Extracting prog: 19m25.763972324s
Minimizing prog: 4h50m0.018056185s
Simplifying prog options: 0s
Extracting C: 8m20.807015971s
Simplifying C: 36m49.240622341s


30 programs, 3 VMs, timeouts [6m0s]
extracting reproducer from 30 programs
single: executing 5 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): open_tree-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-sched_setaffinity-syz_open_dev$video4linux-ioctl$VIDIOC_TRY_DECODER_CMD-openat$hwrng-preadv-ioctl$SNDCTL_DSP_SETFMT-io_uring_setup-fcntl$lock-socket$nl_xfrm-syz_io_uring_setup-io_uring_register$IORING_REGISTER_PBUF_RING-socket$nl_netfilter-bpf$PROG_LOAD-syz_io_uring_submit-getrandom-getrandom-madvise-memfd_create-mq_open-ppoll-shmget$private-shmat-shmat-getrandom-mq_timedsend-shmctl$IPC_INFO
detailed listing:
executing program 0:
open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89001)
prlimit64(0x0, 0xe, &(0x7f0000000140), 0x0)
sched_setscheduler(0x0, 0x0, &(0x7f0000000240))
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001)
r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x71, 0x0)
ioctl$VIDIOC_TRY_DECODER_CMD(r0, 0xc0585605, &(0x7f00000005c0)={0x1, 0x1, @raw_data=[0x0, 0x0, 0x1012]})
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0)
ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000000))
io_uring_setup(0x0, &(0x7f0000000180))
fcntl$lock(0xffffffffffffffff, 0x0, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
r2 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x200, 0x0, 0x21f}, &(0x7f0000000100)=<r3=>0x0, &(0x7f00000002c0)=<r4=>0x0)
io_uring_register$IORING_REGISTER_PBUF_RING(r2, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xe, &(0x7f0000000a40)=ANY=[@ANYBLOB="b70200000d000000bfa300000000000005000000000000007a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000050404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf27fb6d2c643db7e2d5fb4b0936cdf827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923dd29c034055b67d5b310efcfa89147a7fb0a93d035f2f206d2ef831ab7ea0c34f17e3ad6eecbb622003b538dfd8e012e79578e51bc53099e90f4580d7be3e8c254a5cba117cbdb9cd38bdb2cc8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e6a9f65f1328d6704902cbe7bc04b82d2789cb132b8667c214733a18c8b6619f28d996d60a17e3c184b751c51160100000000000080148b9a31ee8dc8b544f3c4a532e60a0ac346dfebd31a08060000000200000000000000334d83239dd20100008000000000d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08a406f99f7b1e1ad828267d4eadd3964663e085354133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0183babc190ae2ebf8aad34732181feb28cb0bae7c34dc5e7c805210600000000000000c3dec04b25df45d4f71ab158c36657b7218baa07a99bd50499ccc421ace5e845885efb5b9964e4beba3da8223fe5308e4e65ee93e107000000f8ddebf70132a4d01776839b8eccf707882042e716df9b57b290c661d4e85031086197bcc5cb0e221a0c34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb0015982730711c599e1c72ffa11ed8be1a6830d7507005154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d1cdac944779dc08a705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe3304000000323e9c707fe81436b024c2574980397bc49d70c060d57bc88fbe3bbaa058b040362ab926150763fb099408885afc2bf9a46a076b7babfcddeff8c35030669ea69f5e4be1b8e0d6697e97186f9ae97d5670dba6623279f73db9dec75070cd9ab0fda6b069ef6d2857ca3e4e6068f1bf710d133d541da86e046e513b3177e4a6cc999dc21c3ef408e6b178e7c9f274d7fafc8d757d33dfa35aa2b2ff7f9a7d365e63845f3e1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cadecc13219ba7518aa4f7db34ead13484742067ab743c1d82a5687f2ed690000010000000000000000000000000000000000000099d4fa0000000000003f0ecdc7c82e72919c91d2039afe17e95edef8ba72205beff7771bcb293747b88486cacee403000000a2919a4b09e168e4e4d5ff2ed893f2e314679fa69fc7e0cf761f91b18725704a01c56009a9f748e5aaf30a10bd8c409b1870c1f75e26b45264e3d3f8e0048e55ae289c2f884d0766cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c1540bf3d162dc1c27fa30f0dc60b9f257db5d1c7ed2efce676a93110904d5e055af44664b53c764d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354da8de21eada75d3a3afb2c76ff0700007976694b6a0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d201721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e671282a2d3066ac968c7d7d7db195f255b1b4a85eb9ee0a3b68c9e209756623adf685dd715d68ed1274b4d5502f512493af8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb20407ff7098b7174bef66fa03a99b5c0c20b378065fac4ef9ac2d0d804b9400000060e5d3f1749f6aecf69ba83a71caa9bdddc679f1b826f74b6563a4be1fd82b73c8c2bc"], 0x0}, 0x90)
syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r5, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x23}})
getrandom(&(0x7f0000002a40)=""/245, 0xf5, 0x0)
getrandom(&(0x7f0000002940)=""/250, 0xfa, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
memfd_create(&(0x7f0000001140)='!^*}.\x00', 0x1)
r6 = mq_open(&(0x7f000084dff0)='rmdF\x17\x16\xbc\xec', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x81})
ppoll(&(0x7f0000000100)=[{r6}], 0x1, 0x0, 0x0, 0x0)
