46f17b93495a3d58fbfdcbea1e5b628c6ed956516f37ca8c92350e9f98faa4da5"}]}}, {{0x9, 0x5, 0xe, 0x10, 0x10, 0x9, 0x7, 0x5b, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x80, 0x200}]}}, {{0x9, 0x5, 0x9, 0x0, 0x10, 0x8, 0x6, 0x40, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0x400}, @generic={0x1b, 0x10, "e495cf5a72d8f0987282aeb0f1ee2dd43cc6ad898716f0d517"}]}}, {{0x9, 0x5, 0xa, 0x1, 0x3ff, 0x7, 0x2, 0x49, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x0, 0xfffd}, @generic={0xd7, 0x4, "c07907e8d0bc84b5cb761c4ce2d01e512ebf4d9208f6e2a850f5e51c7cef6566cf59782ead5824b172a9e4a71c306a5ea70598b603adb8e323d92422cb2b2b900023540dcc144a133316ae105a999e1b174ca1def5ab541c00b95864f7fa09da2402c129442bc136aa6581163fd299602594f10c52cc6916f8d7fcbbdfbd8a16f67f9bf65c91f4aeb85ebb447bc02a524f4e3c80f8db5eb3466517c427e9b745752030a0b4c7a68deda2f3bc9312df91362d9063a03ce52b7b8332c550f8eb4c7768160baf345ecaca7994598e7d1402b6234614c2"}]}}, {{0x9, 0x5, 0x7, 0x0, 0x8, 0x0, 0x8, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x101, 0x6, 0x2}, @generic={0x62, 0x21, "42c96d2f2da5debb58466841e4464c0b085baad35df75cc2954464027e018cab659875fd260b1b5f0f14409fb7939a053bd70d8a9490147b8b150960d1e5c06f29a1f4765089f5c9c02577056502ddc667177d26490081bc873226967c3b302c"}]}}, {{0x9, 0x5, 0xc, 0x10, 0x19f, 0x8, 0x9, 0x81, [@generic={0x84, 0x6, "6aae56e109fb109fb94f3dceb8dccf96d689693131484b338beea60fe4dd85fda8ad2515721903d8ab2fb3fed741dcc5b113b0401af69c1f2d27fd2777561ddfeabe2ded3cb4cec4052b1c2fb4febc9b897da1ad6891fc0639381b0ab7891e33b5e99d4886836f2489801f8f74e7f315225b4a1fdc78bde86fc8d5eace69c7827024"}]}}, {{0x9, 0x5, 0xf, 0x4, 0x400, 0x4, 0x0, 0xbc, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x4, 0x2284}]}}, {{0x9, 0x5, 0xe, 0x0, 0x20, 0x3, 0x5, 0x2, [@generic={0x12, 0x24, "36c5774183214589e4636001c68c142c"}]}}]}}, {{0x9, 0x4, 0xb3, 0x2, 0x4, 0x13, 0x6e, 0xb6, 0x0, [@hid_hid={0x9, 0x21, 0x54, 0x1, 0x1, {0x22, 0xbd7}}, @uac_control={{0xa, 0x24, 0x1, 0xdb, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x6, 0x304, 0x1, 0x2, 0x7}]}], [{{0x9, 0x5, 0x80, 0x2, 0x3ff, 0x4, 0x3, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x3, 0xe}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x8b, 0x5}]}}, {{0x9, 0x5, 0x7, 0x0, 0x3ff, 0x10, 0xcd, 0x4, [@generic={0x47, 0x2, "44763b372091992f2e8167b12355033c59f5c9a0ce7f29949b128a66e4d20e59113ce456492aecd79037b53331161e86aeb7d8da92ea6822cda7be086f0531cd588e8648cf"}]}}, {{0x9, 0x5, 0x5, 0x2, 0x400, 0x8, 0x0, 0x6, [@generic={0x33, 0x8, "bb89ee72a7bf8e6ea951bef86f7f65d04ada7c9c612130c58926bc206ff0cfd7156e83b123efea65b43a72961953dd25f5"}, @generic={0x2c, 0x3, "1f28aaf9816508c1505d9bb59ca7f0b4188a631c1950df3cd14063bff35fda098e119aae657420df2ac6"}]}}, {{0x9, 0x5, 0x5, 0x10, 0x40, 0x7, 0x7, 0xc8, [@generic={0xea, 0x9, "0660a58a0b4be0080c485626c34f15928d6f75f63463b91de9edd939f2df09979cd573417058ada4e6b7a09a660cf24bc2dc64ed2a4e9fb80883059f883f1c2e358afacdc611ffd6a5f9ff38a35574f55ad455feea8efb98d7da03e442741768a83a0acc31b9b8c834fdfa0c05a068b432ac3c288b45fdd2c03fb513e7f6ff4a92054b8aab57371482c85c559c30d5141e9130ae152aa795d6efc702507f1c8a019f563467105a37b40c968750ec2c414f9f5c3e8cbe780cd4555548601fbfb8c2e01b786de35efe43072a46008771b74f07026baef39734f5793a70330d40e3a2099a90bea7ca0b"}]}}]}}, {{0x9, 0x4, 0xd3, 0xa6, 0x8, 0x9e, 0xe2, 0x9d, 0x6, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "c19b328f6ef6"}, {0x5, 0x24, 0x0, 0xfffe}, {0xd, 0x24, 0xf, 0x1, 