Extracting prog: 2m26.605004406s
Minimizing prog: 15m8.855916006s
Simplifying prog options: 0s
Extracting C: 1m57.12013764s
Simplifying C: 11m18.816655956s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x65, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x53, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as={[@as_header={0x7, 0x24, 0x1, 0x9, 0x1, 0x3}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x3f, 0x3, 0x8, 0x7}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x3, 0x7, 0x2}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x40, 0x4, 0x6}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0xf9, 0x2, 0x3f, 0x2}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x1, 0x2, 0x7e}]}], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x65, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x53, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as={[@as_header={0x7, 0x24, 0x1, 0x9, 0x1, 0x3}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x3f, 0x3, 0x8, 0x7}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x3, 0x7, 0x2}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x40, 0x4, 0x6}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0xf9, 0x2, 0x3f, 0x2}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x1, 0x2, 0x7e}]}], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x65, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x53, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as={[@as_header={0x7, 0x24, 0x1, 0x9, 0x1, 0x3}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x3f, 0x3, 0x8, 0x7}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x3, 0x7, 0x2}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x40, 0x4, 0x6}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0xf9, 0x2, 0x3f, 0x2}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x1, 0x2, 0x7e}]}], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2f, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x2, 0x5}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, 0x0, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, 0x0, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
extracting C reproducer
testing compiled C program (duration=50.96411722s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
simplifying C reproducer
testing compiled C program (duration=50.96411722s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing compiled C program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing compiled C program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing compiled C program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing compiled C program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing compiled C program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing compiled C program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
testing program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
validation run: crashed=true
testing program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
validation run: crashed=true
testing program (duration=50.96411722s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x34, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xcf, 0xa, 0xd2, 0x40, 0x5ac, 0x24e, 0xd4d7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x22, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa, 0x0, 0x1, 0x3, 0xec, 0x2, 0x0, [@uac_as], [{{0x9, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "8136a5545b"}]}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)={0x40, 0x0, 0x7f, "92a7d8181753a052f534fd8813c4b82a85a6bd96988850b68b1d74e3b83876e7830e018abb0c34c16a8e38f4e51e018deaf7807a1ed6fb8db03b16ce232a7b2f62e5c91a57354ba8199a9c80964c0e46071b7932e010fcd73b26cf79b43709723698ddcaade084719f18e594f373ad2e5442ecb1caaa4ae30fdc5cc3d1c4c1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program crashed: WARNING in bcm5974_start_traffic/usb_submit_urb
validation run: crashed=true
reproducing took 35m46.252859088s
repro crashed as (corrupted=false):
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 3622 at drivers/usb/core/urb.c:505 usb_submit_urb+0xc74/0x1970 drivers/usb/core/urb.c:504
Modules linked in:
CPU: 0 PID: 3622 Comm: acpid Not tainted 6.1.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:usb_submit_urb+0xc74/0x1970 drivers/usb/core/urb.c:504
Code: 8b 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 0b 09 00 00 45 8b 06 48 c7 c7 80 32 2e 8b 48 89 ee 4c 89 e2 e8 7c f5 37 fb <0f> 0b 44 8b 64 24 34 44 0f b6 74 24 10 4c 89 f7 48 c7 c6 30 b0 67
RSP: 0018:ffffc90003297630 EFLAGS: 00010246
RAX: 2573530e5ba6af00 RBX: ffff8881447f4100 RCX: ffff88807d738000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffffff8b2e9d80 R08: dffffc0000000000 R09: ffffed10171e4f34
R10: ffffed10171e4f34 R11: 1ffff110171e4f33 R12: ffff888019e8b870
R13: dffffc0000000000 R14: ffffffff8b2e3068 R15: ffff888019ed80f8
FS:  00007fc72bbd1740(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e363fff CR3: 000000007fa15000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 bcm5974_start_traffic+0xd7/0x140 drivers/input/mouse/bcm5974.c:799
 bcm5974_open+0x8e/0x120 drivers/input/mouse/bcm5974.c:839
 input_open_device+0x16c/0x2e0 drivers/input/input.c:650
 mousedev_open_device+0xc3/0x150 drivers/input/mousedev.c:430
 mousedev_open+0x2e5/0x4a0 drivers/input/mousedev.c:556
 chrdev_open+0x597/0x670 fs/char_dev.c:414
 do_dentry_open+0x7e9/0x10d0 fs/open.c:882
 do_open fs/namei.c:3626 [inline]
 path_openat+0x25c6/0x2e70 fs/namei.c:3783
 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810
 do_sys_openat2+0x142/0x490 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc72bc5b407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcddab56e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fc72bbd1740 RCX: 00007fc72bc5b407
RDX: 0000000000080800 RSI: 00007ffcddab58f0 RDI: ffffffffffffff9c
RBP: 00007ffcddab58f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000020
R13: 00007ffcddab59f0 R14: 0000562d94fff7fe R15: 00007ffcddab59f0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 3622 at drivers/usb/core/urb.c:505 usb_submit_urb+0xc74/0x1970 drivers/usb/core/urb.c:504
Modules linked in:
CPU: 0 PID: 3622 Comm: acpid Not tainted 6.1.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:usb_submit_urb+0xc74/0x1970 drivers/usb/core/urb.c:504
Code: 8b 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 0b 09 00 00 45 8b 06 48 c7 c7 80 32 2e 8b 48 89 ee 4c 89 e2 e8 7c f5 37 fb <0f> 0b 44 8b 64 24 34 44 0f b6 74 24 10 4c 89 f7 48 c7 c6 30 b0 67
RSP: 0018:ffffc90003297630 EFLAGS: 00010246
RAX: 2573530e5ba6af00 RBX: ffff8881447f4100 RCX: ffff88807d738000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffffff8b2e9d80 R08: dffffc0000000000 R09: ffffed10171e4f34
R10: ffffed10171e4f34 R11: 1ffff110171e4f33 R12: ffff888019e8b870
R13: dffffc0000000000 R14: ffffffff8b2e3068 R15: ffff888019ed80f8
FS:  00007fc72bbd1740(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e363fff CR3: 000000007fa15000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 bcm5974_start_traffic+0xd7/0x140 drivers/input/mouse/bcm5974.c:799
 bcm5974_open+0x8e/0x120 drivers/input/mouse/bcm5974.c:839
 input_open_device+0x16c/0x2e0 drivers/input/input.c:650
 mousedev_open_device+0xc3/0x150 drivers/input/mousedev.c:430
 mousedev_open+0x2e5/0x4a0 drivers/input/mousedev.c:556
 chrdev_open+0x597/0x670 fs/char_dev.c:414
 do_dentry_open+0x7e9/0x10d0 fs/open.c:882
 do_open fs/namei.c:3626 [inline]
 path_openat+0x25c6/0x2e70 fs/namei.c:3783
 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810
 do_sys_openat2+0x142/0x490 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1345
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc72bc5b407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcddab56e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fc72bbd1740 RCX: 00007fc72bc5b407
RDX: 0000000000080800 RSI: 00007ffcddab58f0 RDI: ffffffffffffff9c
RBP: 00007ffcddab58f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000020
R13: 00007ffcddab59f0 R14: 0000562d94fff7fe R15: 00007ffcddab59f0
 </TASK>