r7 = shmget$private(0x0, 0x3000, 0x54001800, &(0x7f000010d000/0x3000)=nil)
shmat(r7, &(0x7f0000000000/0x4000)=nil, 0x6000)
shmat(r7, &(0x7f00005d1000/0x3000)=nil, 0x4000)
getrandom(&(0x7f0000001680)=""/73, 0x49, 0x1)
mq_timedsend(r6, 0x0, 0x0, 0x0, &(0x7f00000000c0))
shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000001380)=""/76)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-fcntl$lock-fcntl$lock-fcntl$lock-openat$adsp1-epoll_ctl$EPOLL_CTL_ADD-syz_usb_connect$cdc_ncm
detailed listing:
executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
fcntl$lock(r0, 0x26, &(0x7f0000000000)={0x1})
fcntl$lock(r0, 0x25, &(0x7f00000000c0))
fcntl$lock(r0, 0x26, &(0x7f0000000000)={0x2, 0x0, 0x2})
r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x402000, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040)={0x4000000a})
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581"], 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-close_range-signalfd4
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r8 = io_uring_setup(0x3367, &(0x7f00000000c0))
r9 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r9)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r9, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
close_range(r8, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, &(0x7f0000000180), 0x8, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb-close_range
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r8 = io_uring_setup(0x3367, &(0x7f00000000c0))
r9 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r9)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r9, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
close_range(r8, 0xffffffffffffffff, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
io_uring_setup(0x3367, &(0x7f00000000c0))
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
io_uring_setup(0x3367, &(0x7f00000000c0))
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
io_uring_setup(0x3367, &(0x7f00000000c0))
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_disconnect-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
io_uring_setup(0x3367, &(0x7f00000000c0))
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-io_uring_setup-syz_open_dev$evdev-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
io_uring_setup(0x3367, &(0x7f00000000c0))
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-io_uring_setup-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
io_uring_setup(0x3367, &(0x7f00000000c0))
syz_usb_disconnect(0xffffffffffffffff)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(0xffffffffffffffff, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$KVM_CREATE_VCPU-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TIOCSETD-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet6_int-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-sendmsg$nl_route-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
r7 = dup2(r5, r5)
sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[], 0x14}}, 0x0)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r8 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r8)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r8, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
dup2(r5, r5)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r7 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r7)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r7, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-io_submit-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380)=<r6=>0x0)
io_submit(r6, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r5, &(0x7f00000000c0)="d6", 0x1}])
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r7 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r7)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r7, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-io_setup-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
io_setup(0x5, &(0x7f0000000380))
dup2(r5, r5)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r6)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r6, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
r5 = accept4$alg(r4, 0x0, 0x0, 0x0)