0xc, 0x8, 0x14c, 0x7}, [@mbim={0xc, 0x24, 0x1b, 0x800, 0x4, 0x7, 0x6, 0x1000, 0x2}, @dmm={0x7, 0x24, 0x14, 0x400, 0x8}]}], [{{0x9, 0x5, 0x5, 0x0, 0x8, 0x23, 0x8, 0x15, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x7, 0x6f}, @generic={0xa, 0xa, "d999e44aa599e5f6"}]}}, {{0x9, 0x5, 0xa, 0x4, 0x400, 0x90, 0x1, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x7, 0x2}, @generic={0xa1, 0x21, "08f9714f355c374f65536e2b8fb1838fd0c9c5296c4c70ebc6b8b4aad930b0be87683bf9ce14d1579a6a35bc33fd0312f96968d4164dbd7dc17e5bcc4932546d227b50324152c0e3e4134e6d34e912e1c4dc88ef5cf7bf4eb71202ee5fb4ad1221db8e643e1ac08eb2a627b6a1fa2ca011eb82834eec9ba2dfc74265d8fb6cd68f54880c52187fd3e766b4db034d6de515d5fe12c0f0fd8fd48e80102f32e7"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x40, 0x8, 0x2, 0x1, [@generic={0xb9, 0x2, "830b6fcf9dea36152b53549f9f0de8775a476ee21ceaea2dd90125859b804523a6b56dd4c14c709fe3e1b0105922f556519416244f41793bab1feaf5af225318df27a3ade77066ab2f9305d832a592943e6f21f69bec634d496e7522b7cf1a7c20fd3eef15cc4063e88abff7c1e06d9c93e38fa4039859ebea5147349c5a46607ac30cca5a5304126a870d99d2b0abae3ac93e15a7162c45320d25f7ca2e5931bfe7eda0fee994b79973a6aebcaf7dd0ce26983393fafe"}]}}, {{0x9, 0x5, 0x1, 0x2, 0x400, 0x9, 0x81, 0x8, [@generic={0x89, 0x33, "cbed0fbe4a74dc2745440929c95f517460a5156c247ccdd5d7ff58ec33f0e6a012bc126ec645584a0299eb55c000d9783c4a33e938583d5fbf9ef6ea9f22270fed0e74a4eecca369e805885d25039ef6cb4ca77cc094dc8fe889114d9b5daf922e157ecc9a93a6c567537bc9d8214db1e3c80ded49968ec8b40b55aed37fb13a49180806404186"}]}}, {{0x9, 0x5, 0x8, 0x8, 0x8, 0x5, 0x7f, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x83, 0x1000}]}}, {{0x9, 0x5, 0x1, 0x0, 0x200, 0x0, 0x9, 0x4, [@generic={0x5a, 0x6, "659c56fc3099a3a89b4c247fadf4c41f347899ec8553ff025d21edeb26bc14696bf0a6ad7cfd7227e4ce0c0186de16a5f8b63bea3adfd89ebfd6fad622f58b79f9848c44dc692360a8ad10a60c9bafdb94572b505562858e"}, @generic={0x1d, 0x9, "eb63cfb5f82521aefe7233c35a247a17386f3c507608877bffe1e2"}]}}, {{0x9, 0x5, 0xd, 0x2, 0x10, 0x62, 0x82, 0x4, [@generic={0x51, 0x5, "bcf70b81b8fa25f02b6e604a691e1b7cdf370a85812487d797b03d8eceae67aee383f69b3104a70eb3377a80572d76820f9d60dde0a094f28bac11c268e93f1c966ee98c2065c263c85ab208e6e475"}]}}, {{0x9, 0x5, 0x5, 0x10, 0x208, 0x4, 0x0, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x3fbb}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x1}]}}]}}]}}]}}, &(0x7f0000000880)={0xa, &(0x7f0000000800)={0xa, 0x6, 0x110, 0x9, 0x80, 0x4, 0x20, 0x4}, 0xcd, &(0x7f00000009c0)={0x5, 0xf, 0xcd, 0x3, [@wireless={0xb, 0x10, 0x1, 0xc, 0xa2, 0xa9, 0x8e, 0x1, 0x7}, @generic={0xb2, 0x10, 0xb, "5ce9f194945766d2c7441f1bd503562cfee41bb42799c79f1c4ac55e75b20b1afe9e3bb5789fcdfc200597d0c08129ebcee92a8053601d1717bcbecdd0b8019426a603e9109e4b89e27e89dc702a68e123435a84794629e2ae5991dce1fb8cf5277c3ad14586884c49d68678549a9d093198f78358f5288949bde1d361992f43b47d12a1b3a11b88e3e7cf1620396817bd53a759ea1b93f513c1f87f7284a641db5c81362d5fbcc3c114f97b56b717"}, @wireless={0xb, 0x10, 0x1, 0xc, 0xa, 0x8, 0x10, 0x9, 0x58}]}, 0x1, [{0x2e, &(0x7f0000000840)=@string={0x2e, 0x3, "3a7cec086d9e746d74e2fb81a5337cb6a13c357dafe10905a9a32fa75043a7195eaca80358fcd07da2f9f1c2"}}]}) syz_usb_control_io$lan78xx(r5, &(0x7f0000000040)={0xfffffffffffffe5b, &(0x7f00000007c0)=ANY=[@ANYRESOCT=r0], &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3401}}}, &(0x7f0000000440)={0x34, &(0x7f0000000ac0)={0x60, 0x7c5e0756df3cf934, 