Extracting prog: 1m27.899802429s
Minimizing prog: 5m54.76419661s
Simplifying prog options: 0s
Extracting C: 32.848666912s
Simplifying C: 4m25.899005811s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002b3b8d440ba11011057ec0102030109021b000101feaf1309044e03014d6be7ca090501020800070702"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x24f})
syz_usb_ep_read(r0, 0x1, 0xe6, &(0x7f0000000040)=""/230) (async)
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=38.667943534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002b3b8d440ba11011057ec0102030109021b000101feaf1309044e03014d6be7ca090501020800070702"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x24f})
program did not crash
testing program (duration=38.667943534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_ep_read
detailed listing:
executing program 0:
syz_usb_ep_read(0xffffffffffffffff, 0x1, 0xe6, &(0x7f0000000040)=""/230) (async)
program did not crash
testing program (duration=38.667943534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002b3b8d440ba11011057ec0102030109021b000101feaf1309044e03014d6be7ca090501020800070702"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x24f})
syz_usb_ep_read(r0, 0x1, 0xe6, &(0x7f0000000040)=""/230)
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
testing program (duration=38.667943534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0})
syz_usb_ep_read(r0, 0x1, 0xe6, &(0x7f0000000040)=""/230)
program did not crash
testing program (duration=38.667943534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0})
syz_usb_ep_read(r0, 0x1, 0xe6, &(0x7f0000000040)=""/230)
program did not crash
testing program (duration=38.667943534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002b3b8d440ba11011057ec0102030109021b000101feaf1309044e03014d6be7ca090501020800070702"], 0x0)
syz_usb_ep_read(r0, 0x1, 0xe6, &(0x7f0000000040)=""/230)
program did not crash
testing program (duration=38.667943534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002b3b8d440ba11011057ec0102030109021b000101feaf1309044e03014d6be7ca090501020800070702"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x24f})
syz_usb_ep_read(r0, 0x1, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=38.667943534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
simplifying C reproducer
testing compiled C program (duration=38.667943534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
testing compiled C program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
testing compiled C program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
testing compiled C program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
testing compiled C program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
testing compiled C program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
testing compiled C program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
testing program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002b3b8d440ba11011057ec0102030109021b000101feaf1309044e03014d6be7ca090501020800070702"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x24f})
syz_usb_ep_read(r0, 0x1, 0xe6, &(0x7f0000000040)=""/230)
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
validation run: crashed=true
testing program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002b3b8d440ba11011057ec0102030109021b000101feaf1309044e03014d6be7ca090501020800070702"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x24f})
syz_usb_ep_read(r0, 0x1, 0xe6, &(0x7f0000000040)=""/230)
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
validation run: crashed=true
testing program (duration=38.667943534s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002b3b8d440ba11011057ec0102030109021b000101feaf1309044e03014d6be7ca090501020800070702"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x24f})
syz_usb_ep_read(r0, 0x1, 0xe6, &(0x7f0000000040)=""/230)
program crashed: WARNING in pvr2_send_request_ex/usb_submit_urb
validation run: crashed=true
reproducing took 14m23.297230887s
repro crashed as (corrupted=false):
pvrusb2: Invalid read control endpoint