dup2(r5, r5)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r6)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r6, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r5 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r5)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r5, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-bind$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r5 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r5)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r5, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r4 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r4)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r4, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$inet6_sctp-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r4 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r4)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r4, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-openat$ptmx-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r2, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000180)={r1, 0x0, 0x0}, 0x20)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r2, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r2)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r2, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0xfffffffffffffea5, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x90)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x2fd, 0x0, 0x10, 0x0, 0x0})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x0, 0x1014}, 0x48)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x84)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(0x0, 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='mm_page_alloc\x00'}, 0x10)
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_dev$usbfs(0x0, 0x200, 0x2)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$alg(0x26, 0x5, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000280)=0x1, 0x4)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x0)
r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r3)
syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB, @ANYBLOB="73c8"], 0x0)
ioctl$EVIOCRMFF(r3, 0x4004550f, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program crashed: INFO: rcu detected stall in corrupted
simplifying C reproducer
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program crashed: INFO: task hung in kernfs_dop_revalidate
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program crashed: WARNING in wdm_rxwork/usb_submit_urb
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program did not crash
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program did not crash
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-bind$inet6-syz_open_dev$usbfs-ioctl$USBDEVFS_CONTROL-bpf$MAP_CREATE-openat$ptmx-socket$inet6_sctp-socket$alg-dup2-setsockopt$inet6_int-setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-ioctl$TCFLSH-syz_open_dev$evdev-syz_usb_disconnect-syz_usb_connect$cdc_ncm-ioctl$EVIOCRMFF-syz_open_dev$char_usb
program crashed: WARNING in wdm_rxwork/usb_submit_urb
reproducing took 5h54m35.829696762s
repro crashed as (corrupted=false):
------------[ cut here ]------------
URB ffff888017ecff00 submitted while active
WARNING: CPU: 0 PID: 929 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1039/0x18c0 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 PID: 929 Comm: kworker/0:2 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events wdm_rxwork
RIP: 0010:usb_submit_urb+0x1039/0x18c0 drivers/usb/core/urb.c:379
Code: 00 eb 66 e8 79 61 79 fa e9 79 f0 ff ff e8 6f 61 79 fa c6 05 6c 09 7b 08 01 90 48 c7 c7 a0 a5 6d 8c 4c 89 ee e8 e8 8f 3b fa 90 <0f> 0b 90 90 e9 40 f0 ff ff e8 49 61 79 fa eb 12 e8 42 61 79 fa 41
RSP: 0000:ffffc90003e1fae8 EFLAGS: 00010246
RAX: d0b8f066bebd3200 RBX: 0000000000000cc0 RCX: ffff888020e10000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff888017ecff08 R08: ffffffff81585822 R09: fffffbfff1c39994
R10: dffffc0000000000 R11: fffffbfff1c39994 R12: 1ffff110047c6512
R13: ffff888017ecff00 R14: dffffc0000000000 R15: ffff888023e32828
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5c383addd3 CR3: 0000000021990000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 wdm_rxwork+0x116/0x1f0 drivers/usb/class/cdc-wdm.c:989
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
URB ffff888017ecff00 submitted while active
WARNING: CPU: 0 PID: 929 at drivers/usb/core/urb.c:379 usb_submit_urb+0x1039/0x18c0 drivers/usb/core/urb.c:379
Modules linked in:
CPU: 0 PID: 929 Comm: kworker/0:2 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events wdm_rxwork
RIP: 0010:usb_submit_urb+0x1039/0x18c0 drivers/usb/core/urb.c:379
Code: 00 eb 66 e8 79 61 79 fa e9 79 f0 ff ff e8 6f 61 79 fa c6 05 6c 09 7b 08 01 90 48 c7 c7 a0 a5 6d 8c 4c 89 ee e8 e8 8f 3b fa 90 <0f> 0b 90 90 e9 40 f0 ff ff e8 49 61 79 fa eb 12 e8 42 61 79 fa 41
RSP: 0000:ffffc90003e1fae8 EFLAGS: 00010246
RAX: d0b8f066bebd3200 RBX: 0000000000000cc0 RCX: ffff888020e10000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff888017ecff08 R08: ffffffff81585822 R09: fffffbfff1c39994
R10: dffffc0000000000 R11: fffffbfff1c39994 R12: 1ffff110047c6512
R13: ffff888017ecff00 R14: dffffc0000000000 R15: ffff888023e32828
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5c383addd3 CR3: 0000000021990000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 wdm_rxwork+0x116/0x1f0 drivers/usb/class/cdc-wdm.c:989
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>