0xa0, "e1e7406f5ae804a194ca0ac8d000eb0e3d9ea8c5f4d5ef94215745e815c453365fee75e6f5ac8c69fadb0bc20715d84a5d534c81dafd83b91cd67a359bc462748ce04bf6b7088a00000000000000d35dee68680f000000000000007b6138bc69ba3363c89a36acd7b15d08f1227357c908ec9217688fac4cc90cd379b5d85270fcb917d1724a5b07b80f6f9e42039495245c7e560ee1b74670ec5c84507b685b"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000008c0)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000380)={0xc0, 0xa1, 0x4, 0x200}, &(0x7f00000003c0)={0x40, 0xa0, 0x4}, &(0x7f0000000400)={0xc0, 0xa2, 0x2f, "072e831014a98477a1988368d2a7fa7a91423522efe3c0182f13ea96a711f6a2f58d623ad0f6348a3de5e89cf51ef7"}}) syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[], 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d010140010102030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c2402000000030000000000092406000601000000092403000000000500092406050001", @ANYBLOB="96"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000001000)=ANY=[], 0x0) syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d010140000102030109025f0009000c00f40904000000010100000a24010f00010201020904010000010200000904"], 0x0) r2 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d010140010102030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c2402000000030000000000092406000601000000092403000000000500092406050001"], 0x0) syz_usb_disconnect(r2) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000001000)=ANY=[], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000001380)={0x2c, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0003020000000203c2"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f00000007c0)={0x14, 0x0, &(0x7f0000000780)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000440)={0x20, 0x8, 0x1, "d7"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000280)={0x20, 0x15, 0x1, "9c"}, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000001380)={0x2c, 0x0, &(0x7f0000001180)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000100), 0x1, 0x380402) ioctl$EVIOCREVOKE(r4, 0x40044591, &(0x7f0000000140)) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r5 = syz_open_dev$evdev(&(0x7f00000000c0), 0x5, 0x200001) ioctl$EVIOCGREP(r5, 0x80084503, &(0x7f00000013c0)=""/4096) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000a80)={0x34, &(0x7f00000008c0)={0x0, 0x12, 0x5, "9f13e1c5a8"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000ac0)={0x34, &(0x7f0000000080)=ANY=[@ANYBLOB="20180500"], 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfffffffffffffe9f}}]}}, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100002439da20cd061201a2d20102030109021b0001000000000904000001717ffe000905a1"], 0x0) r1 = syz_usb_connect(0x0, 0xdd, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c4b8680857230901dabd000000010902f1000100220000090400ff010000ff00"], 0x0) syz_usb_connect(0x0, 0x6d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003cda2a200a111022"], 0x0) syz_usb_control_io$lan78xx(r1, &(0x7f0000000040)={0x14, &(0x7f00000001c0)={0x0, 0x21, 0xf7, {0xf7, 0x23, "0d558124db7284fdbe6412058d9269ea5ece92be53c99134143509d584bfd80730b30a9cb8333ba41be1e311eca1bf6376d947c67600825baef6355abee35ddbab4cd403a6f8cafa90c49ae3f45682f053dcc9cab664c2eeb9909c14824c91f9358ef1fdfbe590ad036ea97c0d0decba29d5c46bb3d82441767e0d1f59f5828872561fd647a09c5f0ffa1428303007e1d4b8ed83f6af7665be3110cafb8c68639f511ed2ea6391e7641fc0bf6481b84b93736613768a038f905ee78e4c14e737a51adf45a7d6805cd328136ce478be5322fe5eaf20c4dc7930603d860723b4cc321af9005d2e19f56311a89568212f904831f4a361"}}, &(0x7f0000000440)={0x0, 