------------[ cut here ]------------
URB ffff88802a8fb900 submitted while active
WARNING: drivers/usb/core/urb.c:380 at usb_submit_urb+0x15a0/0x1970 drivers/usb/core/urb.c:380, CPU#3: pvrusb2-context/2490
Modules linked in:
CPU: 3 UID: 0 PID: 2490 Comm: pvrusb2-context Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x15a3/0x1970 drivers/usb/core/urb.c:380
Code: 4b 03 00 00 48 8b 04 24 48 8b 90 b0 00 00 00 eb 91 bb ed ff ff ff e9 07 f3 ff ff e8 f7 b2 a8 fa 48 8d 3d 90 41 7e 09 48 89 de <67> 48 0f b9 3a bb f0 ff ff ff e9 e9 f2 ff ff e8 d9 b2 a8 fa 0f 1f
RSP: 0018:ffffc9000e1ded10 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802a8fb900 RCX: ffffffff880203bf
RDX: ffff88802e354980 RSI: ffff88802a8fb900 RDI: ffffffff90947750
RBP: 0000000000000005 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88802e3554b0 R12: 0000000000000000
R13: 00000000c0008200 R14: ffff8880315fb000 R15: ffff88802d831628
FS: 0000000000000000(0000) GS:ffff8880d6bf5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efd28cdc3a0 CR3: 000000003a0df000 CR4: 0000000000352ef0
Call Trace:
pvr2_send_request_ex+0x7eb/0x1ef0 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3676
pvr2_send_request+0x3a/0x50 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3819
pvr2_i2c_read+0x203/0x6d0 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:130
pvr2_i2c_basic_op+0xcf/0xf0 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:172
pvr2_i2c_xfer+0x380/0xfd0 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:445
__i2c_transfer+0x6b6/0x2100 drivers/i2c/i2c-core-base.c:2261
i2c_smbus_xfer_emulated+0x230/0x1210 drivers/i2c/i2c-core-smbus.c:470
__i2c_smbus_xfer drivers/i2c/i2c-core-smbus.c:608 [inline]
__i2c_smbus_xfer+0x836/0xf60 drivers/i2c/i2c-core-smbus.c:554
i2c_smbus_xfer drivers/i2c/i2c-core-smbus.c:546 [inline]
i2c_smbus_xfer+0x200/0x3c0 drivers/i2c/i2c-core-smbus.c:536
i2c_smbus_read_byte_data+0x135/0x1e0 drivers/i2c/i2c-core-smbus.c:143
saa711x_detect_chip drivers/media/i2c/saa7115.c:1710 [inline]
saa711x_probe+0x234/0x20b0 drivers/media/i2c/saa7115.c:1816
i2c_device_probe+0x66e/0xd90 drivers/i2c/i2c-core-base.c:592
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xb20 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x470 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x350 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4e0 drivers/base/dd.c:1031
device_initial_probe+0xaa/0xc0 drivers/base/dd.c:1086
bus_probe_device+0x64/0x150 drivers/base/bus.c:574
device_add+0x116e/0x1980 drivers/base/core.c:3689
i2c_new_client_device+0x660/0xed0 drivers/i2c/i2c-core-base.c:1019
v4l2_i2c_new_subdev_board+0xb6/0x300 drivers/media/v4l2-core/v4l2-i2c.c:81
v4l2_i2c_new_subdev+0x14f/0x1c0 drivers/media/v4l2-core/v4l2-i2c.c:136
pvr2_hdw_load_subdev drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2022 [inline]
pvr2_hdw_load_modules drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2074 [inline]
pvr2_hdw_setup_low drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2155 [inline]
pvr2_hdw_setup drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2261 [inline]
pvr2_hdw_initialize+0x28d0/0x4510 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2338
pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:111 [inline]
pvr2_context_thread_func+0x253/0x9b0 drivers/media/usb/pvrusb2/pvrusb2-context.c:158
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
----------------
Code disassembly (best guess):
0: 4b 03 00 rex.WXB add (%r8),%rax
3: 00 48 8b add %cl,-0x75(%rax)
6: 04 24 add $0x24,%al
8: 48 8b 90 b0 00 00 00 mov 0xb0(%rax),%rdx
f: eb 91 jmp 0xffffffa2
11: bb ed ff ff ff mov $0xffffffed,%ebx
16: e9 07 f3 ff ff jmp 0xfffff322
1b: e8 f7 b2 a8 fa call 0xfaa8b317
20: 48 8d 3d 90 41 7e 09 lea 0x97e4190(%rip),%rdi # 0x97e41b7
27: 48 89 de mov %rbx,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: bb f0 ff ff ff mov $0xfffffff0,%ebx
34: e9 e9 f2 ff ff jmp 0xfffff322
39: e8 d9 b2 a8 fa call 0xfaa8b317
3e: 0f .byte 0xf
3f: 1f (bad)
final repro crashed as (corrupted=false):
pvrusb2: Invalid read control endpoint