0x3, 0x5a, @string={0x5a, 0x3, "2f0043c5ef3a26af962e631893a9ca5ffa9bf08af28b5144a23f40367c89b1066e4459a7dd79b75a6348ef900bb0b4b7c411b69092621ce42128b5e75b03e56714716ff4bb2e0c66b527b264be8e3868c9d628678321b240"}}}, &(0x7f00000003c0)={0x34, &(0x7f0000000100)={0x20, 0x10, 0x10, "fbcf3fa79927d22441aa2a876ca5e4a6"}, &(0x7f0000000140)={0x0, 0xa, 0x1}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000300)={0xc0, 0xa1, 0x4, 0x9}, &(0x7f0000000000)={0x40, 0xa0, 0x4, 0xfffffff9}, &(0x7f0000000380)={0xc0, 0xa2, 0x2f, "5cbc90160cf75e97a752d83822b22b3a4735e51742f83d5dd6b86e89484f19cede67249f051baa60399be7fdb24708"}}) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x1, &(0x7f00000000c0)="cc") syz_usb_disconnect(r0) r2 = syz_usb_connect(0x1, 0x24, &(0x7f0000000cc0)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000180)=ANY=[@ANYBLOB='D __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 v4l2_fh_open+0x64/0xa0 drivers/media/v4l2-core/v4l2-fh.c:64 em28xx_v4l2_open+0x24e/0x7e0 drivers/media/usb/em28xx/em28xx-video.c:2153 v4l2_open+0x1d2/0x5e0 drivers/media/v4l2-core/v4l2-dev.c:433 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x6da/0x13a0 fs/open.c:965 vfs_open+0x82/0x3f0 fs/open.c:1097 do_open fs/namei.c:3975 [inline] path_openat+0x1de4/0x2cb0 fs/namei.c:4134 do_filp_open+0x20b/0x470 fs/namei.c:4161 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdcc7acc407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc841c6630 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fdcc79de880 RCX: 00007fdcc7acc407 RDX: 0000000000000000 RSI: 00007ffc841c6f24 RDI: ffffffffffffff9c RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007ffc841c6880 R14: 00007fdcc8262000 R15: 0000557dd30f44d8 Allocated by task 9: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:417 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] em28xx_v4l2_init+0x114/0x4080 drivers/media/usb/em28xx/em28xx-video.c:2532 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 9: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 __kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x43/0x70 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2539 [inline] slab_free mm/slub.c:6630 [inline] kfree+0x288/0x670 mm/slub.c:6837 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2118 [inline] kref_put include/linux/kref.h:65 [inline] em28xx_v4l2_init+0x22b5/0x4080 drivers/media/usb/em28xx/em28xx-video.c:2901 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88811ca48000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 1848 bytes inside of freed 8192-byte region [ffff88811ca48000, ffff88811ca4a000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ca48 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff888100042280 ffffea0004727800 dead000000000004 raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 head: 0200000000000040 ffff888100042280 ffffea0004727800 dead000000000004 head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 head: 0200000000000003 ffffea0004729201 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3029, tgid 3029 (syz-executor), ts 52004598729, free_ts 51906976935 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1850 prep_new_page mm/page_alloc.c:1858 [inline] get_page_from_freelist+0x1003/0x2dc0 mm/page_alloc.c:3884 __alloc_frozen_pages_noprof+0x259/0x21f0 mm/page_alloc.c:5183 alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:3055 [inline] allocate_slab mm/slub.c:3228 [inline] new_slab+0x24a/0x360 mm/slub.c:3282 ___slab_alloc+0xdb7/0x1a70 mm/slub.c:4651 __slab_alloc.constprop.0+0x63/0x110 mm/slub.c:4770 __slab_alloc_node mm/slub.c:4846 [inline] slab_alloc_node mm/slub.c:5268 [inline] __kmalloc_cache_noprof+0x3c8/0x750 mm/slub.c:5758 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] mr_table_alloc+0x5f/0x2e0 net/ipv4/ipmr_base.c:41 ipmr_new_table net/ipv4/ipmr.c:423 [inline] ipmr_rules_init net/ipv4/ipmr.c:342 [inline] ipmr_net_init net/ipv4/ipmr.c:3234 [inline] ipmr_net_init+0x2b1/0x370 net/ipv4/ipmr.c:3226 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137 setup_net+0x100/0x390 net/core/net_namespace.c:445 copy_net_ns+0x2f8/0x690 net/core/net_namespace.c:580 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3129 page last free pid 3017 tgid 3017 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1394 [inline] __free_frozen_pages+0x78f/0x1000 mm/page_alloc.c:2906 discard_slab mm/slub.c:3326 [inline] __put_partials+0x130/0x170 mm/slub.c:3872 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:352 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4970 [inline] slab_alloc_node mm/slub.c:5280 [inline] kmem_cache_alloc_noprof+0x260/0x6c0 mm/slub.c:5287 getname_flags.part.0+0x4c/0x550 fs/namei.c:146 getname_flags+0x93/0xf0 include/linux/audit.h:345 user_path_at+0x24/0x60 fs/namei.c:3214 ksys_umount fs/namespace.c:2061 [inline] __do_sys_umount fs/namespace.c:2069 [inline] __se_sys_umount fs/namespace.c:2067 [inline] __x64_sys_umount+0x10a/0x1a0 fs/namespace.c:2067 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88811ca48600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811ca48680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811ca48700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811ca48780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811ca48800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 Read of size 8 at addr ffff88811ca48738 by task v4l_id/6218 CPU: 0 UID: 0 PID: 6218 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 v4l2_fh_open+0x64/0xa0 drivers/media/v4l2-core/v4l2-fh.c:64 em28xx_v4l2_open+0x24e/0x7e0 drivers/media/usb/em28xx/em28xx-video.c:2153 v4l2_open+0x1d2/0x5e0 drivers/media/v4l2-core/v4l2-dev.c:433 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x6da/0x13a0 fs/open.c:965 vfs_open+0x82/0x3f0 fs/open.c:1097 do_open fs/namei.c:3975 [inline] path_openat+0x1de4/0x2cb0 fs/namei.c:4134 do_filp_open+0x20b/0x470 fs/namei.c:4161 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdcc7acc407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc841c6630 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fdcc79de880 RCX: 00007fdcc7acc407 RDX: 0000000000000000 RSI: 00007ffc841c6f24 RDI: ffffffffffffff9c RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007ffc841c6880 R14: 00007fdcc8262000 R15: 0000557dd30f44d8 Allocated by task 9: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:417 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] em28xx_v4l2_init+0x114/0x4080 drivers/media/usb/em28xx/em28xx-video.c:2532 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 9: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 __kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x43/0x70 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2539 [inline] slab_free mm/slub.c:6630 [inline] kfree+0x288/0x670 mm/slub.c:6837 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2118 [inline] kref_put include/linux/kref.h:65 [inline] em28xx_v4l2_init+0x22b5/0x4080 drivers/media/usb/em28xx/em28xx-video.c:2901 em28xx_init_extension+0x13a/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x56d/0x700 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88811ca48000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 1848 bytes inside of freed 8192-byte region [ffff88811ca48000, ffff88811ca4a000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ca48 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff888100042280 ffffea0004727800 dead000000000004 raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 head: 0200000000000040 ffff888100042280 ffffea0004727800 dead000000000004 head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 head: 0200000000000003 ffffea0004729201 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3029, tgid 3029 (syz-executor), ts 52004598729, free_ts 51906976935 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1850 prep_new_page mm/page_alloc.c:1858 [inline] get_page_from_freelist+0x1003/0x2dc0 mm/page_alloc.c:3884 __alloc_frozen_pages_noprof+0x259/0x21f0 mm/page_alloc.c:5183 alloc_pages_mpol+0xe4/0x410 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:3055 [inline] allocate_slab mm/slub.c:3228 [inline] new_slab+0x24a/0x360 mm/slub.c:3282 ___slab_alloc+0xdb7/0x1a70 mm/slub.c:4651 __slab_alloc.constprop.0+0x63/0x110 mm/slub.c:4770 __slab_alloc_node mm/slub.c:4846 [inline] slab_alloc_node mm/slub.c:5268 [inline] __kmalloc_cache_noprof+0x3c8/0x750 mm/slub.c:5758 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] mr_table_alloc+0x5f/0x2e0 net/ipv4/ipmr_base.c:41 ipmr_new_table net/ipv4/ipmr.c:423 [inline] ipmr_rules_init net/ipv4/ipmr.c:342 [inline] ipmr_net_init net/ipv4/ipmr.c:3234 [inline] ipmr_net_init+0x2b1/0x370 net/ipv4/ipmr.c:3226 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137 setup_net+0x100/0x390 net/core/net_namespace.c:445 copy_net_ns+0x2f8/0x690 net/core/net_namespace.c:580 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3129 page last free pid 3017 tgid 3017 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1394 [inline] __free_frozen_pages+0x78f/0x1000 mm/page_alloc.c:2906 discard_slab mm/slub.c:3326 [inline] __put_partials+0x130/0x170 mm/slub.c:3872 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x4e/0x70 mm/kasan/common.c:352 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4970 [inline] slab_alloc_node mm/slub.c:5280 [inline] kmem_cache_alloc_noprof+0x260/0x6c0 mm/slub.c:5287 getname_flags.part.0+0x4c/0x550 fs/namei.c:146 getname_flags+0x93/0xf0 include/linux/audit.h:345 user_path_at+0x24/0x60 fs/namei.c:3214 ksys_umount fs/namespace.c:2061 [inline] __do_sys_umount fs/namespace.c:2069 [inline] __se_sys_umount fs/namespace.c:2067 [inline] __x64_sys_umount+0x10a/0x1a0 fs/namespace.c:2067 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88811ca48600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811ca48680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811ca48700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811ca48780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811ca48800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================