------------[ cut here ]------------
URB ffff88802a8fb900 submitted while active
WARNING: drivers/usb/core/urb.c:380 at usb_submit_urb+0x15a0/0x1970 drivers/usb/core/urb.c:380, CPU#3: pvrusb2-context/2490
Modules linked in:
CPU: 3 UID: 0 PID: 2490 Comm: pvrusb2-context Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:usb_submit_urb+0x15a3/0x1970 drivers/usb/core/urb.c:380
Code: 4b 03 00 00 48 8b 04 24 48 8b 90 b0 00 00 00 eb 91 bb ed ff ff ff e9 07 f3 ff ff e8 f7 b2 a8 fa 48 8d 3d 90 41 7e 09 48 89 de <67> 48 0f b9 3a bb f0 ff ff ff e9 e9 f2 ff ff e8 d9 b2 a8 fa 0f 1f
RSP: 0018:ffffc9000e1ded10 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802a8fb900 RCX: ffffffff880203bf
RDX: ffff88802e354980 RSI: ffff88802a8fb900 RDI: ffffffff90947750
RBP: 0000000000000005 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88802e3554b0 R12: 0000000000000000
R13: 00000000c0008200 R14: ffff8880315fb000 R15: ffff88802d831628
FS: 0000000000000000(0000) GS:ffff8880d6bf5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efd28cdc3a0 CR3: 000000003a0df000 CR4: 0000000000352ef0
Call Trace:
pvr2_send_request_ex+0x7eb/0x1ef0 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3676
pvr2_send_request+0x3a/0x50 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3819
pvr2_i2c_read+0x203/0x6d0 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:130
pvr2_i2c_basic_op+0xcf/0xf0 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:172
pvr2_i2c_xfer+0x380/0xfd0 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:445
__i2c_transfer+0x6b6/0x2100 drivers/i2c/i2c-core-base.c:2261
i2c_smbus_xfer_emulated+0x230/0x1210 drivers/i2c/i2c-core-smbus.c:470
__i2c_smbus_xfer drivers/i2c/i2c-core-smbus.c:608 [inline]
__i2c_smbus_xfer+0x836/0xf60 drivers/i2c/i2c-core-smbus.c:554
i2c_smbus_xfer drivers/i2c/i2c-core-smbus.c:546 [inline]
i2c_smbus_xfer+0x200/0x3c0 drivers/i2c/i2c-core-smbus.c:536
i2c_smbus_read_byte_data+0x135/0x1e0 drivers/i2c/i2c-core-smbus.c:143
saa711x_detect_chip drivers/media/i2c/saa7115.c:1710 [inline]
saa711x_probe+0x234/0x20b0 drivers/media/i2c/saa7115.c:1816
i2c_device_probe+0x66e/0xd90 drivers/i2c/i2c-core-base.c:592
call_driver_probe drivers/base/dd.c:581 [inline]
really_probe+0x241/0xb20 drivers/base/dd.c:659
__driver_probe_device+0x1de/0x470 drivers/base/dd.c:801
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:831
__device_attach_driver+0x1df/0x350 drivers/base/dd.c:959
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4e0 drivers/base/dd.c:1031
device_initial_probe+0xaa/0xc0 drivers/base/dd.c:1086
bus_probe_device+0x64/0x150 drivers/base/bus.c:574
device_add+0x116e/0x1980 drivers/base/core.c:3689
i2c_new_client_device+0x660/0xed0 drivers/i2c/i2c-core-base.c:1019
v4l2_i2c_new_subdev_board+0xb6/0x300 drivers/media/v4l2-core/v4l2-i2c.c:81
v4l2_i2c_new_subdev+0x14f/0x1c0 drivers/media/v4l2-core/v4l2-i2c.c:136
pvr2_hdw_load_subdev drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2022 [inline]
pvr2_hdw_load_modules drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2074 [inline]
pvr2_hdw_setup_low drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2155 [inline]
pvr2_hdw_setup drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2261 [inline]
pvr2_hdw_initialize+0x28d0/0x4510 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2338
pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:111 [inline]
pvr2_context_thread_func+0x253/0x9b0 drivers/media/usb/pvrusb2/pvrusb2-context.c:158
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
----------------
Code disassembly (best guess):
0: 4b 03 00 rex.WXB add (%r8),%rax
3: 00 48 8b add %cl,-0x75(%rax)
6: 04 24 add $0x24,%al
8: 48 8b 90 b0 00 00 00 mov 0xb0(%rax),%rdx
f: eb 91 jmp 0xffffffa2
11: bb ed ff ff ff mov $0xffffffed,%ebx
16: e9 07 f3 ff ff jmp 0xfffff322
1b: e8 f7 b2 a8 fa call 0xfaa8b317
20: 48 8d 3d 90 41 7e 09 lea 0x97e4190(%rip),%rdi # 0x97e41b7
27: 48 89 de mov %rbx,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: bb f0 ff ff ff mov $0xfffffff0,%ebx
34: e9 e9 f2 ff ff jmp 0xfffff322
39: e8 d9 b2 a8 fa call 0xfaa8b317
3e: 0f .byte 0xf
3f: 1f (bad)